ConcentricAI
Concentric’s Semantic Intelligence™ solution discovers and protects business critical, unstructured data. We use deep learning to identify risky sharing, inappropriate third party access, assets in the wrong location, mis-classified documents, or lateral movement of data – all without rules or complex upfront configuration.
Data Enrichment & Threat Intelligence · ConcentricAI
Details
| ID | ConcentricAI |
|---|---|
| Provider | Concentric AI |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Concentric’s Semantic Intelligence™ solution discovers and protects business critical, unstructured data. We use deep learning to identify risky sharing, inappropriate third party access, assets in the wrong location, mis-classified documents, or lateral movement of data – all without rules or complex upfront configuration.
Configure ConcentricAI in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL | True | |
| Minimum severity of alerts to fetch | True | |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False | |
| Client ID | False | |
| Client Secret | False | |
| Domain | False | |
| Maximum no. of incidents to fetch. | max -> 200 | False |
| Incident type | False | |
| Fetch incidents | False | |
| First Fetch Time of Risks | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
concentricai-get-file-details
Get’s file information
Base Command
concentricai-get-file-details
Input
| Argument Name | Description | Required |
|---|---|---|
| path | Path of the file. | Required |
| file-name | Name of File. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| ConcentricAI.FileInfo.risk_names | String | Risk names. |
| ConcentricAI.FileInfo.ownerDetails | String | owner Details. |
| ConcentricAI.FileInfo.pii | String | PII present in file or not |
| ConcentricAI.FileInfo.cid | String | File ID |
concentricai-get-users-overview
Get overview of Users involved
Base Command
concentricai-get-users-overview
Input
| Argument Name | Description | Required |
|---|---|---|
| max_users | Maximum no. of users fetched per category. Default is 50. | Optional |
Context Output
There is no context output for this command.
concentricai-get-user-details
Get’s user details
Base Command
concentricai-get-user-details
Input
| Argument Name | Description | Required |
|---|---|---|
| user | Enter user name. | Required |
Context Output
There is no context output for this command.
concentricai-get-file-sharing-details
Get’s file sharing details
Base Command
concentricai-get-file-sharing-details
Input
| Argument Name | Description | Required |
|---|---|---|
| cid | File ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| ConcentricAI.FileSharingInfo.type | Array | Sharing type. |
| ConcentricAI.FileSharingInfo.user_name | Array | User name. |
Configuration parameters
url— Server URL (required)min_severity— Minimum severity of alerts to fetch (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settingsclient_id— Client IDclient_secret— Client Secretdomain— Domainmax_fetch— Maximum no. of incidents to fetch.incidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervalisFetch— Fetch incidentsfirst_fetch— First Fetch Time of Risks
Commands (4)
-
concentricai-get-file-detailsGet's file information.
-
concentricai-get-file-sharing-detailsGet's file sharing details.
-
concentricai-get-user-detailsGet's user details.
-
concentricai-get-users-overviewGet overview of Users involved.
import json from datetime import datetime def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) def get_headers_for_login(): headers_for_login = { "Authorization": "Basic some-alphanumeric", "X-Domain": "Domain-1", "grant_type": "client_credentials", "Content-Type": "application/json", } return headers_for_login def get_headers_for_query(): headers_for_query = { "Cookie": "COOKIE", "X-Domain": "DOMAIN", "grant_type": "client_credentials", "client_id": "CLIENT_ID", "Content-Type": "application/json", } return headers_for_query def setup(): from ConcentricAI import LoginClient, QueryClient, initialise_scrolls_and_rules headers_login = get_headers_for_login() loginClient = LoginClient(base_url="https://mock-url.com", verify="False", headers=headers_login, proxy="False") headers_query = get_headers_for_query() queryClient = QueryClient(base_url="https://mock-url.com", headers=headers_query, proxy="False") initialise_scrolls_and_rules() return loginClient, queryClient def test_test_module(requests_mock): from ConcentricAI import LoginClient, test_module headers = get_headers_for_login() loginClient = LoginClient(base_url="https://mock-url.com", verify="False", headers=headers, proxy="False") mock_response = {"accessToken": "token"} requests_mock.get("https://mock-url.com/api/v1/login", json=mock_response) response = test_module(loginClient) assert response == "ok" def test_fetch_incidents(requests_mock): # given : Mock response and arguments needed for the given call from ConcentricAI import fetch_incidents loginClient, queryClient = setup() last_run: dict = {} max_results = "100" fetch_time = "3 days" mock_response = util_load_json("test_data/mock_incident.json") requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"]) # when : Actual function call _, new_incidents = fetch_incidents(loginClient, queryClient, last_run, max_results, fetch_time) t = datetime.fromtimestamp(int("1600114903415") / 1000) inced_time = t.strftime("%Y-%m-%dT%H:%M:%SZ") rawJson = ( '{"cid": "8f4619ebc927276a5908db0e46be2e7da14df3bd", "rule_name": "risk1,risk3", ' '"service": "sharepoint", "name": "file-name-1", "file-path": "file-path", ' '"owner": ["joe@company.com"], "risk": "high", "risk_timestamp": "1600114903415"}' ) # then : Assert values of the incident populated. assert new_incidents == [{"name": "file-name-1", "occurred": inced_time, "severity": 3, "rawJSON": rawJson}] def test_fetch_file_information(requests_mock): # given : Mock response and arguments needed for the given call from ConcentricAI import fetch_file_information loginClient, queryClient = setup() path = "path" name = "file-name-1" mock_response = util_load_json("test_data/mock_file_information.json") requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"]) # when : Actual function call result = fetch_file_information(loginClient, queryClient, path, name) # then : Assert values of the Output prefix assert result.outputs_prefix == "ConcentricAI.FileInfo" assert result.outputs_key_field == "ownerDetails" assert result.outputs == mock_response["output"] def test_get_users_overview(requests_mock): # given : Mock response and arguments needed for the given call from ConcentricAI import get_users_overview loginClient, queryClient = setup() mock_response = util_load_json("test_data/mock_user_overview.json") requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"]) max_users = "10" # when : Actual function call result = get_users_overview(loginClient, queryClient, max_users) # then : Assert values of the Output prefix assert result.outputs_prefix == "ConcentricAI.UserInfo" assert result.outputs_key_field == "info" def test_get_user_details(requests_mock): # given : Mock response and arguments needed for the given call from ConcentricAI import get_user_details loginClient, queryClient = setup() mock_response = util_load_json("test_data/mock_user_details.json") requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"]) user = "joe" # when : Actual function call result = get_user_details(loginClient, queryClient, user) # then : Assert values of the Output prefix assert result.outputs_prefix == "ConcentricAI.UserDetails" assert result.outputs_key_field == "info" def test_get_file_sharing_details(requests_mock): # given : Mock response and arguments needed for the given call from ConcentricAI import get_file_sharing_details loginClient, queryClient = setup() mock_response = util_load_json("test_data/mock_file_permissions.json") requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"]) cid = "lsknadkl12312" # when : Actual function call result = get_file_sharing_details(loginClient, queryClient, cid) # then : Assert values of the Output prefix assert result.outputs_prefix == "ConcentricAI.FileSharingInfo" assert result.outputs_key_field == "info"