OnboardingIntegration

Details

ID	`OnboardingIntegration`
Provider	Open Source
Category	Utilities
From Version	5.0.0
Docker Image	`demisto/faker3:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Creates mock email incidents using one of two randomly selected HTML templates. Textual content is randomly generated and defined to include some text (100 random words) and the following data (at least 5 of each data type): IP addresses, URLs, SHA-1 hashes, SHA-256 hashes, MD5 hashes, email addresses, domain names.

Configure OnboardingIntegration in Cortex

Parameter	Required
Number of incidents to create per minute	False
Maximum number of incidents to create	False
How often to create new incidents (in minutes)	False
Fetch incidents	False
Incident type	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

demo-ip

Gets the simulated reputation of the IP address.

Base Command

demo-ip

Input

Argument Name	Description	Required
ip	The IP address to get the reputation of.	Required

Context Output

Path	Type	Description
IP.Address	String	IP address that was tested
IP.Malicious.Vendor	String	For malicious IPs, the vendor that made the decision
IP.Malicious.Description	String	For malicious IPs, the reason that the vendor made the decision
DBotScore.Type	String	The indicator type
DBotScore.Vendor	String	The vendor used to calculate the score
DBotScore.Score	Number	The actual score
DBotScore.Indicator	String	The indicator that was tested

demo-url

Gets the simulated reputation of the URL address.

Base Command

demo-url

Input

Argument Name	Description	Required
url	The URL to get the reputation of.	Required

Context Output

Path	Type	Description
URL.Data	String	The URL address that was tested
URL.Malicious.Vendor	String	For malicious URLs, the vendor that made the decision
URL.Malicious.Description	String	For malicious URLs, the reason that the vendor made the decision
DBotScore.Type	String	The indicator type
DBotScore.Vendor	String	The vendor used to calculate the score
DBotScore.Score	Number	The actual score
DBotScore.Indicator	String	The indicator that was tested

demo-domain

Gets the simulated reputation of the domain.

Base Command

demo-domain

Input

Argument Name	Description	Required
domain	The domain to get the reputation of.	Required

Context Output

Path	Type	Description
Domain.Name	String	The domain name that was tested
Domain.Malicious.Vendor	String	For malicious domains, the vendor that made the decision
Domain.Malicious.Description	String	For malicious domains, the reason that the vendor made the decision
DBotScore.Type	String	Indicator type
DBotScore.Vendor	String	Vendor used to calculate the score
DBotScore.Score	Number	The actual score
DBotScore.Indicator	String	The indicator that was tested

demo-file

Gets the simulated reputation of the file hash.

Base Command

demo-file

Input

Argument Name	Description	Required
file	The file hash to get the reputation of.	Required

Context Output

Path	Type	Description
File.MD5	String	File MD5 hash that was tested
File.SHA1	String	File SHA-1 hash that was tested
File.SHA256	String	File SHA-256 hash that was tested
File.SHA512	String	File SHA-512 hash that was tested
File.Malicious.Vendor	String	For malicious files, the vendor that made the decision
File.Malicious.Description	String	For malicious files, the reason that the vendor made the decision
DBotScore.Type	String	The indicator type
DBotScore.Vendor	String	The vendor used to calculate the score
DBotScore.Score	Number	The actual score
DBotScore.Indicator	String	The indicator that was tested

demo-email

Gets the simulated reputation of the email address.

Base Command

demo-email

Input

Argument Name	Description	Required
email	The email address to get the reputation of.	Required

Context Output

Path	Type	Description
Account.Email.Address	String	The email address that was tested
Account.Email.Malicious.Vendor	String	For malicious email addresses, the vendor that made the decision
Account.Email.Malicious.Description	String	For malicious email addresses, the reason that the vendor made the decision
DBotScore.Type	String	The indicator type
DBotScore.Vendor	String	The vendor used to calculate the score
DBotScore.Score	Number	The actual score
DBotScore.Indicator	String	The indicator that was tested

Configuration parameters

incidents_per_minute — Number of incidents to create per minute
max_num_of_incidents — Maximum number of incidents to create
frequency — How often to create new incidents (in minutes)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (5)

demo-domain
Gets the simulated reputation of the domain.
demo-email
Gets the simulated reputation of the email address.
demo-file
Gets the simulated reputation of the file hash.
demo-ip
Gets the simulated reputation of the IP address.
demo-url
Gets the simulated reputation of the URL address.

Source

OnboardingIntegration.py OnboardingIntegration_test.py OnboardingIntegration.yml OnboardingIntegration_description.md

Download History Raw

import demistomock as demisto
import OnboardingIntegration


def test_frequency(mocker):
    mocker.patch.object(demisto, "params", return_value={"frequency": "1"})
    mocker.patch.object(demisto, "command", return_value="fetch-incidents")
    mocker.patch.object(demisto, "incidents")
    OnboardingIntegration.main()
    assert demisto.incidents.call_count == 1


def test_no_settings(mocker):
    mocker.patch.object(demisto, "params", return_value={})
    mocker.patch.object(demisto, "command", return_value="fetch-incidents")
    mocker.patch.object(demisto, "incidents")
    OnboardingIntegration.main()
    assert demisto.incidents.call_count == 1