ResecurityMonitoring

This package allows retrieving asset monitoring results from monitoring tasks that can be configured in Context and Risk platforms.

Data Enrichment & Threat Intelligence · Resecurity

Details

IDResecurityMonitoring
ProviderResecurity
CategoryData Enrichment & Threat Intelligence
From Version6.8.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

This package allows retrieving asset monitoring results from monitoring tasks that can be configured in Resecurity® CTI and Resecurity® DRM platforms.
This integration was integrated and tested with version 1.01 of ResecurityMonitoring

Configure Resecurity Monitoring in Cortex

Parameter Description Required
Your server URL   True
API Key The API Key to use for connection True
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

resecurity-get-task-monitor-results-data-breaches


Retrieve monitoring results from a specific monitor task

Base Command

resecurity-get-task-monitor-results-data-breaches

Input

Argument Name Description Required
monitor_task_id Monitor Task ID. Required
page Page number. The results will be returned only for specified page if param value is not empty. Optional
page_size Page size. Possible range of values: 1 - 50. Default value is 20. Optional
limit Limit of the records in dataset. Default value is 1000. Optional
mode Affects which results will be included in dataset. Possible values: 1 - only new results, 2 - last results (default value), 3 - all results. Optional

Context Output

Path Type Description
Resecurity.DataBreach.id String Data breach ID
Resecurity.DataBreach.query String The query for which the result was found
Resecurity.DataBreach.detection_date Number Data breach detection date
Resecurity.DataBreach.email String Data breach email
Resecurity.DataBreach.username String Data breach username
Resecurity.DataBreach.password String Data breach password
Resecurity.DataBreach.password_hash String Data breach password hash
Resecurity.DataBreach.salt String Data breach salt
Resecurity.DataBreach.ip String Data breach IP address
Resecurity.DataBreach.source_name String Data breach source name

Command example

!resecurity-get-task-monitor-results-data-breaches monitor_task_id=1 limit=2 mode=2

Context Example

{
    "Resecurity": {
        "DataBreach": [
            {
                "date": "2016-11-04 21:55:00",
                "detection_date": "2023-03-18 13:14:04",
                "email": "email@domain.test",
                "id": 11192938,
                "info": "",
                "ip": "95.112.168.138",
                "password": "",
                "password_hash": "71356c329abee63757ecb3f60b5f90be34ab47caa85d41344cea3f9c92f38eea0313bf60650fe2149e4a2e169d492d9b59a71e97d7331d74caa8b054b448cf04",
                "query": "domain.test",
                "salt": "",
                "source_name": "source1",
                "username": "JMBStarYT"
            },
            {
                "date": "2016-11-30 21:30:00",
                "detection_date": "2023-03-18 13:14:04",
                "email": "email@domain.test",
                "id": 47200407,
                "info": "",
                "ip": "86.178.141.167",
                "password": null,
                "password_hash": "c2f5c61a8ad5dc1ef8c0478617cac76a",
                "query": "domain.test",
                "salt": null,
                "source_name": "source2",
                "username": null
            }
        ]
    }
}

Human Readable Output

Breaches results from task with ID 1

date detection_date email id info ip password password_hash query salt source_name username
2016-11-04 21:55:00 2023-03-18 13:14:04 email@domain.test 11192938   95.112.168.138   71356c329abee63757ecb3f60b5f90be34ab47caa85d41344cea3f9c92f38eea0313bf60650fe2149e4a2e169d492d9b59a71e97d7331d74caa8b054b448cf04 domain.test   source1 JMBStarYT
2016-11-30 21:30:00 2023-03-18 13:14:04 email@domain.test 47200407   86.178.141.167   c2f5c61a8ad5dc1ef8c0478617cac76a domain.test   source2  

Command example

!resecurity-get-task-monitor-results-data-breaches monitor_task_id=1 page_size=2 page=10 mode=2

Context Example

{
    "Resecurity": {
        "DataBreach": [
            {
                "date": "2016-12-07 15:53:00",
                "detection_date": "2023-03-18 13:14:04",
                "email": "test@test.test",
                "id": 361424177,
                "info": "",
                "ip": "",
                "password": "aaaaaa",
                "password_hash": null,
                "query": "test.test",
                "salt": null,
                "source_name": "source3",
                "username": null
            },
            {
                "date": "2016-12-07 15:53:00",
                "detection_date": "2023-03-18 13:14:04",
                "email": "test@test.test",
                "id": 361832967,
                "info": "",
                "ip": "",
                "password": "pppppp",
                "password_hash": null,
                "query": "test.test",
                "salt": null,
                "source_name": "source3",
                "username": null
            }
        ]
    }
}

Human Readable Output

Breaches results from task with ID 1

date detection_date email id info ip password password_hash query salt source_name username
2016-12-07 15:53:00 2023-03-18 13:14:04 test@test.test 361424177     aaaaaa   test.test   source3  
2016-12-07 15:53:00 2023-03-18 13:14:04 test@test.test 361832967     pppppp   test.test   source3  

Configuration parameters

  • url — Your server URL (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • resecurity-get-task-monitor-results-data-breaches

    Retrieve monitoring results from a specific monitor task

import json
import urllib.parse

import pytest
from ResecurityMonitoring import DEFAULT_MODE, DEFAULT_PAGE_SIZE, MODULE_NAME_BREACHES, PAGINATION_HEADER_NAME


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_test_module(requests_mock):
    from ResecurityMonitoring import Client, DemistoException, test_module

    url = "https://test.com/api/monitor/check-connection"

    mock_response = util_load_json("test_data/test_module_result.json")
    requests_mock.get(url, json=mock_response)

    client = Client(
        base_url="https://test.com/api/",
        verify=False,
        auth=("some_api_key", ""),
    )

    result_message = test_module(client)
    assert result_message == mock_response["message"]

    # case when message is empty - the result is fail
    requests_mock.get(url, json={})
    with pytest.raises((DemistoException), match="Failed to establish connection with provided credentials."):
        test_module(client)


def test_get_task_monitor_results_command(requests_mock):
    from ResecurityMonitoring import Client, DemistoException, get_task_monitor_results_command

    page = 1
    task_id = 1

    params = {
        "id": task_id,
        "module_name": MODULE_NAME_BREACHES,
        "page": page,
        "per-page": DEFAULT_PAGE_SIZE,
        "mode": DEFAULT_MODE,
    }
    url = "https://test.com/api/monitor/task-results-by-module?" + urllib.parse.urlencode(params)

    mock_response = util_load_json("test_data/get_task_monitor_results.json")

    requests_mock.get(url, headers={PAGINATION_HEADER_NAME: str(page)}, json=mock_response)

    client = Client(
        base_url="https://test.com/api/",
        verify=False,
        auth=("some_api_key", ""),
    )

    args = {"monitor_task_id": task_id}

    command_function = get_task_monitor_results_command(MODULE_NAME_BREACHES)
    response = command_function(client, args)

    assert response.outputs == mock_response
    assert response.outputs_prefix == "Resecurity.DataBreach"
    assert response.outputs_key_field == "id"

    # case when the 'page' arg is not None
    page_arg = 2
    params = {
        "id": task_id,
        "module_name": MODULE_NAME_BREACHES,
        "page": page_arg,
        "per-page": DEFAULT_PAGE_SIZE,
        "mode": DEFAULT_MODE,
    }
    url = "https://test.com/api/monitor/task-results-by-module?" + urllib.parse.urlencode(params)

    mock_response = util_load_json("test_data/get_task_monitor_results.json")
    requests_mock.get(url, headers={PAGINATION_HEADER_NAME: str(page)}, json=mock_response)

    args = {
        "monitor_task_id": task_id,
        "page": page_arg,
    }

    response = command_function(client, args)

    assert response.outputs == mock_response
    assert response.outputs_prefix == "Resecurity.DataBreach"
    assert response.outputs_key_field == "id"

    # check that 'per_page' value is not bigger that 'limit' value
    params = {"id": task_id, "module_name": MODULE_NAME_BREACHES, "page": page, "per-page": 1, "mode": DEFAULT_MODE}
    url = "https://test.com/api/monitor/task-results-by-module?" + urllib.parse.urlencode(params)

    mock_response = util_load_json("test_data/get_task_monitor_results.json")
    requests_mock.get(url, headers={PAGINATION_HEADER_NAME: str(page)}, json=mock_response)

    args = {"monitor_task_id": task_id, "per-page": 5, "limit": 1}

    response = command_function(client, args)

    assert response.outputs == mock_response[:1]
    assert response.outputs_prefix == "Resecurity.DataBreach"
    assert response.outputs_key_field == "id"

    # check for raising an error if header does not consist of pagination value
    requests_mock.get(url, json=mock_response)
    with pytest.raises((DemistoException), match=f"Something is wrong, header {PAGINATION_HEADER_NAME} is empty for API request"):
        command_function(client, args)