Packetsled

Packetsled Network Security API commands.

Network Security · Packetsled

Details

ID	`Packetsled`
Provider	Mixmode
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Overview

Use this integration to access the PacketSled playbook and command query.

Employ incidents and artifacts from an investigation, or a full packet capture, based on the perspective of a user or a host.

Use either the playbook or the individual commands to get the level of detail necessary for your investigation.

This integration was integrated and tested with PacketSled v5.3.2 and earlier.

Use Cases

Extract incidents, files, or PCAP.
Extract metadata for a specific host.
Enumerate sensors.

Prerequisites

Make sure you have the following PacketSled information.

Username and password for credential access
Confirm firewall rules to enable access to PacketSled API

Configure PacketSled on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for PacketSled.
Click Add instance to create and configure a new integration instance.
- Name: textual name for the integration instance
- Server URL (https://<customer_id>.packetsled.com)
- If you want to Cortex XSOAR incidents to be created automatically from this integration instance, click Fetch Incidents.
- Credentials: PacketSled username
- Password: PacketSled password
Click Test to validate credentials and configuration.
Click Done to install integration.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Extract incidents: packetsled-get-incidents
Enumerate sensors: packetsled-get-sensors
Extract metadata for a specific host: packetsled-get-flows
Extract files: packetsled-get-files
Extract PCAP: packetsled-get-pcaps

Extract incidents: packetsled-get-incidents

Extracts all incidents that occurred from last time they were extracted.

Inputs

Parameter	Description	Required
start_time	Beginning of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to 1 hour ago)	Optional
stop_time	End of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to current time)	Optional
envid	Unique ID in PacketSled to identify a group of sensors that belong to a single customer (by default, all sensors are queried)	Optional
probe	Unique ID in an envid used to identify a single sensor (by default, all sensors are queried)	Optional

Raw Output

{  
   "name":"Source: Packetsled SENSOR: , ENTITY: ",
   "rawJSON":{  

   }
}

Enumerate sensors: packetsled-get-sensors

Enumerates all attached sensors.

-NO FURTHER INFORMATION-

Extract metadata for a specific host: packetsled-get-flows

Finds flow metadata based on the specified parameters. The flows are posted as JSON files to the War Room.

Command Example

!packetsled-get-flows entity=192.168.0.110 limit=10000

Inputs

Parameter	Description	Required
start_time	Beginning of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to 1 hour ago)	Optional
stop_time	End of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to current time)	Optional
envid	Unique ID in PacketSled to identify a group of sensors that belong to a single customer (by default, all sensors are queried)	Optional
probe	Unique ID in an envid used to identify a single sensor (by default, all sensors are queried)	Optional
entity	IP address	Optional
port	Port	Optional
geo	Geographical code	Optional
family	Protocol family (enumeration value)	Optional
proto	Protocol (enumeration value)	Optional

Extract files: packetsled-get-files

Finds file artifacts based on the specified parameters. The files are posted to the War Room.

Inputs

Parameter	Description	Required
start_time	Beginning of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to 1 hour ago)	Optional
stop_time	End of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to current time)	Optional
envid	Unique ID in PacketSled to identify a group of sensors that belong to a single customer (by default, all sensors are queried)	Optional
probe	Unique ID in an envid used to identify a single sensor (by default, all sensors are queried)	Optional
entity	IP address	Optional
port	Port	Optional
geo	Geographical code	Optional
family	Protocol family (enumeration value)	Optional
proto	Protocol (enumeration value)	Optional

Extract PCAP: packetsled-get-pcaps

Finds full packet capture files based on the specified parameters. The PCAP files are posted to the War Room.

Command Example

!packetsled-get-pcaps entity=192.168.0.110

Inputs

Parameter	Description	Required
start_time	Beginning of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to 1 hour ago)	Optional
stop_time	End of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to current time)	Optional
envid	Unique ID in PacketSled to identify a group of sensors that belong to a single customer (by default, all sensors are queried)	Optional
probe	Unique ID in an envid used to identify a single sensor (by default, all sensors are queried)	Optional
entity	IP address	Optional
port	Port	Optional
proto	A protocol (enumeration value)	Optional

packetsled-sensors

List the sensors attached to the packetsled platform.

Base Command

packetsled-sensors

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
Packetsled.Sensors	unknown	The list of sensors
Packetsled.Sensors.label	unknown	The label of the sensor
Packetsled.Sensors.envid	unknown	The environment id of the sensor
Packetsled.Sensors.probe	unknown	The probe number of the sensor

packetsled-get-events

Get all of the events for a given uid

Base Command

packetsled-get-events

Input

Argument Name	Description	Required
uid	The uid to retrieve logs for. Use the _id attribute from a flow for this parameter value.	Required
envid	The environment id of the probe to search.	Optional
probe	The probe number of the probe to search.	Optional

Context Output

Path	Type	Description
Packetsled.Events	unknown	Retrieve all logs for a single flow
Packetsled.Events._id	unknown	The unique id of the Event
Packetsled.Events.src_ip	unknown	The originator of the Events
Packetsled.Events.dest_ip	unknown	The respondant of the Events

Configuration parameters

ApiServer — The protocol and domain of the packetsled instance. (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
credentials — Username (required)
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
max_fetch — Fetch Limit

Commands (6)

packetsled-get-events
Get all of the events for a given uid
packetsled-get-files
Query packetsled extracted files
packetsled-get-flows
Query packetsled sensor metadata
packetsled-get-incidents
Query for incidents by time range and severity
packetsled-get-pcaps
Query packetsled for full packet
packetsled-sensors
List the sensors attached to the packetsled platform.

Source

Packetsled.py Packetsled_test.py Packetsled.yml Packetsled_description.md

Download History Raw

commonfields:
  id: Packetsled
  version: -1
name: Packetsled
display: Packetsled
category: Network Security
sectionorder:
- Connect
- Collect
provider: Mixmode
description: Packetsled Network Security API commands.
configuration:
- display: The protocol and domain of the packetsled instance.
  name: ApiServer
  defaultvalue: https://www.packetsled.com
  type: 0
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: "Username"
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
  section: Connect
- name: first_fetch
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
  defaultvalue: 7 days
  type: 0
  additionalinfo: ""
  required: false
  section: Collect
- additionalinfo: the maximum number of incidents to fetch
  defaultvalue: '50'
  display: Fetch Limit
  name: max_fetch
  type: 0
  required: false
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: packetsled-get-incidents
    arguments:
    - name: severity
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      - "4"
      - "5"
      - "6"
      - "7"
      - "8"
      - "9"
      - "10"
      description: Return incidents with severity greater than or equal to this value.
      defaultValue: "5"
    - name: start_time
      description: Start time to query for incidents.
    - name: stop_time
      description: Stop time to query for incidents.
    - name: probe
      description: The probe number.
    - name: envid
      description: The environment id.
    outputs:
    - contextPath: Packetsled.Incidents
      description: The list of incidents.
    - contextPath: Packetsled.Incidents.id
      description: The id of the incident.
    - contextPath: Packetsled.Incidents.entity
      description: The entity of the incident.
    - contextPath: Packetsled.Incidents.log
      description: The log types for the incident.
    - contextPath: Packetsled.Incidents.start_time
      description: The beginning of the time range containing the incident.
    - contextPath: Packetsled.Incidents.stop_time
      description: The end of the time range containing the incident.
    - contextPath: Packetsled.Incidents.envid
      description: The environment id of the incident.
    - contextPath: Packetsled.Incidents.probe
      description: The probe number of the incident.
    description: Query for incidents by time range and severity
  - name: packetsled-sensors
    arguments: []
    outputs:
    - contextPath: Packetsled.Sensors
      description: The list of sensors.
    - contextPath: Packetsled.Sensors.label
      description: The label of the sensor.
    - contextPath: Packetsled.Sensors.envid
      description: The environment id of the sensor.
    - contextPath: Packetsled.Sensors.probe
      description: The probe number of the sensor.
    description: List the sensors attached to the packetsled platform.
  - name: packetsled-get-flows
    arguments:
    - name: entity
      description: The ip of the entity to query flows for.
    - name: protocol
      auto: PREDEFINED
      predefined:
      - tcp
      - udp
      - dns
      - dhcp
      - arp
      - finger
      - ncp
      - rpc
      - telnet
      - rlogin
      - citrix
      - dhcpv6
      - icmp
      - ntp
      - snmp
      - bgp
      - ripv1
      - ripv2
      - ipmi
      - ssh
      - ssl
      - openvpn
      - teredo
      - tunnel
      - ciscovpn_tcp
      - ciscovpn_udp
      - syslog
      - dce-rpc
      - xmpp
      - amqp
      - emp
      - dce-rpc-lsa
      - ident
      - radius
      - socks
      - kerberos
      - ntlm
      - login
      - rdp
      - vnc
      - pcanywhere
      - ftp
      - netbios
      - smb
      - ftp-data
      - irc-dcc-data
      - rsync
      - tftp
      - dropbox
      - bittorrent
      - gnutella
      - dnp3
      - modbus
      - gtpv1
      - gps
      - wiu
      - http
      - smtp
      - imap
      - pop3
      - mapi
      - mysql
      - irc
      - sip
      description: The protocol.
    - name: family
      auto: PREDEFINED
      predefined:
      - network_services
      - network_management
      - encrypted
      - tunnel
      - logging
      - application_service
      - authentication
      - remote_access
      - file_transfer
      - p2p
      - scada
      - mobile
      - web
      - mail
      - database
      - chat
      - voice
      description: The protocol family.
    - name: log
      auto: PREDEFINED
      predefined:
      - app_stats
      - arp
      - bittorrent
      - communication
      - conn
      - credit_card_exposure
      - dce_rpc
      - dce_rpc_lsa
      - dhcp
      - dhcpv6
      - dnp3
      - dns
      - dpd
      - files
      - ftp
      - gnutella
      - http
      - icmp
      - imap
      - intel
      - irc
      - kerberos
      - known_certs
      - known_hosts
      - known_services
      - loaded_scripts
      - mqtt
      - mysql
      - notice
      - ntlm
      - ntp
      - openvpn
      - packet_filter
      - pcr
      - pe
      - pop3
      - ps_long_running_flows
      - psanalytics
      - psfile_analytics
      - rdp
      - reporter
      - rfb
      - sip
      - smb_auth
      - smb_cmd
      - smb_files
      - smb_mapping
      - smtp
      - snmp
      - socks
      - software
      - ssh
      - ssl
      - stats
      - syslog
      - tcp
      - telnet
      - traceroute
      - tunnel
      - udp
      - weird
      - x509
      description: The log name.
    - name: geo
      description: The 2-digit geo code,' local', or 'private'.
    - name: port
      description: The port number.
    - name: start_time
      description: The beginning of the time range to query. Either an ISO time string or seconds since the epoch.
    - name: stop_time
      description: The end of the time range to query. Either an ISO time string or seconds since the epoch.
    - name: envid
      description: The environment id of the probe to search.
    - name: probe
      description: The probe number of the probe to search.
    - name: limit
      description: Limit the number of search results.
      defaultValue: "5000"
    outputs:
    - contextPath: Packetsled.Flows
      description: Flow metadata.
    - contextPath: Packetsled.Flows._id
      description: The unique id of the flow.
    - contextPath: Packetsled.Flows.src_ip
      description: The originator of the flow.
    - contextPath: Packetsled.Flows.dest_ip
      description: The respondant of the flow.
    description: Query packetsled sensor metadata
  - name: packetsled-get-files
    arguments:
    - name: entity
      description: The ip of the entity to query flows for.
    - name: protocol
      auto: PREDEFINED
      predefined:
      - tcp
      - udp
      - dns
      - dhcp
      - arp
      - finger
      - ncp
      - rpc
      - telnet
      - rlogin
      - citrix
      - dhcpv6
      - icmp
      - ntp
      - snmp
      - bgp
      - ripv1
      - ripv2
      - ipmi
      - ssh
      - ssl
      - openvpn
      - teredo
      - tunnel
      - ciscovpn_tcp
      - ciscovpn_udp
      - syslog
      - dce-rpc
      - xmpp
      - amqp
      - emp
      - dce-rpc-lsa
      - ident
      - radius
      - socks
      - kerberos
      - ntlm
      - login
      - rdp
      - vnc
      - pcanywhere
      - ftp
      - netbios
      - smb
      - ftp-data
      - irc-dcc-data
      - rsync
      - tftp
      - dropbox
      - bittorrent
      - gnutella
      - dnp3
      - modbus
      - gtpv1
      - gps
      - wiu
      - http
      - smtp
      - imap
      - pop3
      - mapi
      - mysql
      - irc
      - sip
      description: The protocol.
    - name: family
      auto: PREDEFINED
      predefined:
      - network_services
      - network_management
      - encrypted
      - tunnel
      - logging
      - application_service
      - authentication
      - remote_access
      - file_transfer
      - p2p
      - scada
      - mobile
      - web
      - mail
      - database
      - chat
      - voice
      description: The protocol family.
    - name: log
      auto: PREDEFINED
      predefined:
      - app_stats
      - arp
      - bittorrent
      - communication
      - conn
      - credit_card_exposure
      - dce_rpc
      - dce_rpc_lsa
      - dhcp
      - dhcpv6
      - dnp3
      - dns
      - dpd
      - files
      - ftp
      - gnutella
      - http
      - icmp
      - imap
      - intel
      - irc
      - kerberos
      - known_certs
      - known_hosts
      - known_services
      - loaded_scripts
      - mqtt
      - mysql
      - notice
      - ntlm
      - ntp
      - openvpn
      - packet_filter
      - pcr
      - pe
      - pop3
      - ps_long_running_flows
      - psanalytics
      - psfile_analytics
      - rdp
      - reporter
      - rfb
      - sip
      - smb_auth
      - smb_cmd
      - smb_files
      - smb_mapping
      - smtp
      - snmp
      - socks
      - software
      - ssh
      - ssl
      - stats
      - syslog
      - tcp
      - telnet
      - traceroute
      - tunnel
      - udp
      - weird
      - x509
      description: The log name.
    - name: geo
      description: The 2-digit geo code,' local', or 'private'.
    - name: port
      description: The port number.
    - name: start_time
      description: The beginning of the time range to query. Either an ISO time string or seconds since the epoch.
    - name: stop_time
      description: The end of the time range to query. Either an ISO time string or seconds since the epoch.
    - name: envid
      description: The environment id of the probe to search.
    - name: probe
      description: The probe number of the probe to search.
    - name: limit
      description: Limit the number of search results.
      defaultValue: "5000"
    description: Query packetsled extracted files
  - name: packetsled-get-pcaps
    arguments:
    - name: entity
      description: The ip of the entity to query flows for.
    - name: protocol
      auto: PREDEFINED
      predefined:
      - tcp
      - udp
      - dns
      - dhcp
      - arp
      - finger
      - ncp
      - rpc
      - telnet
      - rlogin
      - citrix
      - dhcpv6
      - icmp
      - ntp
      - snmp
      - bgp
      - ripv1
      - ripv2
      - ipmi
      - ssh
      - ssl
      - openvpn
      - teredo
      - tunnel
      - ciscovpn_tcp
      - ciscovpn_udp
      - syslog
      - dce-rpc
      - xmpp
      - amqp
      - emp
      - dce-rpc-lsa
      - ident
      - radius
      - socks
      - kerberos
      - ntlm
      - login
      - rdp
      - vnc
      - pcanywhere
      - ftp
      - netbios
      - smb
      - ftp-data
      - irc-dcc-data
      - rsync
      - tftp
      - dropbox
      - bittorrent
      - gnutella
      - dnp3
      - modbus
      - gtpv1
      - gps
      - wiu
      - http
      - smtp
      - imap
      - pop3
      - mapi
      - mysql
      - irc
      - sip
      description: The protocol.
    - name: port
      description: The port number.
    - name: start_time
      description: The beginning of the time range to query. Either an ISO time string or seconds since the epoch.
    - name: stop_time
      description: The end of the time range to query. Either an ISO time string or seconds since the epoch.
    - name: limitbytes
      description: The upper bound on the number of bytes to return from the query.
    - name: limitpkts
      description: The upper bound on the number of packets to process from the query.
    - name: envid
      description: The environment id of the probe to search.
    - name: probe
      description: The probe number of the probe to search.
    description: Query packetsled for full packet
  - name: packetsled-get-events
    arguments:
    - name: uid
      required: true
      description: The uid to retrieve logs for. Use the _id attribute from a flow for this parameter value.
    - name: envid
      description: The environment id of the probe to search.
    - name: probe
      description: The probe number of the probe to search.
    outputs:
    - contextPath: Packetsled.Events
      description: Retrieve all logs for a single flow.
    - contextPath: Packetsled.Events._id
      description: The unique id of the Event.
    - contextPath: Packetsled.Events.src_ip
      description: The originator of the Events.
    - contextPath: Packetsled.Events.dest_ip
      description: The respondant of the Events.
    description: Get all of the events for a given uid
  isfetch: true
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- No test
fromversion: 5.0.0