FireMonSecurityManager

FireMon Security Manager delivers comprehensive rule lifecycle management to help you manage and automate every stage of the change management process. Workflows can be customized and automated to conform to your security goals and standards, with tools at your disposal to evolve policy and protection over time.

Authentication & Identity Management · FireMon Security Manager

Details

IDFireMonSecurityManager
ProviderFireMon
CategoryAuthentication & Identity Management
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

FireMon Security Manager delivers comprehensive rule lifecycle management to help you manage and automate every stage of the change management process. Workflows can be customized and automated to conform to your security goals and standards, with tools at your disposal to evolve policy and protection over time.

Configure FireMon Security Manager in Cortex

Parameter Required
Server URL (e.g. https://example.net) True
Username True
Password True
Fetch incidents False
Incident type False
Trust any certificate (not secure) False
Use system proxy settings False
Incidents Fetch Interval False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

firemon-user-authentication

Returns authentication token

Base Command

firemon-user-authentication

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
FireMonSecurityManager.Authentication.token String Authentication token

firemon-create-pp-ticket

Creates a ticket in policy planner application

Base Command

firemon-create-pp-ticket

Input

Argument Name Description Required
domain_id Domain Id. Required
workflow_name Workflow Name. Default is Access Req WF. Optional
requirement Add requirement. Optional
priority Priority of Policy Planner Ticket. Default is LOW. Required
due_date Due Date of Policy Planner Ticket. Required

Context Output

Path Type Description
FireMonSecurityManager.CreatePPTicket.pp_ticket Unknown Response for Policy Planner Ticket

firemon-pca

PCA- Pre-Change Assessment is process of showing impact of created devices changes in early stages before implementing changes to devices.
We can check the PCA table in Review stage of Policy planner ticket.

Base Command

firemon-pca

Input

Argument Name Description Required
domain_id Domain ID. Optional
device_group_id DeviceGroup ID. Optional
destinations Enter comma seperated destination values. Optional
sources Enter comma seperated source values. Optional
services Enter comma seperated service values. Optional
action PCA. Required

Context Output

Path Type Description
FireMonSecurityManager.PCA.pca Unknown Response for PCA

firemon-secmgr-secrule-search

Searches for security rules using the SIQL language query (limit to 10k)

Base Command

firemon-secmgr-secrule-search

Input

Argument Name Description Required
q SIQL query to search for security rules. Required
pageSize Number of results in the page. Default is 10. Optional
page Page in which to retrieve results. Default is 0. Optional

Context Output

Path Type Description
FireMonSecurityManager.SIQL.matchId Unknown Resposne for the SIQL query

Base Command

firemon-collector-get-all

Input

Argument Name Description Required
pageSize Number of results in the page. Optional
page Page in which to retrieve results. Optional

Context Output

Path Type Description
FireMonSecurityManager.Collector Unknown Firemon Collector Infomation.

Base Command

firemon-collector-get-status-byid

Input

Argument Name Description Required
id Collector id. true

Context Output

Path Type Description
FireMonSecurityManager.CollectorStatus Unknown Firemon Collector Status.

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • credentials — Username (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval

Commands (6)

  • firemon-collector-get-all

    Get all the collectors in the inventory.

  • firemon-collector-get-status-byid

    Get collector status.

  • firemon-create-pp-ticket

    Creates a ticket in policy planner application.

  • firemon-pca

    PCA- Pre-Change Assessment is process of showing impact of created devices changes in early stages before implementing changes to devices. We can check the PCA table in Review stage of Policy planner ticket.

  • firemon-secmgr-secrule-search

    Searches for security rules using the SIQL language query (limit to 10k).

  • firemon-user-authentication

    Returns authentication token.

Source

FireMonSecurityManager.py FireMonSecurityManager_test.py FireMonSecurityManager.yml FireMonSecurityManager_description.md
Download History Raw 
import json


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_authenticate_user(requests_mock):
    from FireMonSecurityManager import Client, authenticate_command

    mock_response = util_load_json("test_data/get_authentication.json")
    requests_mock.post("https://example.test.com/securitymanager/api/authentication/login", json=mock_response)

    client = Client(base_url="https://example.test.com", verify=False, proxy=False, username="test", password="test")

    response = authenticate_command(client)
    assert response is not None
    assert response.raw_response["authorized"] is True


def test_create_pp_ticket_command(requests_mock):
    from FireMonSecurityManager import Client, create_pp_ticket_command

    mock_response = util_load_json("test_data/get_authentication.json")
    requests_mock.post("https://example.test.com/securitymanager/api/authentication/login", json=mock_response)

    mock_response = util_load_json("test_data/get_workflows.json")
    requests_mock.get("https://example.test.com/policyplanner/api/domain/1/workflow/version/latest/all", json=mock_response)

    mock_response = util_load_json("test_data/get_pp_ticket.json")
    requests_mock.post("https://example.test.com/policyplanner/api/domain/1/workflow/3/packet", json=mock_response)

    client = Client(base_url="https://example.test.com", verify=False, proxy=False, username="test", password="test")
    args = {
        "domain_id": 1,
        "workflow_name": "Access Req WF",
        "requirement": [{"action": "ACCEPT", "destinations": "2.2.2.2", "services": "http", "sources": "1.1.1.1"}],
        "priority": "Low",
        "due_date": "2021-08-26T03:50:17-04:00",
    }
    response = create_pp_ticket_command(client, args=args)
    assert response is not None
    assert response.outputs_prefix == "FireMonSecurityManager.CreatePPTicket"


def test_pca_new_command(requests_mock):
    from FireMonSecurityManager import Client, pca_command

    mock_response = util_load_json("test_data/get_authentication.json")
    requests_mock.post("https://example.test.com/securitymanager/api/authentication/login", json=mock_response)

    mock_response = util_load_json("test_data/get_rule_rec.json")
    requests_mock.post("https://example.test.com/orchestration/api/domain/1/change/rulerec", json=mock_response)

    mock_response = util_load_json("test_data/get_pca.json")
    requests_mock.post("https://example.test.com/orchestration/api/domain/1/change/device/9/pca", json=mock_response)

    client = Client(base_url="https://example.test.com", verify=False, proxy=False, username="test", password="test")

    args = {
        "sources": "10.1.1.1",
        "destinations": "1.1.1.1",
        "services": "tcp/8080",
        "action": "ACCEPT",
        "domain_id": 1,
        "device_group_id": 1,
    }

    response = pca_command(client, args=args)
    assert response is not None
    assert response.outputs_prefix == "FireMonSecurityManager.PCA"


def test_secrule_search_command(requests_mock):
    from FireMonSecurityManager import Client, secmgr_secrule_search_command

    mock_response = util_load_json("test_data/get_authentication.json")
    requests_mock.post("https://example.test.com/securitymanager/api/authentication/login", json=mock_response)

    mock_response = util_load_json("test_data/get_paged_search_secrule.json")
    requests_mock.get("https://example.test.com/securitymanager/api/siql/secrule/paged-search", json=mock_response)

    client = Client(base_url="https://example.test.com", verify=False, proxy=False, username="test", password="test")

    args = {"q": "test_query"}

    response = secmgr_secrule_search_command(client, args=args)
    assert response is not None
    assert response.outputs_prefix == "FireMonSecurityManager.SIQL"