Jask Deprecated
Deprecated. Use Sumo Logic Cloud SIEM instead. Freeing the analyst with autonomous decisions.
Analytics & SIEM · Jask (Deprecated)
Details
| ID | Jask |
|---|---|
| Provider | Francisco Partners |
| Category | Analytics & SIEM |
| From Version | 5.0.0 |
| Docker Image | demisto/python:2.7.18.20958 |
| Supported Modules | Agentix |
README
Deprecated. Use Sumo Logic Cloud SIEM integration instead. For further details about the migration, visit our Sumo Logic SIEM integration documentation.
Overview
Use the JASK integration to manage entities, signals, and insights.
Configure the JASK Integration on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for JASK.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Fetch incidents
- Incident type
- Use system proxy settings
- Override default fetch query
- Click Test to validate the URLs and token
Fetched Incidents Data
The integration fetches insights. The first fetch returns insights from the previous 24 hour period. By default, the fetch will fetch all insights with the status new and in-progress. This is a sample default query: workflow_status:(new OR inprogress). You can modify the default query in the Override default fetch query parameter.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
- Get details for an insight: jask-get-insight-details
- Get comments for an insight: jask-get-insight-comments
- Get details for a signal: jask-get-signal-details
- Get details for an entity: jask-get-entity-details
- Get related entities: jask-get-related-entities
- Get a list of entities on allow list: jask-get-whitelisted-entities
- Search JASK insights: jask-search-insights
- Search JASK signals: jask-search-signals
- Search JASK entities: jask-search-entities
1. Get details for an insight
Note: This command is deprecated. Use `sumologic-sec-insight-get-details` command in Sumo Logic SIEM integration. For further details, visit our Sumo Logic SIEM integration documentation.
Returns detailed information for a specified insight.
Base Command
jask-get-insight-details
Input
| Parameter | Description |
|---|---|
| insight-id | The insight to retrieve details for |
Context Output
| Path | Description |
|---|---|
| Jask.Insight.Id | Insight ID |
| Jask.Insight.Name | Insight name |
| Jask.Insight.Action | Insight action |
| Jask.Insight.Entity | The main entity related to the insight |
| Jask.Insight.AssignedTo | Who the insight was assigned to |
| Jask.Insight.Description | Insight description |
| Jask.Insight.IpAddress | Insight IP address |
| Jask.Insight.LastUpdated | The time the insight was last updated |
| Jask.Insight.LastUpdatedBy | The last person to update the insight |
| Jask.Insight.Severity | Insight severity |
| Jask.Insight.InsightTime | The time of the insight |
| Jask.Insight.WorkflowStatus | Insight status |
| Jask.Insight.RelatedEntityList.Id | The ID of the related entity |
| Jask.Insight.RelatedEntityList.EntityType | Related entity type |
| Jask.Insight.RelatedEntityList.Hostname | The hostname of the related entity |
| Jask.Insight.SignalList.Id | Signal ID |
| Jask.Insight.SignalList.Name | Signal name |
| Jask.Insight.SignalList.Category | Signal category |
| Jask.Insight.SignalList.SourceType | The source of the signal |
| Jask.Insight.SignalListMetadata.Patterns.Count | Number of signals of the category pattern |
| Jask.Insight.SignalListMetadata.Anomalies.Count | Number of signals of the category anomaly |
| Jask.Insight.SignalListMetadata.ThreatIntel.Count | Number of signals of the category threat intelligence |
| Jask.Insight.RelatedEntityList.IpAddress | IP address of the related entity |
| Jask.Insight.RelatedEntityList.IsWhitelisted | Whether or not the entity is on allow list |
| Jask.Insight.RelatedEntityList.RiskScore | The risk score of the related entity |
| Jask.Insight.RelatedEntityList.Source | The source of the related entity |
Command Example
!jask-get-insight-details insight-id="7ead8dc9-d541-3484-9320-ea593729e7cc"
Context Example
{
"Jask": {
"Insight": {
"SignalListMetadata": {
"Patterns": {
"Count": 4
},
"ThreatIntel": {
"Count": 0
},
"Anomalies": {
"Count": 0
}
},
"WorkflowStatus": "new",
"Description": "Exfiltration, C2 Risk Score: 14",
"IpAddress": "104.236.54.196",
"Severity": 2,
"RelatedEntityList": [],
"LastUpdated": "2018-07-13T05:17:55.620330",
"EntityDetails": {
"EntityType": "ip",
"Name": "^^^104.236.54.196^^^",
"RiskScore": 9,
"Hostname": "Unknown",
"Source": "discovery",
"LastSeen": "Sun, 05 Aug 2018 10:00:56 GMT",
"PrimaryEntityType": null,
"IpAddress": "^^^104.236.54.196^^^",
"Id": "7ead8dc9-d541-3484-9320-ea593729e7cc",
"FirstSeen": "Wed, 14 Feb 2018 19:54:31 GMT"
},
"InsightTime": "2018-07-11T18:59:12",
"Id": "7ead8dc9-d541-3484-9320-ea593729e7cc",
"SignalList": [
{
"Category": "Exfiltration",
"Name": "Hexadecimal in DNS Query Domain",
"Timestamp": "2018-07-11T19:06:14",
"ThreatIndicators": [
{
"Value": "analytics-9dd8570e3fd957ce828c34761a8e98b8.xyz",
"IndicatorType": "hostname"
}
],
"Score": "2",
"Description": "Encoding in hexadecimal is a way that attackers can bypass network security devices that are inspecting traffic. While hexadecimal often appears in subdomains, it much less frequent in domains.",
"Id": "b7f76616-f27b-5c18-b503-2d3dbab1bb96",
"SourceType": "rule"
},
{
"Category": "C2",
"Name": "TeslaCrypt Ransomware Domain",
"Timestamp": "2018-07-11T19:51:16",
"ThreatIndicators": [
{
"Value": "o4dm3.leaama.at",
"IndicatorType": "hostname"
}
],
"Score": "6",
"Description": "TeslaCrypt is a ransomware that encrypts documents, databases, code, bitcoin wallets and more. This rule looks for DNS queries that include domains known to be associated with TeslaCrypt.",
"Id": "67b2ba91-9c32-5ffb-9587-873ef68f7899",
"SourceType": "rule"
},
{
"Category": "C2",
"Name": "TeslaCrypt Ransomware Domain",
"Timestamp": "2018-07-11T19:51:17",
"ThreatIndicators": [
{
"Value": "kbv5s.kylepasse.at",
"IndicatorType": "hostname"
}
],
"Score": "6",
"Description": "TeslaCrypt is a ransomware that encrypts documents, databases, code, bitcoin wallets and more. This rule looks for DNS queries that include domains known to be associated with TeslaCrypt.",
"Id": "26fc053b-ad5f-5f39-8e48-12feb39b77d2",
"SourceType": "rule"
},
{
"Category": "C2",
"Name": "TorrentLocker Ransomware Domain",
"Timestamp": "2018-07-11T19:51:19",
"ThreatIndicators": [
{
"Value": "mz7oyb3v32vshcvk.tormidle.at",
"IndicatorType": "hostname"
}
],
"Score": "6",
"Description": "TorrentLocker is a ransomware that encrypts documents, databases, code, bitcoin wallets and more. This rule looks for DNS queries that include domains known to be associated with TorrentLocker.",
"Id": "7ed97e33-73fd-599c-9c55-6c89aa0e7bf3",
"SourceType": "rule"
}
],
"Name": "Possible Malware - Ransomware (TeslaCrypt) and Data Exfiltration"
}
}
}
Human Readable Output
2. Get comments for an insight
Note: This command is deprecated. Use `sumologic-sec-insight-get-comments` command in Sumo Logic SIEM integration. For further details, visit our Sumo Logic SIEM integration documentation.
Returns comments for a specified insight.
Base Command
jask-get-insight-comments
Input
| Parameter | Description |
|---|---|
| insight-id | The insight to retrieve comments for |
Context Output
| Path | Description |
|---|---|
| Jask.InsightCommentList.id | Comment ID |
| Jask.InsightCommentList.InsightId | Insight ID |
| Jask.InsightCommentList.Author | Author of comment |
| Jask.InsightCommentList.Body | Comment body |
| Jask.InsightCommentList.LastUpdated | The date the comment was last updated |
| Jask.InsightCommentList.Timestamp | The time of the comment |
Command Example
asdf
Context Example
asdf
Human Readable Output
asdf
3. Get details for a signal
Note: This command is deprecated. Use `sumologic-sec-signal-get-details` command in Sumo Logic SIEM integration. For further details, visit our Sumo Logic SIEM integration documentation.
Returns detailed information for a specified signal.
Base Command
jask-get-signal-details
Input
| Parameter | Description |
|---|---|
| signal-id | The signal to retrieve details for |
Context Output
| Path | Description |
|---|---|
| Jask.Signal.Id | Signal ID |
| Jask.Signal.Name | Signal name |
| Jask.Signal.Category | Signal category |
| Jask.Signal.Description | Signal description |
| Jask.Signal.Score | Signal score |
| Jask.Signal.SourceType | The source type of the signal |
| Jask.Signal.Timestamp | The time of the signal |
| Jask.Signal.Metadata.RecordType | Record type |
| Jask.Signal.Metadata.RecordCount | The associated count of each record type |
| Jask.SignalThreatIndicators.IndicatorType | Threat indicator type |
| Jask.Signal.ThreatIndicators.Value | Value of the threat indicator |
Command Example
!jask-get-signal-details signal-id=b7f76616-f27b-5c18-b503-2d3dbab1bb96
Context Example
{
"Jask": {
"Signal": {
"Category": "Exfiltration",
"SourceType": "rule",
"Name": "Hexadecimal in DNS Query Domain",
"Timestamp": "2018-07-11T19:06:14",
"ThreatIndicators": [
{
"Value": "analytics-9dd8570e3fd957ce828c34761a8e98b8.xyz",
"IndicatorType": "hostname"
}
],
"Score": "2",
"Description": "Encoding in hexadecimal is a way that attackers can bypass network security devices that are inspecting traffic. While hexadecimal often appears in subdomains, it much less frequent in domains.",
"Id": "b7f76616-f27b-5c18-b503-2d3dbab1bb96",
"Metadata": [
{
"RecordType": "flow",
"RecordCount": 0
},
{
"RecordType": "notice",
"RecordCount": 0
},
{
"RecordType": "http",
"RecordCount": 0
}
]
}
}
}
Human Readable Output
4. Get details for an entity
Note: This command is deprecated. Use `sumologic-sec-entity-get-details` command in Sumo Logic SIEM integration. For further details, visit our Sumo Logic SIEM integration documentation.
Returns detailed information about a speficied entity.
Base Command
jask-get-entity-details
Input
| Parameter | Description |
|---|---|
| entity-id | The entity to retrieve details for |
Context Output
| Path | Description |
|---|---|
| Jask.Entity.Id | Entity ID |
| Jask.Entity.Name | Entity name |
| Jask.Entity.IpAddress | Entity IP address |
| Jask.Entity.FirstSeen | Time the entity was first seen |
| Jask.Entity.LastSeen | Time the entity was last seen |
| Jask.Entity.Source | The source of the entity |
| Jask.Entity.AssetType | Asset type |
| Jask.Entity.PrimaryAssetType | Primary asset type |
| Jask.Entity.HostName | Hostname |
| Jask.Entity.RiskScore | Risk score |
| Jask.Entity.IsWhiteListed | Whether or not the entity is on allow list |
Command Example
!jask-get-entity-details entity-id=d07ef37f-06c1-58c3-a7a0-c1cd0fa4cd8e
Context Example
{
"Jask": {
"Entity": {
"Name": "craig.campbell",
"EntityType": "username",
"PrimaryEntityType": "hostname",
"Source": "ad",
"LastSeen": "Sun, 05 Aug 2018 10:30:18 GMT",
"Groups": [
"CN=Remote Desktop Users,CN=Builtin,DC=corp,DC=skaj,DC=ai"
],
"Id": "d07ef37f-06c1-58c3-a7a0-c1cd0fa4cd8e",
"FirstSeen": "Thu, 01 Mar 2018 16:52:50 GMT"
}
}
}
Human Readable Output
5. Get related entities
Note: This command is deprecated and will not be supported in Sumo Logic SIEM. For further details, visit our Sumo Logic SIEM integration documentation.
Get all related entities for the specified entity.
Base Command
jask-get-related-entities
Input
| Parameter | Description |
|---|---|
| entity-id | The entity ID that the related entities are retrieved for |
Context Output
| Path | Description |
|---|---|
| Jask.RelatedEntityList.Id | Entity ID |
| Jask.RelatedEntityList.Name | Entity name |
| Jask.RelatedEntityList.Email | Entity email |
| Jask.RelatedEntityList.Source | Entity source |
| Jask.RelatedEntityList.UserName | Username of the related entity |
| Jask.RelatedEntityList.HostName | Entity hostname |
| Jask.RelatedEntityList.Active | Whether or not the entity is active |
| Jask.RelatedEntityList.Admin | Entity admin |
| Jask.RelatedEntityList.AssetType | Asset type |
| Jask.RelatedEntityList.CreatedTimestamp | Time the entity was created |
| Jask.RelatedEntityList.FirstSeen | Time the entity was first seen |
| Jask.RelatedEntityList.GivenName | Name given to the entity |
| Jask.RelatedEntityList.IsWhiteListed | Whether or not the entity is on allow list |
| Jask.RelatedEntityList.LastSeen | Time the entity was last seen |
| Jask.RelatedEntityList.LastName | The last name |
| Jask.RelatedEntityList.RiskScore | Entity risk score |
Command Example
!jask-get-related-entities entity-id=d5d04bc6-c00a-4a9a-a8f5-6f6231f55d80
Context Example
{
"Jask": {
"RelatedEntityList": [
{
"Username": "craig.campbell",
"Name": "craig.campbell",
"LastName": "Campbell",
"EntityType": "username",
"Id": "d07ef37f-06c1-58c3-a7a0-c1cd0fa4cd8e",
"CreatedTimestamp": "2018-01-23T05:01:38",
"Source": "ad",
"LastSeen": "2018-08-05T10:30:18",
"Groups": [
"CN=Remote Desktop Users,CN=Builtin,DC=corp,DC=skaj,DC=ai"
],
"Active": true,
"GivenName": "Craig",
"Email": "example.gmail.com",
"FirstSeen": "2018-03-01T16:52:50"
},
{
"EntityType": "hostname",
"Name": "sea-dt5820-357.corp.skaj.ai",
"Hostname": "sea-dt5820-357.corp.skaj.ai",
"Source": "ad",
"LastSeen": "2018-08-05T10:30:38",
"Groups": [
"CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=corp,DC=skaj,DC=ai",
"CN=Cert Publishers,CN=Users,DC=corp,DC=skaj,DC=ai"
],
"Id": "7d63f14f-81c0-5442-9de1-6061404bcbd7",
"FirstSeen": "2018-02-15T16:04:35"
}
]
}
}
Human Readable Output
6. Get a list of entities on allow list
Note: This command is deprecated and will not be supported in Sumo Logic SIEM. For further details, visit our Sumo Logic SIEM integration documentation.
Returns a list of all entities on allow list.
Base Command
jask-get-whitelisted-entities
Input
There are no inputs for this command.
Context Output
| Path | Description |
|---|---|
| Jask.Whitelisted.EntityList.Id | ID of the entity on allow list |
| Jask.Whitelisted.EntityList.Name | Name of the entity on allow list |
| Jask.Whitelisted.EntityList.UserName | Username of the entity on allow list |
| Jask.Whitelisted.EntityList.ModelId | The modelID of the entity on allow list |
| Jask.Whitelisted.EntityList.Timestamp | Time of the entity on allow list |
| Jask.Whitelisted.EntityList.Metadata.TotalCount | Number of entities on allow list |
Command Example
!jask-get-whitelisted-entities
Context Example
{
"Jask": {
"WhiteListed": {
"EntityList": [
{
"UserName": "demisto",
"Timestamp": "2018-05-31T21:20:45.302635",
"Name": "wittes-imac-pro.local",
"Id": "e0a7172f-aa5d-4ba9-ae66-b49d99d9b4e7",
"ModelId": "e0a7172f-aa5d-4ba9-ae66-b49d99d9b4e7"
},
{
"UserName": "demisto",
"Timestamp": "2018-05-31T21:12:54.003527",
"Name": "172.18.20.20",
"Id": "d5d04bc6-c00a-4a9a-a8f5-6f6231f55d80",
"ModelId": "d5d04bc6-c00a-4a9a-a8f5-6f6231f55d80"
},
{
"UserName": "demisto",
"Timestamp": "2018-05-31T21:20:37.218586",
"Name": "192.168.2.195",
"Id": "306360bb-57d2-4a8d-a882-a7b3f2b92429",
"ModelId": "306360bb-57d2-4a8d-a882-a7b3f2b92429"
}
],
"Metadata": {
"TotalCount": 3
}
}
}
}
Human Readable Output
7. Search JASK insights
Note: This command is deprecated. Use `sumologic-sec-insight-search` command in Sumo Logic SIEM integration. For further details, visit our Sumo Logic SIEM integration documentation.
Search for JASK insights according to specific criteria.
Base Command
jask-search-insights
Input
| Parameter | Description |
|---|---|
| last-seen | When the insight was last seen. Defaults to 'All time' if no time arguments are specified. |
| rating | Comma-separated list of values between 1-5 (inclusive) |
| status | Comma-separated list of values (new, inprogress, closed) |
| assigned-team | Comma-separated list of values |
| assigned-user | Comma-separated list of values |
| offset | The page offset for the results |
| limit | How many results to retrieve |
| sort | What to sort the results by |
| time-from | Start time for the search (MM/DD/YYYY) |
| time-to | End time for the search (MM/DD/YYYY) |
Context Output
| Path | Description |
|---|---|
| Jask.Insight.Id | Insight ID |
| Jask.Insight.Name | Insight name |
| Jask.Insight.Action | The action to take on the insight |
| Jask.Insight.AssignedTo | Who the insight was assigned to |
| Jask.Insight.Description | Insight description |
| Jask.Insight.IpAddress | Insight IP address |
| Jask.Insight.LastUpdated | When the insight was last updated |
| Jask.Insight.LastUpdatedBy | Who the insight was last updated by |
| Jask.Insight.Severity | Insight severity |
| Jask.Insight.InsightTime | Time of the insight |
| Jask.WorkflowStatus | Insight status |
Command Example
!jask-search-insights last-seen="Last 48 hours" limit=2 assigned-user=unassigned
Context Example
{
"Jask": {
"Insight": [
{
"WorkflowStatus": "new",
"Description": "Multiple signals related to lateral movement with other anomalies and threats.",
"InsightTime": "2018-08-04T11:06:14",
"LastUpdated": "2018-08-04T11:06:15.373616",
"AssignedTo": "unassigned",
"Severity": 1,
"IpAddress": "172.18.20.20",
"Id": "a01f689c-f7da-4838-bf5c-2046f1736aff",
"Name": "Insider Threat - Lateral Movement with Increased Traffic"
},
{
"WorkflowStatus": "new",
"Description": "Multiple signals related to user, network and other threats.",
"InsightTime": "2018-08-04T11:05:12",
"LastUpdated": "2018-08-04T11:05:13.654486",
"AssignedTo": "unassigned",
"Severity": 1,
"IpAddress": "^^^172.18.20.20^^^",
"Id": "88cd2086-126f-4e95-a6c5-dde91f86afb6",
"Name": "User Anomalies with Beaconing Behavior"
}
]
}
}
Human Readable Output
8. Search JASK signals
Note: This command is deprecated. Use `sumologic-sec-signal-search` command in Sumo Logic SIEM integration. For further details, visit our Sumo Logic SIEM integration documentation.
Search for JASK signals according to specific criteria.
Base Command
jask-search-signals
Input
| Parameter | Description |
|---|---|
| last-seen | When the insight was last seen. Defaults to 'All time' if no time arguments are specified. |
| source | Comma-separated list of values (threatintel, rule, anomaly) |
| category | Comma-separated list of values form options (Attack Stage, C2, Defense Evasion, Discovery, Exfiltration, Exploitation, External Recon, Internal Recon, Lateral Movement, Threat Intelligence, Traffic Anomaly) |
| offset | The page offset for the results |
| limit | The maximum number of signals to retrieve |
| sort | What to sort the results by |
| time-from | Start time for the search (MM/DD/YYYY) |
| time-to | End time for the search (MM/DD/YYYY) |
Context Output
asdfas
Command Example
!jask-search-signals last-seen="Last 24 hours" category="Attack Stage, C2" offset="0" limit="10" sort="score:desc"
Context Example
{
"Jask": {
"Signal": [
{
"Category": "C2",
"Name": "TeslaCrypt Ransomware Domain",
"Timestamp": "2018-08-04T11:59:26.447586",
"ThreatIndicators": [
{
"Value": "lovemydress.pl",
"IndicatorType": "hostname"
}
],
"Score": "6",
"Description": "TeslaCrypt is a ransomware that encrypts documents, databases, code, bitcoin wallets and more. This rule looks for DNS queries that include domains known to be associated with TeslaCrypt.",
"Id": "79d796dc-97e6-11e8-bdd7-02346534339c",
"SourceType": "rule"
},
{
"Category": "Attack Stage",
"Name": "SSH Password Brute Force",
"Timestamp": "2018-08-04T10:36:35.256445",
"ThreatIndicators": [
{
"Value": "104.236.48.178",
"IndicatorType": "ip"
}
],
"Score": "2",
"Description": "SSH Password brute force attack detected",
"Id": "79d790a6-97e6-11e8-bdc7-02346534339c",
"SourceType": "rule"
},
{
"Category": "Attack Stage",
"Name": "SSH Password Brute Force",
"Timestamp": "2018-08-04T11:24:49.534168",
"ThreatIndicators": [
{
"Value": "^^^104.236.48.178^^^",
"IndicatorType": "ip"
}
],
"Score": "2",
"Description": "SSH Password brute force attack detected",
"Id": "79d78eb2-97e6-11e8-bdc2-02346534339c",
"SourceType": "rule"
}
]
}
}
Human Readable Output
9. Search JASK entities
Note: This command is deprecated. Use `sumologic-sec-entity-search` command in Sumo Logic SIEM integration. For further details, visit our Sumo Logic SIEM integration documentation.
Search for JASK entities according to specific criteria.
Base Command
jask-search-entities
Input
| Parameter | Description |
|---|---|
| last-seen | When the insight was last seen. Defaults to 'All time' if no time arguments are specified. |
| entity-type | Comma-separated list of values (username, hostname, ip) |
| offset | The page offset for the results |
| limit | How many results to retrieve |
| sort | What to sort the results by |
| time-from | Start time for the search(MM/DD/YYYY) |
| time-to | End time for the search (MM/DD/YYYY) |
Context Output
| Path | Description |
|---|---|
| Jask.Entity.Id | Entity ID |
| Jask.Entity.Name | Entity name |
| Jask.Entity.FirstSeen | When the entity was first seen |
| Jask.Entity.LastSeen | When the entity was last seen |
| Jask.Entity.Source | The source of the entity |
| Jask.Entity.EntityType | Entity type |
| Jask.Entity.PrimaryEntityType | The primary entity type |
| Jask.Entity.HostName | Entity hostname |
| Jask.Entity.RiskScore | Entity risk score |
| Jask.Entity.IsWhiteListed | Whether or not the entity is on allow list |
| Jask.Entity.Groups | The groups of the entity |
| Jask.Entity.Ip.Address | Entity IP address |
Command Example
!jask-search-entities entity-type=ip limit=3 time-from=08/04/2018 time-to=08/05/2018
Context Example
{
"Jask": {
"Entity": [
{
"EntityType": "ip",
"Name": "112.175.209.72",
"Hostname": "Unknown",
"Source": "discovery",
"PrimaryEntityType": null,
"IpAddress": "^^^112.175.209.72^^^",
"Id": "68fe56f0-4cbc-4664-9227-868069607636"
},
{
"EntityType": "ip",
"Name": "186.185.91.72",
"Hostname": "Unknown",
"Source": "discovery",
"PrimaryEntityType": null,
"IpAddress": "^^^186.185.91.72^^^",
"Id": "ada67af4-a7c1-45f4-9740-69b095ffdac6"
},
{
"EntityType": "ip",
"Name": "105.102.75.16",
"Hostname": "Unknown",
"Source": "discovery",
"PrimaryEntityType": null,
"IpAddress": "^^^105.102.75.16^^^",
"Id": "b3e40046-0450-48a4-8752-6a20aec89143"
}
]
}
}
Human Readable Output
Configuration parameters
URL— Server URL (required)Username— Username (required)APIKey— API Key (required)isFetch— Fetch incidentsincidentType— Incident typeinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsfetchQuery— Override default fetch queryfetchLimit— Limit the maximum incidents amount per fetch
Commands (9)
-
jask-get-entity-detailsGet entity details for a specific entity ID
-
jask-get-insight-commentsGet comments for a specific Insight ID. (Users can post and update comments on the JASK SIEM portal for any Insight ID.)
-
jask-get-insight-detailsGet Insight details for a specific Insight ID. Insight details command references SmartAlerts, which are the highest level abstractions in JASK SIEM consisting of multiple signals, and records and relating to one or more assets.
-
jask-get-related-entitiesGet entities related to a specific entity ID.
-
jask-get-signal-detailsGet Signal details for a specific Signal ID. Signal details command references signals in JASK which are created when records exhibit suspicious properties and mate with patterns or other detection logic.
-
jask-get-whitelisted-entitiesGet the entities on allow list.
-
jask-search-entitiesSearch entities using the given filters.
-
jask-search-insightsSearch insights using the given filters.
-
jask-search-signalsSearch signals using the given filters.
category: Analytics & SIEM provider: Francisco Partners commonfields: id: Jask version: -1 configuration: - display: Server URL name: URL required: true type: 0 - display: Username name: Username required: true type: 0 - display: API Key name: APIKey required: true type: 4 - display: Fetch incidents name: isFetch type: 8 required: false - display: Incident type name: incidentType type: 13 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - display: Override default fetch query name: fetchQuery type: 0 required: false - defaultvalue: '100' display: Limit the maximum incidents amount per fetch name: fetchLimit type: 0 required: false description: Deprecated. Use Sumo Logic Cloud SIEM instead. Freeing the analyst with autonomous decisions. display: Jask (Deprecated) name: Jask script: commands: - arguments: - default: true description: The insight to retrieve details for name: insight-id required: true description: Get Insight details for a specific Insight ID. Insight details command references SmartAlerts, which are the highest level abstractions in JASK SIEM consisting of multiple signals, and records and relating to one or more assets. name: jask-get-insight-details outputs: - contextPath: Jask.Insight.Id description: The insight ID type: string - contextPath: Jask.Insight.Name description: The insight name type: string - contextPath: Jask.Insight.Action description: The insight action type: string - contextPath: Jask.Insight.Entity description: The main entity related to the insight type: string - contextPath: Jask.Insight.AssignedTo description: Who the insight was assigned to type: string - contextPath: Jask.Insight.Description description: The insight description type: string - contextPath: Jask.Insight.IpAddress description: The IP address of the insight type: string - contextPath: Jask.Insight.LastUpdated description: The time the insight was last updated type: date - contextPath: Jask.Insight.LastUpdatedBy description: The last person to update the insight type: string - contextPath: Jask.Insight.Severity description: 'The severity of the insight ' type: number - contextPath: Jask.Insight.InsightTime description: The time of the insight type: date - contextPath: Jask.Insight.WorkflowStatus description: The status of the insight type: string - contextPath: Jask.Insight.RelatedEntityList.Id description: The ID of the related entity type: string - contextPath: Jask.Insight.RelatedEntityList.EntityType description: The type of the related entity type: string - contextPath: Jask.Insight.RelatedEntityList.Hostname description: The hostname of the related entity type: string - contextPath: Jask.Insight.SignalList.Id description: The ID of the signal type: string - contextPath: Jask.Insight.SignalList.Name description: The name of the signal type: string - contextPath: Jask.Insight.SignalList.Category description: The category of the signal type: string - contextPath: Jask.Insight.SignalList.SourceType description: The source of the signal type: string - contextPath: Jask.Insight.SignalListMetadata.Patterns.Count description: The number of signals of the category pattern type: number - contextPath: Jask.Insight.SignalListMetadata.Anomalies.Count description: The number of signals of the category anomaly type: number - contextPath: Jask.Insight.SignalListMetadata.ThreatIntel.Count description: The number of signals of the category threat intelligence type: number - contextPath: Jask.Insight.RelatedEntityList.IpAddress description: IP address of related entity type: string - contextPath: Jask.Insight.RelatedEntityList.IsWhitelisted description: Whether or not the entity is on allow list type: boolean - contextPath: Jask.Insight.RelatedEntityList.RiskScore description: The risk score of the related entity type: number - contextPath: Jask.Insight.RelatedEntityList.Source description: The source of the related entity type: string - arguments: - default: true description: 'The insight ID for which to retrieve comments. ' name: insight-id required: true description: Get comments for a specific Insight ID. (Users can post and update comments on the JASK SIEM portal for any Insight ID.) name: jask-get-insight-comments outputs: - contextPath: Jask.InsightCommentList.id description: ID of comment type: string - contextPath: Jask.InsightCommentList.InsightId description: ID of insight type: string - contextPath: Jask.InsightCommentList.Author description: Author of comment type: string - contextPath: Jask.InsightCommentList.Body description: The comment body type: string - contextPath: Jask.InsightCommentList.LastUpdated description: The date the comment was last updated type: date - contextPath: Jask.InsightCommentList.Timestamp description: The time of the comment type: date - arguments: - default: true description: The signal to retrieve details for name: signal-id required: true description: Get Signal details for a specific Signal ID. Signal details command references signals in JASK which are created when records exhibit suspicious properties and mate with patterns or other detection logic. name: jask-get-signal-details outputs: - contextPath: Jask.Signal.Id description: The signal ID type: string - contextPath: Jask.Signal.Name description: The signal name type: string - contextPath: Jask.Signal.Category description: The signal category type: string - contextPath: Jask.Signal.Description description: The signal description type: string - contextPath: Jask.Signal.Score description: The signal score type: number - contextPath: Jask.Signal.SourceType description: The source type of the signal type: string - contextPath: Jask.Signal.Timestamp description: The time of the signal type: date - contextPath: Jask.Signal.Metadata.RecordType description: The record type type: string - contextPath: Jask.Signal.Metadata.RecordCount description: the associated count of each record type type: number - contextPath: Jask.SignalThreatIndicators.IndicatorType description: The type of threat indicator type: string - contextPath: Jask.Signal.ThreatIndicators.Value description: The value of the threat indicator type: string - arguments: - default: true description: The entity to retrieve details for name: entity-id required: true description: Get entity details for a specific entity ID name: jask-get-entity-details outputs: - contextPath: Jask.Entity.Id description: The entity ID type: string - contextPath: Jask.Entity.Name description: The entity name type: string - contextPath: Jask.Entity.IpAddress description: The IP address of the entity type: string - contextPath: Jask.Entity.FirstSeen description: When the entity was first seen type: date - contextPath: Jask.Entity.LastSeen description: The time the entity was last seen type: date - contextPath: Jask.Entity.Source description: The source of the entity type: string - contextPath: Jask.Entity.AssetType description: The asset type type: string - contextPath: Jask.Entity.PrimaryAssetType description: The primary asset type type: string - contextPath: Jask.Entity.HostName description: The hostname type: string - contextPath: Jask.Entity.RiskScore description: The risk score type: number - contextPath: Jask.Entity.IsWhiteListed description: Whether or not the entity is on allow list type: boolean - arguments: - default: true description: 'The entity ID for which the related entities are retrieved. ' name: entity-id required: true description: Get entities related to a specific entity ID. name: jask-get-related-entities outputs: - contextPath: Jask.RelatedEntityList.Id description: The entity ID type: string - contextPath: Jask.RelatedEntityList.Name description: The entity name type: string - contextPath: Jask.RelatedEntityList.Email description: The entity email type: string - contextPath: Jask.RelatedEntityList.Source description: The entity source type: string - contextPath: Jask.RelatedEntityList.UserName description: The username of the related entity type: string - contextPath: Jask.RelatedEntityList.HostName description: The hostname of the entity type: string - contextPath: Jask.RelatedEntityList.Active description: Whether or not the entity is active type: boolean - contextPath: Jask.RelatedEntityList.Admin description: The entity admin type: string - contextPath: Jask.RelatedEntityList.AssetType description: The asset type type: string - contextPath: Jask.RelatedEntityList.CreatedTimestamp description: The time of creation type: date - contextPath: Jask.RelatedEntityList.FirstSeen description: The time the entity was first seen type: date - contextPath: Jask.RelatedEntityList.GivenName description: The name given to the entity type: string - contextPath: Jask.RelatedEntityList.IsWhiteListed description: Whether or not the entity is on allow list type: boolean - contextPath: Jask.RelatedEntityList.LastSeen description: The time the entity was last seen type: date - contextPath: Jask.RelatedEntityList.LastName description: 'The last name ' type: string - contextPath: Jask.RelatedEntityList.RiskScore description: The risk score of the entity type: number - description: Get the entities on allow list. name: jask-get-whitelisted-entities outputs: - contextPath: Jask.Whitelisted.EntityList.Id description: Id of the entity on allow list type: string - contextPath: Jask.Whitelisted.EntityList.Name description: Name of the entity on allow list type: string - contextPath: Jask.Whitelisted.EntityList.UserName description: Username of the entity on allow list type: string - contextPath: Jask.Whitelisted.EntityList.ModelId description: The modelID of the entity on allow list type: string - contextPath: Jask.Whitelisted.EntityList.Timestamp description: The time of the entity on allow list type: date - contextPath: Jask.Whitelisted.EntityList.Metadata.TotalCount description: The number of entities on allow list type: number - arguments: - auto: PREDEFINED description: When the insight was last seen. Defaults to 'All time' if no time arguments are specified. name: last-seen predefined: - All time - Last week - Last 48 hours - Last 24 hours - description: comma separated list of values between 1-5 inclusive name: rating - defaultValue: new,inprogress description: 'comma separated list of values from the options: new, inprogress, closed' name: status - description: comma separated list of values name: assigned-team - description: comma separated list of values name: assigned-user - defaultValue: '0' description: The page offset for the results name: offset - defaultValue: '100' description: How many results to retrieve name: limit - defaultValue: timestamp:desc description: What to sort the results by name: sort - description: The start time for the search in the following string format - MM/DD/YYYY name: time-from - description: The end time for the search in the following string format - MM/DD/YYYY name: time-to description: Search insights using the given filters. name: jask-search-insights outputs: - contextPath: Jask.Insight.Id description: The ID of the insight type: string - contextPath: Jask.Insight.Name description: The name of the insight type: string - contextPath: Jask.Insight.Action description: The action to take on the insight type: string - contextPath: Jask.Insight.AssignedTo description: 'Who the insight was assigned to ' type: string - contextPath: Jask.Insight.Description description: The description of the insight type: string - contextPath: Jask.Insight.IpAddress description: The IP address of the insight type: string - contextPath: Jask.Insight.LastUpdated description: 'When the insight was last updated. ' type: date - contextPath: Jask.Insight.LastUpdatedBy description: Who the insight was last updated by type: string - contextPath: Jask.Insight.Severity description: The severity of the insight type: number - contextPath: Jask.Insight.InsightTime description: The time of the insight type: date - contextPath: Jask.WorkflowStatus description: The status of the insight type: string - arguments: - auto: PREDEFINED description: When the insight was last seen. Defaults to 'All time' if no time arguments are specified. name: last-seen predefined: - All time - Last week - Last 48 hours - Last 24 hours - description: 'comma separated list of values from options: threatintel, rule, anomaly' name: source - description: 'comma separated list of values form options: Attack Stage, C2, Defense Evasion, Discovery, Exfiltration, Exploitation, External Recon, Internal Recon, Lateral Movement, Threat Intelligence, Traffic Anomaly' name: category - defaultValue: '0' description: The page offset for the results name: offset - defaultValue: '100' description: The maximum number of signals retrieved name: limit - defaultValue: score:desc description: How to sort the results name: sort - description: The start time for the search in the following string format - MM/DD/YYYY name: time-from - description: The end time for the search in the following string format - MM/DD/YYYY name: time-to description: Search signals using the given filters. name: jask-search-signals outputs: - contextPath: Jask.Signal.Id description: The ID of the signal type: string - contextPath: Jask.Signal.Name description: The name of the signal type: string - contextPath: Jask.Signal.Category description: The category of the signal type: string - contextPath: Jask.Signal.Description description: The description of the signal type: string - contextPath: Jask.Signal.Score description: The score of the signal type: number - contextPath: Jask.Signal.SourceType description: The source type of the signal type: string - contextPath: Jask.Signal.Timestamp description: The time of the signal type: date - contextPath: Jask.Signal.ThreatIndicators.IndicatorType description: The type of threat indicator type: string - contextPath: Jask.Signal.ThreatIndicators.Value description: The value of the threat indicator type: string - arguments: - auto: PREDEFINED description: When the insight was last seen. Defaults to 'All time' if no time arguments are specified. name: last-seen predefined: - All time - Last week - Last 48 hours - Last 24 hours - description: 'comma separated list of values from the options: username, hostname, ip' name: entity-type - defaultValue: '0' description: The page offset for the results name: offset - defaultValue: '100' description: How many results to retrieve name: limit - defaultValue: risk_score:desc description: What to sort by name: sort - description: The start time for the search in the following string format - MM/DD/YYYY name: time-from - description: The end time for the search in the following string format - MM/DD/YYYY name: time-to description: Search entities using the given filters. name: jask-search-entities outputs: - contextPath: Jask.Entity.Id description: The ID of the entity type: string - contextPath: Jask.Entity.Name description: The name of the entity type: string - contextPath: Jask.Entity.FirstSeen description: When the entity was first seen type: date - contextPath: Jask.Entity.LastSeen description: When the entity was last seen type: date - contextPath: Jask.Entity.Source description: The source of the entity type: string - contextPath: Jask.Entity.EntityType description: The type of the entity type: string - contextPath: Jask.Entity.PrimaryEntityType description: The primary entity type type: string - contextPath: Jask.Entity.HostName description: 'The hostname ' type: string - contextPath: Jask.Entity.RiskScore description: The risk score of the entity type: number - contextPath: Jask.Entity.IsWhiteListed description: Whether or not the entity is on allow list type: boolean - contextPath: Jask.Entity.Groups description: The groups of the entity type: string - contextPath: Jask.Entity.Ip.Address description: The IP address of the entity type: string isfetch: true script: '-' type: python subtype: python2 dockerimage: demisto/python:2.7.18.20958 tests: - No test fromversion: 5.0.0 deprecated: true