Imperva Skyfence

The Imperva Skyfence Cloud Gateway is a Cloud Access Security Broker (CASB) that provides visibility and control over sanctioned and unsanctioned cloud apps to enable their safe and productive use.

Network Security · Imperva Skyfence

Details

ID	`Imperva Skyfence`
Provider	Forcepoint
Category	Network Security
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

The Imperva Skyfence Cloud Gateway is a Cloud Access Security Broker (CASB) that provides visibility and control over sanctioned and unsanctioned cloud apps to enable their safe and productive use.
This integration was integrated and tested with version 1.0.8 of Imperva Skyfence

Configure Imperva Skyfence in Cortex

Parameter	Required
Server URL (e.g., 123.168.01.222)	True
Client ID	False
Client ID	False
Client Secret	False
Client Secret	False
Trust any certificate (not secure)	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

imp-sf-list-endpoints

Returns a list of, and basic details for, all managed and un-managed endpoints.

Base Command

imp-sf-list-endpoints

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

imp-sf-set-endpoint-status

Updates the status (enroll or revoke) of an endpoint. You can run this command on an endpoint with any status, but the most common use case is endpoints with a status of pending.

Base Command

imp-sf-set-endpoint-status

Input

Argument Name	Description	Required
endpointId	The ID of the endpoint. Run the “imp-sf-list-endpoints” command to return a list.	Required
action	Enroll/Revoke endpoint status. Can be “enroll” or “revoke”.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g., 123.168.01.222) (required)
clientId — Client ID
clientSecret — Client Secret
credentials — Client ID
insecure — Trust any certificate (not secure)

Commands (2)

imp-sf-list-endpoints
Returns a list of, and basic details for, all managed and un-managed endpoints.
imp-sf-set-endpoint-status
Updates the status (enroll or revoke) of an endpoint. You can run this command on an endpoint with any status, but the most common use case is endpoints with a status of pending.

Source

ImpervaSkyfence.js ImpervaSkyfence.yml ImpervaSkyfence_description.md

Download History Raw

To use the Imperva Skyfence integration, you need to retrieve your credentials, and generate an authentication to use for all requests.

## Get your credentials
In the Skyfence platform, the customer ID is the "Client ID", and the password is the "Client Secret".
- To obtain these credentials, go to the Skyfence platform and navigate to **Settings > API**.

## Generate an authentication token
All API requests require authentication. The authentication model is OAuth 2.0, which requires an authentication token. To receive an authentication token, the client performs
a token request by providing a customer ID and password. The received token is used in all requests.

Important/:/ The Client Secret is displayed only during the initial use. Make sure you copy the Client Secret for further reference.