Details

ID	`Digital Guardian`
Provider	Fortra
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Digital Guardian ARC Watchlist Integration

This integration was integrated and tested with version 2.11.0 of Digital Guardian ARC

Configure Digital Guardian in Cortex

Parameter	Description	Required
auth_url	auth_url	True
arc_url	arc_url	True
insecure	Allow Insecure HTTPS	False
client_id	client_id	True
client_secret	client_secret	True
export_profile	export_profile	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

digitalguardian-add-watchlist-entry

Add Watchlist Entry

Base Command

digitalguardian-add-watchlist-entry

Input

Argument Name	Description	Required
watchlist_name	Watchlist Name	Required
watchlist_entry	Watchlist Entry	Required

Context Output

There is no context output for this command.

Command Example

!digitalguardian-add-watchlist-entry watchlist_entry=playbook_test watchlist_name=atac_test

Context Example

{}

Human Readable Output

added watchlist entry (playbook_test) to watchlist name (atac_test)

digitalguardian-check-watchlist-entry

Check Watchlist Entry

Base Command

digitalguardian-check-watchlist-entry

Input

Argument Name	Description	Required
watchlist_name	Watchlist Name	Required
watchlist_entry	Watchlist Entry	Required

Context Output

Path	Type	Description
DigitalGuardian.Watchlist.Found	boolean	Watchlist Found

Command Example

!digitalguardian-check-watchlist-entry watchlist_entry=playbook_test watchlist_name=atac_test

Context Example

{
    "DigitalGuardian": {
        "Watchlist": {
            "Found": true
        }
    }
}

Human Readable Output

Watchlist found

digitalguardian-remove-watchlist-entry

Remove Watchlist Entry

Base Command

digitalguardian-remove-watchlist-entry

Input

Argument Name	Description	Required
watchlist_name	Watchlist Name	Required
watchlist_entry	Watchlist Entry	Optional

Context Output

There is no context output for this command.

Command Example

!digitalguardian-remove-watchlist-entry watchlist_entry=playbook_test watchlist_name=atac_test

Context Example

{}

Human Readable Output

removed watchlist entry (playbook_test) from watchlist name (atac_test)

digitalguardian-add-componentlist-entry

Add Componentlist Entry

Base Command

digitalguardian-add-componentlist-entry

Input

Argument Name	Description	Required
componentlist_name	Componentlist Name	Required
componentlist_entry	Componentlist Entry	Required

Context Output

There is no context output for this command.

Command Example

!digitalguardian-add-componentlist-entry componentlist_entry=email@example.com componentlist_name="Test - JLL - Email Address Blacklist"

Context Example

{}

Human Readable Output

added componentlist entry (email@example.com) to componentlist name (Test - JLL - Email Address Blacklist)

digitalguardian-check-componentlist-entry

Check Componentlist Entry

Base Command

digitalguardian-check-componentlist-entry

Input

Argument Name	Description	Required
componentlist_name	Componentlist Name	Required
componentlist_entry	Componentlist Entry	Required

Context Output

Path	Type	Description
DigitalGuardian.Componentlist.Found	boolean	Componentlist Found

Command Example

!digitalguardian-check-componentlist-entry componentlist_entry=email@example.com componentlist_name="Test - JLL - Email Address Blacklist"

Context Example

{
    "DigitalGuardian": {
        "Componentlist": {
            "Found": true
        }
    }
}

Human Readable Output

Componentlist found

digitalguardian-remove-componentlist-entry

Remove Componentlist Entry

Base Command

digitalguardian-remove-componentlist-entry

Input

Argument Name	Description	Required
componentlist_name	Componentlist Name	Required
componentlist_entry	Componentlist Entry	Required

Context Output

There is no context output for this command.

Command Example

!digitalguardian-remove-componentlist-entry componentlist_entry=email@example.com componentlist_name="Test - JLL - Email Address Blacklist"

Context Example

{}

Human Readable Output

removed componentlist entry (email@example.com) from componentlist name (Test - JLL - Email Address Blacklist)

Configuration parameters

auth_url — Auth Server URL (required)
arc_url — Gateway Base URL (required)
client_id — API Client ID (required)
client_secret — API Client Secret (required)
export_profile — Export Profile (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (6)

digitalguardian-add-componentlist-entry
Add Componentlist Entry.
digitalguardian-add-watchlist-entry
Add Watchlist Entry.
digitalguardian-check-componentlist-entry
Check Componentlist Entry.
digitalguardian-check-watchlist-entry
Check Watchlist Entry.
digitalguardian-remove-componentlist-entry
Remove Componentlist Entry.
digitalguardian-remove-watchlist-entry
Remove Watchlist Entry.

Source

DigitalGuardian.py DigitalGuardian_test.py DigitalGuardian.yml DigitalGuardian_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Fortra
sectionorder:
- Connect
- Collect
commonfields:
  id: Digital Guardian
  version: -1
configuration:
- display: Auth Server URL
  name: auth_url
  required: true
  type: 0
  section: Connect
- display: Gateway Base URL
  name: arc_url
  required: true
  type: 0
  section: Connect
- display: API Client ID
  name: client_id
  required: true
  type: 0
  section: Connect
- display: API Client Secret
  name: client_secret
  required: true
  type: 4
  section: Connect
- display: Export Profile
  name: export_profile
  required: true
  type: 0
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Use Digital Guardian Integration to fetch incidents and to programmatically add or remove entries from watchlists and component lists.
display: Digital Guardian
name: Digital Guardian
script:
  commands:
  - arguments:
    - description: Watchlist Name.
      name: watchlist_name
      required: true
    - description: Watchlist Entry.
      name: watchlist_entry
      required: true
    description: Add Watchlist Entry.
    name: digitalguardian-add-watchlist-entry
  - arguments:
    - description: Watchlist Name.
      name: watchlist_name
      required: true
    - description: Watchlist Entry.
      name: watchlist_entry
      required: true
    description: Check Watchlist Entry.
    name: digitalguardian-check-watchlist-entry
    outputs:
    - contextPath: DigitalGuardian.Watchlist.Found
      description: Watchlist Found.
      type: boolean
  - arguments:
    - description: Watchlist Name.
      name: watchlist_name
      required: true
    - description: Watchlist Entry.
      name: watchlist_entry
    description: Remove Watchlist Entry.
    name: digitalguardian-remove-watchlist-entry
  - arguments:
    - description: Componentlist Name.
      name: componentlist_name
      required: true
    - description: Componentlist Entry.
      name: componentlist_entry
      required: true
    description: Add Componentlist Entry.
    name: digitalguardian-add-componentlist-entry
  - arguments:
    - description: Componentlist Name.
      name: componentlist_name
      required: true
    - description: Componentlist Entry.
      name: componentlist_entry
      required: true
    description: Check Componentlist Entry.
    name: digitalguardian-check-componentlist-entry
    outputs:
    - contextPath: DigitalGuardian.Componentlist.Found
      description: Componentlist Found.
      type: boolean
  - arguments:
    - description: Componentlist Name.
      name: componentlist_name
      required: true
    - description: Componentlist Entry.
      name: componentlist_entry
      required: true
    description: Remove Componentlist Entry.
    name: digitalguardian-remove-componentlist-entry
  dockerimage: demisto/python3:3.12.8.3296088
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- No tests (auto formatted)