CounterCraft Deception Director

CounterCraft Deception Solution detects advanced adversaries. Automate counterintelligence campaigns to discover targeted attacks with real-time active response.

Deception & Breach Simulation · CounterCraft Deception Director

Details

IDCounterCraft Deception Director
ProviderCounterCraft
CategoryDeception & Breach Simulation
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Overview

CounterCraft Deception Solution detects advanced adversaries. Automate counterintelligence campaigns to discover targeted attacks with real-time active response.
This integration was integrated and tested with version 2.5.13 of CounterCraft Deception Director

CounterCraft Deception Director Playbook

Use Cases

  • Query IOCs (objects) in your Deception Director
  • Retrieve events from your deception campaigns
  • Retrieve configuration from your Deception Director
  • Retrieve alerts (notifications) from your Deception Director
  • Create new deception campaigns
  • Create new deception hosts
  • Operate your campaigns, hosts, services and breadcrumbs

Prerequisites

You need to obtain the following Deception Director information.

  • Server URL
  • API Key
  • Secret Key

In order to obtain the API Key and the Secret Key you need to go to the user settings in the Deception Director
and copy both or generate a new pair if they are not already generated.

Configure CounterCraft Deception Director on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for CounterCraft Deception Director.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Deception Director Domain or IP Address: for example, https://192.168.1.1
    • Fetch incidents: if you select this option, your notifications in the Deception Director will be created as Cortex XSOAR incidents.
    • Incident type
    • API Key for Deception Director connection: paste your API Key.
    • Secret Key for Deception Director connection: paste your Secret Key.
    • Ignore SSL Warnings: in case the SSL certificate is self-signed.
    • Use system proxy settings: in case you need to connect through a proxy.
  4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. countercraft-list-campaigns
  2. countercraft-list-hosts
  3. countercraft-list-services
  4. countercraft-list-breadcrumbs
  5. countercraft-get-object
  6. countercraft-get-events
  7. countercraft-create-campaign
  8. countercraft-list-dsns
  9. countercraft-list-providers
  10. countercraft-create-host-machine
  11. countercraft-list-incidents
  12. countercraft-manage-campaign
  13. countercraft-manage-host
  14. countercraft-manage-service
  15. countercraft-manage-breadcrumb

1. countercraft-list-campaigns

List all deception campaigns

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the campaigns you have access to.

Base Command

countercraft-list-campaigns

Input
Argument Name Description Required
name Campaign Name Optional
Context Output
Path Type Description
CounterCraft.Campaign.ID number Campaign ID
CounterCraft.Campaign.Name string Campaign Name
CounterCraft.Campaign.Description string Campaign Description
CounterCraft.Campaign.StatusCode string Campaign Status
Command Example

!countercraft-list-campaigns

Human Readable Output
ID Name Description StatusCode
1 AntiPhishing Gather intelligence from phishers ACTIVE
2 External recoinassance Collect pre-attack evidence ACTIVE
3 Internal lateral movement Detect lateral movement ACTIVE
4 DMZ DMZ activity ACTIVE
5 VIP VIP mobile protection ACTIVE

2. countercraft-list-hosts

Lists all deception hosts

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the hosts you have access to.

Base Command

countercraft-list-hosts

Input
Argument Name Description Required
campaign_id Campaign ID Optional
Context Output
Path Type Description
CounterCraft.Host.ID number Host Id
CounterCraft.Host.Name string Host Name
CounterCraft.Host.Description string Host Description
CounterCraft.Host.StatusCode string Host Status
CounterCraft.Host.TypeCode string Host Type
Command Example

!countercraft-list-hosts campaign_id=2

Human Readable Output
ID Name Description StatusCode TypeCode
1 Ubuntu Web Wordpress ACTIVE MACHINE
2 Azure Windows 2019 RDP with breadcrumbs ACTIVE MACHINE
3 Office365 tenant Office365 with domain name ACTIVE CLOUD_ENTITY
4 Apache Struts Vulnerable Apache Struts ACTIVE MACHINE
5 CFO CFO persona ACTIVE IDENTITY

3. countercraft-list-services

List services currently deployed on deception hosts

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the services you have access to.

Base Command

countercraft-list-services

Input
Argument Name Description Required
host_id Host Id Optional
Context Output
Path Type Description
CounterCraft.Service.ID number Service ID
CounterCraft.Service.Name string Service Name
CounterCraft.Service.Description string Service.Description
CounterCraft.Service.StatusCode string Service Status
CounterCraft.Service.TypeCode string Service Type
Command Example

!countercraft-list-services host_id=1

Human Readable Output
ID Name Description StatusCode TypeCode
1 Operating system User events ACTIVE SYSTEM
2 WebApp Web application ACTIVE WEB_SERVER
8 Tailored Service Anonymous FTP ACTIVE FTP_SERVER
9 Phishing Sinkhole Sinkhole ACTIVE SMTP_SERVER

4. countercraft-list-breadcrumbs

List breadcrumbs in a campaign

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the breadcrumbs you have access to.

Base Command

countercraft-list-breadcrumbs

Input
Argument Name Description Required
campaign_id Campaign ID Optional
Context Output
Path Type Description
CounterCraft.Breadcrumb.ID number Breadcrumb ID
CounterCraft.Breadcrumb.Name string Breadcrumb Name
CounterCraft.Breadcrumb.Description string Breadcrumb Description
CounterCraft.Breadcrumb.StatusCode string Breadcrumb Status
CounterCraft.Breadcrumb.TypeCode string Breadcrumb Type
Command Example

!countercraft-list-breadcrumbs campaign_id=1

Human Readable Output
ID Name Description StatusCode TypeCode
1 Fake document   ACTIVE DOCUMENT
2 Mobile App   ACTIVE MOBILE_APP
3 SSL Certificate   ACTIVE SSL_CERTIFICATE
4 LinkedIn_persona   ACTIVE HONEYTOKEN

5. countercraft-get-object

Get information about an object (IoC)

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the objects you have access to.

Base Command

countercraft-get-object

Input
Argument Name Description Required
value Object value Required
Context Output
Path Type Description
CounterCraft.Object.ID number Object ID
CounterCraft.Object.Value string Object value
CounterCraft.Object.Hits number Object hits
CounterCraft.Object.Score number Object score
CounterCraft.Object.TypeCode string Object type
CounterCraft.Object.FirstSeen date Object first seen
CounterCraft.Object.LastSeen date Object last seen
CounterCraft.Object.EventsCount number Object events count
CounterCraft.Object.Tags string Object tags
Command Example

!countercraft-get-object value=root

Human Readable Output
   
Id 852
Value root
EventsCount 7
TypeCode CC_USERNAME
Score 0
FirstSeen Wed Jan 29 12:33:34 2020
LastSeen Wed Jan 29 12:53:19 2020
Tags  

6. countercraft-get-events

Get full list of Events

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the objects you have access to.

Base Command

countercraft-get-events

Input
Argument Name Description Required
criteria Search criteria Required
max_results Maximum number of results Required
Context Output
Path Type Description
CounterCraft.Event.ID number Event id
CounterCraft.Event.CampaignName string Campaign name
CounterCraft.Event.CategoryCode string Category Code
CounterCraft.Event.EventDate date Event date
CounterCraft.Event.HostName string Host name
CounterCraft.Event.ServiceName string Service name
CounterCraft.Event.TypeCode string Type
CounterCraft.Event.Score number Score
CounterCraft.Event.Tags string Tags
CounterCraft.Events.Data unknown Data
Command Example

!countercraft-get-events criteria="type_code:ValidAuth" max_results="1"

Human Readable Output
     
Id 45  
Campaignname External recoinassance  
Hostname Azure Windows
Servicename OS Logs (Azure Windows)
Eventdate Thu Jan 30 08:11:01 2020  
Score 100  
Typecode ValidAuth  
Data event: ValidAuth subject: A session was reconnected to a Window Station event_id: 4778 …  
Tags attack.T1078  

7. countercraft-create-campaign

Create a new deception campaign

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You can only create campaigns if you have the role ARCHITECT.

Base Command

countercraft-create-campaign

Input
Argument Name Description Required
name Campaign name Required
description Campaign description Required
Context Output
Path Type Description
CounterCraft.Campaign.ID number Campaign ID
CounterCraft.Campaign.Name string Name
CounterCraft.Campaign.Description string Description
CounterCraft.Campaign.StatusCode string Status Code
Command Example

!countercraft-create-campaign name="TestCampaign" description="Test Description"

Human Readable Output
   
Id 5
Name TestCampaign
Description Test Description
StatusCode DESIGN

8. countercraft-list-dsns

List Deception Support Nodes (DSNs)

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You can only create campaigns if you have the role ARCHITECT.

Base Command

countercraft-list-dsns

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output
Path Type Description
CounterCraft.DSN.ID number ID
CounterCraft.DSN.Name string Name
CounterCraft.DSN.Description string Description
CounterCraft.DSN.Hostname string Hostname
CounterCraft.DSN.Port number Port
Command Example

!countercraft-list-dsns

Human Readable Output
   
Id 1
Name Local DSN
Description Local DSN in the intranet
Hostname 192.168.1.2
Port  4567

9. countercraft-list-providers

List providers (providers for hosts or services i.e. AWS or Office365)

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the providers you have access to.

Base Command

countercraft-list-providers

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output
Path Type Description
ID number ID
CounterCraft.Provider.Name string Name
CounterCraft.Provider.Description string Description
CounterCraft.Provider.TypeCode string Type
CounterCraft.Provider.StatusCode string Status
Command Example

!countercraft-list-providers

Human Readable Output
ID Name Description StatusCode TypeCode
1 Splunk Internal Splunk HEALTHY SPLUNK_PROVIDER
3 Signal Signal notifications HEALTHY SIGNAL_PROVIDER
4 Office365 Office365 Tenant HEALTHY OFFICE365_PROVIDER
5 AWS AWS EC2 HEALTHY AWS_PROVIDER

10. countercraft-create-host-machine

Deploy a new deception host

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to create a host if you are MANAGER in a campaign.

Base Command

countercraft-create-host-machine

Input
Argument Name Description Required
name Name Required
description Description Optional
provider_id Provider Required
deception_support_node_id Deception Support Node ID Required
campaign_id Campaign Required
os_family Operating System Required
ip_address IP Address Required
port Port Required
username Username Required
password Password Required
Context Output
Path Type Description
CounterCraft.Host.Id number Host ID
Command Example

!countercraft-create-host-machine campaign_id=2 deception_support_node_id=1 os_family=linux ip_address=192.168.1.2 port=22 name="Test host" description="Test Description" username="ubuntu" password="ubuntu provider_id=1"

Human Readable Output
   
Id 8
Name Test Host
Description Test Description
StatusCode DESIGN
TypeCode MACHINE

11. countercraft-list-incidents

List all incidents currently active

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the incidents you have access to.

Base Command

countercraft-list-incidents

Input
Argument Name Description Required
campaign_id Campaign ID Required
Context Output
Path Type Description
CounterCraft.Incident.ID number Incident ID
CounterCraft.Incident.Name string Name
CounterCraft.Incident.Description string Description
CounterCraft.Incident.StatusCode string Status
CounterCraft.Incident.TLPCode string TLP code
Command Example

!countercraft-list-incidents campaign_id=1

Human Readable Output
ID Name Description StatusCode TLPCode Tags
1 APT incident State-sponsored OPEN AMBER  
2 Internal Fraud SWIFT apps CLOSED AMBER  

12. countercraft-manage-campaign

Manage Campaign parameters

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to manage only the campaigns you have access to.

Base Command

countercraft-manage-campaign

Input
Argument Name Description Required
campaign_id Campaign ID Required
operation Operation Required
Context Output
Path Type Description
CounterCraft.Campaign.Message string Result message
CounterCraft.Campaign.ID number Campaign ID
Command Example

!countercraft-manage-campaign campaign_id=5 operation=activate

Human Readable Output
   
Id 5
Message Campaign is currently in state: PAUSED. Action activate discarded

13. countercraft-manage-host

Manage a deception host

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to manage only the hosts you have access to.

Base Command

countercraft-manage-host

Input
Argument Name Description Required
host_id Host ID Required
operation Operation Required
Context Output
Path Type Description
CounterCraft.Host.Message string Result message
CounterCraft.Host.ID number Host ID
Command Example

!countercraft-manage-campaign host_id=5 operation=activate

Human Readable Output
   
Id 5
Message Host is currently in state: PAUSED. Action activate discarded

14. countercraft-manage-service

Manage a deception service

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to manage only the services you have access to.

Base Command

countercraft-manage-service

Input
Argument Name Description Required
service_id Service ID Required
operation Operation Required
Context Output
Path Type Description
CounterCraft.Service.Message string Result message
CounterCraft.Service.ID number Service ID
Command Example

!countercraft-manage-campaign service_id=5 operation=activate

Human Readable Output
   
Id 5
Message Service is currently in state: PAUSED. Action activate discarded

15. countercraft-manage-breadcrumb

Manage breadcrumb

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to manage only the breadcrumbs you have access to.

Base Command

countercraft-manage-breadcrumb

Input
Argument Name Description Required
breadcrumb_id Breadcrumb ID Required
operation Operation Required
Context Output
Path Type Description
CounterCraft.Breadcrumb.Message string Result message
CounterCraft.Breadcrumb.ID number Breadcrumb ID
Command Example

!countercraft-manage-campaign breadcrumb_id=5 operation=activate

Human Readable Output
   
Id 5
Message Breadcrumb is currently in state: PAUSED. Action activate discarded

Additional Information

Please check the Deception Director user manual for more guidance on how to use and deploy campaigns.

Configuration parameters

  • server — Deception Director Domain or IP Address (required)
  • api_key — API Key for Deception Director connection (required)
  • secret_key — Secret Key for Deception Director connection (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (15)

  • countercraft-create-campaign

    Create a new deception campaign.

  • countercraft-create-host-machine

    Deploy a new deception host.

  • countercraft-get-events

    Get full list of Events.

  • countercraft-get-object

    Get information about an object (IoC).

  • countercraft-list-breadcrumbs

    List breadcrumbs in a campaign.

  • countercraft-list-campaigns

    List all deception campaigns.

  • countercraft-list-dsns

    List Deception Support Nodes (DSNs).

  • countercraft-list-hosts

    Lists all deception hosts.

  • countercraft-list-incidents

    List all incidents currently active.

  • countercraft-list-providers

    List providers (providers for hosts or services i.e. AWS or Office365).

  • countercraft-list-services

    List services currently deployed on deception hosts.

  • countercraft-manage-breadcrumb

    Manage breadcrumb.

  • countercraft-manage-campaign

    Manage Campaign parameters.

  • countercraft-manage-host

    Manage a deception host.

  • countercraft-manage-service

    Manage a deception service.

Source

CounterCraft.py CounterCraft_test.py CounterCraft.yml CounterCraft_description.md
Download History Raw 
commonfields:
  id: CounterCraft Deception Director
  version: -1
name: CounterCraft Deception Director
display: CounterCraft Deception Director
category: Deception & Breach Simulation
sectionorder:
- Connect
- Collect
provider: CounterCraft
description: CounterCraft Deception Solution detects advanced adversaries. Automate counterintelligence campaigns to discover targeted attacks with real-time active response.
configuration:
- display: Deception Director Domain or IP Address
  name: server
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: API Key for Deception Director connection
  name: api_key
  defaultvalue: ""
  type: 4
  required: true
  section: Connect
- display: Secret Key for Deception Director connection
  name: secret_key
  defaultvalue: ""
  type: 4
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
script:
  script: ''
  type: python
  commands:
  - name: countercraft-list-campaigns
    arguments:
    - name: name
      description: Campaign Name.
    outputs:
    - contextPath: CounterCraft.Campaign.ID
      description: Campaign ID.
      type: number
    - contextPath: CounterCraft.Campaign.Name
      description: Campaign Name.
      type: string
    - contextPath: CounterCraft.Campaign.Description
      description: Campaign Description.
      type: string
    - contextPath: CounterCraft.Campaign.StatusCode
      description: Campaign Status.
      type: string
    description: 'List all deception campaigns.'
  - name: countercraft-list-hosts
    arguments:
    - name: campaign_id
      description: Campaign ID.
    outputs:
    - contextPath: CounterCraft.Host.ID
      description: Host Id.
      type: number
    - contextPath: CounterCraft.Host.Name
      description: Host Name.
      type: string
    - contextPath: CounterCraft.Host.Description
      description: Host Description.
      type: string
    - contextPath: CounterCraft.Host.StatusCode
      description: Host Status.
      type: string
    - contextPath: CounterCraft.Host.TypeCode
      description: Host Type.
      type: string
    - contextPath: Host.Domain
      description: The domain of the host.
      type: string
    - contextPath: Host.Hostname
      description: The name of the host.
      type: string
    - contextPath: Host.BIOSVersion
      description: The BIOS version of the host.
      type: string
    - contextPath: Host.ID
      description: The UUID of the host.
      type: string
    - contextPath: Host.IP
      description: The IP address of the host.
      type: string
    - contextPath: Host.Memory
      description: The memory of the host.
      type: string
    - contextPath: Host.Model
      description: The model of the host.
      type: string
    - contextPath: Host.OS
      description: The OS of the host.
      type: string
    - contextPath: Host.OSVersion
      description: The OS version of the host.
      type: string
    - contextPath: Host.Processor
      description: The processor of the host.
      type: string
    - contextPath: Host.Processors
      description: The number of processors of the host.
      type: string
    description: Lists all deception hosts.
  - name: countercraft-list-services
    arguments:
    - name: host_id
      description: Host Id.
    outputs:
    - contextPath: CounterCraft.Service.ID
      description: Service ID.
      type: number
    - contextPath: CounterCraft.Service.Name
      description: Service Name.
      type: string
    - contextPath: CounterCraft.Service.Description
      description: Service.Description
      type: string
    - contextPath: CounterCraft.Service.StatusCode
      description: Service Status.
      type: string
    - contextPath: CounterCraft.Service.TypeCode
      description: Service Type.
      type: string
    description: 'List services currently deployed on deception hosts.'
  - name: countercraft-list-breadcrumbs
    arguments:
    - name: campaign_id
      description: Campaign ID.
    outputs:
    - contextPath: CounterCraft.Breadcrumb.ID
      description: Breadcrumb ID.
      type: number
    - contextPath: CounterCraft.Breadcrumb.Name
      description: Breadcrumb Name.
      type: string
    - contextPath: CounterCraft.Breadcrumb.Description
      description: Breadcrumb Description.
      type: string
    - contextPath: CounterCraft.Breadcrumb.StatusCode
      description: Breadcrumb Status.
      type: string
    - contextPath: CounterCraft.Breadcrumb.TypeCode
      description: Breadcrumb Type.
      type: string
    description: List breadcrumbs in a campaign.
  - name: countercraft-get-object
    arguments:
    - name: value
      required: true
      description: Object value. For example 'root' or '192.168.1.1'.
    outputs:
    - contextPath: CounterCraft.Object.ID
      description: Object ID.
      type: number
    - contextPath: CounterCraft.Object.Value
      description: Object value.
      type: string
    - contextPath: CounterCraft.Object.Hits
      description: Object hits.
      type: number
    - contextPath: CounterCraft.Object.Score
      description: Object score.
      type: number
    - contextPath: CounterCraft.Object.TypeCode
      description: Object type.
      type: string
    - contextPath: CounterCraft.Object.FirstSeen
      description: Object first seen.
      type: date
    - contextPath: CounterCraft.Object.LastSeen
      description: Object last seen.
      type: date
    - contextPath: CounterCraft.Object.EventsCount
      description: Object events count.
      type: number
    - contextPath: CounterCraft.Object.Tags
      description: Object tags.
      type: string
    description: Get information about an object (IoC).
  - name: countercraft-get-events
    arguments:
    - name: criteria
      required: true
      description: Search criteria. For example 'type_code:ValidAuth'.
    - name: max_results
      default: true
      description: Maximum number of results.
      defaultValue: "50"
    outputs:
    - contextPath: CounterCraft.Event.ID
      description: Event id.
      type: number
    - contextPath: CounterCraft.Event.CampaignName
      description: Campaign name.
      type: string
    - contextPath: CounterCraft.Event.CategoryCode
      description: Category Code.
      type: string
    - contextPath: CounterCraft.Event.EventDate
      description: Event date.
      type: date
    - contextPath: CounterCraft.Event.HostName
      description: Host name.
      type: string
    - contextPath: CounterCraft.Event.ServiceName
      description: Service name.
      type: string
    - contextPath: CounterCraft.Event.TypeCode
      description: Type.
      type: string
    - contextPath: CounterCraft.Event.Score
      description: Score.
      type: number
    - contextPath: CounterCraft.Event.Tags
      description: Tags.
      type: string
    - contextPath: CounterCraft.Events.Data
      description: Data.
      type: unknown
    description: Get full list of Events.
  - name: countercraft-create-campaign
    arguments:
    - name: name
      required: true
      description: Campaign name.
    - name: description
      required: true
      description: Campaign description.
    outputs:
    - contextPath: CounterCraft.Campaign.ID
      description: Campaign ID.
      type: number
    - contextPath: CounterCraft.Campaign.Name
      description: Name.
      type: string
    - contextPath: CounterCraft.Campaign.Description
      description: Description.
      type: string
    - contextPath: CounterCraft.Campaign.StatusCode
      description: Status Code.
      type: string
    description: Create a new deception campaign.
  - name: countercraft-list-dsns
    arguments: []
    outputs:
    - contextPath: CounterCraft.DSN.ID
      description: ID.
      type: number
    - contextPath: CounterCraft.DSN.Name
      description: Name.
      type: string
    - contextPath: CounterCraft.DSN.Description
      description: Description.
      type: string
    - contextPath: CounterCraft.DSN.Hostname
      description: Hostname.
      type: string
    - contextPath: CounterCraft.DSN.Port
      description: Port.
      type: number
    description: List Deception Support Nodes (DSNs).
  - name: countercraft-list-providers
    arguments: []
    outputs:
    - contextPath: ID
      description: ID.
      type: number
    - contextPath: CounterCraft.Provider.Name
      description: Name.
      type: string
    - contextPath: CounterCraft.Provider.Description
      description: Description.
      type: string
    - contextPath: CounterCraft.Provider.TypeCode
      description: Type.
      type: string
    - contextPath: CounterCraft.Provider.StatusCode
      description: Status.
      type: string
    description: 'List providers (providers for hosts or services i.e. AWS or Office365).'
  - name: countercraft-create-host-machine
    arguments:
    - name: name
      required: true
      description: Name.
    - name: description
      description: Description.
    - name: provider_id
      required: true
      description: Provider.
    - name: deception_support_node_id
      required: true
      description: Deception Support Node ID.
    - name: campaign_id
      required: true
      description: ID of the campaign where you want to deploy a new host. You can execute countercraft-list-campaigns in order to obtain the ID.
    - name: os_family
      required: true
      auto: PREDEFINED
      predefined:
      - windows
      - linux
      description: Operating System.
    - name: ip_address
      required: true
      description: IP Address.
    - name: port
      required: true
      description: Port.
    - name: username
      required: true
      description: Username.
    - name: password
      required: true
      description: Password.
    outputs:
    - contextPath: CounterCraft.Host.Id
      description: Host ID.
      type: number
    description: Deploy a new deception host.
  - name: countercraft-list-incidents
    arguments:
    - name: campaign_id
      required: true
      description: Campaign ID.
    outputs:
    - contextPath: CounterCraft.Incident.ID
      description: Incident ID.
      type: number
    - contextPath: CounterCraft.Incident.Name
      description: Name.
      type: string
    - contextPath: CounterCraft.Incident.Description
      description: Description.
      type: string
    - contextPath: CounterCraft.Incident.StatusCode
      description: Status.
      type: string
    - contextPath: CounterCraft.Incident.TLPCode
      description: TLP code.
      type: string
    description: List all incidents currently active.
  - name: countercraft-manage-campaign
    arguments:
    - name: campaign_id
      required: true
      description: Campaign ID.
    - name: operation
      required: true
      auto: PREDEFINED
      predefined:
      - activate
      - pause
      - resume
      - terminate
      description: Operation.
    outputs:
    - contextPath: CounterCraft.Campaign.Message
      description: Result message.
      type: string
    - contextPath: CounterCraft.Campaign.ID
      description: Campaign ID.
      type: number
    description: Manage Campaign parameters.
  - name: countercraft-manage-host
    arguments:
    - name: host_id
      required: true
      description: Host ID.
    - name: operation
      required: true
      auto: PREDEFINED
      predefined:
      - activate
      - pause
      - resume
      - terminate
      description: Operation.
    outputs:
    - contextPath: CounterCraft.Host.Message
      description: Result message.
      type: string
    - contextPath: CounterCraft.Host.ID
      description: Host ID.
      type: number
    description: Manage a deception host.
  - name: countercraft-manage-service
    arguments:
    - name: service_id
      required: true
      description: Service ID.
    - name: operation
      required: true
      auto: PREDEFINED
      predefined:
      - activate
      - pause
      - resume
      - terminate
      description: Operation.
    outputs:
    - contextPath: CounterCraft.Service.Message
      description: Result message.
      type: string
    - contextPath: CounterCraft.Service.ID
      description: Service ID.
      type: number
    description: Manage a deception service.
  - name: countercraft-manage-breadcrumb
    arguments:
    - name: breadcrumb_id
      required: true
      description: Breadcrumb ID.
    - name: operation
      required: true
      auto: PREDEFINED
      predefined:
      - activate
      - pause
      - resume
      - terminate
      description: Operation.
    outputs:
    - contextPath: CounterCraft.Breadcrumb.Message
      description: Result message.
      type: string
    - contextPath: CounterCraft.Breadcrumb.ID
      description: Breadcrumb ID.
      type: number
    description: Manage  breadcrumb.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  subtype: python3
fromversion: 5.0.0
tests:
- CounterCraft - Test