IllusiveNetworks

The Illusive Attack Management API allows customers to retrieve detected incidents with a forensics timeline, attack surface insights, collect forensics on-demand, and manage a variety of operations with regard to deceptive entities, deception policies, and more.

Deception & Breach Simulation · Illusive Networks

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • api_token — API Token (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_time — The initial time to fetch from
  • has_forensics — Fetch only incidents with forensics

Commands (20)

  • illusive-add-deceptive-servers

    Add or approve deceptive servers.

  • illusive-add-deceptive-users

    Add or approve deceptive users.

  • illusive-assign-host-to-policy

    Assign a deception policy to domain hosts.

  • illusive-delete-deceptive-servers

    Delete deceptive servers.

  • illusive-delete-deceptive-users

    Delete deceptive users.

  • illusive-get-asm-cj-insight

    Retrieve Crown-Jewels insights from Attack Surface Manager.

  • illusive-get-asm-host-insight

    Retrieve the specified host insights from Attack Surface Manager.

  • illusive-get-deceptive-servers

    Retrieve a list of all deceptive servers.

  • illusive-get-deceptive-users

    Retrieve a list of all deceptive users.

  • illusive-get-event-incident-id

    Retrieve the incident ID of an event.

  • illusive-get-forensics-analyzers

    Retrieve Illusive's forensics analyzers on a certain event.

  • illusive-get-forensics-artifacts

    Retrieve forensics artifacts from Illusive's forensics.

  • illusive-get-forensics-timeline

    Retrieve forensics timeline for a specific incident.

  • illusive-get-forensics-triggering-process-info

    Retrieve the triggering process information from Illusive's forensics.

  • illusive-get-incident-events

    Retrieve all the events that are associated with an incident.

  • illusive-get-incidents

    Retrieve incidents.

  • illusive-is-deceptive-server

    Retrieve whether a specified server is deceptive.

  • illusive-is-deceptive-user

    Retrieve whether a specified user is deceptive.

  • illusive-remove-host-from-policy

    Remove deception policy assignment from domain hosts.

  • illusive-run-forensics-on-demand

    Collect forensics on a specified host and retrieve the forensics timeline.