Covalence For Security Providers

Triggers by any alert from endpoint, cloud, and network security monitoring, with mitigation steps where applicable. Query Covalence for more detail.

Endpoint · Covalence For Security Providers

Details

IDCovalence For Security Providers
ProviderCobalt Strike
CategoryEndpoint
From Version5.0.0
Docker Imagedemisto/xsoar-tools:1.0.0.11807991
Supported ModulesAgentix XSIAM

README

Triggers by any alert from endpoint, cloud, and network security monitoring, with mitigation steps where applicable. Query Covalence for more detail.
This integration was integrated and tested with version 3.0 of Covalence For Security Providers

Configure Covalence For Security Providers in Cortex

Parameter Description Required
Broker Set to true if connections are made through a broker False
Host Covalence’s host (IP or domain) or broker’s socket (ip:port) if using broker True
Credentials   True
Password   True
Verify SSL If set to false, will trust any certificate (not secure) False
Timeout Timeout in seconds False
First run time range When fetching incidents for the first time, this parameter specifies in days how far the integration looks for incidents. For instance if set to “2”, it will pull all alerts in Covalence for the last 2 days and will create corresponding incidents. False
Fetch limit Maximum number of alerts to be fetch per fetch command. It is advised to not fetch more than 200 alerts. False
Use system proxy settings   False
Fetch incidents   False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
None   False
Incident type   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cov-secpr-list-alerts

Lists Covalence alerts

Base Command

cov-secpr-list-alerts

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
max_count Maximum number of alerts to be returned, if none provided will be set to 1000. Optional
initial_index Initial index where to start listing alerts. Optional
alert_type Alert type to be listed. Optional
alert_time_min Minimal alert time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
alert_time_max Maximal alert time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.Alert.acknowledgedStatus String Acknowledged Status
Covalence.Alert.alertCount Number Alert Count
Covalence.Alert.alertHash String Alert Hash
Covalence.Alert.analystDescription String Analyst Description
Covalence.Alert.analystTitle String Analyst Title
Covalence.Alert.assignee String Assignee
Covalence.Alert.blacklistDetails.blacklistedEntity String Blacklisted Entity
Covalence.Alert.blacklistDetails.bytesIn Number Bytes In
Covalence.Alert.blacklistDetails.bytesOut Number Bytes Out
Covalence.Alert.blacklistDetails.listLabels String List Labels
Covalence.Alert.blacklistDetails.listUuids String List Uuids
Covalence.Alert.createdTime Number Created Time
Covalence.Alert.destCiscoUmbrellaRanking Number Dest Cisco Umbrella Ranking
Covalence.Alert.destCiscoUmbrellaTopLevelDomainRanking Number Dest Cisco Umbrella Top Level Domain Ranking
Covalence.Alert.destCityName String Dest City Name
Covalence.Alert.destCountryName unknown Dest Country Name
Covalence.Alert.destDomainName String Dest Domain Name
Covalence.Alert.destGeoX Number Dest Geo X
Covalence.Alert.destGeoY Number Dest Geo Y
Covalence.Alert.destIp String Dest Ip
Covalence.Alert.destIpAttributes.k String Key
Covalence.Alert.destIpAttributes.t Number Type
Covalence.Alert.destIpAttributes.v String Value
Covalence.Alert.destMajesticMillionRanking Number Dest Majestic Million Ranking
Covalence.Alert.destMajesticMillionTopLevelDomainRanking Number Dest Majestic Million Top Level Domain Ranking
Covalence.Alert.destPort String Dest Port
Covalence.Alert.endpointAgentUuid String Endpoint Agent Uuid
Covalence.Alert.facility String Facility
Covalence.Alert.id String Id
Covalence.Alert.isFavorite Boolean Is Favorite
Covalence.Alert.lastAlertedTime Number Last Alerted Time
Covalence.Alert.notes String Notes
Covalence.Alert.organizationId String Organization Id
Covalence.Alert.pcapResourceUuid String Pcap Resource Uuid
Covalence.Alert.priority unknown Priority
Covalence.Alert.protocol String Protocol
Covalence.Alert.sensorId String Sensor Id
Covalence.Alert.severity String Severity
Covalence.Alert.sigEvalDetails.id Number Id
Covalence.Alert.sigEvalDetails.message String Message
Covalence.Alert.sourceCiscoUmbrellaRanking Number Source Cisco Umbrella Ranking
Covalence.Alert.sourceCiscoUmbrellaTopLevelDomainRanking Number Source Cisco Umbrella Top Level Domain Ranking
Covalence.Alert.sourceCityName String Source City Name
Covalence.Alert.sourceCountryName String Source Country Name
Covalence.Alert.sourceDomainName String Source Domain Name
Covalence.Alert.sourceGeoX Number Source Geo X
Covalence.Alert.sourceGeoY Number Source Geo Y
Covalence.Alert.sourceIp String Source Ip
Covalence.Alert.sourceIpAttributes.k String Key
Covalence.Alert.sourceIpAttributes.t Number Type
Covalence.Alert.sourceIpAttributes.v String Value
Covalence.Alert.sourceMajesticMillionRanking Number Source Majestic Million Ranking
Covalence.Alert.sourceMajesticMillionTopLevelDomainRanking Number Source Majestic Million Top Level Domain Ranking
Covalence.Alert.sourcePort String Source Port
Covalence.Alert.subType String Sub Type
Covalence.Alert.title String Title
Covalence.Alert.type String Type

Command Example


#### Context Example

```json
{
    "Covalence": {
        "Alert": [
            {
                "acknowledgedStatus": "None",
                "analystDescription": "We've detected suspicious persistent software, C:\\\\test.ps1, on the following system: DESKTOP-1.",
                "analystTitle": "Suspicious persistent software detected",
                "destIp": null,
                "sourceIp": null,
                "subType": "Analytic",
                "title": "Analyst alert",
                "type": "ANALYST GENERIC"
            }
        ]
    }
}

Human Readable Output

Alerts

Acknowledgedstatus Analystdescription Analysttitle Subtype Title Type
None We’ve detected suspicious persistent software, C:\test.ps1, on the following system: DESKTOP-1 Suspicious persistent software detected Analytic Analyst alert ANALYST GENERIC

cov-secpr-list-sensors

Lists Covalence sensors

Base Command

cov-secpr-list-sensors

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.Sensors.id String Id
Covalence.Sensors.name String Name
Covalence.Sensors.isAuthorized Boolean Is Authorized
Covalence.Sensors.isNetflowGenerator Boolean Is Netflow Generator
Covalence.Sensors.bytesIn Number Bytes In
Covalence.Sensors.bytesOut Number Bytes Out
Covalence.Sensors.lastActive String Last Active
Covalence.Sensors.listeningInterfaces String Listening Interfaces

Command Example


#### Context Example

```json
{
    "Covalence": {
        "Sensors": [
            {
                "isAuthorized": false,
                "isNetflowGenerator": true,
                "name": "External Sources"
            },
            {
                "isAuthorized": true,
                "isNetflowGenerator": false,
                "name": "1.1.1.1"
            }
        ]
    }
}

Human Readable Output

Sensors

Isauthorized Isnetflowgenerator Name
false true External Sources
true false 1.1.1.1

cov-secpr-get-sensor

Get sensor details when provided with the sensor id

Base Command

cov-secpr-get-sensor

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
sensor_id Sensor id. Required

Context Output

Path Type Description
Covalence.Sensor.id String Id
Covalence.Sensor.name String Name
Covalence.Sensor.isAuthorized Boolean Is Authorized
Covalence.Sensor.listeningInterfaces String Listening Interfaces
Covalence.Sensor.isNetflowGenerator Boolean Is Netflow Generator
Covalence.Sensor.bytesIn Number Bytes In
Covalence.Sensor.bytesOut Number Bytes Out
Covalence.Sensor.lastActive String Last Active

Command Example

!cov-secpr-get-sensor sensor_id=94397407-5577-4d14-8f21-9a65ad5ac7fe

Context Example

{
    "Covalence": {
        "Sensor": {
            "bytesIn": null,
            "bytesOut": null,
            "id": "94397407-5577-4d14-8f21-9a65ad5ac7fe",
            "isAuthorized": true,
            "isNetflowGenerator": false,
            "listeningInterfaces": [
                "eth0",
                "eth1"
            ],
            "name": "1.1.1.1"
        }
    }
}

Human Readable Output

Sensor

Id Isauthorized Isnetflowgenerator Listeninginterfaces Name
94397407-5577-4d14-8f21-9a65ad5ac7fe true false eth0,
eth1		 1.1.1.1

cov-secpr-connections-summary-ip

List summarized connections details by IP Address

Base Command

cov-secpr-connections-summary-ip

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
max_count Maximum number of connection summary by ip to be returned, if none provided will be set to 100. Optional
initial_index Initial index where to start listing connection summaries. Optional
source_ip source ip filter, if used only connections related to the specified source ip will be returned. Optional
start_time Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
end_time Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
clients_only if “clients_only=true”, only connections labeled as client connections will be returned. Optional
internal_only if “internal_only=true”, only internal connections will be returned. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.Connections.averageDuration Number Average Duration
Covalence.Connections.bytesIn Number Bytes In
Covalence.Connections.bytesOut Number Bytes Out
Covalence.Connections.clientServerRelationship String Client Server Relationship
Covalence.Connections.continuingConnectionCount Number Continuing Connection Count
Covalence.Connections.destinationCity String Destination City
Covalence.Connections.destinationCountry String Destination Country
Covalence.Connections.destinationId String Destination Id
Covalence.Connections.destinationIpAddress String Destination Ip Address
Covalence.Connections.destinationMacAddress String Destination Mac Address
Covalence.Connections.dstDomainName String Dst Domain Name
Covalence.Connections.id String Id
Covalence.Connections.packetsIn Number Packets In
Covalence.Connections.packetsOut Number Packets Out
Covalence.Connections.serverPortCount Number Server Port Count
Covalence.Connections.serverPorts String Server Ports
Covalence.Connections.sourceCity String Source City
Covalence.Connections.sourceCountry String Source Country
Covalence.Connections.sourceDomainName String Source Domain Name
Covalence.Connections.sourceId String Source Id
Covalence.Connections.sourceIpAddress String Source Ip Address
Covalence.Connections.sourceMacAddress String Source Mac Address
Covalence.Connections.terminatedConnectionCount Number Terminated Connection Count
Covalence.Connections.totalDuration Number Total Duration

Command Example

!cov-secpr-connections-summary-ip source_ip=1.1.1.1 max_count=10

Context Example

{
    "Covalence": {
        "Connections": [
            {
                "averageDuration": 0,
                "bytesIn": 13360769,
                "bytesOut": 8645498,
                "clientServerRelationship": "CLIENT",
                "destinationIpAddress": "8.8.8.8",
                "dstDomainName": "dns.google",
                "serverPorts": "0,53,443",
                "sourceDomainName": null,
                "sourceIpAddress": "1.1.1.1"
            }
        ]
    }
}

Human Readable Output

Connections

Averageduration Bytesin Bytesout Clientserverrelationship Destinationipaddress Dstdomainname Serverports Sourceipaddress
0 13360769 8645498 CLIENT 8.8.8.8 dns.google 0,53,443 1.1.1.1

cov-secpr-connections-summary-port

List summarized connections details by Port

Base Command

cov-secpr-connections-summary-port

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
max_count Maximum number of connection summary by port to be returned, if none provided will be set to 100. Optional
initial_index Initial index where to start listing connection summaries. Optional
source_ip source ip filter, only connections related to the specified source ip will be returned. Required
start_time Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
end_time Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
clients_only if “clients_only=true”, only connections labeled as client connections will be returned. Optional
internal_only if “internal_only=true”, only internal connections will be returned. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.Connections.averageDuration Number Average Duration
Covalence.Connections.bytesIn Number Bytes In
Covalence.Connections.bytesOut Number Bytes Out
Covalence.Connections.continuingConnectionCount Number Continuing Connection Count
Covalence.Connections.destinationCity String Destination City
Covalence.Connections.destinationCountry String Destination Country
Covalence.Connections.destinationId String Destination Id
Covalence.Connections.destinationIpAddress String Destination Ip Address
Covalence.Connections.destinationMacAddress String Destination Mac Address
Covalence.Connections.dstDomainName String Dst Domain Name
Covalence.Connections.endTime Date End Time
Covalence.Connections.id String Id
Covalence.Connections.packetsIn Number Packets In
Covalence.Connections.packetsOut Number Packets Out
Covalence.Connections.protocol String Protocol
Covalence.Connections.serverPort Number Server Port
Covalence.Connections.sourceCity String Source City
Covalence.Connections.sourceCountry String Source Country
Covalence.Connections.sourceDomainName String Source Domain Name
Covalence.Connections.sourceId String Source Id
Covalence.Connections.sourceIpAddress String Source Ip Address
Covalence.Connections.sourceMacAddress String Source Mac Address
Covalence.Connections.startTime Date Start Time
Covalence.Connections.terminatedConnectionCount Number Terminated Connection Count
Covalence.Connections.totalDuration Number Total Duration

Command Example

!cov-secpr-connections-summary-port source_ip=1.1.1.1 max_count=10

Context Example

{
    "Covalence": {
        "Connections": [
            {
                "averageDuration": 44,
                "bytesIn": 0,
                "bytesOut": 305837,
                "destinationIpAddress": "8.8.8.8",
                "dstDomainName": "dns.google",
                "serverPort": 0,
                "sourceDomainName": null,
                "sourceIpAddress": "1.1.1.1"
            }
        ]
    }
}

Human Readable Output

Connections

Averageduration Bytesin Bytesout Destinationipaddress Dstdomainname Serverport Sourceipaddress
44 0 305837 8.8.8.8 dns.google 0 1.1.1.1

cov-secpr-list-dns-resolutions

List summarized connections details by Port

Base Command

cov-secpr-list-dns-resolutions

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
max_count Maximum number of DNS resolutions to be returned, if none provided will be set to 100. Optional
initial_index Initial index where to start listing DNS resolutions. Optional
request_time_after Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
request_time_before Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
domain_name Domain name filter, if used will only return DNS resolutions from the specified domain name. Optional
resolved_ip IP filter, if used will only return DNS resolutions to the specified IP. Optional
request_origin_ip Source IP filter, if used will only return DNS resolutions originating from the specified IP. Optional
nameserver_ip Nameserver IP filter, if used will only return DNS resolutions involving the specified nameserver IP. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.DNSResolutions.id String Id
Covalence.DNSResolutions.domainName String Domain Name
Covalence.DNSResolutions.resolvedIp String Resolved Ip
Covalence.DNSResolutions.requestOriginIp String Request Origin Ip
Covalence.DNSResolutions.nameserverIp String Nameserver Ip
Covalence.DNSResolutions.nodeLabel String Node Label
Covalence.DNSResolutions.requestTime Number Request Time
Covalence.DNSResolutions.byteCount Number Byte Count
Covalence.DNSResolutions.pktCount Number Pkt Count

Command Example

!cov-secpr-list-dns-resolutions max_count=10

Context Example

{
    "Covalence": {
        "DNSResolutions": [
            {
                "domainName": "ntp.ubuntu.com",
                "requestOriginIp": "1.1.1.1",
                "requestTime": 1625752183,
                "resolvedIp": "2001:67c:1560:8003::c7"
            }
        ]
    }
}

Human Readable Output

DNS Resolutions

Domainname Requestoriginip Requesttime Resolvedip
ntp.ubuntu.com 1.1.1.1 1625752183 2001:67c:1560:8003::c7

cov-secpr-list-internal-networks

List internal networks

Base Command

cov-secpr-list-internal-networks

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional

Context Output

Path Type Description
Covalence.InternalNetworks.cidr String Cidr
Covalence.InternalNetworks.notes String Notes

Command Example


#### Context Example

```json
{
    "Covalence": {
        "InternalNetworks": {
            "cidr": "'1.1.1.1/24'",
            "notes": "'update'"
        }
    }
}

Human Readable Output

Internal Networks

Cidr Notes
‘1.1.1.1/24’ ‘update’

cov-secpr-set-internal-networks

Set internal networks

Base Command

cov-secpr-set-internal-networks

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
cidr The network to be set as internal in CIDR notation. Required
notes Comment notes associated with the network, notes must be inside quotes. Required

Context Output

Path Type Description
Covalence.InternalNetworks.cidr String Cidr
Covalence.InternalNetworks.notes String Notes

Command Example

!cov-secpr-set-internal-networks cidr='1.2.1.1/24' notes=update

Context Example

{
    "Covalence": {
        "InternalNetworks": [
            "'1.2.1.1/24'",
            "update"
        ]
    }
}

Human Readable Output

Internal network set as ‘1.2.1.1/24’ with notes “update”

cov-secpr-list-endpoint-agents

List endpoint agents

Base Command

cov-secpr-list-endpoint-agents

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
advanced_filter Advanced filter query, if used any other parameters provided to the command will be ignored. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.EndpointAgents.agentUuid String Agent Uuid
Covalence.EndpointAgents.agentVersion String Agent Version
Covalence.EndpointAgents.firstSeenTime Date First Seen Time
Covalence.EndpointAgents.lastSeenTime Date Last Seen Time
Covalence.EndpointAgents.lastSessionUser String Last Session User
Covalence.EndpointAgents.isMobile Boolean Is Mobile
Covalence.EndpointAgents.isConnected Boolean Is Connected
Covalence.EndpointAgents.coreVersion String Core Version
Covalence.EndpointAgents.coreArchitecture String Core Architecture
Covalence.EndpointAgents.coreOs String Core Os
Covalence.EndpointAgents.operatingSystem String Operating System
Covalence.EndpointAgents.hostName String Host Name
Covalence.EndpointAgents.hardwareVendor String Hardware Vendor
Covalence.EndpointAgents.hardwareModel String Hardware Model
Covalence.EndpointAgents.arch String Arch
Covalence.EndpointAgents.osDistro String Os Distro
Covalence.EndpointAgents.osVersion String Os Version
Covalence.EndpointAgents.kernelVersion String Kernel Version
Covalence.EndpointAgents.operatingSystemReleaseId String Operating System Release Id
Covalence.EndpointAgents.ipAddress String Ip Address
Covalence.EndpointAgents.secondaryIpAddress String Secondary Ip Address
Covalence.EndpointAgents.ipAddresses String Ip Addresses
Covalence.EndpointAgents.serialNumber String Serial Number
Covalence.EndpointAgents.deviceIdentifier String Device Identifier
Covalence.EndpointAgents.cpuArchitectureEnum String Cpu Architecture Enum

Command Example


#### Context Example

```json
{
    "Covalence": {
        "EndpointAgents": [
            {
                "hardwareVendor": "VMware, Inc.",
                "hostName": "DESKTOP-0EENF9N",
                "ipAddress": "192.168.223.132",
                "isConnected": false,
                "lastSessionUser": "jsmith",
                "operatingSystem": "Windows 10 Home",
                "serialNumber": "VMware-56 4d 6d cd 58 53 49 e4-73 20 4b 2d b2 15 ca 36"
            },
            {
                "hardwareVendor": "VMware, Inc.",
                "hostName": "DESKTOP-N0E5EN6",
                "ipAddress": "192.168.223.130",
                "isConnected": false,
                "lastSessionUser": "jdoe",
                "operatingSystem": "Windows 10 Pro",
                "serialNumber": "VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91"
            }
        ]
    }
}

Human Readable Output

Endpoint Agents

Hardwarevendor Hostname Ipaddress Isconnected Lastsessionuser Operatingsystem Serialnumber
VMware, Inc. DESKTOP-0EENF9N 192.168.223.132 false jsmith Windows 10 Home VMware-56 4d 6d cd 58 53 49 e4-73 20 4b 2d b2 15 ca 36
VMware, Inc. DESKTOP-N0E5EN6 192.168.223.130 false jdoe Windows 10 Pro VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91

cov-secpr-find-endpoint-agents-by-user

List endpoint agents where the last session user is the one provided as parameter

Base Command

cov-secpr-find-endpoint-agents-by-user

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
user User filter. Required

Context Output

Path Type Description
Covalence.EndpointAgents.agentUuid String Agent Uuid
Covalence.EndpointAgents.agentVersion String Agent Version
Covalence.EndpointAgents.firstSeenTime Date First Seen Time
Covalence.EndpointAgents.lastSeenTime Date Last Seen Time
Covalence.EndpointAgents.lastSessionUser String Last Session User
Covalence.EndpointAgents.isMobile Boolean Is Mobile
Covalence.EndpointAgents.isConnected Boolean Is Connected
Covalence.EndpointAgents.coreVersion String Core Version
Covalence.EndpointAgents.coreArchitecture String Core Architecture
Covalence.EndpointAgents.coreOs String Core Os
Covalence.EndpointAgents.operatingSystem String Operating System
Covalence.EndpointAgents.hostName String Host Name
Covalence.EndpointAgents.hardwareVendor String Hardware Vendor
Covalence.EndpointAgents.hardwareModel String Hardware Model
Covalence.EndpointAgents.arch String Arch
Covalence.EndpointAgents.osDistro String Os Distro
Covalence.EndpointAgents.osVersion String Os Version
Covalence.EndpointAgents.kernelVersion String Kernel Version
Covalence.EndpointAgents.operatingSystemReleaseId String Operating System Release Id
Covalence.EndpointAgents.ipAddress String Ip Address
Covalence.EndpointAgents.secondaryIpAddress String Secondary Ip Address
Covalence.EndpointAgents.ipAddresses String Ip Addresses
Covalence.EndpointAgents.serialNumber String Serial Number
Covalence.EndpointAgents.deviceIdentifier String Device Identifier
Covalence.EndpointAgents.cpuArchitectureEnum String Cpu Architecture Enum

Command Example

!cov-secpr-find-endpoint-agents-by-user user=jdoe

Context Example

{
    "Covalence": {
        "EndpointAgents": {
            "agentUuid": "4dda9c12-b9ec-498b-8e89-1b2bc9078643",
            "agentVersion": "2.0.1.5",
            "arch": "X64",
            "coreArchitecture": "X64",
            "coreOs": "Windows",
            "coreVersion": "2.0.1.5",
            "cpuArchitectureEnum": "X64",
            "deviceIdentifier": "dff207a9-57e0-417d-b72f-667d1c310a65",
            "firstSeenTime": "2021-03-08 13:57:39",
            "hardwareModel": "VMware7,1",
            "hardwareVendor": "VMware, Inc.",
            "hostName": "DESKTOP-N0E5EN6",
            "ipAddress": "192.168.223.130",
            "ipAddresses": "192.168.223.130",
            "isConnected": false,
            "isMobile": false,
            "kernelVersion": "0.0.0.0",
            "lastSeenTime": "2021-07-07 14:14:58",
            "lastSessionUser": "jdoe",
            "operatingSystem": "Windows 10 Pro",
            "operatingSystemReleaseId": "2009",
            "osDistro": "Professional",
            "osVersion": "10.0.0.19042",
            "secondaryIpAddress": "",
            "serialNumber": "VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91"
        }
    }
}

Human Readable Output

Endpoint Agents

Agentuuid Agentversion Arch Corearchitecture Coreos Coreversion Cpuarchitectureenum Deviceidentifier Firstseentime Hardwaremodel Hardwarevendor Hostname Ipaddress Ipaddresses Isconnected Ismobile Kernelversion Lastseentime Lastsessionuser Operatingsystem Operatingsystemreleaseid Osdistro Osversion Serialnumber
4dda9c12-b9ec-498b-8e89-1b2bc9078643 2.0.1.5 X64 X64 Windows 2.0.1.5 X64 dff207a9-57e0-417d-b72f-667d1c310a65 2021-03-08 13:57:39 VMware7,1 VMware, Inc. DESKTOP-N0E5EN6 192.168.223.130 192.168.223.130 false false 0.0.0.0 2021-07-07 14:14:58 jdoe Windows 10 Pro 2009 Professional 10.0.0.19042 VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91

cov-secpr-find-endpoint-agents-by-uuid

Find the endpoint agent with the UUID provided as parameter

Base Command

cov-secpr-find-endpoint-agents-by-uuid

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
uuid Endpoint agent UUID. Required

Context Output

Path Type Description
Covalence.EndpointAgents.agentUuid String Agent Uuid
Covalence.EndpointAgents.agentVersion String Agent Version
Covalence.EndpointAgents.firstSeenTime Date First Seen Time
Covalence.EndpointAgents.lastSeenTime Date Last Seen Time
Covalence.EndpointAgents.lastSessionUser String Last Session User
Covalence.EndpointAgents.isMobile Boolean Is Mobile
Covalence.EndpointAgents.isConnected Boolean Is Connected
Covalence.EndpointAgents.coreVersion String Core Version
Covalence.EndpointAgents.coreArchitecture String Core Architecture
Covalence.EndpointAgents.coreOs String Core Os
Covalence.EndpointAgents.operatingSystem String Operating System
Covalence.EndpointAgents.hostName String Host Name
Covalence.EndpointAgents.hardwareVendor String Hardware Vendor
Covalence.EndpointAgents.hardwareModel String Hardware Model
Covalence.EndpointAgents.arch String Arch
Covalence.EndpointAgents.osDistro String Os Distro
Covalence.EndpointAgents.osVersion String Os Version
Covalence.EndpointAgents.kernelVersion String Kernel Version
Covalence.EndpointAgents.operatingSystemReleaseId String Operating System Release Id
Covalence.EndpointAgents.ipAddress String Ip Address
Covalence.EndpointAgents.secondaryIpAddress String Secondary Ip Address
Covalence.EndpointAgents.ipAddresses String Ip Addresses
Covalence.EndpointAgents.serialNumber String Serial Number
Covalence.EndpointAgents.deviceIdentifier String Device Identifier
Covalence.EndpointAgents.cpuArchitectureEnum String Cpu Architecture Enum

Command Example

!cov-secpr-find-endpoint-agents-by-uuid uuid=4dda9c12-b9ec-498b-8e89-1b2bc9078643

Context Example

{
    "Covalence": {
        "EndpointAgents": {
            "agentUuid": "4dda9c12-b9ec-498b-8e89-1b2bc9078643",
            "agentVersion": "2.0.1.5",
            "arch": "X64",
            "coreArchitecture": "X64",
            "coreOs": "Windows",
            "coreVersion": "2.0.1.5",
            "cpuArchitectureEnum": "X64",
            "deviceIdentifier": "dff207a9-57e0-417d-b72f-667d1c310a65",
            "firstSeenTime": "2021-03-08 13:57:39",
            "hardwareModel": "VMware7,1",
            "hardwareVendor": "VMware, Inc.",
            "hostName": "DESKTOP-N0E5EN6",
            "ipAddress": "192.168.223.130",
            "ipAddresses": "192.168.223.130",
            "isConnected": false,
            "isMobile": false,
            "kernelVersion": "0.0.0.0",
            "lastSeenTime": "2021-07-07 14:14:58",
            "lastSessionUser": "jdoe",
            "operatingSystem": "Windows 10 Pro",
            "operatingSystemReleaseId": "2009",
            "osDistro": "Professional",
            "osVersion": "10.0.0.19042",
            "secondaryIpAddress": "",
            "serialNumber": "VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91"
        }
    }
}

Human Readable Output

Endpoint Agents

Agentuuid Agentversion Arch Corearchitecture Coreos Coreversion Cpuarchitectureenum Deviceidentifier Firstseentime Hardwaremodel Hardwarevendor Hostname Ipaddress Ipaddresses Isconnected Ismobile Kernelversion Lastseentime Lastsessionuser Operatingsystem Operatingsystemreleaseid Osdistro Osversion Serialnumber
4dda9c12-b9ec-498b-8e89-1b2bc9078643 2.0.1.5 X64 X64 Windows 2.0.1.5 X64 dff207a9-57e0-417d-b72f-667d1c310a65 2021-03-08 13:57:39 VMware7,1 VMware, Inc. DESKTOP-N0E5EN6 192.168.223.130 192.168.223.130 false false 0.0.0.0 2021-07-07 14:14:58 jdoe Windows 10 Pro 2009 Professional 10.0.0.19042 VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91

cov-secpr-search-endpoint-process

Search processes by name or advanced filter, at least one parameter is required

Base Command

cov-secpr-search-endpoint-process

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
name Process name. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.EndpointProcess.id Number Id
Covalence.EndpointProcess.agentUuid String Agent Uuid
Covalence.EndpointProcess.processName String Process Name
Covalence.EndpointProcess.processPath String Process Path
Covalence.EndpointProcess.parentProcessName String Parent Process Name
Covalence.EndpointProcess.parentProcessPath String Parent Process Path
Covalence.EndpointProcess.commandLine String Command Line
Covalence.EndpointProcess.username String Username
Covalence.EndpointProcess.firstSeenTime Date First Seen Time
Covalence.EndpointProcess.lastSeenTime Date Last Seen Time
Covalence.EndpointProcess.lastEndTime Date Last End Time
Covalence.EndpointProcess.seenCount Number Seen Count
Covalence.EndpointProcess.activeCount Number Active Count

Command Example

!cov-secpr-search-endpoint-process name=explorer.exe

Context Example

{
    "Covalence": {
        "EndpointProcess": [
            {
                "commandLine": "C:\\Windows\\Explorer.EXE",
                "firstSeenTime": "2021-03-08T12:25:54.100Z",
                "lastSeenTime": "2021-04-08T15:23:10.069Z",
                "processPath": "C:\\Windows\\explorer.exe",
                "username": "jdoe"
            },
            {
                "commandLine": "C:\\Windows\\Explorer.EXE",
                "firstSeenTime": "2021-04-23T07:24:25.570Z",
                "lastSeenTime": "2021-07-07T09:52:17.352Z",
                "processPath": "C:\\Windows\\explorer.exe",
                "username": "jsmith"
            }
        ]
    }
}

Human Readable Output

Endpoint Process

Commandline Firstseentime Lastseentime Processpath Username
C:\Windows\Explorer.EXE 2021-03-08T12:25:54.100Z 2021-04-08T15:23:10.069Z C:\Windows\explorer.exe jdoe
C:\Windows\Explorer.EXE 2021-04-23T07:24:25.570Z 2021-07-07T09:52:17.352Z C:\Windows\explorer.exe jsmith

cov-secpr-search-endpoint-installed-software

Search for endpoint installed software

Base Command

cov-secpr-search-endpoint-installed-software

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
name The name of installed software, quotes are required is space character is used. At least one parameter is required. Required
version The version of installed software. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.EndpointSoftware.arch Number Arch
Covalence.EndpointSoftware.type Number Type
Covalence.EndpointSoftware.packageManager Number Package Manager
Covalence.EndpointSoftware.installTimestamp Date Install Timestamp
Covalence.EndpointSoftware.uninstallTimestamp Date Uninstall Timestamp
Covalence.EndpointSoftware.name String Name
Covalence.EndpointSoftware.version String Version
Covalence.EndpointSoftware.vendor String Vendor
Covalence.EndpointSoftware.installPath String Install Path
Covalence.EndpointSoftware.appDataPath String App Data Path
Covalence.EndpointSoftware.sharedDataPath String Shared Data Path
Covalence.EndpointSoftware.installedForUser String Installed For User
Covalence.EndpointSoftware.installSource String Install Source
Covalence.EndpointSoftware.id Number Id
Covalence.EndpointSoftware.agentUuid String Agent Uuid
Covalence.EndpointSoftware.softwareNotifyAction String Software Notify Action

Command Example

!cov-secpr-search-endpoint-installed-software name=firefox

Context Example

{
    "Covalence": {
        "EndpointSoftware": {
            "installTimestamp": "1970-01-01T00:00:00.000Z",
            "name": "Mozilla Firefox 88.0 (x86 fr)",
            "uninstallTimestamp": null,
            "vendor": "Mozilla",
            "version": "88.0"
        }
    }
}

Human Readable Output

Endpoint Software

Installtimestamp Name Vendor Version
1970-01-01T00:00:00.000Z Mozilla Firefox 88.0 (x86 fr) Mozilla 88.0

cov-secpr-list-organizations

List monitored organizations, only available in broker mode

Base Command

cov-secpr-list-organizations

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Covalence.Organization.org_name String Org_name

Command Example

!cov-secpr-list-organizations

Human Readable Output

No organizations found

Configuration parameters

  • broker — Broker
  • host — Host (required)
  • credentials — Credentials (required)
  • verify_ssl — Verify SSL
  • timeout — Timeout
  • first_run_time_range — First run time range
  • fetch_limit — Fetch limit
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • incidentType — Incident type
  • max_fetch — Fetch limit

Commands (14)

  • cov-secpr-connections-summary-ip

    List summarized connections details by IP Address.

  • cov-secpr-connections-summary-port

    List summarized connections details by Port.

  • cov-secpr-find-endpoint-agents-by-user

    List endpoint agents where the last session user is the one provided as parameter.

  • cov-secpr-find-endpoint-agents-by-uuid

    Find the endpoint agent with the UUID provided as parameter.

  • cov-secpr-get-sensor

    Get sensor details when provided with the sensor id.

  • cov-secpr-list-alerts

    Lists Covalence alerts.

  • cov-secpr-list-dns-resolutions

    List summarized connections details by Port.

  • cov-secpr-list-endpoint-agents

    List endpoint agents.

  • cov-secpr-list-internal-networks

    List internal networks.

  • cov-secpr-list-organizations

    List monitored organizations, only available in broker mode.

  • cov-secpr-list-sensors

    Lists Covalence sensors.

  • cov-secpr-search-endpoint-installed-software

    Search for endpoint installed software.

  • cov-secpr-search-endpoint-process

    Search processes by name or advanced filter, at least one parameter is required.

  • cov-secpr-set-internal-networks

    Set internal networks.

Source

CovalenceForSecurityProviders.py CovalenceForSecurityProviders_test.py CovalenceForSecurityProviders.yml CovalenceForSecurityProviders_description.md command_examples.txt
Download History Raw 
category: Endpoint
provider: Cobalt Strike
commonfields:
  id: Covalence For Security Providers
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: Set to true if connections are made through a broker
  defaultvalue: 'false'
  display: Broker
  name: broker
  type: 8
  required: false
  section: Connect
- additionalinfo: Covalence's host (IP or domain) or broker's socket (ip:port) if using broker
  display: Host
  name: host
  required: true
  type: 0
  section: Connect
- display: Credentials
  name: credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: If set to false, will trust any certificate (not secure)
  defaultvalue: 'false'
  display: Verify SSL
  name: verify_ssl
  type: 8
  section: Connect
  required: false
- additionalinfo: Timeout in seconds
  defaultvalue: '15'
  display: Timeout
  name: timeout
  type: 0
  required: false
  section: Collect
- additionalinfo: When fetching incidents for the first time, this parameter specifies in days how far the integration looks for incidents. For instance if set to "2", it will pull all alerts in Covalence for the last 2 days and will create corresponding incidents.
  defaultvalue: '1'
  display: First run time range
  name: first_run_time_range
  type: 0
  section: Collect
  required: false
- additionalinfo: Maximum number of alerts to be fetch per fetch command. It is advised to not fetch more than 200 alerts.
  defaultvalue: '200'
  display: Fetch limit
  name: fetch_limit
  type: 0
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- defaultvalue: '50'
  display: Fetch limit
  name: max_fetch
  type: 0
  hidden: true
  required: false
  section: Collect
description: Triggers by any alert from endpoint, cloud, and network security monitoring, with mitigation steps where applicable. Query Covalence for more detail.
display: Covalence For Security Providers
fromversion: 5.0.0
name: Covalence For Security Providers
script:
  commands:
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: Maximum number of alerts to be returned, if none provided will be set to 1000.
      name: max_count
    - description: Initial index where to start listing alerts.
      name: initial_index
    - description: Alert type to be listed.
      name: alert_type
    - description: Minimal alert time in %Y-%m-%dT%H:%M:%S format and UTC time zone.
      name: alert_time_min
    - description: Maximal alert time in %Y-%m-%dT%H:%M:%S format and UTC time zone.
      name: alert_time_max
    - description: Advanced filter query.
      name: advanced_filter
    - description: if details=true, will return the complete response from Covalence API.
      name: details
    description: Lists Covalence alerts.
    name: cov-secpr-list-alerts
    outputs:
    - contextPath: Covalence.Alert.acknowledgedStatus
      description: Acknowledged Status.
      type: String
    - contextPath: Covalence.Alert.alertCount
      description: Alert Count.
      type: Number
    - contextPath: Covalence.Alert.alertHash
      description: Alert Hash.
      type: String
    - contextPath: Covalence.Alert.analystDescription
      description: Analyst Description.
      type: String
    - contextPath: Covalence.Alert.analystTitle
      description: Analyst Title.
      type: String
    - contextPath: Covalence.Alert.assignee
      description: Assignee.
      type: String
    - contextPath: Covalence.Alert.blacklistDetails.blacklistedEntity
      description: Blacklisted Entity.
      type: String
    - contextPath: Covalence.Alert.blacklistDetails.bytesIn
      description: Bytes In.
      type: Number
    - contextPath: Covalence.Alert.blacklistDetails.bytesOut
      description: Bytes Out.
      type: Number
    - contextPath: Covalence.Alert.blacklistDetails.listLabels
      description: List Labels.
      type: String
    - contextPath: Covalence.Alert.blacklistDetails.listUuids
      description: List Uuids.
      type: String
    - contextPath: Covalence.Alert.createdTime
      description: Created Time.
      type: Number
    - contextPath: Covalence.Alert.destCiscoUmbrellaRanking
      description: Dest Cisco Umbrella Ranking.
      type: Number
    - contextPath: Covalence.Alert.destCiscoUmbrellaTopLevelDomainRanking
      description: Dest Cisco Umbrella Top Level Domain Ranking.
      type: Number
    - contextPath: Covalence.Alert.destCityName
      description: Dest City Name.
      type: String
    - contextPath: Covalence.Alert.destCountryName
      description: Dest Country Name.
    - contextPath: Covalence.Alert.destDomainName
      description: Dest Domain Name.
      type: String
    - contextPath: Covalence.Alert.destGeoX
      description: Dest Geo X.
      type: Number
    - contextPath: Covalence.Alert.destGeoY
      description: Dest Geo Y.
      type: Number
    - contextPath: Covalence.Alert.destIp
      description: Dest Ip.
      type: String
    - contextPath: Covalence.Alert.destIpAttributes.k
      description: Key.
      type: String
    - contextPath: Covalence.Alert.destIpAttributes.t
      description: Type.
      type: Number
    - contextPath: Covalence.Alert.destIpAttributes.v
      description: Value.
      type: String
    - contextPath: Covalence.Alert.destMajesticMillionRanking
      description: Dest Majestic Million Ranking.
      type: Number
    - contextPath: Covalence.Alert.destMajesticMillionTopLevelDomainRanking
      description: Dest Majestic Million Top Level Domain Ranking.
      type: Number
    - contextPath: Covalence.Alert.destPort
      description: Dest Port.
      type: String
    - contextPath: Covalence.Alert.endpointAgentUuid
      description: Endpoint Agent Uuid.
      type: String
    - contextPath: Covalence.Alert.facility
      description: Facility.
      type: String
    - contextPath: Covalence.Alert.id
      description: Id.
      type: String
    - contextPath: Covalence.Alert.isFavorite
      description: Is Favorite.
      type: Boolean
    - contextPath: Covalence.Alert.lastAlertedTime
      description: Last Alerted Time.
      type: Number
    - contextPath: Covalence.Alert.notes
      description: Notes.
      type: String
    - contextPath: Covalence.Alert.organizationId
      description: Organization Id.
      type: String
    - contextPath: Covalence.Alert.pcapResourceUuid
      description: Pcap Resource Uuid.
      type: String
    - contextPath: Covalence.Alert.priority
      description: Priority.
    - contextPath: Covalence.Alert.protocol
      description: Protocol.
      type: String
    - contextPath: Covalence.Alert.sensorId
      description: Sensor Id.
      type: String
    - contextPath: Covalence.Alert.severity
      description: Severity.
      type: String
    - contextPath: Covalence.Alert.sigEvalDetails.id
      description: Id.
      type: Number
    - contextPath: Covalence.Alert.sigEvalDetails.message
      description: Message.
      type: String
    - contextPath: Covalence.Alert.sourceCiscoUmbrellaRanking
      description: Source Cisco Umbrella Ranking.
      type: Number
    - contextPath: Covalence.Alert.sourceCiscoUmbrellaTopLevelDomainRanking
      description: Source Cisco Umbrella Top Level Domain Ranking.
      type: Number
    - contextPath: Covalence.Alert.sourceCityName
      description: Source City Name.
      type: String
    - contextPath: Covalence.Alert.sourceCountryName
      description: Source Country Name.
      type: String
    - contextPath: Covalence.Alert.sourceDomainName
      description: Source Domain Name.
      type: String
    - contextPath: Covalence.Alert.sourceGeoX
      description: Source Geo X.
      type: Number
    - contextPath: Covalence.Alert.sourceGeoY
      description: Source Geo Y.
      type: Number
    - contextPath: Covalence.Alert.sourceIp
      description: Source Ip.
      type: String
    - contextPath: Covalence.Alert.sourceIpAttributes.k
      description: Key.
      type: String
    - contextPath: Covalence.Alert.sourceIpAttributes.t
      description: Type.
      type: Number
    - contextPath: Covalence.Alert.sourceIpAttributes.v
      description: Value.
      type: String
    - contextPath: Covalence.Alert.sourceMajesticMillionRanking
      description: Source Majestic Million Ranking.
      type: Number
    - contextPath: Covalence.Alert.sourceMajesticMillionTopLevelDomainRanking
      description: Source Majestic Million Top Level Domain Ranking.
      type: Number
    - contextPath: Covalence.Alert.sourcePort
      description: Source Port.
      type: String
    - contextPath: Covalence.Alert.subType
      description: Sub Type.
      type: String
    - contextPath: Covalence.Alert.title
      description: Title.
      type: String
    - contextPath: Covalence.Alert.type
      description: Type.
      type: String
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: if details=true, will return the complete response from Covalence API.
      name: details
    description: Lists Covalence sensors.
    name: cov-secpr-list-sensors
    outputs:
    - contextPath: Covalence.Sensors.id
      description: Id.
      type: String
    - contextPath: Covalence.Sensors.name
      description: Name.
      type: String
    - contextPath: Covalence.Sensors.isAuthorized
      description: Is Authorized.
      type: Boolean
    - contextPath: Covalence.Sensors.isNetflowGenerator
      description: Is Netflow Generator.
      type: Boolean
    - contextPath: Covalence.Sensors.bytesIn
      description: Bytes In.
      type: Number
    - contextPath: Covalence.Sensors.bytesOut
      description: Bytes Out.
      type: Number
    - contextPath: Covalence.Sensors.lastActive
      description: Last Active.
      type: String
    - contextPath: Covalence.Sensors.listeningInterfaces
      description: Listening Interfaces.
      type: String
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: Sensor id.
      name: sensor_id
      required: true
    description: Get sensor details when provided with the sensor id.
    name: cov-secpr-get-sensor
    outputs:
    - contextPath: Covalence.Sensor.id
      description: Id.
      type: String
    - contextPath: Covalence.Sensor.name
      description: Name.
      type: String
    - contextPath: Covalence.Sensor.isAuthorized
      description: Is Authorized.
      type: Boolean
    - contextPath: Covalence.Sensor.listeningInterfaces
      description: Listening Interfaces.
      type: String
    - contextPath: Covalence.Sensor.isNetflowGenerator
      description: Is Netflow Generator.
      type: Boolean
    - contextPath: Covalence.Sensor.bytesIn
      description: Bytes In.
      type: Number
    - contextPath: Covalence.Sensor.bytesOut
      description: Bytes Out.
      type: Number
    - contextPath: Covalence.Sensor.lastActive
      description: Last Active.
      type: String
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: Maximum number of connection summary by ip to be returned, if none provided will be set to 100.
      name: max_count
    - description: Initial index where to start listing connection summaries.
      name: initial_index
    - description: source ip filter, if used only connections related to the specified source ip will be returned.
      name: source_ip
    - description: Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone.
      name: start_time
    - description: Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone.
      name: end_time
    - description: if "clients_only=true", only connections labeled as client connections will be returned.
      name: clients_only
    - description: if "internal_only=true", only internal connections will be returned.
      name: internal_only
    - description: Advanced filter query.
      name: advanced_filter
    - description: if details=true, will return the complete response from Covalence API.
      name: details
    description: List summarized connections details by IP Address.
    name: cov-secpr-connections-summary-ip
    outputs:
    - contextPath: Covalence.Connections.averageDuration
      description: Average Duration.
      type: Number
    - contextPath: Covalence.Connections.bytesIn
      description: Bytes In.
      type: Number
    - contextPath: Covalence.Connections.bytesOut
      description: Bytes Out.
      type: Number
    - contextPath: Covalence.Connections.clientServerRelationship
      description: Client Server Relationship.
      type: String
    - contextPath: Covalence.Connections.continuingConnectionCount
      description: Continuing Connection Count.
      type: Number
    - contextPath: Covalence.Connections.destinationCity
      description: Destination City.
      type: String
    - contextPath: Covalence.Connections.destinationCountry
      description: Destination Country.
      type: String
    - contextPath: Covalence.Connections.destinationId
      description: Destination Id.
      type: String
    - contextPath: Covalence.Connections.destinationIpAddress
      description: Destination Ip Address.
      type: String
    - contextPath: Covalence.Connections.destinationMacAddress
      description: Destination Mac Address.
      type: String
    - contextPath: Covalence.Connections.dstDomainName
      description: Dst Domain Name.
      type: String
    - contextPath: Covalence.Connections.id
      description: Id.
      type: String
    - contextPath: Covalence.Connections.packetsIn
      description: Packets In.
      type: Number
    - contextPath: Covalence.Connections.packetsOut
      description: Packets Out.
      type: Number
    - contextPath: Covalence.Connections.serverPortCount
      description: Server Port Count.
      type: Number
    - contextPath: Covalence.Connections.serverPorts
      description: Server Ports.
      type: String
    - contextPath: Covalence.Connections.sourceCity
      description: Source City.
      type: String
    - contextPath: Covalence.Connections.sourceCountry
      description: Source Country.
      type: String
    - contextPath: Covalence.Connections.sourceDomainName
      description: Source Domain Name.
      type: String
    - contextPath: Covalence.Connections.sourceId
      description: Source Id.
      type: String
    - contextPath: Covalence.Connections.sourceIpAddress
      description: Source Ip Address.
      type: String
    - contextPath: Covalence.Connections.sourceMacAddress
      description: Source Mac Address.
      type: String
    - contextPath: Covalence.Connections.terminatedConnectionCount
      description: Terminated Connection Count.
      type: Number
    - contextPath: Covalence.Connections.totalDuration
      description: Total Duration.
      type: Number
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: Maximum number of connection summary by port to be returned, if none provided will be set to 100.
      name: max_count
    - description: Initial index where to start listing connection summaries.
      name: initial_index
    - description: source ip filter, only connections related to the specified source ip will be returned.
      name: source_ip
      required: true
    - description: Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone.
      name: start_time
    - description: Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone.
      name: end_time
    - description: if "clients_only=true", only connections labeled as client connections will be returned.
      name: clients_only
    - description: if "internal_only=true", only internal connections will be returned.
      name: internal_only
    - description: Advanced filter query.
      name: advanced_filter
    - description: if details=true, will return the complete response from Covalence API.
      name: details
    description: List summarized connections details by Port.
    name: cov-secpr-connections-summary-port
    outputs:
    - contextPath: Covalence.Connections.averageDuration
      description: Average Duration.
      type: Number
    - contextPath: Covalence.Connections.bytesIn
      description: Bytes In.
      type: Number
    - contextPath: Covalence.Connections.bytesOut
      description: Bytes Out.
      type: Number
    - contextPath: Covalence.Connections.continuingConnectionCount
      description: Continuing Connection Count.
      type: Number
    - contextPath: Covalence.Connections.destinationCity
      description: Destination City.
      type: String
    - contextPath: Covalence.Connections.destinationCountry
      description: Destination Country.
      type: String
    - contextPath: Covalence.Connections.destinationId
      description: Destination Id.
      type: String
    - contextPath: Covalence.Connections.destinationIpAddress
      description: Destination Ip Address.
      type: String
    - contextPath: Covalence.Connections.destinationMacAddress
      description: Destination Mac Address.
      type: String
    - contextPath: Covalence.Connections.dstDomainName
      description: Dst Domain Name.
      type: String
    - contextPath: Covalence.Connections.endTime
      description: End Time.
      type: Date
    - contextPath: Covalence.Connections.id
      description: Id.
      type: String
    - contextPath: Covalence.Connections.packetsIn
      description: Packets In.
      type: Number
    - contextPath: Covalence.Connections.packetsOut
      description: Packets Out.
      type: Number
    - contextPath: Covalence.Connections.protocol
      description: Protocol.
      type: String
    - contextPath: Covalence.Connections.serverPort
      description: Server Port.
      type: Number
    - contextPath: Covalence.Connections.sourceCity
      description: Source City.
      type: String
    - contextPath: Covalence.Connections.sourceCountry
      description: Source Country.
      type: String
    - contextPath: Covalence.Connections.sourceDomainName
      description: Source Domain Name.
      type: String
    - contextPath: Covalence.Connections.sourceId
      description: Source Id.
      type: String
    - contextPath: Covalence.Connections.sourceIpAddress
      description: Source Ip Address.
      type: String
    - contextPath: Covalence.Connections.sourceMacAddress
      description: Source Mac Address.
      type: String
    - contextPath: Covalence.Connections.startTime
      description: Start Time.
      type: Date
    - contextPath: Covalence.Connections.terminatedConnectionCount
      description: Terminated Connection Count.
      type: Number
    - contextPath: Covalence.Connections.totalDuration
      description: Total Duration.
      type: Number
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: Maximum number of DNS resolutions to be returned, if none provided will be set to 100.
      name: max_count
    - description: Initial index where to start listing DNS resolutions.
      name: initial_index
    - description: Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone.
      name: request_time_after
    - description: Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone.
      name: request_time_before
    - description: Domain name filter, if used will only return DNS resolutions from the specified domain name.
      name: domain_name
    - description: IP filter, if used will only return DNS resolutions to the specified IP.
      name: resolved_ip
    - description: Source IP filter, if used will only return DNS resolutions originating from the specified IP.
      name: request_origin_ip
    - description: Nameserver IP filter, if used will only return DNS resolutions involving the specified nameserver IP.
      name: nameserver_ip
    - description: Advanced filter query.
      name: advanced_filter
    - description: if details=true, will return the complete response from Covalence API.
      name: details
    description: List summarized connections details by Port.
    name: cov-secpr-list-dns-resolutions
    outputs:
    - contextPath: Covalence.DNSResolutions.id
      description: Id.
      type: String
    - contextPath: Covalence.DNSResolutions.domainName
      description: Domain Name.
      type: String
    - contextPath: Covalence.DNSResolutions.resolvedIp
      description: Resolved Ip.
      type: String
    - contextPath: Covalence.DNSResolutions.requestOriginIp
      description: Request Origin Ip.
      type: String
    - contextPath: Covalence.DNSResolutions.nameserverIp
      description: Nameserver Ip.
      type: String
    - contextPath: Covalence.DNSResolutions.nodeLabel
      description: Node Label.
      type: String
    - contextPath: Covalence.DNSResolutions.requestTime
      description: Request Time.
      type: Number
    - contextPath: Covalence.DNSResolutions.byteCount
      description: Byte Count.
      type: Number
    - contextPath: Covalence.DNSResolutions.pktCount
      description: Pkt Count.
      type: Number
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    description: List internal networks.
    name: cov-secpr-list-internal-networks
    outputs:
    - contextPath: Covalence.InternalNetworks.cidr
      description: Cidr.
      type: String
    - contextPath: Covalence.InternalNetworks.notes
      description: Notes.
      type: String
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: The network to be set as internal in CIDR notation.
      name: cidr
      required: true
    - description: Comment notes associated with the network, notes must be inside quotes.
      name: notes
      required: true
    description: Set internal networks.
    name: cov-secpr-set-internal-networks
    outputs:
    - contextPath: Covalence.InternalNetworks.cidr
      description: Cidr.
      type: String
    - contextPath: Covalence.InternalNetworks.notes
      description: Notes.
      type: String
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: Advanced filter query, if used any other parameters provided to the command will be ignored.
      name: advanced_filter
    - description: if details=true, will return the complete response from Covalence API.
      name: details
    description: List endpoint agents.
    name: cov-secpr-list-endpoint-agents
    outputs:
    - contextPath: Covalence.EndpointAgents.agentUuid
      description: Agent Uuid.
      type: String
    - contextPath: Covalence.EndpointAgents.agentVersion
      description: Agent Version.
      type: String
    - contextPath: Covalence.EndpointAgents.firstSeenTime
      description: First Seen Time.
      type: Date
    - contextPath: Covalence.EndpointAgents.lastSeenTime
      description: Last Seen Time.
      type: Date
    - contextPath: Covalence.EndpointAgents.lastSessionUser
      description: Last Session User.
      type: String
    - contextPath: Covalence.EndpointAgents.isMobile
      description: Is Mobile.
      type: Boolean
    - contextPath: Covalence.EndpointAgents.isConnected
      description: Is Connected.
      type: Boolean
    - contextPath: Covalence.EndpointAgents.coreVersion
      description: Core Version.
      type: String
    - contextPath: Covalence.EndpointAgents.coreArchitecture
      description: Core Architecture.
      type: String
    - contextPath: Covalence.EndpointAgents.coreOs
      description: Core Os.
      type: String
    - contextPath: Covalence.EndpointAgents.operatingSystem
      description: Operating System.
      type: String
    - contextPath: Covalence.EndpointAgents.hostName
      description: Host Name.
      type: String
    - contextPath: Covalence.EndpointAgents.hardwareVendor
      description: Hardware Vendor.
      type: String
    - contextPath: Covalence.EndpointAgents.hardwareModel
      description: Hardware Model.
      type: String
    - contextPath: Covalence.EndpointAgents.arch
      description: Arch.
      type: String
    - contextPath: Covalence.EndpointAgents.osDistro
      description: Os Distro.
      type: String
    - contextPath: Covalence.EndpointAgents.osVersion
      description: Os Version.
      type: String
    - contextPath: Covalence.EndpointAgents.kernelVersion
      description: Kernel Version.
      type: String
    - contextPath: Covalence.EndpointAgents.operatingSystemReleaseId
      description: Operating System Release Id.
      type: String
    - contextPath: Covalence.EndpointAgents.ipAddress
      description: Ip Address.
      type: String
    - contextPath: Covalence.EndpointAgents.secondaryIpAddress
      description: Secondary Ip Address.
      type: String
    - contextPath: Covalence.EndpointAgents.ipAddresses
      description: Ip Addresses.
      type: String
    - contextPath: Covalence.EndpointAgents.serialNumber
      description: Serial Number.
      type: String
    - contextPath: Covalence.EndpointAgents.deviceIdentifier
      description: Device Identifier.
      type: String
    - contextPath: Covalence.EndpointAgents.cpuArchitectureEnum
      description: Cpu Architecture Enum.
      type: String
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: User filter.
      name: user
      required: true
    description: List endpoint agents where the last session user is the one provided as parameter.
    name: cov-secpr-find-endpoint-agents-by-user
    outputs:
    - contextPath: Covalence.EndpointAgents.agentUuid
      description: Agent Uuid.
      type: String
    - contextPath: Covalence.EndpointAgents.agentVersion
      description: Agent Version.
      type: String
    - contextPath: Covalence.EndpointAgents.firstSeenTime
      description: First Seen Time.
      type: Date
    - contextPath: Covalence.EndpointAgents.lastSeenTime
      description: Last Seen Time.
      type: Date
    - contextPath: Covalence.EndpointAgents.lastSessionUser
      description: Last Session User.
      type: String
    - contextPath: Covalence.EndpointAgents.isMobile
      description: Is Mobile.
      type: Boolean
    - contextPath: Covalence.EndpointAgents.isConnected
      description: Is Connected.
      type: Boolean
    - contextPath: Covalence.EndpointAgents.coreVersion
      description: Core Version.
      type: String
    - contextPath: Covalence.EndpointAgents.coreArchitecture
      description: Core Architecture.
      type: String
    - contextPath: Covalence.EndpointAgents.coreOs
      description: Core Os.
      type: String
    - contextPath: Covalence.EndpointAgents.operatingSystem
      description: Operating System.
      type: String
    - contextPath: Covalence.EndpointAgents.hostName
      description: Host Name.
      type: String
    - contextPath: Covalence.EndpointAgents.hardwareVendor
      description: Hardware Vendor.
      type: String
    - contextPath: Covalence.EndpointAgents.hardwareModel
      description: Hardware Model.
      type: String
    - contextPath: Covalence.EndpointAgents.arch
      description: Arch.
      type: String
    - contextPath: Covalence.EndpointAgents.osDistro
      description: Os Distro.
      type: String
    - contextPath: Covalence.EndpointAgents.osVersion
      description: Os Version.
      type: String
    - contextPath: Covalence.EndpointAgents.kernelVersion
      description: Kernel Version.
      type: String
    - contextPath: Covalence.EndpointAgents.operatingSystemReleaseId
      description: Operating System Release Id.
      type: String
    - contextPath: Covalence.EndpointAgents.ipAddress
      description: Ip Address.
      type: String
    - contextPath: Covalence.EndpointAgents.secondaryIpAddress
      description: Secondary Ip Address.
      type: String
    - contextPath: Covalence.EndpointAgents.ipAddresses
      description: Ip Addresses.
      type: String
    - contextPath: Covalence.EndpointAgents.serialNumber
      description: Serial Number.
      type: String
    - contextPath: Covalence.EndpointAgents.deviceIdentifier
      description: Device Identifier.
      type: String
    - contextPath: Covalence.EndpointAgents.cpuArchitectureEnum
      description: Cpu Architecture Enum.
      type: String
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: Endpoint agent UUID.
      name: uuid
      required: true
    description: Find the endpoint agent with the UUID provided as parameter.
    name: cov-secpr-find-endpoint-agents-by-uuid
    outputs:
    - contextPath: Covalence.EndpointAgents.agentUuid
      description: Agent Uuid.
      type: String
    - contextPath: Covalence.EndpointAgents.agentVersion
      description: Agent Version.
      type: String
    - contextPath: Covalence.EndpointAgents.firstSeenTime
      description: First Seen Time.
      type: Date
    - contextPath: Covalence.EndpointAgents.lastSeenTime
      description: Last Seen Time.
      type: Date
    - contextPath: Covalence.EndpointAgents.lastSessionUser
      description: Last Session User.
      type: String
    - contextPath: Covalence.EndpointAgents.isMobile
      description: Is Mobile.
      type: Boolean
    - contextPath: Covalence.EndpointAgents.isConnected
      description: Is Connected.
      type: Boolean
    - contextPath: Covalence.EndpointAgents.coreVersion
      description: Core Version.
      type: String
    - contextPath: Covalence.EndpointAgents.coreArchitecture
      description: Core Architecture.
      type: String
    - contextPath: Covalence.EndpointAgents.coreOs
      description: Core Os.
      type: String
    - contextPath: Covalence.EndpointAgents.operatingSystem
      description: Operating System.
      type: String
    - contextPath: Covalence.EndpointAgents.hostName
      description: Host Name.
      type: String
    - contextPath: Covalence.EndpointAgents.hardwareVendor
      description: Hardware Vendor.
      type: String
    - contextPath: Covalence.EndpointAgents.hardwareModel
      description: Hardware Model.
      type: String
    - contextPath: Covalence.EndpointAgents.arch
      description: Arch.
      type: String
    - contextPath: Covalence.EndpointAgents.osDistro
      description: Os Distro.
      type: String
    - contextPath: Covalence.EndpointAgents.osVersion
      description: Os Version.
      type: String
    - contextPath: Covalence.EndpointAgents.kernelVersion
      description: Kernel Version.
      type: String
    - contextPath: Covalence.EndpointAgents.operatingSystemReleaseId
      description: Operating System Release Id.
      type: String
    - contextPath: Covalence.EndpointAgents.ipAddress
      description: Ip Address.
      type: String
    - contextPath: Covalence.EndpointAgents.secondaryIpAddress
      description: Secondary Ip Address.
      type: String
    - contextPath: Covalence.EndpointAgents.ipAddresses
      description: Ip Addresses.
      type: String
    - contextPath: Covalence.EndpointAgents.serialNumber
      description: Serial Number.
      type: String
    - contextPath: Covalence.EndpointAgents.deviceIdentifier
      description: Device Identifier.
      type: String
    - contextPath: Covalence.EndpointAgents.cpuArchitectureEnum
      description: Cpu Architecture Enum.
      type: String
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: Process name.
      name: name
    - description: Advanced filter query.
      name: advanced_filter
    - description: if details=true, will return the complete response from Covalence API.
      name: details
    description: Search processes by name or advanced filter, at least one parameter is required.
    name: cov-secpr-search-endpoint-process
    outputs:
    - contextPath: Covalence.EndpointProcess.id
      description: Id.
      type: Number
    - contextPath: Covalence.EndpointProcess.agentUuid
      description: Agent Uuid.
      type: String
    - contextPath: Covalence.EndpointProcess.processName
      description: Process Name.
      type: String
    - contextPath: Covalence.EndpointProcess.processPath
      description: Process Path.
      type: String
    - contextPath: Covalence.EndpointProcess.parentProcessName
      description: Parent Process Name.
      type: String
    - contextPath: Covalence.EndpointProcess.parentProcessPath
      description: Parent Process Path.
      type: String
    - contextPath: Covalence.EndpointProcess.commandLine
      description: Command Line.
      type: String
    - contextPath: Covalence.EndpointProcess.username
      description: Username.
      type: String
    - contextPath: Covalence.EndpointProcess.firstSeenTime
      description: First Seen Time.
      type: Date
    - contextPath: Covalence.EndpointProcess.lastSeenTime
      description: Last Seen Time.
      type: Date
    - contextPath: Covalence.EndpointProcess.lastEndTime
      description: Last End Time.
      type: Date
    - contextPath: Covalence.EndpointProcess.seenCount
      description: Seen Count.
      type: Number
    - contextPath: Covalence.EndpointProcess.activeCount
      description: Active Count.
      type: Number
  - arguments:
    - description: 'Only required in broker mode, used to target a specific organization: target_org="Acme Corporation".'
      name: target_org
    - description: The name of installed software, quotes are required is space character is used. At least one parameter is required.
      name: name
      required: true
    - description: The version of installed software.
      name: version
    - description: Advanced filter query.
      name: advanced_filter
    - description: if details=true, will return the complete response from Covalence API.
      name: details
    description: Search for endpoint installed software.
    name: cov-secpr-search-endpoint-installed-software
    outputs:
    - contextPath: Covalence.EndpointSoftware.arch
      description: Arch.
      type: Number
    - contextPath: Covalence.EndpointSoftware.type
      description: Type.
      type: Number
    - contextPath: Covalence.EndpointSoftware.packageManager
      description: Package Manager.
      type: Number
    - contextPath: Covalence.EndpointSoftware.installTimestamp
      description: Install Timestamp.
      type: Date
    - contextPath: Covalence.EndpointSoftware.uninstallTimestamp
      description: Uninstall Timestamp.
      type: Date
    - contextPath: Covalence.EndpointSoftware.name
      description: Name.
      type: String
    - contextPath: Covalence.EndpointSoftware.version
      description: Version.
      type: String
    - contextPath: Covalence.EndpointSoftware.vendor
      description: Vendor.
      type: String
    - contextPath: Covalence.EndpointSoftware.installPath
      description: Install Path.
      type: String
    - contextPath: Covalence.EndpointSoftware.appDataPath
      description: App Data Path.
      type: String
    - contextPath: Covalence.EndpointSoftware.sharedDataPath
      description: Shared Data Path.
      type: String
    - contextPath: Covalence.EndpointSoftware.installedForUser
      description: Installed For User.
      type: String
    - contextPath: Covalence.EndpointSoftware.installSource
      description: Install Source.
      type: String
    - contextPath: Covalence.EndpointSoftware.id
      description: Id.
      type: Number
    - contextPath: Covalence.EndpointSoftware.agentUuid
      description: Agent Uuid.
      type: String
    - contextPath: Covalence.EndpointSoftware.softwareNotifyAction
      description: Software Notify Action.
      type: String
  - arguments: []
    description: List monitored organizations, only available in broker mode.
    name: cov-secpr-list-organizations
    outputs:
    - contextPath: Covalence.Organization.org_name
      description: Org_name.
      type: String
  dockerimage: demisto/xsoar-tools:1.0.0.11807991
  isfetch: true
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)