QSS

QSS integration helps you to fetch Cases from Q-SCMP and add new cases automatically through XSOAR.

Utilities · Quantum Security Systems

Details

IDQSS
ProviderOpen Source
CategoryUtilities
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

QSS integration helps you to fetch Cases from Q-SCMP and add new cases automatically through XSOAR.
This integration was integrated and tested with version 3.6 of Q-SCMP. Please contact your platform administrtor to enable Cortex XSOAR integration.

Configure QSS on Cortex XSOAR

Prerequisites

  1. Please contact your Q-SCMP platform administrtor to obtain Cortex API Key.
  2. Please contact your Q-SCMP platform administrtor to obtain Cortex Server URL.

Configure Q-SCMP on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for QSS.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Required
    Server URL (e.g. https://) True
    Fetch incidents False
    Incident type False
    Max fetch False
    API Key True
    Fetch cases with status (Open, Closed) False
    Minimum severity of cases to fetch False
    Flase positive cases to fetch False
    Back time duration of cases to fetch (Hours) True
    First fetch time False
    Trust any certificate (not secure) False
    Use system proxy settings False
  4. Click Test to validate the URLs, token, and connection.

Use Cases

  1. Fetch SOC cases to Cortex SOAR based on the case severity.
  2. Fetch SOC cases to Cortex SOAR based on the case status.
  3. Fetch SOC cases to Cortex SOAR based on the case false positive flag.

Fetched Cases Data

  1. Case ID
  2. Case Creation Date
  3. Case Number
  4. Case Category
  5. Case Sub Category
  6. Case Severity
  7. Case Status
  8. Case Title
  9. Case Assignee
  10. Case False Positive
  11. Case Created By
  12. Case Last Update
  13. Case TLP
  14. Case Description
  15. Case Notes
  16. Case Tags
  17. Case Custom Attributes
  18. Case Assets
  19. Case IOCs

Configuration parameters

  • url — Server URL (e.g. https://example.com) (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • apikey — API Key (required)
  • severity — Minimum severity of cases to fetch
  • max_fetch — Max fetch
  • status — Fetch cases with status (Open, Closed)
  • false_positive — Flase positive cases to fetch
  • first_fetch — First fetch time
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (0)

This integration defines no commands.

Source

QSS.py QSS_test.py QSS.yml QSS_description.md
Download History Raw 
category: Utilities
sectionorder:
- Connect
- Collect
provider: Open Source
commonfields:
  id: QSS
  version: -1
configuration:
- defaultvalue: https://www.example.com
  display: Server URL (e.g. https://example.com)
  name: url
  required: true
  type: 0
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Minimum severity of cases to fetch
  name: severity
  options:
  - Low
  - Medium
  - High
  - Critical
  type: 15
  required: false
  section: Collect
- defaultvalue: "10"
  display: Max fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Fetch cases with status (Open, Closed)
  name: status
  options:
  - Open
  - Closed
  type: 15
  required: false
  section: Collect
- display: Flase positive cases to fetch
  name: false_positive
  options:
  - "No"
  - "Yes"
  type: 15
  required: false
  section: Collect
- defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
defaultclassifier: QSS Classifier
defaultmapperin: QSS Mapper
description: QSS integration helps you to fetch Cases from Q-SCMP and add new cases automatically through XSOAR.
display: QSS
name: QSS
script:
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)