Pentera

Automate remediation actions based on Pentera, the Automated Security Validation Platform, proactively exposing high-risk vulnerabilities.

Data Enrichment & Threat Intelligence · Pentera

Details

IDPentera
ProviderPentera
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/auth-utils:1.0.0.3562326
Supported ModulesAgentix XSIAM

README

Overview

Integration with Pentera.
This integration was integrated and tested with version 4.5.2 of Pentera

Pentera Playbook

Use Cases

Integration Use Cases:

  1. Integrate PenTera’s Automated Penetration Testing findings within Cortex XSOAR for playbook-driven enrichment and response
  2. Address penetration testing findings, prioritize, and automate response tasks
  3. Leverage Cortex XSOAR’s third-party product integrations

Use Case #1: Automate Dynamic Vulnerability Alerts - Password Policy
Challenge: Password policies are a continuous undertaking that organizations need to review regularly.
Solution: With the Cortex XSOAR-PenTera integration, PenTera can continuously validate the effectiveness of enterprise passwords and take action on easily crackable passwords with focus on high privileged accounts. Once PenTera flags a password that doesn’t meet the standard, automated playbooks through Cortex XSOAR take action and remediate the vulnerability based on corporate policy.

Use Case #2: Automated real-time validation for critical vulnerabilities
Challenge: Continuous security validation is critical for the ongoing cyber hygiene of an organization’s network. However, critical vulnerabilities require on-demand testing as they influence many components of the network. Security teams struggle with prioritizing remediation and understanding the true impact vulnerabilities have on their specific network.
Solution: After running automated single-action tests for critical vulnerabilities, the Cortex XSOAR integration allows security teams to automate the response process based on the findings. For example, PenTera discovers the vulnerability of different components of the network, e.g a server or an endpoint. The latter is a simpler fix that should go through one workflow, perhaps even be automatically remediated, while the first, a much more complex process, will create a high-risk task in the relevant workflow, automatically prioritizing the response tasks based on business impact severity.

Configure Pentera on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Pentera.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URL (e.g. https://192.168.64.128)
    • Pentera API port
    • TGT (The token from Pentera UI in Administration -> API Clients)
    • Client Id
    • Trust any certificate (not secure)
    • Use system proxy settings
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. pentera-run-template-by-name
  2. pentera-get-task-run-status
  3. pentera-get-task-run-full-action-report

1. pentera-run-template-by-name

Run a specific template by its name. Please add the template name in the parameters

Required Permissions

Operator and admin users

Base Command

pentera-run-template-by-name

Input
Argument Name Description Required
template_name The name of the template that you want to run Required
Context Output
Path Type Description
Pentera.TaskRun.TemplateName String Returns the name of the template
Pentera.TaskRun.ID String The task run id
Pentera.TaskRun.StartTime Date The date when the task run started
Pentera.TaskRun.EndTime Date The date when the task run ended
Pentera.TaskRun.Status String The status of the task run; e.g.: ‘Running’, ‘Pending’, ‘Failed’, ‘Cleaning up’, ‘Canceled’, ‘Done’, ‘Warning’, ‘Aborted (exceeded max hosts limit)’.
Command Example

!pentera-run-template-by-name template_name="Test Template for Playbook"

Context Example
{
    "Pentera.TaskRun": {
        "Status": "Running", 
        "TemplateName": "Test Template for Playbook", 
        "StartTime": 2020-02-13T19:32:45Z, 
        "EndTime": null, 
        "ID": "5e45883d1deb8eda82b1eed5"
    }
}
Human Readable Output

Test Template for Playbook

|ID|StartTime|Status|TemplateName|
|—|—|—|—|
| 2020-02-13 17:32:45Z | 5e45883d1deb8eda82b1eed5 | ‘2020-02-13T17:32:45Z’ | Running | Test Template for Playbook |
Integration log: Full Integration Log:
Got command: pentera-run-template-by-name
result is JSON
Parsed JSON Response: {‘ID’: ‘5e45883d1deb8eda82b1eed5’, ‘TemplateName’: ‘Test Template for Playbook’, ‘StartTime’: ‘2020-02-13T17:32:45Z’, ‘EndTime’: None, ‘Status’: ‘Running’}
Parsed JSON Response: {‘ID’: ‘5e45883d1deb8eda82b1eed5’, ‘TemplateName’: ‘Test Template for Playbook’, ‘StartTime’: ‘2020-02-13T17:32:45Z’, ‘EndTime’: None, ‘Status’: ‘Running’}

2. pentera-get-task-run-status

Get the status of a task run by its task run id

Required Permissions

Operator and admin users

Base Command

pentera-get-task-run-status

Input
Argument Name Description Required
task_run_id The ID of the task run Required
Context Output
Path Type Description
Pentera.TaskRun.ID String The task run id
Pentera.TaskRun.TemplateName String Returns the name of the template
Pentera.TaskRun.StartTime Date The date when the task run started
Pentera.TaskRun.EndTime Date The date when the task run ended
Pentera.TaskRun.Status String The status of the task run; e.g.: ‘Running’, ‘Pending’, ‘Failed’, ‘Cleaning up’, ‘Canceled’, ‘Done’, ‘Warning’, ‘Aborted (exceeded max hosts limit)’.
Command Example

```!pentera-get-task-run-status task_run_id=”5e4583221deb8eda82b195c5”


##### Context Example

{
“Pentera.TaskRun”: {
“Status”: “Done”,
“TemplateName”: “Test Template for Playbook”,
“StartTime”: “2020-02-13T17:10:58Z”,
“EndTime”: “2020-02-13T19:14:12Z”,
“ID”: “5e4583221deb8eda82b195c5”
}
}


##### Human Readable Output

### Test Template for Playbook

|EndTime|ID|StartTime|Status|TemplateName|
|---|---|---|---|---|
| 2020-02-13 17:10:58Z | 1581614052321.0 | 5e4583221deb8eda82b195c5 | 1581613858961.0 | Done | Test Template for Playbook |
Integration log: Full Integration Log:
Got command: pentera-get-task-run-status
result is JSON
Parsed JSON Response: {'ID': '5e4583221deb8eda82b195c5', 'TemplateName': 'Test Template for Playbook', 'StartTime': '2020-02-13T17:10:58Z', 'EndTime': '2020-02-13T19:14:12Z', 'Status': 'Done'}

### 3. pentera-get-task-run-full-action-report

Get the full action report of a task run

###### Fieldnames: 'Severity', 'Time', 'Duration', 'Operation Type', 'Techniques', 'Parameters', 'Status'

#### Severity

* Low: [0: 2.5)
* Medium: [2.5: 5)
* High: [5: 7.5)
* Critical: [7.5: 10]

#### Duration

In milliseconds

#### Status

'Running', 'Pending', 'Failed', 'Cleaning up', 'Canceled', 'Done', 'Warning', 'Aborted (exceeded max hosts limit)'.

##### Required Permissions

User view, operator and admin users

##### Base Command

`pentera-get-task-run-full-action-report`

##### Input

| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| task_run_id | The ID of the task run | Required |

##### Context Output

| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| Pentera.TaskRun.ID | String | The task run id |
| Pentera.TaskRun.TemplateName | String | Returns the name of the template |
| Pentera.TaskRun.StartTime | Date | The date when the task run started |
| Pentera.TaskRun.EndTime | Date | The date when the task run ended |
| Pentera.TaskRun.Status | String | The status of the task run; e.g.: 'Running', 'Pending', 'Failed', 'Cleaning up', 'Canceled', 'Done', 'Warning', 'Aborted (exceeded max hosts limit)'. |
| Pentera.TaskRun.FullActionReport | String | The full action report of the task run |

##### Command Example

```!pentera-get-task-run-full-action-report task_run_id="5e4583221deb8eda82b195c5"
Context Example
{
    "Pentera.TaskRun": {
        "FullActionReport": [
            {
                "Status": "no results", 
                "Severity": "", 
                "Parameters": "Host: 192.168.1.2", 
                "Time": "13/02/2020, 17:11:59", 
                "Duration": "31578", 
                "Operation Type": "BlueKeep (CVE-2019-0708) Vulnerability Discovery", 
                "Techniques": "Network Service Scanning(T1046)"
            }, 
            {
                "Status": "no results", 
                "Severity": "", 
                "Parameters": "Host: 192.168.1.1", 
                "Time": "13/02/2020, 17:12:01", 
                "Duration": "31618", 
                "Operation Type": "BlueKeep (CVE-2019-0708) Vulnerability Discovery", 
                "Techniques": "Network Service Scanning(T1046)"
            }
        ], 
        "ID": "5e4583221deb8eda82b195c5"
    }
}
Human Readable Output

Pentera Report for TaskRun ID

|Agent Name|Categories|Duration|Operation Type|Parameters|Severity|Status|Techniques|Time|
|—|—|—|—|—|—|—|—|—|
| default-node | Discovery, Reconnaissance | 31578 | BlueKeep (CVE-2019-0708) Vulnerability Discovery | Host: 192.168.1.2 | | no results | Network Service Scanning(T1046) | 13/02/2020, 17:11:59 |
| default-node | Discovery, Reconnaissance | 31618 | BlueKeep (CVE-2019-0708) Vulnerability Discovery | Host: 192.168.1.1 | | no results | Network Service Scanning(T1046) | 13/02/2020, 17:12:01 |
Integration log: Full Integration Log:
Got command: pentera-get-task-run-full-action-report
result is TEXT

Configuration parameters

  • url — Server URL (e.g. https://192.168.64.128) (required)
  • port — Pentera API port (required)
  • clientId — Client Id (required)
  • tgt — TGT (The token from Pentera UI in Administration -> API Clients) (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (3)

  • pentera-get-task-run-full-action-report

    Get the full action report of a task run.

  • pentera-get-task-run-status

    Get the status of a task run by its task run id.

  • pentera-run-template-by-name

    Run a specific template by its name. Please add the template name in the parameters.

Source

Pcysys.py Pcysys_test.py Pcysys.yml Pcysys_description.md
Download History Raw 
import demistomock as demisto
import jwt
from Pcysys import (
    Client,
    pentera_authentication,
    pentera_get_task_run_full_action_report_command,
    pentera_get_task_run_status_command,
    pentera_run_template_command,
)

MOCK_PENTERA_FULL_ACTION_REPORT = "penterascan-5e4530961deb8eda82b08730.csv"
MOCK_CSV = open("TestData/mock_csv_file").read()
MOCK_AUTHENTICATION = {"token": "TOKEN", "tgt": "TGT"}
MOCK_AUTHENTICATION_EXP = 1579763364
MOCK_RUN_TEMPLATE = {
    "taskRuns": [
        {
            "status": "Running",
            "taskRunId": "5e41923cf24e1f99979b1cb4",
            "taskRunName": "Test mock task run name",
            "startTime": 1581348380358.0,
            "endTime": 1581349123973.0,
        }
    ],
}
MOCK_TASK_RUN_STATS = {
    "taskRuns": [
        {
            "taskRunId": "5e41923cf24e1f99979b1cb4",
            "taskRunName": "Test mock task run name",
            "startTime": 1581348380358.0,
            "endTime": 1581349123973.0,
            "status": "Warning",
        }
    ]
}


def test_pentera_get_task_run_full_action_report(mocker, requests_mock):
    mocker.patch.object(demisto, "params", return_value={"url": "https://pentera.com", "port": "8181"})
    mocker.patch.object(
        demisto,
        "getIntegrationContext",
        return_value={
            "base_url": "https://pentera.com",
            "tgt": "omgNewTGT",
            "accessToken": "omgNewSecret",
            "expiry": MOCK_AUTHENTICATION_EXP,
        },
    )
    mocker.patch.object(demisto, "args", return_value={"task_run_id": "5e4530961deb8eda82b08730"})
    requests_mock.get("https://pentera.com:8181/api/v1/taskRun/5e4530961deb8eda82b08730/fullActionReportCSV", text=MOCK_CSV)
    client_id = demisto.params().get("clientId")
    tgt = demisto.params().get("tgt")
    base_url = demisto.params()["url"].rstrip("/") + ":" + demisto.params()["port"]
    verify_certificate = not demisto.params().get("insecure", False)
    proxy = demisto.params().get("proxy", False)
    args = demisto.args()
    client = Client(
        base_url=base_url,
        tgt=tgt,
        verify=verify_certificate,
        client_id=client_id,
        proxy=proxy,
        headers={"Accept": "application/json"},
    )
    entries = pentera_get_task_run_full_action_report_command(client, args)
    raw_csv_file_name = entries[0]["File"]
    assert raw_csv_file_name == MOCK_PENTERA_FULL_ACTION_REPORT
    task_run_id = entries[1]["EntryContext"]["Pentera.TaskRun(val.ID == obj.ID)"]["ID"]
    assert task_run_id == "5e4530961deb8eda82b08730"
    operation_type = entries[1]["EntryContext"]["Pentera.TaskRun(val.ID == obj.ID)"]["FullActionReport"][0]["Operation Type"]
    assert operation_type == "BlueKeep (CVE-2019-0708) Vulnerability Discovery"


def test_pentera_get_task_run_stats(mocker, requests_mock):
    mocker.patch.object(demisto, "params", return_value={"url": "https://pentera.com", "port": "8181"})
    mocker.patch.object(
        demisto,
        "getIntegrationContext",
        return_value={
            "base_url": "https://pentera.com",
            "tgt": "omgNewTGT",
            "accessToken": "omgNewSecret",
            "expiry": MOCK_AUTHENTICATION_EXP,
        },
    )
    mocker.patch.object(demisto, "args", return_value={"task_run_id": "5e41923cf24e1f99979b1cb4"})
    requests_mock.get("https://pentera.com:8181/api/v1/taskRun/5e41923cf24e1f99979b1cb4", json=MOCK_RUN_TEMPLATE)
    client_id = demisto.params().get("clientId")
    tgt = demisto.params().get("tgt")
    base_url = demisto.params()["url"].rstrip("/") + ":" + demisto.params()["port"]
    verify_certificate = not demisto.params().get("insecure", False)
    proxy = demisto.params().get("proxy", False)
    args = demisto.args()
    client = Client(
        base_url=base_url,
        tgt=tgt,
        verify=verify_certificate,
        client_id=client_id,
        proxy=proxy,
        headers={"Accept": "application/json"},
    )
    readable, parsed, raw = pentera_get_task_run_status_command(client, args)

    assert parsed["Pentera.TaskRun(val.ID == obj.ID)"]["ID"] == MOCK_TASK_RUN_STATS["taskRuns"][0]["taskRunId"]


def test_pentera_run_template(mocker, requests_mock):
    mocker.patch.object(demisto, "params", return_value={"url": "https://pentera.com", "port": "8181"})
    mocker.patch.object(
        demisto,
        "getIntegrationContext",
        return_value={
            "base_url": "https://pentera.com",
            "tgt": "omgNewTGT",
            "accessToken": "omgNewSecret",
            "expiry": MOCK_AUTHENTICATION_EXP,
        },
    )
    mocker.patch.object(demisto, "args", return_value={"template_name": "omgRunThisTemplate"})
    requests_mock.post("https://pentera.com:8181/api/v1/template/runBulk", json=MOCK_RUN_TEMPLATE)
    client_id = demisto.params().get("clientId")
    tgt = demisto.params().get("tgt")
    base_url = demisto.params()["url"].rstrip("/") + ":" + demisto.params()["port"]
    verify_certificate = not demisto.params().get("insecure", False)
    proxy = demisto.params().get("proxy", False)
    args = demisto.args()
    client = Client(
        base_url=base_url,
        tgt=tgt,
        verify=verify_certificate,
        client_id=client_id,
        proxy=proxy,
        headers={"Accept": "application/json"},
    )
    readable, parsed, raw = pentera_run_template_command(client, args)
    assert parsed["Pentera.TaskRun(val.ID == obj.ID)"]["Status"] == MOCK_RUN_TEMPLATE["taskRuns"][0]["status"]


def test_pentera_authentication(mocker, requests_mock):
    mocker.patch.object(
        demisto,
        "params",
        return_value={"clientId": "mmtzv", "tgt": "omgSecretsWow", "url": "https://pentera.com", "port": "8181"},
    )
    mocker.patch.object(jwt, "get_unverified_header", return_value={"alg": "HS256", "exp": 1579763364, "iat": 1579762464})

    requests_mock.post("https://pentera.com:8181/auth/token", json=MOCK_AUTHENTICATION)
    mocker.patch.object(demisto, "args", return_value={})
    mocker.patch.object(demisto, "setIntegrationContext")

    client_id = demisto.params().get("clientId")
    tgt = demisto.params().get("tgt")
    base_url = demisto.params()["url"].rstrip("/") + ":" + demisto.params()["port"]
    verify_certificate = not demisto.params().get("insecure", False)
    proxy = demisto.params().get("proxy", False)
    client = Client(
        base_url=base_url,
        tgt=tgt,
        verify=verify_certificate,
        client_id=client_id,
        proxy=proxy,
        headers={"Accept": "application/json"},
    )
    pentera_authentication(client)

    assert demisto.setIntegrationContext.call_count == 1
    integration_context = demisto.setIntegrationContext.call_args[0][0]
    assert isinstance(integration_context, dict)
    assert integration_context["expiry"] == MOCK_AUTHENTICATION_EXP
    assert integration_context["accessToken"] == MOCK_AUTHENTICATION["token"]