CyberArkAIM v2

Details

ID	`CyberArkAIM v2`
Provider	Palo Alto Networks
Category	Authentication & Identity Management
From Version	5.0.0
Docker Image	`demisto/ntlm:1.0.0.9067966`
Supported Modules	Agentix XSIAM

README

The CyberArk Central Credential Provider (CCP) provides a secure safe in which to store your account credentials. Use this integration to retrieve the account credentials in CyberArk CCP. This integration fetches credentials. For more information, see Managing Credentials.

Authentication Options

The integration uses the Central Credential Provider and supports the following authentication methods:

OS User (Windows NTLM Authentication): Set the domain user and password in the credentials field. Make sure your CyberArk Server is configured to support NTLM authentication as documented here. Note that the user option may require specifying full domain\user.
Client Certificate Authentication: Enter the Certificate and Private key in the integration instance configuration parameters. Make sure to follow the instructions here to enable the Central Credential Provider to accept client authentication with client certificates.
Allowed Machines: Leave all authentication methods empty. Follow CyberArk’s instructions here to accept the Cortex XSOAR Server IP for the configured AppID.

Further information is available from CyberArk at:

https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20and%20ASCP/Application-Authentication-Methods-general.htm
https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CCP/Configure_CCPWindows.htm

Configure CyberArkAIM v2 in Cortex

Navigate to Settings > Integrations > Servers & Services.
Search for CyberArkCCP.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Server URL and Port (e.g., https://example.net:1234)		True
AppID as configured in AIM		False
Folder to search in safe		False
Safe to search in		False
A comma-separated list of credential names in the safe.	Partial names are not supported. If left empty, no credentials will be fetched.	False
Username		False
Password		False
Certificate File as Text	Add a certificate file in text format to use to connect to the CyberArk AIM server.	False
Key File as Text		False
Fetch credentials		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberark-aim-list-credentials

Lists all available credentials according to the list of credential names configured.

Base Command

cyberark-aim-list-credentials

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
CyberArkAIM.AccountType	String	The type of the account.
CyberArkAIM.Address	String	The address of the account.
CyberArkAIM.CPMStatus	String	The CMP status of the account.
CyberArkAIM.Domain	String	The domain of the account.
CyberArkAIM.Name	String	The credential name of the account.

Command Example


#### Context Example

{
“CyberArkAIM”: {
“AccountCategory”: “True”,
“AccountDescription”: “Built-in account for administering the computer/domain”,
“AccountDiscoveryDate”: “1573128798”,
“AccountEnabled”: “True”,
“AccountExpirationDate”: “0”,
“AccountOSGroups”: “Administrators”,
“AccountType”: “Domain”,
“Address”: “AIM.COM”,
“CPMDisabled”: “(CPM)Newly discovered dependency”,
“CPMStatus”: “success”,
“CreationMethod”: “AutoDetected”,
“DeviceType”: “Operating System”,
“DiscoveryPlatformType”: “Windows Domain”,
“Domain”: “AIM.COM”,
“Folder”: “Root”,
“LastLogonDate”: “1572451901”,
“LastPasswordSetDate”: “1566376303”,
“LastSuccessChange”: “1575910475”,
“LastSuccessReconciliation”: “1583521898”,
“LastSuccessVerification”: “1583256386”,
“LastTask”: “ReconcileTask”,
“LogonDomain”: “domain1”,
“MachineOSFamily”: “Server”,
“Name”: “name1”,
“OSVersion”: “Windows Server 2016 Standard”,
“OU”: “CN=Users,DC=COM”,
“PasswordChangeInProcess”: “False”,
“PasswordNeverExpires”: “True”,
“PolicyID”: “WinDomain”,
“RetriesCount”: “-1”,
“SID”: “sid”,
“Safe”: “Windows Domain Admins”,
“SequenceID”: “1”,
“Tags”: “DAdmin”,
“UserName”: “username1”
}
}
```

Human Readable Output

Results

AccountCategory AccountDescription AccountDiscoveryDate AccountEnabled AccountExpirationDate AccountOSGroups AccountType Address CPMDisabled CPMStatus CreationMethod DeviceType DiscoveryPlatformType Domain Folder LastLogonDate LastPasswordSetDate LastSuccessChange LastSuccessReconciliation LastSuccessVerification LastTask LogonDomain MachineOSFamily Name OSVersion OU PasswordChangeInProcess PasswordNeverExpires PolicyID RetriesCount SID Safe SequenceID Tags UserName

True Built-in account for administering the computer/domain 1573128798 True 0 Administrators Domain AIM.COM (CPM)Newly discovered dependency success AutoDetected Operating System Windows Domain AIM.COM Root 1572451901 1566376303 1575910475 1583521898 1583256386 ReconcileTask domain1 Server name1 Windows Server 2016 Standard CN=Users,DC=COM False True WinDomain -1 sid Windows Domain Admins 1 DAdmin username1

Configuration parameters

url — Server URL and Port (e.g., https://example.net:1234) (required)
app_id — AppID as configured in AIM
folder — Folder to search in safe
safe — Safe to search in
credential_names — A comma-separated list of credential names in the safe.
credentials — Username
cert_text — Certificate File as Text
key_text — Key File as Text
key_text_creds —
isFetchCredentials — Fetch credentials
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

cyberark-aim-list-credentials
Lists all available credentials according to the list of credential names configured.

Source

CyberArkAIM_v2.py CyberArkAIM_v2_test.py CyberArkAIM_v2.yml CyberArkAIM_v2_description.md command_examples.txt

Download History Raw

import copy

import demistomock as demisto
import pytest
from CyberArkAIM_v2 import Client, fetch_credentials, list_credentials_command
from test_data.context import LIST_CREDENTIALS_CONTEXT
from test_data.get_credentials_res import LIST_CREDENTIALS_RAW


@pytest.mark.parametrize(
    "command, get_credentials_res, context",
    [(list_credentials_command, copy.deepcopy(LIST_CREDENTIALS_RAW), LIST_CREDENTIALS_CONTEXT)],
)
def test_cyberark_aim_commands(command, get_credentials_res, context, mocker):
    """Unit test
    Given
    - raw response of the http request
    When
    - mock the http request result
    Then
    - create the context
    - validate the expected_result and the created context
    - make sure the key "Content" that contains the password doesn't appear in content or raw_response
    """
    client = Client(
        server_url="https://api.cyberark.com/",
        use_ssl=False,
        proxy=False,
        app_id="app",
        folder="Root",
        safe="safe1",
        credentials_object="name1,name2",
        username="",
        password="",
        cert_text="",
        key_text="",
    )
    mocker.patch.object(Client, "get_credentials", side_effect=lambda name: get_credentials_res[name])

    outputs = command(client)
    results = outputs.to_context()
    assert results.get("EntryContext") == context
    assert not results.get("EntryContext")["CyberArkAIM(val.Name && val.Name == obj.Name)"][0].get("Content")
    assert not results.get("Contents")[0].get("Content")


@pytest.mark.parametrize(
    "creds_name_to_fetch, expected_res",
    [
        (
            "name1",
            [
                {
                    "user": "username1",
                    "password": "password1",
                    "name": "name1",
                }
            ],
        ),
        (
            None,
            [
                {
                    "user": "username1",
                    "password": "password1",
                    "name": "name1",
                },
                {
                    "user": "username2",
                    "password": "password2",
                    "name": "name2",
                },
                {
                    "user": "username3",
                    "password": "password3",
                    "name": "name3",
                },
            ],
        ),
    ],
)
def test_cyberark_fetch_credentials(creds_name_to_fetch, expected_res, mocker):
    """
    Given
    - Case A: Creds name to fetch credentials is 'name1'
    - Case B: No specific creds were asked in fetch credentials
    When
    - Running fetch-credentials process
    Then
    - Ensure that the credentials returned to demisto are: [(username1,password1,name1)]
    - Ensure that all credentials were returned to demisto:
        [(username1,password1,name1),(username2,password2,name2),(username3,password3,name3)]
    """
    client = Client(
        server_url="https://api.cyberark.com/",
        use_ssl=False,
        proxy=False,
        app_id="app",
        folder="Root",
        safe="safe1",
        credentials_object="name1,name2,name3",
        username="",
        password="",
        cert_text="",
        key_text="",
    )
    mocker.patch.object(Client, "get_credentials", side_effect=lambda name: LIST_CREDENTIALS_RAW[name])
    mocker.patch.object(demisto, "credentials")
    fetch_credentials(client, {"identifier": creds_name_to_fetch})
    demisto.credentials.assert_called_with(expected_res)


@pytest.mark.parametrize("creds_name_to_fetch, get_call_num, expected_res", [("name1, name2", 2, "ok"), ("", 1, "ok")])
def test_test_module_passes(creds_name_to_fetch, get_call_num, expected_res, mocker):
    """
    Given
    - Case A: Creds name to fetch credentials is 'name1, name2'
    - Case B: No specific creds were asked in fetch credentials
    When
    - Running fetch-credentials process
    Then
    - Ensure that the credentials returned to demisto are: [(username1,password1,name1)]
    - Ensure that all credentials were returned to demisto: [(username1,password1,name1),(username2,password2,name2)]
    """
    from CyberArkAIM_v2 import test_module

    client = Client(
        server_url="https://api.example.com/",
        use_ssl=False,
        proxy=False,
        app_id="app",
        folder="Root",
        safe="safe1",
        credentials_object=creds_name_to_fetch,
        username="",
        password="",
        cert_text="",
        key_text="",
    )
    get_mock = mocker.patch.object(Client, "get_credentials")
    res = test_module(client)
    assert get_mock.call_count == get_call_num
    assert res == expected_res