CarbonBlackEndpointStandardEventCollector

Details

ID	`CarbonBlackEndpointStandardEventCollector`
Provider	Broadcom
Category	Endpoint
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Endpoint Standard (formerly called Carbon Black Defense), a Next-Generation Anti-Virus + EDR. Collect Anti-Virus & EDR alerts and Audit Log Events.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Carbon Black Endpoint Standard Event Collector in Cortex

Parameter	Description	Required
Server URL		True
API ID	The API Key to use for connection	True
API Secret Key		True
Organization Key		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Include Audit Logs		False
Maximum number of alerts per fetch	Default 100,000.	False
Maximum number of audit logs per fetch	Default 25,000.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

carbonblack-endpoint-standard-get-events

Fetch alerts and audit logs from Carbon Black Endpoint Standard.

Base Command

carbonblack-endpoint-standard-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display the events. Possible values are: true, false. Default is false.	Required
alerts_limit	The maximum number of alerts to return (maximum value - 100000). Default is 10000.	Optional
audit_logs_limit	The maximum number of audit logs to return (maximum value - 25000). Default is 2500.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — API ID (required)
org_key — Organization Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
add_audit_logs — Include Audit Logs
max_alerts — Maximum number of alerts per fetch
max_audit_logs — Maximum number of audit logs per fetch

Commands (1)

carbonblack-endpoint-standard-get-events
Fetch alerts and audit logs from Carbon Black Endpoint Standard.

Source

CarbonBlackEndpointStandardEventCollector.py CarbonBlackEndpointStandardEventCollector_test.py CarbonBlackEndpointStandardEventCollector.yml CarbonBlackEndpointStandardEventCollector_description.md command_examples.txt

Download History Raw

import json

import pytest
from CarbonBlackEndpointStandardEventCollector import (
    LAST_ALERT_IDS,
    LAST_AUDIT_TIME,
    MAX_AUDITS,
    MAX_FETCH_LOOP,
    Client,
    get_alerts_to_limit,
    get_audit_logs_to_limit,
    get_events,
    init_last_run,
    prepare_audit_logs_result,
    timestamp_to_datestring,
)


def util_load_json(path):
    with open(path) as f:
        return json.loads(f.read())


@pytest.fixture
def cb_client():
    return Client(url="https://test.com", org_key="test", credentials={})


@pytest.fixture
def alerts():
    return util_load_json("test_data/alerts.json")


@pytest.fixture
def audit_logs():
    return util_load_json("test_data/audit_logs.json")


@pytest.fixture
def last_run():
    return init_last_run({})


def test_get_alerts_to_limit_empty(mocker, cb_client, last_run):
    """
    Given a CB client and last run
    When get_alerts_to_limit is called and empty response returned
    Then empty list is returned and last_run is returned unchanged
    """

    mocker.patch.object(cb_client, "get_alerts", return_value=[])

    alerts, new_last_run = get_alerts_to_limit(cb_client, last_run)

    assert len(alerts) == 0
    assert new_last_run.get(LAST_AUDIT_TIME) is None
    assert new_last_run.get(LAST_ALERT_IDS) == []
    assert new_last_run == last_run


def test_prepare_audit_logs_result_remove_duplicates(cb_client, audit_logs):
    """
    Given: audit logs contain duplicate entries
    When: calling prepare_audit_logs_result
    Then: Filter out duplicate entries based on eventTime and return the filtered list
    """
    last_time = timestamp_to_datestring(audit_logs[2]["eventTime"])
    filtered_audit_logs = prepare_audit_logs_result(audit_logs, last_time)
    assert len(audit_logs) == len(filtered_audit_logs) + 2


def test_get_events(mocker, cb_client, last_run):
    """
    Given there are no events and no audits to fetch
    When get_events is called
    Then return no events and the last_run unchanged
    """

    mocker.patch.object(cb_client, "get_alerts", return_value=[])
    mocker.patch.object(cb_client, "get_audit_logs", return_value=[])

    events, new_last_run = get_events(cb_client, last_run, True)

    assert len(events) == 0
    assert new_last_run == last_run


def test_get_audit_logs_to_limit_max(mocker, cb_client, audit_logs):
    """
    Given there are 11 audit logs pages to fetch
    When  get_audit_logs_to_limit is called
    Then  10 pages are returned
    """
    mocker.patch.object(cb_client, "get_audit_logs", return_value=[audit_logs] * (MAX_FETCH_LOOP + 1))
    audit_logs = get_audit_logs_to_limit(cb_client)
    assert len(audit_logs) < MAX_AUDITS
    assert cb_client.get_audit_logs.call_count == MAX_FETCH_LOOP