icebrg

Reduces risk by accelerating threat detection, triage, and response to rapidly-evolving breaches across global networks.

Network Security · Icebrg

Details

ID	`icebrg`
Provider	Gigamon
Category	Network Security
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

ICEBRG is a network security product which is used in conjunction with Cortex XSOAR to get events and reports produced in ICEBRG for queries.

The following data is fetched :

Fetching reports which contain more than one asset.
Events cannot be fetched.
Flittering by published date.
Fetching every 10 minutes.

To set up ICEBRG to work with Cortex XSOAR:

To obtain API token (on ICEBRG):

Go to ‘Settings > Profile Settings > Tokens’.
Click ‘Create new token’.
Enter description.
Click ‘Create’
Record this token to use in the next steps.

To set up the integration on Cortex XSOAR:

Go to ‘Settings > Integrations > Servers & Services’
Locate ‘ICEBRG’ by searching for it using the search box on the top of the page.
Click ‘Add instance’ to create and configure a new integration. You should configure the following settings:
Name: A textual name for the integration instance.
Server URL for the search API: The URL appliance.
API username: ICEBRG API token.
Server URL for the reports API: The server used for the reports API.
Password: ICEBRG API password.
ICEBRG token: The token obtained in the steps above.
Fetch incidents: Select whether to automatically create Cortex XSOAR incidents from ICEBRG offenses.
Cortex XSOAR engine: If relevant, select the engine that acts as a proxy to the server. Engines are used when you need to access a remote network segments and there are network devices such as proxies, firewalls, etc. that prevent the Cortex XSOAR server from accessing the remote networks.
For more information on Cortex XSOAR engines see:
Cortex XSOAR 6.13 - Engines
Cortex XSOAR 8 Cloud- Engines
Cortex XSOAR 8.7 On-prem - Engines
Press the ‘Test’ button to validate connection.
After completing the test successfully, press the ‘Done’ button.

Top Use-cases:

Search events by query.
Get reports by UUID..

Commands:

icebrg-search-events

Input:

Query (mandatory) - The query string or entity for which to search.
Start date - The beginning of the temporal extent by which to restrict filter results, inclusive (in RFC3339 format).
End date - The end of the temporal extent by which to restrict filter results, exclusive (in RFC3339 format).
Order by - The event property by which to order results. Default: timestamp.
Order - The order of results, either "asc" or "desc". Default: desc.
Customer ID - The customer ID by which to restrict filter results. Default: user's account.
History - When true, save this query in user's Query History and include up to the last 50 queries from user's Query History. Default: false.
Service traffic - When true, the service will include the service_traffic aggregation. Default: false.

Context output:

Icebrg.Events.QueryType - Query type
Icebrg.Events.Total - Total events
Icebrg.Events.OrderBy - Key to order events by
Icebrg.Events.Order - Order of the events
Icebrg.Events.Offset - Events offset
Icebrg.Events.History - History of events
Icebrg.Events.Limit - Limit number of events to show

Raw output:

{
 "total": 135359505,
 "offset": 0,
 "limit": 100,
 "order_by": "timestamp",
 "query_type": "complex",
 "events": [ ... ]
}

icebrg-get-history

Input:

none

Context output:

Icebrg.UserQueryHistory.Total - Total user queries
Icebrg.UserQueryHistory.Timestamp - Timestamp of user query
Icebrg.UserQueryHistory.Query - Called query
Icebrg.UserQueryHistory.QueryId - ID of query
Icebrg.UserQueryHistory.UserId - User ID

Raw output:

{
  "history": [{
       "total": 3393897721,
       "timestamp": "2017-03-30T20:56:11.556Z",
       "query": "port = 80",
       "id": "725be4f112f5b5ae9807b7130b2cea97"
  },
  {
       "total": 211313295,
       "timestamp": "2017-03-30T17:44:35.748Z",
       "query": "google.com",
    "id": "655765009424c447765d06773e711dd3"
 }],
 "User_id": "f3259c9f-e54a-4e93-b71d-8e995a2cd96b"
 }

icebrg-saved-searches

Input:

none

Context output:

Icebrg.SavedSearches.Tags - Query tags
Icebrg.SavedSearches.Description - Query description
Icebrg.SavedSearches.Title - Query title
Icebrg.SavedSearches.Timestamp - Query timestamp
Icebrg.SavedSearches.Query - Called query
Icebrg.SavedSearches.Id - Query ID

Raw output:

{
 "saved_queries": [{
       "tags": [],
       "description": "",
       "title": "Test",
       "timestamp": "2017-03-17T00:48:34.359Z",
       "query": "ip='127.0.0.1'",
       "id": "AVrZvNBGl0ZSNz2usg93"
  }]
}

icebrg-get-reports

Input:

Limit - The maximum number of records to return. The default is no limit.
Offset - The number of records to skip. The default is none.
Sort by - The field to sort by (created, updated, or published). The default is unsorted.
Sort order - The sort order asc or desc. The default is asc if sort_by is provided.
Account UUID - UUID of account to filter by.
Archived - Archived status to filter by.
Confidence - Confidence to filter by (low, moderate, high).
Risk - Risk to filter by (low, moderate, high).
Search - Text string to search the title and summary.
Status - Status to filter by.
Published start - Published start date to filter by (inclusive), RFC3339 format.
Published end - Published end date to filter by (exclusive), RFC3339 format.

Context output:

Icebrg.Reports.Publishes.UserUuid - User UUID that published the report Icebrg.Reports.Publishes.Publishe - Timestamp of published report Icebrg.Reports.AssetCount - Asset count of report
Icebrg.Reports.IndicatorCount - Indicator count of report
Icebrg.Reports.Archived - True if archived, else false
Icebrg.Reports.Details - Report details
Icebrg.Reports.Summary - Report summary
Icebrg.Reports.Category - Category of the report
Icebrg.Reports.Confidence - Indicator count of report
Icebrg.Reports.Archived - Confidence of report
Icebrg.Reports.Risk - Risk of report
Icebrg.Reports.Title - Report title
Icebrg.Reports.Status - Status of report
Icebrg.Reports.AccountUuid - Account UUID of report
Icebrg.Reports.UpdatedUserUuid - User UUID that updated the report Icebrg.Reports.CreatedUserUuid - User UUID that created the report Icebrg.Reports.Updated - Timestamp of report update
Icebrg.Reports.Created - Timestamp of report creation
Icebrg.Reports.Uuid - Report UUID

Raw output:

{
    "reports": [{
   "publishes": [{
           "user_uuid": "b3fc3df4-d3cf-4202-971c-0dcfe7cccf42",
             "published": "2017-01-24T10:13:13.418Z"
       }],
     "asset_count": 1,
    "indicator_count": 5,
    "archived": false,
    "details": "On 21 January, ...",
    "summary": "A host was infected with Cerber ransomware after opening a
             malicious Word document received via email.",
    "category": "Ransomware",
    "confidence": "high",
    "risk": "moderate",
    "title": "Cerber Malware Infection",
    "status": "published",
    "account_uuid": "6bc3d2f1-af77-4236-a9db-17dacd06e4d9",
    "updated_user_uuid": "b3fc3df4-d3cf-4202-971c-0dcfe7cccf42",
    "created_user_uuid": "b3fc3df4-d3cf-4202-971c-0dcfe7cccf42",
    "updated": "2017-01-24T10:12:32.534Z",
    "created": "2017-01-24T07:25:36.363Z",
    "uuid": "2d35734f-5b16-41ff-a482-b08a7c74202a"
 }],
}

icebrg-get-report-assets

Input:

Report UUID (mandatory) - Report UUID to get the indicator

Context output:

Icebrg.ReportAssets.Asset - Assets of Report UUID

Raw output:

{
 "assets": [{
       "asset" : "10.248.100.74"
  }]
}

Troubleshooting

This integration was integrated and tested with version 1.3 of ICEBRG.

Configuration parameters

url_search — Server URL for the search API (e.g. https://192.168.0.1)
url_reports — Server URL for the reports API (e.g. https://192.168.0.1)
token — ICEBRG token (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (6)

icebrg-get-history
Gets history of the events
icebrg-get-report-assets
Gets impacted assets for a report
icebrg-get-report-indicators
Gets indicators for a reports
icebrg-get-reports
Gets a list of reports
icebrg-saved-searches
Gets user saved searches
icebrg-search-events
Perform an ICEBRG datastore event search

Source

Icebrg.js Icebrg.yml

Download History Raw

commonfields:
  id: icebrg
  version: -1
name: icebrg
display: Icebrg
category: Network Security
sectionorder:
- Connect
- Collect
provider: Gigamon
description: Reduces risk by accelerating threat detection, triage, and response to rapidly-evolving breaches across global networks.
configuration:
- display: Server URL for the search API (e.g. https://192.168.0.1)
  name: url_search
  defaultvalue: https://events.icebrg.io/v2/query
  type: 0
  required: false
  section: Connect
- display: Server URL for the reports API (e.g. https://192.168.0.1)
  name: url_reports
  defaultvalue: https://report.icebrg.io/v1/reports
  type: 0
  required: false
  section: Connect
- display: ICEBRG token
  name: token
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
script:
  script: ''
  type: javascript
  commands:
  - name: icebrg-search-events
    arguments:
    - name: query
      required: true
      default: true
      description: The query string or entity for which to search.
    - name: start_date
      description: The beginning of the temporal extent by which to restrict filter results, inclusive.
    - name: end_date
      description: The end of the temporal extent by which to restrict filter results, exclusive.
    - name: limit
      description: A limit on the number of events returned in filter results. Default is 100. Max is 10000.
    - name: order_by
      description: The event property by which to order results. Default is timestamp.
    - name: order
      description: The order of results, either asc or desc. Default is desc.
    - name: customer_id
      description: The customer ID by which to restrict filter results. Default is user account.
    - name: history
      description: When true, save this query in user Query History and include up to the last 50 queries from users Query History. Default is false.
    - name: service_traffic
      description: When true, the service will include the service_traffic aggregation. Default is false.
    outputs:
    - contextPath: Icebrg.Events.QueryType
      description: Query type.
    - contextPath: Icebrg.Events.Total
      description: Total events.
    - contextPath: Icebrg.Events.OrderBy
      description: Key to order events by.
    - contextPath: Icebrg.Events.Order
      description: Order of the events.
    - contextPath: Icebrg.Events.Offset
      description: Events offset.
    - contextPath: Icebrg.Events.History
      description: History of events.
    - contextPath: Icebrg.Events.Limit
      description: Limit number of events to show.
    description: Perform an ICEBRG datastore event search
  - name: icebrg-get-history
    arguments: []
    outputs:
    - contextPath: Icebrg.UserQueryHistory.Total
      description: Total user queries.
    - contextPath: Icebrg.UserQueryHistory.Timestamp
      description: Timestamp of user query.
    - contextPath: Icebrg.UserQueryHistory.Query
      description: Called query.
    - contextPath: Icebrg.UserQueryHistory.QueryId
      description: ID of query.
    - contextPath: Icebrg.UserQueryHistory.UserId
      description: User ID.
    description: Gets history of the events
  - name: icebrg-saved-searches
    arguments: []
    outputs:
    - contextPath: Icebrg.SavedSearches.Tags
      description: Query tags.
    - contextPath: Icebrg.SavedSearches.Description
      description: Query description.
    - contextPath: Icebrg.SavedSearches.Title
      description: Query title.
    - contextPath: Icebrg.SavedSearches.Timestamp
      description: Query timestamp.
    - contextPath: Icebrg.SavedSearches.Query
      description: Called query.
    - contextPath: Icebrg.SavedSearches.Id
      description: Query ID.
    description: Gets user saved searches
  - name: icebrg-get-reports
    arguments:
    - name: limit
      description: The maximum number of records to return. The default is no limit.
    - name: offset
      description: The number of records to skip past. The default is none.
    - name: sort_by
      description: The field to sort by created, updated, or published. The default is unsorted.
    - name: sort_order
      description: The sort order asc or desc. The default is asc if sort_by is provided.
    - name: account_uuid
      description: UUID of account to filter by.
    - name: archived
      description: Archived status to filter by.
    - name: confidence
      auto: PREDEFINED
      predefined:
      - low
      - moderate
      - high
      description: Confidence to filter by (low, moderate, high).
    - name: risk
      auto: PREDEFINED
      predefined:
      - low
      - moderate
      - high
      description: Risk to filter by (low, moderate, high).
    - name: search
      description: Text string to search on title and summary.
    - name: status
      description: Status to filter by.
    - name: published_start
      description: Published start date to filter by (inclusive). RFC3339 format, i.e. 2017-01-24T10:13:13.418Z.
    - name: published_end
      description: Published end date to filter by (exclusive). RFC3339 format, i.e. 2017-01-24T10:13:13.418Z.
    outputs:
    - contextPath: Icebrg.Reports.Publishes.UserUuid
      description: User UUID that published the report.
    - contextPath: Icebrg.Reports.Publishes.Published
      description: Timestamp of published report.
    - contextPath: Icebrg.Reports.AssetCount
      description: Asset count of report.
    - contextPath: Icebrg.Reports.IndicatorCount
      description: Indicator count of report.
    - contextPath: Icebrg.Reports.Archived
      description: True if archived, else false.
    - contextPath: Icebrg.Reports.Details
      description: Report details.
    - contextPath: Icebrg.Reports.Summary
      description: Report summary.
    - contextPath: Icebrg.Reports.Category
      description: Category of the report.
    - contextPath: Icebrg.Reports.Confidence
      description: Confidence of report.
    - contextPath: Icebrg.Reports.Risk
      description: Risk of report.
    - contextPath: Icebrg.Reports.Title
      description: Report title.
    - contextPath: Icebrg.Reports.Status
      description: Status of report.
    - contextPath: Icebrg.Reports.AccountUuid
      description: Account UUID of report.
    - contextPath: Icebrg.Reports.UpdatedUserUuid
      description: User UUID that updated the report.
    - contextPath: Icebrg.Reports.CreatedUserUuid
      description: User UUID that created the report.
    - contextPath: Icebrg.Reports.Updated
      description: Timestamp of report update.
    - contextPath: Icebrg.Reports.Created
      description: Timestamp of report creation.
    - contextPath: Icebrg.Reports.Uuid
      description: Report UUID.
    description: Gets a list of reports
  - name: icebrg-get-report-indicators
    arguments:
    - name: report_uuid
      required: true
      default: true
      description: Report UUID to get indicator of.
    outputs:
    - contextPath: Icebrg.ReportIndicators.Type
      description: Type of indicator.
    - contextPath: Icebrg.ReportIndicators.Indicators.Observable
      description: Observable of Indicator.
    description: Gets indicators for a reports
  - name: icebrg-get-report-assets
    arguments:
    - name: report_uuid
      required: true
      default: true
      description: Report UUID to get asset of.
    outputs:
    - contextPath: Icebrg.ReportAssets.Asset
      description: Assets of Report UUID.
    description: Gets impacted assets for a report
  isfetch: true
tests:
- Icebrg Test
fromversion: 5.0.0