MongoDBAtlasEventCollector

Details

ID	`MongoDBAtlasEventCollector`
Provider	MongoDB Inc.
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

MongoDB Atlas is an integration that supports fetching and managing alerts and events within Cortex XSIAM.

This integration was integrated and tested with version 2.0 of MongoDB Atlas.

Configure MongoDB Atlas on Cortex XSIAM

Navigate to Settings > Configurations > Automation & Feed Integrations.
Search for MongoDB Atlas.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Server URL	The endpoint URL.	True
Public Key	The Public Key to use for connection.	True
Private Key	The Private Key to use for connection.	True
Group ID	The Project ID from MongoDB Atlas account.	True
Maximum number of events per fetch	Defines the maximum number of alerts or events fetched per type in each fetch cycle. Default value: 2500.	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Click Test to validate the URLs, keys, and connection.

To create an API key for a project using the MongoDB Atlas UI

Log in to MongoDB Atlas.
Click Access Manager in the navigation bar, then click your project.
Navigate to Applications.
Click Create Application and then click API Key.
Enter a Description and set Project Permissions. For reading alerts and events, you can set the Project Permissions to “Read Only”.
Copy and save the Public Key. The public key acts as the username when making API requests.
Copy and save the Private Key. The private key acts as the password when making API requests.

WARNING: Save the Private Key securely! The Private Key is only displayed once on this page. Click Copy to copy it to your clipboard. Save and secure both the Public and Private Keys.
Add an API Access List Entry by clicking Add Access List Entry.
Enter an IP address from which MongoDB Atlas should accept API requests for this API Key. You can also click Use Current IP Address if the host you are using to access MongoDB Atlas will also make API requests using this API Key.
Click Save.
Click Done.

IMPORTANT

You need to allow access from Cortex XSIAM to MongoDB via the UI by adding a Cortex XSIAM IP address:
https://cloud.mongodb.com/v2/#/security/network/accessList

Additional Information

Groups and projects are synonymous terms. Your group ID is the same as your project ID. For existing groups, your group/project ID remains the same. The resource and corresponding endpoints use the term groups.

Authentication and authorization

Grant Programmatic Access to a Project

Use the following procedures to grant programmatic access to a project.
To learn more, see Manage Programmatic Access to a Project.

Commands

You can execute these commands from the Cortex XSIAM CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

mongo-db-atlas-get-events

Retrieves a list of events from the MongoDB Atlas instance.

Base Command

mongo-db-atlas-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of events to return. Value range: 1-2500.	Required

Context Output

Path	Type	Description
MongoDBAtlasEventCollector	List	The list of the events and the alerts.

Configuration parameters

url — Server URL (required)
credentials — Public Key (required)
group_id — Group ID (required)
max_events_per_fetch — Maximum number of events per fetch (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

mongo-db-atlas-get-events
Retrieves a list of events from the MongoDB Atlas instance.

Source

MongoDBAtlasEventCollector.py MongoDBAtlasEventCollector_test.py MongoDBAtlasEventCollector.yml MongoDBAtlasEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: MongoDB Inc.
sectionorder:
- Connect
- Collect
commonfields:
  id: MongoDBAtlasEventCollector
  version: -1
configuration:
- display: Server URL
  defaultvalue: "https://cloud.mongodb.com/"
  additionalinfo: The endpoint URL.
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The credentials used to connect to MongoDB Atlas, including the username (Public Key) and password (Private Key).
  display: Public Key
  displaypassword: Private Key
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Group ID
  name: group_id
  additionalinfo: The Project ID from the MongoDB Atlas account.
  required: true
  type: 0
  section: Connect
- additionalinfo: 'Defines the maximum number of alerts or events fetched per type in each fetch cycle. Default value: 2500.'
  defaultvalue: "2500"
  display: Maximum number of events per fetch
  name: max_events_per_fetch
  required: true
  type: 0
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
description: 'MongoDB Atlas is an integration that supports fetching and managing alerts and events within Cortex XSIAM.'
display: MongoDB Atlas
name: MongoDBAtlasEventCollector
script:
  commands:
  - name: mongo-db-atlas-get-events
    description: Retrieves a list of events from the MongoDB Atlas instance.
    arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise it will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: 'Maximum number of events to return. Value range: 1-2500.'
      name: limit
      required: true
    outputs:
    - contextPath: MongoDBAtlasEventCollector
      description: The list of the events and alerts.
      type: List
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam