Bastille Networks

RF monitoring for wireless intrusion detection and policy enforcement. Visit https://www.bastille.net for details.

Network Security · Bastille Networks

Details

IDBastille Networks
ProviderBastille Networks
CategoryNetwork Security
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

RF monitoring for wireless intrusion detection and policy enforcement. Visit https://www.bastille.net for details.

This integration was integrated and tested with Bastille Networks product version 1.5.0.

Configure BastilleNetworks in Cortex

Parameter Description Required
api_url Server URL False
api_key API Key True
site Site True
concentrator Concentrator True
map Map True
isFetch Fetch incidents False
incidentType Incident type False
tags Tags False
event_types Event types False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

bastille-get-device-events

Command to fetch device detection events

Base Command

bastille-get-device-events

Input

Argument Name Description Required
protocol Filter by transmitter protocol name Optional
since Earliest time to return incidents from Optional
until Latest time to return incidents from Optional
limit Limit the number of fetched events Optional
tags List of tags to filter events by Optional
event_id Unique identifier of the zone detection event Optional
transmitter_id Device identifier to query the detections for Optional

Context Output

Path Type Description
Bastille.DeviceEvent.event_id String Unique identifier of the event
Bastille.DeviceEvent.event_type String Type of the event
Bastille.DeviceEvent.time_s Date Event detection timestamp
Bastille.DeviceEvent.tags String Tags attached to the zone event
Bastille.DeviceEvent.zone_name String Zone name where the incident took place
Bastille.DeviceEvent.area.site_id String Deployment site identifier
Bastille.DeviceEvent.area.concentrator_id String Deployment concentrator identifier
Bastille.DeviceEvent.area.map_id String Deployment map identifier
Bastille.DeviceEvent.emitter.protocol String Wireless protcol used by the detected transmitter
Bastille.DeviceEvent.emitter.transmitter_id String Wireless transmitter identifier
Bastille.DeviceEvent.emitter.vendor String Wireless transmitter vendor
Bastille.DeviceEvent.emitter.network.name String Name of the network the transmitter is connected to
Bastille.DeviceEvent.device_info.manufacturer String Manufacturer associated with device in the deployment
Bastille.DeviceEvent.device_info.user String User associated with device in the deployment
Bastille.DeviceEvent.device_info.model String Model associated with device in the deployment
Bastille.DeviceEvent.device_info.name String Name associated with device in the deployment
Bastille.DeviceEvent.first_seen.time Number Event first seen timestamp
Bastille.DeviceEvent.first_seen.position Unknown Event first seen coordinates
Bastille.DeviceEvent.last_seen.time Number Event last seen timestamp
Bastille.DeviceEvent.last_seen.position Unknown Event last seen coordinates

Command Example

!bastille-get-device-events since=2020-05-01T13:00:00T until=2020-05-01T17:00:00T

Context Example

{
    "Bastille": {
        "DeviceEvent": [
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338000",
                "event_type": "device_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-05-01T13:00:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-05-01T13:00:00+00:00"
                },
                "tags": [],
                "time_s": "2020-05-01T13:00:00+00:00"
            },
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338060",
                "event_type": "device_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-05-01T13:01:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-05-01T13:01:00+00:00"
                },
                "tags": [],
                "time_s": "2020-05-01T13:01:00+00:00"
            },
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338120",
                "event_type": "device_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-05-01T13:02:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-05-01T13:02:00+00:00"
                },
                "tags": [],
                "time_s": "2020-05-01T13:02:00+00:00"
            },
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338180",
                "event_type": "device_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-05-01T13:03:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-05-01T13:03:00+00:00"
                },
                "tags": [],
                "time_s": "2020-05-01T13:03:00+00:00"
            },
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338240",
                "event_type": "device_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-05-01T13:04:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-05-01T13:04:00+00:00"
                },
                "tags": [],
                "time_s": "2020-05-01T13:04:00+00:00"
            }
        ]
    }
}

Human Readable Output

Device Events

area device_info emitter event_id first_seen last_seen tags time_s
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338000 time_s: 2020-05-01T13:00:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-05-01T13:00:00+00:00		   2020-05-01T13:00:00+00:00
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338060 time_s: 2020-05-01T13:01:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-05-01T13:01:00+00:00		   2020-05-01T13:01:00+00:00
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338120 time_s: 2020-05-01T13:02:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-05-01T13:02:00+00:00		   2020-05-01T13:02:00+00:00
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338180 time_s: 2020-05-01T13:03:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-05-01T13:03:00+00:00		   2020-05-01T13:03:00+00:00
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 LTE_vzw:1100:249:6f4d_s1_c1_m1_1588338240 time_s: 2020-05-01T13:04:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-05-01T13:04:00+00:00		   2020-05-01T13:04:00+00:00

bastille-get-zone-events

Command to fetch zone detection events

Base Command

bastille-get-zone-events

Input

Argument Name Description Required
zone Filter by zone name Optional
protocol Filter by transmitter protocol name Optional
since Earliest time to return incidents from Optional
until Latest time to return incidents from Optional
limit Limit the number of fetched events Optional
tags List of tags to filter events by Optional
event_id Unique identifier of the zone detection event Optional

Context Output

Path Type Description
Bastille.ZoneEvent.event_id String Unique identifier of the event
Bastille.ZoneEvent.event_type String Type of the event
Bastille.ZoneEvent.time_s Date Event detection timestamp
Bastille.ZoneEvent.tags String Tags attached to the zone event
Bastille.ZoneEvent.zone_name String Zone name where the incident took place
Bastille.ZoneEvent.area.site_id String Deployment site identifier
Bastille.ZoneEvent.area.concentrator_id String Deployment concentrator identifier
Bastille.ZoneEvent.area.map_id String Deployment map identifier
Bastille.ZoneEvent.emitter.protocol String Wireless protcol used by the detected transmitter
Bastille.ZoneEvent.emitter.transmitter_id String Wireless transmitter identifier
Bastille.ZoneEvent.emitter.vendor String Wireless transmitter vendor
Bastille.ZoneEvent.emitter.network.name String Name of the network the transmitter is connected to
Bastille.ZoneEvent.device_info.manufacturer String Manufacturer associated with device in the deployment
Bastille.ZoneEvent.device_info.user String User associated with device in the deployment
Bastille.ZoneEvent.device_info.model String Model associated with device in the deployment
Bastille.ZoneEvent.device_info.name String Name associated with device in the deployment
Bastille.ZoneEvent.first_seen.time Number Event first seen timestamp
Bastille.ZoneEvent.first_seen.position Unknown Event first seen coordinates
Bastille.ZoneEvent.last_seen.time Number Event last seen timestamp
Bastille.ZoneEvent.last_seen.position Unknown Event last seen coordinates

Command Example

!bastille-get-zone-events zone=conference-1

Context Example

{
    "Bastille": {
        "ZoneEvent": [
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699200",
                "event_type": "zone_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-04-01T00:00:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-04-01T00:00:00+00:00"
                },
                "tags": [],
                "time_s": "2020-04-01T00:00:00+00:00",
                "zone_name": "conference-1"
            },
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699260",
                "event_type": "zone_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-04-01T00:01:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-04-01T00:01:00+00:00"
                },
                "tags": [],
                "time_s": "2020-04-01T00:01:00+00:00",
                "zone_name": "conference-1"
            },
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699320",
                "event_type": "zone_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-04-01T00:02:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-04-01T00:02:00+00:00"
                },
                "tags": [],
                "time_s": "2020-04-01T00:02:00+00:00",
                "zone_name": "conference-1"
            },
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699380",
                "event_type": "zone_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-04-01T00:03:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-04-01T00:03:00+00:00"
                },
                "tags": [],
                "time_s": "2020-04-01T00:03:00+00:00",
                "zone_name": "conference-1"
            },
            {
                "area": {
                    "concentrator_id": "c1",
                    "map_id": "m1",
                    "site_id": "s1"
                },
                "device_info": {
                    "manufacturer": "Apple",
                    "model": "iPhone 7",
                    "name": "Jane's iPhone 7",
                    "user": "Jane Doe"
                },
                "emitter": {
                    "network": {
                        "name": "Verizon"
                    },
                    "protocol": "LTE",
                    "transmitter_id": "vzw:1100:249:6f4d",
                    "vendor": "Unknown"
                },
                "event_id": "conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699440",
                "event_type": "zone_event",
                "first_seen": {
                    "position": [
                        34.61,
                        13.31
                    ],
                    "time_s": "2020-04-01T00:04:00+00:00"
                },
                "last_seen": {
                    "position": [
                        32.31,
                        11.24
                    ],
                    "time_s": "2020-04-01T00:04:00+00:00"
                },
                "tags": [],
                "time_s": "2020-04-01T00:04:00+00:00",
                "zone_name": "conference-1"
            }
        ]
    }
}

Human Readable Output

Zone Events

area device_info emitter event_id first_seen last_seen tags time_s zone_name
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699200 time_s: 2020-04-01T00:00:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-04-01T00:00:00+00:00		   2020-04-01T00:00:00+00:00 conference-1
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699260 time_s: 2020-04-01T00:01:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-04-01T00:01:00+00:00		   2020-04-01T00:01:00+00:00 conference-1
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699320 time_s: 2020-04-01T00:02:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-04-01T00:02:00+00:00		   2020-04-01T00:02:00+00:00 conference-1
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699380 time_s: 2020-04-01T00:03:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-04-01T00:03:00+00:00		   2020-04-01T00:03:00+00:00 conference-1
site_id: s1
concentrator_id: c1
map_id: m1		 manufacturer: Apple
user: Jane Doe
model: iPhone 7
name: Jane’s iPhone 7		 protocol: LTE
transmitter_id: vzw:1100:249:6f4d
vendor: Unknown
network: {“name”: “Verizon”}		 conference-1_LTE_vzw:1100:249:6f4d_s1_c1_m1_1585699440 time_s: 2020-04-01T00:04:00+00:00
position: 34.61,
13.31		 position: 32.31,
11.24
time_s: 2020-04-01T00:04:00+00:00		   2020-04-01T00:04:00+00:00 conference-1

bastille-add-device-tag

Command to add tag to an existing device

Base Command

bastille-add-device-tag

Input

Argument Name Description Required
transmitter_id Unique identifier of an existing admin devices entry Required
tag Tag to append to the admin devices entry Required

Context Output

There is no context output for this command.

Command Example

!bastille-add-device-tag transmitter_id=78:9f:70:7b:62:82 tag=test-tag

Context Example

{}

Human Readable Output

created

bastille-remove-device-tag

Command to remove tag from an existing device

Base Command

bastille-remove-device-tag

Input

Argument Name Description Required
transmitter_id Unique identifier of an existing admin devices entry Required
tag Tag to be removed from the admin devices entry Required

Context Output

There is no context output for this command.

Command Example

!bastille-remove-device-tag transmitter_id=78:9f:70:7b:62:82 tag=test-tag

Context Example

{}

Human Readable Output

updated

Configuration parameters

  • api_url — Server URL
  • api_key — API Key (required)
  • site — Site (required)
  • concentrator — Concentrator (required)
  • map — Map (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • tags — Tags
  • event_types — Event types (required)
  • first_fetch — First fetch time
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (4)

  • bastille-add-device-tag

    Command to add tag to an existing device

  • bastille-get-device-events

    Command to fetch device detection events

  • bastille-get-zone-events

    Command to fetch zone detection events

  • bastille-remove-device-tag

    Command to remove tag from an existing device

Source

BastilleNetworks.py BastilleNetworks_test.py BastilleNetworks.yml BastilleNetworks_description.md command_examples.txt
Download History Raw 
category: Network Security
sectionorder:
- Connect
- Collect
provider: Bastille Networks
commonfields:
  id: Bastille Networks
  version: -1
configuration:
- additionalinfo: 'Example: https://api.demisto-example.com'
  display: Server URL
  name: api_url
  type: 0
  required: false
  section: Connect
- display: API Key
  name: api_key
  required: true
  type: 4
  section: Connect
- additionalinfo: Enter site name of deployment area
  display: Site
  name: site
  required: true
  type: 0
  section: Connect
- additionalinfo: Enter concentrator name of deployment area
  display: Concentrator
  name: concentrator
  required: true
  type: 0
  section: Connect
- additionalinfo: Enter map name of deployment area
  display: Map
  name: map
  required: true
  type: 0
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- additionalinfo: Fetch only events with listed tags
  display: Tags
  name: tags
  type: 0
  required: false
  section: Collect
- additionalinfo: Fetch only events with selected event types
  defaultvalue: zone_event
  display: Event types
  name: event_types
  options:
  - zone_event
  - device_event
  - all
  required: true
  type: 16
  section: Collect
- defaultvalue: 5 minutes
  display: First fetch time
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: RF monitoring for wireless intrusion detection and policy enforcement. Visit https://www.bastille.net for details.
display: Bastille Networks
name: Bastille Networks
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: Filter by transmitter protocol name.
      name: protocol
      predefined:
      - BT
      - BTLE
      - WIFI
      - LTE
    - description: Earliest time to return incidents from.
      name: since
    - description: Latest time to return incidents from.
      name: until
    - defaultValue: '5'
      description: Limit the number of fetched events.
      name: limit
    - description: List of tags to filter events by.
      isArray: true
      name: tags
    - description: Unique identifier of the zone detection event.
      name: event_id
    - description: Device identifier to query the detections for.
      name: transmitter_id
    description: Command to fetch device detection events
    name: bastille-get-device-events
    outputs:
    - contextPath: Bastille.DeviceEvent.event_id
      description: Unique identifier of the event.
      type: String
    - contextPath: Bastille.DeviceEvent.event_type
      description: Type of the event.
      type: String
    - contextPath: Bastille.DeviceEvent.time_s
      description: Event detection timestamp.
      type: Date
    - contextPath: Bastille.DeviceEvent.tags
      description: Tags attached to the zone event.
      type: String
    - contextPath: Bastille.DeviceEvent.zone_name
      description: Zone name where the incident took place.
      type: String
    - contextPath: Bastille.DeviceEvent.area.site_id
      description: Deployment site identifier.
      type: String
    - contextPath: Bastille.DeviceEvent.area.concentrator_id
      description: Deployment concentrator identifier.
      type: String
    - contextPath: Bastille.DeviceEvent.area.map_id
      description: Deployment map identifier.
      type: String
    - contextPath: Bastille.DeviceEvent.emitter.protocol
      description: Wireless protcol used by the detected transmitter.
      type: String
    - contextPath: Bastille.DeviceEvent.emitter.transmitter_id
      description: Wireless transmitter identifier.
      type: String
    - contextPath: Bastille.DeviceEvent.emitter.vendor
      description: Wireless transmitter vendor.
      type: String
    - contextPath: Bastille.DeviceEvent.emitter.network.name
      description: Name of the network the transmitter is connected to.
      type: String
    - contextPath: Bastille.DeviceEvent.device_info.manufacturer
      description: Manufacturer associated with device in the deployment.
      type: String
    - contextPath: Bastille.DeviceEvent.device_info.user
      description: User associated with device in the deployment.
      type: String
    - contextPath: Bastille.DeviceEvent.device_info.model
      description: Model associated with device in the deployment.
      type: String
    - contextPath: Bastille.DeviceEvent.device_info.name
      description: Name associated with device in the deployment.
      type: String
    - contextPath: Bastille.DeviceEvent.first_seen.time
      description: Event first seen timestamp.
      type: Number
    - contextPath: Bastille.DeviceEvent.first_seen.position
      description: Event first seen coordinates.
      type: Unknown
    - contextPath: Bastille.DeviceEvent.last_seen.time
      description: Event last seen timestamp.
      type: Number
    - contextPath: Bastille.DeviceEvent.last_seen.position
      description: Event last seen coordinates.
      type: Unknown
  - arguments:
    - description: Filter by zone name.
      name: zone
    - auto: PREDEFINED
      description: Filter by transmitter protocol name.
      name: protocol
      predefined:
      - BT
      - BTLE
      - WIFI
      - LTE
    - description: Earliest time to return incidents from.
      name: since
    - description: Latest time to return incidents from.
      name: until
    - defaultValue: '5'
      description: Limit the number of fetched events.
      name: limit
    - description: List of tags to filter events by.
      isArray: true
      name: tags
    - description: Unique identifier of the zone detection event.
      name: event_id
    description: Command to fetch zone detection events
    name: bastille-get-zone-events
    outputs:
    - contextPath: Bastille.ZoneEvent.event_id
      description: Unique identifier of the event.
      type: String
    - contextPath: Bastille.ZoneEvent.event_type
      description: Type of the event.
      type: String
    - contextPath: Bastille.ZoneEvent.time_s
      description: Event detection timestamp.
      type: Date
    - contextPath: Bastille.ZoneEvent.tags
      description: Tags attached to the zone event.
      type: String
    - contextPath: Bastille.ZoneEvent.zone_name
      description: Zone name where the incident took place.
      type: String
    - contextPath: Bastille.ZoneEvent.area.site_id
      description: Deployment site identifier.
      type: String
    - contextPath: Bastille.ZoneEvent.area.concentrator_id
      description: Deployment concentrator identifier.
      type: String
    - contextPath: Bastille.ZoneEvent.area.map_id
      description: Deployment map identifier.
      type: String
    - contextPath: Bastille.ZoneEvent.emitter.protocol
      description: Wireless protcol used by the detected transmitter.
      type: String
    - contextPath: Bastille.ZoneEvent.emitter.transmitter_id
      description: Wireless transmitter identifier.
      type: String
    - contextPath: Bastille.ZoneEvent.emitter.vendor
      description: Wireless transmitter vendor.
      type: String
    - contextPath: Bastille.ZoneEvent.emitter.network.name
      description: Name of the network the transmitter is connected to.
      type: String
    - contextPath: Bastille.ZoneEvent.device_info.manufacturer
      description: Manufacturer associated with device in the deployment.
      type: String
    - contextPath: Bastille.ZoneEvent.device_info.user
      description: User associated with device in the deployment.
      type: String
    - contextPath: Bastille.ZoneEvent.device_info.model
      description: Model associated with device in the deployment.
      type: String
    - contextPath: Bastille.ZoneEvent.device_info.name
      description: Name associated with device in the deployment.
      type: String
    - contextPath: Bastille.ZoneEvent.first_seen.time
      description: Event first seen timestamp.
      type: Number
    - contextPath: Bastille.ZoneEvent.first_seen.position
      description: Event first seen coordinates.
      type: Unknown
    - contextPath: Bastille.ZoneEvent.last_seen.time
      description: Event last seen timestamp.
      type: Number
    - contextPath: Bastille.ZoneEvent.last_seen.position
      description: Event last seen coordinates.
      type: Unknown
  - arguments:
    - description: Unique identifier of an existing admin devices entry.
      name: transmitter_id
      required: true
    - description: Tag to append to the admin devices entry.
      name: tag
      required: true
    description: Command to add tag to an existing device
    name: bastille-add-device-tag
  - arguments:
    - description: Unique identifier of an existing admin devices entry.
      name: transmitter_id
      predefined:
      - ''
      required: true
    - description: Tag to be removed from the admin devices entry.
      name: tag
      required: true
    description: Command to remove tag from an existing device
    name: bastille-remove-device-tag
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 5.0.0