Fortanix DSM

Details

ID	`Fortanix DSM`
Provider	Fortanix
Category	Identity and Access Management
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Manage Secrets and Protect Confidential Data using Fortanix Data Security Manager (DSM)

Authorize Cortext XSOAR to Fortanix DSM

User/password or Client Certificate Auth Method

These fields accept the Username and Password parameters for a user or App. These credentials may also be used for mutual-TLS using a client key and certificate. The may be signed by a Trusted CA if Fortanix DSM is configured accordingly.

API KEY Auth Method

An easy and quick way to test the integration is to specify the Basic Authentication token parameter from the Fortanix DSM App’s API KEY.

Configure Fortanix DSM in Cortex

Parameter	Description	Required
Fortanix DSM server endpoint	URL e.g., https://amer.smartkey.io	True
Username / App UUID / Certificate	If Certificate, specify PEM	False
Password / App Secret / Private Key	Private key cannot be encrypted	False
API Key	Alternative to Username and Password	False
Trust any server certificate (insecure)	Ignores TLS, not recommended	False
Use system proxy settings	Whether to use proxy settings from the Environment	False
Group UUID to list secrets from	Filter the secrets accessible to a single DSM Group	False
Data protection key used for encryption and decryption	Also configure the Cipher Mode	False
Encryption and decryption mode	e.g. FPE, GCM, CBC	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fortanix-list-secrets

List secrets from one or more specified group(s)

Base Command

fortanix-list-secrets

Input

Argument Name	Description	Required
group_id	Group UUID to list secrets from (overrides integration settings).	Optional
state	Current state of the secret (default show all except deleted or destroyed). Possible values are: enabled, disabled, preactive, active, deactivated, compromised, deleted, destroyed.	Optional
page	Page offset to return (100 results at a time).	Optional

Context Output

Path	Type	Description
Fortanix.Secret.Name	string	Secret Name
Fortanix.Secret.ID	string	Secret ID (Key ID or kid)
Fortanix.Secret.Group	unknown	Group ID

fortanix-get-secret-metadata

Get the secret metadata without exposing its value

Base Command

fortanix-get-secret-metadata

Input

Argument Name	Description	Required
name	Name of the secret (mandatory, unless kid is specified).	Optional
kid	Secret UUID (unless name is unspecified).	Optional

Context Output

Path	Type	Description
Fortanix.Secret	unknown	Secret metadata, if successful

fortanix-fetch-secret

Retrieve the secret value

Base Command

fortanix-fetch-secret

Input

Argument Name	Description	Required
kid	Secret UUID (obtained from the list-secrets command).	Required

Context Output

Path	Type	Description
Fortanix.Secret.Value	unknown	Sensitive value of the secret

fortanix-new-secret

Import a new secret

Base Command

fortanix-new-secret

Input

Argument Name	Description	Required
name	Name of the secret.	Required
value	Sensitive value of the secret.	Required
group_id	Group UUID to import the secret into.	Optional
metadata	List of key-value pairs.	Optional

Context Output

Path	Type	Description
Fortanix.Secret	unknown	Secret metadata, if successful

fortanix-rotate-secret

Update an existing secret, which will be rotated

Base Command

fortanix-rotate-secret

Input

Argument Name	Description	Required
name	Name of the secret.	Required
value	Sensitive value of the secret.	Required
metadata	List of key-value pairs.	Optional

Context Output

Path	Type	Description
Fortanix.Secret	unknown	Secret metadata, if successful

fortanix-delete-secret

Delete the secret

Base Command

fortanix-delete-secret

Input

Argument Name	Description	Required
kid	Secret UUID.	Required

Context Output

Path	Type	Description
Fortanix.Secret.Result	unknown	Deletion status

fortanix-invoke-plugin

Invoke a Fortanix Plugin that is executed in a Confidential Computing enclave

Base Command

fortanix-invoke-plugin

Input

Argument Name	Description	Required
pid	Plugin UUID.	Required
input	Arbitrary user input based on the plugin.	Optional

Context Output

Path	Type	Description
Fortanix.Plugin.Output	unknown	Plugin invocation output

fortanix-encrypt

Protects data using key configured in Fortanix DSM

Base Command

fortanix-encrypt

Input

Argument Name	Description	Required
data	User data.	Required
key	Key name used for protection (overrides configured).	Optional
mode	Encryption mode (overrides configured). Possible values are: FPE, GCM, CBC.	Optional

Context Output

Path	Type	Description
Fortanix.Data.Cipher	unknown	Encryption output

fortanix-decrypt

Reveal data using key configured in Fortanix DSM

Base Command

fortanix-decrypt

Input

Argument Name	Description	Required
cipher	Protected ciphertext.	Required
kid	Key UUID for decryption (overrides configured).	Optional
mode	Decryption mode (overrides configured). Possible values are: FPE, GCM, CBC.	Optional
iv	Nonce or initialization vector (if any).	Optional

Context Output

Path	Type	Description
Fortanix.Data.Plain	unknown	Decryption output

Configuration parameters

server — Fortanix DSM server endpoint (required)
credentials — Username / App UUID / Certificate
token — API Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
group_ids — Group UUID to list secrets from
protection_key — Data protection key used for encryption and decryption
protection_mode — Encryption and decryption mode

Commands (9)

fortanix-decrypt
Reveal data using key configured in Fortanix DSM
fortanix-delete-secret
Delete the secret
fortanix-encrypt
Protects data using key configured in Fortanix DSM
fortanix-fetch-secret
Retrieve the secret value
fortanix-get-secret-metadata
Get the secret metadata without exposing its value
fortanix-invoke-plugin
Invoke a Fortanix Plugin that is executed in a Confidential Computing enclave
fortanix-list-secrets
List secrets from one or more specified group(s)
fortanix-new-secret
Import a new secret
fortanix-rotate-secret
Update an existing secret, which will be rotated

Source

FortanixDSM.py FortanixDSM_test.py FortanixDSM.yml FortanixDSM_description.md command_examples.txt

Download History Raw

!fortanix-list-secrets
!fortanix-list-secrets group_id=aedc4bd0-2880-4191-8f38-043fce5ee97
!fortanix-get-secret-metadata name="Test Secret"
!fortanix-get-secret-metadata kid=09299af7-0d69-4091-9dc7-27d426667847
!fortanix-fetch-secret kid=4bd14880-522d-4c34-8560-617e0fb6485b
!fortanix-new-secret value="Top Secret !3$8" name=metasec metadata="key1=value1, key2=meta2,key3=\"whats that\",key 4=nothin new" group_id=07f85883-adaf-4a6c-a040-ffed46dfd349
!fortanix-rotate-secret value="Fib0nac!I !3$8" name=metasec metadata="key1=value01,key2=meta2a,key3=\"whats that\",key 4=nothin new" group_id=07f85883-adaf-4a6c-a040-ffed46dfd349
!fortanix-delete-secret kid=30d7286a-ad4c-4cb3-8bb1-0f9265e0adfc
!fortanix-invoke-plugin pid=3599796b-7b18-49c3-aad8-9758af24fbf9
!fortanix-invoke-plugin pid=3599796b-7b18-49c3-aad8-9758af24fbf9 input="Hello World Oct 29"
!fortanix-invoke-plugin pid=c6a5351e-d516-4099-b5c9-be00c6967a53 input=ewogICJjYV9rZXkiOiAiU1NIQ0EtUHJpdmF0ZS1LZXktRWQyNTUxOSIsCiAgInB1YmtleSI6ICJBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkt0R3dTeFhWdU4zbXFkaE9YNXozVjBNT243MkRJNWNQQThzSXBTemJSVjZnNTNRYW0yVzNNaW1JdlNaazkxL2x4aFNXRE82RmUxQXVqYy9VQ2VCc3lNPSIsCiAgImNlcnRfbGlmZXRpbWUiOiAzNjAwLAogICJ2YWxpZF9wcmluY2lwYWxzIjogInVidW50dSIsCiAgImNlcnRfdHlwZSI6ICJ1c2VyIiwKICAiY3JpdGljYWxfZXh0ZW5zaW9ucyI6IHt9LAogICJleHRlbnNpb25zIjogewogICAgInBlcm1pdC1wdHkiOiAiIgogIH0KfQo=
!fortanix-invoke-plugin pid=3599796b-7b18-49c3-aad8-9758af24fbf9 input="{\"iv\":\"DaRIkBoCaAPqpGSczBeVGQ==\",\"kid\":\"3451bf0b-1728-4b9a-9859-f1c6bd0d8652\",\"op\":\"decrypt\",\"cipher\":\"ZmHxqmbgYGAtauvCnco7EA==\"}"
!fortanix-encrypt data="Hello World 123"
!fortanix-decrypt cipher=eyJraWQiOiAiY2E5ZTJiMGYtNzFjNC00ZjNiLWJhYTYtNGM1YWY5YTM5N2YwIiwgImNpcGhlciI6ICJqcGxqVUk2S2tIb3drbHhhdG1MWXVBPT0iLCAiaXYiOiAidDFJczFWUTR3TlRFOThLZHR2aUlWZz09IiwgIm1vZGUiOiAiQ0JDIn0=
!fortanix-decrypt cipher=u2KMcAUF1jsifJfh99uWqw== iv=r7HeHduHSZ1IrCC6s7MG0w==
!fortanix-decrypt kid=ca9e2b0f-71c4-4f3b-baa6-4c5af9a397f0 cipher=u2KMcAUF1jsifJfh99uWqw== iv=r7HeHduHSZ1IrCC6s7MG0w==