CyberX - Central Manager

Details

ID	`CyberX - Central Manager`
Provider	Microsoft
Category	Network Security
From Version	6.0.0
Docker Image	`demisto/python3-deb:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

cyberx-update-alert

Updating the alert

Base Command

cyberx-update-alert

Input

Argument Name	Description	Required
cyberx_uuid	The unique ID.	Required
action	The action to perform on the alert. Possible values are: handle, handleAndLearn.	Required

Context Output

There is no context output for this command.

Configuration parameters

Server — IP/DNS (required)
Api-Token — Token generated in CyberX (required)
proxy — Use system proxy settings
unsecure — Trust any certificate (not secure)

Commands (1)

cyberx-update-alert
Updating the alert

Source

CyberXCentralManager.py CyberXCentralManager.yml CyberXCentralManager_description.md

Download History Raw

import demistomock as demisto  # noqa: F401
import requests
from CommonServerPython import *  # noqa: F401

server = demisto.params()["Server"]
token = demisto.params()["Api-Token"]
ssl_check = not demisto.params().get("unsecure", False)
headers = {"Authorization": token}

if not demisto.params().get("proxy", False):
    # Remove proxy environment variables if they exist
    for proxy_var in ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"]:
        os.environ.pop(proxy_var, None)

# The command demisto.command() holds the command sent from the user.
if demisto.command() == "test-module":
    url = "https://" + server + "/external/v1/alerts/"
    response = requests.put(url, headers=headers, verify=ssl_check)
    # This is the call made when pressing the integration test button.
    if response.status_code == requests.codes.ok:
        demisto.results("ok")
    else:
        demisto.results(response.status_code)
    sys.exit(0)

# This command takes a UUID as argument to update the according incident
if demisto.command() == "cyberx-update-alert":
    url = "https://" + server + "/external/v1/alerts/" + demisto.args()["cyberx_uuid"]
    payload = {"action": demisto.args()["action"]}
    response = requests.put(url, data=json.dumps(payload), headers=headers, verify=ssl_check)
    demisto.results(response.content)
    sys.exit(0)