Claroty

Use the Claroty CTD integration to manage assets and alerts.

Network Security · Claroty

Details

IDClaroty
ProviderClaroty
CategoryNetwork Security
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Use the Claroty CTD integration to manage assets and alerts.
This integration was integrated and tested with version 4.0.1 of Claroty

Claroty Playbook

Playbook 1: OT Asset Discovery
Maintaining an accurate enterprise asset database is extremely difficult,
but without it effective security is near impossible. This playbook automates the population and maintenance of the
enterprise’s configuration management database (CMDB) with OT asset information.
The rich contextual data provided for each asset makes it realistic to prioritize security processes and actions
based on the CMDB.
Proactive vulnerability management is a fundamental control because it hardens assets against the most common exploits
seen in the wild. This playbook automates OT vulnerability management: it identifies high-severity vulnerabilities on
OT assets, and creates context-rich tickets in the enterprise service manager for action. Crucially, it focuses on
high-risk issues on truly important assets, so that non-critical issues do not overwhelm the vulnerability management
process and obfuscate the issues that demand immediate attention.

Playbook 3: OT Threat Detection Alerts
In order to scale, enterprises must centralize and automate the processing of alerts that are indicators of risk or
compromise. This playbook automates the passing of OT threat detection alerts from the Claroty CTD system to the
enterprise SIEM and ticketing system. CTD correlates the alert with asset and flow information observed in the OT
environment and passes it upstream via the integration, allowing security analysts to quickly evaluate the alert and
take corrective action if necessary.

Use Cases

Retrieve and resolve alerts related to OT devices (communicating outside of the network,
policy violations such as active outside working hours, etc.)

Insights: get information about vulnerable assets in the network (retrieve vulnerabilities and CVEs per asset,
divide according to CVE risk and mitigate accordingly (high will have different mitigation steps)

Configure Claroty on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Claroty.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • CTD Server URL (e.g. https://<IP>:5000)
    • Username
    • Trust any certificate (not secure)
    • Use system proxy settings
    • Incident type
    • Fetch incidents
    • The initial time to fetch from
    • Minimal severity to fetch by
    • Site ID to fetch by
    • Fetch by alert type
    • Exclude resolved alerts
    • Include only ARR completed alerts
  4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. claroty-get-assets
  2. claroty-query-alerts
  3. claroty-resolve-alert
  4. claroty-get-single-alert

1. claroty-get-assets

Gets all assets from CTD. You can apply one or more filters.

Required Permissions

Admin user.

Base Command

claroty-get-assets

Input
Argument Name Description Required
fields Asset fields to return. The default value is “all”. Optional
criticality Returns assets with this criticality. Can be “Low”, “Medium”, or “High”. Optional
insight_name Get assets with that include the given insight name Optional
should_enrich_assets Add aditional value for the asset CVEs. Optional
asset_limit Maximal value of assets to query at once. Optional
assets_last_seen Get all assets seen last from the given date. Format - YYYY-MM-DDThh:mm:ssZ. Example - 2020-02-02T01:02:03Z Optional
Context Output
Path Type Description
Claroty.Asset.AssetID Number The ID of the asset.
Claroty.Asset.AssetType String The asset type.
Claroty.Asset.CVE.CVSS String CVE Score.
Claroty.Asset.CVE.Description String CVE Description.
Claroty.Asset.CVE.ID String CVE ID.
Claroty.Asset.CVE.Modified Date CVE modification date.
Claroty.Asset.CVE.Published Date CVE publish date.
CVE.CVSS String CVE Score.
CVE.Description String CVE Description.
CVE.ID String CVE ID.
CVE.Modified Date CVE modification date.
CVE.Published Date CVE publish date.
Claroty.Asset.ClassType String The OT/IT class type.
Claroty.Asset.Criticality String The criticality of the asset, according to the Purdue model.
Claroty.Asset.FirmwareVersion String The FM version of the asset.
Claroty.Asset.HighestCVEScore Number Highest CVE Score for the Asset.
Claroty.Asset.IP String The IPv4 address of the asset.
Claroty.Asset.InsightName String The asset insight names generated by CTD.
Claroty.Asset.LastSeen Date The date the asset was last seen.
Claroty.Asset.MAC String The MAC address of the asset.
Claroty.Asset.Name String The asset name.
Claroty.Asset.ResourceID String The asset RID (AssetID-SiteID).
Claroty.Asset.RiskLevel Number The risk indicator.
Claroty.Asset.SiteID Number The site ID of the asset.
Claroty.Asset.SiteName String The site name of the asset.
Claroty.Asset.Vendor String The vendor of the asset.
Claroty.Asset.VirtualZone String The virtual zone of the asset.
Claroty.Asset.WasParsed String Whether the project was parsed.
Command Example

!claroty-get-assets asset_limit=1 criticality=High should_enrich_assets=True

Context Example
{
    "CVE": [
        [
            {
                "ID": "RA-470154-1", 
                "Published": "2012-01-19", 
                "CVSS": "8.8", 
                "Modified": "2018-01-11", 
                "Description": "Denial of Service by receiving valid CIP message"
            }, 
            {
                "ID": "RA-470154-3", 
                "Published": "2012-01-19", 
                "CVSS": "8.8", 
                "Modified": "2018-01-11", 
                "Description": "Denial of Service (reset the product) by receiving valid CIP message"
            }, 
            {
                "ID": "RA-470155-1", 
                "Published": "2012-01-19", 
                "CVSS": "8.8", 
                "Modified": "2018-01-11", 
                "Description": "Denial of Service by receiving malformed CIP packet"
            }
        ]
    ], 
    "Claroty.Asset": [
        {
            "ResourceID": "9-1", 
            "AssetType": "PLC", 
            "Vendor": "Rockwell Automation", 
            "Name": "10.1.0.10", 
            "Criticality": "High", 
            "AssetID": 9, 
            "ClassType": "OT", 
            "SiteName": "site-1", 
            "InsightName": [
                "Full Match CVEs", 
                "Open Ports"
            ], 
            "VirtualZone": "PLC: Rockwell", 
            "RiskLevel": 1, 
            "MAC": [
                "E4:90:69:A7:70:0F"
            ], 
            "SiteID": 1, 
            "HighestCVEScore": 8.8, 
            "IP": [
                "10.1.0.10"
            ], 
            "WasParsed": null, 
            "CVE": [
                {
                    "ID": "RA-470154-1", 
                    "Published": "2012-01-19", 
                    "CVSS": "8.8", 
                    "Modified": "2018-01-11", 
                    "Description": "Denial of Service by receiving valid CIP message"
                }, 
                {
                    "ID": "RA-470154-3", 
                    "Published": "2012-01-19", 
                    "CVSS": "8.8", 
                    "Modified": "2018-01-11", 
                    "Description": "Denial of Service (reset the product) by receiving valid CIP message"
                }, 
                {
                    "ID": "RA-470155-1", 
                    "Published": "2012-01-19", 
                    "CVSS": "8.8", 
                    "Modified": "2018-01-11", 
                    "Description": "Denial of Service by receiving malformed CIP packet"
                }
            ], 
            "FirmwareVersion": "V4.003", 
            "LastSeen": "2020-02-19T07:42:16+00:00"
        }
    ]
}
Human Readable Output

Claroty Asset List

AssetID AssetType CVE ClassType Criticality FirmwareVersion HighestCVEScore IP InsightName LastSeen MAC Name ResourceID RiskLevel SiteID SiteName Vendor VirtualZone WasParsed
9 PLC {‘ID’: ‘RA-470154-1’, ‘CVSS’: ‘8.8’, ‘Published’: ‘2012-01-19’, ‘Modified’: ‘2018-01-11’, ‘Description’: ‘Denial of Service by receiving valid CIP message’},
{‘ID’: ‘RA-470154-3’, ‘CVSS’: ‘8.8’, ‘Published’: ‘2012-01-19’, ‘Modified’: ‘2018-01-11’, ‘Description’: ‘Denial of Service (reset the product) by receiving valid CIP message’},
{‘ID’: ‘RA-470155-1’, ‘CVSS’: ‘8.8’, ‘Published’: ‘2012-01-19’, ‘Modified’: ‘2018-01-11’, ‘Description’: ‘Denial of Service by receiving malformed CIP packet’}		 OT High V4.003 8.8 10.1.0.10 Full Match CVEs,
Open Ports		 2020-02-19T07:42:16+00:00 E4:90:69:A7:70:0F 10.1.0.10 9-1 1 1 site-1 Rockwell Automation PLC: Rockwell  

2. claroty-query-alerts

Gets alerts from CTD.

Required Permissions

Admin user.

Base Command

claroty-query-alerts

Input
Argument Name Description Required
fields Alert fields to return. Optional
sort_by The field by which to sort the results. The default value is “timestamp”.
Default sort order is ascending		 Optional
type Returns alerts that match this alert type. Optional
date_from The start date from which to get alerts. Format - YYYY-MM-DDThh:mm:ssZ. Example - 2020-02-02T01:02:03Z Optional
sort_order The sorting order of the alerts - descending or ascending Optional
alert_limit The maximum number of alerts to query. Optional
minimal_severity Set minimal severity to query by. Optional
exclude_resolved_alerts Returns only unresloved alerts. Optional
include_only_arr_completed_alerts Includes only alerts that have completed their initial Automated Resolution Rules flow. Default is False. Optional
Context Output
Path Type Description
Claroty.Alert.AlertType String The alert type.
Claroty.Alert.AlertTypeID Number The alert type int value
Claroty.Alert.Description String The alert description.
Claroty.Alert.Indicator String The alert indicators.
Claroty.Alert.NetworkID Number The network ID.
Claroty.Alert.RelatedAssets String Assets related to the alert.
Claroty.Alert.RelatedAssets.AssetID Number The ID of the asset.
Claroty.Alert.RelatedAssets.AssetType String The asset type.
Claroty.Alert.RelatedAssets.ClassType String The OT/IT class type.
Claroty.Alert.RelatedAssets.Criticality String The criticality of the asset, according to the Purdue model.
Claroty.Alert.RelatedAssets.FirmwareVersion String The FM version of the asset.
Claroty.Alert.RelatedAssets.IP String The IPv4 address of the asset.
Claroty.Alert.RelatedAssets.InsightName String The asset insight names generated by CTD.
Claroty.Alert.RelatedAssets.LastSeen Date The date the asset was last seen.
Claroty.Alert.RelatedAssets.MAC String The MAC address of the asset.
Claroty.Alert.RelatedAssets.Name String The asset name.
Claroty.Alert.RelatedAssets.ResourceID String The asset RID (AssetID-SiteID).
Claroty.Alert.RelatedAssets.RiskLevel Number The risk indicator.
Claroty.Alert.RelatedAssets.SiteID Number The site ID of the asset.
Claroty.Alert.RelatedAssets.SiteName String The site name of the asset.
Claroty.Alert.RelatedAssets.Vendor String The vendor of the asset.
Claroty.Alert.RelatedAssets.VirtualZone String The virtual zone of the asset.
Claroty.Alert.RelatedAssets.WasParsed String Whether the project was parsed.
Claroty.Alert.Resolved Number The resolve status of the alert.
Claroty.Alert.ResourceID String The alert resource ID (AlertID-SiteID).
Claroty.Alert.Severity String The alert severity.
Claroty.Alert.Category String The alert category.
Claroty.Alert.InitialArrFlowCompleted Number Whether the alert has completed its initial Automated Resolution Rules flow.
Command Example

!claroty-query-alerts alert_limit=1 type=`Known Threat Alert`

Context Example
{
    "Claroty.Alert": [
        {
            "Category": "Security", 
            "NetworkID": 1, 
            "Indicator": "Alert ID - 14\r\nDescription - Event occurred out of working hours\r\nPoints - 10\r\n\nAlert ID - 14\r\nDescription - First time over the past 30 days, this Threat Signature is seen in the network\r\nPoints - 100\r\n\n", 
            "AlertType": "KnownThreatAlert", 
            "Description": "Known Threat: Threat ET TROJAN Conficker.b Shellcode was detected from 192.168.0.121 to 192.168.0.100", 
            "ResourceID": "14-1", 
            "AlertTypeID": 23, 
            "RelatedAssets": [
                {
                    "ResourceID": "15-1", 
                    "AssetType": "Endpoint", 
                    "Vendor": "Advantech Technology", 
                    "Name": "GTWB", 
                    "Criticality": null, 
                    "AssetID": 15, 
                    "IP": null, 
                    "SiteName": null, 
                    "VirtualZone": null, 
                    "RiskLevel": null, 
                    "MAC": [
                        "00:0B:AB:1A:DD:DD"
                    ], 
                    "SiteID": 1, 
                    "InsightName": null, 
                    "ClassType": null, 
                    "WasParsed": null, 
                    "FirmwareVersion": null, 
                    "LastSeen": null
                }, 
                {
                    "ResourceID": "33-1", 
                    "AssetType": "Endpoint", 
                    "Vendor": "Advantech Technology", 
                    "Name": "OISERVM", 
                    "Criticality": null, 
                    "AssetID": 33, 
                    "IP": null, 
                    "SiteName": null, 
                    "VirtualZone": null, 
                    "RiskLevel": null, 
                    "MAC": [
                        "00:0B:AB:1A:DE:BE", 
                        "00:0B:AB:1A:DE:BF"
                    ], 
                    "SiteID": 1, 
                    "InsightName": null, 
                    "ClassType": null, 
                    "WasParsed": null, 
                    "FirmwareVersion": null, 
                    "LastSeen": null
                }, 
                {
                    "ResourceID": "19-1", 
                    "AssetType": "Endpoint", 
                    "Vendor": "Advantech Technology", 
                    "Name": "GTWA", 
                    "Criticality": null, 
                    "AssetID": 19, 
                    "IP": null, 
                    "SiteName": null, 
                    "VirtualZone": null, 
                    "RiskLevel": null, 
                    "MAC": [
                        "00:0B:AB:1A:DD:F8"
                    ], 
                    "SiteID": 1, 
                    "InsightName": null, 
                    "ClassType": null, 
                    "WasParsed": null, 
                    "FirmwareVersion": null, 
                    "LastSeen": null
                }, 
                {
                    "ResourceID": "18-1", 
                    "AssetType": "Endpoint", 
                    "Vendor": "Advantech Technology", 
                    "Name": "DRWSTN", 
                    "Criticality": null, 
                    "AssetID": 18, 
                    "IP": null, 
                    "SiteName": null, 
                    "VirtualZone": null, 
                    "RiskLevel": null, 
                    "MAC": [
                        "00:0B:AB:1A:DE:BC"
                    ], 
                    "SiteID": 1, 
                    "InsightName": null, 
                    "ClassType": null, 
                    "WasParsed": null, 
                    "FirmwareVersion": null, 
                    "LastSeen": null
                }, 
                {
                    "ResourceID": "17-1", 
                    "AssetType": "Endpoint", 
                    "Vendor": "Dell", 
                    "Name": "OISERVR", 
                    "Criticality": null, 
                    "AssetID": 17, 
                    "IP": null, 
                    "SiteName": null, 
                    "VirtualZone": null, 
                    "RiskLevel": null, 
                    "MAC": [
                        "F0:4D:A2:EF:FF:11"
                    ], 
                    "SiteID": 1, 
                    "InsightName": null, 
                    "ClassType": null, 
                    "WasParsed": null, 
                    "FirmwareVersion": null, 
                    "LastSeen": null
                }
            ], 
            "Resolved": true, 
            "Severity": "Critical"
        }
    ]
}
Human Readable Output

Claroty Alert List

AlertType AlertTypeID Category Description Indicator NetworkID RelatedAssets Resolved ResourceID Severity
KnownThreatAlert 23 Security Known Threat: Threat ET TROJAN Conficker.b Shellcode was detected from 192.168.0.121 to 192.168.0.100 Alert ID - 14
Description - Event occurred out of working hours
Points - 10

Alert ID - 14
Description - First time over the past 30 days, this Threat Signature is seen in the network
Points - 100

 1 {‘AssetID’: 15, ‘Name’: ‘GTWB’, ‘InsightName’: None, ‘Vendor’: ‘Advantech Technology’, ‘Criticality’: None, ‘AssetType’: ‘Endpoint’, ‘LastSeen’: None, ‘IP’: None, ‘MAC’: [‘00:0B:AB:1A:DD:DD’], ‘VirtualZone’: None, ‘ClassType’: None, ‘SiteName’: None, ‘SiteID’: 1, ‘WasParsed’: None, ‘RiskLevel’: None, ‘FirmwareVersion’: None, ‘ResourceID’: ‘15-1’},
{‘AssetID’: 33, ‘Name’: ‘OISERVM’, ‘InsightName’: None, ‘Vendor’: ‘Advantech Technology’, ‘Criticality’: None, ‘AssetType’: ‘Endpoint’, ‘LastSeen’: None, ‘IP’: None, ‘MAC’: [‘00:0B:AB:1A:DE:BE’, ‘00:0B:AB:1A:DE:BF’], ‘VirtualZone’: None, ‘ClassType’: None, ‘SiteName’: None, ‘SiteID’: 1, ‘WasParsed’: None, ‘RiskLevel’: None, ‘FirmwareVersion’: None, ‘ResourceID’: ‘33-1’},
{‘AssetID’: 19, ‘Name’: ‘GTWA’, ‘InsightName’: None, ‘Vendor’: ‘Advantech Technology’, ‘Criticality’: None, ‘AssetType’: ‘Endpoint’, ‘LastSeen’: None, ‘IP’: None, ‘MAC’: [‘00:0B:AB:1A:DD:F8’], ‘VirtualZone’: None, ‘ClassType’: None, ‘SiteName’: None, ‘SiteID’: 1, ‘WasParsed’: None, ‘RiskLevel’: None, ‘FirmwareVersion’: None, ‘ResourceID’: ‘19-1’},
{‘AssetID’: 18, ‘Name’: ‘DRWSTN’, ‘InsightName’: None, ‘Vendor’: ‘Advantech Technology’, ‘Criticality’: None, ‘AssetType’: ‘Endpoint’, ‘LastSeen’: None, ‘IP’: None, ‘MAC’: [‘00:0B:AB:1A:DE:BC’], ‘VirtualZone’: None, ‘ClassType’: None, ‘SiteName’: None, ‘SiteID’: 1, ‘WasParsed’: None, ‘RiskLevel’: None, ‘FirmwareVersion’: None, ‘ResourceID’: ‘18-1’},
{‘AssetID’: 17, ‘Name’: ‘OISERVR’, ‘InsightName’: None, ‘Vendor’: ‘Dell’, ‘Criticality’: None, ‘AssetType’: ‘Endpoint’, ‘LastSeen’: None, ‘IP’: None, ‘MAC’: [‘F0:4D:A2:EF:FF:11’], ‘VirtualZone’: None, ‘ClassType’: None, ‘SiteName’: None, ‘SiteID’: 1, ‘WasParsed’: None, ‘RiskLevel’: None, ‘FirmwareVersion’: None, ‘ResourceID’: ‘17-1’}		 true 14-1 Critical

3. claroty-resolve-alert

Resolves alerts.

Required Permissions

Admin user.

Base Command

claroty-resolve-alert

Input
Argument Name Description Required
selected_alerts The ResourceId of the Alerts to resolve (in - format) Required
resolve_as How to resolve the alert. Can be “archive” or “resolve”. The default value is “resolve”. Optional
resolve_comment A comment to add when resolving an alert. Optional
Context Output
Path Type Description
Claroty.Resolve_out.success String Success output of alert resolving.
Command Example

!claroty-resolve-alert selected_alerts="75-1" resolve_as=archive resolve_comment="Claroty is much wow!"

Context Example
{
    "Claroty.Resolve_out": {
        "success": true
    }
}
Human Readable Output

Alert was resolved successfully

4. claroty-get-single-alert

Get a single alert from CTD.

Required Permissions

Admin user.

Base Command

claroty-get-single-alert

Input
Argument Name Description Required
fields Asset fields to return. The default value is “all”. Optional
alert_rid Resource ID of the desired alert. Expected value - - Required
Context Output
Path Type Description
Claroty.Alert.AlertType String The alert type.
Claroty.Alert.AlertTypeID Number The alert type int value
Claroty.Alert.Description String The alert description.
Claroty.Alert.Indicator String The alert indicators.
Claroty.Alert.NetworkID Number The network ID.
Claroty.Alert.RelatedAssets String Assets related to the alert.
Claroty.Alert.Resolved Number The resolve status of the alert.
Claroty.Alert.ResourceID String The alert resource ID (AlertID-SiteID).
Claroty.Alert.Severity String The alert severity.
Command Example

!claroty-get-single-alert alert_rid="75-1"

Context Example
{
    "Claroty.Alert": {
        "Category": "Integrity", 
        "NetworkID": 1, 
        "Indicator": "Alert ID - 75\r\nDescription - This Event does not currently support Alert Indicators\r\nPoints - 100\r\n\n", 
        "AlertType": "PortScan", 
        "Description": "UDP Port scan: Asset 192.168.1.10 sent probe packets to 192.168.1.25 IP address on different ports", 
        "ResourceID": "75-1", 
        "AlertTypeID": 28, 
        "RelatedAssets": [
            {
                "ResourceID": "47-1", 
                "AssetType": "Endpoint", 
                "Vendor": "Hewlett Packard", 
                "Name": "192.168.1.10", 
                "Criticality": "Low", 
                "AssetID": 47, 
                "IP": null, 
                "SiteName": "site-1", 
                "VirtualZone": "Endpoint: Other", 
                "RiskLevel": 0, 
                "MAC": [
                    "00:1A:4B:6A:CE:FE"
                ], 
                "SiteID": 1, 
                "InsightName": null, 
                "ClassType": "IT", 
                "WasParsed": null, 
                "FirmwareVersion": null, 
                "LastSeen": null
            }, 
            {
                "ResourceID": "48-1", 
                "AssetType": "Endpoint", 
                "Vendor": "VMware", 
                "Name": "192.168.1.25", 
                "Criticality": "Low", 
                "AssetID": 48, 
                "IP": null, 
                "SiteName": "site-1", 
                "VirtualZone": "Endpoint: Other", 
                "RiskLevel": 0, 
                "MAC": [
                    "00:0C:29:86:C8:36"
                ], 
                "SiteID": 1, 
                "InsightName": null, 
                "ClassType": "IT", 
                "WasParsed": null, 
                "FirmwareVersion": null, 
                "LastSeen": null
            }
        ], 
        "Resolved": false, 
        "Severity": "Critical"
    }
}
Human Readable Output

Claroty Alert List

AlertType AlertTypeID Category Description Indicator NetworkID RelatedAssets Resolved ResourceID Severity
PortScan 28 Integrity UDP Port scan: Asset 192.168.1.10 sent probe packets to 192.168.1.25 IP address on different ports Alert ID - 75
Description - This Event does not currently support Alert Indicators
Points - 100

 1 {‘AssetID’: 47, ‘Name’: ‘192.168.1.10’, ‘InsightName’: None, ‘Vendor’: ‘Hewlett Packard’, ‘Criticality’: ‘Low’, ‘AssetType’: ‘Endpoint’, ‘LastSeen’: None, ‘IP’: None, ‘MAC’: [‘00:1A:4B:6A:CE:FE’], ‘VirtualZone’: ‘Endpoint: Other’, ‘ClassType’: ‘IT’, ‘SiteName’: ‘site-1’, ‘SiteID’: 1, ‘WasParsed’: None, ‘RiskLevel’: 0, ‘FirmwareVersion’: None, ‘ResourceID’: ‘47-1’},
{‘AssetID’: 48, ‘Name’: ‘192.168.1.25’, ‘InsightName’: None, ‘Vendor’: ‘VMware’, ‘Criticality’: ‘Low’, ‘AssetType’: ‘Endpoint’, ‘LastSeen’: None, ‘IP’: None, ‘MAC’: [‘00:0C:29:86:C8:36’], ‘VirtualZone’: ‘Endpoint: Other’, ‘ClassType’: ‘IT’, ‘SiteName’: ‘site-1’, ‘SiteID’: 1, ‘WasParsed’: None, ‘RiskLevel’: 0, ‘FirmwareVersion’: None, ‘ResourceID’: ‘48-1’}		 false 75-1 Critical

Configuration parameters

  • url — CTD Server URL (e.g. https://<IP>:5000) (required)
  • credentials — Username (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • fetch_time — The initial time to fetch from
  • max_fetch — Max per page
  • severity — Minimal severity to fetch by
  • site_id — Site ID to fetch by
  • alert_type — Fetch by alert type
  • exclude_resolved_alerts — Exclude resolved alerts
  • include_only_arr_completed_alerts — Include only ARR completed alerts

Commands (4)

  • claroty-get-assets

    Gets all assets from CTD. You can apply one or more filters.

  • claroty-get-single-alert

    Get a single alert from CTD.

  • claroty-query-alerts

    Gets alerts from CTD.

  • claroty-resolve-alert

    Resolves alerts.

Source

Claroty.py Claroty_test.py Claroty.yml Claroty_description.md
Download History Raw 
category: Network Security
provider: Claroty
sectionorder:
- Connect
- Collect
fromversion: 5.0.0
commonfields:
  id: Claroty
  version: -1
configuration:
- display: CTD Server URL (e.g. https://<IP>:5000)
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- defaultvalue: 7 days
  display: The initial time to fetch from
  name: fetch_time
  type: 0
  section: Collect
  required: false
- display: Max per page
  name: max_fetch
  type: 0
  section: Collect
  defaultvalue: '10'
  required: false
- display: Minimal severity to fetch by
  name: severity
  type: 15
  section: Collect
  options:
  - Low
  - Medium
  - High
  - Critical
  required: false
- display: Site ID to fetch by
  name: site_id
  type: 0
  section: Collect
  additionalinfo: All sites if none selected
  required: false
- display: Fetch by alert type
  name: alert_type
  type: 0
  section: Collect
  required: false
- display: Exclude resolved alerts
  name: exclude_resolved_alerts
  type: 8
  section: Collect
  required: false
- display: Include only ARR completed alerts
  name: include_only_arr_completed_alerts
  type: 8
  section: Collect
  additionalinfo: Includes only alerts that have completed their initial Automated Resolution Rules flow
  defaultvalue: 'false'
  required: false
description: Use the Claroty CTD integration to manage assets and alerts.
display: Claroty
name: Claroty
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: all
      description: Asset fields to return. The default value is "all".
      name: fields
      predefined:
      - all
      - id
      - name
      - insight_names
      - vendor
      - criticality
      - asset_type
      - last_seen
      - ipv4
      - mac
      - virtual_zone_name
      - class_type
      - site_name
      - project_parsed
      - risk_level
      - firmware_version
      - site_id
    - auto: PREDEFINED
      description: Returns assets with this criticality. Can be "Low", "Medium", or "High".
      name: criticality
      predefined:
      - Low
      - Medium
      - High
    - description: Get assets with that include the given insight name.
      name: insight_name
      predefined:
      - ''
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Add aditional value for the asset CVEs.
      name: should_enrich_assets
      predefined:
      - 'True'
      - 'False'
    - defaultValue: '10'
      description: Maximal value of assets to query at once.
      name: asset_limit
    - description: Get all assets seen last from the given date. Format - YYYY-MM-DDThh:mm:ssZ. Example - 2020-02-02T01:02:03Z.
      name: assets_last_seen
    description: Gets all assets from CTD. You can apply one or more filters.
    name: claroty-get-assets
    outputs:
    - contextPath: Claroty.Asset.AssetID
      description: The ID of the asset.
      type: Number
    - contextPath: Claroty.Asset.AssetType
      description: The asset type.
      type: String
    - contextPath: Claroty.Asset.CVE.CVSS
      description: CVE Score.
      type: String
    - contextPath: Claroty.Asset.CVE.Description
      description: CVE Description.
      type: String
    - contextPath: Claroty.Asset.CVE.ID
      description: CVE ID.
      type: String
    - contextPath: Claroty.Asset.CVE.Modified
      description: CVE modification date.
      type: Date
    - contextPath: Claroty.Asset.CVE.Published
      description: CVE publish date.
      type: Date
    - contextPath: CVE.CVSS
      description: CVE Score.
      type: String
    - contextPath: CVE.Description
      description: CVE Description.
      type: String
    - contextPath: CVE.ID
      description: CVE ID.
      type: String
    - contextPath: CVE.Modified
      description: CVE modification date.
      type: Date
    - contextPath: CVE.Published
      description: CVE publish date.
      type: Date
    - contextPath: Claroty.Asset.ClassType
      description: The OT/IT class type.
      type: String
    - contextPath: Claroty.Asset.Criticality
      description: The criticality of the asset, according to the Purdue model.
      type: String
    - contextPath: Claroty.Asset.FirmwareVersion
      description: The FM version of the asset.
      type: String
    - contextPath: Claroty.Asset.HighestCVEScore
      description: Highest CVE Score for the Asset.
      type: Number
    - contextPath: Claroty.Asset.IP
      description: The IPv4 address of the asset.
      type: String
    - contextPath: Claroty.Asset.InsightName
      description: The asset insight names generated by CTD.
      type: String
    - contextPath: Claroty.Asset.LastSeen
      description: The date the asset was last seen.
      type: Date
    - contextPath: Claroty.Asset.MAC
      description: The MAC address of the asset.
      type: String
    - contextPath: Claroty.Asset.Name
      description: The asset name.
      type: String
    - contextPath: Claroty.Asset.ResourceID
      description: The asset RID (AssetID-SiteID).
      type: String
    - contextPath: Claroty.Asset.RiskLevel
      description: The risk indicator.
      type: Number
    - contextPath: Claroty.Asset.SiteID
      description: The site ID of the asset.
      type: Number
    - contextPath: Claroty.Asset.SiteName
      description: The site name of the asset.
      type: String
    - contextPath: Claroty.Asset.Vendor
      description: The vendor of the asset.
      type: String
    - contextPath: Claroty.Asset.VirtualZone
      description: The virtual zone of the asset.
      type: String
    - contextPath: Claroty.Asset.WasParsed
      description: Whether the project was parsed.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: all
      description: Alert fields to return.
      name: fields
      predefined:
      - all
      - resource_id
      - type
      - severity
      - network_id
      - resolved
      - description
      - alert_indicators
      - actionable_assets
      - category
      - initial_arr_flow_completed
    - auto: PREDEFINED
      defaultValue: timestamp
      description: |-
        The field by which to sort the results. The default value is "timestamp".
        Default sort order is ascending.
      name: sort_by
      predefined:
      - resource_id
      - type
      - severity
      - network_id
      - resolved
      - description
      - alert_indicators
      - actionable_assets
      - id
      - timestamp
    - description: Returns alerts that match this alert type.
      name: type
    - description: The start date from which to get alerts. Format - YYYY-MM-DDThh:mm:ssZ. Example - 2020-02-02T01:02:03Z.
      name: date_from
    - auto: PREDEFINED
      defaultValue: asc
      description: The sorting order of the alerts - descending or ascending.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: The maximum number of alerts to query.
      name: alert_limit
    - auto: PREDEFINED
      description: Set minimal severity to query by.
      name: minimal_severity
      predefined:
      - Low
      - Medium
      - High
      - Critical
    - description: Returns only unresloved alerts.
      name: exclude_resolved_alerts
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Includes only alerts that have completed their initial Automated Resolution Rules flow.
      name: include_only_arr_completed_alerts
      predefined:
      - 'True'
      - 'False'
    description: Gets alerts from CTD.
    name: claroty-query-alerts
    outputs:
    - contextPath: Claroty.Alert.AlertType
      description: The alert type.
      type: String
    - contextPath: Claroty.Alert.AlertTypeID
      description: The alert type int value.
      type: Number
    - contextPath: Claroty.Alert.Description
      description: The alert description.
      type: String
    - contextPath: Claroty.Alert.Indicator
      description: The alert indicators.
      type: String
    - contextPath: Claroty.Alert.NetworkID
      description: The network ID.
      type: Number
    - contextPath: Claroty.Alert.RelatedAssets
      description: Assets related to the alert.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.AssetID
      description: The ID of the asset.
      type: Number
    - contextPath: Claroty.Alert.RelatedAssets.AssetType
      description: The asset type.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.ClassType
      description: The OT/IT class type.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.Criticality
      description: The criticality of the asset, according to the Purdue model.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.FirmwareVersion
      description: The FM version of the asset.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.IP
      description: The IPv4 address of the asset.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.InsightName
      description: The asset insight names generated by CTD.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.LastSeen
      description: The date the asset was last seen.
      type: Date
    - contextPath: Claroty.Alert.RelatedAssets.MAC
      description: The MAC address of the asset.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.Name
      description: The asset name.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.ResourceID
      description: The asset RID (AssetID-SiteID).
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.RiskLevel
      description: The risk indicator.
      type: Number
    - contextPath: Claroty.Alert.RelatedAssets.SiteID
      description: The site ID of the asset.
      type: Number
    - contextPath: Claroty.Alert.RelatedAssets.SiteName
      description: The site name of the asset.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.Vendor
      description: The vendor of the asset.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.VirtualZone
      description: The virtual zone of the asset.
      type: String
    - contextPath: Claroty.Alert.RelatedAssets.WasParsed
      description: Whether the project was parsed.
      type: String
    - contextPath: Claroty.Alert.Resolved
      description: The resolve status of the alert.
      type: Number
    - contextPath: Claroty.Alert.ResourceID
      description: The alert resource ID (AlertID-SiteID).
      type: String
    - contextPath: Claroty.Alert.Severity
      description: The alert severity.
      type: String
    - contextPath: Claroty.Alert.Category
      description: The alert category.
      type: String
    - contextPath: Claroty.Alert.InitialArrFlowCompleted
      description: Whether the alert has completed its initial Automated Resolution Rules flow.
      type: Boolean
  - arguments:
    - description: The ResourceId of the Alerts to resolve (in <alert_id>-<site_id> format).
      name: selected_alerts
      required: true
    - auto: PREDEFINED
      defaultValue: resolve
      description: How to resolve the alert. Can be "archive" or "resolve". The default value is "resolve".
      name: resolve_as
      predefined:
      - archive
      - resolve
    - defaultValue: Resolved by Demisto
      description: A comment to add when resolving an alert.
      name: resolve_comment
    description: Resolves alerts.
    execution: true
    name: claroty-resolve-alert
    outputs:
    - contextPath: Claroty.Resolve_out.success
      description: Success output of alert resolving.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: all
      description: Asset fields to return. The default value is "all".
      name: fields
      predefined:
      - all
      - resource_id
      - type
      - severity
      - network_id
      - resolved
      - description
      - alert_indicators
      - actionable_assets
    - description: Resource ID of the desired alert. Expected value - <alert_id>-<site_id>.
      name: alert_rid
      required: true
    description: Get a single alert from CTD.
    name: claroty-get-single-alert
    outputs:
    - contextPath: Claroty.Alert.AlertType
      description: The alert type.
      type: String
    - contextPath: Claroty.Alert.AlertTypeID
      description: The alert type int value.
      type: Number
    - contextPath: Claroty.Alert.Description
      description: The alert description.
      type: String
    - contextPath: Claroty.Alert.Indicator
      description: The alert indicators.
      type: String
    - contextPath: Claroty.Alert.NetworkID
      description: The network ID.
      type: Number
    - contextPath: Claroty.Alert.RelatedAssets
      description: Assets related to the alert.
      type: String
    - contextPath: Claroty.Alert.Resolved
      description: The resolve status of the alert.
      type: Number
    - contextPath: Claroty.Alert.ResourceID
      description: The alert resource ID (AlertID-SiteID).
      type: String
    - contextPath: Claroty.Alert.Severity
      description: The alert severity.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
autoUpdateDockerImage: true
defaultclassifier: Claroty
defaultmapperin: Claroty-mapper
tests:
- No tests (auto formatted)