KeeperSecurity

Details

ID	`KeeperSecurity`
Provider	Keeper Security Inc.
Category	Authentication & Identity Management
From Version	6.8.0
Docker Image	`demisto/keepercommander:1.0.0.10182333`
Supported Modules	XSIAM

README

Use this integration to fetch audit logs from Keeper Security Admin Console as XSIAM events.
This integration was integrated and tested with version 16.11.8 of Keeper Commander.

Configure Keeper Secrets Manager Event Collector in Cortex

Parameter	Description	Required
Server URL	The server URL. For more help, checkout the ‘Server Regions’ section in the description.	True
Username		True
Password		True
Maximum number of Alerts to fetch.	The maximum number of Alert events to fetch.
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

keeper-security-register-start

Use this command to start the registration process.

Base Command

keeper-security-register-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Human Readable Output

Code was sent successfully to the user’s email

keeper-security-register-complete

Use this command to complete the registration process.

Base Command

keeper-security-register-complete

Input

Argument Name	Description	Required
code	The authorization code retrieved from user’s email.	Optional

Context Output

There is no context output for this command.

Human Readable Output

Login completed

keeper-security-register-test

Use this command to test the connectivity of the instance.

Base Command

keeper-security-register-test

Input

There is no context output for this command.

Context Output

There is no context output for this command.

Human Readable Output

Successful connection

Configuration parameters

url — Server URL (required)
credentials — Username (required)
alerts_max_fetch — Maximum number of Alerts to fetch.
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (3)

keeper-security-register-complete
Use this command to complete the registration process.
keeper-security-register-start
Use this command to start the registration process.
keeper-security-register-test
Use this command to test the connectivity of the instance.

Source

KeeperSecurity.py KeeperSecurity_test.py KeeperSecurity.yml KeeperSecurity_description.md command_examples.txt

Download History Raw

# Keeper Security Event Collector

## Authentication

Use basic authentication to communicate with the product. Supply your username and password of the account that you want to use.
To create a new user:

1. Log in in as admin in [Keeper Admin Console](https://keepersecurity.com/console/).
2. Go to the **Admin** panel, found in the left side bar.
3. Press on **Add User**, and complete the registration process.
4. Once the user has been created, press on the **Edit** icon, and in the **User Actions** dropdown, click **Disable 2FA** (2FA is currently not supported).

### Authentication Process

In order to authenticate the configured user, the product uses a device registration process. In order to register a new device that will be used to authenticate the user, follow the following procedures:

1. Run the **!keeper-security-register-start** command.
2. If the account does **not** have a configured device, then an authorization code will be sent to the configured email address.
3. Run the **!keeper-security-register-complete** command with the acquired authorization code. If the account already has a registered device, run the command without supplying any arguments.
4. Run the command **!keeper-security-register-test** to test that everything is working fine.

## Server Regions

Use the URLs for the region that hosts your account:
For more information, see the [Server Config File Options](https://docs.keeper.io/en/v/secrets-manager/commander-cli/commander-installation-setup/configuration#config-file-options)

- US Instance: <https://keepersecurity.com>
- EU Instance: <https://keepersecurity.eu>
- AU Instance: <https://keepersecurity.com.au>
- GOV Instance: <https://govcloud.keepersecurity.us>
- CA Instance: <https://keepersecurity.ca>
- JP Instance: <https://keepersecurity.jp>