SecurityAdvisor Deprecated

Deprecated. No available replacement.

Messaging and Conferencing · SecurityAdvisor (Deprecated)

Details

IDSecurityAdvisor
ProviderKnowBe4
CategoryMessaging and Conferencing
From Version5.0.0
Docker Imagedemisto/python3:3.9.8.24399
Supported ModulesAgentix

README

Use SecurityAdvisor integration to coach your end users on cyber security threats they face.
SecurityAdvisor advisor contextual coaching platform allows you to perform targeted coaching to users therefore making them more likely to change their behavior and reduce the number of incidents.
For example, a user whose system is often targeted for malware can be coached with a malware context, a phishing target educated about phishing.
Our training is quick & relevant not more than 5 minutes and has shown to reduce incidents from targeted user by 90% due to better security awareness and hygine.

Use Cases


  1. A user is targeted with a phishing attack. Use coach-end-user end user command with this user’s email address and “phishing” context to send them a training on Email Phishing.
  2. A malware is found on user’s machine due to unsafe browsing habbits. Use coach-end-user end user command with this user’s email address and “malware” context to send them a training on staying safe online.
  3. A user is targeted with ransomware attack. Use coach-end-user end user command with this user’s email address and “ransomware” context to send them a training on staying safe online.
  4. You can create conditional coaching conditions like send coaching is the user has scored less than 80 in a particular coaching context.

You can add coach-end-user command (see commands below) to any section of your playbook to trigger these notifications.

Prerequisites

You need an API key for this integration.

  1. Log in to www.securityadvisor.io.
  2. Navigate to the My Profile section or contact support@securityadvisor.io.

Configure SecurityAdvisor on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for SecurityAdvisor.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • use system proxy
    • trust any certificate
    • API Endpoint URL = “https://www.securityadvisor.io/
    • API Key = See Prerequisites above to get your API key
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. coach-end-user

1. Coach an end user


Sends a contextual message to a single user. This command takes a user email address as “user” input. This is where the training email is sent.
The “context” input has four predefined settings:

  • malware: Coach user on malware
  • phishing: Coach user on phishing
  • ransomware: Coach user on ransomware
  • spam: Coach user to avoid spam
Base Command

coach-end-user

Input
Argument Name Description Required
user User email address. Required
context Coaching context. Optional
Context Output
Path Type Description
SecurityAdvisor.CoachUser.coaching_date string Time when coaching was sent or completed.
SecurityAdvisor.CoachUser.coaching_status string User coaching status for context. “Pending” means that coaching has been sent and is pending. “Done” means the user has completed the coaching.
SecurityAdvisor.CoachUser.coaching_score string User’s coaching score (out of 100).
SecurityAdvisor.CoachUser.context string Coaching context.
Command Example

coach-end-user user="track@securityadvisor.io" context="phishing"

Context Example
{
    "SecurityAdvisor.CoachUser": {
        "coaching_date": "2019-10-04T21:04:19.480425", 
        "coaching_status": "Pending", 
        "coaching_score": "", 
        "user": "track@securityadvisor.io", 
        "context": "phishing", 
        "message": "Coaching Sent"
    }
}

SecurityAdvisorBot says

coaching_date coaching_status coaching_score user context message
2019-10-04T21:04:19.480425 Pending   track@securityadvisor.io phishing Coaching Sent

Configuration parameters

  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • url — API Endpoint URL (required)
  • apikey — API Key

Commands (1)

  • coach-end-user

    sends contextual message to single user

import demistomock as demisto
from CommonServerPython import *
''' IMPORTS '''
import json
import collections

# disable insecure warnings
import urllib3
urllib3.disable_warnings()


''' CONSTANTS '''
URL_SUFFIX_COACH_USER = 'apis/coachuser/'


# Allows nested keys to be accesible
def makehash():
    return collections.defaultdict(makehash)


'''MAIN FUNCTIONS'''


class Client(BaseClient):
    """
    Calls SecurityAdvisor API and returns results
    """

    def http_request_coachuser(self, data):
        """
        calls coach user api
        """
        response_data_json = self._http_request(
            method='POST',
            url_suffix=URL_SUFFIX_COACH_USER,
            json_data=data,
            data=data,
        )
        return response_data_json


def coach_end_user_command(client, args):
    """
    Returns Coaching status of user

    Args:
        client: SecurityAdvisor client
        args: all command arguments

    Returns:
        json version of coaching status for user
        readable_output: This will be presented in Warroom - should be in markdown syntax - human readable
        outputs: Dictionary/JSON - saved in incident context in order to be used as input for other tasks in the
                 playbook
        raw_response: Used for debugging/troubleshooting purposes - will be shown only if the command executed with
                      raw-response=true
    """
    user = args.get('user')
    context = args.get('context')
    data = json.dumps({"username": user, "context": context})
    result = client.http_request_coachuser(data)

    contxt = makehash()
    contxt['user'] = user
    contxt['context'] = context
    contxt['message'] = result['message']
    contxt['coaching_status'] = result['coaching_status']
    contxt['coaching_score'] = result['coaching_score']
    contxt['coaching_date'] = result['coaching_date']
    outputs = ({
        'SecurityAdvisor.CoachUser(val.user == obj.user && val.context == obj.context)': contxt,
    })

    readable_output = tableToMarkdown("Coaching Status", [contxt])

    return (
        readable_output,
        outputs,
        result  # raw response - the original response
    )


def test_module(client):
    """Test Module when testing integration"""
    data = json.dumps({
        "username": "track@securityadvisor.io",
        "context": "malware"
    })
    client.http_request_coachuser(data)

    return 'ok'


''' EXECUTION '''


def main():
    """
    PARSE AND VALIDATE INTEGRATION PARAMS
    """
    base_url = demisto.params().get('url', 'https://www.securityadvisor.io/')
    proxy = demisto.params().get('proxy')
    api_key = demisto.params().get('apikey')
    verify_certificate = not demisto.params().get('insecure', False)
    if not demisto.params().get('proxy', False):
        try:
            del os.environ['HTTP_PROXY']
            del os.environ['HTTPS_PROXY']
            del os.environ['http_proxy']
            del os.environ['https_proxy']
        except KeyError:
            pass
    LOG('Command being called is %s' % (demisto.command()))

    try:
        headers = {
            'Content-Type': 'application/json',
            'Accept': 'application/json',
            'Authorization': 'Token ' + api_key
        }
        client = Client(
            base_url=base_url,
            verify=verify_certificate,
            headers=headers,
            proxy=proxy)
        if demisto.command() == 'coach-end-user':
            return_outputs(*coach_end_user_command(client, demisto.args()))
        elif demisto.command() == 'test-module':
            test_module(client)
            demisto.results('ok')
    # Log exceptions
    except Exception as e:
        return_error('Failed to execute %s command. Error: %s' %
                     (demisto.command(), str(e)))


if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()