Polar Security

Details

ID	`Polar Security`
Provider	IBM
Category	Network Security
From Version	6.9.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Polar Security, an innovator in technology that helps companies discover, continuously monitor and secure cloud and software-as-a-service (SaaS) application data – and addresses the growing shadow data problem.

Configure Polar Security in Cortex

Parameter	Required
Polar Security API URL	True
Username	False
Password	False
Trust any certificate (not secure)	False
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

polar-list-linked-vendors

Get a list of all 3rd party vendors connected to your cloud workloads

Base Command

polar-list-linked-vendors

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
PolarSecurity.Vendors.vendorId	string	The 3rd party vendor unique ID
PolarSecurity.Vendors.vendorName	string	The 3rd party vendor name (Company name)
PolarSecurity.Vendors.vendorUrl	string	The 3rd party company website URL
PolarSecurity.Vendors.description	string	Short description of the 3rd party vendor
PolarSecurity.Vendors.accounts.vendorAccountId	string	The Cloud account ID
PolarSecurity.Vendors.accounts.vendorAccountName	string	The Cloud account name (as was onboarded to Polar)
PolarSecurity.Vendors.accounts.cloudProvider	string	Cloud service providers identifier (aws, gcp, azure)
PolarSecurity.Vendors.certificates.certificateName	string	The vendor certification (“PCI” “HIPAA” “GDPR”, etc)

polar-list-data-stores

List observed data stores

Base Command

polar-list-data-stores

Input

Argument Name	Description	Required
limit	Maximum results to return. Default is 50.	Optional
page_size	Maximum results to return per page. Default is 50.	Optional
next_token	Hash value for the next page.	Optional

Context Output

Path	Type	Description
PolarSecurity.DataStores.Stores.dataStoreId	string	Unique ID within PolarSecurity
PolarSecurity.DataStores.Stores.dataStoreType	string	Type of data store
PolarSecurity.DataStores.Stores.dataStoreName	string	Name of data store
PolarSecurity.DataStores.Stores.cloudAccountDetails.cloudAccountId	string	ID of account where store is located
PolarSecurity.DataStores.Stores.cloudAccountDetails.cloudAccountName	string	Name of account where store is located
PolarSecurity.DataStores.Stores.cloudAccountDetails.serviceProvider	string	Cloud service providers identifier (aws, gcp, azure)
PolarSecurity.DataStores.Stores.cloudRegion	string	Cloud provider region designation
PolarSecurity.DataStores.Stores.country	string	Country location of data store
PolarSecurity.DataStores.Stores.classificationStatus	string	One of “CLASSIFIED” “UNCLASSIFIED” “IN_PROGRESS”
PolarSecurity.DataStores.Stores.vpcId	string	ID of the VPC
PolarSecurity.DataStores.Stores.isBackedUp	boolean	Backup status
PolarSecurity.DataStores.Stores.stats	unknown	Array of statistics

polar-data-stores-summary

Summarize your data stores by storage type, service provider, cloud location, etc.

Base Command

polar-data-stores-summary

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
PolarSecurity.DataStores.Summary.totalSensitiveStores	number	Count of stores with sensitivities set
PolarSecurity.DataStores.Summary.totalPotentialFlows	number	Total ways data could be accessed
PolarSecurity.DataStores.Summary.totalActualFlows	number	Total ways data has actually been accessed
PolarSecurity.DataStores.Summary.totalStores	number	Count of all stores observed
PolarSecurity.DataStores.Summary.totalSensitivities	number	Total sensitive items observed
PolarSecurity.DataStores.Summary.cloudLocations	unknown	Array of objects
PolarSecurity.DataStores.Summary.serviceProviders	unknown	Array of objects
PolarSecurity.DataStores.Summary.accountsIds	unknown	Array of strings
PolarSecurity.DataStores.Summary.storeTypes	unknown	Array of objects

polar-list-vendors-data-stores

Get a list of all data stores a specific 3rd party vendor can access. See whether they have sensitivities and with what role the access is made possible.

Base Command

polar-list-vendors-data-stores

Input

Argument Name	Description	Required
vendor_id	Specific vendor ID retrieved from polar-list-linked-vendors command.	Required
limit	Maximum results to return. Default is 50.	Optional
page_size	Maximum results to return per page. Default is 50.	Optional
next_token	Hash value for the next page.	Optional

Context Output

Path	Type	Description
PolarSecurity.Vendors.vendor.vendorId	string	The 3rd party vendor unique ID
PolarSecurity.Vendors.vendor.dataStores.cloudProvider	string	Cloud service providers identifier (aws, gcp, azure)
PolarSecurity.Vendors.vendor.dataStores.cloudRegion	string	Cloud provider region designation
PolarSecurity.Vendors.vendor.dataStores.dataStoreId	string	Unique ID within PolarSecurity
PolarSecurity.Vendors.vendor.dataStores.dataStoreName	string	Name of data store
PolarSecurity.Vendors.vendor.dataStores.dataStoreType	string	Type of data store
PolarSecurity.Vendors.vendor.dataStores.sensitivitiesSummary	unknown	Array of objects (SensitivitySummary)

polar-get-data-store

Get a specific data store by its ID. Doesn’t return anything above and beyond the polar-list-data-stores command, so no need to run it again if you’ve already run that.

Base Command

polar-get-data-store

Input

Argument Name	Description	Required
store_id	ID of data store of interest.	Required

Context Output

Path	Type	Description
PolarSecurity.DataStores.Stores.dataStoreName	string	Name of data store
PolarSecurity.DataStores.Stores.cloudRegion	string	Cloud provider region designation
PolarSecurity.DataStores.Stores.isBackedUp	boolean	Backup status
PolarSecurity.DataStores.Stores.dataStoreType	string	Type of data store
PolarSecurity.DataStores.Stores.dataStoreId	string	Unique ID within PolarSecurity
PolarSecurity.DataStores.Stores.country	string	Country location of data store
PolarSecurity.DataStores.Stores.dataStoreUrl	string	Public URL to access store
PolarSecurity.DataStores.Stores.classificationStatus	string	One of “CLASSIFIED” “UNCLASSIFIED” “IN_PROGRESS”
PolarSecurity.DataStores.Stores.stats	unknown	Array of statistics
PolarSecurity.DataStores.Stores.cloudTags	unknown	Array of tags assigned to store
PolarSecurity.DataStores.Stores.cloudAccountDetails.cloudAccountId	string	ID of account that owns the store
PolarSecurity.DataStores.Stores.cloudAccountDetails.cloudAccountName	string	Name of account that owns the store
PolarSecurity.DataStores.Stores.cloudAccountDetails.serviceProvider	string	Cloud service providers identifier (aws, gcp, azure)

polar-list-vendor-accessible-data-stores

List all data stores accessible by 3rd party vendors, along with which vendors have access.

Base Command

polar-list-vendor-accessible-data-stores

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
PolarSecurity.DataStores.Stores.3rdParties.accounts.cloudProvider	string	Cloud service providers identifier (aws, gcp, azure)
PolarSecurity.DataStores.Stores.3rdParties.accounts.vendorAccountId	string	The Cloud account ID
PolarSecurity.DataStores.Stores.3rdParties.accounts.vendorAccountName	string	The Cloud account name (as was onboarded to Polar)
PolarSecurity.DataStores.Stores.3rdParties.certificates.certificateName	string	The vendor certification (“PCI” “HIPAA” “GDPR”, etc)
PolarSecurity.DataStores.Stores.3rdParties.description	string	Short description of the 3rd party vendor
PolarSecurity.DataStores.Stores.3rdParties.vendorId	string	The 3rd party vendor unique ID
PolarSecurity.DataStores.Stores.3rdParties.vendorName	string	The 3rd party vendor name (Company name)
PolarSecurity.DataStores.Stores.3rdParties.vendorUrl	string	The 3rd party company website URL
PolarSecurity.DataStores.Stores.cloudProvider	string	Cloud service providers identifier (aws, gcp, azure)
PolarSecurity.DataStores.Stores.cloudRegion	string	Cloud provider region designation
PolarSecurity.DataStores.Stores.dataStoreId	string	Unique ID within PolarSecurity
PolarSecurity.DataStores.Stores.dataStoreName	string	Name of data store
PolarSecurity.DataStores.Stores.dataStoreType	string	Type of data store
PolarSecurity.DataStores.Stores.sensitivitiesSummary	unknown	Array of objects (SensitivitySummary)

polar-apply-label

Add or update a custom label to a data store

Base Command

polar-apply-label

Input

Argument Name	Description	Required
label	256 character max string.	Required
store_id	Which store to apply label.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Polar Security API URL (required)
credentials — Username
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (7)

polar-apply-label
Add or update a custom label to a data store.
polar-data-stores-summary
Summarize your data stores by storage type, service provider, cloud location, etc.
polar-get-data-store
Get a specific data store by its ID. Doesn't return anything above and beyond the polar-list-data-stores command, so no need to run it again if you've already run that.
polar-list-data-stores
List observed data stores.
polar-list-linked-vendors
Get a list of all 3rd party vendors connected to your cloud workloads.
polar-list-vendor-accessible-data-stores
List all data stores accessible by 3rd party vendors, along with which vendors have access.
polar-list-vendors-data-stores
Get a list of all data stores a specific 3rd party vendor can access. See whether they have sensitivities and with what role the access is made possible.

Source

PolarSecurity.py PolarSecurity.yml PolarSecurity_description.md

Download History Raw

category: Network Security
provider: IBM
commonfields:
  id: Polar Security
  version: -1
configuration:
- defaultvalue: https://api.polar-security.com/v0
  display: Polar Security API URL
  name: url
  required: true
  type: 0
- display: Username
  displaypassword: Password
  name: credentials
  required: false
  type: 9
- defaultvalue: "false"
  display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
- defaultvalue: "false"
  display: Use system proxy settings
  name: proxy
  required: false
  type: 8
description: Polar Security, an innovator in technology that helps companies discover, continuously monitor and secure cloud and software-as-a-service (SaaS) application data – and addresses the growing shadow data problem.
display: Polar Security
name: Polar Security
script:
  commands:
  - arguments: []
    description: Get a list of all 3rd party vendors connected to your cloud workloads.
    name: polar-list-linked-vendors
    outputs:
    - contextPath: PolarSecurity.Vendors.vendorId
      description: The 3rd party vendor unique ID.
      type: string
    - contextPath: PolarSecurity.Vendors.vendorName
      description: The 3rd party vendor name (Company name).
      type: string
    - contextPath: PolarSecurity.Vendors.vendorUrl
      description: The 3rd party company website URL.
      type: string
    - contextPath: PolarSecurity.Vendors.description
      description: Short description of the 3rd party vendor.
      type: string
    - contextPath: PolarSecurity.Vendors.accounts.vendorAccountId
      description: The Cloud account ID.
      type: string
    - contextPath: PolarSecurity.Vendors.accounts.vendorAccountName
      description: The Cloud account name (as was onboarded to Polar).
      type: string
    - contextPath: PolarSecurity.Vendors.accounts.cloudProvider
      description: Cloud service providers identifier (aws, gcp, azure).
      type: string
    - contextPath: PolarSecurity.Vendors.certificates.certificateName
      description: The vendor certification ("PCI" "HIPAA" "GDPR", etc).
      type: string
  - arguments:
    - defaultValue: "50"
      description: Maximum results to return.
      name: limit
      type: textArea
    - defaultValue: "50"
      description: Maximum results to return per page.
      name: page_size
      type: textArea
    - description: Hash value for the next page.
      name: next_token
    description: List observed data stores.
    name: polar-list-data-stores
    outputs:
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreId
      description: Unique ID within PolarSecurity.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreType
      description: Type of data store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreName
      description: Name of data store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudAccountDetails.cloudAccountId
      description: ID of account where store is located.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudAccountDetails.cloudAccountName
      description: Name of account where store is located.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudAccountDetails.serviceProvider
      description: Cloud service providers identifier (aws, gcp, azure).
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudRegion
      description: Cloud provider region designation.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.country
      description: Country location of data store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.classificationStatus
      description: One of "CLASSIFIED" "UNCLASSIFIED" "IN_PROGRESS".
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.vpcId
      description: ID of the VPC.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.isBackedUp
      description: Backup status.
      type: boolean
    - contextPath: PolarSecurity.DataStores.Stores.stats
      description: Array of statistics.
  - arguments: []
    description: Summarize your data stores by storage type, service provider, cloud location, etc.
    name: polar-data-stores-summary
    outputs:
    - contextPath: PolarSecurity.DataStores.Summary.totalSensitiveStores
      description: Count of stores with sensitivities set.
      type: number
    - contextPath: PolarSecurity.DataStores.Summary.totalPotentialFlows
      description: Total ways data could be accessed.
      type: number
    - contextPath: PolarSecurity.DataStores.Summary.totalActualFlows
      description: Total ways data has actually been accessed.
      type: number
    - contextPath: PolarSecurity.DataStores.Summary.totalStores
      description: Count of all stores observed.
      type: number
    - contextPath: PolarSecurity.DataStores.Summary.totalSensitivities
      description: Total sensitive items observed.
      type: number
    - contextPath: PolarSecurity.DataStores.Summary.cloudLocations
      description: Array of objects.
    - contextPath: PolarSecurity.DataStores.Summary.serviceProviders
      description: Array of objects.
    - contextPath: PolarSecurity.DataStores.Summary.accountsIds
      description: Array of strings.
    - contextPath: PolarSecurity.DataStores.Summary.storeTypes
      description: Array of objects.
  - arguments:
    - description: Specific vendor ID retrieved from polar-list-linked-vendors command.
      name: vendor_id
      required: true
    - defaultValue: "50"
      description: Maximum results to return.
      name: limit
    - defaultValue: "50"
      description: Maximum results to return per page.
      name: page_size
    - description: Hash value for the next page.
      name: next_token
    description: Get a list of all data stores a specific 3rd party vendor can access. See whether they have sensitivities and with what role the access is made possible.
    name: polar-list-vendors-data-stores
    outputs:
    - contextPath: PolarSecurity.Vendors.vendor.vendorId
      description: The 3rd party vendor unique ID.
      type: string
    - contextPath: PolarSecurity.Vendors.vendor.dataStores.cloudProvider
      description: Cloud service providers identifier (aws, gcp, azure).
      type: string
    - contextPath: PolarSecurity.Vendors.vendor.dataStores.cloudRegion
      description: Cloud provider region designation.
      type: string
    - contextPath: PolarSecurity.Vendors.vendor.dataStores.dataStoreId
      description: Unique ID within PolarSecurity.
      type: string
    - contextPath: PolarSecurity.Vendors.vendor.dataStores.dataStoreName
      description: Name of data store.
      type: string
    - contextPath: PolarSecurity.Vendors.vendor.dataStores.dataStoreType
      description: Type of data store.
      type: string
    - contextPath: PolarSecurity.Vendors.vendor.dataStores.sensitivitiesSummary
      description: Array of objects (SensitivitySummary).
  - arguments:
    - description: ID of data store of interest.
      name: store_id
      required: true
    description: Get a specific data store by its ID. Doesn't return anything above and beyond the polar-list-data-stores command, so no need to run it again if you've already run that.
    name: polar-get-data-store
    outputs:
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreName
      description: Name of data store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudRegion
      description: Cloud provider region designation.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.isBackedUp
      description: Backup status.
      type: boolean
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreType
      description: Type of data store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreId
      description: Unique ID within PolarSecurity.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.country
      description: Country location of data store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreUrl
      description: Public URL to access store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.classificationStatus
      description: One of "CLASSIFIED" "UNCLASSIFIED" "IN_PROGRESS".
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.stats
      description: Array of statistics.
    - contextPath: PolarSecurity.DataStores.Stores.cloudTags
      description: Array of tags assigned to store.
    - contextPath: PolarSecurity.DataStores.Stores.cloudAccountDetails.cloudAccountId
      description: ID of account that owns the store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudAccountDetails.cloudAccountName
      description: Name  of account that owns the store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudAccountDetails.serviceProvider
      description: Cloud service providers identifier (aws, gcp, azure).
      type: string
  - arguments: []
    description: List all data stores accessible by 3rd party vendors, along with which vendors have access.
    name: polar-list-vendor-accessible-data-stores
    outputs:
    - contextPath: PolarSecurity.DataStores.Stores.3rdParties.accounts.cloudProvider
      description: Cloud service providers identifier (aws, gcp, azure).
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.3rdParties.accounts.vendorAccountId
      description: The Cloud account ID.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.3rdParties.accounts.vendorAccountName
      description: The Cloud account name (as was onboarded to Polar).
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.3rdParties.certificates.certificateName
      description: The vendor certification ("PCI" "HIPAA" "GDPR", etc).
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.3rdParties.description
      description: Short description of the 3rd party vendor.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.3rdParties.vendorId
      description: The 3rd party vendor unique ID.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.3rdParties.vendorName
      description: The 3rd party vendor name (Company name).
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.3rdParties.vendorUrl
      description: The 3rd party company website URL.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudProvider
      description: Cloud service providers identifier (aws, gcp, azure).
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.cloudRegion
      description: Cloud provider region designation.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreId
      description: Unique ID within PolarSecurity.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreName
      description: Name of data store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.dataStoreType
      description: Type of data store.
      type: string
    - contextPath: PolarSecurity.DataStores.Stores.sensitivitiesSummary
      description: Array of objects (SensitivitySummary).
  - arguments:
    - description: 256 character max string.
      name: label
      required: true
      type: textArea
    - description: Which store to apply label.
      name: store_id
      required: true
      type: textArea
    description: Add or update a custom label to a data store.
    name: polar-apply-label
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.9.0
tests:
- No tests (auto formatted)