Attivo Botsink

Network-based Threat Deception for Post-Compromise Threat Detection.

Deception & Breach Simulation · Attivo Botsink

Details

ID	`Attivo Botsink`
Provider	SentinelOne
Category	Deception & Breach Simulation
From Version	5.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Use the Attivo BOTsink integration to pull Attivo events into Cortex XSOAR to initiate investigations, manage deception environments, and to deploy decoy systems.

This integration was tested with version Attivo BOTsink v4.1.1 and v4.1.3.

Use Cases

Determine if an artifact is part of the deception environment
Dynamically deploy decoy systems
Search for events related to a specific attacker

Configure Attivo Botsink on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Attivo Botsink.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Botsink name or address
- BOTsink API credentials
- SSL Verification toggle
- Minimum severity when fetching events (Very High, High, Medium)
- Fetch incidents toggle
Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

The Attivo BOTsink plugin for Cortex XSOAR can optionally pull Attivo events into Cortex XSOAR to initiate investigations. The fetch_severity parameter specifies the lowest severity of event to pull (Very High, High, or Medium).

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Verify if a user is part of a deception environment: attivo-check-user
Verify if a host is part of the deception environment: attivo-check-host
Run a playbook configured on Attivo BOTsink: attivo-run-playbook
Deploy a decoy system on a subnet: attivo-deploy-decoy
Get events for an attacker IP address: attivo-get-events
Get information for playbooks: attivo-list-playbooks
Get information for network decoys: attivo-list-hosts
Get a list of all deceptive users: attivo-list-users

1. Verify if a user is part of a deception environment

Checks whether a user is part of the deceptive environment.

Base Command

attivo-check-user

Input

Argument Name	Description	Required
user	User to validate	Required

Context Output

Path	Type	Description
Attivo.User.IsDeceptive	boolean	Is the user part of the Deception environment
Attivo.User.Groups	unknown	If the user is part of the Deception environment, the member is a member of these groups

Command Example

!attivo-check-user user="a-user-l-ftp-0"

Context Example

{
    "Attivo": {
        "User": {
            "IsDeceptive": true,
            "Groups": [
                "a-user-l-ftp"
            ],
            "Name": "a-user-l-ftp-0"
        }
    }
}

Human Readable Output

2. Verify if a host is part of a deception environment

Checks whether a host is part of the deception environment.

Base Command

attivo-check-host

Input

Argument Name	Description	Required
host	Host name or IP address to validate	Required

Command Example

!attivo-check-host host="linuxserver"

Context Example

{
    "Attivo": {
        "Host": {
            "IsDeceptive": true,
            "HostInfo": {
                "name": [
                    "linuxserver"
                ],
                "ip": "162.236.53.68",
                "vlan": null,
                "user_defined": true,
                "mac": "52:54:00:9f:65:76",
                "dhcp": false
            }
        }
    }
}

Human Readable Output

3. Run a playbook configured on Attivo BOTsink

Run a pre-built Attivo playbook on the BOTsink appliance.

Base Command

attivo-run-playbook

Input

Argument Name	Description	Required
playbook_name	Name of the prebuilt playbook	Required
attacker_ip	Malicious source IP	Required

Context Output

Path	Type	Description
Attivo.Playbook.Status	boolean	Was the playbook successful
Attivo.Playbook.Message	string	Complete status message

Command Example

!attivo-run-playbook attacker_ip=172.16.2.20 playbook_name="Endpoint Forensics"

4. Deploy a decoy system on a subnet

Deploy a new network decoy

Base Command

attivo-deploy-decoy

Input

Argument Name	Description	Required
vulnerable_ip	Used to determine which subnet to deploy to	Required
decoy_number	The number of decoys to deploy	Optional

Context Output

Path	Type	Description
Attivo.DeployDecoy.Status	boolean	Was the network decoy successfully deployed
Attivo.DeployDecoy.Message	string	Complete status message

Command Example

!attivo-deploy-decoy vulnerable_ip=172.16.40.55

Human Readable Output

1 new Attivo decoy(s) deployed on the subnet with 172.16.40.55

5. Get events for an attacker IP address

Retrieves events for a specific source IP.

Base Command

attivo-get-events

Input

Argument Name	Description	Required
attacker_ip	Source IP address	Required
severity	The minimum Attivo severity for the events, default is "Medium"; "VeryHigh", "High", "Medium", "Low", "VeryLow", "SystemActivity"	Optional
alerts_start_date	Date and time to start looking for events. For example: 2018-12-10 or 2018-12-10T13:59:05Z	Optional
alerts_end_date	Date and time to stop looking for events. For example: 2018-12-10 or 2018-12-10T13:59:05Z	Optional

Context Output

Path	Type	Description
Attivo.Events.Count	number	Total number of events retrieved
Attivo.Events.List.AttackName	unknown	Short name of the attack
Attivo.Events.List.Attack Phase	string	Kill chain phase of the attack
Attivo.Events.List.Server	string	Internal name of the target decoy
Attivo.Events.List.Target	string	Display name of the target decoy
Attivo.Events.List.TargetOS	string	Operating system of the target decoy
Attivo.Events.List.Attacker	string	Attacker IP address
Attivo.Events.List.Service	string	The attacked service
Attivo.Events.List.Timestamp	string	Time of the attack
Attivo.Events.List.TargetIP	string	IP address of the target decoy
Attivo.Events.List.Severity	string	Attivo severity of the attack

Command Example

!attivo-get-events attacker_ip=CentOS70 alerts_start_date=2018-11-30T23:59:05Z alerts_end_date=2018-12-01T00:02:05Z

Context Example

{
    "Attivo": {
        "Events": {
            "Count": 2,
            "List": [
                {
                    "geoip_src_latitude": null,
                    "Severity": "Medium",
                    "Service": "DNS SERVER",
                    "VLAN": null,
                    "AttackName": "DNS Response",
                    "TargetIP": "SinkHole",
                    "AttackPhase": "C&C",
                    "TargetOS": "CentOS 7.0",
                    "Timestamp": "2018-12-01T00:01:43.500Z",
                    "geoip_dest_city_name": null,
                    "geoip_dest_country_code2": null,
                    "geoip_dest_country_code3": null,
                    "Attacker": "CentOS70",
                    "Device": "0",
                    "geoip_src_country_code3": null,
                    "geoip_src_country_code2": null,
                    "Target": "SinkHole",
                    "Server": "ZZZ-BServer01",
                    "geoip_dest_latitude": null,
                    "geoip_src_country_name": null,
                    "geoip_src_longitude": null,
                    "geoip_dest_country_name": null,
                    "geoip_dest_longitude": null
                },
                {
                    "geoip_src_latitude": null,
                    "Severity": "Medium",
                    "Service": "DNS SERVER",
                    "VLAN": null,
                    "AttackName": "DNS Response",
                    "TargetIP": "SinkHole",
                    "AttackPhase": "C&C",
                    "TargetOS": "CentOS 7.0",
                    "Timestamp": "2018-12-01T00:01:38.500Z",
                    "geoip_dest_city_name": null,
                    "geoip_dest_country_code2": null,
                    "geoip_dest_country_code3": null,
                    "Attacker": "CentOS70",
                    "Device": "0",
                    "geoip_src_country_code3": null,
                    "geoip_src_country_code2": null,
                    "Target": "SinkHole",
                    "Server": "ZZZ-BServer01",
                    "geoip_dest_latitude": null,
                    "geoip_src_country_name": null,
                    "geoip_src_longitude": null,
                    "geoip_dest_country_name": null,
                    "geoip_dest_longitude": null
                }
            ]
        }
    }
}

6. Get information for playbooks

List information about playbooks configured on the Attivo device

Base Command

attivo-list-playbooks

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

7. Get information for network decoys

List information about network decoys

Base Command

attivo-list-hosts

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Human Readable Output

8. Get a list of all deceptive users

Lists all deceptive users.

Base Command

attivo-list-users

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Human Readable Output

Known Limitations

This integration works with the Attivo BOTsink. You can only run the attivo-deploy-decoy using the physical appliance.

Configuration parameters

server — Botsink name or address (required)
credentials — BOTsink API credentials (required)
insecure — Trust any certificate (not secure)
fetch_severity — Minimum severity when fetching events; "Very High", "High", "Medium" (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
first_fetch — Number of days to go back for the initial fetch. Use "0" to only retrieve new incidents. (required)

Commands (8)

attivo-check-host
Checks whether a host is deceptive.
attivo-check-user
Checks whether a user is deceptive.
attivo-deploy-decoy
Deploys a new network decoy.
attivo-get-events
Retrieves events for a specified source IP.
attivo-list-hosts
List information about network decoys.
attivo-list-playbooks
List information about playbooks configured on the Attivo device.
attivo-list-users
List all deceptive users.
attivo-run-playbook
Runs a prebuilt playbook on the BOTsink appliance.

Source

AttivoBotsink.py AttivoBotsink.yml

Download History Raw

commonfields:
  id: Attivo Botsink
  version: -1
name: Attivo Botsink
display: Attivo Botsink
category: Deception & Breach Simulation
sectionorder:
- Connect
- Collect
provider: SentinelOne
description: Network-based Threat Deception for Post-Compromise Threat Detection.
configuration:
- display: Botsink name or address
  name: server
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: BOTsink API credentials
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Minimum severity when fetching events; "Very High", "High", "Medium"
  name: fetch_severity
  defaultvalue: High
  type: 0
  required: true
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Number of days to go back for the initial fetch. Use "0" to only retrieve new incidents.
  name: first_fetch
  defaultvalue: "0"
  type: 0
  required: true
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: attivo-check-user
    arguments:
    - name: user
      required: true
      description: User to validate.
    outputs:
    - contextPath: Attivo.User.IsDeceptive
      description: Is the user part of the Deception environment.
      type: boolean
    - contextPath: Attivo.User.Groups
      description: If the user is part of the Deception environment, the member is a member of these groups.
    description: Checks whether a user is deceptive.
  - name: attivo-check-host
    arguments:
    - name: host
      required: true
      default: true
      description: Hostname or IP to validate.
    outputs:
    - contextPath: Attivo.Host.IsDeceptive
      description: Is the IP or hostname part of the Decpetion environment.
      type: boolean
    - contextPath: Attivo.Host.IPAddress
      description: IP Address of the deceptive host.
    - contextPath: Attivo.Host.Name
      description: Hostname of the deceptive host.
    - contextPath: Attivo.Host.MACAddress
      description: MAC address of the deceptive host.
    - contextPath: Attivo.Host.VLAN
      description: VLAN of the deceptive host.
    - contextPath: Attivo.Host.UserDefined
      description: Was this host manually defined.
      type: boolean
    - contextPath: Attivo.Host.DHCP
      description: Does the host have a dynamic IP address.
      type: boolean
    - contextPath: Attivo.Host.ThreatDirect.Name
      description: Name of the ThreatDirect device projecting this deceptive host.
    - contextPath: Attivo.Host.ThreatDirect.Type
      description: The type of ThreatDirect device projecting the deceptive host.
    description: Checks whether a host is deceptive.
  - name: attivo-run-playbook
    arguments:
    - name: playbook_name
      required: true
      description: The name of the prebuilt playbook.
    - name: attacker_ip
      required: true
      description: Malicious source IP.
    outputs:
    - contextPath: Attivo.Playbook.Message
      description: Complete status message.
      type: string
    - contextPath: Attivo.Playbook.Status
      description: Was the playbook successful.
      type: boolean
    description: Runs a prebuilt playbook on the BOTsink appliance.
  - name: attivo-deploy-decoy
    arguments:
    - name: vulnerable_ip
      required: true
      description: Used to determine which subnet to deploy to.
    - name: decoy_number
      default: true
      description: The number of decoys to deploy, default is "1".
      defaultValue: "1"
    outputs:
    - contextPath: Attivo.DeployDecoy.Status
      description: Was the network decoy successfully deployed.
      type: boolean
    - contextPath: Attivo.DeployDecoy.Message
      description: Complete status message.
      type: string
    description: 'Deploys a new network decoy.'
  - name: attivo-get-events
    arguments:
    - name: attacker_ip
      required: true
      description: Source IP address.
    - name: severity
      auto: PREDEFINED
      predefined:
      - VeryHigh
      - High
      - Medium
      - Low
      - VeryLow
      - SystemActivity
      description: The minimum Attivo severity for the events, default is "Medium"; "VeryHigh", "High", "Medium", "Low", "VeryLow", "SystemActivity".
      defaultValue: Medium
    - name: alerts_start_date
      description: Date and time to start looking for events, e.g.,  2018-12-10 or 2018-12-10T13:59:05Z.
    - name: alerts_end_date
      description: Date and time to stop looking for events, e.g.,  2018-12-10 or 2018-12-10T13:59:05Z.
    outputs:
    - contextPath: Attivo.Events.Count
      description: Total number of events retrieved.
      type: number
    - contextPath: Attivo.Events.List.AttackName
      description: Short name of the attack.
    - contextPath: Attivo.Events.List.Attack Phase
      description: Kill chain phase of the attack.
      type: string
    - contextPath: Attivo.Events.List.Server
      description: Internal name of the target decoy.
      type: string
    - contextPath: Attivo.Events.List.Target
      description: Display name of the target decoy.
      type: string
    - contextPath: Attivo.Events.List.TargetOS
      description: Operating system of the target decoy.
      type: string
    - contextPath: Attivo.Events.List.Attacker
      description: Attacker IP address.
      type: string
    - contextPath: Attivo.Events.List.Service
      description: The attacked service.
      type: string
    - contextPath: Attivo.Events.List.Timestamp
      description: Time of the attack.
      type: string
    - contextPath: Attivo.Events.List.TargetIP
      description: IP address of the target decoy.
      type: string
    - contextPath: Attivo.Events.List.Severity
      description: Attivo severity of the attack.
      type: string
    description: Retrieves events for a specified source IP.
  - name: attivo-list-playbooks
    arguments: []
    description: List information about playbooks configured on the Attivo device.
  - name: attivo-list-hosts
    arguments: []
    description: List information about network decoys.
  - name: attivo-list-users
    arguments: []
    description: List all deceptive users.
  isfetch: true
  runonce: false
  dockerimage: demisto/python3:3.12.8.3296088
tests:
- AttivoBotsinkTest
fromversion: 5.0.0