ConcentricAI

Concentric’s Semantic Intelligence™ solution discovers and protects business critical, unstructured data. We use deep learning to identify risky sharing, inappropriate third party access, assets in the wrong location, mis-classified documents, or lateral movement of data – all without rules or complex upfront configuration.

Data Enrichment & Threat Intelligence · ConcentricAI

Details

IDConcentricAI
ProviderConcentric AI
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Concentric’s Semantic Intelligence™ solution discovers and protects business critical, unstructured data. We use deep learning to identify risky sharing, inappropriate third party access, assets in the wrong location, mis-classified documents, or lateral movement of data – all without rules or complex upfront configuration.

Configure ConcentricAI in Cortex

Parameter Description Required
Server URL   True
Minimum severity of alerts to fetch   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Client ID   False
Client Secret   False
Domain   False
Maximum no. of incidents to fetch. max -> 200 False
Incident type   False
Fetch incidents   False
First Fetch Time of Risks   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

concentricai-get-file-details


Get’s file information

Base Command

concentricai-get-file-details

Input

Argument Name Description Required
path Path of the file. Required
file-name Name of File. Required

Context Output

Path Type Description
ConcentricAI.FileInfo.risk_names String Risk names.
ConcentricAI.FileInfo.ownerDetails String owner Details.
ConcentricAI.FileInfo.pii String PII present in file or not
ConcentricAI.FileInfo.cid String File ID

concentricai-get-users-overview


Get overview of Users involved

Base Command

concentricai-get-users-overview

Input

Argument Name Description Required
max_users Maximum no. of users fetched per category. Default is 50. Optional

Context Output

There is no context output for this command.

concentricai-get-user-details


Get’s user details

Base Command

concentricai-get-user-details

Input

Argument Name Description Required
user Enter user name. Required

Context Output

There is no context output for this command.

concentricai-get-file-sharing-details


Get’s file sharing details

Base Command

concentricai-get-file-sharing-details

Input

Argument Name Description Required
cid File ID. Required

Context Output

Path Type Description
ConcentricAI.FileSharingInfo.type Array Sharing type.
ConcentricAI.FileSharingInfo.user_name Array User name.

Configuration parameters

  • url — Server URL (required)
  • min_severity — Minimum severity of alerts to fetch (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • client_id — Client ID
  • client_secret — Client Secret
  • domain — Domain
  • max_fetch — Maximum no. of incidents to fetch.
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • first_fetch — First Fetch Time of Risks

Commands (4)

  • concentricai-get-file-details

    Get's file information.

  • concentricai-get-file-sharing-details

    Get's file sharing details.

  • concentricai-get-user-details

    Get's user details.

  • concentricai-get-users-overview

    Get overview of Users involved.

import json
from datetime import datetime


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def get_headers_for_login():
    headers_for_login = {
        "Authorization": "Basic some-alphanumeric",
        "X-Domain": "Domain-1",
        "grant_type": "client_credentials",
        "Content-Type": "application/json",
    }
    return headers_for_login


def get_headers_for_query():
    headers_for_query = {
        "Cookie": "COOKIE",
        "X-Domain": "DOMAIN",
        "grant_type": "client_credentials",
        "client_id": "CLIENT_ID",
        "Content-Type": "application/json",
    }
    return headers_for_query


def setup():
    from ConcentricAI import LoginClient, QueryClient, initialise_scrolls_and_rules

    headers_login = get_headers_for_login()
    loginClient = LoginClient(base_url="https://mock-url.com", verify="False", headers=headers_login, proxy="False")
    headers_query = get_headers_for_query()
    queryClient = QueryClient(base_url="https://mock-url.com", headers=headers_query, proxy="False")
    initialise_scrolls_and_rules()
    return loginClient, queryClient


def test_test_module(requests_mock):
    from ConcentricAI import LoginClient, test_module

    headers = get_headers_for_login()
    loginClient = LoginClient(base_url="https://mock-url.com", verify="False", headers=headers, proxy="False")

    mock_response = {"accessToken": "token"}
    requests_mock.get("https://mock-url.com/api/v1/login", json=mock_response)
    response = test_module(loginClient)
    assert response == "ok"


def test_fetch_incidents(requests_mock):
    # given : Mock response and arguments needed for the given call
    from ConcentricAI import fetch_incidents

    loginClient, queryClient = setup()
    last_run: dict = {}
    max_results = "100"
    fetch_time = "3 days"
    mock_response = util_load_json("test_data/mock_incident.json")
    requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"])
    # when : Actual function call
    _, new_incidents = fetch_incidents(loginClient, queryClient, last_run, max_results, fetch_time)
    t = datetime.fromtimestamp(int("1600114903415") / 1000)
    inced_time = t.strftime("%Y-%m-%dT%H:%M:%SZ")
    rawJson = (
        '{"cid": "8f4619ebc927276a5908db0e46be2e7da14df3bd", "rule_name": "risk1,risk3", '
        '"service": "sharepoint", "name": "file-name-1", "file-path": "file-path", '
        '"owner": ["joe@company.com"], "risk": "high", "risk_timestamp": "1600114903415"}'
    )
    # then : Assert values of the incident populated.
    assert new_incidents == [{"name": "file-name-1", "occurred": inced_time, "severity": 3, "rawJSON": rawJson}]


def test_fetch_file_information(requests_mock):
    # given : Mock response and arguments needed for the given call
    from ConcentricAI import fetch_file_information

    loginClient, queryClient = setup()
    path = "path"
    name = "file-name-1"
    mock_response = util_load_json("test_data/mock_file_information.json")
    requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"])
    # when : Actual function call
    result = fetch_file_information(loginClient, queryClient, path, name)
    # then : Assert values of the Output prefix
    assert result.outputs_prefix == "ConcentricAI.FileInfo"
    assert result.outputs_key_field == "ownerDetails"
    assert result.outputs == mock_response["output"]


def test_get_users_overview(requests_mock):
    # given : Mock response and arguments needed for the given call
    from ConcentricAI import get_users_overview

    loginClient, queryClient = setup()
    mock_response = util_load_json("test_data/mock_user_overview.json")
    requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"])
    max_users = "10"
    # when : Actual function call
    result = get_users_overview(loginClient, queryClient, max_users)
    # then : Assert values of the Output prefix
    assert result.outputs_prefix == "ConcentricAI.UserInfo"
    assert result.outputs_key_field == "info"


def test_get_user_details(requests_mock):
    # given : Mock response and arguments needed for the given call
    from ConcentricAI import get_user_details

    loginClient, queryClient = setup()
    mock_response = util_load_json("test_data/mock_user_details.json")
    requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"])
    user = "joe"
    # when : Actual function call
    result = get_user_details(loginClient, queryClient, user)
    # then : Assert values of the Output prefix
    assert result.outputs_prefix == "ConcentricAI.UserDetails"
    assert result.outputs_key_field == "info"


def test_get_file_sharing_details(requests_mock):
    # given : Mock response and arguments needed for the given call
    from ConcentricAI import get_file_sharing_details

    loginClient, queryClient = setup()
    mock_response = util_load_json("test_data/mock_file_permissions.json")
    requests_mock.post("https://mock-url.com/graphql-third-party", json=mock_response["response"])
    cid = "lsknadkl12312"
    # when : Actual function call
    result = get_file_sharing_details(loginClient, queryClient, cid)
    # then : Assert values of the Output prefix
    assert result.outputs_prefix == "ConcentricAI.FileSharingInfo"
    assert result.outputs_key_field == "info"