Details

ID	`CiscoThousandEyes`
Provider	Cisco Systems
Category	Data Enrichment & Threat Intelligence
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Cisco ThousandEyes Integration for Cortex XSIAM

This is the Cisco ThousandEyes event collector integration for Cortex XSIAM. This integration enables you to fetch events such as alerts and audit logs from Cisco ThousandEyes and process them within Cortex XSIAM.

This integration was developed and tested with version 1.0.0 of Cisco ThousandEyes.

Configure CiscoThousandEyes in Cortex XSIAM

Navigate to Settings > Configurations > Automation & Feed Integrations.
Search for CiscoThousandEyes.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Server URL	The URL of the Cisco ThousandEyes server (e.g., `https://api.thousandeyes.com`).	True
User API Token	The API token for authenticating with Cisco ThousandEyes.	True
The maximum number of audit events per fetch	Maximum number of audit events to retrieve per fetch cycle. Default is 50.	False
The maximum number of alerts per fetch	Maximum number of alert events to retrieve per fetch cycle. Default is 50.	False
Trust any certificate (not secure)	If enabled, the integration will trust self-signed certificates.	False
Use system proxy settings	If enabled, the integration will use the system proxy settings.	False

Note

This API returns a list of activity log events in the current account group.
If the user has View activity log permission for all users in the account group, the logs returned include events across all the account groups they belong to.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cisco-thousandeyes-get-events

Gets events from Cisco ThousandEyes.

Base Command

!cisco-thousandeyes-get-events

Input

Argument Name	Description	Required
limit	The number of events to return. Default is 10.	Optional
start_date	The start date from which to filter events.	Optional
end_date	The end date to which to filter events.	Optional
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Optional

Example Usage

!cisco-thousandeyes-get-events limit="100" start_date="2024-10-10T00:00:00Z" should_push_events=true

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
api_token — (required)
max_events_per_fetch — The maximum number of audit events per fetch.
max_alerts_per_fetch — The maximum number of alerts per fetch.
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

cisco-thousandeyes-get-events
Gets events from Cisco ThousandEyes.

Source

CiscoThousandEyes.py CiscoThousandEyes_test.py CiscoThousandEyes.yml CiscoThousandEyes_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Cisco Systems
sectionorder:
- Connect
- Collect
commonfields:
  id: CiscoThousandEyes
  version: -1
configuration:
- defaultvalue: https://api.thousandeyes.com
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: User API Token
  name: api_token
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- defaultvalue: 5000
  section: Collect
  display: The maximum number of audit events per fetch.
  name: max_events_per_fetch
  required: false
  type: 0
  advanced: true
- defaultvalue: 2500
  section: Collect
  display: The maximum number of alerts per fetch.
  name: max_alerts_per_fetch
  required: false
  type: 0
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
description: This is the Cisco ThousandEyes event collector integration for Cortex XSIAM.
display: Cisco ThousandEyes
name: CiscoThousandEyes
script:
  commands:
  - arguments:
    - description: The number of events (per event type) to return.
      name: limit
      defaultValue: 10
    - description: The start date from which to filter events.
      name: start_date
    - description: The end date to which to filter events.
      name: end_date
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Gets events from Cisco ThousandEyes.
    execution: false
    name: cisco-thousandeyes-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam