SafeBreach v2 Deprecated

Deprecated. No available replacement.

Data Enrichment & Threat Intelligence · SafeBreach - Breach and Attack Simulation platform · Feed

Details

ID	`SafeBreach v2`
Provider	SafeBreach
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.10.12.63474`
Supported Modules	Agentix XSIAM

README

Deprecated. No available replacement.

Configure SafeBreach v2 (Deprecated) for Cortex XSOAR Integration

Open the Navigation bar → … → CLI Console
Type config accounts to find out the account id
Use the id as the accountId parameter in Cortex XSOAR configuration
Type config apikeys to list existing API keys \
OR \
Add a new one by typing: **config apikeys add –name **
Use the generated API token as apiKey parameter in Cortex XSOAR configuration
Use your SafeBreach Management URL as the url parameter in Cortex XSOAR configuration

Configure SafeBreach v2 (Deprecated) on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for SafeBreach v2 (Deprecated).

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
SafeBreach Managment URL	For example, https://yourorg.safebreach.com	True
Account ID	Obtained with “config accounts” SafeBreach command	True
API Key	Generated with “config apikeys add” SafeBreach command	True
Insight Category
Insight Data Type
Non Behavioral Indicator Reputation	Non-Behavioral Indicator from this integration instance will be marked with this reputation
Behavioral Reputation	Behavioral Indicator from this integration instance will be marked with this reputation
Indicators Limit	The maximum number of indicators to generate. The default is 1000.
Fetch indicators
Source Reliability	Reliability of the source providing the intelligence data	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed

Feed Fetch Interval
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.

Trust any certificate (not secure)
Use system proxy settings
Indicator Reputation	Indicators from this integration instance will be marked with this reputation
Tags	Supports CSV values.

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Configuration parameters

url — SafeBreach Managment URL (required)
accountId — Account ID (required)
apiKey — API Key (required)
insightCategory — Insight Category
insightDataType — Insight Data Type
nonBehavioralReputation — Non Behavioral Indicator Reputation
behavioralReputation — Behavioral Reputation
indicatorLimit — Indicators Limit
feed — Fetch indicators
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedExpirationPolicy —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
feedExpirationInterval —
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feedReputation — Indicator Reputation
feedTags — Tags

Commands (7)

safebreach-get-indicators Deprecated
Fetches SafeBreach Insights from which indicators are extracted, creating new indicators or updating existing indicators.
safebreach-get-insights Deprecated
Gets SafeBreach Insights for all security control categories.
safebreach-get-remediation-data Deprecated
Gets remediation data for a specific SafeBreach Insight.
safebreach-get-simulation Deprecated
Get SafeBreach simulation
safebreach-get-test-status Deprecated
Gets the status of a SafeBreach test for tracking progress of a run.
safebreach-rerun-insight Deprecated
Reruns a specific SafeBreach Insight related simulations in your environment.
safebreach-rerun-simulation Deprecated
Reruns a specific SafeBreach simulation in your environment.

Source

SafeBreach_v2.py SafeBreach_v2_test.py SafeBreach_v2.yml SafeBreach_v2_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: SafeBreach
commonfields:
  id: SafeBreach v2
  version: -1
configuration:
- additionalinfo: For example, https://yourorg.safebreach.com
  display: SafeBreach Managment URL
  name: url
  required: true
  type: 0
- additionalinfo: Obtained with "config accounts" SafeBreach command
  display: Account ID
  name: accountId
  required: true
  type: 0
- additionalinfo: Generated with "config apikeys add" SafeBreach command
  display: API Key
  name: apiKey
  required: true
  type: 4
- defaultvalue: Network Access,Network Inspection,Endpoint,Email,Web,Data Leak
  display: Insight Category
  name: insightCategory
  options:
  - Network Access
  - Network Inspection
  - Endpoint
  - Email
  - Web
  - Data Leak
  type: 16
  required: false
- defaultvalue: Hash,Domain,URI,Command,Port,Protocol
  display: Insight Data Type
  name: insightDataType
  options:
  - Hash
  - Domain
  - URI
  - Command
  - Port
  - Protocol
  type: 16
  required: false
- additionalinfo: Non-Behavioral Indicator from this integration instance will be marked with this reputation
  display: Non Behavioral Indicator Reputation
  name: nonBehavioralReputation
  defaultvalue: Bad
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 15
  required: false
- additionalinfo: Behavioral Indicator from this integration instance will be marked with this reputation
  display: Behavioral Reputation
  name: behavioralReputation
  defaultvalue: Suspicious
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 15
  required: false
- additionalinfo: The maximum number of indicators to generate. The default is 1000.
  defaultvalue: '1000'
  display: Indicators Limit
  name: indicatorLimit
  type: 0
  required: false
- display: Fetch indicators
  name: feed
  type: 8
  defaultvalue: 'true'
  required: false
- additionalinfo: Reliability of the source providing the intelligence data
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
- name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  display: ''
  required: false
- display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
- name: feedExpirationInterval
  type: 1
  display: ''
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  display: Indicator Reputation
  hidden: true
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
description: Deprecated. No available replacement.
display: SafeBreach v2 (Deprecated)
name: SafeBreach v2
script:
  commands:
  - arguments:
    - description: Array of insight IDs to fetch.
      isArray: true
      name: insightIds
    description: Gets SafeBreach Insights for all security control categories.
    name: safebreach-get-insights
    outputs:
    - contextPath: SafeBreach.Insight.Name
      description: Insight name representing the action required to be taken.
      type: String
    - contextPath: SafeBreach.Insight.Id
      description: Insight unique ID number.
      type: Number
    - contextPath: SafeBreach.Insight.DataType
      description: Insight data type. Options are Hash, Domain, URI, Command, Port, or Protocol.
      type: String
    - contextPath: SafeBreach.Insight.Category
      description: Security control category name.
      type: String
    - contextPath: SafeBreach.Insight.LatestSimulation
      description: Time of the latest simulation from the insight.
      type: Date
    - contextPath: SafeBreach.Insight.SimulationsCount
      description: Number of the related simulations.
      type: Number
    - contextPath: SafeBreach.Insight.RiskImpact
      description: Risk impact of the insight on the environment total risk score.
      type: Number
    - contextPath: SafeBreach.Insight.AffectedTargetsCount
      description: Number of affected targets.
      type: Number
    - contextPath: SafeBreach.Insight.SeverityScore
      description: Insight severity numeric value
      type: Number
    - contextPath: SafeBreach.Insight.Severity
      description: Insight severity mapped to low/medium/high.
      type: String
    - contextPath: SafeBreach.Insight.RemediationDataCount
      description: Number of the remediation data points.
      type: Number
    - contextPath: SafeBreach.Insight.RemediationDataType
      description: Type of the remediation data.
      type: String
    - contextPath: SafeBreach.Insight.ThreatGroups
      description: Array of APT names that are mapped to the insight.
      type: Array
    - contextPath: SafeBreach.Insight.NetworkDirection
      description: Communication direction of Insight, relative to the target (inbound/outbound).
      type: String
    - contextPath: SafeBreach.Insight.AttacksCount
      description: List of all insight related SafeBreach attack IDs.
      type: Number
    - contextPath: SafeBreach.Insight.AffectedTargets
      description: List of the affected targets including name, IP and number of the remediation points
      type: Unknown
    - contextPath: SafeBreach.Insight.RemediationAction
      description: Description of an action to take for the remediation
      type: String
    - contextPath: SafeBreach.Insight.ResultsLink
      description: Link to the SafeBreach platform Results page filtered for the relevant simulation results
      type: String
    - contextPath: SafeBreach.Insight.AttackIds
      description: SafeBreach Attack Ids
      type: Unknown
    deprecated: true
  - arguments:
    - description: The ID of the insight for which to fetch remediation data.
      name: insightId
      required: true
    description: Gets remediation data for a specific SafeBreach Insight.
    name: safebreach-get-remediation-data
    outputs:
    - contextPath: SafeBreach.Insight.Id
      description: Insight unique ID number.
      type: Number
    - contextPath: SafeBreach.Insight.SHA256
      description: Malware SHA256 hash.
      type: String
    - contextPath: SafeBreach.Insight.Domain
      description: Malicious domains.
      type: String
    - contextPath: SafeBreach.Insight.IP
      description: Malicious IP addresses.
      type: String
    - contextPath: SafeBreach.Insight.Port
      description: Ports used during the attack.
      type: Number
    - contextPath: SafeBreach.Insight.Protocol
      description: Protocols used during the attack.
      type: String
    - contextPath: SafeBreach.Insight.Proxy
      description: Proxies used during the attack.
      type: String
    - contextPath: SafeBreach.Insight.URI
      description: Malicious URIs.
      type: String
    - contextPath: SafeBreach.Insight.DropPath
      description: Malware drop paths.
      type: String
    - contextPath: SafeBreach.Insight.User
      description: Impersonated users running the attacks.
      type: String
    - contextPath: SafeBreach.Insight.Command
      description: Attack executed commands.
      type: String
    - contextPath: SafeBreach.Insight.Registry
      description: Attack read/changed registry paths.
      type: String
    - contextPath: SafeBreach.Insight.ClientHeader
      description: Client HTTP headers used in the attacks.
      type: String
    - contextPath: SafeBreach.Insight.ServerHeader
      description: Server HTTP headers used in the attacks.
      type: String
    - contextPath: URL.Data
      description: Malicious domains, URLs, or IP addresses.
      type: String
    - contextPath: File.SHA256
      description: Malicious SHA256 file hashes.
      type: String
    - contextPath: Process.CommandLine
      description: Suspicious commands.
      type: String
    - contextPath: DBotScore.Indicator
      description: Indicator value. Options are IP, SHA1, MD5, SHA256, Email, or Url.
      type: String
    - contextPath: DBotScore.Type
      description: Indicator type. Options are ip, file, email, or url.
      type: String
    - contextPath: DBotScore.Vendor
      description: SafeBreach. This is the vendor reporting the score of the indicator.
      type: String
    - contextPath: DBotScore.Score
      description: 3 (Bad). The score of the indicator.
      type: Number
    - contextPath: SafeBreach.Insight.RemediationData.Splunk
      description: Remediation data in a form of a Splunk query
      type: String
    deprecated: true
  - arguments:
    - description: Array of insight IDs to rerun.
      isArray: true
      name: insightIds
    description: Reruns a specific SafeBreach Insight related simulations in your environment.
    name: safebreach-rerun-insight
    outputs:
    - contextPath: SafeBreach.Insight.Id
      description: Insight unique ID.
      type: Number
    - contextPath: SafeBreach.Insight.Rerun.Name
      description: Insight rerun test name.
      type: String
    - contextPath: SafeBreach.Insight.Rerun.Id
      description: ID of the rerun insight test.
      type: String
    - contextPath: SafeBreach.Insight.Rerun.AttacksCount
      description: Count of the attacks executed in the insight rerun test.
      type: Number
    - contextPath: SafeBreach.Test.Id
      description: ID of the test.
      type: String
    - contextPath: SafeBreach.Test.Name
      description: Name of the test.
      type: String
    - contextPath: SafeBreach.Test.AttacksCount
      description: The number of attacks executed in the insight rerun test.
      type: Number
    - contextPath: SafeBreach.Test.Status
      description: Test run status. For insight rerun, starts from PENDING.
      type: String
    - contextPath: SafeBreach.Test.ScheduledTime
      description: Time when the test was triggered.
      type: Date
    deprecated: true
  - arguments:
    - defaultValue: '1000'
      description: The maximum number of indicators to generate. The default is 1000.
      name: limit
    - description: |-
        Multi-select option for the category of the insights to get remediation data for:
        Network Access, Network Inspection, Endpoint, Email, Web, Data Leak
      name: insightCategory
      predefined:
      - ''
    - description: |-
        Multi-select option for the remediation data type to get:
        Hash, Domain, URI, Command, Port, Protocol, Registry
      isArray: true
      name: insightDataType
      predefined:
      - ''
    description: Fetches SafeBreach Insights from which indicators are extracted, creating new indicators or updating existing indicators.
    name: safebreach-get-indicators
    deprecated: true
  - arguments:
    - description: The ID of the test to track.
      isArray: true
      name: testId
      required: true
    description: Gets the status of a SafeBreach test for tracking progress of a run.
    name: safebreach-get-test-status
    outputs:
    - contextPath: SafeBreach.Test.Id
      description: ID of the test.
      type: String
    - contextPath: SafeBreach.Test.Name
      description: Name of the test.
      type: String
    - contextPath: SafeBreach.Test.Status
      description: Test run status. Options are PENDING, RUNNING, CANCELED, or COMPLETED.
      type: String
    - contextPath: SafeBreach.Test.StartTime
      description: Starting time of the test.
      type: Date
    - contextPath: SafeBreach.Test.EndTime
      description: Ending time of the test.
      type: Date
    - contextPath: SafeBreach.Test.TotalSimulationNumber
      description: Number of simulations for the test.
      type: Number
    deprecated: true
  - arguments:
    - description: The ID of the simulation. By default, taken from the incident.
      name: simulationId
      required: true
    description: Get SafeBreach simulation
    name: safebreach-get-simulation
    outputs:
    - contextPath: SafeBreach.Simulation.Id
      description: ID of the simulation result.
      type: String
    - contextPath: SafeBreach.Simulation.FinalStatus
      description: Simulation final status. Options are Missed, Detected, Stopped, Prevented, or Inconsistent.
      type: String
    - contextPath: SafeBreach.Simulation.Result
      description: Indicates whether the simulation was blocked.
      type: String
    - contextPath: SafeBreach.Simulation.DetectedAction
      description: Indicates the overall detected action taken by security controls.
      type: String
    - contextPath: SafeBreach.Simulation.SimulationRunId
      description: The unique simulation run ID (changes between simulation runs).
      type: Number
    - contextPath: SafeBreach.Simulation.Time
      description: Latest simulation run time.
      type: Datetime
    - contextPath: SafeBreach.Simulation.LastChangeTime
      description: Time when the simulation result was changed.
      type: Datetime
    - contextPath: SafeBreach.Simulation.Labels
      description: Array of labels applied on the simulation.
      type: Array
    - contextPath: SafeBreach.Simulation.Attack.Id
      description: ID of the simulated attack.
      type: String
    - contextPath: SafeBreach.Simulation.Attack.Name
      description: Name of the simulated attack.
      type: String
    - contextPath: SafeBreach.Simulation.Attack.Description
      description: Description of the attack flow.
      type: String
    - contextPath: SafeBreach.Simulation.Attack.Phase
      description: The phase of the attack. Option are Infiltration, Exfiltration ,Lateral Movement, or Host Level.
      type: String
    - contextPath: SafeBreach.Simulation.Attack.Type
      description: The type of the attack. For example, Real C2 Communication, Malware Transfer, or Malware Write to Disk.
      type: String
    - contextPath: SafeBreach.Simulation.Attack.SecurityControl
      description: Related security control category.
      type: String
    - contextPath: SafeBreach.Simulation.Attack.IndicatorBased
      description: True if this attack is based on an indicator. False if this is behavioral non-indicator based.
      type: Bool
    - contextPath: SafeBreach.Simulation.Attacker.Name
      description: Name of the attacker simulator.
      type: String
    - contextPath: SafeBreach.Simulation.Attacker.OS
      description: OS of the attacker simulator.
      type: String
    - contextPath: SafeBreach.Simulation.Attacker.InternalIp
      description: Internal IP address of the attacker simulator.
      type: String
    - contextPath: SafeBreach.Simulation.Attacker.ExternalIp
      description: External IP address of the attacker simulator.
      type: String
    - contextPath: SafeBreach.Simulation.Attacker.SimulationDetails
      description: Simulation run detailed logs from the attacker simulator.
      type: JSON
    - contextPath: SafeBreach.Simulation.Target.Name
      description: Name of the target simulator.
      type: String
    - contextPath: SafeBreach.Simulation.Target.OS
      description: OS of the target simulator.
      type: String
    - contextPath: SafeBreach.Simulation.Target.InternalIp
      description: Internal IP address of the target simulator.
      type: String
    - contextPath: SafeBreach.Simulation.Target.ExternalIp
      description: External IP address of the target simulator.
      type: String
    - contextPath: SafeBreach.Simulation.Target.SimulationDetails
      description: Simulation run detailed logs from the target simulator.
      type: JSON
    - contextPath: SafeBreach.Simulation.Network.Direction
      description: Attack network direction relative to the target - inbound/outbound.
      type: String
    - contextPath: SafeBreach.Simulation.Network.SourceIp
      description: The IP address that initiated the network communication.
      type: String
    - contextPath: SafeBreach.Simulation.Network.DestinationIp
      description: The IP address that received the network communication.
      type: String
    - contextPath: SafeBreach.Simulation.Network.SourcePort
      description: The source port of the network communication.
      type: String
    - contextPath: SafeBreach.Simulation.Network.DestinationPort
      description: The destination port of the network communication.
      type: String
    - contextPath: SafeBreach.Simulation.Network.Protocol
      description: The top-level protocol of the network communication.
      type: String
    - contextPath: SafeBreach.Simulation.Network.Proxy
      description: The proxy name used in the network communication.
      type: String
    - contextPath: SafeBreach.Simulation.Classifications.MITRETechniques
      description: List of attack related MITRE techniques.
      type: Array
    - contextPath: SafeBreach.Simulation.Classifications.MITREGroups
      description: List of attack related MITRE threat groups.
      type: Array
    - contextPath: SafeBreach.Simulation.Classifications.MITRESoftware
      description: List of attack related MITRE software and tools.
      type: Array
    - contextPath: SafeBreach.Simulation.Parameters
      description: Parameters of the simulation.
      type: JSON
    deprecated: true
  - arguments:
    - description: The ID of the simulation to rerun.
      name: simulationId
      required: true
    description: Reruns a specific SafeBreach simulation in your environment.
    name: safebreach-rerun-simulation
    outputs:
    - contextPath: SafeBreach.Simulation.Id
      description: Simulation unique ID.
      type: Number
    - contextPath: SafeBreach.Simulation.Rerun.Name
      description: Simulation rerun test name.
      type: String
    - contextPath: SafeBreach.Simulation.Rerun.Id
      description: ID of the rerun test.
      type: String
    - contextPath: SafeBreach.Simulation.Rerun.ScheduledTime
      description: Time when the rerun was triggered.
      type: Datetime
    - contextPath: SafeBreach.Test.Id
      description: ID of the test.
      type: String
    - contextPath: SafeBreach.Test.Name
      description: Name of the test.
      type: String
    - contextPath: SafeBreach.Test.AttacksCount
      description: The number of the attacks executed in the insight rerun test.
      type: Number
    - contextPath: SafeBreach.Test.Status
      description: Test run status. For insight rerun - “PENDING”
      type: String
    - contextPath: SafeBreach.Test.ScheduledTime
      description: Time when the test was triggered.
      type: Datetime
    deprecated: true
  dockerimage: demisto/python3:3.10.12.63474
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (deprecated)
fromversion: 5.5.0
deprecated: true