BluecatAddressManager

Use the BlueCat Address Manager integration to enrich IP addresses and manage response policies.

Network Security · Bluecat Address Manager

Details

ID	`BluecatAddressManager`
Provider	BlueCat Networks
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This integration supports Bluecat Address Manager version 9.5.

Use the BlueCat integration to enrich IP addresses and manage response policies.

Configure BluecatAddressManager on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for BluecatAddressManager.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Incident type
- Server URL (e.g., https://192.168.0.1)
- Username
- Trust any certificate (insecure)
- Use system proxy
- Configuration Name
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Enrich an IP address: bluecat-am-query-ip
Get all response policies: bluecat-am-get-response-policies
Search response policies by domain: bluecat-am-search-response-policies-by-domain
Add a domain to a response policy: bluecat-am-response-policy-add-domain
Remove a domain from a response policy: bluecat-am-response-policy-remove-domain
Get an IPv4 block containing an IPv4 address: bluecat-am-get-range-by-ip

1. Enrich an IP address

Enriches an IP address with data about IP networks and blocks to which it belongs, linked IPs, MAC addresses, and so on.

Base Command

bluecat-am-query-ip

Input

Argument Name	Description	Required
ip	The IP to get data for.	Required

Context Output

Path	Type	Description
BlueCat.AddressManager.IP.ID	Number	The address manager ID of the IP address.
BlueCat.AddressManager.IP.Name	String	Name of the IP address.
BlueCat.AddressManager.IP.MacAddress	String	Corresponding MAC address.
BlueCat.AddressManager.IP.Parents.ID	String	ID of the parent IP address.
BlueCat.AddressManager.IP.Parents.Type	String	Type of the parent IP address.
BlueCat.AddressManager.IP.Parents.Name	String	Name of the parent IP address.
BlueCat.AddressManager.IP.Parents.CIDR	String	Classless Inter-Domain Routing.
BlueCat.AddressManager.IP.Type	String	Type of IP address.
IP.Address	String	Address of IP.
BlueCat.AddressManager.IP.Parents.Prefix	String	Prefix of the IP address.

Command Example

bluecat-am-query-ip ip="10.0.0.10"

Context Example

{
    "IP": {
        "Address": "10.0.0.10"
    },
    "BlueCat.AddressManager.IP": {
        "Name": null,
        "LocationInherited": "true",
        "State": "STATIC",
        "Parents": [
            {
                "InheritPingBeforeAssign": "true",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "ID": 100913,
                "InheritAllowDuplicateHost": "true",
                "InheritDefaultView": "true",
                "CIDR": "10.0.0.0/24",
                "DefaultView": "100907",
                "Type": "IP4Network",
                "Gateway": "10.0.0.1",
                "InheritDefaultDomains": "true",
                "Name": "East Office"
            },
            {
                "InheritPingBeforeAssign": "true",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "InheritAllowDuplicateHost": "true",
                "InheritDefaultView": "true",
                "CIDR": "10.0.0.0/21",
                "DefaultView": "100907",
                "Type": "IP4Block",
                "ID": 100912,
                "InheritDefaultDomains": "true",
                "Name": "Tampa"
            },
            {
                "InheritPingBeforeAssign": "true",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "InheritAllowDuplicateHost": "true",
                "InheritDefaultView": "true",
                "CIDR": "10.0.0.0/19",
                "DefaultView": "100907",
                "Type": "IP4Block",
                "ID": 100911,
                "InheritDefaultDomains": "true",
                "Name": "Florida"
            },
            {
                "InheritPingBeforeAssign": "true",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "InheritAllowDuplicateHost": "true",
                "InheritDefaultView": "true",
                "CIDR": "10.0.0.0/16",
                "DefaultView": "100907",
                "Type": "IP4Block",
                "ID": 100910,
                "InheritDefaultDomains": "true",
                "Name": "North America"
            },
            {
                "InheritPingBeforeAssign": "false",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "InheritAllowDuplicateHost": "false",
                "InheritDefaultView": "false",
                "CIDR": "10.0.0.0/8",
                "DefaultView": "100907",
                "Type": "IP4Block",
                "ID": 100909,
                "InheritDefaultDomains": "true",
                "Name": "global"
            }
        ],
        "Address": "10.0.0.10",
        "Type": "IPv4",
        "ID": 100923
    }
}

Human Readable Output

10.0.0.10 IP Result:

ID	Name	Type	Address	State	Location Inherited
100923		IPv4	10.0.0.10	STATIC	true

Parents Details:

ID	Type	Name	CIDR	Allow Duplicate Host	Inherit Allow Duplicate Host	Ping Before Assign	Inherit Ping Before Assign	Location Inherited	Inherit Default Domains	Default View	Inherit Default View	Inherit DNS Restrictions
100909	IP4Block	global	10.0.0.0/8	disable	false	disable	false	true	true	100907	false	true
100910	IP4Block	North America	10.0.0.0/16	disable	true	disable	true	true	true	100907	true	true
100911	IP4Block	Florida	10.0.0.0/19	disable	true	disable	true	true	true	100907	true	true
100912	IP4Block	Tampa	10.0.0.0/21	disable	true	disable	true	true	true	100907	true	true
100913	IP4Network	East Office	10.0.0.0/24	disable	true	disable	true	true	true	100907	true	true

2. Get all response policies

Returns all response policies.

Base Command

bluecat-am-get-response-policies

Input

Argument Name	Description	Required
start	Start index from which to get the response policies. Default is 0.	Optional
count	Maximum number of response policies to return.	Optional

Context Output

Path	Type	Description
BlueCat.AddressManager.ResponsePolicies.ID	Number	ID of the response policy.
BlueCat.AddressManager.ResponsePolicies.Name	String	Name of the response policy.
BlueCat.AddressManager.ResponsePolicies.Ttl	Unknown	Time to live (TTL) of the response policy.
BlueCat.AddressManager.ResponsePolicies.Type	String	Type of the response policy (BLACKLIST, BLACKHOLE, WHITELIST, or REDIRECT).
BlueCat.AddressManager.ResponsePolicies.RedirectTarget	String	Target of redirect, in case of REDIRECT policy type.

Command Example

bluecat-am-get-response-policies start="0" count="30"

Context Example

{
    "BlueCat.AddressManager.ResponsePolicies": [
        {
            "RedirectTarget": "foo.com",
            "ResponsePolicyType": "REDIRECT",
            "Ttl": "30",
            "Type": "ResponsePolicy",
            "ID": 100930,
            "Name": "Malware Trap"
        }
    ]
}

Human Readable Output

Response Policies:

Malware Trap

ID	Name	Type	Ttl	ResponsePolicyType	RedirectTarget
100930	Malware Trap	ResponsePolicy	30	REDIRECT	foo.com

3. Search response policies by domain

Searches all response policies in which the given domain is included.

Base Command

bluecat-am-search-response-policies-by-domain

Input

Argument Name	Description	Required
domain	Domain name by which to search.	Required

Context Output

Path	Type	Description
BlueCat.AddressManager.ResponsePolicies.ID	Number	ID of the response policy.
BlueCat.AddressManager.ResponsePolicies.Name	String	Name of the response policy.
BlueCat.AddressManager.ResponsePolicies.Ttl	Unknown	Time to live (TTL) of the response policy
BlueCat.AddressManager.ResponsePolicies.Type	String	Type of the responce policy ( BLACKLIST, BLACKHOLE, WHITELIST, or REDIRECT).
BlueCat.AddressManager.ResponsePolicies.RedirectTarget	String	Target of redirect, in case of REDIRECT policy type.

Command Example

bluecat-am-search-response-policies-by-domain domain="demisto.com"

Human Readable Output

Could not find any response policy

4. Add a domain to a response policy

Adds a domain to the given response policy.

Base Command

bluecat-am-response-policy-add-domain

Input

Argument Name	Description	Required
policy_id	ID of the response policy to edit.	Required
domain	Domain to add to the response policy.	Required

Context Output

There is no context output for this command.

Command Example

bluecat-am-response-policy-add-domain policy_id="100930" domain="demisto.com"

Human Readable Output

Successfully added demisto.com to response policy 100930

5. Remove a domain from a response policy

Removes a domain from the given response policy.

Base Command

bluecat-am-response-policy-remove-domain

Input

Argument Name	Description	Required
policy_id	ID of the response policy to edit.	Required
domain	Domain to remove from the response policy.	Required

Context Output

There is no context output for this command.

Command Example

bluecat-am-response-policy-remove-domain policy_id="100930" domain="demisto.com"

Human Readable Output

Successfully removed demisto.com from response policy 100930

6. Get an IPv4 block containing an IPv4 address

Gets an IPv4 block, which contains a specified IPv4 address.

Base Command

bluecat-am-get-range-by-ip

Input

Argument Name	Description	Required
ip	The IP address for which to get the range.	Required

Context Output

Path	Type	Description
BlueCat.AddressManager.Range.ID	String	The address manager ID of the Range.
BlueCat.AddressManager.Range.Name	String	Name of the Range.
BlueCat.AddressManager.Range.Type	String	Type of the Range.
BlueCat.AddressManager.Range.Parents.ID	String	ID of the parent Range.
BlueCat.AddressManager.Range.Parents.Type	String	Type of the parent Range.
BlueCat.AddressManager.Range.Parents.Name	String	Name of the parent Range.
BlueCat.AddressManager.Range.Parents.CIDR	String	Classless Inter-Domain Routing.

Command Example

  !bluecat-am-get-range-by-ip ip=10.0.0.11

Human Readable Output

Configuration parameters

url — Server URL (e.g., https://192.168.0.1) (required)
credentials — Username (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
conf_name — Configuration Name

Commands (6)

bluecat-am-get-range-by-ip
Returns the IPv4 block that contains the specified IPv4 address.
bluecat-am-get-response-policies
Returns all response policies.
bluecat-am-query-ip
Enriches an IP address with data, including IP networks and blocks to which it belongs, linked IPs, MAC addresses, and more.
bluecat-am-response-policy-add-domain
Adds a domain to the given response policy.
bluecat-am-response-policy-remove-domain
Removes a domain from the given response policy.
bluecat-am-search-response-policies-by-domain
Searches all response policies in which the given domain is included.

Source

BluecatAddressManager.py BluecatAddressManager.yml BluecatAddressManager_description.md

Download History Raw

category: Network Security
provider: BlueCat Networks
commonfields:
  id: BluecatAddressManager
  version: -1
configuration:
- defaultvalue: https://192.168.0.1
  display: Server URL (e.g., https://192.168.0.1)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Configuration Name
  name: conf_name
  type: 0
  required: false
description: Use the BlueCat Address Manager integration to enrich IP addresses and manage response policies.
display: Bluecat Address Manager
name: BluecatAddressManager
script:
  commands:
  - arguments:
    - default: true
      description: The IP address for which to return data.
      name: ip
      required: true
    description: Enriches an IP address with data, including IP networks and blocks to which it belongs, linked IPs, MAC addresses, and more.
    name: bluecat-am-query-ip
    outputs:
    - contextPath: BlueCat.AddressManager.IP.ID
      description: The address manager ID of the IP address.
      type: Number
    - contextPath: BlueCat.AddressManager.IP.Name
      description: Name of the IP address.
      type: String
    - contextPath: BlueCat.AddressManager.IP.MacAddress
      description: Corresponding MAC address.
      type: String
    - contextPath: BlueCat.AddressManager.IP.Parents.ID
      description: ID of the parent IP address.
      type: String
    - contextPath: BlueCat.AddressManager.IP.Parents.Type
      description: Type of the parent IP address.
      type: String
    - contextPath: BlueCat.AddressManager.IP.Parents.Name
      description: Name of the parent IP address.
      type: String
    - contextPath: BlueCat.AddressManager.IP.Parents.CIDR
      description: Classless Inter-Domain Routing.
      type: String
    - contextPath: BlueCat.AddressManager.IP.Type
      description: Type of IP address.
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: BlueCat.AddressManager.IP.Parents.Prefix
      description: Prefix of the IP address.
      type: String
  - arguments:
    - defaultValue: '0'
      description: Start index from which to get the response policies. Default is 0.
      name: start
    - defaultValue: '30'
      description: Maximum number of response policies to return.
      name: count
    description: Returns all response policies.
    name: bluecat-am-get-response-policies
    outputs:
    - contextPath: BlueCat.AddressManager.ResponsePolicies.ID
      description: ID of the response policy.
      type: Number
    - contextPath: BlueCat.AddressManager.ResponsePolicies.Name
      description: Name of the response policy.
      type: String
    - contextPath: BlueCat.AddressManager.ResponsePolicies.Ttl
      description: Time to live (TTL) of the response policy.
      type: Unknown
    - contextPath: BlueCat.AddressManager.ResponsePolicies.Type
      description: Type of the response policy (BLACKLIST, BLACKHOLE, WHITELIST, or REDIRECT).
      type: String
    - contextPath: BlueCat.AddressManager.ResponsePolicies.RedirectTarget
      description: Target of redirect, in case of REDIRECT policy type.
      type: String
  - arguments:
    - description: Domain name by which to search.
      name: domain
      required: true
    description: Searches all response policies in which the given domain is included.
    name: bluecat-am-search-response-policies-by-domain
    outputs:
    - contextPath: BlueCat.AddressManager.ResponsePolicies.ID
      description: ID of the response policy.
      type: Number
    - contextPath: BlueCat.AddressManager.ResponsePolicies.Name
      description: Name of the response policy.
      type: String
    - contextPath: BlueCat.AddressManager.ResponsePolicies.Ttl
      description: Time to live (TTL) of the response policy.
      type: Unknown
    - contextPath: BlueCat.AddressManager.ResponsePolicies.Type
      description: Type of the responce policy ( BLACKLIST, BLACKHOLE, WHITELIST, or REDIRECT).
      type: String
    - contextPath: BlueCat.AddressManager.ResponsePolicies.RedirectTarget
      description: Target of redirect, in case of REDIRECT policy type.
      type: String
  - arguments:
    - default: true
      description: ID of the response policy to edit.
      name: policy_id
      required: true
    - description: Domain to add to the response policy.
      name: domain
      required: true
    description: Adds a domain to the given response policy.
    name: bluecat-am-response-policy-add-domain
  - arguments:
    - default: true
      description: ID of the response policy to edit.
      name: policy_id
      required: true
    - description: Domain to remove from the response policy.
      name: domain
      required: true
    description: Removes a domain from the given response policy.
    name: bluecat-am-response-policy-remove-domain
  - arguments:
    - description: The IP address for which to get the range.
      name: ip
      required: true
    description: Returns the IPv4 block that contains the specified IPv4 address.
    name: bluecat-am-get-range-by-ip
    outputs:
    - contextPath: BlueCat.AddressManager.Range.ID
      description: The address manager ID of the range.
      type: String
    - contextPath: BlueCat.AddressManager.Range.Name
      description: Name of the range.
      type: String
    - contextPath: BlueCat.AddressManager.Range.Type
      description: Type of the range.
      type: String
    - contextPath: BlueCat.AddressManager.Range.Parents.ID
      description: ID of the parent range.
      type: String
    - contextPath: BlueCat.AddressManager.Range.Parents.Type
      description: Type of the parent range.
      type: String
    - contextPath: BlueCat.AddressManager.Range.Parents.Name
      description: Name of the parent range.
      type: String
    - contextPath: BlueCat.AddressManager.Range.Parents.CIDR
      description: Classless Inter-Domain Routing.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Bluecat Address Manager test
fromversion: 5.0.0