Digital Defense FrontlineVM

Details

ID	`Digital Defense FrontlineVM`
Provider	Fortra
Category	Vulnerability Management
From Version	5.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Use the Digital Defense Frontline VM to identify and evaluate the security and business risks of network devices and applications deployed as premise, cloud, or hybrid network-based implementations.
This integration was integrated and tested with version 6.2.4 of Digital Defense FrontlineVM

Configure Digital Defense FrontlineVM in Cortex

Parameter	Description	Required
frontlineURL	Frontline VM URL	True
insecure	Trust any certificate (not secure)	False
apiToken	API Token to access Frontline VM	True
isFetch	Fetch incidents	False
incidentType	Incident type	False
incidentSeverity	Minimum vulnerability severity for fetching incidents	False
incidentFrequency	Rate at which to check vulnerability events when fetching incidents	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

frontline-get-assets

Retrieves the asset’s information from Frontline VM.

Base Command

frontline-get-assets

Input

Argument Name	Description	Required
ip_address	The IP address for which to return assets.	Optional
label_name	The label name for which to return assets.	Optional
max_days_since_scan	The number of days (retroactive) since the last scan.	Optional
hostname	The hostname for which to return assets.	Optional

Context Output

Path	Type	Description
FrontlineVM.Hosts	unknown	The host data from Frontline.Cloud.
FrontlineVM.Hosts.ID	unknown	The ID number of the host.
FrontlineVM.Hosts.Hostname	unknown	The hostname of the asset.
FrontlineVM.Hosts.IP	unknown	The IP address of the host.
FrontlineVM.Hosts.DNSHostname	unknown	The DNS hostname of the host.
FrontlineVM.Hosts.MAC	unknown	The MAC address of the host.
FrontlineVM.Hosts.OS	unknown	The operating system of the host.
FrontlineVM.Hosts.OSType	unknown	The operating system type of the host.
FrontlineVM.Hosts.CriticalVulnCount	unknown	The severity count of critical vulnerabilities.

Command Example


#### Human Readable Output

### frontline-get-vulns

***
Retrieves vulnerability information from Frontline VM.

#### Base Command

`frontline-get-vulns`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| min_severity | The minimum severity level for which to return vulnerabilities. This argument overrides the "severity" argument when used together. Can be: "critical","high","medium","low","trivial", or "info". | Optional |
| severity | Returns all vulnerabilities from Frontline with the specified severity level. Can be: "critical","high","medium","low","trivial", or "info". | Optional |
| max_days_since_created | Retrieves vulnerabilities found prior to the specified date (in days). | Optional |
| min_days_since_created | Retrieves vulnerabilities found after the specified date (in days). | Optional |
| host_id | Retrieves vulnerabilities from a specific host based on the Host ID. | Optional |
| ip_address | The IP address of the host for which to retrieve the vulnerability data. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| FrontlineVM.Vulns | unknown | Retrieved vulnerability data pulled from Frontline.Cloud. |
| FrontlineVM.Stat | unknown | The statistical overview of vulnerabilities pulled. |
| FrontlineVM.Vulns.vuln-id | unknown | The ID of the vulnerability. |
| FrontlineVM.Vulns.hostname | unknown | The hostname of the asset. |
| FrontlineVM.Vulns.ip-address | unknown | The IP address of the asset. |
| FrontlineVM.Vulns.vuln-title | unknown | The title of the vulnerability. |
| FrontlineVM.Vulns.date-created | unknown | The date the vulnerability was created. |
| FrontlineVM.Vulns.ddi-severity | unknown | The severity level of the vulnerability. |
| FrontlineVM.Vulns.vuln-info | unknown | Information related to the vulnerability. |

#### Command Example

Human Readable Output

frontline-scan-asset

Performs a scan on the specified asset.

Base Command

frontline-scan-asset

Input

Argument Name	Description	Required
ip_address	The IP address of the asset to scan.	Optional
scan_policy	The policy of the scan (case sensitive).	Optional
ip_range_start	The IP address start range of the asset to scan.	Optional
ip_range_end	The IP address end range of the asset to scan.	Optional
scan_name	The name of this scan to run in FrontlineVM. Default value will be “Cortex XSOAR Scan [<asset_ip_address>]”	Optional

Context Output

Path	Type	Description
FrontlineVM.Scan.ID	unknown	The ID number of the scan.
FrontlineVM.Scan.Name	unknown	The name of the scan.
FrontlineVM.Scan.Policy	unknown	The policy name of the scan.
FrontlineVM.Scan.IP	unknown	The IP address of the scan (can be a single IP address or a range of IP addresses).

Command Example

``````

Human Readable Output

Configuration parameters

frontlineURL — Frontline VM URL (required)
insecure — Trust any certificate (not secure)
apiToken — API Token to access Frontline VM (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
incidentSeverity — Minimum vulnerability severity for fetching incidents
incidentFrequency — Rate at which to check vulnerability events when fetching incidents (required)

Commands (3)

frontline-get-assets
Retrieves the asset's information from Frontline VM.
frontline-get-vulns
Retrieves vulnerability information from Frontline VM.
frontline-scan-asset
Performs a scan on the specified asset.

Source

.vulture_whitelist.py Digital_Defense_FrontlineVM.py Digital_Defense_FrontlineVM.yml Digital_Defense_FrontlineVM_description.md

Download History Raw

commonfields:
  id: Digital Defense FrontlineVM
  version: -1
name: Digital Defense FrontlineVM
display: Digital Defense FrontlineVM
category: Vulnerability Management
sectionorder:
- Connect
- Collect
provider: Fortra
description: Use the Digital Defense FrontlineVM to identify and evaluate the security and business risks of network devices and applications deployed as premise, cloud, or hybrid network-based implementations.
configuration:
- display: Frontline VM URL
  name: frontlineURL
  defaultvalue: https://vm.frontline.cloud
  type: 0
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: API Token to access Frontline VM
  name: apiToken
  defaultvalue: ""
  type: 4
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Minimum vulnerability severity for fetching incidents
  name: incidentSeverity
  defaultvalue: medium
  type: 15
  options:
  - critical
  - high
  - medium
  - low
  - trivial
  - info
  required: false
  section: Collect
- display: Rate at which to check vulnerability events when fetching incidents
  name: incidentFrequency
  defaultvalue: 3 hr
  type: 15
  required: true
  options:
  - 5 min
  - 15 min
  - 30 min
  - 1 hr
  - 3 hr
  - 8 hr
  - 12 hr
  - 24 hr
  section: Collect
script:
  script: ''
  type: python
  commands:
  - name: frontline-get-assets
    arguments:
    - name: ip_address
      description: The IP address for which to return assets.
    - name: label_name
      description: The label name for which to return assets.
    - name: max_days_since_scan
      description: The number of days (retroactive) since the last scan.
    - name: hostname
      description: The hostname for which to return assets.
    outputs:
    - contextPath: FrontlineVM.Hosts
      description: The host data from Frontline.Cloud.
      type: unknown
    - contextPath: FrontlineVM.Hosts.ID
      description: The ID number of the host.
    - contextPath: FrontlineVM.Hosts.Hostname
      description: The hostname of the asset.
    - contextPath: FrontlineVM.Hosts.IP
      description: The IP address of the host.
    - contextPath: FrontlineVM.Hosts.DNSHostname
      description: The DNS hostname of the host.
    - contextPath: FrontlineVM.Hosts.MAC
      description: The MAC address of the host.
    - contextPath: FrontlineVM.Hosts.OS
      description: The operating system of the host.
    - contextPath: FrontlineVM.Hosts.OSType
      description: The operating system type of the host.
    - contextPath: FrontlineVM.Hosts.CriticalVulnCount
      description: The severity count of critical vulnerabilities.
    description: Retrieves the asset's information from Frontline VM.
  - name: frontline-get-vulns
    arguments:
    - name: min_severity
      auto: PREDEFINED
      predefined:
      - critical
      - high
      - medium
      - low
      - trivial
      - info
      description: 'The minimum severity level for which to return vulnerabilities. This argument overrides the "severity" argument when used together. Can be: "critical","high","medium","low","trivial", or "info".'
    - name: severity
      auto: PREDEFINED
      predefined:
      - critical
      - high
      - medium
      - low
      - trivial
      - info
      description: 'Returns all vulnerabilities from Frontline with the specified severity level. Can be: "critical","high","medium","low","trivial", or "info".'
    - name: max_days_since_created
      description: Retrieves vulnerabilities found prior to the specified date (in days).
    - name: min_days_since_created
      description: Retrieves vulnerabilities found after the specified date (in days).
    - name: host_id
      description: Retrieves vulnerabilities from a specific host based on the Host ID.
    - name: ip_address
      description: The IP address of the host for which to retrieve the vulnerability data.
    outputs:
    - contextPath: FrontlineVM.Vulns
      description: Retrieved vulnerability data pulled from Frontline.Cloud.
      type: unknown
    - contextPath: FrontlineVM.Stat
      description: The statistical overview of vulnerabilities pulled.
    - contextPath: FrontlineVM.Vulns.vuln-id
      description: The ID of the vulnerability.
    - contextPath: FrontlineVM.Vulns.hostname
      description: The hostname of the asset.
    - contextPath: FrontlineVM.Vulns.ip-address
      description: The IP address of the asset.
    - contextPath: FrontlineVM.Vulns.vuln-title
      description: The title of the vulnerability.
    - contextPath: FrontlineVM.Vulns.date-created
      description: The date the vulnerability was created.
    - contextPath: FrontlineVM.Vulns.ddi-severity
      description: The severity level of the vulnerability.
    - contextPath: FrontlineVM.Vulns.vuln-info
      description: Information related to the vulnerability.
    description: Retrieves vulnerability information from Frontline VM.
  - name: frontline-scan-asset
    arguments:
    - name: ip_address
      description: The IP address of the asset to scan.
    - name: scan_policy
      description: The policy of the scan (case sensitive).
      defaultValue: Default
    - name: ip_range_start
      description: The IP address start range of the asset to scan.
    - name: ip_range_end
      description: The IP address end range of the asset to scan.
    - name: scan_name
      description: A unique name for the scan to run in FrontlineVM. Default value will be "Cortex XSOAR Scan [<asset_ip_address>]. Limited to 100 characters."
    outputs:
    - contextPath: FrontlineVM.Scan.ID
      description: The ID number of the scan.
    - contextPath: FrontlineVM.Scan.Name
      description: The name of the scan.
    - contextPath: FrontlineVM.Scan.Policy
      description: The policy name of the scan.
    - contextPath: FrontlineVM.Scan.IP
      description: The IP address of the scan (can be a single IP address or a range of IP addresses).
    description: Performs a scan on the specified asset.
  dockerimage: demisto/python3:3.12.8.3296088
  isfetch: true
  subtype: python3
fromversion: 5.0.0
tests:
- No tests (auto formatted)