Exterro FTK

Details

ID	`Exterro FTK`
Provider	Exterro
Category	Forensics & Malware Analysis
From Version	6.2.0
Docker Image	`demisto/accessdata:1.1.0.10133006`
Supported Modules	Agentix XSIAM

README

Use the Exterro package to integrate with the Exterro FTK platform enabling the automation of case/evidence management and endpoint collection.

Documentation for the integration was provided by FTK Connect.

Configure Exterro in Cortex

Parameter	Description	Example
Name	A meaningful name for the integration instance.	FTKC Instance
Web Protocol	Protocol used in the FTKC server	https (or) https
Service URL	The URL to the FTKC server, including the scheme.	FQDN or IP address in X.X.X.X format with scheme specified.
Service Listening Port	The Port to the FTKC server.	4443
The API authentication key	A piece of data that servers use to verify for authenticity	eea810f5-a6f6
The path to the public certificate required to authenticate	When selected, certificates are not checked.	N/A

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Trigger Automation Workflow in FTK Connect

Triggers the automation job and returns a string.

Base Command

exterro-ftk-trigger-workflow

Input

Argument Name	Description	Required
automation_id	The Id of the automation workflow.	Required
case_name	The name of the case.	Optional
case_ids	Value of caseids.	Optional
evidence_path	The filepath of the evidence.	Optional
target_ips	Targetips for the collection.	Optional
search_tag_path	The filepath of the search and tag.	Optional
export_path	The path to export files.	Optional

Context Output

Path	Type	Description
ExterroFTK.Workflow.Status	string	The Status of the automation workflow trigger.

Command Example

If automation workflow Id 232 is designed for Agent Memory collection in FTK Connect, then below command can be used to trigger the automation job from cortex xsoar.

exterro-ftk-trigger-workflow automation_id=232 target_ips=X.X.X.X

Command Example

If automation workflow Id 233 is designed to create new case, add and process the evidence from provided path in FTK Connect, then below command can be used to trigger the automation job from cortex xsoar.

exterro-ftk-trigger-workflow automation_id=233 case_name="Test case_name" evidence_path="\\X.X.X.X\ProjectData\Evidences\AR"

Context Example

{
    ExterroFTK.Workflow
    {
        'Status': True
    }
}

Human Readable Output

True

Configuration parameters

protocol — Web Protocol (required)
server — Service URL (FQDN or IP Address.) (required)
port — Service Listening Port (required)
apikey — The API authentication key. http://support.accessdata.com/hc/en-us/articles/360053994573-Generating-API-Keys (required)
public_cert — The path to the public certificate required to authenticate.

Commands (1)

exterro-ftk-trigger-workflow
Returns a boolean value.

Source

Exterro.py Exterro_test.py Exterro.yml Exterro_description.md command_examples.txt

Download History Raw

# python 3.9 imports
from json import JSONDecodeError
from traceback import format_exc

import demistomock as demisto  # noqa: F401

# accessdata imports
from accessdata.client import Client
from CommonServerPython import *  # noqa: F401

# xsoar imports
from CommonServerUserPython import *


def _trigger_workflow(client, **kwargs):
    result = client.connect.trigger(**kwargs)
    if result.get("Status") is not True:
        raise ValueError("Failed to trigger automation workflow.", result.get("Status"))

    return CommandResults(outputs_prefix="Accessdata.Workflow", outputs_key_field="Status", outputs=result)


def _test_module(client):  # pragma: no cover
    # test the client can reach the case list
    try:
        client.cases  # noqa: B018
    except JSONDecodeError as exc:
        raise RuntimeError("False API key provided to FTK Connect.", exc)
    except DemistoException as exc:
        raise RuntimeError("Authentication with FTK Connect failed.", exc)

    return "ok"


def main():  # pragma: no cover
    # gather parameters
    params = demisto.params()

    # generate client arguments
    protocol = params.get("protocol", "http")
    port = params.get("port", "4443")
    address = params.get("server", "localhost")
    url = f"{protocol}://{address}:{port}/"
    apikey = params.get("apikey", "")
    # check if using ssl
    is_secure = protocol[-1] == "s"

    # build client
    client = Client(url, apikey, validate=not is_secure)
    # if using ssl, gather certs and apply
    if is_secure:
        public_certificate = params.get("public_cert", None)
        client.session.cert = public_certificate

    try:
        # call function with supplied args
        command = demisto.command()
        args = demisto.args()
        if args.get("case_ids") is not None:
            args["case_ids"] = argToList(args.get("case_ids"))
        if args.get("target_ips") is not None:
            args["target_ips"] = argToList(args.get("target_ips"))
        if command == "exterro-ftk-trigger-workflow":
            return_results(_trigger_workflow(client, **args))
        if command == "test-module":
            return_results(_test_module(client))
    except Exception as exception:
        demisto.error(format_exc())  # print the traceback
        return_error(f"Failed to execute {demisto.command()} command.\nError:\n{exception!s}")


""" Entry Point """

if __name__ in ("__main__", "__builtin__", "builtins"):
    main()