BluecatAddressManager

Use the BlueCat Address Manager integration to enrich IP addresses and manage response policies.

Network Security · Bluecat Address Manager

Details

ID	`BluecatAddressManager`
Provider	BlueCat Networks
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This integration supports Bluecat Address Manager version 9.5.

Use the BlueCat integration to enrich IP addresses and manage response policies.

Configure BluecatAddressManager on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for BluecatAddressManager.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Incident type
- Server URL (e.g., https://192.168.0.1)
- Username
- Trust any certificate (insecure)
- Use system proxy
- Configuration Name
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Enrich an IP address: bluecat-am-query-ip
Get all response policies: bluecat-am-get-response-policies
Search response policies by domain: bluecat-am-search-response-policies-by-domain
Add a domain to a response policy: bluecat-am-response-policy-add-domain
Remove a domain from a response policy: bluecat-am-response-policy-remove-domain
Get an IPv4 block containing an IPv4 address: bluecat-am-get-range-by-ip

1. Enrich an IP address

Enriches an IP address with data about IP networks and blocks to which it belongs, linked IPs, MAC addresses, and so on.

Base Command

bluecat-am-query-ip

Input

Argument Name	Description	Required
ip	The IP to get data for.	Required

Context Output

Path	Type	Description
BlueCat.AddressManager.IP.ID	Number	The address manager ID of the IP address.
BlueCat.AddressManager.IP.Name	String	Name of the IP address.
BlueCat.AddressManager.IP.MacAddress	String	Corresponding MAC address.
BlueCat.AddressManager.IP.Parents.ID	String	ID of the parent IP address.
BlueCat.AddressManager.IP.Parents.Type	String	Type of the parent IP address.
BlueCat.AddressManager.IP.Parents.Name	String	Name of the parent IP address.
BlueCat.AddressManager.IP.Parents.CIDR	String	Classless Inter-Domain Routing.
BlueCat.AddressManager.IP.Type	String	Type of IP address.
IP.Address	String	Address of IP.
BlueCat.AddressManager.IP.Parents.Prefix	String	Prefix of the IP address.

Command Example

bluecat-am-query-ip ip="10.0.0.10"

Context Example

{
    "IP": {
        "Address": "10.0.0.10"
    },
    "BlueCat.AddressManager.IP": {
        "Name": null,
        "LocationInherited": "true",
        "State": "STATIC",
        "Parents": [
            {
                "InheritPingBeforeAssign": "true",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "ID": 100913,
                "InheritAllowDuplicateHost": "true",
                "InheritDefaultView": "true",
                "CIDR": "10.0.0.0/24",
                "DefaultView": "100907",
                "Type": "IP4Network",
                "Gateway": "10.0.0.1",
                "InheritDefaultDomains": "true",
                "Name": "East Office"
            },
            {
                "InheritPingBeforeAssign": "true",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "InheritAllowDuplicateHost": "true",
                "InheritDefaultView": "true",
                "CIDR": "10.0.0.0/21",
                "DefaultView": "100907",
                "Type": "IP4Block",
                "ID": 100912,
                "InheritDefaultDomains": "true",
                "Name": "Tampa"
            },
            {
                "InheritPingBeforeAssign": "true",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "InheritAllowDuplicateHost": "true",
                "InheritDefaultView": "true",
                "CIDR": "10.0.0.0/19",
                "DefaultView": "100907",
                "Type": "IP4Block",
                "ID": 100911,
                "InheritDefaultDomains": "true",
                "Name": "Florida"
            },
            {
                "InheritPingBeforeAssign": "true",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "InheritAllowDuplicateHost": "true",
                "InheritDefaultView": "true",
                "CIDR": "10.0.0.0/16",
                "DefaultView": "100907",
                "Type": "IP4Block",
                "ID": 100910,
                "InheritDefaultDomains": "true",
                "Name": "North America"
            },
            {
                "InheritPingBeforeAssign": "false",
                "InheritDNSRestrictions": "true",
                "LocationInherited": "true",
                "PingBeforeAssign": "disable",
                "AllowDuplicateHost": "disable",
                "InheritAllowDuplicateHost": "false",
                "InheritDefaultView": "false",
                "CIDR": "10.0.0.0/8",
                "DefaultView": "100907",
                "Type": "IP4Block",
                "ID": 100909,
                "InheritDefaultDomains": "true",
                "Name": "global"
            }
        ],
        "Address": "10.0.0.10",
        "Type": "IPv4",
        "ID": 100923
    }
}

Human Readable Output

10.0.0.10 IP Result:

ID	Name	Type	Address	State	Location Inherited
100923		IPv4	10.0.0.10	STATIC	true

Parents Details:

ID	Type	Name	CIDR	Allow Duplicate Host	Inherit Allow Duplicate Host	Ping Before Assign	Inherit Ping Before Assign	Location Inherited	Inherit Default Domains	Default View	Inherit Default View	Inherit DNS Restrictions
100909	IP4Block	global	10.0.0.0/8	disable	false	disable	false	true	true	100907	false	true
100910	IP4Block	North America	10.0.0.0/16	disable	true	disable	true	true	true	100907	true	true
100911	IP4Block	Florida	10.0.0.0/19	disable	true	disable	true	true	true	100907	true	true
100912	IP4Block	Tampa	10.0.0.0/21	disable	true	disable	true	true	true	100907	true	true
100913	IP4Network	East Office	10.0.0.0/24	disable	true	disable	true	true	true	100907	true	true

2. Get all response policies

Returns all response policies.

Base Command

bluecat-am-get-response-policies

Input

Argument Name	Description	Required
start	Start index from which to get the response policies. Default is 0.	Optional
count	Maximum number of response policies to return.	Optional

Context Output

Path	Type	Description
BlueCat.AddressManager.ResponsePolicies.ID	Number	ID of the response policy.
BlueCat.AddressManager.ResponsePolicies.Name	String	Name of the response policy.
BlueCat.AddressManager.ResponsePolicies.Ttl	Unknown	Time to live (TTL) of the response policy.
BlueCat.AddressManager.ResponsePolicies.Type	String	Type of the response policy (BLACKLIST, BLACKHOLE, WHITELIST, or REDIRECT).
BlueCat.AddressManager.ResponsePolicies.RedirectTarget	String	Target of redirect, in case of REDIRECT policy type.

Command Example

bluecat-am-get-response-policies start="0" count="30"

Context Example

{
    "BlueCat.AddressManager.ResponsePolicies": [
        {
            "RedirectTarget": "foo.com",
            "ResponsePolicyType": "REDIRECT",
            "Ttl": "30",
            "Type": "ResponsePolicy",
            "ID": 100930,
            "Name": "Malware Trap"
        }
    ]
}

Human Readable Output

Response Policies:

Malware Trap

ID	Name	Type	Ttl	ResponsePolicyType	RedirectTarget
100930	Malware Trap	ResponsePolicy	30	REDIRECT	foo.com

3. Search response policies by domain

Searches all response policies in which the given domain is included.

Base Command

bluecat-am-search-response-policies-by-domain

Input

Argument Name	Description	Required
domain	Domain name by which to search.	Required

Context Output

Path	Type	Description
BlueCat.AddressManager.ResponsePolicies.ID	Number	ID of the response policy.
BlueCat.AddressManager.ResponsePolicies.Name	String	Name of the response policy.
BlueCat.AddressManager.ResponsePolicies.Ttl	Unknown	Time to live (TTL) of the response policy
BlueCat.AddressManager.ResponsePolicies.Type	String	Type of the responce policy ( BLACKLIST, BLACKHOLE, WHITELIST, or REDIRECT).
BlueCat.AddressManager.ResponsePolicies.RedirectTarget	String	Target of redirect, in case of REDIRECT policy type.

Command Example

bluecat-am-search-response-policies-by-domain domain="demisto.com"

Human Readable Output

Could not find any response policy

4. Add a domain to a response policy

Adds a domain to the given response policy.

Base Command

bluecat-am-response-policy-add-domain

Input

Argument Name	Description	Required
policy_id	ID of the response policy to edit.	Required
domain	Domain to add to the response policy.	Required

Context Output

There is no context output for this command.

Command Example

bluecat-am-response-policy-add-domain policy_id="100930" domain="demisto.com"

Human Readable Output

Successfully added demisto.com to response policy 100930

5. Remove a domain from a response policy

Removes a domain from the given response policy.

Base Command

bluecat-am-response-policy-remove-domain

Input

Argument Name	Description	Required
policy_id	ID of the response policy to edit.	Required
domain	Domain to remove from the response policy.	Required

Context Output

There is no context output for this command.

Command Example

bluecat-am-response-policy-remove-domain policy_id="100930" domain="demisto.com"

Human Readable Output

Successfully removed demisto.com from response policy 100930

6. Get an IPv4 block containing an IPv4 address

Gets an IPv4 block, which contains a specified IPv4 address.

Base Command

bluecat-am-get-range-by-ip

Input

Argument Name	Description	Required
ip	The IP address for which to get the range.	Required

Context Output

Path	Type	Description
BlueCat.AddressManager.Range.ID	String	The address manager ID of the Range.
BlueCat.AddressManager.Range.Name	String	Name of the Range.
BlueCat.AddressManager.Range.Type	String	Type of the Range.
BlueCat.AddressManager.Range.Parents.ID	String	ID of the parent Range.
BlueCat.AddressManager.Range.Parents.Type	String	Type of the parent Range.
BlueCat.AddressManager.Range.Parents.Name	String	Name of the parent Range.
BlueCat.AddressManager.Range.Parents.CIDR	String	Classless Inter-Domain Routing.

Command Example

  !bluecat-am-get-range-by-ip ip=10.0.0.11

Human Readable Output

Configuration parameters

url — Server URL (e.g., https://192.168.0.1) (required)
credentials — Username (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
conf_name — Configuration Name

Commands (6)

bluecat-am-get-range-by-ip
Returns the IPv4 block that contains the specified IPv4 address.
bluecat-am-get-response-policies
Returns all response policies.
bluecat-am-query-ip
Enriches an IP address with data, including IP networks and blocks to which it belongs, linked IPs, MAC addresses, and more.
bluecat-am-response-policy-add-domain
Adds a domain to the given response policy.
bluecat-am-response-policy-remove-domain
Removes a domain from the given response policy.
bluecat-am-search-response-policies-by-domain
Searches all response policies in which the given domain is included.

Source

BluecatAddressManager.py BluecatAddressManager.yml BluecatAddressManager_description.md

Download History Raw

**This integration supports Bluecat Address Manager version 9.5**

When you configure an instance of the Bluecat Address Manager integration in Cortex XSOAR, you need to provide an API user account.

## Generate an API user account

1. Using the Address Manager web interface, log in to Address Manager as an administrator.
2. On the Administration page, click **Users and Groups**.
3. In the **Users** section, click **New**.
4. Enter a name in the **Username** field.
5. In the **Authentication** section, type and confirm the API user password in the **Password and ConfirmPassword** fields. If external authenticators are available, an **Other** checkbox and a list of authenticators appears in the **Authentication** section. To use an external authenticator for the API user, select the **Other** checkbox, and then select an authenticator from the list.
6. In the **Extra Information** section, set the following parameters for the API user. 
    - E-mail Address (required) 
    - Phone number (optional)
7. In the **User Access** section, define the user type, security, and history privileges, and access type.
    - Type of User: select either Non-Administrator or Administrator. Non-Administrator users have access only to DNS and IPAM management functions. Administrator users have unlimited access to all Address Manager functions.
    - Security Privilege: select a security privilege type from the drop-down list. This field is available only for Non-Administrator users with GUI, API, or GUI and API access.
    - History Privilege: select a history privilege type from the drop-down list. This field is available only for Non-Administrator users with GUI, or GUI and API access.
    - Access Type: select the type of access; GUI, API, or GUI and API. GUI users can access Address Manager only through the Address Manager web interface. API users can access Address Manager only through the API. GUI and API users can access Address Manager either through the Address Manager web interface or the API.
8. In the **Assign to Group** section, To assign the user to one or more existing user groups, go to Assign to Group section, and enter the name of a use group. Select a name from the list, and then click **Add**.
9. (optional) In the **Change Control** section, add comments to describe the changes. Although this step is optional but maybe set to be required.
10. Click **Add**.

About Integration Parameters:
* **Configuration Name:** In case you have more than one configuration set up, you can use this parameter to manually set the configuration you want the instance to run on, otherwise, if no value was given, the integration will use the first configuration it can find.