Neosec

Details

ID	`Neosec`
Provider	Akamai Technologies
Category	Network Security
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Neosec is reinventing application security. Its pioneering SaaS platform gives security professionals visibility into behavior across their entire API estate. Built for organizations that expose APIs to partners, suppliers, and users, Neosec discovers all your APIs, analyzes their behavior, and stops threats lurking inside.

What does this pack do?

Ingests alerts from Neosec into XSOAR:
- Neosec Posture Alerts covers OWASP top 10 and other vulnerabilities in API endpoints. Handled by R&D.
- Neosec Runtime Alerts are on suspicious or malicious user behavior. Handled by SOC analysts.
Close/Reopens Neosec Alerts

Configure Neosec in Cortex

Parameter	Description	Required
API Key	The API Key to use to connect to Neograph API	True
URL	Neograph API URL	False
Tenant Key	Tenant identifer (Tenant name)	False
Fetch alerts with status	Select the statuses of the alerts you wish to fetch (Open/Closed).	False
Fetch alerts with type	Select the types of the alerts you wish to fetch (Posture/Runtime).	False
Severity of alerts to fetch	Select the severities of the alerts you wish to fetch.	False
Max incident to fetch		False
Incident type		False
Fetch incidents		False
First fetch time		False
De-tokenize alerts	Select this if you use tokenization on PII data and wish to ingest Neosec alerts to XSOAR with detokenized data.	False
Neosec Node URL	If the ‘De-tokenize alets’ is selected, provide the url of the Neosec Node. for example http://[neosec node ip]:8080	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

neosec-alert-status-set

Set alert status(Open, Closed)

Base Command

neosec-alert-status-set

Input

Argument Name	Description	Required
alert_id	The alert id(UUID) in the Neosec platform. .	Required
alert_status	The alert status. Possible values are: Open, Closed.	Required

Context Output

There is no context output for this command.

Configuration parameters

credentials — (required)
url — URL (required)
tenant_key — Tenant Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
alert_status — Fetch alerts with status
alert_type — Fetch alerts with type
severities — Severity of alerts to fetch
max_fetch — Max incident to fetch
first_fetch — First fetch time
neosec_node_url — Neosec Node URL (Optional)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (1)

neosec-alert-status-set
Set alert status(Open, Closed)

Source

Neosec.py Neosec_test.py Neosec.yml Neosec_description.md command_examples.txt

Download History Raw

category: Network Security
sectionorder:
- Connect
- Collect
provider: Akamai Technologies
commonfields:
  id: Neosec
  version: -1
configuration:
- name: credentials
  display:
  required: true
  defaultvalue:
  type: 9
  additionalinfo: The API Key to use for connection
  displaypassword: API Key
  hiddenusername: true
  section: Connect
- name: url
  display: URL
  required: true
  defaultvalue: https://neograph.neosec.com
  type: 0
  additionalinfo: ""
  section: Connect
- name: tenant_key
  display: Tenant Key
  required: true
  defaultvalue:
  type: 0
  additionalinfo: ""
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- name: alert_status
  display: Fetch alerts with status
  defaultvalue: Open
  type: 15
  additionalinfo: ""
  options:
  - Open
  - Closed
  required: false
  section: Collect
- name: alert_type
  display: Fetch alerts with type
  defaultvalue:
  type: 16
  additionalinfo: ""
  options:
  - Runtime
  - Posture
  required: false
  section: Collect
- name: severities
  display: Severity of alerts to fetch
  defaultvalue: Low,Medium,High,Critical
  type: 16
  additionalinfo: ""
  options:
  - Info
  - Low
  - Medium
  - High
  - Critical
  required: false
  section: Collect
- name: max_fetch
  display: Max incident to fetch
  defaultvalue: "50"
  type: 0
  additionalinfo: ""
  required: false
  section: Collect
- name: first_fetch
  display: First fetch time
  defaultvalue: 3 days
  type: 0
  additionalinfo:
  required: false
  section: Collect
- name: neosec_node_url
  display: Neosec Node URL (Optional)
  defaultvalue:
  type: 0
  additionalinfo: ""
  required: false
  section: Connect
- display: Incident type
  name: incidentType
  type: 13
  defaultvalue: Neosec Incident
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
description: Neosec is reinventing application security. Its pioneering SaaS platform gives security professionals visibility into behavior across their entire API estate. Built for organizations that expose APIs to partners, suppliers, and users, Neosec discovers all your APIs, analyzes their behavior, and stops threats lurking inside.
display: Neosec
name: Neosec
script:
  commands:
  - name: neosec-alert-status-set
    description: Set alert status(Open, Closed)
    arguments:
    - name: alert_id
      description: The alert id(UUID) in the Neosec platform.
      required: true
      defaultValue: ""
      predefined:
      - ""
    - name: alert_status
      description: The alert status, the options are "Open" or "Closed".
      required: true
      defaultValue: ""
      auto: PREDEFINED
      predefined:
      - Open
      - Closed
    outputs: []
  isfetch: true
  script: "-"
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.5.0
defaultmapperin: Neosec - Incoming Mapper
tests:
- No tests (auto formatted)