CloudShark

Details

ID	`CloudShark`
Provider	QA Cafe LLC
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Overview

Designed for networking and security teams, CS Enterprise is a collaboration platform focused on network packet capture (PCAP) analysis. CS Enterprise delivers secure storage, organization, access control, and powerful analysis tools in an elegant, responsive browser-based interface.

Use Cases

Upload a network capture for analysis in your browser
Collaborate on network pcap analysis by easily sharing captures with others via a URL
Collect meta-information about a capture file
Manage and organize capture files in CS Enterprise

To set up CS Enterprise to work with Cortex XSOAR

You will need the following before setting up the CS Enterprise integration on
Cortex XSOAR:

CS Enterprise URL The URL of your CS Enterprise instance
API Token: An API Token from CloudShark with upload, info, download, and delete permissions enabled on it

Configure the CS Enterprise Integration on Cortex XSOAR

Go to Settings > Integrations > Servers & Services
Search for CloudShark
Click Add instance to create and configure a new integration instance

Name: a textual name for the integration instance
CS Enterprise URL: The URL of your CS Enterprise Instance
API Token: Your API token

Click Test to validate the URL

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

cloudshark-upload: cloudshark-upload
cloudshark-info: cloudshark-info
cloudshark-download: cloudshark-download
cloudshark-delete: cloudshark-delete

1. cloudshark-upload

Upload a capture file into CS Enterprise

Base Command

cloudshark-upload

Input

Argument Name	Description	Required
file	EntryID of the capture to upload	Required
additional_tags	A comma-separated list of tags to apply to the capture file	Optional
filename	The filename of the capture in CS Enterprise	Optional

Context Output

Path	Type	Description
URL.Data	string	URL of the capture file in CS Enterprise
CloudShark.CaptureID	string	Capture ID of the capture in CS Enterprise

Command Example

!cloudshark-upload file=494@1e6024f1-485b-4d1a-8ee3-b6bf51e8ca1a filename=demisto.pcapng additional_tags=demisto,cloudshark,test

Context Example

{
    "CloudShark": {
        "CaptureID": "5277a3a64076"
    },
    "URL": {
        "Data": "CLOUDSHARK_URL/captures/5277a3a64076"
    }
}

Human Readable Output

Open Capture in CloudShark

2. cloudshark-info

Retrieve meta-information about a capture file from CS Enterprise

Base Command

cloudshark-info

Input

Argument Name	Description	Required
capture_id	Capture ID of the capture in CS Enterprise	Required

Context Output

Path	Type	Description
CloudShark.CaptureInfo	unknown	Meta-information of capture file

Command Example

!cloudshark-info capture_id=ccaa62cbbb06

Context Example

{
    "CloudShark": {
        "CaptureInfo": {
            "avg_packet_rate": "3.24",
            "avg_packet_size": "70.19",
            "cap_file_id": 165174,
            "comments": "",
            "created_at": "2019-11-06T21:18:30+00:00",
            "data_bit_rate": "1817.36",
            "data_byte_rate": "227.17",
            "data_size": 4071908,
            "disable_autodelete": false,
            "duration": "17924.501967",
            "encapsulation": "Ethernet",
            "end_time": "2019-07-26T23:20:44+00:00",
            "file": "/var/www/cloudshark/current/uploads/2019/11/05/16/13172ab4-61a7-4439-aa27-292306c062c0.cap",
            "file_source": "upload",
            "file_type": "Wireshark/tcpdump/... - pcap",
            "filename": "capture.pcapng",
            "group": "",
            "group_write?": false,
            "id": "ccaa62cbbb06",
            "last_accessed": "2019-11-07T15:42:07+00:00",
            "num_packets": 58009,
            "public?": false,
            "sha1_hash": "e871eee9d85a9898d1f7aec37f22f291fb1d1971",
            "size": 5000076,
            "start_time": "2019-07-26T18:22:00+00:00",
            "tag_list": "",
            "truncated": "No",
        }
    }
}

Human Readable Output

Capture file info

avg_packet_rate	avg_packet_size	cap_file_id	comments	created_at	data_bit_rate	data_byte_rate	data_size	disable_autodelete	duration	encapsulation	end_time	file	file_source	file_type	filename	group	group_write?	id	last_accessed	num_packets	public?	sha1_hash	size	start_time	tag_list	truncated	user
3.24	70.19	165174		2019-11-06T21:18:30+00:00	1817.36	227.17	4071908	false	17924.501967	Ethernet	2019-07-26T23:20:44+00:00	/var/www/cloudshark/current/uploads/2019/11/05/16/13172ab4-61a7-4439-aa27-292306c062c0.cap	upload	Wireshark/tcpdump/... - pcap	capture.pcapng		false	ccaa62cbbb06	2019-11-07T15:42:07+00:00	58009	false	e871eee9d85a9898d1f7aec37f22f291fb1d1971	5000076	2019-07-26T18:22:00+00:00		No

3. cloudshark-download

Download a capture file from CS Enterprise

Base Command

cloudshark-download

Input

Argument Name	Description	Required
capture_id	Capture ID of the capture in CS Enterprise	Optional

Context Output

Path	Type	Description
File	unknown	File downloaded from CloudShark

Command Example

!cloudshark-download capture_id=ccaa62cbbb06

Human Readable Output

4. cloudshark-delete

Delete a capture file from CS Enterprise

Base Command

cloudshark-delete

Input

Argument Name	Description	Required
capture_id	Delete a capture file from CS Enterprise	Optional

Context Output

Path	Type	Description
CloudShark.Result	unknown	Result of delete command

Command Example

!cloudshark-delete capture_id=ccaa62cbbb06

Context Example

{
    "CloudShark": {
        "Result": {
            "id": "5277a3a64076",
            "message": "Capture deleted successfully.",
            "status": 200
        }
    }
}

Human Readable Output

Result

Response
id: ccaa62cbbb06 status: 200 message: Capture deleted successfully.

Configuration parameters

url — CS Enterprise URL (required)
apikey — API Token (required)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (4)

cloudshark-delete
Deletes a capture file from CS Enterprise.
cloudshark-download
Downloads a capture file from CS Enterprise.
cloudshark-info
Retrieves meta-information about a capture file from CS Enterprise.
cloudshark-upload
Uploads a capture file into CS Enterprise

Source

CloudShark.py CloudShark.yml CloudShark_description.md

Download History Raw

commonfields:
  id: CloudShark
  version: -1
name: CloudShark
display: CloudShark
category: Data Enrichment & Threat Intelligence
provider: QA Cafe LLC
description: Use the CloudShark integration to upload, share, and collaborate on network packet capture files using your on-premises CS Enterprise system.
configuration:
- display: CS Enterprise URL
  name: url
  defaultvalue: ""
  type: 0
  required: true
- display: API Token
  name: apikey
  defaultvalue: ""
  type: 4
  required: true
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
script:
  script: ''
  type: python
  commands:
  - name: cloudshark-delete
    arguments:
    - name: capture_id
      description: Capture ID of the capture in CS Enterprise.
    outputs:
    - contextPath: CloudShark.Result
      description: Result of the delete command.
    description: Deletes a capture file from CS Enterprise.
  - name: cloudshark-download
    arguments:
    - name: capture_id
      description: Capture ID of the capture in CS Enterprise.
    outputs:
    - contextPath: File
      description: The file downloaded from CS Enterprise.
    description: Downloads a capture file from CS Enterprise.
  - name: cloudshark-info
    arguments:
    - name: capture_id
      required: true
      description: Capture ID of the capture in CS Enterprise.
    outputs:
    - contextPath: CloudShark.CaptureInfo.CaptureID
      description: Capture ID of the capture.
      type: string
    - contextPath: CloudShark.CaptureInfo.GroupWrite
      type: boolean
      description: Group permission setting.
    - contextPath: CloudShark.CaptureInfo.Size
      type: number
      description: Size of the capture file.
    - contextPath: CloudShark.CaptureInfo.DataByteRate
      type: string
      description: Data byte rate.
    - contextPath: CloudShark.CaptureInfo.TagList
      type: string
      description: List of the capture file's tags.
    - contextPath: CloudShark.CaptureInfo.DataBitRate
      type: string
      description: Data bit rate.
    - contextPath: CloudShark.CaptureInfo.FileName
      type: string
      description: Filename.
    - contextPath: CloudShark.CaptureInfo.SHA1
      type: string
      description: SHA1 hash of the capture file.
    - contextPath: CloudShark.CaptureInfo.AvgPacketRate
      type: string
      description: Average packet rate.
    - contextPath: CloudShark.CaptureInfo.StartTime
      type: date
      description: Start time of the capture.
    - contextPath: CloudShark.CaptureInfo.CreatedAt
      type: date
      description: When the capture file was added.
    - contextPath: CloudShark.CaptureInfo.AvgPacketSize
      type: string
      description: Average packet size.
    - contextPath: CloudShark.CaptureInfo.User
      type: string
      description: Owner of the capture file.
    - contextPath: CloudShark.CaptureInfo.LastAccessed
      type: date
      description: When the capture was last accessed.
    - contextPath: CloudShark.CaptureInfo.DisableAutodelete
      type: boolean
      description: Whether autodelete is enabled or disabled.
    - contextPath: CloudShark.CaptureInfo.CapFileID
      type: number
      description: Capture file ID.
    - contextPath: CloudShark.CaptureInfo.EndTime
      type: date
      description: End time of the capture.
    - contextPath: CloudShark.CaptureInfo.NumPackets
      type: number
      description: Number of packets in the capture.
    - contextPath: CloudShark.CaptureInfo.Encapsulation
      type: string
      description: Encapsulation type.
    - contextPath: CloudShark.CaptureInfo.Duration
      type: string
      description: Duration of the capture.
    - contextPath: CloudShark.CaptureInfo.Comments
      type: string
      description: Comments for the capture.
    - contextPath: CloudShark.CaptureInfo.Public
      type: boolean
      description: Whether permission settings are public.
    - contextPath: CloudShark.CaptureInfo.DataSize
      type: number
      description: Size of data in the capture.
    - contextPath: CloudShark.CaptureInfo.File
      type: string
      description: Location of capture file on disk.
    - contextPath: CloudShark.CaptureInfo.FileType
      type: string
      description: File type.
    - contextPath: CloudShark.CaptureInfo.FileSource
      type: string
      description: Source of capture file.
    - contextPath: CloudShark.CaptureInfo.Truncated
      type: string
      description: Whether the capture file is truncated.
    - contextPath: CloudShark.CaptureInfo.Group
      type: string
      description: Group with which the capture file is shared.
    description: Retrieves meta-information about a capture file from CS Enterprise.
  - name: cloudshark-upload
    arguments:
    - name: file
      required: true
      description: EntryID of the network capture file to upload.
    - name: additional_tags
      description: A comma-separated list of tags to apply to the capture file.
    - name: filename
      description: The filename of the capture in CS Enterprise.
    outputs:
    - contextPath: URL.Data
      description: URL of the capture file in CS Enterprise.
      type: string
    - contextPath: CloudShark.CaptureID
      description: Capture ID of the capture in CS Enterprise.
      type: string
    description: Uploads a capture file into CS Enterprise
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  subtype: python3
tests:
- CloudShark - Test Playbook
fromversion: 5.0.0