ExtrahopRevealXEventCollector

Details

ID	`ExtrahopRevealXEventCollector`
Provider	Bain Capital Private Equity
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

ExtraHop Reveal(x) is a network detection and response solution that provides complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response.

This integration works with ExtraHop firmware version greater than or equal to 9.3.0

Configure an instance for ExtraHop Reveal(x)

How to create REST API Credentials

You must have system and access administration privileges.

Log in to RevealX 360.
Click the System Settings icon - at the top right of the page and then click All Administration.
Click API Access.
Click Create Credentials.
In the Name field, type a name for the credentials.
In the Privileges field, specify a privilege level for the credentials. The privilege level determines which actions can be performed with the credential. Do not grant more privileges to REST API credentials than needed because it can create a security risk. For example, applications that only retrieve metrics should not be granted credentials that grant administrative privileges. For more information about each privilege level, see User privileges.

Note: System and Access Administration privileges are similar to Full write privileges and allow the credentials to connect sensors and Trace appliances to RevealX 360.*

In the Packet Access field, specify whether you can retrieve packets and session keys with the credentials.
Click Save. The Copy REST API Credentials pane appears.
Under ID, click Copy to Clipboard and save the ID to your local machine.
Under Secret, click Copy to Clipboard and save the secret to your local machine.
Click Done.

Configure ExtraHop Reveal(x) in Cortex

Parameter	Description	Required
Your server URL		True
Client Id	The client ID generated on your ExtraHop system that is required for authentication if connecting to ExtraHop Reveal(x) 360.	True
Client Secret	The client secret generated on your ExtraHop system that is required for authentication if connecting to ExtraHop Reveal(x) 360.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch events		False
Maximum number of events per fetch	Defines the maximum number of audits events per fetch cycle. Default value: 25000.	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

revealx-get-events

Retrieves a list of audit logs events from the Extrahop RevealX instance.

Base Command

revealx-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to true in order to create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
max_events	Returns no more than the specified number of detections.	Optional

Context Output

There is no context output for this command.

Configuration parameters

server_url — Server URL (required)
credentials — Client ID (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch events
max_events_per_fetch — Maximum number of events per fetch

Commands (1)

revealx-get-events
Retrieves a list of audit logs events from the Extrahop RevealX instance.

Source

ExtrahopRevealXEventCollector.py ExtrahopRevealXEventCollector_test.py ExtrahopRevealXEventCollector.yml ExtrahopRevealXEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Bain Capital Private Equity
sectionorder:
- Connect
- Collect
commonfields:
  id: ExtrahopRevealXEventCollector
  version: -1
configuration:
- display: Server URL
  name: server_url
  required: true
  type: 0
  section: Connect
- additionalinfo: The Client Credentials (ID, Secret) generated on your ExtraHop system that is required for authentication if connecting to ExtraHop Reveal(x) 360.
  displaypassword: Client Secret
  display: Client ID
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Collect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Collect
  advanced: true
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  hidden:
  - xsoar
  defaultvalue: "true"
- additionalinfo: 'Defines the maximum number of audits events per fetch cycle. Default value: 25000.'
  defaultvalue: "25000"
  display: Maximum number of events per fetch
  name: max_events_per_fetch
  required: false
  type: 0
  section: Collect
  advanced: true
description: ExtraHop Reveal(x) is a network detection and response solution that provides complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response.
display: ExtraHop Reveal(x) Event Collector
name: ExtrahopRevealXEventCollector
supportlevelheader: xsoar
script:
  commands:
  - name: revealx-get-events
    description: Retrieves a list of audit logs events from the Extrahop RevealX instance.
    arguments:
      - auto: PREDEFINED
        defaultValue: 'false'
        description: Set this argument to true in order to create events, otherwise it will only display them.
        name: should_push_events
        predefined:
          - 'true'
          - 'false'
        required: true
      - description: Returns no more than the specified number of detections.
        name: limit
        required: false
      - description: "The UTC date or relative timestamp from where to start fetching incidents
                      Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ."
        name: first_fetch
        required: false
  isfetch: false
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam