Gamma

Details

ID	`Gamma`
Provider	Gamma
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Gamma Enterprise DLP provides 1-click automatic discovery and remediation of data loss instances
across enterprise sanctioned SaaS applications (cloud and on-prem) such as: Slack, Github, GSuite (Gmail, GDrive), Atlassian Suite (Jira, Confluence), Microsoft Office 365 (Outlook, Teams, OneDrive), ServiceNow, ZenDesk and many more.

Configure Gamma.AI Enterprise DLP on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Gamma.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
api_key	Gamma Discovery API Key	True
url	URL of the Gamma API	True
first_fetch	The violation ID (offset) to begin fetching from. The value must be a number equal to or greater than 1. If empty, the fetch will default to the first violation that exists. You can retrieve a list of violation IDs by running the gamma-get-violation-list command.	False
max_fetch	Max results to return	False
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gamma-get-violation-list

Fetch DLP violations found across SaaS applications monitored by Gamma

Base Command

gamma-get-violation-list

Input

Argument Name	Description	Required
minimum_violation	Violation ID to begin pulling from. Defaults to the earliest existing violation for your account.	Required
limit	Default is “10”.	Required

Context Output

Path	Type	Description
GammaViolation.violation_id	Integer	Violation ID
GammaViolation.file_labels_map	Array	File in reference to the DLP violation
GammaViolation.violation_status	String	one of ‘OPEN’, ‘RESOLVED’, ‘IGNORED’
GammaViolation.violation_category	String	Category of the violation e.g. PII, Secrets, GDPR/CCPA, etc.
GammaViolation.violation_event_timestamp	Integer	Timestamp of violation in epoch milliseconds
GammaViolation.text_labels	Array	Data classification labels
GammaViolation.user	JSON Object	a JSON field containing optional information (based on what the app allows us to access) like email address, name, atlassian account id, AD id, github login, etc. All these fields are nullable.
GammaViolation.dashboard_url	String	Gamma dashboard URL
GammaViolation.app_name	String	Name of the application

Command Example

!gamma-get-violation-list minimum_violation=998 limit=1

Context Example

{
    "response": [
        {
            "violation_id": 999,
            "file_labels_map": {
                "svc-prod-account.json": [
                    "cloud_db_credential"
                ]
            },
            "violation_status": "OPEN",
            "violation_category": "secrets",
            "violation_event_timestamp": 1569550580,
            "text_labels": [],
            "user": {
                "name": null,
                "atlassian_account_id": null,
                "email_address": "foo@example.com",
                "active_directory_user_id": null,
                "atlassian_server_user_key": null,
                "slack_user_id": "USER9Aa2",
                "github_handle": "markzuck"
            },
            "dashboard_url": "https://prod-iab12.gamma.ai/dashboard/slack/monitor/violationId/999",
            "app_name": "slack"
        }]
}

gamma-get-violation

Fetches a single DLP violation. This command is the same as gamma-get-violation-list except that this
command only returns the DLP violation details of the given violation id.

Base Command

gamma-get-violation

Input

Argument Name	Description	Required
violation	Violation id	Required

Context Output

Path	Type	Description
GammaViolation.violation_id	Integer	Violation ID
GammaViolation.file_labels_map	Array	File in reference to the DLP violation
GammaViolation.violation_status	String	one of ‘OPEN’, ‘RESOLVED’, ‘IGNORED’
GammaViolation.violation_category	String	Category of the violation e.g. PII, Secrets, GDPR/CCPA, etc.
GammaViolation.violation_event_timestamp	Integer	Timestamp of violation in epoch milliseconds
GammaViolation.text_labels	Array	Data classification labels
GammaViolation.user	JSON Object	a JSON field containing optional information (based on what the app allows us to access) like email address, name, atlassian account id, AD id, github login, etc. All these fields are nullable.
GammaViolation.dashboard_url	String	Gamma dashboard URL
GammaViolation.app_name	String	Name of the application

Command Example

!gamma-get-violation violation=998

Context Example

{
    "response": [
        {
            "violation_id": 999,
            "file_labels_map": {
                "svc-prod-account.json": [
                    "cloud_db_credential"
                ]
            },
            "violation_status": "OPEN",
            "violation_category": "secrets",
            "violation_event_timestamp": 1569550580,
            "text_labels": [],
            "user": {
                "name": null,
                "atlassian_account_id": null,
                "email_address": "foo@example.com",
                "active_directory_user_id": null,
                "atlassian_server_user_key": null,
                "slack_user_id": "USER9Aa2",
                "github_handle": "markzuck"
            },
            "dashboard_url": "https://prod-iab12.gamma.ai/dashboard/slack/monitor/violationId/999",
            "app_name": "slack"
        }]
}

gamma-update-violation

Updates a DLP violation status in Gamma

Base Command

gamma-update-violation

Input

Argument Name	Description	Required
violation	Violation id	Required
status	Status of violation	Required
notes	Notes for violation	Optional

Context Output

There is no context output for this command

Configuration parameters

url — Server URL (e.g. https://example.net) (required)
api_key — Gamma API Key
credentials_api_key —
first_fetch — Starting Violation
max_fetch — Results per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (3)

gamma-get-violation
Get a specific violation.
gamma-get-violation-list
Get a list of violations.
gamma-update-violation
Update a specific violation.

Source

Gamma.py Gamma_test.py Gamma.yml Gamma_description.md command_examples.txt

Download History Raw

category: Network Security
provider: Gamma
sectionorder:
- Connect
- Collect
commonfields:
  id: Gamma
  version: -1
configuration:
- additionalinfo: URL of the Gamma API to query
  defaultvalue: https://app.gamma.ai
  display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: Gamma API Key
  hidden: true
  name: api_key
  type: 4
  section: Connect
  required: false
- displaypassword: Gamma API Key
  name: credentials_api_key
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- additionalinfo: Enter the violation ID to begin fetching from. If empty, the API will default to your first violation
  display: Starting Violation
  name: first_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: Enter a number of results for each fetch to return. The number must be between 1 and 100.
  defaultvalue: '10'
  display: Results per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
description: Query and update violations in Gamma.
display: Gamma
name: Gamma
script:
  commands:
  - arguments:
    - defaultValue: '1'
      description: Violation ID to begin pulling from. Defaults to the earliest existing violation for your account.
      name: minimum_violation
      required: true
    - defaultValue: '10'
      description: 'Upper limit for retrieving violations (max: 100).'
      name: limit
      required: true
    description: Get a list of violations.
    name: gamma-get-violation-list
    outputs:
    - contextPath: GammaViolation.violation_id
      description: Violation ID.
      type: Number
    - contextPath: GammaViolation.file_labels_map
      description: List of Files and corresponding DLP labels in reference to the DLP violation.
      type: Array
    - contextPath: GammaViolation.text_labels
      description: List of DLP labels in reference to the DLP violation.
      type: Array
    - contextPath: GammaViolation.violation_status
      description: Violation status, one of 'OPEN', 'RESOLVED', 'IGNORED'.
      type: String
    - contextPath: GammaViolation.violation_category
      description: Category of the violation e.g. PII, Secrets, GDPR/CCPA, etc.
      type: String
    - contextPath: GammaViolation.violation_event_timestamp
      description: Timestamp of violation in epoch milliseconds.
      type: Number
    - contextPath: GammaViolation.user
      description: JSON field containing optional information about user.
      type: String
    - contextPath: GammaViolation.dashboard_url
      description: Gamma dashboard URL.
      type: String
    - contextPath: GammaViolation.app_name
      description: Name of the application where the violation is found.
      type: String
  - arguments:
    - description: Violation ID to retrieve.
      name: violation
      required: true
    description: Get a specific violation.
    name: gamma-get-violation
    outputs:
    - contextPath: GammaViolation.violation_id
      description: Violation ID.
      type: Number
    - contextPath: GammaViolation.file_labels_map
      description: List of Files and corresponding DLP labels in reference to the DLP violation.
      type: Array
    - contextPath: GammaViolation.text_labels
      description: List of DLP labels in reference to the DLP violation.
      type: Array
    - contextPath: GammaViolation.violation_status
      description: Violation status, one of 'OPEN', 'RESOLVED', 'IGNORED'.
      type: String
    - contextPath: GammaViolation.violation_category
      description: Category of the violation e.g. PII, Secrets, GDPR/CCPA, etc.
      type: String
    - contextPath: GammaViolation.violation_event_timestamp
      description: Timestamp of violation in epoch milliseconds.
      type: Number
    - contextPath: GammaViolation.user
      description: JSON field containing optional information about user.
      type: String
    - contextPath: GammaViolation.dashboard_url
      description: Gamma dashboard URL.
      type: String
    - contextPath: GammaViolation.app_name
      description: Name of the application where the violation is found.
      type: String
  - arguments:
    - description: Violation ID to update.
      name: violation
      required: true
    - auto: PREDEFINED
      description: Status of the violation.
      name: status
      predefined:
      - OPEN
      - RESOLVED
      - IGNORED
      required: true
    - default: true
      defaultValue: None
      description: Any notes to add to a violation. It will overwrite existing notes.
      name: notes
    description: Update a specific violation.
    name: gamma-update-violation
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- No test - unit test