CommvaultSecurityIQ

Details

ID	`CommvaultSecurityIQ`
Provider	Commvault
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/commvault:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Commvault Cloud provides pre-built integrations, automation workflows, and playbooks to streamline operations, enhance threat intelligence integration, and gain actionable insights through advanced reporting and analytics.
This integration was integrated and tested with version 6.9.0 of CommvaultSecurityIQ.

Configure Commvault Cloud in Cortex

Parameter	Required
Long running instance	False
Mapper (incoming)	True
Commvault Webservice Url	True
Commvault API Token	True
Azure KeyVault Url	False
Azure KeyVault Tenant ID	False
Azure KeyVault Client ID	False
Azure KeyVault Client Secret	False
Port mapping (<port> or <host port>:<docker port>)	False
Incident type	False
Fetch incidents	False
Incidents Fetch Interval	False
Forwarding Rule	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	False
Max events to fetch	False
Webhook Listener Username	False

Note :- If “Fetch Incidents” parameter is selected then make sure “Long running instance” capability of the integration is disabled

Note :- Set Mapper (incoming) to “Commvault Suspicious File Activity Mapper”

Note: When using Forwarding Rule = Webhook, you must set Webhook Listener Credentials (username + password). The Commvault Cloud webhook sender must be configured to present these same credentials to Cortex using HTTP Basic Auth. To use a custom header API token instead of Basic Auth, set the username to _header:<HeaderName> (for example, _header:X-Commvault-Token) and put the token in the password field.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

commvault-security-set-disable-data-aging

Disables data aging on CS

Base Command

commvault-security-set-disable-data-aging

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
CommvaultSecurityIQ.DisableDataAging	string	Status returned after calling disable data aging API

commvault-security-get-generate-token

Generate Token

Base Command

commvault-security-get-generate-token

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
CommvaultSecurityIQ.GenerateToken	string	Status indicating whether successfully generated access token or not

commvault-security-get-access-token-from-keyvault

Read the access token from KeyVault

Base Command

commvault-security-get-access-token-from-keyvault

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
CommvaultSecurityIQ.GetAccessToken	string	Status returned after getting the access token from KeyVault

commvault-security-set-disable-saml-provider

Disable SAML provider

Base Command

commvault-security-set-disable-saml-provider

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
CommvaultSecurityIQ.DisableSaml	string	Status indicating whether successfully disabled SAML provider or not

commvault-security-get-copy-files-list-to-war-room

Copy the list of affected files list to war room

Base Command

commvault-security-get-copy-files-list-to-war-room

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

commvault-security-set-disable-user

Disables user

Base Command

commvault-security-set-disable-user

Input

Argument Name	Description	Required
user_email	Email id of the user to be disabled.	Required

Context Output

Path	Type	Description
CommvaultSecurityIQ.DisableUser	string	Response indicating whether successfully disabled user or not.

commvault-security-set-cleanroom-add-vm-to-recovery-group

Add VM to Cleanroom

Base Command

commvault-security-set-cleanroom-add-vm-to-recovery-group

Input

Argument Name	Description	Required
vm_name	VM name.	Required
clean_recovery_point	Recovery point timestamp to which we add the VM.	Required

Context Output

Path	Type	Description
CommvaultSecurityIQ.AddEntityToCleanroom	string	Response indicating whether successfully added the VM to the recovery point or not.

Configuration parameters

isFetch — Fetch incidents
longRunning — Long running instance ( Only select it, if Fetch Incidents was not selected )
CVWebserviceUrl — Commvault Webservice Url (required)
CommvaultAPIToken — Commvault API Token (required)
AzureKeyVaultUrl — Azure KeyVault Url
AzureKeyVaultTenantId — Azure KeyVault Tenant ID
AzureKeyVaultClientSecret — Azure KeyVault Client Secret
AzureKeyVaultClientId — Azure KeyVault Client ID
longRunningPort — Port mapping (<port> or <host port>:<docker port>)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
forwardingRule — Forwarding Rule
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — Max events to fetch
creds_certificate — Certificate
credentials — Webhook Listener Username

Commands (7)

commvault-security-get-access-token-from-keyvault
Read the access token from KeyVault.
commvault-security-get-copy-files-list-to-war-room
Copy the list of affected files list to war room.
commvault-security-get-generate-token
Generate Token.
commvault-security-set-cleanroom-add-vm-to-recovery-group
Add VM to Cleanroom.
commvault-security-set-disable-data-aging
Disables data aging on CS.
commvault-security-set-disable-saml-provider
Disable SAML provider.
commvault-security-set-disable-user
Disables user.

Source

CommvaultSecurityIQ.py CommvaultSecurityIQ_test.py CommvaultSecurityIQ.yml CommvaultSecurityIQ_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: Commvault
commonfields:
  id: CommvaultSecurityIQ
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Collect
- display: Long running instance ( Only select it, if Fetch Incidents was not selected )
  name: longRunning
  required: false
  type: 8
  section: Collect
- display: Commvault Webservice Url
  name: CVWebserviceUrl
  required: true
  type: 0
  section: Connect
- display: Commvault API Token
  name: CommvaultAPIToken
  hiddenusername: true
  displaypassword: API Token
  required: true
  type: 9
  section: Connect
- display: Azure KeyVault Url
  name: AzureKeyVaultUrl
  hiddenusername: true
  displaypassword: AzureKeyVaultUrl
  required: false
  type: 9
  section: Connect
- display: Azure KeyVault Tenant ID
  name: AzureKeyVaultTenantId
  hiddenusername: true
  displaypassword: Azure KeyVault Tenant ID
  required: false
  type: 9
  section: Connect
- display: Azure KeyVault Client Secret
  name: AzureKeyVaultClientSecret
  hiddenusername: true
  displaypassword: Azure KeyVault Client Secret
  required: false
  type: 9
  section: Connect
- display: Azure KeyVault Client ID
  name: AzureKeyVaultClientId
  required: false
  type: 4
  section: Connect
- display: 'Port mapping (<port> or <host port>:<docker port>) '
  name: longRunningPort
  required: false
  type: 0
  additionalinfo: Only for Long running Integration
  section: Connect
- display: Incident type
  name: incidentType
  defaultvalue: Commvault Suspicious File Activity
  required: false
  type: 13
  section: Collect
- defaultvalue: '60'
  display: Incidents Fetch Interval
  additionalinfo: Only for Fetch Incidents
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
- display: Forwarding Rule
  additionalinfo: Only for Long running Integration
  name: forwardingRule
  options:
  - Syslog
  - Webhook
  required: false
  type: 15
  section: Collect
- defaultvalue: 1 day
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  additionalinfo: Only for Fetch Incidents
  name: first_fetch
  required: false
  type: 0
  section: Collect
- display: Max events to fetch
  additionalinfo: Maximum events that can be fetch is 200 (Only for Fetch Incidents)
  name: max_fetch
  required: false
  type: 0
  defaultvalue: '50'
  section: Collect
- name: creds_certificate
  display: Certificate
  type: 9
  section: Connect
  displaypassword: Private Key
  required: false
- name: credentials
  display: Webhook Listener Username
  displaypassword: Webhook Listener Password
  additionalinfo: The username and password used to authenticate inbound webhook requests. Required when the Forwarding Rule is set to Webhook. Use `_header:<HeaderName>` as the username for custom-header API tokens.
  type: 9
  section: Connect
  required: false
description: Commvault Cloud provides pre-built integrations, automation workflows, and playbooks to streamline operations, enhance threat intelligence integration, and gain actionable insights through advanced reporting and analytics.
display: Commvault Cloud
name: CommvaultSecurityIQ
script:
  commands:
  - deprecated: false
    description: Disables data aging on CS.
    execution: false
    name: commvault-security-set-disable-data-aging
    outputs:
    - contextPath: CommvaultSecurityIQ.DisableDataAging
      description: Status returned after calling disable data aging API.
      type: string
  - deprecated: false
    description: Generate Token.
    execution: false
    name: commvault-security-get-generate-token
    outputs:
    - contextPath: CommvaultSecurityIQ.GenerateToken
      description: Status indicating whether successfully generated access token or not.
      type: string
  - deprecated: false
    description: Read the access token from KeyVault.
    execution: false
    name: commvault-security-get-access-token-from-keyvault
    outputs:
    - contextPath: CommvaultSecurityIQ.GetAccessToken
      description: Status returned after getting the access token from KeyVault.
      type: string
  - deprecated: false
    description: Disable SAML provider.
    execution: false
    name: commvault-security-set-disable-saml-provider
    outputs:
    - contextPath: CommvaultSecurityIQ.DisableSaml
      description: Status indicating whether successfully disabled SAML provider or not.
      type: string
  - deprecated: false
    description: Copy the list of affected files list to war room.
    execution: false
    name: commvault-security-get-copy-files-list-to-war-room
  - deprecated: false
    description: Disables user.
    execution: false
    name: commvault-security-set-disable-user
    arguments:
    - name: user_email
      description: Email id of the user to be disabled.
      required: true
      type: textArea
    outputs:
    - contextPath: CommvaultSecurityIQ.DisableUser
      description: Response indicating whether successfully disabled user or not.
      type: string
  - deprecated: false
    description: Add VM to Cleanroom.
    execution: false
    name: commvault-security-set-cleanroom-add-vm-to-recovery-group
    arguments:
    - name: vm_name
      description: VM name.
      required: true
      type: textArea
    - name: clean_recovery_point
      description: Recovery point timestamp to which we add the VM.
      required: true
      type: textArea
    outputs:
    - contextPath: CommvaultSecurityIQ.AddEntityToCleanroom
      description: Response indicating whether successfully added the VM to the recovery point or not.
      type: string
  dockerimage: demisto/commvault:1.0.0.10120494
  feed: false
  isfetch: true
  longRunning: true
  longRunningPort: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.8.0
tests:
- No tests (auto formatted)