Cymptom

Details

ID	`Cymptom`
Provider	Tenable
Category	Vulnerability Management
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Cymptom is a Breach and Attack Simulation solution that revolutionizes the existing approach by transforming attack simulation into a data analysis question. Cymptom agentless scanning brings real-time always-on visibility into the entire security posture.
This integration was integrated and tested with version 0.3.4 of Cymptom.

Configure Cymptom in Cortex

Parameter	Description	Required
url	Management URL (for ex: `https://customer_name.cymptom.com/api/`)	True
api_key	API key	True
is_fetch	Fetch incidents	False
proxy	Use system proxy settings	False
insecure	Trust any certificate (not secure)	False
first_fetch	First fetch time range (`<number> <time unit>`, e.g., 1 hour, 30 minutes). Default is “3 days”	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cymptom-get-mitigations

This command returns mitigations recommended by Cymptom

Base Command

cymptom-get-mitigations

Input

Argument Name	Description	Required
timeout	Timeout for operation. Default is 60.	Optional

Context Output

Path	Type	Description
Cymptom.Mitigations.SeverityType	String	The severity of the mitigation
Cymptom.Mitigations.Name	String	The name of the mitigation
Cymptom.Mitigations.AttackVectorsUsedPercentage	String	The percentage of attack vectors used that can be mitigated
Cymptom.Mitigations.ID	String	The mitigation’s ID
Cymptom.Mitigations.AttackVectorsCount	number	The attack vectors counts that can be mitigated
Cymptom.Mitigations.Techniques	unknown	Techniques relevant for this mitigation

Command Example

!cymptom-get-mitigations

Human Readable Output

Mitigations

ID	Name	Severity Type	Attack Vectors Use Percentage	Attack Vectors Count	Techniques
3936	Steal or Forge Kerberos Tickets	Critical	21.16	299	Encrypt Sensitive Information, Privileged Account Management, Active Directory Configuration, Password Policies

cymptom-get-users-with-cracked-passwords

This command returns users with cracked password

Input

Argument Name	Description	Required
timeout	Timeout for operation. Default is 60.	Optional
privileged	Return only privileged (Domain Admin or Local Admin) or unprivileged users. Default is True.	Optional

Context Output

Path	Type	Description
Cymptom.CrackedUsers.Username	String	Username of users with cracked passwords

Context Example

[
    {'Username':'cymptom'},
    {'Username':'chen'}
]

Command Example

!cymptom-get-users-with-cracked-passwords privileged=False

Human Readable Output

Unprivileged Users With Cracked Passwords

Username
user1
user2

Configuration parameters

url — Management URL. for example https://customerName.cymptom.com/api/) (required)
api_key — API key (required)
is_fetch — Fetch incidents
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
first_fetch — First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is "3 days"

Commands (2)

cymptom-get-mitigations
This command returns mitigations recommended by Cymptom
cymptom-get-users-with-cracked-passwords
This command returns users with cracked password

Source

Cymptom.py Cymptom_test.py Cymptom.yml Cymptom_description.md command_examples.txt

Download History Raw

category: Vulnerability Management
provider: Tenable
commonfields:
  id: Cymptom
  version: -1
configuration:
- additionalinfo: URL to connect to the Cymptom service.
  defaultvalue: ""
  display: Management URL. for example https://customerName.cymptom.com/api/)
  name: url
  required: true
  type: 0
- additionalinfo: API key token to connect to the Cymptom API.
  defaultvalue: ""
  display: API key
  name: api_key
  required: true
  type: 4
- display: Fetch incidents
  name: is_fetch
  type: 8
  required: false
- additionalinfo: Whether to use the system proxy.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Whether to accept insecure certificates.
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- additionalinfo: Initial time to start fetching mitigations.
  defaultvalue: 3 days
  display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is "3 days"
  name: first_fetch
  type: 0
  required: false
description: Cymptom is a Breach and Attack Simulation solution that revolutionizes the existing approach by transforming attack simulation into a data analysis question. Cymptom agentless scanning brings real-time always-on visibility into the entire security posture.
display: Cymptom
name: Cymptom
script:
  commands:
  - arguments:
    - default: true
      defaultValue: "60"
      description: Timeout for operation.
      name: timeout
    description: This command returns mitigations recommended by Cymptom
    name: cymptom-get-mitigations
    outputs:
    - contextPath: Cymptom.Mitigations.SeverityType
      description: The severity of the mitigation
      type: String
    - contextPath: Cymptom.Mitigations.Name
      description: The name of the mitigation
      type: String
    - contextPath: Cymptom.Mitigations.AttackVectorsUsedPercentage
      description: The percentege of attack vectors used that can be mitigated
      type: String
    - contextPath: Cymptom.Mitigations.ID
      description: The mitigation's ID
      type: String
    - contextPath: Cymptom.Mitigations.AttackVectorsCount
      description: The attack vectors counts that can be mitigated
      type: number
    - contextPath: Cymptom.Mitigations.Procedures
      description: Procedures relevant for this mitigation
      type: unknown
    - contextPath: Cymptom.Mitigations.Techniques
      description: Techniques relevant for this mitigation
      type: unknown
    - contextPath: Cymptom.Mitigations.SubTechniques
      description: Sub Techniques relevant for this mitigation
      type: String
    - contextPath: Cymptom.Mitigations.References
      description: References relevant for this mitigation
      type: String
  - arguments:
    - defaultValue: "60"
      description: Timeout for operation.
      name: timeout
    - default: true
      defaultValue: "True"
      description: Return only privileged (Domaind Admin or Local Admin) or unprivileged users.
      name: privileged
    description: This command returns users with cracked password
    name: cymptom-get-users-with-cracked-passwords
    outputs:
    - contextPath: Cymptom.CrackedUsers.Username
      description: Username of users with cracked passwords
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- No tests