Forcepoint
Advanced threat protection with added local management controls.
Network Security · Forcepoint Web Security
Details
| ID | Forcepoint |
|---|---|
| Provider | Francisco Partners |
| Category | Network Security |
| From Version | 5.0.0 |
| Supported Modules | Agentix XSIAM Cortex Cloud EDR Cloud Runtime Security |
README
Forcepoint is an advanced threat protection product with added local management controls.
The Forcepoint-XSOAR integration allows you to create and manage custom categories.
To set up Forcepoint to work with Cortex XSOAR:
- Make sure you have administrator permissions.
- Make sure you have port 15873 open.
- Make sure you have Forcepoint API version 8.5.7 or later.
To set up the integration on Cortex XSOAR:
- Go to ‘Settings > Integrations > Servers & Services’
- Locate ‘Forcepoint ’ by searching for it using the search box on the top of the page.
- Click ‘Add instance’ to create and configure a new integration. You should configure the following settings:
Name: A textual name for the integration instance.
Server URL: API Server URL.
Username and Password: The username and password for accessing the integration.
Use system proxy settings: Specify whether to communicate with the integration with the system proxy server.
Do not validate server certificate: Select to circumvent server certification validation. You may want to do this in case the server you are connecting to does not have a valid certificate.
Forcepoint version 8.5.5 or later: Select if you have a hotfix/instrumental build that requires using POST requests instead of DELETE requests.
Cortex XSOAR engine: If relevant, select the engine that acts as a proxy to the server. Engines are used when you need to access a remote network segments and there are network devices such as proxies, firewalls, etc. that prevent the Cortex XSOAR server from accessing the remote networks.
For more information on Cortex XSOAR engines see:
Cortex XSOAR 6.13 - Engines
Cortex XSOAR 8 Cloud- Engines
Cortex XSOAR 8.7 On-prem - Engines - Press the ‘Test’ button to validate connection.
- After completing the test successfully, press the ‘Done’ button.
Fetched incidents data:
This integration does not fetch incidents.
Top Use-cases:
Forcepoint integration can be used to create a block list category for URL and IP addresses.
A possible flow of commands could be:
- Use ‘fp-add-category’ to add a new category. The new category will automatically be set to block access.
- Use ‘fp-get-category-details’ to get the new category ID.
- Use ‘fp-add-addresses-to-category’ to add URLs and/or IP addresses to the category. Use the category name or ID as identifier.
- Use ‘fp-delete-addresses-from-category’ to remove URLs and/or IP addresses from the category.
The integration can also be used to view a detailed list of managed categories. Use ‘fp-list-categories’ to view all Forceoint categories or only categories managed by the integration.
Commands:
- fp-list-categories
Input:
|
Option to list all categories or only API-managed categories (default). |
Context output:
|
``` { Forcepoint: { ListCategories: [ { CategoryDescription: Sites that provide information about or that sell or provide curriculum materials or direct instruction; also, learned journals and similar publications. CategoryID: 118 CategoryName: Educational Materials CategoryOwner: Forcepoint CategoryParent: Education } ] } ``` |
Raw output:
|
``` [ { Category Description: Parent category that contains categories known to consume bandwidth resources. Category Hierarchy: 890 Category ID: 116 Category Name: Bandwidth Category Owner: Forcepoint CategoryParent: Children: [ { Category Description: Sites that store personal files on Internet servers for backup or exchange. Category Hierarchy: 1510 Category ID: 113 Category Name: Personal Network Storage and Backup Category Owner: Forcepoint CategoryParent: Bandwidth } ] } ] ``` |
-
fp-get-category-details
Input:
|
category name or ID |
Context output:
|
{ Forcepoint: { CategoryDetails: { CategoryID: 116 CategoryName: Bandwidth IPs: [] URLs: [] } } } |
Raw output:
|
``` { Category ID: 116 Category Name: Bandwidth IPs: [] URLs: [] } ``` |
- fp-add-category
Input:
|
category name, category description, category parent. |
Context output:
|
``` { Forcepoint: { Add Category: { Categories: [ { Category Name: Test category } ] } } }
``` |
Raw output:
|
``` { Categories: [ { Category Name: Test category } ] } ``` |
- fp-add-addresses-to-category
Input:
|
Category name or ID , list of URLs and/or list of IP addresses. |
Context output:
|
``` { Forcepoint: { AddAddressToCategory: { Category ID: 1932 Category Name: Totals: { Added IPs: 0 Added URLs: 1 } } } } ``` |
Raw output:
|
``` { Category ID: 1932 Category Name: Totals: { Added IPs: 0 Added URLs: 1 } } ``` |
- fp-delete-addresses-from-category
Input:
|
category name or ID , list of URLs and/or list of IP addresses. |
Context output:
|
``` { Forcepoint: { AddAddressToCategory: { Category ID: 1932 Category Name: Totals: { Deleted IPs: 0 Deleted URLs: 1 } } } } ``` |
Raw output:
|
``` { Category ID: 1932 Category Name: Totals: { Deleted IPs: 0 Deleted URLs: 1 } } ``` |
- fp-delete-category
Input:
|
List of category names or IDs |
Context output:
|
``` { Forcepoint: { DeletedCategories: [ { CategoryID: 116 CategoryName: Bandwidth IPs: [] URLs: [] }, … ] } } ``` |
Raw output:
|
``` { Category ID: 116 Category Name: Bandwidth IPs: [] URLs: [] }, … ] ``` |
Additional info:
URL restrictions and clarifications:
- Only the hostname field (part of the authority) is required.
- Other parts are optional, but can be used to define a stricter match.
- CGI parameters (anything after the "?" in a URL) are automatically removed from the URL.
- If no protocol is specified, the following protocols will be added to the database:
http://, https://, and ftp://. - URLs can be added to more than one category. When the URL is matched, all categories for the URL are returned for use in policy enforcement.
IP addresses restrictions and clarification:
- IP addresses and ranges are as specified by IPv4 and IPv6.
- IP addresses and ranges can be added to more than one category. When an IP address is matched, all categories for the IP address are returned for use in policy enforcement.
Known Limitations
- New category will automatically be set to block access. You may change category access with Forcepoint TRITON manager.
- Since the API does not support TLS 1.2, the integration works only with TLS versions 1.0 and below.
Troubleshooting
-
Failed attempts to add/delete URL or IP addresses to a category might be caused by invalid category name or ID.
Invalid category name/ID indicates one of the following:- The category does not exist.
- The ID/name belongs to a Forcepoint-defined category.
- The ID/name belongs to a custom category defined via the TRITON Manager.
-
Failed attempts to create a new category might be caused by:
- The name provided is associated with another category.
-
Recurring error ‘Another transaction is in process …’:
This error might rise when running a playbook with parallel tasks assigned to the integration commands.
This error is caused by the Forcepoint data enforcement protocol. Any request to update/add/delete a category cannot run in parallel to another request of this type.
If this error arises, try to avoid assigning the following commands to parallel tasks:- ‘fp-add-category’
- ‘fp-add-addresses-to-category’
- ‘fp-delete-addresses-from-category’
- ‘fp-delete-category’
Configuration parameters
url— Server URL (e.g. https://192.168.0.1) (required)credentials— Credentials (required)proxy— Use system proxy settingsinsecure— Trust any certificate (not secure)versionCheck— Forcepoint version 8.5.5 or later
Commands (6)
-
fp-add-address-to-categoryAdd URLs and IP addresses to an API-managed category. Refer to category either by it's ID or by it's name.
-
fp-add-categoryCreate custom category.
-
fp-delete-address-from-categoryRemove URLs, IP addresses, and ranges from a specific API-managed category. Refer to category either by it's ID or by it's name.
-
fp-delete-categoriesDelete API-managed categories. Refer to categories you wish to delete either by ID list or by name list. It is possible to pass both lists, when each list refers to different categories.
-
fp-get-category-detailesGet a list of URLs and IP addresses in an API-managed category.
-
fp-list-categoriesRetrieve a list of all the categories, or only API-managed categories.
commonfields: id: Forcepoint version: -1 sectionorder: - Connect name: Forcepoint display: Forcepoint Web Security category: Network Security provider: Francisco Partners description: Advanced threat protection with added local management controls. configuration: - display: Server URL (e.g. https://192.168.0.1) name: url defaultvalue: "" type: 0 required: true section: Connect - display: Credentials name: credentials defaultvalue: "" type: 9 required: true section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Forcepoint version 8.5.5 or later name: versionCheck type: 8 required: false section: Connect script: script: '' type: javascript commands: - name: fp-add-category arguments: - name: categoryName required: true description: The category name. Must be unique, alphanumeric name. - name: categoryDescription description: The category description. It may contain alphanumeric characters, periods, and commas. - name: parent description: "The category parent. 0 is the top-level category, and can be specified as the parent. \t Subcategories can be added to categories that have a parent of 0, but not to categories with a different parent." defaultValue: "0" outputs: - contextPath: Forcepoint.AddCategory.CategoryName description: The category name. description: Create custom category. - name: fp-list-categories arguments: - name: allCategories auto: PREDEFINED predefined: - "true" - "false" description: Select 'true' to retrieve a list of all the categories. Else, only API-managed categories will be listed. defaultValue: "false" outputs: - contextPath: ListCategories.CategoryName description: Category name. - contextPath: ListCategories.CategoryID description: Category ID. - contextPath: ListCategories.CategoryDescription description: Category description. - contextPath: ListCategories.CategoryOwner description: Category owner. description: Retrieve a list of all the categories, or only API-managed categories. - name: fp-get-category-detailes arguments: - name: categoryName description: The category name. Leave blank if category ID is provided. - name: categoryId description: The category ID. Leave blank if category name is provided. outputs: - contextPath: Forcepoint.CategoryDetails.CategoryName description: Category name. - contextPath: Forcepoint.CategoryDetails.CategoryID description: Category ID. - contextPath: Forcepoint.CategoryDetails.URLs description: Category URLs. - contextPath: Forcepoint.CategoryDetails.IPs description: Category IPs. description: Get a list of URLs and IP addresses in an API-managed category. - name: fp-add-address-to-category arguments: - name: urls description: 'Comma separated list of URL addresses to add. ' - name: ips description: 'Comma separated list of IP address to add. ' - name: categoryID description: The category ID. Leave blank if category name is provided. - name: categoryName description: The category name. Leave Blank if category ID is provided. outputs: - contextPath: Forcepoint.AddAddressToCategory.CategoryName description: The category name. - contextPath: Forcepoint.AddAddressToCategory.CategoryID description: The category ID. - contextPath: Forcepoint.AddAddressToCategory.Totals.AddedURLs description: Total URLs added to category. - contextPath: Forcepoint.AddAddressToCategory.Totals.AddedIPs description: Total IP addresses added to category. description: Add URLs and IP addresses to an API-managed category. Refer to category either by it's ID or by it's name. - name: fp-delete-categories arguments: - name: categoryIDs description: Comma separated list of category IDs. - name: categoryNames description: Comma separated list of category names. outputs: - contextPath: Forcepoint.DeletedCategories.CategoryName description: Category name. - contextPath: Forcepoint.DeletedCategories.CategoryID description: Category ID. - contextPath: Forcepoint.DeletedCategories.URLs description: Category URLs. - contextPath: Forcepoint.DeletedCategories.IPs description: Category IPs. description: Delete API-managed categories. Refer to categories you wish to delete either by ID list or by name list. It is possible to pass both lists, when each list refers to different categories. - name: fp-delete-address-from-category arguments: - name: categoryID description: The category ID. Leave blank if category name is provided. - name: urls description: Comma separated list of URL address to remove. - name: ips description: Comma separated list of IP address to remove. - name: categoryName description: The category name. Leave blank if category ID is provided. outputs: - contextPath: Forcepoint.DeleteAddressesFromCategory.CategoryName description: The category Name. - contextPath: Forcepoint.DeleteAddressesFromCategory.CategoryID description: The category ID. - contextPath: Forcepoint.DeleteAddressesFromCategory.Totals.DeletedURLs description: Total URLs deleted from category. - contextPath: Forcepoint.DeleteAddressesFromCategory.Totals.DeletedIPs description: Total IP addresses deleted from category. description: ' Remove URLs, IP addresses, and ranges from a specific API-managed category. Refer to category either by it''s ID or by it''s name.' fromversion: 5.0.0 tests: - No tests (auto formatted)