Picus

Run commands on Picus and automate security validation with playbooks.

Network Security · PicusAutomation (Deprecated)

Details

IDPicus
ProviderPicus Security
CategoryNetwork Security
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

Run commands on Picus and automate security validation with playbooks.
This integration was integrated and tested with version 3976 of Picus

Configure Picus in Cortex

image

Parameter Description Required
Picus Manager URL   True
Picus Refresh Token The refresh token will be used to generate access token. True
Trust any certificate (not secure)   False
Use system proxy settings   False

image

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

picus-get-access-token

Generates an access token for API usage. This function used for other functions inner authentication mechanism. Looks for X-Refresh-Token on the header or refresh-token cookie.

Base Command

picus-get-access-token

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

picus-get-vector-list

Returns the vector list from PICUS. These vectors can be used for automation processes.

Base Command

picus-get-vector-list

Input

Argument Name Description Required
add_user_details Add vectors’ assigned user details to the response. Optional
page Requested page number. Optional
size Requested data size. Optional

Context Output

Path Type Description
Picus.vectorlist.description String Description info of the vector
Picus.vectorlist.heartbeat_results.is_successful Boolean Was the heartbeat end successfully?
Picus.vectorlist.heartbeat_results.module String On which module did the heartbeat executed?
Picus.vectorlist.heartbeat_results.result_time Date When the heartbeat is executed? (End time)
Picus.vectorlist.heartbeat_results.variant String On which variant did the heartbeat executed?
Picus.vectorlist.is_disabled Boolean Is the vector status disabled?
Picus.vectorlist.name String Name of the vector
Picus.vectorlist.trusted String Trusted peer name
Picus.vectorlist.type String Type of the vector, if error is encountered, “Unknown” is returned. Other valid values are: “Network”, “Email, “Endpoint”
Picus.vectorlist.untrusted String Untrusted peer name
Picus.vectorlist.users Unknown Users assigned to this vector

Command Example

!picus-get-vector-list

Human Readable Output

Name Trusted Untrusted Is Disabled Type
Picus_Attacker_1 - Win10-Det1 Win10-Det1 Picus_Attacker_1 true Endpoint
Picus_Attacker_2 - Win10-Det2 Win10-Det2 Picus_Attacker_2 true Endpoint

picus-get-peer-list

Returns the peer list with current statuses. These peers also can be seen on the PICUS Panel ->Settings-> Peers.

image

Base Command

picus-get-peer-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
Picus.peerlist.is_alive Boolean Is Peer Alive?
Picus.peerlist.latest_attack Date Latest Attack Time of the Peer
Picus.peerlist.name String Peer Name
Picus.peerlist.registered_ip String IP of the peer
Picus.peerlist.type String Peer’s Type

Command Example

!picus-get-peer-list

Human Readable Output

Name Registered Ip Type Is Alive
Picus_Attacker_1 x.x.x.x Network true
Picus_Attacker_2 x.x.x.x Network true
Win10-Det2 x.x.x.x Endpoint true

picus-get-attack-results

In the Picus, all attacks are carried out with the logic of the attacker and the victim. This command returns the list of the attack results on specified peers. Time range and result status can be given.

Base Command

picus-get-attack-results

Input

Argument Name Description Required
attacker_peer Untrusted peer name. Required
victim_peer Trusted peer name. Required
days Set days parameter. Default is 3. Optional
result This setting can only be insecure,secure and all. Default is all. Optional

Context Output

Path Type Description
Picus.attackresults.results.threat_ids String Threat ID List
Picus.attackresults.results.begin_time Date begin time of the attack
Picus.attackresults.results.destination_port Number Value “0” indicates it is not applicable such as all vector types except network
Picus.attackresults.results.end_time Date end time of the attack
Picus.attackresults.results.id Number id
Picus.attackresults.results.l1_category_name String Level 1 Category Name of the attack
Picus.attackresults.results.scenario_details.action_id Number Action ID of the threat scenario action
Picus.attackresults.results.scenario_details.action_name String Action Name of the threat scenario action
Picus.attackresults.results.scenario_details.end Date The time attack ended
Picus.attackresults.results.scenario_details.id Number Primary key
Picus.attackresults.results.scenario_details.process_results Unknown Process Results(play and rewind)
Picus.attackresults.results.scenario_details.result String Final result of the scenario action
Picus.attackresults.results.scenario_details.technique_id String Technique ID of the threat scenario action
Picus.attackresults.results.source_port Number Value “0” indicates it is not applicable such as all vector types except network and wats attacks
Picus.attackresults.results.string String Attack Result
Picus.attackresults.results.threat_id Number Threat ID of the attack
Picus.attackresults.results.threat_name String Threat Name of the attack
Picus.attackresults.results.trusted String Trusted peer name
Picus.attackresults.results.untrusted String Untrusted peer name
Picus.attackresults.results.variant String Variant info

Command Example

!picus-get-attack-results attacker_peer="Picus_Attacker_1" victim_peer="net1-det1" days=1 result="insecure"

Human Readable Output

Begin Time End Time String Threat Id Threat Name
2021-09-16T23:59:54.738644627Z 2021-09-16T23:59:54.753408649Z Insecure 206450 HTML5 Web Storage Sensitive Data Exposure
2021-09-16T23:52:52.022470123Z 2021-09-16T23:52:52.077736344Z Insecure 206111 Zeus PandaBanker Trojan .EXE File Download Variant-11

picus-run-attacks

In the Picus, all attacks are carried out with the logic of the attacker and the victim. This command schedules a single attack on the requested vector.

Base Command

picus-run-attacks

Input

Argument Name Description Required
threat_ids Threat ID list (“111,222,333,…”) or single threat ID can be given. Required
attacker_peer Untrusted peer name. Required
victim_peer Trusted peer name. Required
variant This parameter can be HTTP or HTTPS. Example variant=HTTP Required

Context Output

Path Type Description
Picus.runattacks String IDs of the assessed attacks

Command Example

!picus-run-attacks attacker_peer="Picus_Attacker_1" victim_peer="net1-det1" threat_ids="881728,879812,798283" variant="HTTP"

Human Readable Output

Threat Id Result
881728 success
879812 success
798283 success

picus-get-threat-results

Returns the list of the attack results of a single threat have optional parameters for filtration.

Base Command

picus-get-threat-results

Input

Argument Name Description Required
threat_ids Threat ID list (“111,222,333,…”) or single threat ID can be given. Required
attacker_peer Untrusted peer name. Required
victim_peer Trusted peer name. Required
variant This parameter can be HTTP or HTTPS. Example variant=HTTP Required

Context Output

Path Type Description
Picus.threatresults.results.threat_results String Threat Results(ID and result combination)
Picus.threatresults.results.l1_category String Level 1 Category Name of the attack
Picus.threatresults.results.last_time Date Last Threat Result Time
Picus.threatresults.results.result String Threat Result
Picus.threatresults.results.status String Status
Picus.threatresults.results.threat_id Number Threat ID of the attack

Command Example

!picus-get-threat-results attacker_peer="Picus_Attacker_1" victim_peer="net1-det1" variant="HTTP" threat_ids="562172"

Human Readable Output

Threat Id Result L1 Category Last Time Status
562172 Secure Vulnerability Exploitation 2021-09-16T13:26:00.932298Z success

picus-set-paramPB

Set parameter on the playbook. (This command is only used on playbook)

Base Command

picus-set-paramPB

Input

Argument Name Description Required
attacker_peer Untrusted peer name. Required
victim_peer Trusted peer name. Required
variant This parameter can be HTTP or HTTPS. Example variant=HTTP Required
mitigation_product Products info of the mitigation. This parameter can be Check Point NGFW, ForcepointNGFW, McAfee IPS, PaloAlto IPS, SourceFire IPS, TippingPoint, F5 BIG-IP, Fortigate WAF, FortiWeb, Fortigate IPS, Snort, CitrixWAF, and ModSecurity. Required
days Set days parameter. Default is 3. Optional

Context Output

Path Type Description
Picus.param.attacker_peer String Untrusted peer name
Picus.param.days Number days
Picus.param.mitigation_product String Products info of the mitigation
Picus.param.variant String This parameter can be HTTP or HTTPS. Example variant=HTTP
Picus.param.victim_peer String Trusted peer name

filter-insecure-attacks

Filter insecure attacks on the playbook. (This command is only used on playbook)

Base Command

picus-filter-insecure-attacks

Input

Argument Name Description Required
threatinfo Threat id and result combine. Used for playbook. Required

Context Output

Path Type Description
Picus.filterinsecure String Insecure Attack List

picus-get-mitigation-list

Returns the list of the mitigations of threats have optional parameters for filtration, this route may not be used associated with your license.

Base Command

picus-get-mitigation-list

Input

Argument Name Description Required
threat_ids Threat ID list (“111,222,333,…”) or single threat ID can be given. Required
product Products info of the mitigation. This parameter can be Check Point NGFW, ForcepointNGFW, McAfee IPS, PaloAlto IPS, SourceFire IPS, TippingPoint, F5 BIG-IP, Fortigate WAF, FortiWeb, Fortigate IPS, Snort, CitrixWAF, and ModSecurity. Required

Context Output

Path Type Description
Picus.mitigationresults.signature_id String ID of the signature
Picus.mitigationresults.signature_name String Name of the signature
Picus.mitigationresults.threat_id Number Threat ID of Picus Attack
Picus.mitigationresults.vendor String Product name of the mitigation

Command Example

!picus-get-mitigation-list threat_ids="103847" product="Snort"

Human Readable Output

Threat Dd Signature Id Signature Name
103847 1.2025644.1 ET TROJAN Possible Metasploit Payload Common Construct Bind_API (from server)
103847 1.44728.3 INDICATOR-COMPROMISE Meterpreter payload download attempt

picus-get-vector-compare

Makes a comparison of the given vector’s results.

Base Command

picus-get-vector-compare

Input

Argument Name Description Required
attacker_peer Untrusted peer name. Required
victim_peer Trusted peer name. Required
days Set days parameter. Default is 3. Optional

Context Output

Path Type Description
Picus.vectorresults.name String Name of Picus Attack
Picus.vectorresults.status String Compare Result
Picus.vectorresults.threat_id String Threat ID of Picus Attack

Command Example

!picus-get-vector-compare attacker_peer="Picus_Attacker_1" victim_peer="net1-det1"

Human Readable Output

Status Threat Id Name
secure 204923 XSS Evasion via HTML Encoding Variant-4
insecure null null
secure_to_insecures null null
insecure_to_secures null null

picus-version

Returns the current Picus version and the update time config.

Base Command

picus-version

Input

There are no input arguments for this command.

Context Output

Path Type Description
Picus.versioninfo.last_update_date Date When was the last update?
Picus.versioninfo.update_time Number When to update?
Picus.versioninfo.version Number Current version

Command Example

!picus-version

Human Readable Output

Version Update Time Last Update Date
4025 0 20.10.2021

picus-trigger-update

Triggers the Picus product update mechanism manually.

Base Command

picus-trigger-update

Input

There are no input arguments for this command.

Context Output

Path Type Description
Picus.triggerupdate.data Boolean Collected data that will be returned
Picus.triggerupdate.success Boolean Is the operation Succeed?

Command Example

!picus-trigger-update

Human Readable Output

Data Success
true true

Configuration parameters

  • picus_server — Picus Manager URL (required)
  • picus_apikey — Picus Refresh Token (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (12)

  • picus-filter-insecure-attacks

    Filter insecure attacks on playbook. (This command is only used on playbook).

  • picus-get-access-token

    Generates an access token for api usage. Looks for X-Refresh-Token on header or refresh-token cookie.

  • picus-get-attack-results

    Returns the list of the attack results have optional parameters for filtration.

  • picus-get-mitigation-list

    Returns the list of the mitigations of threats have optional parameters for filtration, this route may not be used associated with your license.

  • picus-get-peer-list

    Returns the peer list with current statuses.

  • picus-get-threat-results

    Returns the list of the attack results of a single threat have optional parameters for filtration.

  • picus-get-vector-compare

    Makes a comparison of the given vector's results.

  • picus-get-vector-list

    Returns the list of the vectors all disabled and enabled ones have optional parameters for pagination.

  • picus-run-attacks

    Schedules a single attack on requested vector.

  • picus-set-paramPB

    Set parameter on playbook. (This command is only used on playbook).

  • picus-trigger-update

    Triggers the Picus product update mechanism manually.

  • picus-version

    Returns the current Picus version and the update time config.

Source

Picus.py Picus_test.py Picus.yml Picus_description.md command_examples.txt
Download History Raw 
category: Network Security
provider: Picus Security
commonfields:
  id: Picus
  version: -1
configuration:
- display: Picus Manager URL
  name: picus_server
  required: true
  type: 0
- additionalinfo: The refresh token will be used to generate access token.
  display: Picus Refresh Token
  name: picus_apikey
  required: true
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Run commands on Picus and automate security validation with playbooks.
display: Picus Security
name: Picus
script:
  commands:
  - arguments:
    - description: Add vector's assigned user details to the response.
      name: add_user_details
    - description: Requested page number.
      name: page
    - description: Requested data size.
      name: size
    description: Returns the list of the vectors all disabled and enabled ones have optional parameters for pagination.
    name: picus-get-vector-list
    outputs:
    - contextPath: Picus.vectorlist.description
      description: Description info of the vector.
      type: String
    - contextPath: Picus.vectorlist.heartbeat_results.is_successful
      description: Was the heartbeat end successfully?
      type: Boolean
    - contextPath: Picus.vectorlist.heartbeat_results.module
      description: On which module did the heartbeat executed?
      type: String
    - contextPath: Picus.vectorlist.heartbeat_results.result_time
      description: When the heartbeat is executed? (End time).
      type: Date
    - contextPath: Picus.vectorlist.heartbeat_results.variant
      description: On which variant did the heartbeat executed?
      type: String
    - contextPath: Picus.vectorlist.is_disabled
      description: Is the vector status disabled?
      type: Boolean
    - contextPath: Picus.vectorlist.name
      description: Name of the vector.
      type: String
    - contextPath: Picus.vectorlist.trusted
      description: Trusted peer name.
      type: String
    - contextPath: Picus.vectorlist.type
      description: 'Type of the vector, if error is encountered, "Unknown" is returned. Other valid values are: "Network", "Email, "Endpoint".'
      type: String
    - contextPath: Picus.vectorlist.untrusted
      description: Untrusted peer name.
      type: String
    - contextPath: Picus.vectorlist.users
      description: Users assigned to this vector.
      type: Unknown
  - description: Returns the peer list with current statuses.
    name: picus-get-peer-list
    outputs:
    - contextPath: Picus.peerlist.is_alive
      description: Is Peer Alive?
      type: Boolean
    - contextPath: Picus.peerlist.latest_attack
      description: Latest Attack Time of the Peer.
      type: Date
    - contextPath: Picus.peerlist.name
      description: Peer Name.
      type: String
    - contextPath: Picus.peerlist.registered_ip
      description: IP of the peer.
      type: String
    - contextPath: Picus.peerlist.type
      description: Peer's Type.
      type: String
  - arguments:
    - description: Untrusted peer name.
      name: attacker_peer
      required: true
    - description: Trusted peer name.
      name: victim_peer
      required: true
    - defaultValue: '3'
      description: Set days parameter.
      name: days
    - defaultValue: all
      description: This setting can only be insecure,secure and all.
      name: result
    description: Returns the list of the attack results have optional parameters for filtration.
    name: picus-get-attack-results
    outputs:
    - contextPath: Picus.attackresults.results.threat_ids
      description: Threat ID List.
      type: String
    - contextPath: Picus.attackresults.results.begin_time
      description: begin time of the attack.
      type: Date
    - contextPath: Picus.attackresults.results.destination_port
      description: Value "0" indicates it is not applicable such as all vector types except network.
      type: Number
    - contextPath: Picus.attackresults.results.end_time
      description: end time of the attack.
      type: Date
    - contextPath: Picus.attackresults.results.id
      description: id.
      type: Number
    - contextPath: Picus.attackresults.results.l1_category_name
      description: Level 1 Category Name of the attack.
      type: String
    - contextPath: Picus.attackresults.results.scenario_details.action_id
      description: Action ID of the threat scenario action.
      type: Number
    - contextPath: Picus.attackresults.results.scenario_details.action_name
      description: Action Name of the threat scenario action.
      type: String
    - contextPath: Picus.attackresults.results.scenario_details.end
      description: The time attack ended.
      type: Date
    - contextPath: Picus.attackresults.results.scenario_details.id
      description: Primary key.
      type: Number
    - contextPath: Picus.attackresults.results.scenario_details.process_results
      description: 'Process Results(play and rewind).'
      type: Unknown
    - contextPath: Picus.attackresults.results.scenario_details.result
      description: Final result of the scenario action.
      type: String
    - contextPath: Picus.attackresults.results.scenario_details.technique_id
      description: Technique ID of the threat scenario action.
      type: String
    - contextPath: Picus.attackresults.results.source_port
      description: Value "0" indicates it is not applicable such as all vector types except network and wats attacks.
      type: Number
    - contextPath: Picus.attackresults.results.string
      description: Attack Result.
      type: String
    - contextPath: Picus.attackresults.results.threat_id
      description: Threat ID of the attack.
      type: Number
    - contextPath: Picus.attackresults.results.threat_name
      description: Threat Name of the attack.
      type: String
    - contextPath: Picus.attackresults.results.trusted
      description: Trusted peer name.
      type: String
    - contextPath: Picus.attackresults.results.untrusted
      description: Untrusted peer name.
      type: String
    - contextPath: Picus.attackresults.results.variant
      description: Variant info.
      type: String
  - arguments:
    - description: Threat ID list ("111,222,333,...") or single threat ID can be given.
      name: threat_ids
      required: true
    - description: Untrusted peer name.
      name: attacker_peer
      required: true
    - description: Trusted peer name.
      name: victim_peer
      required: true
    - auto: PREDEFINED
      description: This parameter can be HTTP or HTTPS. Example variant=HTTP.
      name: variant
      predefined:
      - HTTP
      - HTTPS
      required: true
    description: Schedules a single attack on requested vector.
    name: picus-run-attacks
    outputs:
    - contextPath: Picus.runattacks
      description: IDs of the assessed attacks.
      type: String
  - arguments:
    - description: Threat ID list ("111,222,333,...") or single threat ID can be given.
      name: threat_ids
      required: true
    - description: Untrusted peer name.
      name: attacker_peer
      required: true
    - description: Trusted peer name.
      name: victim_peer
      required: true
    - auto: PREDEFINED
      description: This parameter can be HTTP or HTTPS. Example variant=HTTP.
      name: variant
      predefined:
      - HTTP
      - HTTPS
      required: true
    description: Returns the list of the attack results of a single threat have optional parameters for filtration.
    name: picus-get-threat-results
    outputs:
    - contextPath: Picus.threatresults.results.threat_results
      description: Threat Results(ID and result combination).
      type: String
    - contextPath: Picus.threatresults.results.l1_category
      description: Level 1 Category Name of the attack.
      type: String
    - contextPath: Picus.threatresults.results.last_time
      description: Last Threat Result Time.
      type: Date
    - contextPath: Picus.threatresults.results.result
      description: Threat Result.
      type: String
    - contextPath: Picus.threatresults.results.status
      description: Status.
      type: String
    - contextPath: Picus.threatresults.results.threat_id
      description: Threat ID of the attack.
      type: Number
  - arguments:
    - description: Untrusted peer name.
      name: attacker_peer
      required: true
    - description: Trusted peer name.
      name: victim_peer
      required: true
    - auto: PREDEFINED
      description: This parameter can be HTTP or HTTPS. Example variant=HTTP.
      name: variant
      predefined:
      - HTTP
      - HTTPS
      required: true
    - description: Products info of the mitigation. This parameter can be Check Point NGFW, ForcepointNGFW, McAfee IPS, PaloAlto IPS, SourceFire IPS, TippingPoint, F5 BIG-IP, Fortigate WAF, FortiWeb, Fortigate IPS, Snort, CitrixWAF, and ModSecurity.
      name: mitigation_product
      required: true
    - defaultValue: '3'
      description: Set days parameter.
      name: days
    description: Set parameter on playbook. (This command is only used on playbook).
    name: picus-set-paramPB
    outputs:
    - contextPath: Picus.param.attacker_peer
      description: Untrusted peer name.
      type: String
    - contextPath: Picus.param.days
      description: days.
      type: Number
    - contextPath: Picus.param.mitigation_product
      description: Products info of the mitigation.
      type: String
    - contextPath: Picus.param.variant
      description: This parameter can be HTTP or HTTPS. Example variant=HTTP.
      type: String
    - contextPath: Picus.param.victim_peer
      description: Trusted peer name.
      type: String
  - arguments:
    - description: Threat id and result combine. Used for playbook.
      name: threatinfo
      required: true
    description: Filter insecure attacks on playbook. (This command is only used on playbook).
    name: picus-filter-insecure-attacks
    outputs:
    - contextPath: Picus.filterinsecure
      description: Insecure Attack List.
      type: String
  - arguments:
    - description: Threat ID list ("111,222,333,...") or single threat ID can be given.
      name: threat_ids
      required: true
    - description: Products info of the mitigation. This parameter can be Check Point NGFW, ForcepointNGFW, McAfee IPS, PaloAlto IPS, SourceFire IPS, TippingPoint, F5 BIG-IP, Fortigate WAF, FortiWeb, Fortigate IPS, Snort, CitrixWAF, and ModSecurity.
      name: product
      required: true
    description: Returns the list of the mitigations of threats have optional parameters for filtration, this route may not be used associated with your license.
    name: picus-get-mitigation-list
    outputs:
    - contextPath: Picus.mitigationresults.signature_id
      description: ID of the signature.
      type: String
    - contextPath: Picus.mitigationresults.signature_name
      description: Name of the signature.
      type: String
    - contextPath: Picus.mitigationresults.threat_id
      description: Threat ID of Picus Attack.
      type: Number
    - contextPath: Picus.mitigationresults.vendor
      description: Product name of the mitigation.
      type: String
  - arguments:
    - description: Untrusted peer name.
      name: attacker_peer
      required: true
    - description: Trusted peer name.
      name: victim_peer
      required: true
    - defaultValue: '3'
      description: Set days parameter.
      name: days
    description: Makes a comparison of the given vector's results.
    name: picus-get-vector-compare
    outputs:
    - contextPath: Picus.vectorresults.name
      description: Name of Picus Attack.
      type: String
    - contextPath: Picus.vectorresults.status
      description: Compare Result.
      type: String
    - contextPath: Picus.vectorresults.threat_id
      description: Threat ID of Picus Attack.
      type: String
  - description: Returns the current Picus version and the update time config.
    name: picus-version
    outputs:
    - contextPath: Picus.versioninfo.last_update_date
      description: When was the last update?
      type: Date
    - contextPath: Picus.versioninfo.update_time
      description: When to update?
      type: Number
    - contextPath: Picus.versioninfo.version
      description: Current version.
      type: Number
  - description: Triggers the Picus product update mechanism manually.
    name: picus-trigger-update
    outputs:
    - contextPath: Picus.triggerupdate.data
      description: Collected data that will be returned.
      type: Boolean
    - contextPath: Picus.triggerupdate.success
      description: Is the operation Succeed?
      type: Boolean
  - description: Generates an access token for api usage. Looks for X-Refresh-Token on header or refresh-token cookie.
    name: picus-get-access-token
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0