Packetsled

Details

ID	`Packetsled`
Provider	Mixmode
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Overview

Use this integration to access the PacketSled playbook and command query.

Employ incidents and artifacts from an investigation, or a full packet capture, based on the perspective of a user or a host.

Use either the playbook or the individual commands to get the level of detail necessary for your investigation.

This integration was integrated and tested with PacketSled v5.3.2 and earlier.

Use Cases

Extract incidents, files, or PCAP.
Extract metadata for a specific host.
Enumerate sensors.

Prerequisites

Make sure you have the following PacketSled information.

Username and password for credential access
Confirm firewall rules to enable access to PacketSled API

Configure PacketSled on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for PacketSled.
Click Add instance to create and configure a new integration instance.
- Name: textual name for the integration instance
- Server URL (https://<customer_id>.packetsled.com)
- If you want to Cortex XSOAR incidents to be created automatically from this integration instance, click Fetch Incidents.
- Credentials: PacketSled username
- Password: PacketSled password
Click Test to validate credentials and configuration.
Click Done to install integration.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Extract incidents: packetsled-get-incidents
Enumerate sensors: packetsled-get-sensors
Extract metadata for a specific host: packetsled-get-flows
Extract files: packetsled-get-files
Extract PCAP: packetsled-get-pcaps

Extract incidents: packetsled-get-incidents

Extracts all incidents that occurred from last time they were extracted.

Inputs

Parameter	Description	Required
start_time	Beginning of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to 1 hour ago)	Optional
stop_time	End of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to current time)	Optional
envid	Unique ID in PacketSled to identify a group of sensors that belong to a single customer (by default, all sensors are queried)	Optional
probe	Unique ID in an envid used to identify a single sensor (by default, all sensors are queried)	Optional

Raw Output

{  
   "name":"Source: Packetsled SENSOR: , ENTITY: ",
   "rawJSON":{  

   }
}

Enumerate sensors: packetsled-get-sensors

Enumerates all attached sensors.

-NO FURTHER INFORMATION-

Extract metadata for a specific host: packetsled-get-flows

Finds flow metadata based on the specified parameters. The flows are posted as JSON files to the War Room.

Command Example

!packetsled-get-flows entity=192.168.0.110 limit=10000

Inputs

Parameter	Description	Required
start_time	Beginning of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to 1 hour ago)	Optional
stop_time	End of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to current time)	Optional
envid	Unique ID in PacketSled to identify a group of sensors that belong to a single customer (by default, all sensors are queried)	Optional
probe	Unique ID in an envid used to identify a single sensor (by default, all sensors are queried)	Optional
entity	IP address	Optional
port	Port	Optional
geo	Geographical code	Optional
family	Protocol family (enumeration value)	Optional
proto	Protocol (enumeration value)	Optional

Extract files: packetsled-get-files

Finds file artifacts based on the specified parameters. The files are posted to the War Room.

Inputs

Parameter	Description	Required
start_time	Beginning of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to 1 hour ago)	Optional
stop_time	End of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to current time)	Optional
envid	Unique ID in PacketSled to identify a group of sensors that belong to a single customer (by default, all sensors are queried)	Optional
probe	Unique ID in an envid used to identify a single sensor (by default, all sensors are queried)	Optional
entity	IP address	Optional
port	Port	Optional
geo	Geographical code	Optional
family	Protocol family (enumeration value)	Optional
proto	Protocol (enumeration value)	Optional

Extract PCAP: packetsled-get-pcaps

Finds full packet capture files based on the specified parameters. The PCAP files are posted to the War Room.

Command Example

!packetsled-get-pcaps entity=192.168.0.110

Inputs

Parameter	Description	Required
start_time	Beginning of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to 1 hour ago)	Optional
stop_time	End of the time range to query, can be either epoch seconds or ISO formatted datetime (defaults to current time)	Optional
envid	Unique ID in PacketSled to identify a group of sensors that belong to a single customer (by default, all sensors are queried)	Optional
probe	Unique ID in an envid used to identify a single sensor (by default, all sensors are queried)	Optional
entity	IP address	Optional
port	Port	Optional
proto	A protocol (enumeration value)	Optional

packetsled-sensors

List the sensors attached to the packetsled platform.

Base Command

packetsled-sensors

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
Packetsled.Sensors	unknown	The list of sensors
Packetsled.Sensors.label	unknown	The label of the sensor
Packetsled.Sensors.envid	unknown	The environment id of the sensor
Packetsled.Sensors.probe	unknown	The probe number of the sensor

packetsled-get-events

Get all of the events for a given uid

Base Command

packetsled-get-events

Input

Argument Name	Description	Required
uid	The uid to retrieve logs for. Use the _id attribute from a flow for this parameter value.	Required
envid	The environment id of the probe to search.	Optional
probe	The probe number of the probe to search.	Optional

Context Output

Path	Type	Description
Packetsled.Events	unknown	Retrieve all logs for a single flow
Packetsled.Events._id	unknown	The unique id of the Event
Packetsled.Events.src_ip	unknown	The originator of the Events
Packetsled.Events.dest_ip	unknown	The respondant of the Events

Configuration parameters

ApiServer — The protocol and domain of the packetsled instance. (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
credentials — Username (required)
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
max_fetch — Fetch Limit

Commands (6)

packetsled-get-events
Get all of the events for a given uid
packetsled-get-files
Query packetsled extracted files
packetsled-get-flows
Query packetsled sensor metadata
packetsled-get-incidents
Query for incidents by time range and severity
packetsled-get-pcaps
Query packetsled for full packet
packetsled-sensors
List the sensors attached to the packetsled platform.

Source

Packetsled.py Packetsled_test.py Packetsled.yml Packetsled_description.md

Download History Raw

import Packetsled
from freezegun import freeze_time


def test_number_to_ip():
    assert Packetsled.number_to_ip(168496141) == "10.11.12.13"


def test_ip_to_number():
    assert Packetsled.ip_to_number("10.11.12.13") == 168496141


def test_format_flow():
    flow = {"src_ip": 168496141, "dest_ip": 168496141, "family": [2, 4, 6]}
    assert Packetsled.format_flow(flow) == {
        "src_ip": "10.11.12.13",
        "dest_ip": "10.11.12.13",
        "family": ["network_management", "tunnel", "application_service"],
    }


@freeze_time("2022-09-08 17:22:13 UTC")
def test_getTime():
    time = Packetsled.getTime("2017-01-12T14:12:06.000Z")
    assert time == 1484230326.0


@freeze_time("2022-09-08 17:22:13 UTC")
def test_isoTime():
    time = Packetsled.getTime("2017-01-12T14:12:06.000Z")
    assert time == 1484230326.0


def test_coalesceToArray():
    assert Packetsled.coalesceToArray({"1": True, "2": False}) == [{"1": True, "2": False}]


@freeze_time("2022-09-08 17:22:13 UTC")
def test_make_timerange():
    dargs = {"stop_time": "2017-01-12T14:12:06.000Z", "start_time": "2016-01-12T14:12:06.000Z"}
    assert Packetsled.make_timerange(dargs) == (1452607926.0, 1484230326.0)


def test_make_query():
    dargs = {
        "stop_time": "2017-01-12T14:12:06.000Z",
        "start_time": "2016-01-12T14:12:06.000Z",
        "family": ["network_management", "tunnel", "application_service"],
    }
    assert Packetsled.make_query(dargs) == {
        "time": {"=": {"scalars": [], "ranges": [{"v1": 1452607926.0, "v2": 1484230326.0}]}},
        "family": {"=": {"scalars": [{"v1": 2}, {"v1": 4}, {"v1": 6}], "ranges": []}},
    }