Linkshadow

Details

ID	`Linkshadow`
Provider	LinkShadow
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Configure Linkshadow in Cortex

To configure the connection to your Linkshadow instance, you will provide:

API Token, API Username from Linkshadow ( Generate tokens from following url : https://Linkshadow-device-IP/settings/#general-settings ) under the “Generate API Key for LinkShadow” section)

Parameter	Description	Required
API Key	Use API Token	True
url	Server URL (e.g. https://Linkshadow_IP/)	True
API Username	Use API Username	True
action	fetch_entity_anomalies	True
plugin_id	xsoar_integration_1604211382	True
Incidents Fetch Interval	01 Minutes	Default

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Linkshadow-fetch-entity-anomalies

Linkshadow returns the full incident details referenced by timeframe (default = 60min) in an API response. Use of this command will return the JSON structure of the API response.

Base Command

Linkshadow-fetch-entity-anomalies

Input

Argument Name	Description	Required
time_frame	Time Period	Optional(default:60)

Context Output

Path	Type	Description
Linkshadow.data.GlobalID	String	Unique ID of the Anomaly to track in Linkshadow
Linkshadow.data.action_time	Date	Time of Anomaly Send to XSOAR
Linkshadow.data.anomaly_flag	Number	Anomaly Flag Value 1 - Means Active Anomaly, 0 Means Fixed Anomaly
Linkshadow.data.anomaly_id	Number	Anomaly ID for LinkShadow
Linkshadow.data.anomaly_type	String	Incident Type
Linkshadow.data.bandwidth	String	Bandwidth usage of the Anomalous session
Linkshadow.data.category	String	Additional Information for the anomaly
Linkshadow.data.data	String	Time of Anomaly seen
Linkshadow.data.desc	String	Description of anomaly from linkshadow
Linkshadow.data.dip	String	Destination Ip in the detected anomaly
Linkshadow.data.dmac	String	Destination mac address
Linkshadow.data.dport	String	Destination port number of the anomalous session
Linkshadow.data.id	String	NA
Linkshadow.data.inserted_time	Date	Time of Anomaly added to the database
Linkshadow.data.score	Number	Risk Score of the Anomaly - Typical value between 1-20
Linkshadow.data.sip	String	Source IP in the detected Anomaly
Linkshadow.data.smac	String	Source Mac Address in the detected Anomaly
Linkshadow.data.sport	String	Source port number of the anomalous session
Linkshadow.data.time_seen	Date	Time of Anomaly seen

Configuration parameters

apiKey — API Key (required)
url — URL (required)
action — Action (required)
api_username — API Username (required)
plugin_id — Plugin ID (required)
isFetch — Fetch incidents
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
incidentFetchInterval — Incidents Fetch Interval (required)
incidentType — Incident type
max_fetch — Max Fetch
proxy — Use system proxy settings

Commands (1)

Linkshadow-fetch-entity-anomalies
Return the full entity details for all devices referenced by data in an API response. Use of this command will return the JSON structure of the API response .

Source

Linkshadow.py Linkshadow_test.py Linkshadow.yml Linkshadow_description.md command_examples.txt

Download History Raw

commonfields:
  id: Linkshadow
  version: -1
name: Linkshadow
display: Linkshadow
category: Data Enrichment & Threat Intelligence
provider: LinkShadow
description: Fetch Network Anomalies data from LinkShadow and execute the remediation Actions.
detaileddescription: "\n## Linkshadow\n\nLinkshadow is a Next Generation Enterprise Security Analytics platform designed to manage threats in real-time with attacker behavior analytics, LinkShadow enhances organization's defenses against advanced cyber-attacks, zero-day malware and ransomware, while simultaneously gaining rapid insight into the effectiveness of their existing security investments. \n\nThis integration was integrated and tested with version 4.5.8 of Linkshadow.\nEnables LinkShadow to integrate with PaloAlto Cortex XSOAR Platform, It pushes Linkshadow Anomaly events to XSOAR to create a new Incident and trigger the relevant Playbook Actions.This pack includes configurations to combine the world-class threat detection of Linkshadow with the synchrony and automation abilities of XSOAR, allowing security teams to investigate and manage security events before they have time to escalate.\n\nThis section explains how to configure the instance of Linkshadow in Cortex XSOAR.\n - API Key               : `Use API Token`\n - API Username  : `Use API Username`\n - Plugin ID            : `xsoar_integration_1604211382`\n - Action                 : `fetch_entity_anomalies`\n\n---\n"
configuration:
- display: API Key
  name: apiKey
  type: 4
  required: true
- display: URL
  name: url
  type: 0
  required: true
- display: Action
  name: action
  defaultvalue: fetch_entity_anomalies
  type: 0
  required: true
- display: API Username
  name: api_username
  type: 0
  required: true
- display: Plugin ID
  name: plugin_id
  defaultvalue: xsoar_integration_1604211382
  type: 0
  required: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  defaultvalue: 7 days
  type: 0
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: true
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Max Fetch
  name: max_fetch
  defaultvalue: '50'
  type: 0
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
script:
  commands:
  - name: Linkshadow-fetch-entity-anomalies
    arguments:
    - name: time_frame
      default: true
      description: Period of minutes, to be fetched from Linkshadow.
      defaultValue: "60"
    outputs:
    - contextPath: Linkshadow.data.GlobalID
      description: Unique ID of the Anomaly to track in Linkshadow.
      type: string
    - contextPath: Linkshadow.data.action_time
      description: Time of Anomaly Send to XSOAR.
      type: date
    - contextPath: Linkshadow.data.anomaly_flag
      description: Anomaly Flag Value 1 - Means Active Anomaly, 0 Means Fixed Anomaly.
      type: number
    - contextPath: Linkshadow.data.anomaly_id
      description: Anomaly ID for LinkShadow.
      type: number
    - contextPath: Linkshadow.data.anomaly_type
      description: Incident Type.
      type: string
    - contextPath: Linkshadow.data.bandwidth
      description: Bandwidth usage of the Anomalous session.
      type: number
    - contextPath: Linkshadow.data.category
      description: Anomaly Category - Incident Category.
      type: string
    - contextPath: Linkshadow.data.data
      description: Additional Information for the anomaly.
      type: string
    - contextPath: Linkshadow.data.desc
      description: Description of anomaly from linkshadow.
      type: string
    - contextPath: Linkshadow.data.dip
      description: Destination Ip in the detected anomaly.
      type: string
    - contextPath: Linkshadow.data.dmac
      description: Destination mac address.
      type: string
    - contextPath: Linkshadow.data.dport
      description: Destination port number of the anomalous session.
      type: number
    - contextPath: Linkshadow.data.id
      description: NA.
      type: string
    - contextPath: Linkshadow.data.inserted_time
      description: Time of Anomaly added to the database.
      type: date
    - contextPath: Linkshadow.data.score
      description: Risk Score of the Anomaly - Typical value between 1-20.
      type: number
    - contextPath: Linkshadow.data.sip
      description: Source IP in the detected Anomaly.
      type: string
    - contextPath: Linkshadow.data.smac
      description: Source Mac Address in the detected Anomaly.
      type: string
    - contextPath: Linkshadow.data.sport
      description: Source port number of the anomalous session.
      type: string
    - contextPath: Linkshadow.data.time_seen
      description: Time of Anomaly seen.
      type: date
    description: Return the full entity details for all devices referenced  by data in an API response. Use of this command will return the JSON structure of the API response .
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: '-'
  subtype: python3
  type: python
  isFetchSamples: true
fromversion: 5.5.0
tests:
- No test