SafeNetTrustedAccessEventCollector
Retrieve access, authentication, and audit logs and store them on a Security Information and Event Management (SIEM) system, local repository, or syslog file server. You can retrieve the logs only for the tenant that is associated with the API key, or for a direct or delegated child of that tenant.
Authentication & Identity Management · Thales SafeNet Trusted Access
Details
| ID | SafeNetTrustedAccessEventCollector |
|---|---|
| Provider | Thales |
| Category | Authentication & Identity Management |
| From Version | 6.8.0 |
| Docker Image | demisto/python3:3.12.13.10325753 |
| Supported Modules | Agentix XSIAM |
README
Retrieve access, authentication, and audit logs and stores them in a Security Information and Event Management (SIEM) system, local repository, or syslog file server. You can retrieve the logs only for the tenant that is associated with the API key, or for a direct or delegated child of that tenant.
Configure SafeNetTrustedAccessEventCollector in Cortex
| Parameter | Description | Required |
|---|---|---|
| URL | The URL consists of the root part of the REST API Endpoint URL provided in SafeNet Trusted Access, and has the form https://api.[name].com | True |
| Tenant Code | Tenant code for your virtual server or account. | True |
| API Key for the authentication. | True | |
| The product name corresponding to the integration that originated the events | False | |
| The vendor name corresponding to the integration that originated the events | False | |
| The maximum number of audit logs to fetch. Valid limit is multiples of 1000 and less than 10,000. | True | |
| First fetch timestamp | False | |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
sta-get-events
Get access, authentication, and audit logs from SafeNet Trusted Access.
Base Command
sta-get-events
Input
| Argument Name | Description | Required |
|---|---|---|
| should_push_events | If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false. | Required |
| since | Since date. | Optional |
| until | Until date. | Optional |
| marker | A string pointing at the next page of results. The marker can be found within the previous response. | Optional |
Context Output
There is no context output for this command.
Command example
!sta-get-events should_push_events=false since="10 seconds"
Human Readable Output
Event Logs
Marker: 111111
category context details id logVersion timeStamp AUDIT tenantId: TENENTID
originatingAddress: 1.1.1.1
principalId: ID
globalAccessId: IDtype: AUTHENTICATION
serial: SERIAL
action: 0
actionText: AUTH_ATTEMPT
result: 1
resultText: AUTH_SUCCESS
agentId: ID
message: MSG
credentialType: TYPE$ID 1.0 2022-01-01T00:00:00.00000Z AUDIT tenantId: TENENTID
originatingAddress: 1.1.1.1
principalId: ID
globalAccessId: IDtype: AUTHENTICATION
serial: SERIAL
action: 0
actionText: AUTH_ATTEMPT
result: 2
resultText: CHALLENGE
agentId: ID
message: MSG
usedName: NAME
credentialType: TYPE$ID 1.0 2022-01-01T00:00:00.00000Z
Configuration parameters
url— URL (required)tenant_code— Tenant Code (required)credentials— (required)product— The product name corresponding to the integration that originated the eventsvendor— The vendor name corresponding to the integration that originated the eventslimit— The maximum number of audit logs to fetch. Valid limit is multiples of 1000 and less than 10,000. (required)first_fetch— First fetch timestampinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (1)
-
sta-get-eventsGet access, authentication, and audit logs from SafeNet Trusted Access.
import json from datetime import datetime from SafeNetTrustedAccessEventCollector import Client def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) MOCK_ENTRY = util_load_json("test_data/mock_event.json") BASE_URL = "https://sta.example.com/tenant_code" def test_fetch_events(requests_mock): """ Given: - fetch-events call When: - Calling fetch events: 1. without marking, but with first_fetch 2. only marking from last_run Then: - Make sure 3 events returned. - Verify the new lastRun is calculated correctly. """ from SafeNetTrustedAccessEventCollector import fetch_events_command last_run = {"marker": "22222"} requests_mock.get(f"{BASE_URL}/logs", json=MOCK_ENTRY) events, new_last_run = fetch_events_command( Client(base_url=BASE_URL), last_run=last_run, first_fetch=datetime.strptime("2020-01-01", "%Y-%m-%d"), limit=2000 ) assert len(events) == 3 assert events[0].get("id") == "ID1" assert new_last_run["marker"] == 11111111111 def test_get_events(requests_mock): """ Given: - sta-get-events call When: - Running the command with since, until and marker parameters Then: - Make sure all of the events are returned as part of the CommandResult. """ from SafeNetTrustedAccessEventCollector import get_events_command requests_mock.get(f"{BASE_URL}/logs", json=MOCK_ENTRY) args = {"marker": 11111, "since": "01.01.2022", "until": "today"} events, results = get_events_command(Client(base_url=BASE_URL), args=args) assert len(events) == 3 assert results.raw_response == MOCK_ENTRY def test_test_module(requests_mock): """ Given: - test-module call When: - A response with an OK status_code is retrieved from the API call. Then: - Make sure 'ok' is returned. """ from SafeNetTrustedAccessEventCollector import test_module requests_mock.get(f"{BASE_URL}/logs", json=MOCK_ENTRY) assert test_module(Client(base_url=BASE_URL)) == "ok"