Cymptom

Details

ID	`Cymptom`
Provider	Tenable
Category	Vulnerability Management
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Cymptom is a Breach and Attack Simulation solution that revolutionizes the existing approach by transforming attack simulation into a data analysis question. Cymptom agentless scanning brings real-time always-on visibility into the entire security posture.
This integration was integrated and tested with version 0.3.4 of Cymptom.

Configure Cymptom in Cortex

Parameter	Description	Required
url	Management URL (for ex: `https://customer_name.cymptom.com/api/`)	True
api_key	API key	True
is_fetch	Fetch incidents	False
proxy	Use system proxy settings	False
insecure	Trust any certificate (not secure)	False
first_fetch	First fetch time range (`<number> <time unit>`, e.g., 1 hour, 30 minutes). Default is “3 days”	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cymptom-get-mitigations

This command returns mitigations recommended by Cymptom

Base Command

cymptom-get-mitigations

Input

Argument Name	Description	Required
timeout	Timeout for operation. Default is 60.	Optional

Context Output

Path	Type	Description
Cymptom.Mitigations.SeverityType	String	The severity of the mitigation
Cymptom.Mitigations.Name	String	The name of the mitigation
Cymptom.Mitigations.AttackVectorsUsedPercentage	String	The percentage of attack vectors used that can be mitigated
Cymptom.Mitigations.ID	String	The mitigation’s ID
Cymptom.Mitigations.AttackVectorsCount	number	The attack vectors counts that can be mitigated
Cymptom.Mitigations.Techniques	unknown	Techniques relevant for this mitigation

Command Example

!cymptom-get-mitigations

Human Readable Output

Mitigations

ID	Name	Severity Type	Attack Vectors Use Percentage	Attack Vectors Count	Techniques
3936	Steal or Forge Kerberos Tickets	Critical	21.16	299	Encrypt Sensitive Information, Privileged Account Management, Active Directory Configuration, Password Policies

cymptom-get-users-with-cracked-passwords

This command returns users with cracked password

Input

Argument Name	Description	Required
timeout	Timeout for operation. Default is 60.	Optional
privileged	Return only privileged (Domain Admin or Local Admin) or unprivileged users. Default is True.	Optional

Context Output

Path	Type	Description
Cymptom.CrackedUsers.Username	String	Username of users with cracked passwords

Context Example

[
    {'Username':'cymptom'},
    {'Username':'chen'}
]

Command Example

!cymptom-get-users-with-cracked-passwords privileged=False

Human Readable Output

Unprivileged Users With Cracked Passwords

Username
user1
user2

Configuration parameters

url — Management URL. for example https://customerName.cymptom.com/api/) (required)
api_key — API key (required)
is_fetch — Fetch incidents
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
first_fetch — First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is "3 days"

Commands (2)

cymptom-get-mitigations
This command returns mitigations recommended by Cymptom
cymptom-get-users-with-cracked-passwords
This command returns users with cracked password

Source

Cymptom.py Cymptom_test.py Cymptom.yml Cymptom_description.md command_examples.txt

Download History Raw

## How to configure the integration?
In Cymptom's UI, go to "Settings" -> "User management", find your username and press on actions "Get API Token".

Copy your key into XSOAR's Cymptom "API key" field in the integration panel.


[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/cymptom)