FireMonSecurityManager

Details

ID	`FireMonSecurityManager`
Provider	FireMon
Category	Authentication & Identity Management
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

FireMon Security Manager delivers comprehensive rule lifecycle management to help you manage and automate every stage of the change management process. Workflows can be customized and automated to conform to your security goals and standards, with tools at your disposal to evolve policy and protection over time.

Configure FireMon Security Manager in Cortex

Parameter	Required
Server URL (e.g. https://example.net)	True
Username	True
Password	True
Fetch incidents	False
Incident type	False
Trust any certificate (not secure)	False
Use system proxy settings	False
Incidents Fetch Interval	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

firemon-user-authentication

Returns authentication token

Base Command

firemon-user-authentication

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
FireMonSecurityManager.Authentication.token	String	Authentication token

firemon-create-pp-ticket

Creates a ticket in policy planner application

Base Command

firemon-create-pp-ticket

Input

Argument Name	Description	Required
domain_id	Domain Id.	Required
workflow_name	Workflow Name. Default is Access Req WF.	Optional
requirement	Add requirement.	Optional
priority	Priority of Policy Planner Ticket. Default is LOW.	Required
due_date	Due Date of Policy Planner Ticket.	Required

Context Output

Path	Type	Description
FireMonSecurityManager.CreatePPTicket.pp_ticket	Unknown	Response for Policy Planner Ticket

firemon-pca

PCA- Pre-Change Assessment is process of showing impact of created devices changes in early stages before implementing changes to devices.
We can check the PCA table in Review stage of Policy planner ticket.

Base Command

firemon-pca

Input

Argument Name	Description	Required
domain_id	Domain ID.	Optional
device_group_id	DeviceGroup ID.	Optional
destinations	Enter comma seperated destination values.	Optional
sources	Enter comma seperated source values.	Optional
services	Enter comma seperated service values.	Optional
action	PCA.	Required

Context Output

Path	Type	Description
FireMonSecurityManager.PCA.pca	Unknown	Response for PCA

firemon-secmgr-secrule-search

Searches for security rules using the SIQL language query (limit to 10k)

Base Command

firemon-secmgr-secrule-search

Input

Argument Name	Description	Required
q	SIQL query to search for security rules.	Required
pageSize	Number of results in the page. Default is 10.	Optional
page	Page in which to retrieve results. Default is 0.	Optional

Context Output

Path	Type	Description
FireMonSecurityManager.SIQL.matchId	Unknown	Resposne for the SIQL query

Base Command

firemon-collector-get-all

Input

Argument Name	Description	Required
pageSize	Number of results in the page.	Optional
page	Page in which to retrieve results.	Optional

Context Output

Path	Type	Description
FireMonSecurityManager.Collector	Unknown	Firemon Collector Infomation.

Base Command

firemon-collector-get-status-byid

Input

Argument Name	Description	Required
id	Collector id.	true

Context Output

Path	Type	Description
FireMonSecurityManager.CollectorStatus	Unknown	Firemon Collector Status.

Configuration parameters

url — Server URL (e.g. https://example.net) (required)
credentials — Username (required)
isFetch — Fetch incidents
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentFetchInterval — Incidents Fetch Interval

Commands (6)

firemon-collector-get-all
Get all the collectors in the inventory.
firemon-collector-get-status-byid
Get collector status.
firemon-create-pp-ticket
Creates a ticket in policy planner application.
firemon-pca
PCA- Pre-Change Assessment is process of showing impact of created devices changes in early stages before implementing changes to devices. We can check the PCA table in Review stage of Policy planner ticket.
firemon-secmgr-secrule-search
Searches for security rules using the SIQL language query (limit to 10k).
firemon-user-authentication
Returns authentication token.

Source

FireMonSecurityManager.py FireMonSecurityManager_test.py FireMonSecurityManager.yml FireMonSecurityManager_description.md

Download History Raw

category: Authentication & Identity Management
provider: FireMon
sectionorder:
- Connect
- Collect
commonfields:
  id: FireMonSecurityManager
  version: -1
configuration:
- display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
description: FireMon Security Manager delivers comprehensive rule lifecycle management to help you manage and automate every stage of the change management process. Workflows can be customized and automated to conform to your security goals and standards, with tools at your disposal to evolve policy and protection over time.
display: FireMon Security Manager
name: FireMonSecurityManager
script:
  commands:
  - description: Returns authentication token.
    name: firemon-user-authentication
    outputs:
    - contextPath: FireMonSecurityManager.Authentication.token
      description: Authentication token.
      type: String
    arguments: []
  - arguments:
    - description: Domain Id.
      name: domain_id
      required: true
    - default: true
      defaultValue: Access Req WF
      description: Workflow Name.
      name: workflow_name
    - description: Add requirement.
      isArray: true
      name: requirement
    - defaultValue: LOW
      description: Priority of Policy Planner Ticket.
      name: priority
      required: true
    - description: Due Date of Policy Planner Ticket.
      name: due_date
      required: true
    description: Creates a ticket in policy planner application.
    name: firemon-create-pp-ticket
    outputs:
    - contextPath: FireMonSecurityManager.CreatePPTicket.pp_ticket
      description: Response for Policy Planner Ticket.
      type: Unknown
  - arguments:
    - description: Domain ID.
      name: domain_id
    - description: DeviceGroup ID.
      name: device_group_id
    - description: Enter comma seperated destination values.
      name: destinations
    - description: Enter comma seperated source values.
      name: sources
    - description: Enter comma seperated service values.
      name: services
    - description: PCA.
      name: action
      required: true
    description: "PCA- Pre-Change Assessment is process of showing impact of created devices changes in early stages before implementing changes to devices. \nWe can check the PCA table in Review stage of Policy planner ticket."
    name: firemon-pca
    outputs:
    - contextPath: FireMonSecurityManager.PCA.pca
      description: Response for PCA.
      type: Unknown
  - arguments:
    - description: SIQL query to search for security rules.
      name: q
      required: true
    - defaultValue: '10'
      description: Number of results in the page.
      name: pageSize
    - defaultValue: '0'
      description: Page in which to retrieve results.
      name: page
    description: Searches for security rules using the SIQL language query (limit to 10k).
    name: firemon-secmgr-secrule-search
    outputs:
    - contextPath: FireMonSecurityManager.SIQL.matchId
      description: Resposne for the SIQL query.
      type: Unknown
  - arguments:
    - description: Page in which to retrieve results.  
      name: page
    - description: Number of results in the page.
      name: pageSize
    description: Get all the collectors in the inventory.
    name: firemon-collector-get-all
    outputs:
    - contextPath: FireMonSecurityManager.Collector
      description: Firemon Collector Infomation.
  - arguments:
    - description: Collector id.
      name: id
      required: true
    description: Get collector status.
    name: firemon-collector-get-status-byid
    outputs:
    - contextPath: FireMonSecurityManager.CollectorStatus
      description: Firemon Collector Status.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: ''
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 5.5.0