Halcyon

Halcyon is a device management platform that helps organizations monitor, control, and secure their network of devices. It provides centralized tools for overseeing hardware and software inventory, deploying updates, enforcing security policies, and ensuring compliance across device environments.

Analytics & SIEM · Halcyon

Details

IDHalcyon
ProviderHalcyon
CategoryAnalytics & SIEM
From Version8.2.0
Docker Imagedemisto/fastapi:0.125.0.10158186

README

Halcyon

Halcyon is a device management platform that helps organizations monitor, control, and secure their network of devices. It provides centralized tools for overseeing hardware and software inventory, deploying updates, enforcing security policies, and ensuring compliance across device environments.

This integration fetches alerts and events from the Halcyon platform and ingests them into Cortex XSIAM.

Configure Halcyon on Cortex XSIAM

  1. Navigate to Settings > Configurations > Data Collection > Automation & Feed Integrations.
  2. Search for Halcyon.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
Server URL The Halcyon API server URL. Default: https://api.halcyon.ai True
Username Username associated with your Halcyon account. True
Password Password associated with your Halcyon account. True
Trust any certificate (not secure) When selected, certificates are not checked. False
Use system proxy settings Runs the integration instance using the proxy server configured for the server. False
Log types to fetch Select which log types to fetch from Halcyon. Options: Alerts, Events. Default: Both. True
Fetch events When selected, the integration will fetch events. False
Maximum number of alerts per fetch Maximum number of alerts to fetch per fetch cycle. Default: 1000. False
Maximum number of events per fetch Maximum number of events to fetch per fetch cycle. Default: 1000. False
Events Fetch Interval How often to fetch events (in minutes). Default: 1 minute. False
  1. Click Test to validate the connection.

Commands

You can execute these commands from the Cortex XSIAM CLI, as part of an automation, or in a playbook.

halcyon-get-events

This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding.

Base Command

halcyon-get-events

Input

Argument Name Description Required
limit The maximum number of events to return. Default is 1000. Optional
start_time Filter events that occurred after this time. Supports ISO 8601 format or relative time expressions (e.g., “3 days ago”, “2024-01-01T00:00:00Z”). Optional
end_time Filter events that occurred before this time. Supports ISO 8601 format or relative time expressions (e.g., “now”, “2024-01-01T00:00:00Z”). Optional
should_push_events If true, the command creates events in XSIAM; otherwise, it only displays them. Possible values are: true, false. Default is false. Optional

Context Output

There is no context output for this command.

Human Readable Output

The command returns a table with the fetched events.

Fetched Event Types

The integration fetches the following event types:

Alerts

  • API Endpoint: /v2/alerts
  • Time Field: lastOccurredAt
  • Source Log Type: alerts

Alerts represent security-related notifications from the Halcyon platform, including threat detections, policy violations, and other security events.

Events

  • API Endpoint: /v2/events
  • Time Field: occurredAt
  • Source Log Type: events

Events represent general activity logs from the Halcyon platform, including device activities, system events, and operational logs.

Dataset

The data is stored in the halcyon_halcyon_raw dataset in Cortex XSIAM.

Troubleshooting

Authentication Issues

If you encounter authentication errors:

  1. Verify that the username and password are correct.
  2. Ensure the account has the necessary permissions to access the Halcyon API.
  3. Check if the account is locked or disabled.

Rate Limiting

If you encounter rate limiting errors:

  1. Reduce the maximum number of events per fetch.
  2. Increase the fetch interval.
  3. Contact Halcyon support if the issue persists.

Connection Issues

If you encounter connection errors:

  1. Verify the Server URL is correct.
  2. Check network connectivity to the Halcyon API.
  3. If using a proxy, ensure the proxy settings are configured correctly.
  4. If SSL certificate errors occur, you may need to enable “Trust any certificate” (not recommended for production).

Missing Events

If events are not being fetched:

  1. Verify that the “Fetch events” checkbox is enabled.
  2. Check that the correct log types are selected.
  3. Ensure the account has permissions to access the selected log types.
  4. Review the integration logs for any error messages.

Configuration parameters

  • url — Server URL (required)
  • credentials — Username (required)
  • tenant_id — Tenant ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • event_types_to_fetch — Log types to fetch (required)
  • isFetchEvents — Fetch events
  • max_fetch — Maximum number of events per fetch
  • eventFetchInterval — Events Fetch Interval

Commands (1)

  • halcyon-get-events

    This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding.

Source

Halcyon.py Halcyon_test.py Halcyon.yml Halcyon_description.md
Download History Raw 
category: Analytics & SIEM
provider: Halcyon
sectionorder:
- Connect
- Collect
commonfields:
  id: Halcyon
  version: -1
configuration:
- name: url
  display: Server URL
  required: true
  defaultvalue: https://api.halcyon.ai
  type: 0
  additionalinfo: 'The Halcyon API server URL.'
  section: Connect
- name: credentials
  display: Username
  required: true
  type: 9
  additionalinfo: 'Username and password associated with your Halcyon account.'
  displaypassword: Password
  section: Connect
  hiddenusername: false
- name: tenant_id
  display: Tenant ID
  required: true
  type: 0
  additionalinfo: 'The Halcyon Tenant ID for your organization.'
  section: Connect
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  additionalinfo:
  section: Connect
  advanced: true
  required: false
- name: proxy
  display: Use system proxy settings
  type: 8
  additionalinfo:
  section: Connect
  advanced: true
  required: false
- name: event_types_to_fetch
  display: Log types to fetch
  required: true
  defaultvalue: Alerts,Events
  type: 16
  options:
  - Alerts
  - Events
  additionalinfo: 'Select which log types to fetch from Halcyon.'
  section: Collect
- name: isFetchEvents
  display: Fetch events
  type: 8
  section: Collect
  required: false
- name: max_fetch
  display: Maximum number of events per fetch
  type: 0
  defaultvalue: '1000'
  additionalinfo: 'Maximum number of events to fetch per type per fetch cycle. Large amounts may cause performance issues.'
  section: Collect
  required: false
- defaultvalue: 1
  display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
description: Halcyon is a device management platform that helps organizations monitor, control, and secure their network of devices. It provides centralized tools for overseeing hardware and software inventory, deploying updates, enforcing security policies, and ensuring compliance across device environments.
display: Halcyon
name: Halcyon
script:
  commands:
  - name: halcyon-get-events
    description: This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding.
    arguments:
    - name: event_type
      description: 'The type of events to retrieve. If not specified, uses the value configured in the integration parameters.'
      auto: PREDEFINED
      defaultValue: 'Alerts,Events'
      predefined:
        - 'Alerts'
        - 'Events'
        - 'Alerts,Events'
      isArray: true
    - name: limit
      description: The maximum number of events to return per type.
      defaultValue: '1000'
    - name: start_time
      description: 'Filter events that occurred after this time. Supports ISO 8601 format or relative time expressions (e.g., "3 days ago", "2024-01-01T00:00:00Z").'
    - name: end_time
      description: 'Filter events that occurred before this time. Supports ISO 8601 format or relative time expressions (e.g., "now", "2024-01-01T00:00:00Z").'
    - name: should_push_events
      auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command creates events in XSIAM; otherwise, it only displays them.
      predefined:
        - 'true'
        - 'false'
    outputs: []
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/fastapi:0.125.0.10158186
fromversion: 8.2.0
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
supportedModules:
- xsiam