AttackSurfaceManagement

Details

ID	`AttackSurfaceManagement`
Provider	Google
Category	Vulnerability Management
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Integrate with Mandiant Advantage Attack Surface Management to import “issues” as Incidents.
This integration was integrated and tested with version 1 of AttackSurfaceManagement

Configure Mandiant Attack Surface Management in Cortex

Parameter	Description	Required
Your server URL	The ASM API URL. Leave as `https://asm-api.advantage.mandiant.com/` if you’re unsure	True
Access Key	The Access and Secret Keys used for authentication	True
Secret Key		True
Project ID	The ASM Project ID to retrieve issues from	False
Collection IDs	A list of Collection IDs, separated by commas (`,`)	False
Initial Lookback Days	The number of days to look back when first retrieving issues.	True
Maximum Issues To Fetch	The maximum number of issues to pull during a single fetch-incidents command.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Mirror incoming incidents		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

attacksurfacemanagement-get-projects

Retrieve a list of all accessible ASM projects.

Base Command

attacksurfacemanagement-get-projects

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
MandiantAdvantageASM.Projects.Name	String	The name of the project
MandiantAdvantageASM.Projects.ID	Number	The ID of the project
MandiantAdvantageASM.Projects.Owner	unknown	The E-Mail of the project owner

Command example


#### Context Example

```json
{
  "MandiantAdvantageASM": {
    "Projects": [
      {
        "ID": 6797,
        "Name": "ASMQA_AttackSurfaceAPP",
        "Owner": "name@attacksurface.app"
      }
    ]
  }
}

Human Readable Output

Results

ID Name Owner

6797 ASMQA_AttackSurfaceAPP name@attacksurface.app

ID	Name	Owner
6797	ASMQA_AttackSurfaceAPP	name@attacksurface.app

attacksurfacemanagement-get-collections

Retrieve a list of collections for a specified project

Base Command

attacksurfacemanagement-get-collections

Input

Argument Name	Description	Required
project_id	The ID of the project to query collections for.	Optional

Context Output

Path	Type	Description
MandiantAdvantageASM.Collections.Name	String	The name of the collection
MandiantAdvantageASM.Collections.ID	String	The ID of the collection
MandiantAdvantageASM.Collections.Owner	unknown	The owner of the collection

Command example


#### Context Example

```json
{
    "MandiantAdvantageASM": {
        "Collections": [
            {
                "ID": "attacksurface_mw3tdwq",
                "Name": "Attacksurface_APP_QA",
                "Owner": "ASMQA_AttackSurfaceAPP"
            }
        ]
    }
}

Human Readable Output

Results

ID Name Owner

attacksurface_mw3tdwq Attacksurface_APP_QA ASMQA_AttackSurfaceAPP

ID	Name	Owner
attacksurface_mw3tdwq	Attacksurface_APP_QA	ASMQA_AttackSurfaceAPP

fetch-incidents

Fetch Incidents

Base Command

fetch-incidents

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

get-remote-data

Update a specific incident

Base Command

get-remote-data

Input

Argument Name	Description	Required
id	The ASM Incident ID.	Required
lastUpdate	Retrieve entries that were created after lastUpdate. Default is 0.	Optional

Context Output

There is no context output for this command.

update-remote-system

Update issue in Mandiant Advantage ASM

Base Command

update-remote-system

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Mandiant Attack Surface Management corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Mandiant Attack Surface Management.

Configuration parameters

url — Your server URL (required)
credentials — Access Key (required)
project_id — Project ID
collection_ids — Collection IDs
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — Maximum Issues To Fetch (required)
minimum_severity — Minimum Severity (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incoming_mirror — Mirror incoming incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (5)

attacksurfacemanagement-get-collections
Retrieve a list of collections for a specified project
attacksurfacemanagement-get-projects
Retrieve a list of all accessible ASM projects.
fetch-incidents
Fetch Incidents
get-remote-data
Update a specific incident.
update-remote-system
Update issue in Mandiant Advantage ASM

Source

AttackSurfaceManagement.py AttackSurfaceManagement_test.py AttackSurfaceManagement.yml AttackSurfaceManagement_description.md command_examples.txt

Download History Raw

category: Vulnerability Management
sectionorder:
- Connect
- Collect
provider: Google
commonfields:
  id: AttackSurfaceManagement
  version: -1
configuration:
- name: url
  defaultvalue: https://asm-api.advantage.mandiant.com/
  display: Your server URL
  required: true
  type: 0
  additionalinfo: The ASM API URL.  Leave as `https://asm-api.advantage.mandiant.com/` if you're unsure
  section: Connect
- name: credentials
  displaypassword: Secret Key
  display: Access Key
  additionalinfo: The Access and Secret Keys used for authentication
  required: true
  type: 9
  section: Connect
- name: project_id
  display: Project ID
  type: 0
  additionalinfo: The ASM Project ID to retrieve issues from
  required: false
  section: Connect
- name: collection_ids
  display: Collection IDs
  type: 0
  additionalinfo: A list of Collection IDs, separated by commas (`,`)
  required: false
  section: Collect
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  additionalinfo: The number of days to look back when first retrieving issues.
  required: false
  section: Collect
- name: max_fetch
  defaultvalue: 30
  display: Maximum Issues To Fetch
  required: true
  type: 0
  additionalinfo: The maximum number of issues to pull during a single fetch-incidents command.
  section: Collect
- name: minimum_severity
  defaultvalue: 1
  display: Minimum Severity
  required: true
  type: 0
  additionalinfo: The minimum severity of issues to import.  Between 1 and 5.
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Mirror incoming incidents
  name: incoming_mirror
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
description: 'Integrate with Mandiant Advantage Attack Surface Management to import "issues" as Incidents.'
display: 'Mandiant Attack Surface Management'
name: AttackSurfaceManagement
script:
  commands:
  - name: attacksurfacemanagement-get-projects
    description: Retrieve a list of all accessible ASM projects.
    outputs:
    - contextPath: MandiantAdvantageASM.Projects.Name
      description: The name of the project.
      type: String
    - contextPath: MandiantAdvantageASM.Projects.ID
      description: The ID of the project.
      type: Number
    - contextPath: MandiantAdvantageASM.Projects.Owner
      description: The E-Mail of the project owner.
  - name: attacksurfacemanagement-get-collections
    description: Retrieve a list of collections for a specified project
    arguments:
    - name: project_id
      description: 'The ID of the project to query collections for.'
    outputs:
    - contextPath: MandiantAdvantageASM.Collections.Name
      description: The name of the collection.
      type: String
    - contextPath: MandiantAdvantageASM.Collections.ID
      description: The ID of the collection.
      type: String
    - contextPath: MandiantAdvantageASM.Collections.Owner
      description: The owner of the collection.
  - name: fetch-incidents
    description: Fetch Incidents
  - name: get-remote-data
    description: Update a specific incident.
    arguments:
    - description: The ASM Incident ID.
      name: id
      required: true
    - description: Retrieve entries that were created after lastUpdate.
      name: lastUpdate
      defaultValue: '0'
  - name: update-remote-system
    description: Update issue in Mandiant Advantage ASM
    arguments: []
  isfetch: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: "6.8.0"
tests:
- No tests (auto formatted)