NetBox Event Collector

Details

ID	`NetBox Event Collector`
Provider	NetBoxLabs
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

This is the NetBox event collector integration for Cortex XSIAM.
This integration was integrated and tested with version 3.0 and above of NetBox API.

Configure NetBox Event Collector in Cortex

Parameter	Required
Server URL (e.g., https://www.example.com)	True
API Key	True
First fetch time	False
The maximum number of alerts per fetch	False
Trust any certificate (not secure)	False
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

netbox-get-events

Gets events from NetBox.

Base Command

netbox-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of results to return.	Optional

Context Output

There is no context output for this command.

Command Example

!netbox-get-events should_push_events=true limit=1

Human Readable Output

journal-entries Events

assigned_object	assigned_object_id	assigned_object_type	comments	created	created_by	custom_fields	display	id	kind	last_updated	tags	url
id: 4 url: https://www.example.com/api/dcim/devices/4/ display: test3 name: test3	4	dcim.device		2022-12-04T14:33:52.067484Z	1		2022-12-04 14:33 (Info)	6	value: info label: Info	2022-12-07T08:19:57.807055Z		https://www.example.com/api/extras/journal-entries/6/

object-changes Events

action	changed_object	changed_object_id	changed_object_type	display	id	postchange_data	prechange_data	request_id	time	url	user	user_name
value: update label: Updated	id: 6 url: https://www.example.com/api/extras/journal-entries/6/ display: 2022-12-04 14:33 (Info) created: 2022-12-04T14:33:52.067484Z	6	extras.journalentry	extras \| journal entry 2022-12-04 14:33 (Info) updated by netbox	10	kind: info tags: created: 2022-12-04T14:33:52.067Z comments: created_by: 1 last_updated: 2022-12-07T08:19:57.807Z custom_fields: {} assigned_object_id: 4 assigned_object_type: 25	kind: tags: created: 2022-12-04T14:33:52.067Z comments: created_by: 1 last_updated: 2022-12-04T14:33:52.067Z custom_fields: {} assigned_object_id: 4 assigned_object_type: 25	12345678-abcd-1234-abcd-1234567890ab	2022-12-07T08:19:57.810348Z	https://www.example.com/api/extras/object-changes/10/	id: 1 url: https://www.example.com/api/users/users/1/ display: netbox username: netbox	netbox

Configuration parameters

url — Server URL (e.g., https://www.example.com) (required)
credentials — (required)
first_fetch — First fetch time
max_fetch — The maximum number of alerts per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

netbox-get-events
Gets events from NetBox.

Source

NetBoxEventCollector.py NetBoxEventCollector_test.py NetBoxEventCollector.yml NetBoxEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: NetBoxLabs
commonfields:
  id: NetBox Event Collector
  version: -1
configuration:
- defaultvalue: https://www.example.com
  display: Server URL (e.g., https://www.example.com)
  name: url
  required: true
  type: 0
  section: Connect
- display: ""
  displaypassword: API Key
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: '1000'
  display: The maximum number of alerts per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: NetBox event collector integration for Cortex XSIAM.
display: 'NetBox Event Collector'
name: NetBox Event Collector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: Maximum number of results to return.
      name: limit
    description: Gets events from NetBox.
    name: netbox-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam