Code42 Event Collector

Details

ID	`Code42 Event Collector`
Provider	Permira
Category	Data Enrichment & Threat Intelligence
From Version	8.4.0
Docker Image	`demisto/py42:1.0.0.10120494`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Code42 Insider Risk software solutions provide the right balance of transparency, technology and training to detect and appropriately respond to data risk. Use the Code42EventCollector integration to fetch file events and audit logs.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Code42 Event Collector in Cortex

Parameter	Required
Server URL (e.g., https://api.us.code42.com, see help section)	True
API Client ID	True
API Client Secret	True
Maximum number of file events per fetch	True
Maximum number of audit events per fetch	True
Trust any certificate (not secure)	False

Code42 Event Collector Authentication

Code42 API uses the OAuth 2.0 protocol for authentication and authorization.

The domain used for making API requests can be determined using the domain you use to log in to the Code42 console.

Console Domain	API Domain
console.us.code42.com	api.us.code42.com
console.us2.code42.com	api.us2.code42.com
console.ie.code42.com	api.ie.code42.com
console.gov.code42.com	api.gov.code42.com

For each request sent to the API, a bearer token will be requested to authenticate your action. The bearer token should be renewed each 15 minutes. This is done automatically by the integration.

You can retrieve your API credentials by following the instructions in the Code 42 documentation.

Code42 Event Collector Rate Limits

The Code42 API can handle up to 120 requests per minute. After that the API will start to decline client’s requests.

The integration with the default configuration should not raise any rate-limits.

Code42 Event Collector Required Scopes

To use the Code42 Event Collector, make sure you have the correct product plan which must include full Code42 API access.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

code42-get-events

Manual command to get events, used mainly for debugging

Base Command

code42-get-events

Input

Argument Name	Description	Required
start_date	Starting time from which to get events.	Required
end_date	Time until when to get events.	Required
limit	The maximum number of events to return. Default is 100.	Required
event_type	The type of event to return. Possible values are: audit-logs, file-events.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g., https://api.us.code42.com, see help section) (required)
credentials — API Client ID (required)
max_file_events_per_fetch — Maximum number of file events per fetch
max_audit_events_per_fetch — Maximum number of audit events per fetch
insecure — Trust any certificate (not secure)
event_types_to_fetch — Event Types To Fetch

Commands (1)

code42-get-events
Manual command to get events, used mainly for debugging.

Source

Code42EventCollector.py Code42EventCollector_test.py Code42EventCollector.yml Code42EventCollector_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Permira
supportlevelheader: xsoar
commonfields:
  id: Code42 Event Collector
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.us.code42.com
  display: Server URL (e.g., https://api.us.code42.com, see help section)
  name: url
  required: true
  type: 0
  section: Connect
- display: API Client ID
  displaypassword: API Client Secret
  name: credentials
  type: 9
  required: true
  section: Connect
- display: Maximum number of file events per fetch
  name: max_file_events_per_fetch
  defaultvalue: "50000"
  advanced: true
  type: 0
  required: false
  section: Collect
- display: Maximum number of audit events per fetch
  name: max_audit_events_per_fetch
  defaultvalue: "100000"
  advanced: true
  type: 0
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Event Types To Fetch
  section: Collect
  name: event_types_to_fetch
  type: 16
  required: false
  additionalinfo: Event types to fetch. Defaults to all types.
  defaultvalue: File,Audit
  options:
  - File
  - Audit
description: 'Code42 Insider Risk software solutions provide the right balance of transparency, technology and training to detect and appropriately respond to data risk. Use the Code42EventCollector integration to fetch file events and audit logs.'
display: Code42 Event Collector
name: Code42 Event Collector
script:
  commands:
  - arguments:
    - description: 'Starting time from which to get events.'
      name: start_date
      required: true
    - description: 'Time until when to get events.'
      name: end_date
      required: true
    - description: 'The maximum number of events to return.'
      name: limit
      required: true
      defaultValue: '100'
    - description: 'The type of event to return.'
      name: event_type
      required: true
      auto: PREDEFINED
      predefined:
      - "audit"
      - "file"
    description: 'Manual command to get events, used mainly for debugging.'
    name: code42-get-events
    outputs: []
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/py42:1.0.0.10120494
  isfetchevents: true
fromversion: 8.4.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam