IBMMaaS360Security

This is the IBM MaaS360 Security event collector integration for Cortex XSIAM.

Analytics & SIEM · IBM MaaS360 Security

Details

IDIBMMaaS360Security
ProviderIBM
CategoryAnalytics & SIEM
From Version8.4.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesXSIAM

README

This is the IBM MaaS360 Security integration for Cortex XSIAM.

Create App credentials

To access the IBM MaaS360 Security API, you first need to generate an App access key.
Follow these steps:

  1. Log in to the IBM MaaS360 portal.

  2. Go to Setup > Manage Access Keys.
    Generate access key

  3. Click Generate Access Key.
    Generate access key

  4. Create a new MaaS360 Web Services key.
    Generate access key

  5. Get App ID, App Version, Platform ID, and App Access Key.
    Generate access key

For further assistance, you may contact IBM MaaS360 support to request these credentials as well.
See Configuring provisioning for MaaS360

Find your Billing ID

  1. Log in to the IBM MaaS360 portal.

  2. Hover over the profile menu on the top right and copy the Account ID value. This is your Billing ID.
    Get Billing ID

Account permissions

To collect events, the user requires read-only permissions.
Follow these steps to modify user permissions:

  1. Log in to the IBM MaaS360 portal.

  2. Go to Setup > Administrators
    Admin permissions

  3. Find the relevant administrator account or create a new one.

  4. Click Edit. (Note: This does not appear for the primary admin account.)
    Admin permissions

  5. Add the Read-Only permission.
    Admin permissions

Configure IBM MaaS360 Security on Cortex XSIAM

  1. Navigate to Settings > Configurations > Data Collection > Automations & Feed Integrations.
  2. Search for IBM MaaS360 Security.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    Server URL   True
    User Name   True
    Password   True
    App ID   True
    App Version   True
    Platform ID   True
    App Access Key   True
    Billing ID   True
    Maximum number of Admin Login Reports events per fetch Rounds up to the nearest page size increment. (250) False
    Maximum number of Admin Changes Audit events per fetch Rounds up to the nearest page size increment. (250) False
    Trust any certificate (not secure)   False
    Use system proxy settings   False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSIAM CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ibm-maas360-security-get-events

Gets events from IBM MaaS360 Security.

Base Command

ibm-maas360-security-get-events

Input

Argument Name Description Required
should_push_events If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false. Required
limit Maximum number of results to return. Required
from_date Date from which to get events. Optional

Context Output

There is no context output for this command.

Human Readable Output

Admin audits

_time source_log_type updateDate performedBy operationType ipAddress administrator
2024-10-29T13:39:32Z admin_changes_audit 1730209172000 test@mail.com CHANGE 1.1.1.1 email: test@mail.com
username: test@mail.com
firstName: tester
middleName:
lastName: tester
address:
phone:
jobTitle:
watchSubscription: Y
accountStatus: Active
managedUserGroups: All groups
lastLoginTime:
rolesAdded:
rolesDeleted:
previousState:
2024-10-29T13:39:32Z admin_changes_audit 1730209172000 test@mail.com CHANGE 1.1.1.1 email: test@mail.com
username: test@mail.com
firstName: tester
middleName:
lastName: tester
address:
phone:
jobTitle:
watchSubscription: Y
accountStatus: Active
managedUserGroups: All groups
lastLoginTime:
rolesAdded: Help Desk
rolesDeleted:
previousState:
2024-10-29T12:53:49Z admin_changes_audit 1730206429000 test@mail.com CHANGE 1.1.1.1 email: test@mail.com
username: test@mail.com
firstName: tester
middleName:
lastName: tester
address:
phone:
jobTitle:
watchSubscription: Y
accountStatus: Active
managedUserGroups: All groups
lastLoginTime:
rolesAdded:
rolesDeleted:
previousState:
2024-10-29T12:53:49Z admin_changes_audit 1730206429000 test@mail.com CHANGE 1.1.1.1 email: test@mail.com
username: test@mail.com
firstName: tester
middleName:
lastName: tester
address:
phone:
jobTitle:
watchSubscription: Y
accountStatus: Active
managedUserGroups: All groups
lastLoginTime:
rolesAdded:
rolesDeleted: Help Desk
previousState:
2024-10-29T12:41:31Z admin_changes_audit 1730205691000 test@mail.com CHANGE 1.1.1.1 email: test@mail.com
username: test@mail.com
firstName: tester
middleName:
lastName: tester
address:
phone:
jobTitle:
watchSubscription: Y
accountStatus: Active
managedUserGroups: All groups
lastLoginTime:
rolesAdded:
rolesDeleted:
previousState:

Configuration parameters

  • url — Server URL (required)
  • credentials — User Name (required)
  • app_id — App ID (required)
  • app_version — App Version (required)
  • platform_id — Platform ID (required)
  • app_access_key — (required)
  • billing_id — (required)
  • max_login_reports_per_fetch — Maximum number of Admin Login Reports events per fetch
  • max_admin_change_audits_per_fetch — Maximum number of Admin Changes Audit events per fetch
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • ibm-maas360-security-get-events

    Gets events from IBM MaaS360 Security.

Source

IBMMaaS360SecurityEventCollector.py IBMMaaS360SecurityEventCollector_test.py IBMMaaS360SecurityEventCollector.yml IBMMaaS360SecurityEventCollector_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
provider: IBM
sectionorder:
- Connect
- Collect
commonfields:
  id: IBMMaaS360Security
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- name: credentials
  display: User Name
  required: true
  type: 9
  displaypassword: Password
  section: Connect
  hiddenusername: false
- display: App ID
  name: app_id
  required: true
  type: 0
  section: Connect
- display: App Version
  name: app_version
  required: true
  type: 0
  section: Connect
- display: Platform ID
  name: platform_id
  required: true
  type: 0
  section: Connect
- name: app_access_key
  required: true
  type: 9
  displaypassword: App Access Key
  section: Connect
  hiddenusername: true
- name: billing_id
  required: true
  type: 9
  displaypassword: Billing ID
  section: Connect
  hiddenusername: true
- display: Maximum number of Admin Login Reports events per fetch
  name: max_login_reports_per_fetch
  additionalinfo: Rounds up to the nearest page size increment. (250)
  required: false
  type: 0
  section: Collect
  defaultvalue: 1250
- display: Maximum number of Admin Changes Audit events per fetch
  name: max_admin_change_audits_per_fetch
  additionalinfo: Rounds up to the nearest page size increment. (250)
  required: false
  type: 0
  section: Collect
  defaultvalue: 1250
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
description: This is the IBM MaaS360 Security event collector integration for Cortex XSIAM.
display: IBM MaaS360 Security
name: IBMMaaS360Security
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      isArray: false
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - default: false
      description: Maximum number of results to return.
      isArray: false
      name: limit
      required: true
      secret: false
    - default: false
      description: Date from which to get events.
      name: from_date
      required: false
    deprecated: false
    description: Gets events from IBM MaaS360 Security.
    execution: false
    name: ibm-maas360-security-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam