Cryptosim

CRYPTOSIM gets correlations and correlation's alerts. Integration fetchs alerts to incident according to instance.

Analytics & SIEM · Cryptosim

Details

ID	`Cryptosim`
Provider	CRYPTTECH
Category	Analytics & SIEM
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

CRYPTTECH CRYPTOSIM

CRYPTOSIM meets the SIEM needs of corporations by its unique correlation engine works in memory, capable of hierarchical correlation, supports different correlation techniques, query structure that allows all kinds of data analytics, detects AI based algorithms behavioral anomalies and threat patterns that are not in rule sets.

From the personal devices we use to the most critical governmental substructures, the awareness of the importance of cyber threats in every segment of the digitalized world and the fact that cyber security must be in all areas of our lives becomes more and more obvious.

The massive attacks on the global scale have clearly demonstrated the importance of taking measures against cyber threats and increasing investments on this area.

CRYPTTECH continues to work towards the goal with the mission of developing new, innovative and indigenous technology and products in the increasingly complex cyber security world. CRYPTTECH provides its unique in-memory correlation capability for its SIEM product with its strong correlation system. CRYPTOSIM collects all logs, detects behavioral differences & anomalies and automatically associates them.

More over it can catch APT (Advanced Persistent Threats). CRYPTTECH achieves high performance values for the SIEM product with its NoSQL structure developed by itself. CRYPTOSIM has become one of the most strategic products for perception of threats with its unique correlation features working with rules and machine learning methods

What does this pack do?

Gets all correlations from CRPYTOSIM
Gets all correlation alerts from CRPYTOSIM
Creates incidents from correlation alerts

Use Cases

Fetching alerts based on correlations.
Getting additional information by command parameters.
Searching correlations.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Examples:

!cryptosim-get-correlations limit=100 sortType=desc
!cryptosim-get-correlationalerts startDate=2022-01-01T12:00:00 endDate=2022-01-01T23:59:59 etc.(shown when command is written)

cryptosim-get-correlation-alerts

The command is used to get correlation alerts.

Base Command

cryptosim-get-correlation-alerts

Input

Argument Name	Description	Required
startDate	This denotes the start date of the search period. It must be used in all API fields. E.g.: “startDate”: “2021-04-24T12:00:00”.	Required
endDate	This denotes the end date of the search period. It must be used in all API fields. E.g.: endDate: “2021-04-24T24:00:00”.	Required
showSolved	Boolean, show only solved correlations if the parameter is true, otherwise take all correlations.	Optional
crrPluginId	If user want to take specific correlation, can take it when ID of correlation is given as parameter.	Optional
containStr	This is used to search for a word specified in the request. (Contains String) E.g.: “containStr”: “Unsuccessful”.	Optional
risk	The risk level of correlation rules to filter. Default: -1. Default get all.	Optional
srcIPPort	This used to search the source IP address in the request. E.g.: “srcIPPort”: “127.0.0.1”.	Optional
destIPPort	This used to search the destination IP address in the request. E.g.: “dest IPPort”: “127.0.0.1”.	Optional
srcPort	This is used to filter the responses using the source port. E.g.: “srcPort”: “6335”.	Optional
destPort	This is used to filter the responses using the source port. E.g.: “destPort”: “6335”.	Optional
riskOperatorID	risk operator name. It can be equal, greaternumber, greaterorequalnumber, lessnumber, lessnumberorequal, notequal. Default: equal. Default is equal.	Optional
limit	The limit to get how many correlation alerts get. Default: 100.	Optional

Context Output

Path	Type	Description
CorrelationAlerts.Output	Dictionary	Return StatusCode, Data or ErrorMessage and Outparameters. StatusCode represent html response code. If it is 200, return Data as list of desired Correlation object. If not, return ErrorMessage. OutParameters is empty.

Configuration parameters

url — Your server URL (required)
credentials — User (required)
proxy — Use system proxy settings
first_fetch — First Fetch Time (default 1 hour)
max_fetch — Max Fetch
time_zone — Timezone(as hour)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (2)

cryptosim-get-correlation-alerts
The command is used to get correlation alerts.
cryptosim-get-correlations
The command is used to get the list of active correlations.

Source

Cryptosim.py Cryptosim_test.py Cryptosim.yml Cryptosim_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: CRYPTTECH
commonfields:
  id: Cryptosim
  version: -1
configuration:
- display: Your server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: User
  additionalinfo: The User name of CRYPTOSIM
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: First Fetch Time (default 1 hour)
  defaultvalue: 1 hour
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Max Fetch
  additionalinfo: Maximum number of incidents per fetch (Recommended less than 200)
  defaultvalue: '20'
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Timezone(as hour)
  name: time_zone
  type: 0
  additionalinfo: Define the timezone to get correct logs from db. (default:3) eg. 3, 5, -5)
  defaultvalue: '3'
  required: false
  section: Connect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
description: CRYPTOSIM gets correlations and correlation's alerts. Integration fetchs alerts to incident according to instance.
display: Cryptosim
name: Cryptosim
script:
  commands:
  - arguments:
    - description: 'This denotes the start date of the search period. It must be used in all API fields. E.g.: "startDate": "2021-04-24T12:00:00".'
      name: startDate
      required: true
    - description: 'This denotes the end date of the search period. It must be used in all API fields. E.g.: endDate: "2021-04-24T24:00:00".'
      name: endDate
      required: true
    - defaultValue:
      description: 'Boolean, show only solved correlations if the parameter is true, otherwise take all correlations.'
      name: showSolved
    - defaultValue:
      description: 'If user want to take specific correlation, can take it when ID of correlation is given as parameter.'
      name: crrPluginId
    - default:
      description: 'This is used to search for a word specified in the request. (Contains String) E.g.: "containStr": "Unsuccessful".'
      name: containStr
    - defaultValue:
      description: 'The risk level of correlation rules to filter. Default: -1. Default get all.'
      name: risk
    - defaultValue:
      description: 'This  used  to  search  the  source  IP address in the request. E.g.: "srcIPPort": "127.0.0.1".'
      name: srcIPPort
    - defaultValue:
      description: 'This  used  to  search  the  destination  IP address in the request. E.g.: "dest IPPort": "127.0.0.1".'
      name: destIPPort
    - defaultValue:
      description: 'This  is  used  to  filter  the  responses using the source port. E.g.: "srcPort": "6335".'
      name: srcPort
    - defaultValue:
      description: 'This  is  used  to  filter  the  responses using the source port. E.g.: "destPort": "6335".'
      name: destPort
    - defaultValue: 'equal'
      description: 'risk operator name. It can be equal, greaternumber, greaterorequalnumber, lessnumber, lessnumberorequal, notequal. Default: equal.'
      name: riskOperatorID
    - defaultValue:
      description: 'The limit to get how many correlation alerts get. Default: 100.'
      name: limit
    description: 'The command is used to get correlation alerts.'
    name: cryptosim-get-correlation-alerts
    outputs:
    - contextPath: CorrelationAlerts.Output
      description: 'Return StatusCode, Data or ErrorMessage and Outparameters. StatusCode represent html response code. If it is 200, return Data as list of desired Correlation object. If not, return ErrorMessage. OutParameters is empty.'
      type: Dictionary
  - arguments:
    - defaultValue:
      description: 'The limit to get how many correlations get. Default: 100.'
      name: limit
    - defaultValue:
      description: 'Determine how to sort data `asc` for ascending or `desc` for descending to CorrelationId. Default: asc.'
      name: sortType
    description: 'The command is used to get the list of active correlations.'
    name: cryptosim-get-correlations
    outputs:
    - contextPath: Correlations.Output. If not, return ErrorMessage. OutParameters is empty.'
      type: Dictionary
      description: 'Return StatusCode, Data or ErrorMessage and Outparameters. StatusCode represent html response code. If it is 200, return Data as list of active Correlations.'
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 5.5.0
tests:
- No tests (auto formatted)