Linkshadow

Details

ID	`Linkshadow`
Provider	LinkShadow
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Configure Linkshadow in Cortex

To configure the connection to your Linkshadow instance, you will provide:

API Token, API Username from Linkshadow ( Generate tokens from following url : https://Linkshadow-device-IP/settings/#general-settings ) under the “Generate API Key for LinkShadow” section)

Parameter	Description	Required
API Key	Use API Token	True
url	Server URL (e.g. https://Linkshadow_IP/)	True
API Username	Use API Username	True
action	fetch_entity_anomalies	True
plugin_id	xsoar_integration_1604211382	True
Incidents Fetch Interval	01 Minutes	Default

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Linkshadow-fetch-entity-anomalies

Linkshadow returns the full incident details referenced by timeframe (default = 60min) in an API response. Use of this command will return the JSON structure of the API response.

Base Command

Linkshadow-fetch-entity-anomalies

Input

Argument Name	Description	Required
time_frame	Time Period	Optional(default:60)

Context Output

Path	Type	Description
Linkshadow.data.GlobalID	String	Unique ID of the Anomaly to track in Linkshadow
Linkshadow.data.action_time	Date	Time of Anomaly Send to XSOAR
Linkshadow.data.anomaly_flag	Number	Anomaly Flag Value 1 - Means Active Anomaly, 0 Means Fixed Anomaly
Linkshadow.data.anomaly_id	Number	Anomaly ID for LinkShadow
Linkshadow.data.anomaly_type	String	Incident Type
Linkshadow.data.bandwidth	String	Bandwidth usage of the Anomalous session
Linkshadow.data.category	String	Additional Information for the anomaly
Linkshadow.data.data	String	Time of Anomaly seen
Linkshadow.data.desc	String	Description of anomaly from linkshadow
Linkshadow.data.dip	String	Destination Ip in the detected anomaly
Linkshadow.data.dmac	String	Destination mac address
Linkshadow.data.dport	String	Destination port number of the anomalous session
Linkshadow.data.id	String	NA
Linkshadow.data.inserted_time	Date	Time of Anomaly added to the database
Linkshadow.data.score	Number	Risk Score of the Anomaly - Typical value between 1-20
Linkshadow.data.sip	String	Source IP in the detected Anomaly
Linkshadow.data.smac	String	Source Mac Address in the detected Anomaly
Linkshadow.data.sport	String	Source port number of the anomalous session
Linkshadow.data.time_seen	Date	Time of Anomaly seen

Configuration parameters

apiKey — API Key (required)
url — URL (required)
action — Action (required)
api_username — API Username (required)
plugin_id — Plugin ID (required)
isFetch — Fetch incidents
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
incidentFetchInterval — Incidents Fetch Interval (required)
incidentType — Incident type
max_fetch — Max Fetch
proxy — Use system proxy settings

Commands (1)

Linkshadow-fetch-entity-anomalies
Return the full entity details for all devices referenced by data in an API response. Use of this command will return the JSON structure of the API response .

Source

Linkshadow.py Linkshadow_test.py Linkshadow.yml Linkshadow_description.md command_examples.txt

Download History Raw

import json

import dateparser

DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


"""*****COMMAND FUNCTIONS****"""


def test_fetch_incidents(requests_mock):
    from Linkshadow import Client, fetch_incidents

    test_api_response = util_load_json("test_data/fetch_incident.json")
    requests_mock.post("https://LS_test_fetch_incidents.com/api/plugin/", json=test_api_response)
    client = Client(base_url="https://LS_test_fetch_incidents.com/", verify=False, proxy=False)
    last_run = {"last_fetch": dateparser.parse(str(1621860339000), settings={"TIMEZONE": "UTC"}).strftime(DATE_FORMAT)}
    integration_response = fetch_incidents(
        client=client,
        max_alerts=20,
        last_run=last_run,
        first_fetch_time="1 day ago",
        apiKey="",
        api_username="lsadmin",
        plugin_id="xsoar_integration_1604211382",
        action="fetch_entity_anomalies",
    )
    expected_response = util_load_json("test_data/formatted_fetch_incident.json")
    responsejson = integration_response[1][0]
    responsejson["rawJSON"] = json.loads(responsejson["rawJSON"])

    assert responsejson == expected_response[0]


def test_fetch_entity_anomalies(requests_mock):
    from Linkshadow import Client, fetch_entity_anomalies

    test_api_response = util_load_json("test_data/fetch_anomaly.json")
    requests_mock.post("https://LS_test_fetch_anomaly.com/api/plugin/", json=test_api_response)
    client = Client(base_url="https://LS_test_fetch_anomaly.com/", verify=False, proxy=False)
    params = {
        "apiKey": "",
        "username": "lsadmin",
        "plugin_id": "xsoar_integration_1604211382",
        "action": "fetch_entity_anomalies",
    }
    args = {"time_frame": "01"}
    integration_response = fetch_entity_anomalies(client, params, args)
    expected_response = util_load_json("test_data/formatted_fetch_anomaly.json")
    # raise ValueError(integration_response.outputs, expected_response)
    assert integration_response.outputs == expected_response
    assert integration_response.outputs_key_field == "GlobalID"
    assert integration_response.outputs_prefix == "Linkshadow.data"