IllusiveNetworks

Details

ID	`IllusiveNetworks`
Provider	Proofpoint Inc
Category	Deception & Breach Simulation
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Overview

The Illusive Attack Management API allows customers to retrieve detected incidents with a forensics timeline, attack surface insights, collect forensics on-demand, and manage a variety of operations with regard to deceptive entities, deception policies, and more.
This integration was integrated and tested with version 130 of IllusiveNetworks

Configure IllusiveNetworks on Cortex XSOAR

Use Cases

Automatically collect data and forensics from new incidents detected by Illusive
Enrich SOC data by retrieving a rich set of incident and forensics information, including: 1) host details and forensics from a potentially compromised host, 2) a forensics timeline, 3) forensics analysis, 4) additional data
Auto-analyze collected data and calculate incident severity to speed up SOC response times
Collect forensics from any compromised host and retrieve a forensics timeline
Retrieve detailed lists of approved and suggested deceptive servers and users
Approve, delete, and query deceptive entities
Manage deception policy assignments per host
Retrieve attack surface insights for Crown Jewels and specific hosts

Configure IllusiveNetworks on Cortex XSOAR

Illusive Console

Open the Illusive Management console, navigate to Settings > General, and locate the API KEYS section. Generate a new API key with all permissions and copy the token at the end of the process.

Cortex XSOAR Console

Navigate to Settings > Integrations > Servers & Services.
Search for IllusiveNetworks.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
url	Server URL (e.g. https://example.net)	True
api_token	API Token	True
isFetch	Fetch incidents	False
incidentType	Incident type	False
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False
fetch_time	The initial time to fetch from	False
has_forensics	Fetch only incidents with forensics	True

Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

{
“sourceIp”: “10.90.10.25”,
“sourceOperatingSystem”: null,
“policyName”: null,
“incidentTypes”: [“DECEPTION”],
“riskInsights”: {“stepsToDomainAdmin”: null, “stepsToCrownJewel”: null},
“deceptionFamilies”: [“FAMILY_TYPE_BROWSERS”],
“lastSeenUser”: null,
“closed”: false,
“unread”: true,
“flagged”: false,
“hasForensics”: false,
“incidentId”: 32,
“incidentTimeUTC”: “2020-05-04T11:37:10.231Z”,
“sourceHostname”: null,
“userNotes”: null
}

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

illusive-get-forensics-timeline
illusive-get-asm-host-insight
illusive-get-asm-cj-insight
illusive-get-deceptive-users
illusive-get-deceptive-servers
illusive-is-deceptive-user
illusive-is-deceptive-server
illusive-add-deceptive-users
illusive-add-deceptive-servers
illusive-delete-deceptive-users
illusive-delete-deceptive-servers
illusive-assign-host-to-policy
illusive-remove-host-from-policy
illusive-run-forensics-on-demand
illusive-get-incidents
illusive-get-event-incident-id
illusive-get-incident-events
illusive-get-forensics-analyzers
illusive-get-forensics-triggering-process-info
illusive-get-forensics-artifacts

illusive-get-forensics-timeline

Retrieve forensics timeline for a specific incident

Base Command

illusive-get-forensics-timeline

Input

Argument Name	Description	Required
incident_id	The desired incident ID	Required
start_date	The starting date of the forensics timeline.	Optional
end_date	The last date of the forensics timeline.	Optional

Context Output

Path	Type	Description
Illusive.Forensics.Evidence.details	String	The forensics evidence details
Illusive.Forensics.Evidence.eventId	String	The event ID
Illusive.Forensics.Evidence.id	String	The forensics evidence ID
Illusive.Forensics.Evidence.source	String	The Evidence source
Illusive.Forensics.Evidence.starred	Boolean	Whether the forensics evidence has been starred
Illusive.Forensics.Evidence.time	Date	Date and time of the forensics evidence
Illusive.Forensics.Evidence.title	String	The forensics evidence description
Illusive.Forensics.IncidentId	String	The Incident Id
Illusive.Forensics.Status	String	The process progress ( Done, InProgress)
Illusive.Forensics.Evidence.date	Date	The forensics evidence date

Command Example

illusive-get-forensics-timeline incident_id=80 start_date=”10 days” end_date=”3 hours”

Human Readable Output

date	details	eventId	id	source	starred	time	title	type
2020-06-29 09:16:17.480	id: 4 date: 2020-06-29 09:16:17.480 type: LOGIN sourceIP: 172.27.102.12 trap: hr injectedUserName: dgffg injectedPassword: **** destinationIpAddress: 172.27.102.6 serviceType: WEB data: Is Successful Login: false, Accept-language: en-US,en;q=0.9, Web Protocol: HTTP, Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9, Web Host: 172.27.102.6, Web Url: /, Authorization: Digest username=”dgffg”, realm=”Domain Name”, nonce=”1593422172658:ad3f7cc0c86b52747fba1d68583c3827”, uri=”/”, response=”9f5d4174395c7d09460fc88e454713aa”, opaque=”9AC5ADA4A6317F9FB4F2B1211D8A7EFE”, qop=auth, nc=00000002, cnonce=”b000143183c56904”, Web Body: , Web Method: GET, Upgrade-insecure-requests: 1, Web User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36, Connection: keep-alive, Cache-control: max-age=0, Accept-encoding: gzip, deflate hasForensics: No title: WEB login attempt with the username dgffg to the deceptive URL 172.27.102.6/	4	d59f0b0a-4a66-40d0-9565-563adc7534f1	MANAGEMENT	false	1593422177480	WEB login attempt with the username dgffg to the deceptive URL 172.27.102.6/	EVENT

illusive-get-asm-host-insight

Retrieve the specified host insights from Attack Surface Manager

Base Command

illusive-get-asm-host-insight

Input

Argument Name	Description	Required
hostnameOrIp	The hostname or IP address of the desired host	Required

Context Output

Path	Type	Description
Illusive.AttackSurfaceInsightsHost.DomainName	String	The host domain
Illusive.AttackSurfaceInsightsHost.HostName	String	The host hostname
Illusive.AttackSurfaceInsightsHost.HostType	String	The host type (Server, Workstation, Other)
Illusive.AttackSurfaceInsightsHost.IpAddresses	String	The host IP address
Illusive.AttackSurfaceInsightsHost.OperatingSystemName	String	The host operating system name
Illusive.AttackSurfaceInsightsHost.OperatingSystemVersion	String	The host operating system version
Illusive.AttackSurfaceInsightsHost.OrganizationalUnit	String	The host Active Directory Organizational Unit
Illusive.AttackSurfaceInsightsHost.SourceConnectivityExposure	Number	The host Source Connectivity Exposure to crown jewels and domain user credentials

Command Example

illusive-get-asm-host-insight hostnameOrIp=172.27.139.12

Human Readable Output

Illusive ASM Host Insights

domainName	hostName	hostType	ipAddresses	operatingSystemName	operatingSystemVersion	organizationalUnit	sourceConnectivityExposure
illusive.com	win5.illusive.com	Workstation	172.27.139.12,::1,fe80::ffff:ffff:fffe,fe80::2d2d:5763:8c1a:7b9	Windows 10		clients	0.0

illusive-get-asm-cj-insight

Retrieve Crown-Jewels insights from Attack Surface Manager

Base Command

illusive-get-asm-cj-insight

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
Illusive.AttackSurfaceInsightsCrownJewel.data	Unknown	The number of connections to this Crown Jewel per service type
Illusive.AttackSurfaceInsightsCrownJewel.hostname	String	The crown jewel hostname
Illusive.AttackSurfaceInsightsCrownJewel.machineTagAndSubTags.tag	String	The List of a crown jewel category and subcategory couplings
Illusive.AttackSurfaceInsightsCrownJewel.MachineTagAndSubTags.subTag	String	The List of a crown jewel category and subcategory couplings
Illusive.AttackSurfaceInsightsCrownJewel.targetExposureRank	Number	The crown jewel target exposure

Command Example

illusive-get-asm-cj-insight

Human Readable Output

Illusive ASM Crown Jewels Insights

data	hostname	machineTagAndSubTags	targetExposureRank
{‘key’: ‘RDP’, ‘value’: 1}	172.27.139.12	{‘tag’: ‘Mainframe’, ‘subTag’: ‘MAINFRAME’}	0.0

illusive-get-deceptive-users

Retrieve a list of all deceptive users

Base Command

illusive-get-deceptive-users

Input

Argument Name	Description	Required
type	The status of the desired deceptive users (APPROVED, SUGGESTED, ALL)	Optional

Context Output

Path	Type	Description
Illusive.DeceptiveUser.userName	String	The deceptive user name
Illusive.DeceptiveUser.domainName	String	The deceptive user domain
Illusive.DeceptiveUser.policyNames	Unknown	The deception policies the deceptive user is assigned to
Illusive.DeceptiveUser.password	String	The deceptive user password
Illusive.DeceptiveUser.deceptiveState	String	The deceptive user state (APPROVED, SUGGESTED, ALL)
Illusive.DeceptiveUser.adUser	Boolean	Whether the deceptive user is a genuine user in Active Directory
Illusive.DeceptiveUser.activeUser	Boolean	In case the deceptive user is a real AD user, indicates whether he is active

Command Example

!illusive-get-deceptive-users type=APPROVED

Human Readable Output

Illusive Deceptive Users

activeUser	adUser	deceptiveState	domainName	password	policyNames	username
false	false	APPROVED	illusive.com	Password	Full Protection	user1
false	false	APPROVED	illusive.com	Password	Full Protection	user2

illusive-get-deceptive-servers

Retrieve a list of all deceptive servers

Base Command

illusive-get-deceptive-servers

Input

Argument Name	Description	Required
type	The status of the desired deceptive servers (APPROVED, SUGGESTED, ALL)	Optional

Context Output

Path	Type	Description
Illusive.DeceptiveServer.host	String	The deceptive server hostname
Illusive.DeceptiveServer.policyNames	String	The deception policies the deceptive server is assigned to
Illusive.DeceptiveServer.adHost	Boolean	Whether the deceptive server is a genuine machine in Active Directory
Illusive.DeceptiveServer.deceptiveState	String	The deceptive server state (APPROVED, SUGGESTED, ALL)
Illusive.DeceptiveServer.serviceTypes	String	The deception services the deceptive server is assigned to

Command Example

!illusive-get-deceptive-servers type=APPROVED

Human Readable Output

Illusive Deceptive Servers

adHost	deceptiveState	host	policyNames	serviceTypes
false	APPROVED	server1.illusive.com	adiPo, Full Protection	SHARE, DB
false	APPROVED	server2.illusive.com	Full Protection	WEB, DB
false	APPROVED	server3.illusive.com	adiPo, Full Protection	FTP, SHARE, DB

illusive-is-deceptive-user

Retrieve whether a specified user is deceptive

Base Command

illusive-is-deceptive-user

Input

Argument Name	Description	Required
username	The username to be verified	Required

Context Output

Path	Type	Description
Illusive.IsDeceptive.Username	String	The checked username
Illusive.IsDeceptive.IsDeceptiveUser	Boolean	Is the specified user conducted as a deceptive user

Command Example

!illusive-is-deceptive-user username=user1

Human Readable Output

Illusive Is Deceptive

IsDeceptiveUser	Username
true	user1

illusive-is-deceptive-server

Retrieve whether a specified server is deceptive

Base Command

illusive-is-deceptive-server

Input

Argument Name	Description	Required
hostname	The server hostname to be verified	Required

Context Output

Path	Type	Description
Illusive.IsDeceptive.IsDeceptiveServer	Boolean	Is the specified server conducted as a deceptive server
Illusive.IsDeceptive.Hostname	String	The checked server hostname

Command Example

!illusive-is-deceptive-server hostname=server5.illusive.com

Human Readable Output

Illusive Is Deceptive

Hostname	IsDeceptiveServer
server5.illusive.com	false

illusive-add-deceptive-users

Add or approve deceptive users

Base Command

illusive-add-deceptive-users

Input

Argument Name	Description	Required
domain_name	The deceptive user domain	Required
password	The deceptive user password	Required
policy_names	The deception policies to be assigned to the new deceptive user	Optional
username	The deceptive user name	Required

Context Output

There is no context output for this command.

Command Example

!illusive-add-deceptive-users domain_name=illusive.com password=pass username=user3

Human Readable Output

Illusive Add Deceptive User Succeeded

domainName	password	policyNames	userName
illusive.com	pass	All Policies	user3

illusive-add-deceptive-servers

Add or approve deceptive servers

Base Command

illusive-add-deceptive-servers

Input

Argument Name	Description	Required
host	The deceptive server hostname	Required
policy_names	The deception policies to be assigned to the new deceptive server	Optional
service_types	The deception services to be assigned to the new deceptive server	Required

Context Output

There is no context output for this command.

Command Example

!Set key=”serviceTypes” value=”FTP”

!Set key=”serviceTypes” value=”SSH” append=true

!illusive-add-deceptive-servers host=server4.illusive.com service_types=${serviceTypes}

Human Readable Output

Illusive Add Deceptive Server Succeeded

host	policyNames	serviceTypes
server4.illusive.com	All Policies	FTP, SSH

illusive-delete-deceptive-users

Delete deceptive users

Base Command

illusive-delete-deceptive-users

Input

Argument Name	Description	Required
deceptive_users	The list of deceptive users to delete	Required

Context Output

There is no context output for this command.

Command Example

!illusive-delete-deceptive-users deceptive_users=user3

Human Readable Output

Deceptive User [‘user3’] was successfully Deleted

illusive-delete-deceptive-servers

Delete deceptive servers

Base Command

illusive-delete-deceptive-servers

Input

Argument Name	Description	Required
deceptive_hosts	The list of deceptive servers to delete	Required

Context Output

There is no context output for this command.

Command Example

!Set key=”servers” value=”server5.illusive.com”

!Set key=”servers” value=”server1.illusive.com” append=true

!illusive-delete-deceptive-servers deceptive_hosts=${servers}

Human Readable Output

Deceptive Servers [‘server5.illusive.com’, ‘server1.illusive.com’] were successfully Deleted

illusive-assign-host-to-policy

Assign a deception policy to domain hosts

Base Command

illusive-assign-host-to-policy

Input

Argument Name	Description	Required
policy_name	Policy name to assign	Required
hosts	List of hosts to assign, in the following format: machine@domain. Maximum number of hosts is 1000.	Required

Context Output

There is no context output for this command.

Command Example

!illusive-assign-host-to-policy hosts=WIN7@illusive.com policy_name=”Full Protection”

Human Readable Output

Illusive Assign Machines to Policy Succeeded

hosts	isAssigned	policy_name
WIN7@illusive.com	true	Full Protection

illusive-remove-host-from-policy

Remove deception policy assignment from domain hosts

Base Command

illusive-remove-host-from-policy

Input

Argument Name	Description	Required
hosts	List of hosts to remove policy assignment from, in the following format: machine@domain. Maximum number of hosts is 1000	Required

Context Output

There is no context output for this command.

Command Example

!illusive-remove-host-from-policy hosts=WIN7@illusive.com

Human Readable Output

Illusive Remove Machines from All Policies Succeeded

hosts	isAssigned	policy_name
WIN7@illusive.com	false

illusive-run-forensics-on-demand

Collect forensics on a specified host and retrieve the forensics timeline

Base Command

illusive-run-forensics-on-demand

Input

Argument Name	Description	Required
fqdn_or_ip	The host fqdn or IP address on which to collect forensics	Required

Context Output

Path	Type	Description
Illusive.Event.eventId	Number	The created event ID of the operation

Command Example

!illusive-run-forensics-on-demand fqdn_or_ip=172.27.139.12

Human Readable Output

Illusive Run Forensics On Demand

eventId
123

illusive-get-incidents

Retrieve incidents

Base Command

illusive-get-incidents

Input

Argument Name	Description	Required
incident_id	The desired incident ID to retrieve. If specified - other arguments are ignored and only a single incident can be retrieved	Optional
hostnames	The list of hostnames to retrieve incidents	Optional
has_forensics	Whether to retrieve incidents with forensics only	Optional
limit	Use offset and limit for pagination. The maximum limit is 100.	Optional
offset	Use offset and limit for pagination.	Optional
start_date	start date	Optional

Context Output

Command Example

!illusive-get-incidents incident_id=28

Human Readable Output

Illusive Incidents

closed	deceptionFamilies	flagged	hasForensics	incidentId	incidentTimeUTC	incidentTypes	lastSeenUser	policyName	riskInsights	sourceHostname	sourceIp	sourceOperatingSystem	unread	userNotes
false	FAMILY_TYPE_BROWSERS	false	false	28	2020-04-20T06:44:33.207Z	DECEPTION			stepsToDomainAdmin: null stepsToCrownJewel: null		172.27.139.14		false

illusive-get-event-incident-id

Retrieve the incident ID of an event

Base Command

illusive-get-event-incident-id

Input

Argument Name	Description	Required
event_id	The Event id	Required

Context Output

Path	Type	Description
Illusive.Event.incidentId	Number	The Incident ID
Illusive.Event.eventId	Number	The given event ID
Illusive.Event.status	String	The status command ( Done, InProgress)

Command Example

!illusive-get-event-incident-id event_id=80

Human Readable Output

Illusive Get Incident

eventId	incidentId	status
80	72	Done

illusive-get-incident-events

Retrieve all the events that are associated with an incident

Base Command

illusive-get-incident-events

Input

Argument Name	Description	Required
incident_id	The incident ID on which to retrieve the associated events	Required
limit	The maximum number of events to retrieve	Optional
offset	Use offset and limit for pagination	Optional

Context Output

Path	Type	Description
Illusive.Incident.incidentId	Number	The corresponding incident ID
Illusive.Incident.eventsNumber	Number	The number of associated events
Illusive.Incident.Event.eventId	Number	The event ID
Illusive.Incident.Event.eventTimeUTC	Date	The event time
Illusive.Incident.Event.hasForensics	Boolean	Whether the event has forensics

Command Example

!illusive-get-incident-events incident_id=2

Human Readable Output

Illusive get incident’s events

eventId	eventTimeUTC	hasForensics
4	2020-06-29T09:16:17.480Z	false
3	2020-06-29T09:16:17.464Z	false
2	2020-06-29T09:16:12.673Z	false

illusive-get-forensics-analyzers

Retrieve Illusive’s forensics analyzers on a certain event

Base Command

illusive-get-forensics-analyzers

Input

Argument Name	Description	Required
event_id	The event ID to retrieve the forensics analyzers from	Required

Context Output

Path	Type	Description
Illusive.Event.incidentId	Number	The corresponding incident ID
Illusive.Event.eventId	Number	The corresponding event ID
Illusive.Event.ForensicsAnalyzers.analyzerName	String	The forensics analyzer name
Illusive.Event.ForensicsAnalyzers.analyzerValue	String	The forensics analyzer description

Command Example

!illusive-get-forensics-analyzers event_id=2

Human Readable Output

Illusive Forensics Analyzers

analyzerName	analyzerValue
Summary	An attempt to browse to the deceptive URL hr (172.27.102.6) was detected from 172.27.102.12
Event Source And Destination	Event ID: 2 Event time: 2020-06-29T09:16:12.673Z Event originated from 172.27.102.12 Event targeted hr (172.27.102.6)
Web	A GET request was made to the url `http://172.27.102.6/`
Forensics Failure Reason	No resolving for host 172.27.102.12

illusive-get-forensics-triggering-process-info

Retrieve the triggering process information from Illusive’s forensics

Base Command

illusive-get-forensics-triggering-process-info

Input

Argument Name	Description	Required
event_id	The event ID to retrieve the triggering process information from	Required

Context Output

Path	Type	Description
Illusive.Event.incidentId	Number	The corresponding incident ID
Illusive.Event.eventId	Number	The corresponding event ID
Illusive.Event.ForensicsTriggeringProcess.commandLine	String	The triggering process command line
Illusive.Event.ForensicsTriggeringProcess.connectionsNum	Number	The triggering process active connections
Illusive.Event.ForensicsTriggeringProcess.md5	String	The triggering process md5
Illusive.Event.ForensicsTriggeringProcess.sha256	String	The triggering process sha256
Illusive.Event.ForensicsTriggeringProcess.name	String	The triggering process name
Illusive.Event.ForensicsTriggeringProcess.parent	String	The parent process of the triggering process
Illusive.Event.ForensicsTriggeringProcess.path	String	The triggering process path
Illusive.Event.ForensicsTriggeringProcess.startTime	Date	The triggering process start time

Command Example

!illusive-get-forensics-triggering-process-info event_id=5

Human Readable Output

Illusive Triggering Processes Info

commandLine	connectionsNum	md5	name	parent	path	sha256	startTime
“C:\Program Files (x86)\Google\Chrome\Application\chrome.exe” –type=utility –field-trial-handle=1472,8764100348922490764,5250110531070070503,131072 –lang=en-US –service-sandbox-type=network –enable-audio-service-sandbox –mojo-platform-channel-handle=1900 /prefetch:8	15	9E46D108805A743D2D88D04019370A05	chrome.exe	chrome.exe(7848)	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	D7771E5F5090EF37BE554D5DD9E1C24C8CD83EBF284C48CC5D1EF45D02C0E77F	2020-06-29T09:16:47.245+00:00

illusive-get-forensics-artifacts

Retrieve forensics artifacts from Illusive’s forensics

Base Command

illusive-get-forensics-artifacts

Input

Argument Name	Description	Required
event_id	The event ID to retrieve the forensics artifacts from	Required
artifact_type	The type of forensics artifact to retrieve	Required

Context Output

There is no context output for this command.

Command Example

!illusive-get-forensics-artifacts event_id=2

Human Readable Output

event id 2 has no artifacts

Configuration parameters

url — Server URL (e.g. https://example.net) (required)
api_token — API Token (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
fetch_time — The initial time to fetch from
has_forensics — Fetch only incidents with forensics

Commands (20)

illusive-add-deceptive-servers
Add or approve deceptive servers.
illusive-add-deceptive-users
Add or approve deceptive users.
illusive-assign-host-to-policy
Assign a deception policy to domain hosts.
illusive-delete-deceptive-servers
Delete deceptive servers.
illusive-delete-deceptive-users
Delete deceptive users.
illusive-get-asm-cj-insight
Retrieve Crown-Jewels insights from Attack Surface Manager.
illusive-get-asm-host-insight
Retrieve the specified host insights from Attack Surface Manager.
illusive-get-deceptive-servers
Retrieve a list of all deceptive servers.
illusive-get-deceptive-users
Retrieve a list of all deceptive users.
illusive-get-event-incident-id
Retrieve the incident ID of an event.
illusive-get-forensics-analyzers
Retrieve Illusive's forensics analyzers on a certain event.
illusive-get-forensics-artifacts
Retrieve forensics artifacts from Illusive's forensics.
illusive-get-forensics-timeline
Retrieve forensics timeline for a specific incident.
illusive-get-forensics-triggering-process-info
Retrieve the triggering process information from Illusive's forensics.
illusive-get-incident-events
Retrieve all the events that are associated with an incident.
illusive-get-incidents
Retrieve incidents.
illusive-is-deceptive-server
Retrieve whether a specified server is deceptive.
illusive-is-deceptive-user
Retrieve whether a specified user is deceptive.
illusive-remove-host-from-policy
Remove deception policy assignment from domain hosts.
illusive-run-forensics-on-demand
Collect forensics on a specified host and retrieve the forensics timeline.

Source

IllusiveNetworks.py IllusiveNetworks_test.py IllusiveNetworks.yml IllusiveNetworks_description.md

Download History Raw

category: Deception & Breach Simulation
provider: Proofpoint Inc
sectionorder:
- Connect
- Collect
commonfields:
  id: IllusiveNetworks
  version: -1
configuration:
- defaultvalue: https://example.net
  display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: API Token
  name: api_token
  required: true
  type: 4
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 3 days
  display: The initial time to fetch from
  name: fetch_time
  type: 0
  section: Collect
  required: false
- defaultvalue: ALL
  display: Fetch only incidents with forensics
  name: has_forensics
  options:
  - 'True'
  - 'False'
  - ALL
  required: false
  type: 15
  section: Collect
description: The Illusive Attack Management API allows customers to retrieve detected incidents with a forensics timeline, attack surface insights, collect forensics on-demand, and manage a variety of operations with regard to deceptive entities, deception policies, and more.
display: IllusiveNetworks
name: IllusiveNetworks
script:
  commands:
  - arguments:
    - description: The desired incident ID.
      name: incident_id
      required: true
    - description: The starting date of the forensics timeline.
      name: start_date
    - description: The last date of the forensics timeline.
      name: end_date
    description: Retrieve forensics timeline for a specific incident.
    name: illusive-get-forensics-timeline
    outputs:
    - contextPath: Illusive.Forensics.Evidence.details
      description: The forensics evidence details.
      type: String
    - contextPath: Illusive.Forensics.Evidence.eventId
      description: The event ID.
      type: String
    - contextPath: Illusive.Forensics.Evidence.id
      description: The forensics evidence ID.
      type: String
    - contextPath: Illusive.Forensics.Evidence.source
      description: The Evidence source.
      type: String
    - contextPath: Illusive.Forensics.Evidence.starred
      description: Whether the forensics evidence has been starred.
      type: Boolean
    - contextPath: Illusive.Forensics.Evidence.time
      description: 'Date and time of the forensics evidence.'
      type: Date
    - contextPath: Illusive.Forensics.Evidence.title
      description: The forensics evidence description.
      type: String
    - contextPath: Illusive.Forensics.IncidentId
      description: The Incident Id.
      type: String
    - contextPath: Illusive.Forensics.Status
      description: The process progress ( Done, InProgress).
      type: String
    - contextPath: Illusive.Forensics.Evidence.date
      description: The forensics evidence date.
      type: Date
  - arguments:
    - description: The hostname or IP address of the desired host.
      name: hostnameOrIp
      required: true
    description: Retrieve the specified host insights from Attack Surface Manager.
    name: illusive-get-asm-host-insight
    outputs:
    - contextPath: Illusive.AttackSurfaceInsightsHost.DomainName
      description: The host domain.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsHost.HostName
      description: The host hostname.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsHost.HostType
      description: The host type (Server, Workstation, Other).
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsHost.IpAddresses
      description: The host IP address.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsHost.OperatingSystemName
      description: The host operating system name.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsHost.OperatingSystemVersion
      description: The host operating system version.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsHost.OrganizationalUnit
      description: The host Active Directory Organizational Unit.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsHost.SourceConnectivityExposure
      description: The host Source Connectivity Exposure to crown jewels and domain user credentials.
      type: Number
  - description: Retrieve Crown-Jewels insights from Attack Surface Manager.
    name: illusive-get-asm-cj-insight
    outputs:
    - contextPath: Illusive.AttackSurfaceInsightsCrownJewel.data
      description: The number of connections to this Crown Jewel per service type.
      type: Unknown
    - contextPath: Illusive.AttackSurfaceInsightsCrownJewel.hostname
      description: The crown jewel hostname.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsCrownJewel.machineTagAndSubTags.tag
      description: The List of a crown jewel category and subcategory couplings.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsCrownJewel.MachineTagAndSubTags.subTag
      description: The List of a crown jewel category and subcategory couplings.
      type: String
    - contextPath: Illusive.AttackSurfaceInsightsCrownJewel.targetExposureRank
      description: The crown jewel target exposure.
      type: Number
  - arguments:
    - auto: PREDEFINED
      defaultValue: ALL
      description: The status of the desired deceptive users (APPROVED, SUGGESTED, ALL).
      name: type
      predefined:
      - ALL
      - SUGGESTED
      - APPROVED
    description: Retrieve a list of all deceptive users.
    name: illusive-get-deceptive-users
    outputs:
    - contextPath: Illusive.DeceptiveUser.userName
      description: The deceptive user name.
      type: String
    - contextPath: Illusive.DeceptiveUser.domainName
      description: The deceptive user domain.
      type: String
    - contextPath: Illusive.DeceptiveUser.policyNames
      description: The deception policies the deceptive user is assigned to.
      type: Unknown
    - contextPath: Illusive.DeceptiveUser.password
      description: The deceptive user password.
      type: String
    - contextPath: Illusive.DeceptiveUser.deceptiveState
      description: The deceptive user state (APPROVED, SUGGESTED, ALL).
      type: String
    - contextPath: Illusive.DeceptiveUser.adUser
      description: Whether the deceptive user is a genuine user in Active Directory.
      type: Boolean
    - contextPath: Illusive.DeceptiveUser.activeUser
      description: In case the deceptive user is a real AD user, indicates whether he is active.
      type: Boolean
  - arguments:
    - auto: PREDEFINED
      defaultValue: ALL
      description: The status of the desired deceptive servers (APPROVED, SUGGESTED, ALL).
      name: type
      predefined:
      - ALL
      - SUGGESTED
      - APPROVED
    description: Retrieve a list of all deceptive servers.
    name: illusive-get-deceptive-servers
    outputs:
    - contextPath: Illusive.DeceptiveServer.host
      description: The deceptive server hostname.
      type: String
    - contextPath: Illusive.DeceptiveServer.policyNames
      description: The deception policies the deceptive server is assigned to.
      type: String
    - contextPath: Illusive.DeceptiveServer.adHost
      description: Whether the deceptive server is a genuine machine in Active Directory.
      type: Boolean
    - contextPath: Illusive.DeceptiveServer.deceptiveState
      description: The deceptive server state (APPROVED, SUGGESTED, ALL).
      type: String
    - contextPath: Illusive.DeceptiveServer.serviceTypes
      description: The deception services the deceptive server is assigned to.
      type: String
  - arguments:
    - description: The username to be verified.
      name: username
      required: true
    description: Retrieve whether a specified user is deceptive.
    name: illusive-is-deceptive-user
    outputs:
    - contextPath: Illusive.IsDeceptive.Username
      description: The checked username.
      type: String
    - contextPath: Illusive.IsDeceptive.IsDeceptiveUser
      description: Is the specified user conducted as a deceptive user.
      type: Boolean
  - arguments:
    - description: The server hostname to be verified.
      name: hostname
      required: true
    description: Retrieve whether a specified server is deceptive.
    name: illusive-is-deceptive-server
    outputs:
    - contextPath: Illusive.IsDeceptive.IsDeceptiveServer
      description: Is the specified server conducted as a deceptive server.
      type: Boolean
    - contextPath: Illusive.IsDeceptive.Hostname
      description: The checked server hostname.
      type: String
  - arguments:
    - description: The deceptive user domain.
      name: domain_name
      required: true
    - description: The deceptive user password.
      name: password
      required: true
    - description: The deception policies to be assigned to the new deceptive user.
      isArray: true
      name: policy_names
    - description: The deceptive user name.
      name: username
      required: true
    description: Add or approve deceptive users.
    name: illusive-add-deceptive-users
  - arguments:
    - description: The deceptive server hostname.
      name: host
      required: true
    - description: The deception policies to be assigned to the new deceptive server.
      isArray: true
      name: policy_names
    - description: The deception services to be assigned to the new deceptive server.
      isArray: true
      name: service_types
      required: true
    description: Add or approve deceptive servers.
    name: illusive-add-deceptive-servers
  - arguments:
    - description: The list of deceptive users to delete.
      isArray: true
      name: deceptive_users
      required: true
    description: Delete deceptive users.
    name: illusive-delete-deceptive-users
  - arguments:
    - description: The list of deceptive servers to delete.
      isArray: true
      name: deceptive_hosts
      required: true
    description: Delete deceptive servers.
    name: illusive-delete-deceptive-servers
  - arguments:
    - description: Policy name to assign.
      name: policy_name
      required: true
    - description: |-
        List of hosts to assign, in the following format: machine@domain.
        Maximum number of hosts is 1000.
      name: hosts
      required: true
    description: Assign a deception policy to domain hosts.
    name: illusive-assign-host-to-policy
  - arguments:
    - description: |-
        List of hosts to remove policy assignment from, in the following format: machine@domain.
        Maximum number of hosts is 1000.
      name: hosts
      required: true
    description: Remove deception policy assignment from domain hosts.
    name: illusive-remove-host-from-policy
  - arguments:
    - description: The host fqdn or IP address on which to collect forensics.
      name: fqdn_or_ip
      required: true
    description: Collect forensics on a specified host and retrieve the forensics timeline.
    name: illusive-run-forensics-on-demand
    outputs:
    - contextPath: Illusive.Event.eventId
      description: 'The created event ID of the operation.'
      type: Number
  - arguments:
    - description: |-
        The desired incident ID to retrieve.
        If specified - other arguments are ignored and only a single incident can be retrieved.
      name: incident_id
    - description: The list of hostnames to retrieve incidents.
      isArray: true
      name: hostnames
    - auto: PREDEFINED
      description: Whether to retrieve incidents with forensics only.
      name: has_forensics
      predefined:
      - 'True'
      - 'False'
    - description: |-
        Use offset and limit for pagination.
        The maximum limit is 100.
      name: limit
    - description: Use offset and limit for pagination.
      name: offset
    - description: start date.
      name: start_date
    description: Retrieve incidents.
    name: illusive-get-incidents
    outputs:
    - contextPath: Illusive.Incident.closed
      description: Whether the incident has been closed.
      type: Boolean
    - contextPath: Illusive.Incident.deceptionFamilies
      description: |-
        The deception families of the
        deceptions used to trigger
        the incident.
      type: String
    - contextPath: Illusive.Incident.flagged
      description: Whether the incident has been flagged.
      type: Boolean
    - contextPath: Illusive.Incident.hasForensics
      description: Whether incident has forensics.
      type: Boolean
    - contextPath: Illusive.Incident.incidentId
      description: The Incident ID.
      type: Number
    - contextPath: Illusive.Incident.incidentTimeUTC
      description: Date and time of the incident.
      type: Date
    - contextPath: Illusive.Incident.incidentTypes
      description: Type of events detected.
      type: Unknown
    - contextPath: Illusive.Incident.lastSeenUser
      description: The user who last reviewed the incident.
      type: String
    - contextPath: Illusive.Incident.policyName
      description: The compromised host's policy.
      type: String
    - contextPath: Illusive.Incident.riskInsights.stepsToCrownJewel
      description: The compromised host's lateral distance from Crown Jewels.
      type: Number
    - contextPath: Illusive.Incident.riskInsights.stepsToDomainAdmin
      description: The compromised host's lateral distance from domain admin accounts.
      type: Number
    - contextPath: Illusive.Incident.sourceHostname
      description: The compromised host's name.
      type: String
    - contextPath: Illusive.Incident.sourceIp
      description: The compromised host's IP address.
      type: String
    - contextPath: Illusive.Incident.sourceOperatingSystem
      description: The compromised host's operating system.
      type: String
    - contextPath: Illusive.Incident.unread
      description: Whether the incident has been read.
      type: Boolean
    - contextPath: Illusive.Incident.userNotes
      description: The analyst's comments.
      type: String
  - arguments:
    - description: The Event id.
      isArray: true
      name: event_id
      required: true
    description: Retrieve the incident ID of an event.
    name: illusive-get-event-incident-id
    outputs:
    - contextPath: Illusive.Event.incidentId
      description: The Incident ID.
      type: Number
    - contextPath: Illusive.Event.eventId
      description: The given event ID.
      type: Number
    - contextPath: Illusive.Event.status
      description: The status command ( Done, InProgress).
      type: String
  - arguments:
    - description: The incident ID on which to retrieve the associated events.
      name: incident_id
      required: true
    - description: The maximum number of events to retrieve.
      name: limit
    - description: Use offset and limit for pagination.
      name: offset
    description: Retrieve all the events that are associated with an incident.
    name: illusive-get-incident-events
    outputs:
    - contextPath: Illusive.Incident.incidentId
      description: The corresponding incident ID.
      type: Number
    - contextPath: Illusive.Incident.eventsNumber
      description: The number of associated events.
      type: Number
    - contextPath: Illusive.Incident.Event.eventId
      description: The event ID.
      type: Number
    - contextPath: Illusive.Incident.Event.eventTimeUTC
      description: The event time.
      type: Date
    - contextPath: Illusive.Incident.Event.hasForensics
      description: Whether the event has forensics.
      type: Boolean
  - arguments:
    - description: The event ID to retrieve the forensics analyzers from.
      name: event_id
      required: true
    description: Retrieve Illusive's forensics analyzers on a certain event.
    name: illusive-get-forensics-analyzers
    outputs:
    - contextPath: Illusive.Event.incidentId
      description: The corresponding incident ID.
      type: Number
    - contextPath: Illusive.Event.eventId
      description: The corresponding event ID.
      type: Number
    - contextPath: Illusive.Event.ForensicsAnalyzers.analyzerName
      description: The forensics analyzer name.
      type: String
    - contextPath: Illusive.Event.ForensicsAnalyzers.analyzerValue
      description: The forensics analyzer description.
      type: String
  - arguments:
    - description: The event ID to retrieve the triggering process information from.
      name: event_id
      required: true
    description: Retrieve the triggering process information from Illusive's forensics.
    name: illusive-get-forensics-triggering-process-info
    outputs:
    - contextPath: Illusive.Event.incidentId
      description: The corresponding incident ID.
      type: Number
    - contextPath: Illusive.Event.eventId
      description: The corresponding event ID.
      type: Number
    - contextPath: Illusive.Event.ForensicsTriggeringProcess.commandLine
      description: The triggering process command line.
      type: String
    - contextPath: Illusive.Event.ForensicsTriggeringProcess.connectionsNum
      description: The triggering process active connections.
      type: Number
    - contextPath: Illusive.Event.ForensicsTriggeringProcess.md5
      description: The triggering process md5.
      type: String
    - contextPath: Illusive.Event.ForensicsTriggeringProcess.sha256
      description: The triggering process sha256.
      type: String
    - contextPath: Illusive.Event.ForensicsTriggeringProcess.name
      description: The triggering process name.
      type: String
    - contextPath: Illusive.Event.ForensicsTriggeringProcess.parent
      description: The parent process of the triggering process.
      type: String
    - contextPath: Illusive.Event.ForensicsTriggeringProcess.path
      description: The triggering process path.
      type: String
    - contextPath: Illusive.Event.ForensicsTriggeringProcess.startTime
      description: The triggering process start time.
      type: Date
  - arguments:
    - description: The event ID to retrieve the forensics artifacts from.
      name: event_id
      required: true
    - auto: PREDEFINED
      defaultValue: DESKTOP_SCREENSHOTS
      description: 'The type of forensics artifact to retrieve.'
      name: artifact_type
      predefined:
      - DESKTOP_SCREENSHOTS
      required: true
    description: Retrieve forensics artifacts from Illusive's forensics.
    name: illusive-get-forensics-artifacts
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
defaultmapperin: Illusive Networks-mapper
defaultclassifier: Illusive Networks
fromversion: 5.0.0
tests:
- No tests (auto formatted)