cymulate_v3

This integration fetches findings from completed Cymulate assessments as Cortex XSOAR incidents using the V2 Assessment API.

Deception & Breach Simulation · Cymulate

Details

IDcymulate_v3
ProviderCymulate
CategoryDeception & Breach Simulation
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

This integration fetches findings from completed Cymulate assessments as Cortex XSOAR incidents using the Cymulate V2 Assessment API.

Configure Cymulate v3 in Cortex

Parameter Description Required
API token Cymulate API token used for authentication (sent as x-token). True
Base URL Cymulate API base URL (for example: https://api.app.cymulate.com). True
Trust any certificate (not secure) If checked, SSL certificate verification is disabled. False
Use system proxy settings Use the system proxy settings for HTTP/S requests. False
Fetch incidents When enabled, fetches Cymulate assessment findings as Cortex XSOAR incidents. False
Fetch category All fetches all “Not Prevented” findings. Threat Feed IOCs fetches only findings tagged as Threat Feed IOC. Default: All. False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) First time to fetch incidents from. False
Max Fetch Maximum number of incidents to return per fetch run. Default: 25. False
Incident type   False

Commands

This integration does not expose additional commands. It operates exclusively through the fetch-incidents mechanism — findings from completed Cymulate assessments are automatically ingested as Cortex XSOAR incidents on each fetch cycle.

Additional Information

  • Only findings with status “Not Prevented” are ingested as incidents.
  • The Fetch category parameter allows filtering to only Threat Feed IOC tagged findings.
  • Fetching is cursor-based and resumable: if a large assessment exceeds Max Fetch in a single run, the next run continues from exactly where it stopped — no duplicate incidents and no re-processing.
  • The integration includes transient error handling for network issues, ensuring stable ingestion even under temporary connectivity problems.

Configuration parameters

  • credentials — API token (required)
  • base_url — Base URL (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • fetch_category — Fetch category
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Max Fetch
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (0)

This integration defines no commands.

Source

CymulateV3.py CymulateV3_test.py CymulateV3.yml CymulateV3_description.md
Download History Raw 
## Cymulate v3 Integration

Cymulate is a Multi-Vector Cyber Attack, Breach and Attack Simulation (BAS) platform that continuously validates security posture by simulating real-world threats across multiple security controls.

This integration fetches findings from completed Cymulate assessments as Cortex XSOAR incidents using the V2 Assessment API.

### How It Works

1. The integration periodically queries the Cymulate V2 API for completed assessments.
2. For each new assessment, it retrieves all findings.
3. Only findings with status **"Not Prevented"** are created as XSOAR incidents.
4. The **Fetch category** parameter allows filtering to only **Threat Feed IOC** tagged findings.

### Obtaining Your API Key

To generate an API key from your Cymulate instance:

1. Connect to your Cymulate instance.
2. Go to your **profile** &gt; **Settings** &gt; **Cymulate API**.
3. Click **Add API key** button.
4. Give the API key a name.
5. Enable the required API endpoints:
   - `GET /v2/assessments/launched`
   - `GET /v2/assessments/launched/{id}/findings`
6. Copy the generated API key.

### Configuration Parameters

| **Parameter** | **Description** | **Required** |
| --- | --- | --- |
| API token | Cymulate API token used for authentication (sent as `x-token`). | True |
| Base URL | Cymulate API base URL (for example: `https://api.app.cymulate.com`). | True |
| Fetch incidents | When enabled, fetches Cymulate assessment findings as Cortex XSOAR incidents. | False |
| Fetch category | **All** fetches all "Not Prevented" findings. **Threat Feed IOCs** fetches only findings tagged as Threat Feed IOC. Default: All. | False |
| First fetch timestamp | First time to fetch incidents from (e.g., `12 hours`, `7 days`). | False |
| Max Fetch | Maximum number of incidents to return per fetch run. Default: 200. | False |
| Trust any certificate (not secure) | If checked, SSL certificate verification is disabled. | False |
| Use system proxy settings | Use the system proxy settings for HTTP/S requests. | False |