Covalence Managed Security

Triggers by triaged alerts from endpoint, cloud, and network security monitoring. Contains event details and easy-to-follow mitigation steps.

Endpoint · Covalence Managed Security

Details

IDCovalence Managed Security
ProviderField Effect Software Inc
CategoryEndpoint
From Version5.0.0
Docker Imagedemisto/python3:3.12.12.7090913
Supported ModulesAgentix XSIAM

README

Triggers by triaged alerts from endpoint, cloud, and network security monitoring. Contains event details and easy-to-follow mitigation steps.
This integration was integrated and tested with version 1.1.10 of Covalence Managed Security.

Configure Covalence Managed Security in Cortex

Parameter Description Required
Credentials   True
Password   True
Use system proxy settings   False
First run time range When fetching incidents for the first time, this parameter specifies in days how far the integration looks for incidents. For instance if set to “2”, it will pull all alerts in Covalence for the last 2 days and will create corresponding incidents. False
Incident type   False
Fetch incidents   False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
Fetch Limit The maximum number of incidents to fetch False
Broker Server URL Broker Server URL (Optional). Required to use Broker commands. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cov-mgsec-get-aro

Query FES Portal for ARO.

Base Command

cov-mgsec-get-aro

Input

Argument Name Description Required
details if details=true, will return the complete response from Covalence API. Optional
query Portal query, for example: “resolution=Unresolved&type=Recommendation”
Available Keys to filter on:
- id; eg: “id=<ARO_id>
- status; eg: “status=In Triage” or “status=Open” or “status=Closed”
- resolution; eg: “resolution=Unresolved” or “resolution=Resolved” or “resolution=Help Requested” or “resolution=Dismissed”
- type; eg: “type=Action” or “type=Recommendation” or “type=Observation”
- org; eg: “org=<organization_name>“
- since; eg: “since=2021-01-31 14:00:00”
- until; eg: “until=2021-01-31 14:00:00”.		 Required

Context Output

Path Type Description
FESPortal.Aro.ID String ID.
FESPortal.Aro.alert_key String Alert_key.
FESPortal.Aro.analyst_notes String Analyst_notes.
FESPortal.Aro.count Number Count.
FESPortal.Aro.creation_time Date Creation_time.
FESPortal.Aro.details String Details.
FESPortal.Aro.details_markdown String Details_markdown.
FESPortal.Aro.display_url String Display_url.
FESPortal.Aro.external_bug_id String External_bug_id.
FESPortal.Aro.last_updated_time Date Last_updated_time.
FESPortal.Aro.notes String Notes.
FESPortal.Aro.organization.ID String ID.
FESPortal.Aro.organization.email String Email.
FESPortal.Aro.organization.name String Name.
FESPortal.Aro.resolution String Resolution.
FESPortal.Aro.serial_id String Serial_id.
FESPortal.Aro.severity String Severity.
FESPortal.Aro.status String Status.
FESPortal.Aro.steps.ID String ID.
FESPortal.Aro.steps.completed Boolean Completed.
FESPortal.Aro.steps.label String Label.
FESPortal.Aro.steps.last_updated_time Date Last_updated_time.
FESPortal.Aro.template_id String Template_id.
FESPortal.Aro.title String Title.
FESPortal.Aro.triage_id String Triage_id.
FESPortal.Aro.type String Type.

Command example

!cov-mgsec-get-aro query="since=2023-11-30 18:00:00"

Context Example

{
    "FESPortal": {
        "ARO": [
            {
                "organization": {
                    "ID": "9d4297ea-089e-42bd-884d-51744e31a471",
                    "email": "foo@bar.com",
                    "name": "Acme"
                },
                "resolution": "Unresolved",
                "severity": "Critical",
                "status": "Open",
                "title": "test2",
                "type": "Action"
            },
            {
                "organization": {
                    "ID": "e0e04c8b-d50c-4379-bfd6-5e0f2b1037cd",
                    "email": "foo@bar.com",
                    "name": "Capsule Corp"
                },
                "resolution": "Unresolved",
                "severity": "High",
                "status": "Open",
                "title": "Vulnerable Software Detected",
                "type": "Recommendation"
            }
        ]
    }
}

Human Readable Output

AROs

Organization Resolution Severity Status Title Type
ID: 9d4297ea-089e-42bd-884d-51744e31a471
email: foo@bar.com
name: Acme		 Unresolved Critical Open test2 Action
ID: e0e04c8b-d50c-4379-bfd6-5e0f2b1037cd
email: foo@bar.com
name: Capsule Corp		 Unresolved High Open Vulnerable Software Detected Recommendation

cov-mgsec-list-org

List organizations.

Base Command

cov-mgsec-list-org

Input

There are no input arguments for this command.

Context Output

Path Type Description
FESPortal.Org.ID String ID.
FESPortal.Org.email String Email.
FESPortal.Org.email_aro_details Boolean Email_aro_details.
FESPortal.Org.name String Name.

Command example


#### Context Example

```json
{
    "FESPortal": {
        "Org": [
            {
                "ID": "9d4297ea-089e-42bd-884d-51744e31a471",
                "email": "foo@bar.com",
                "email_aro_details": false,
                "name": "Acme"
            },
            {
                "ID": "e0e04c8b-d50c-4379-bfd6-5e0f2b1037cd",
                "email": "foo@bar.com",
                "email_aro_details": false,
                "name": "Capsule Corp"
            }
        ]
    }
}

Human Readable Output

Organizations

Id Email Email Aro Details Name
9d4297ea-089e-42bd-884d-51744e31a471 foo@bar.com false Acme
e0e04c8b-d50c-4379-bfd6-5e0f2b1037cd foo@bar.com false Capsule Corp

cov-mgsec-transition-aro

Transition an ARO.

Base Command

cov-mgsec-transition-aro

Input

Argument Name Description Required
aro_id This ARO ID to transition. Required
resolution Resolution to transition the ARO to. Possible values are: Unresolved, Help Requested, Resolved, Dismissed. Required
comment Optional comment to leave on the ARO. Optional
is_comment_sensitive Optionally mark the comment as sensitive. Optional

Context Output

Path Type Description
FESPortal.Aro.ID String ID.
FESPortal.Aro.alert_key String Alert_key.
FESPortal.Aro.analyst_notes String Analyst_notes.
FESPortal.Aro.count Number Count.
FESPortal.Aro.creation_time Date Creation_time.
FESPortal.Aro.details String Details.
FESPortal.Aro.details_markdown String Details_markdown.
FESPortal.Aro.display_url String Display_url.
FESPortal.Aro.external_bug_id String External_bug_id.
FESPortal.Aro.last_updated_time Date Last_updated_time.
FESPortal.Aro.notes String Notes.
FESPortal.Aro.organization.ID String ID.
FESPortal.Aro.organization.email String Email.
FESPortal.Aro.organization.name String Name.
FESPortal.Aro.resolution String Resolution.
FESPortal.Aro.serial_id String Serial_id.
FESPortal.Aro.severity String Severity.
FESPortal.Aro.status String Status.
FESPortal.Aro.steps.ID String ID.
FESPortal.Aro.steps.completed Boolean Completed.
FESPortal.Aro.steps.label String Label.
FESPortal.Aro.steps.last_updated_time Date Last_updated_time.
FESPortal.Aro.template_id String Template_id.
FESPortal.Aro.title String Title.
FESPortal.Aro.triage_id String Triage_id.
FESPortal.Aro.type String Type.

cov-mgsec-transition-aro

Transition an ARO.

Base Command

cov-mgsec-transition-aro

Input

Argument Name Description Required
aro_id This ARO ID to transition. Required
resolution Resolution to transition the ARO to. Options include: Unresolved, Help Requested, Resolved, or Dismissed. Required
comment Optional comment to leave on the ARO. Optional
is_comment_sensitive Optionally mark the comment as sensitive. Optional

Context Output

Path Type Description
FESPortal.Aro.ID String ID.
FESPortal.Aro.alert_key String Alert_key.
FESPortal.Aro.analyst_notes String Analyst_notes.
FESPortal.Aro.count Number Count.
FESPortal.Aro.creation_time Date Creation_time.
FESPortal.Aro.details String Details.
FESPortal.Aro.details_markdown String Details_markdown.
FESPortal.Aro.display_url String Display_url.
FESPortal.Aro.external_bug_id String External_bug_id.
FESPortal.Aro.last_updated_time Date Last_updated_time.
FESPortal.Aro.notes String Notes.
FESPortal.Aro.organization.ID String ID.
FESPortal.Aro.organization.email String Email.
FESPortal.Aro.organization.name String Name.
FESPortal.Aro.resolution String Resolution.
FESPortal.Aro.serial_id String Serial_id.
FESPortal.Aro.severity String Severity.
FESPortal.Aro.status String Status.
FESPortal.Aro.steps.ID String ID.
FESPortal.Aro.steps.completed Boolean Completed.
FESPortal.Aro.steps.label String Label.
FESPortal.Aro.steps.last_updated_time Date Last_updated_time.
FESPortal.Aro.template_id String Template_id.
FESPortal.Aro.title String Title.
FESPortal.Aro.triage_id String Triage_id.
FESPortal.Aro.type String Type.

Command example

!cov-mgsec-transition-aro aro_id="7ea9b17d-7529-4b17-b0e7-92334d6c674b" resolution="Resolved" comment="Risk mitigated."

Context Example

{
    "FESPortal": {
        "Org": {
            "ID": "7ea9b17d-7529-4b17-b0e7-92334d6c674b",
            "alert_key": "test_alert_key",
            "attachments": [],
            "count": 1,
            "creation_time": "2023-08-16 19:48:02",
            "data": null,
            "details": "ARO Details",
            "details_markdown": null,
            "display_url": "test_url",
            "external_ticket": null,
            "frameworks": [],
            "insights": {},
            "last_updated_time": "2023-11-30 19:01:59",
            "organization": {
                "ID": "test_ID",
                "email": null,
                "name": "test_org_id"
            },
            "references": [],
            "resolution": "Resolved",
            "resolution_duration_seconds": 9155637,
            "resolution_time": "2023-11-30 19:01:59",
            "serial_id": "15",
            "severity": "Low",
            "status": "Open",
            "steps": [
                {
                    "ID": "test_id",
                    "completed": true,
                    "label": "test_resolution_step",
                    "last_updated_time": "2023-10-24 20:53:45"
                }
            ],
            "template_id": null,
            "title": "test_aro_title",
            "triage_id": null,
            "type": "Observation"
        }
    }
}

Human Readable Output

ARO

Id Alert Key Count Creation Time Details Display Url Last Updated Time Organization Resolution Resolution Duration Seconds Resolution Time Serial Id Severity Status Steps Title Type
7ea9b17d-7529-4b17-b0e7-92334d6c674b test_alert_key 1 2023-08-16 19:48:02 ARO Details test_url 2023-11-30 19:01:59 ID: test_ID
email: null
name: test_org_id		 Resolved 9155637 2023-11-30 19:01:59 15 Low Open {‘ID’: ‘test_id’, ‘completed’: True, ‘label’: ‘test_resolution_step’, ‘last_updated_time’: ‘2023-10-24 20:53:45’} test_aro_title Observation

cov-mgsec-broker-cloud-action-by-aro

Broker - Cloud Action By ARO.

Base Command

cov-mgsec-broker-cloud-action-by-aro

Input

Argument Name Description Required
action_type Action to perform. Possible values are: DISABLE_USER, ENABLE_USER, REVOKE_SESSIONS. Required
aro_id ARO ID (eg. “00000000-1111-2222-3333-444444444444”). Required

Context Output

Path Type Description
FESBroker.action_id String Action ID
FESBroker.action_type String Action Type
FESBroker.action_params Unknown Action Parameters
FESBroker.created_time String Created Time
FESBroker.status String Status
FESBroker.result String Result

Command example

!cov-mgsec-broker-cloud-action-by-aro action_type=DISABLE_USER aro_id=00000000-1111-2222-3333-444444444444

Context Example

{
    "FESBroker": {
        "Action": {
            "action_id": "00000000-1111-2222-3333-444444444444",
            "action_params": {
                "user": "azure credential configuration endpoint service"
            },
            "action_type": "disable_user",
            "created_time": "2024-02-22T01:27:04.344179Z",
            "result": "SUCCESS",
            "status": "COMPLETE"
        }
    }
}

Human Readable Output

Command Result

action_id action_params action_type created_time result status
00000000-1111-2222-3333-444444444444 user: azure credential configuration endpoint service disable_user 2024-02-22T01:27:04.344179Z SUCCESS COMPLETE

cov-mgsec-broker-endpoint-action-by-aro

Broker - Endpoint Action By ARO.

Base Command

cov-mgsec-broker-endpoint-action-by-aro

Input

Argument Name Description Required
action_type Action to send to Host. Possible values are: ISOLATE, UNISOLATE, SHUTDOWN, RESTART, DEFENDER_QUICK_SCAN, DEFENDER_FULL_SCAN, DEFENDER_SIGNATURE_UPDATE. Required
aro_id ARO ID (eg. “00000000-1111-2222-3333-444444444444”). Required

Context Output

Path Type Description
FESBroker.host_identifier String Host Identifier
FESBroker.agent_uuid String Agent UUID
FESBroker.covalence_appliance String Covalence Appliance ID
FESBroker.task_id Number Endpoint Action Task ID

Command example

!cov-mgsec-broker-endpoint-action-by-aro action_type=DEFENDER_QUICK_SCAN aro_id=00000000-1111-2222-3333-444444444444

Context Example

{
    "FESBroker": {
        "Action": {
            "agent_uuid": "00000000-1111-2222-3333-444444444444",
            "covalence_appliance": "2000-001-XX-0",
            "host_identifier": "00000000-1111-2222-3333-444444444444",
            "task_id": 26876
        }
    }
}

Human Readable Output

Command Result - Success

agent_uuid covalence_appliance host_identifier task_id
00000000-1111-2222-3333-444444444444 2000-001-XX-0 00000000-1111-2222-3333-444444444444 26876

cov-mgsec-broker-ping

Broker - Ping.

Base Command

cov-mgsec-broker-ping

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
FESBroker.APIStatus String API Status

Command example


#### Context Example

```json
{
    "FESBroker": {
        "APIStatus": "pong"
    }
}

Human Readable Output

Success

cov-mgsec-broker-endpoint-action-by-host

Broker - Endpoint Action By Host.

Base Command

cov-mgsec-broker-endpoint-action-by-host

Input

Argument Name Description Required
action_type Action to send to Host. Possible values are: ISOLATE, UNISOLATE, SHUTDOWN, RESTART, DEFENDER_QUICK_SCAN, DEFENDER_FULL_SCAN, DEFENDER_SIGNATURE_UPDATE. Required
org_id Organization ID (eg. “00000000-1111-2222-3333-444444444444”). Required
host_identifier Hostname. Required

Context Output

Path Type Description
FESBroker.host_identifier String Host Identifier
FESBroker.agent_uuid String Agent UUID
FESBroker.covalence_appliance String Covalence Appliance ID
FESBroker.task_id Number Endpoint Action Task ID

Command example

!cov-mgsec-broker-endpoint-action-by-host action_type=DEFENDER_QUICK_SCAN host_identifier=test-hostname org_id=00000000-1111-2222-3333-444444444444

Context Example

{
    "FESBroker": {
        "Action": {
            "agent_uuid": "00000000-1111-2222-3333-444444444444",
            "covalence_appliance": "2000-001-XX-0",
            "host_identifier": "test-hostname",
            "task_id": 24773
        }
    }
}

Human Readable Output

Command Result - Success

agent_uuid covalence_appliance host_identifier task_id
00000000-1111-2222-3333-444444444444 2000-001-XX-0 test-hostname 24773

cov-mgsec-broker-list-org

Broker - List organizations.

Base Command

cov-mgsec-broker-list-org

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
FESBroker.ID String Organization ID
FESBroker.name String Organization Name
FESBroker.client_id String Client ID

Command example


#### Context Example

```json
{
    "FESBroker": {
        "Org": [
            {
                "ID": "00000000-1111-2222-3333-444444444444",
                "client_id": "2000-001-XX-0",
                "name": "Test Company"
            }
        ]
    }
}

Human Readable Output

Organizations

ID client_id name
00000000-1111-2222-3333-444444444444 2024-1384-SAN 110 Sand Company

cov-mgsec-comment-aro

Comment on an ARO.

Base Command

cov-mgsec-comment-aro

Input

Argument Name Description Required
aro_id This ARO ID to transition. Required
comment Comment to leave on the ARO. Required
is_comment_sensitive Optionally mark the comment as sensitive. Optional

Context Output

Path Type Description
FESPortal.Aro.ID String ID.
FESPortal.Aro.acknowledged Boolean Acknowledged
FESPortal.Aro.acknowledged_by.ID String Acknowledged By ID
FESPortal.Aro.acknowledged_by.avatar_file_url String Acknowledged By
FESPortal.Aro.acknowledged_by.email String Acknowledged By Email
FESPortal.Aro.acknowledged_by.first_name String Acknowledged By First Name
FESPortal.Aro.acknowledged_by.last_name String Acknowledged By Last Name
FESPortal.Aro.acknowledged_time Date Acknowledged Time
FESPortal.Aro.aro_id String ARO ID
FESPortal.Aro.author.ID String Author ID
FESPortal.Aro.author.avatar_file_url String Author Avatar File URL
FESPortal.Aro.author.email String Author Email
FESPortal.Aro.author.first_name String Author First Name
FESPortal.Aro.author.last_name String Author Last Name
FESPortal.Aro.author_organization.ID String Author Organization ID
FESPortal.Aro.author_organization.email String Author Organization Email
FESPortal.Aro.author_organization.name String Author Organization Name
FESPortal.Aro.author_organization_type String Author Organization Type
FESPortal.Aro.available_only_to_organization_id String ARO Comment Available Only to Organization ID
FESPortal.Aro.available_only_to_provider_id String ARO Comment Available Only to Provider ID
FESPortal.Aro.created_time Date ARO Created Time
FESPortal.Aro.id String ARO Comment ID
FESPortal.Aro.last_updated_time Date ARO Comment Last Updated Time
FESPortal.Aro.sensitive Boolean ARO Comment Sensitive
FESPortal.Aro.source String ARO Comment Source
FESPortal.Aro.text String ARO Comment Text
FESPortal.Aro.type String ARO Comment Type
FESPortal.Aro.visible_to.ID String ARO Comment Visible to ID
FESPortal.Aro.visible_to.email String ARO Comment Visible to Email
FESPortal.Aro.visible_to.name String ARO Comment Visible to Name

Command example

!cov-mgsec-comment-aro aro_id="b25e461e-75e9-415b-a631-6d0f4516f33a" comment="Risk mitigated."

Context Example

{
    "FESPortal": {
        "Org": {
            "acknowledged": true,
            "acknowledged_by": {
                "ID": "abcdefghijklmnopqrstuvwxyzabd1",
                "avatar_file_url": null,
                "email": "foo@bar.com",
                "first_name": "John",
                "last_name": "Smith"
            },
            "acknowledged_time": "2024-04-12 17:01:25",
            "aro_id": "b25e461e-75e9-415b-a631-6d0f4516f33a",
            "author": {
                "ID": "abcdefghijklmnopqrstuvwxyzabd1",
                "avatar_file_url": null,
                "email": "foo@bar.com",
                "first_name": "John",
                "last_name": "Smith"
            },
            "author_organization": {
                "ID": "00000000-1111-2222-3333-444444444444",
                "email": "foo@bar.com",
                "name": "Field Effect"
            },
            "author_organization_type": "Field Effect",
            "available_only_to_organization_id": null,
            "available_only_to_provider_id": null,
            "created_time": "2024-04-12 17:01:25",
            "id": "b14a53a4-23ac-488d-b992-dbc1d5ef5361",
            "last_updated_time": "2024-04-12 17:01:25",
            "sensitive": false,
            "source": "Portal",
            "text": "Risk mitigated.",
            "type": "Comment",
            "visible_to": [
                {
                    "ID": "00000000-1111-2222-3333-444444444444",
                    "email": null,
                    "name": "Tradecraft Test & Development (Do Not Delete)"
                },
                {
                    "ID": "00000000-1111-2222-3333-444444444444",
                    "email": "foo@bar.com",
                    "name": "Field Effect"
                }
            ]
        }
    }
}

Human Readable Output

ARO

Acknowledged Acknowledged By Acknowledged Time Aro Id Author Author Organization Author Organization Type Created Time Id Last Updated Time Sensitive Source Text Type Visible To
true ID: abcdefghijklmnopqrstuvwxyzabd1
avatar_file_url: null
email: foo@bar.com
first_name: John
last_name: Smith		 2024-04-12 17:01:25 b25e461e-75e9-415b-a631-6d0f4516f33a ID: abcdefghijklmnopqrstuvwxyzabd1
avatar_file_url: null
email: foo@bar.com
first_name: John
last_name: Smith		 ID: 00000000-1111-2222-3333-444444444444
email: foo@bar.com
name: Field Effect		 Field Effect 2024-04-12 17:01:25 b14a53a4-23ac-488d-b992-dbc1d5ef5361 2024-04-12 17:01:25 false Portal Risk mitigated. Comment {‘ID’: ‘00000000-1111-2222-3333-444444444444’, ‘email’: None, ‘name’: ‘Tradecraft Test & Development (Do Not Delete)’},
{‘ID’: ‘00000000-1111-2222-3333-444444444444’, ‘email’: ‘foo@bar.com’, ‘name’: ‘Field Effect’}

cov-mgsec-list-escalation-contacts

Get the escalation contact list for a given organization.

Base Command

cov-mgsec-list-escalation-contacts

Input

Argument Name Description Required
org_id Organization ID (eg. “00000000-1111-2222-3333-444444444444”). Required

Context Output

Path Type Description
FESPortal.Org.priority String Priority.
FESPortal.Org.first_name String First Name.
FESPortal.Org.last_name String Last Name.
FESPortal.Org.job_title String Job Title.
FESPortal.Org.phone_number String Phone Number.
FESPortal.Org.secondary_phone String Secondary Phone Number.
FESPortal.Org.email String Email.
FESPortal.Org.notes String Notes.

Command example

!cov-mgsec-list-escalation-contacts org_id=cb7e26b7-9d62-4cc7-acf1-4264327ac552

Context Example

{
    "FESPortal": {
        "Org": [
            {
                "email": "test-email@fieldeffect.com",
                "first_name": "John",
                "job_title": null,
                "last_name": "Doe",
                "notes": "test notes",
                "phone_number": null,
                "priority": 1,
                "secondary_phone": null
            },
            {
                "email": "test-user2@fieldeffect.com",
                "first_name": "Testing1",
                "job_title": null,
                "last_name": "User",
                "notes": "test-note",
                "phone_number": null,
                "priority": 2,
                "secondary_phone": null
            },
            {
                "email": "test-user-4@fieldeffect.com",
                "first_name": "Bob",
                "job_title": "QA",
                "last_name": "Tester",
                "notes": "123\n456\n789",
                "phone_number": "+15550199999",
                "priority": 3,
                "secondary_phone": "+15069999999"
            },
            {
                "email": "test5@example.om",
                "first_name": "Smith",
                "job_title": "UI Dev",
                "last_name": "fes",
                "notes": null,
                "phone_number": "+16135445544",
                "priority": 4,
                "secondary_phone": "+16135554548"
            },
            {
                "email": "test-user-44@fieldeffect.com",
                "first_name": "John",
                "job_title": "Head of UI Development",
                "last_name": "Doe",
                "notes": null,
                "phone_number": "+16135554545",
                "priority": 5,
                "secondary_phone": null
            }
        ]
    }
}

Human Readable Output

Escalation Contacts

Priority First Name Last Name Job Title Phone Number Secondary Phone Email Notes
1 John Doe       test-email@fieldeffect.com some other test note
2 Testing1 User       test-user2@fieldeffect.com test-note
3 Bob Tester QA +15550199999 +15069999999 test-user-4@fieldeffect.com  
4 Smith fes UI Dev +16135445544 +16135554548 test5@example.om  
5 John Doe Head of UI Development +16135554545   test-user-44@fieldeffect.com  

cov-mgsec-list-key-contacts

Get the key contact list for a given organization.

Base Command

cov-mgsec-list-key-contacts

Input

Argument Name Description Required
org_id Organization ID (eg. “00000000-1111-2222-3333-444444444444”). Required

Context Output

Path Type Description
FESPortal.Org.first_name String First Name.
FESPortal.Org.last_name String Last Name.
FESPortal.Org.phone_number String Phone Number.
FESPortal.Org.email String Email.
FESPortal.Org.type String Contact Type.

Command example

!cov-mgsec-list-key-contacts org_id=cb7e26b7-9d62-4cc7-acf1-4264327ac552

Context Example

{
    "FESPortal": {
        "Org": [
            {
                "email": "test-email@fieldeffect.com",
                "first_name": "John",
                "last_name": "Doe",
                "phone_number": null,
                "type": "Administrative"
            },
            {
                "email": "test-email@fieldeffect.com",
                "first_name": "John",
                "last_name": "Doe",
                "phone_number": "+19022223333",
                "type": "Technical - Primary"
            },
            {
                "email": "test5@example.om",
                "first_name": "Smith",
                "last_name": "fes",
                "phone_number": "+16135445544",
                "type": "Technical - Secondary"
            }
        ]
    }
}

Human Readable Output

Key Contacts

First Name Last Name Phone Number Email Type
John Doe   test-email@fieldeffect.com Administrative
John Doe +19022223333 test-email@fieldeffect.com Technical - Primary
Smith fes +16135445544 test5@example.om Technical - Secondary

cov-mgsec-list-language

Get the default language for a given organization.

Base Command

cov-mgsec-list-language

Input

Argument Name Description Required
org_id Organization ID (eg. “00000000-1111-2222-3333-444444444444”). Required

Context Output

Path Type Description
FESPortal.Org.default_language String Default Language.

Command example

!cov-mgsec-list-language org_id=cb7e26b7-9d62-4cc7-acf1-4264327ac552

Context Example

{
    "FESPortal": {
        "Org": {
            "default_language": "en-CA"
        }
    }
}

Human Readable Output

Default Organization Language

Default Language
en-CA

Configuration parameters

  • credentials — Credentials (required)
  • proxy — Use system proxy settings
  • first_run_time_range — First run time range
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Fetch Limit
  • broker_url — Broker Server URL

Commands (12)

  • cov-mgsec-broker-cloud-action-by-aro

    Broker - Cloud Action By ARO.

  • cov-mgsec-broker-endpoint-action-by-aro

    Broker - Endpoint Action By ARO.

  • cov-mgsec-broker-endpoint-action-by-host

    Broker - Endpoint Action By Host.

  • cov-mgsec-broker-list-org

    Broker - List organizations.

  • cov-mgsec-broker-ping

    Broker - Test connectivity to the Broker service.

  • cov-mgsec-comment-aro

    Comment on an ARO.

  • cov-mgsec-get-aro

    Query FES Portal for ARO.

  • cov-mgsec-list-escalation-contacts

    Get the escalation contact list for a given organization.

  • cov-mgsec-list-key-contacts

    Get the key contact list for a given organization.

  • cov-mgsec-list-language

    Get the default language for a given organization.

  • cov-mgsec-list-org

    List organizations.

  • cov-mgsec-transition-aro

    Transition an ARO.

Source

CovalenceManagedSecurity.py CovalenceManagedSecurity_test.py CovalenceManagedSecurity.yml CovalenceManagedSecurity_description.md command_examples.txt
Download History Raw 
import importlib
import json
import os

import demistomock as demisto
import pytest

BROKER_HOST = "https://example.com"
PORTAL_URL = "https://example.com/v1"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.load(f)


@pytest.fixture(autouse=True)
def init_tests(mocker):
    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "credentials": {"identifier": "foo", "password": "bar"},
            "first_run_time_range": "2",
            "proxy": False,
            "insecure": True,
        },
    )

    mocker.patch.dict(os.environ, {"HTTP_PROXY": "", "HTTPS_PROXY": "", "http_proxy": "", "https_proxy": ""})


@pytest.fixture()
def broker_client_instance():
    from CovalenceManagedSecurity import BrokerClient

    return BrokerClient(host=BROKER_HOST, api_key="test_api_key")


@pytest.fixture()
def portal_instance():
    from CovalenceManagedSecurity import Portal

    return Portal(bearer="gan ceann", portal_url=PORTAL_URL)


def test_get_aros(mocker):
    mock_get_aros = util_load_json("test_data/get_aros.json")

    Fes_portal = importlib.import_module("CovalenceManagedSecurity")
    mocker.patch.object(demisto, "args", return_value={"details": "false"})
    mock_p = Fes_portal.Portal(bearer="gan ceann")
    mocker.patch.object(Fes_portal, "Portal", return_value=mock_p)
    mocker.patch.object(mock_p, "get_aros", return_value=mock_get_aros)

    r = Fes_portal.get_aros()
    assert len(r[0]) == 6
    assert "title" in r[0]
    assert "organization" in r[0]
    assert "resolution" in r[0]
    assert "severity" in r[0]
    assert "status" in r[0]
    assert "type" in r[0]


def test_get_aros_details(mocker):
    mock_get_aros = util_load_json("test_data/get_aros.json")

    Fes_portal = importlib.import_module("CovalenceManagedSecurity")
    mocker.patch.object(demisto, "args", return_value={"details": "true"})
    mock_p = Fes_portal.Portal(bearer="gan ceann")
    mocker.patch.object(Fes_portal, "Portal", return_value=mock_p)
    mocker.patch.object(mock_p, "get_aros", return_value=mock_get_aros)

    r = Fes_portal.get_aros()
    assert len(r[0]) == 22
    assert "ID" in r[0]
    assert "alert_key" in r[0]
    assert "analyst_notes" in r[0]
    assert "count" in r[0]
    assert "creation_time" in r[0]
    assert "details" in r[0]
    assert "details_markdown" in r[0]
    assert "display_url" in r[0]
    assert "external_bug_id" in r[0]
    assert "last_updated_time" in r[0]
    assert "notes" in r[0]
    assert "organization" in r[0]
    assert "references" in r[0]
    assert "resolution" in r[0]
    assert "serial_id" in r[0]
    assert "severity" in r[0]
    assert "status" in r[0]
    assert "steps" in r[0]
    assert "template_id" in r[0]
    assert "title" in r[0]
    assert "triage_id" in r[0]
    assert "type" in r[0]


def test_comment_aro(mocker):
    mock_comment_aro = util_load_json("test_data/comment_aro.json")

    import CovalenceManagedSecurity

    mock_p = CovalenceManagedSecurity.Portal(bearer="gan ceann")
    mocker.patch.object(CovalenceManagedSecurity, "Portal", return_value=mock_p)
    mocker.patch.object(mock_p, "comment_aro", return_value=mock_comment_aro)

    r = CovalenceManagedSecurity.comment_aro_command()

    assert r == mock_comment_aro


def test_list_org(mocker):
    mock_list_org = util_load_json("test_data/get_org.json")

    import CovalenceManagedSecurity

    mock_p = CovalenceManagedSecurity.Portal(bearer="gan ceann")
    mocker.patch.object(CovalenceManagedSecurity, "Portal", return_value=mock_p)
    mocker.patch.object(mock_p, "get_organizations", return_value=mock_list_org)

    r = CovalenceManagedSecurity.list_organizations()

    assert r == mock_list_org


def test_list_escalation_contacts(portal_instance, requests_mock):
    from CovalenceManagedSecurity import list_escalation_contacts_command

    mock_list_escalation_contacts = util_load_json("test_data/list_escalation_contacts.json")
    requests_mock.get(f"{PORTAL_URL}/escalation_contact_lists", json=mock_list_escalation_contacts)

    args = {"org_id": "6d752a20-b28a-45f8-a72f-b809b52335ed"}

    results = list_escalation_contacts_command(portal_instance, args)

    assert len(results.outputs) == 4
    assert results.outputs_prefix == "FESPortal.Org"
    assert results.outputs_key_field == "ID"


def test_list_organization_contacts(portal_instance, requests_mock):
    from CovalenceManagedSecurity import list_organization_key_contacts_command

    org_id = "6d752a20-b28a-45f8-a72f-b809b52335ed"
    list_organization = util_load_json("test_data/list_organization.json")
    requests_mock.get(f"{PORTAL_URL}/organizations/{org_id}", json=list_organization)

    args = {"org_id": org_id}

    results = list_organization_key_contacts_command(portal_instance, args)

    assert len(results.outputs) == 3
    assert results.outputs_prefix == "FESPortal.Org"
    assert results.outputs_key_field == "ID"


def test_list_organization_language(portal_instance, requests_mock):
    from CovalenceManagedSecurity import list_organization_language_command

    org_id = "6d752a20-b28a-45f8-a72f-b809b52335ed"
    list_organization = util_load_json("test_data/list_organization.json")
    requests_mock.get(f"{PORTAL_URL}/organizations/{org_id}", json=list_organization)

    args = {"org_id": org_id}

    results = list_organization_language_command(portal_instance, args)

    assert results.outputs == {"default_language": "en-CA"}
    assert results.outputs_prefix == "FESPortal.Org"
    assert results.outputs_key_field == "ID"


def test_ping_broker_command(requests_mock, broker_client_instance):
    from CovalenceManagedSecurity import ping_broker_command

    requests_mock.get(f"{BROKER_HOST}/ping", json="pong")

    results = ping_broker_command(broker_client_instance)
    assert results.readable_output == "## Success"
    assert results.outputs_prefix == "FESBroker.APIStatus"


def test_list_organizations_broker_command(requests_mock, broker_client_instance):
    from CovalenceManagedSecurity import list_organizations_broker_command

    mock_broker_list_org = util_load_json("test_data/broker_list_org.json")
    requests_mock.get(f"{BROKER_HOST}/organizations", json=mock_broker_list_org)

    results = list_organizations_broker_command(broker_client_instance)
    assert results.outputs == mock_broker_list_org
    assert results.outputs_prefix == "FESBroker.Org"
    assert results.outputs_key_field == "ID"


def test_endpoint_action_by_host_broker_command(requests_mock, broker_client_instance):
    from CovalenceManagedSecurity import endpoint_action_by_host_broker_command

    mock_endpoint_action_response = util_load_json("test_data/broker_endpoint_action.json")
    requests_mock.post(f"{BROKER_HOST}/endpoint/host/defender_quick_scan", json=mock_endpoint_action_response)
    args = {
        "action_type": "DEFENDER_QUICK_SCAN",
        "org_id": "00000000-1111-2222-3333-444444444444",
        "host_identifier": "test-host-identifier-string",
    }

    results = endpoint_action_by_host_broker_command(broker_client_instance, args)
    assert results.outputs == mock_endpoint_action_response
    assert results.outputs_prefix == "FESBroker.Action"
    assert results.outputs_key_field == "agent_uuid"


def test_endpoint_action_by_aro_broker_command(requests_mock, broker_client_instance):
    from CovalenceManagedSecurity import endpoint_action_by_aro_broker_command

    mock_endpoint_action_response = util_load_json("test_data/broker_endpoint_action.json")
    requests_mock.post(f"{BROKER_HOST}/endpoint/aro/isolate", json=mock_endpoint_action_response)
    args = {"action_type": "ISOLATE", "aro_id": "00000000-1111-2222-3333-444444444444"}

    results = endpoint_action_by_aro_broker_command(broker_client_instance, args)
    assert results.outputs == mock_endpoint_action_response
    assert results.outputs_prefix == "FESBroker.Action"
    assert results.outputs_key_field == "agent_uuid"


def test_cloud_action_by_aro_broker_command(requests_mock, broker_client_instance):
    from CovalenceManagedSecurity import cloud_action_by_aro_broker_command

    mock_endpoint_action_response = util_load_json("test_data/broker_cloud_action.json")
    requests_mock.post(f"{BROKER_HOST}/cloud/aro/revoke_sessions", json=mock_endpoint_action_response)
    args = {"action_type": "REVOKE_SESSIONS", "aro_id": "00000000-1111-2222-3333-444444444444"}

    results = cloud_action_by_aro_broker_command(broker_client_instance, args)
    assert results.outputs == mock_endpoint_action_response
    assert results.outputs_prefix == "FESBroker.Action"
    assert results.outputs_key_field == "action_id"