Details

ID	`CiscoThousandEyes`
Provider	Cisco Systems
Category	Data Enrichment & Threat Intelligence
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Cisco ThousandEyes Integration for Cortex XSIAM

This is the Cisco ThousandEyes event collector integration for Cortex XSIAM. This integration enables you to fetch events such as alerts and audit logs from Cisco ThousandEyes and process them within Cortex XSIAM.

This integration was developed and tested with version 1.0.0 of Cisco ThousandEyes.

Configure CiscoThousandEyes in Cortex XSIAM

Navigate to Settings > Configurations > Automation & Feed Integrations.
Search for CiscoThousandEyes.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Server URL	The URL of the Cisco ThousandEyes server (e.g., `https://api.thousandeyes.com`).	True
User API Token	The API token for authenticating with Cisco ThousandEyes.	True
The maximum number of audit events per fetch	Maximum number of audit events to retrieve per fetch cycle. Default is 50.	False
The maximum number of alerts per fetch	Maximum number of alert events to retrieve per fetch cycle. Default is 50.	False
Trust any certificate (not secure)	If enabled, the integration will trust self-signed certificates.	False
Use system proxy settings	If enabled, the integration will use the system proxy settings.	False

Note

This API returns a list of activity log events in the current account group.
If the user has View activity log permission for all users in the account group, the logs returned include events across all the account groups they belong to.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cisco-thousandeyes-get-events

Gets events from Cisco ThousandEyes.

Base Command

!cisco-thousandeyes-get-events

Input

Argument Name	Description	Required
limit	The number of events to return. Default is 10.	Optional
start_date	The start date from which to filter events.	Optional
end_date	The end date to which to filter events.	Optional
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Optional

Example Usage

!cisco-thousandeyes-get-events limit="100" start_date="2024-10-10T00:00:00Z" should_push_events=true

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
api_token — (required)
max_events_per_fetch — The maximum number of audit events per fetch.
max_alerts_per_fetch — The maximum number of alerts per fetch.
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

cisco-thousandeyes-get-events
Gets events from Cisco ThousandEyes.

Source

CiscoThousandEyes.py CiscoThousandEyes_test.py CiscoThousandEyes.yml CiscoThousandEyes_description.md command_examples.txt

Download History Raw

# Cisco ThousandEyes

Use this integration to fetch audit logs, and alerts from **Cisco ThousandEyes** as events in Cortex XSIAM.

## Note:
>This API returns a list of activity log events **in the current account group**. 
If the user has View activity log permission for all users in the account group, the logs returned include events across all the account groups they belong to.

## Creating a User API Token in Cisco ThousandEyes
Before you configure the integration, retrieve the User API Token from your Cisco ThousandEyes account:

For users with API access enabled (i.e., users with the API access permission), the User API Tokens section is visible, containing the API authentication tokens.

Two types of API authentication token are available: a token for HTTP Basic authentication and a token for OAuth-based authentication.

To issue or regenerate a user API token, you will need to receive and enter a multi-factor authentication (MFA) code sent to the email attached to the current user, to confirm the user permissions.

Click [here](https://docs.thousandeyes.com/product-documentation/user-management/rbac#user-api-tokens) for User API Tokens documentation.

## Obtaining your Bearer Token

In order to interact with the ThousandEyes API, you must first obtain a bearer token.
Open your ThousandEyes dashboard.
Once logged in, navigate to **Account Settings** > **Users and Roles** > **Profile** > **User API Tokens**.

Click [here](https://developer.cisco.com/docs/thousandeyes/authentication/#obtaining-your-bearer-token) for help.