Details
| ID | BoxEventsCollector |
|---|---|
| Provider | Box |
| Category | Analytics & SIEM |
| From Version | 6.6.0 |
| Docker Image | demisto/auth-utils:1.0.0.11206988 |
| Supported Modules | Agentix XSIAM |
README
Box Event Collector
Collect events from Box’s logs.
Permissions
The command is using the events endpoint with enterprise login.
The user making the API call will need to have admin privileges, and the application will need to have the scope manage enterprise properties checked.
This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.
Configure Box Event Collector in Cortex
To acquire the “Credential JSON”, you need to get a JWT token and an app from Box.
You can use the guide from Box V2 to get those credentials.
| Parameter | Required |
|---|---|
| Verify SSL Certificate | False |
| Credentials JSON | True |
| Fetch Events | False |
| First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) | False |
| Maximum number of events per fetch | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
box-get-events
Get events.
Base Command
box-get-events
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Maximum events to fetch. Default is 10. | Optional |
| created_after | Fetch events from this time (<number> <time unit>, e.g., 12 hours, 7 days). Default is 3 days. | Optional |
Context Output
There is no context output for this command.
Command example
!box-get-events limit=1 created_after="30 days"
Context Example
{
"BoxEvents": {
"action_by": null,
"additional_details": null,
"created_at": "2022-04-10T05:39:15-07:00",
"created_by": {
"id": "00000000000",
"login": "johndoe@example.com",
"name": "John Doe",
"type": "user"
},
"event_id": "event_id",
"event_type": "ADD_LOGIN_ACTIVITY_DEVICE",
"ip_address": "ip_address",
"session_id": null,
"source": {
"id": "00000000000",
"login": "johndoe@example.com",
"name": "John Doe",
"type": "user"
},
"type": "event"
}
}
Human Readable Output
Results
action_by additional_details created_at created_by event_id event_type ip_address session_id source type 2022-04-10T05:39:15-07:00 type: user
id: 0000000000
name: John Doe
login: johndoe@example.comevent_id ADD_LOGIN_ACTIVITY_DEVICE ip_address type: user
id: 0000000000
name: John Doe
login: johndoe@example.comevent
Troubleshooting & Advanced Configuration
Each fetch cycle collects up to the Maximum number of events per fetch value (default 2500, capped internally at 5000) and then persists its position, so events are collected incrementally across cycles.
If ingestion is falling behind on a high-volume tenant (events arrive faster than they are collected), you can help the collector keep up by:
- Increasing Maximum number of events per fetch (up to
5000) so each cycle collects more events. - Decreasing Events Fetch Interval (for example, to 1 minute) so cycles run more frequently.
Configuration parameters
url— Server URL (required)credentials_json— (required)proxy— Use system proxy settingsinsecure— Trust any certificate (not secure)isFetchEvents— Fetch Eventscreated_after— First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)max_events_per_fetch— Maximum number of events per fetcheventFetchInterval— Events Fetch Interval
Commands (1)
-
box-get-eventsGets events from Box. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
name: BoxEventsCollector display: Box Event Collector description: Collect events from Box's logs. category: Analytics & SIEM provider: Box supportlevelheader: xsoar sectionorder: - Connect - Collect commonfields: id: BoxEventsCollector version: -1 configuration: - display: "Server URL" name: url type: 0 required: true defaultvalue: 'https://api.box.com' additionalinfo: "The url of the box api" section: Connect - display: "" name: credentials_json type: 9 required: true displaypassword: Credentials JSON hiddenusername: true section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Fetch Events name: isFetchEvents type: 8 required: false section: Collect - defaultvalue: 1 days display: |- First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) name: created_after type: 0 required: false section: Collect - display: Maximum number of events per fetch name: max_events_per_fetch type: 0 defaultvalue: '2500' required: false additionalinfo: "The maximum total number of events to fetch per fetch cycle (max 5000; higher values are capped). If you're encountering fetch timeouts on a high-volume backlog, decrease this value." section: Collect - display: Events Fetch Interval name: eventFetchInterval type: 19 defaultvalue: '1' required: false section: Collect advanced: true script: commands: - arguments: - description: The maximum total number of events to fetch. name: limit defaultValue: 10 - description: Should push events. name: should_push_events defaultValue: 'false' - description: Fetch events from this time (<number> <time unit>, e.g., 12 hours, 7 days). name: created_after defaultValue: 3 days description: Gets events from Box. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism. name: box-get-events dockerimage: demisto/auth-utils:1.0.0.11206988 runonce: false script: '-' subtype: python3 type: python isfetchevents: true marketplaces: - marketplacev2 - platform tests: - No tests fromversion: 6.6.0 supportedModules: - xsiam