Cyberpion

The Cyberpion integration allows you to seamlessly receive all your Cyberpion security solution Action Items and supportive information to your Cortex XSOAR.

Vulnerability Management · Cyberpion

Details

IDCyberpion
ProviderIONIX
CategoryVulnerability Management
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Vulnerabilities management
This integration was integrated and tested with version 1.0 of Cyberpion

Configure Cyberpion in Cortex

Parameter Description Required
Server URL (e.g. https://api.example.com/security/api)   True
API Key   True
Maximum number of incidents per fetch   False
Action items category to fetch as incidents. Allowed values: “Network”, “Web”, “Cloud”, “DNS”, “PKI”, “Vulnerabilities”, “TLS”, “Email Server”, “Mobile”. True
Minimum Action items severity level to fetch incidents from. Allowed values are integers between 1 to 10.
1 will fetch all incidents.		 True
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
Fetch incidents   False
Incident type   False
Show only active issues   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberpion-get-domain-action-items

Retrieves domain’s action items

Base Command

cyberpion-get-domain-action-items

Input

Argument Name Description Required
domain Get action items for this domain. Required

Context Output

Path Type Description
Cyberpion.DomainData.Vulnerabilities.id String Action item ID
Cyberpion.DomainData.Domain String Domain to get action items that are related to
Cyberpion.DomainData.Vulnerabilities.category String Category of action item. can be DNS, PKI, Cloud, Vulnerability
Cyberpion.DomainData.Vulnerabilities.urgency Number Action item urgency
Cyberpion.DomainData.Vulnerabilities.is_open Boolean Is action item still relevant (open)
Cyberpion.DomainData.Vulnerabilities.creation_time Date Action item’s creation time
Cyberpion.DomainData.Vulnerabilities.link String Link to the action item in Cyberpion’s portal
Cyberpion.DomainData.Vulnerabilities.title String Action item’s title
Cyberpion.DomainData.Vulnerabilities.impact String Action item’s potential impact from a security perspective
Cyberpion.DomainData.Vulnerabilities.summary String Action item summary
Cyberpion.DomainData.Vulnerabilities.solution String The necessary course of action needed to remediate the threat
Cyberpion.DomainData.Vulnerabilities.description String Description of the source of the issue that was detected
Cyberpion.DomainData.Vulnerabilities.technical_details String Technical details of the issue

Command Example

!cyberpion-get-domain-action-items domain="$anon100-2.com"

Context Example

{
    "Cyberpion": {
        "DomainData": {
            "Domain": "$anon100-2.com",
            "Vulnerabilities": [
                {
                    "alert_type": "cyberpion_action_item",
                    "category": "PKI",
                    "creation_time": "2020-11-19 14:27:07.430866 UTC",
                    "description": "Certificates are used to authenticate the identities in online communications. Certificate must be both valid (format, cryptographic schemes, etc.) and issued by a trusted certificate authority (CA). The certificate of the domain is about to become invalid, because:\n1) The domain shares certificate with other domains that are vulnerable. Sharing trust with vulnerable domains exposes the domain to risk if the vulnerable domains are hacked. For exmaple, a stolen private key can be abused to impersonate the domain, and in some cases also to intercept live traffic.\n2) Other vulnerable domains use a certificate that is valid for the domain. Sharing trust with vulnerable domains exposes the domain to risk if the vulnerable domains are hacked. Although the certificates are different, if the other certificate is valid for the domain and it is compromised, attackers can abuse it to impersonate the domain.\n",
                    "domain": "$anon100-2.com",
                    "id": 175692,
                    "impact": "Bad PKI design (anomalies, inconsistency, or ignoring best practices) indicates on missing management. PKI anomalies might become security vulnerability, mainly, due to the difficulty in following them.",
                    "is_open": true,
                    "link": "https://api.test.com/static/new/index.html#/pages/assessments/certificates/cert_test_report;$anon100-2.com",
                    "solution": "Issue a new certificate for the domain",
                    "summary": "The domain $anon100-2.com uses certificate that is used also for vulnerable domains and can be forged with another valid certificate that is used for another vulnerable domain",
                    "technical_details": "shares a certificate with the vulnerable domains: $anon100-265.com (risk rank: 98), sd2.$anon100-2.com (risk rank: 98), sd2.$anon100-265.com (risk rank: 98)\ncould be authenticated with the certificate that is used by the vulnerable domains: $anon100-265.com (cvss: 98.39526778), sd2.$anon100-2.com (cvss: 98.39526778), sd2.$anon100-265.com (cvss: 98.39526778)",
                    "title": "Fix PKI issues: Vulnerable domain use certificate that valid fo domain, Domain shares a certificate with vulnerable domain",
                    "urgency": 5
                }
            ]
        }
    }
}

Human Readable Output

Cyberpion

Action Items

domain category urgency is_open creation_time link title impact summary solution description technical_details
$anon100-2.com PKI 5.0 true 2020-11-19 14:27:07.430866 UTC https://api.test.com/static/new/index.html#/pages/assessments/certificates/cert_test_report;$anon100-2.com Fix PKI issues: Vulnerable domain use certificate that valid fo domain, Domain shares a certificate with vulnerable domain Bad PKI design (anomalies, inconsistency, or ignoring best practices) indicates on missing management. PKI anomalies might become security vulnerability, mainly, due to the difficulty in following them. The domain $anon100-2.com uses certificate that is used also for vulnerable domains and can be forged with another valid certificate that is used for another vulnerable domain Issue a new certificate for the domain Certificates are used to authenticate the identities in online communications. Certificate must be both valid (format, cryptographic schemes, etc.) and issued by a trusted certificate authority (CA). The certificate of the domain is about to become invalid, because:
1) The domain shares certificate with other domains that are vulnerable. Sharing trust with vulnerable domains exposes the domain to risk if the vulnerable domains are hacked. For exmaple, a stolen private key can be abused to impersonate the domain, and in some cases also to intercept live traffic.
2) Other vulnerable domains use a certificate that is valid for the domain. Sharing trust with vulnerable domains exposes the domain to risk if the vulnerable domains are hacked. Although the certificates are different, if the other certificate is valid for the domain and it is compromised, attackers can abuse it to impersonate the domain.
 shares a certificate with the vulnerable domains: $anon100-265.com (risk rank: 98), sd2.$anon100-2.com (risk rank: 98), sd2.$anon100-265.com (risk rank: 98)
could be authenticated with the certificate that is used by the vulnerable domains: $anon100-265.com (cvss: 98.39526778), sd2.$anon100-2.com (cvss: 98.39526778), sd2.$anon100-265.com (cvss: 98.39526778)

cyberpion-get-domain-state

Retrieves domain’s info and current state

Base Command

cyberpion-get-domain-state

Input

Argument Name Description Required
domain Get info and current state of this domain. Required

Context Output

Path Type Description
Cyberpion.DomainState.id String Domain State ID
Cyberpion.DomainState.domain String The Domain
Cyberpion.DomainState.ips String Reverse Ip’s of domain’s ips
Cyberpion.DomainState.risk_rank Number Domain’s risk rank
Cyberpion.DomainState.vuln_count Number Number of vulnerabilities associated with domain
Cyberpion.DomainState.cname_chain String Domain’s CName chain (DNS record)
Cyberpion.DomainState.domain_types String Domain’s infrastructure info (provider etc.)
Cyberpion.DomainState.discovery_date Date The Date domain was discovered

Command Example

!cyberpion-get-domain-state domain="$anon100-2.com"

Context Example

{
    "Cyberpion": {
        "DomainState": {
            "cname_chain": null,
            "discovery_date": "2021-03-07",
            "domain": "$anon100-2.com",
            "domain_types": "1.\nservice_type: CBSP\nprovider: Incapsula\nservice: None\ndescription: None",
            "id": "9ab5474a-3da2-4910-9d59-9a1f11a2193e",
            "ips": "153.228.75.31: None\n235.125.130.90: None",
            "risk_rank": 0,
            "vuln_count": 0
        }
    }
}

Human Readable Output

Cyberpion

Domain State

id domain ips risk_rank vuln_count cname_chain domain_types discovery_date
9ab5474a-3da2-4910-9d59-9a1f11a2193e $anon100-2.com 153.228.75.31: None
235.125.130.90: None		 0 0   1.
service_type: CBSP
provider: Incapsula
service: None
description: None		 2021-03-07

Configuration parameters

  • url — Server URL (e.g. https://portal.cyberpion.com/portal/api/) (required)
  • apikey — API Key (required)
  • max_fetch — Maximum number of incidents per fetch
  • categories — Action items category to fetch as incidents. (required)
  • minSeverity — Minimum Action items severity level to fetch incidents from. (required)
  • first_fetch — First fetch timestamp (in months)- Optional. If not set, all incidents will be fetched
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • ShowOnlyOpen — Show only open issues
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (2)

  • cyberpion-get-domain-action-items

    Retrieves domain's action items.

  • cyberpion-get-domain-state

    Retrieves domain's info and current state.

Source

Cyberpion.py Cyberpion_test.py Cyberpion.yml Cyberpion_description.md command_examples.txt
Download History Raw 
import json

MOCKED_BASE_URL = "https://api.test.com/api/"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_get_domain_state(mocker):
    from Cyberpion import Client

    mock_response = util_load_json("test_data/domain_state.json")
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    client = Client(base_url=MOCKED_BASE_URL, verify=False, headers={"Authentication": "Bearer some_api_key"})
    domain = "$anon100-2.com"
    response = client.get_domain_state(domain)
    # domain types and ips are reformatted in the function, skip checking them
    response.pop("domain_types")
    response.pop("ips")
    mocked = mock_response["results"][0]
    assert response == mocked


def test_get_domain_state_command(mocker):
    from Cyberpion import Client, get_domain_state_command

    mock_response = util_load_json("test_data/domain_state.json")
    # requests_mock.get(
    #     f'{MOCKED_BASE_URL}domainstate/?verbosity=details&domain=$anon100-2.com',
    #     json=mock_response)
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    client = Client(base_url=f"{MOCKED_BASE_URL}", verify=False, headers={"Authentication": "Bearer some_api_key"})
    domain = "$anon100-2.com"
    response = get_domain_state_command(client, {"domain": domain})
    mocker.patch.object(Client, "_http_request", return_value=util_load_json("test_data/domain_state.json"))
    assert response.outputs["DomainState"] == client.get_domain_state(domain)
    assert response.outputs_prefix == "Cyberpion"
    assert response.outputs_key_field == "id"


def test_fetch_incidents(mocker):
    """Tests the fetch-incidents command function.

    Configures requests_mock instance to generate the appropriate
    get_alert API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from Cyberpion import Client, fetch_incidents

    mock_response = util_load_json("test_data/new_incidents.json")
    mocker.patch.object(Client, "_http_request", return_value=mock_response)

    client = Client(base_url=f"{MOCKED_BASE_URL}", verify=False, headers={"Authentication": "Bearer some_api_key"})

    _, new_incidents = fetch_incidents(
        client,
        max_fetch=2,
        min_severity=0,
        show_only_active=True,
        alert_types=[],
    )
    # name is too long for unit test, won't pass nop matter what
    name_part_1 = "Fix DNS issues: Nameservers are not geo-separated,"
    name_part_2 = " Authoritative nameservers are not geo-separated - $anon100-4.com"
    assert new_incidents[0] == {
        "name": name_part_1 + name_part_2,
        "occurred": "2020-11-18T07:55:31.242711+00:00",
        "rawJSON": json.dumps(mock_response["results"][0]),
        "severity": 2,
    }
    assert new_incidents[1] == {
        "name": "Fix PKI issue: Weak certificate issuer - $anon100-4.com",
        "occurred": "2020-11-19T14:27:05.811645+00:00",
        "rawJSON": json.dumps(mock_response["results"][1]),
        "severity": 3,
    }