cymulate_v3

This integration fetches findings from completed Cymulate assessments as Cortex XSOAR incidents using the V2 Assessment API.

Deception & Breach Simulation · Cymulate

Details

ID	`cymulate_v3`
Provider	Cymulate
Category	Deception & Breach Simulation
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This integration fetches findings from completed Cymulate assessments as Cortex XSOAR incidents using the Cymulate V2 Assessment API.

Configure Cymulate v3 in Cortex

Parameter	Description	Required
API token	Cymulate API token used for authentication (sent as `x-token`).	True
Base URL	Cymulate API base URL (for example: `https://api.app.cymulate.com`).	True
Trust any certificate (not secure)	If checked, SSL certificate verification is disabled.	False
Use system proxy settings	Use the system proxy settings for HTTP/S requests.	False
Fetch incidents	When enabled, fetches Cymulate assessment findings as Cortex XSOAR incidents.	False
Fetch category	All fetches all “Not Prevented” findings. Threat Feed IOCs fetches only findings tagged as Threat Feed IOC. Default: All.	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	First time to fetch incidents from.	False
Max Fetch	Maximum number of incidents to return per fetch run. Default: 25.	False
Incident type		False

Commands

This integration does not expose additional commands. It operates exclusively through the fetch-incidents mechanism — findings from completed Cymulate assessments are automatically ingested as Cortex XSOAR incidents on each fetch cycle.

Additional Information

Only findings with status “Not Prevented” are ingested as incidents.
The Fetch category parameter allows filtering to only Threat Feed IOC tagged findings.
Fetching is cursor-based and resumable: if a large assessment exceeds Max Fetch in a single run, the next run continues from exactly where it stopped — no duplicate incidents and no re-processing.
The integration includes transient error handling for network issues, ensuring stable ingestion even under temporary connectivity problems.

Configuration parameters

credentials — API token (required)
base_url — Base URL (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
fetch_category — Fetch category
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — Max Fetch
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (0)

This integration defines no commands.

Source

CymulateV3.py CymulateV3_test.py CymulateV3.yml CymulateV3_description.md

Download History Raw

category: Deception & Breach Simulation
provider: Cymulate
sectionorder:
- Connect
- Collect
commonfields:
  id: cymulate_v3
  version: -1
configuration:
- name: credentials
  displaypassword: API token
  display: API token
  type: 9
  hiddenusername: true
  required: true
  section: Connect
- name: base_url
  defaultvalue: https://api.app.cymulate.com/
  display: Base URL
  type: 0
  required: true
  section: Connect
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  required: false
  section: Connect
- name: proxy
  display: Use system proxy settings
  type: 8
  required: false
  section: Connect
- name: isFetch
  display: Fetch incidents
  type: 8
  required: false
  section: Collect
- name: fetch_category
  additionalinfo: Select which findings to fetch. "All" fetches all Not Prevented findings. "Threat Feed IOCs" fetches only findings tagged as Threat Feed IOC.
  display: Fetch category
  options:
  - All
  - Threat Feed IOCs
  type: 15
  required: false
  defaultvalue: All
  section: Collect
- name: first_fetch
  defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  type: 0
  required: false
  section: Collect
- name: max_fetch
  additionalinfo: Maximum number of incidents to return per fetch run. Maximun 100. Default 25.
  defaultvalue: "25"
  display: Max Fetch
  type: 0
  required: false
  section: Collect
- display: Incident type
  defaultvalue: Cymulate Assessment Findings
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
description: This integration fetches findings from completed Cymulate assessments as Cortex XSOAR incidents using the V2 Assessment API.
display: Cymulate v3
defaultmapperin: Cymulate Assessment Findings - Incoming Mapper
name: cymulate_v3
script:
  commands: []
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: "-"
  subtype: python3
  type: python
tests:
- No test
fromversion: 6.10.0