QSS

QSS integration helps you to fetch Cases from Q-SCMP and add new cases automatically through XSOAR.

Utilities · Quantum Security Systems

Details

IDQSS
ProviderOpen Source
CategoryUtilities
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

QSS integration helps you to fetch Cases from Q-SCMP and add new cases automatically through XSOAR.
This integration was integrated and tested with version 3.6 of Q-SCMP. Please contact your platform administrtor to enable Cortex XSOAR integration.

Configure QSS on Cortex XSOAR

Prerequisites

  1. Please contact your Q-SCMP platform administrtor to obtain Cortex API Key.
  2. Please contact your Q-SCMP platform administrtor to obtain Cortex Server URL.

Configure Q-SCMP on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for QSS.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Required
    Server URL (e.g. https://) True
    Fetch incidents False
    Incident type False
    Max fetch False
    API Key True
    Fetch cases with status (Open, Closed) False
    Minimum severity of cases to fetch False
    Flase positive cases to fetch False
    Back time duration of cases to fetch (Hours) True
    First fetch time False
    Trust any certificate (not secure) False
    Use system proxy settings False
  4. Click Test to validate the URLs, token, and connection.

Use Cases

  1. Fetch SOC cases to Cortex SOAR based on the case severity.
  2. Fetch SOC cases to Cortex SOAR based on the case status.
  3. Fetch SOC cases to Cortex SOAR based on the case false positive flag.

Fetched Cases Data

  1. Case ID
  2. Case Creation Date
  3. Case Number
  4. Case Category
  5. Case Sub Category
  6. Case Severity
  7. Case Status
  8. Case Title
  9. Case Assignee
  10. Case False Positive
  11. Case Created By
  12. Case Last Update
  13. Case TLP
  14. Case Description
  15. Case Notes
  16. Case Tags
  17. Case Custom Attributes
  18. Case Assets
  19. Case IOCs

Configuration parameters

  • url — Server URL (e.g. https://example.com) (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • apikey — API Key (required)
  • severity — Minimum severity of cases to fetch
  • max_fetch — Max fetch
  • status — Fetch cases with status (Open, Closed)
  • false_positive — Flase positive cases to fetch
  • first_fetch — First fetch time
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (0)

This integration defines no commands.

Source

QSS.py QSS_test.py QSS.yml QSS_description.md
Download History Raw 
import json


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_fetch_incidents(requests_mock):
    from QSS import Client, fetch_incidents

    mock_response = util_load_json("test_data/soc_monitoring_cases.json")
    requests_mock.get("https://test.com/api/v1/rest/noauth/third_party/read_object/xsoar/v1", json=mock_response["alerts"])
    client = Client(base_url="https://test.com/api/v1", verify=False, headers={})

    last_run = {
        "last_fetch": 1581944401  # Mon Feb 17 2020
    }

    _, new_incidents = fetch_incidents(
        client=client,
        max_results=2,
        last_run=last_run,
        alert_status="ACTIVE",
        min_severity="Low",
        first_fetch_time="3 days",
        false_positive="No",
        api_key="aS5Xcaf7b17e4c5e679d2a851a91a2",
    )

    assert new_incidents == [
        {
            "name": "SOC Case CAS-4-20210328-1",
            "occurred": "2021-03-28T13:42:39Z",
            "event_id": "2160",
            "rawJSON": json.dumps(mock_response["alerts"][0]),
            "severity": 1,  # medium, this is XSOAR severity (already converted)
        }
    ]