Imperva Skyfence

The Imperva Skyfence Cloud Gateway is a Cloud Access Security Broker (CASB) that provides visibility and control over sanctioned and unsanctioned cloud apps to enable their safe and productive use.

Network Security · Imperva Skyfence

Details

ID	`Imperva Skyfence`
Provider	Forcepoint
Category	Network Security
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

The Imperva Skyfence Cloud Gateway is a Cloud Access Security Broker (CASB) that provides visibility and control over sanctioned and unsanctioned cloud apps to enable their safe and productive use.
This integration was integrated and tested with version 1.0.8 of Imperva Skyfence

Configure Imperva Skyfence in Cortex

Parameter	Required
Server URL (e.g., 123.168.01.222)	True
Client ID	False
Client ID	False
Client Secret	False
Client Secret	False
Trust any certificate (not secure)	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

imp-sf-list-endpoints

Returns a list of, and basic details for, all managed and un-managed endpoints.

Base Command

imp-sf-list-endpoints

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

imp-sf-set-endpoint-status

Updates the status (enroll or revoke) of an endpoint. You can run this command on an endpoint with any status, but the most common use case is endpoints with a status of pending.

Base Command

imp-sf-set-endpoint-status

Input

Argument Name	Description	Required
endpointId	The ID of the endpoint. Run the “imp-sf-list-endpoints” command to return a list.	Required
action	Enroll/Revoke endpoint status. Can be “enroll” or “revoke”.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g., 123.168.01.222) (required)
clientId — Client ID
clientSecret — Client Secret
credentials — Client ID
insecure — Trust any certificate (not secure)

Commands (2)

imp-sf-list-endpoints
Returns a list of, and basic details for, all managed and un-managed endpoints.
imp-sf-set-endpoint-status
Updates the status (enroll or revoke) of an endpoint. You can run this command on an endpoint with any status, but the most common use case is endpoints with a status of pending.

Source

ImpervaSkyfence.js ImpervaSkyfence.yml ImpervaSkyfence_description.md

Download History Raw

if (typeof params.insecure === 'string' || !params.insecure) {
    params.insecure = params.insecure === 'true' ? true : false;
}
var fixUrl = function(url) {
    fixedUrl = '';
    if (url.indexOf("http") !== 0) {
        if (params.insecure) {
            fixedUrl = 'http://' + url;
        } else {
            fixedUrl = 'https://' + url;
        }
    }
    return fixedUrl;
};
var parseResponse = function(resp) {
    var res = null;
    if (resp.StatusCode >= 200 && resp.StatusCode < 300) {
        try {
            res = JSON.parse(resp.Body);
        } catch (e) {
            res = resp.Body;
        }
    } else {
      err = resp.Status;
      if (resp.Body) {
          err += '\n' + resp.Body;
      }
      throw err;
    }
    if (res && res.length && res.length > 1 ) {
        // response body is array, then put it into object
        // we don't want to return array
        return { result: res };
    } else if (res && res.length === 0) {
        return {};
    } else {
        return res;
    }
};
var url = fixUrl(params.url);
var login = function(params) {
    var fullUrl = fixUrl(params.url) + '/cm/api/v1.0/oauth2/token';
    var body = {
        grant_type: 'client_credentials',
        client_id: params.credentials ? params.credentials.identifier : params.clientId,
        client_secret: params.credentials ? params.credentials.password : params.clientSecret
    };
    var res = httpMultipart(
        fullUrl,
        '',
        {
            Method: 'POST'
        },
        body,
        params.insecure
    );
    return parseResponse(res);
};
var listEndpoints = function(url, token) {
    var fullUrl = fixUrl(url) + '/cm/api/v1.0/endpoint';
    var res = http(
        fullUrl,
        {
            Method: 'GET',
            Headers: {'Authorization': ['Bearer ' + token]}
        },
        params.insecure
    );
    return parseResponse(res);
};
var setEndpointStatus = function(url, token, endpointId, action) {
    // validate action
    // action can be "enroll" or "revoke"
    if (action !== 'enroll' && action !== 'revoke') {
        throw 'action must be "enroll" or "revoke"!';
    }
    var fullUrl = fixUrl(url) + '/cm/api/v1.0/endpoint/' + endpointId;
    var res = http(
        fullUrl,
        {
            Method: 'POST',
            Headers: {
                'Authorization': ['Bearer ' + token],
                'Content-Type': ['application/json']
            },
            Body: JSON.stringify({
                action: action
            })
        },
        params.insecure
    );
    parseResponse(res);
    return 'Success';
};
switch(command) {
    case 'test-module':
        login(params);
        return true;
    case 'imp-sf-list-endpoints':
        var loginRes = login(params);
        return listEndpoints(params.url, loginRes.access_token);
    case 'imp-sf-set-endpoint-status':
        var loginRes = login(params);
        return setEndpointStatus(params.url, loginRes.access_token, args.endpointId, args.action);
    default:
        return true;
}