Securonix

Overview

Use the Securonix integration to manage incidents, threats, lookup tables, whitelists and watchlists. Integration was built and tested with SNYPR Versions: 6.4 (Nov 2024 R2 release).

This integration supports both cloud and on-prem instances of Securonix.
To configure a cloud base instance use the Tenant parameter only.
To configure an on-prem instance, use both the Host and Tenant parameters.

Use cases

1. Fetch newly created incidents from Securonix.
2. Fetch newly created threats from Securonix.
3. Get, update and create Securonix incidents, add comments and perform actions on the Securonix incidents.
4. Get, update, create and delete records from the whitelist.
5. Get, update, create and delete records from the lookup table.
6. Get, update, and create records from the watchlist.

Pre-Requisites

On Securonix

Ensure the integration user satisfies below mentioned pre-requisites:

1. A role “ROLE_CASE_ADMIN” must be assigned
2. For the target Securonix platform, enable the “Show Incidents To All Users” option under “INCIDENT MANAGEMENT SETTINGS” as shown below:
   
   

Configure Securonix on Cortex XSOAR

1. Navigate to Settings > Integrations > Instances.
2. Search for Securonix.
3. Click Add instance to create and configure a new integration instance.
4. To fetch Securonix Incidents refer to the section “Configuration for fetching Securonix Incident as an XSOAR Incident”.
5. To fetch Securonix Threats refer to the section “Configuration for fetching Securonix Threat as an XSOAR Incident”.

Configuration Parameters

1. Click Test to validate the URLs, token, and connection.

Configuration for fetching Securonix Incident as an XSOAR Incident

To fetch Securonix Incident follow the next steps:

1. Select Fetches incidents.
2. Under Classifier, select “N/A”.
3. Under Incident type, select “Securonix Incident”.
4. Under Mapper (incoming), select “Securonix Incident - Incoming Mapper” for default mapping.
5. Enter the connection parameters. (Host, Tenant, Username & Password)
6. Under the Type of entity to fetch, select “Incident”.
7. Select the “Incidents to fetch”:
   • all - This will fetch incidents updated in the given time range.
   • opened - This will fetch incidents created in the given time range.
   • closed - This will fetch incidents closed in the given time range.
8. Update “Set default incident severity”, “First Fetch time range” & “Max Fetch Count” based on your requirement.
9. Select the Incident Mirroring Direction:
   • Incoming - Mirrors changes from the Securonix incident into the Cortex XSOAR incident.
   • Outgoing - Mirrors changes from the Cortex XSOAR incident to the Securonix incident.
   • Incoming And Outgoing - Mirrors changes both Incoming and Outgoing directions on incidents.
   • None - Turns off incident mirroring.
10. Enter the relevant values for “State” & “Action” values for mirroring.
    • Below table indicates which fields are required for the respective mirroring type.

1. Enter the relevant Comment Entry Tag.
   Note: This value is mapped to the dbotMirrorTags incident field in Cortex XSOAR, which defines how Cortex XSOAR handles comments when you tag them in the War Room. This is required for mirroring comments from Cortex XSOAR to Securonix.
2. Optional: Check the “Close respective Securonix incident after fetching” parameter, if you want to close the Securonix Incident once it is fetched in the XSOAR.
   Below Parameters are required if this option is checked:
   • Securonix action name for XSOAR’s active state for Outgoing
   • Securonix status for XSOAR’s active state for Outgoing
   • Securonix action name for XSOAR’s close state for Outgoing
   • Securonix status for XSOAR’s close state for Outgoing
3. Enter the relevant values for Securonix Retry parameters “Count”, “Delay” & “Delay Type”.

Notes for mirroring:

• This feature is compliant with XSOAR version 6.0 and above.
• When mirroring incidents, you can make changes in Securonix that will be reflected in Cortex XSOAR, or vice versa. You can also attach files in Securonix Incident which will then be available in the XSOAR incident.
• The mirroring settings apply only for incidents that are fetched after applying the settings. Pre-existing comments are not fetched/mirrored at the time of incident creation.
• For mirroring to work flawlessly, a three-state workflow(similar to XSOAR) must be configured on the Securonix Incident side.
• The mirroring is strictly tied to Incident type “Securonix Incident” & Incoming mapper “Securonix Incident - Incoming Mapper” if you want to change or use your custom incident type/mapper then make sure changes related to these are present.
• If you want to use the mirror mechanism and you’re using custom mappers, then the incoming mapper must contain the following fields: dbotMirrorDirection, dbotMirrorId, dbotMirrorInstance, dbotMirrorTags and securonixcloseincident.
• To use a custom mapper, you must first duplicate the mapper and update the fields in the copy of the mapper. (Refer to the “Create a custom mapper consisting of the default Securonix mapper” section for more information.)
• Following new fields are introduced in the response of the incident to enable the mirroring:
  • mirror_direction: This field determines the mirroring direction for the incident. It is a required field for XSOAR to enable mirroring support.
  • mirror_tags: This field determines what would be the tag needed to mirror the XSOAR entry out to Securonix. It is a required field for XSOAR to enable mirroring support.
  • mirror_instance: This field determines from which instance the XSOAR incident was created. It is a required field for XSOAR to enable mirroring support.
  • close_sx_incident: This field determines whether to close the respective Securonix incident once fetched in the XSOAR based on the instance configuration. It is required for closing the respective incident on Securonix. This will be used in the playbook to close the securonix incident.

Configuration for fetching Securonix Threat as an XSOAR Incident

To fetch Securonix Threat follow the next steps:

1. Select Fetches incidents.
2. Under Classifier, select “N/A”.
3. Under Incident type, select Securonix Threat.
4. Under Mapper (incoming), select Securonix Threat - Incoming Mapper for default mapping.
5. Under Type of entity to fetch, select Threat.
6. Enter the Tenant Name in case of MSSP user.
7. Enter the connection parameters. (Host, Tenant, Username & Password)
8. Enter the “The maximum number of incidents to fetch each time”. The recommended number of threats to fetch is 100 considering the API implications, although 200 is allowed.
9. Enter the relevant values for Securonix Retry parameters “Count”, “Delay” & “Delay Type”.

Create a custom mapper consisting of the default Securonix mapper

1. Go to the settings -> Object setup -> Incidents.
2. Navigate to the “Classification and Mapping” tab.
3. Select the Mapper “Securonix incident - Incoming Mapper”.
4. Create a copy of that mapper and click on it. (You can rename the mapper.)
5. Under the Incident Type dropdown, verify that the type of Mapper is “Securonix Incident”.
6. Click on “Choose data path” and map it to the custom field:
   • Find the context field you want to map to this incident field on the right side and click on its value.
   • Then you will see the path you’ve selected under your newly added field.
   • Note: You can also type the path manually.
7. Click “Save Version”.
8. Created mapper will appear in the drop-down for the “Mapper (incoming)” integration instance settings fields.
9. Select the newly added mapper at the time of instance configuration.

Create a custom layout consisting of the default Securonix layout

1. Go to the settings -> Object setup -> Incidents
2. Navigate to the “Layouts” tab.
3. Select the layout “Securonix Incident Information”.
4. Create a copy of that layout and click on it. (You can rename the layout.)
5. Select the newly created layout and click on edit.
   • To create a new section, drag and drop the “New Section” widget into the layout.
   • To add a new field to the layout, navigate to the “Fields and Buttons” section and search for the field. Drag and drop the field widget in the layout.
6. Once done, select “Save Version”.
7. Navigate to the “Incident Type” tab and select “Securonix Incident” type and detach it.
8. Attach the newly created layout.
9. Reattach the same “Incident Type” again else this incident type will not receive any new updates.

Note: It is recommended to use out-of-the-box mappers, layout & incident types for better visualization and meaningful mappings. If you are changing any out-of-the-box mappers/layout then it might not render all the fields as per the expectation.

Troubleshooting

Receive Notification on an Incident Fetch Error

The administrator and Cortex XSOAR users on the recipient’s list receive a notification when an integration experiences an incident fetch error. Cortex XSOAR users can select their notification method, such as email, from their user preferences. Refer to Cortex XSOAR 6.13 documentation or Cortex XSOAR 8 Cloud documentation or Cortex XSOAR 8.7 On-prem documentation for more information.

Input and output entries of the playbook are not visible in the war room

Follow the below steps and add a new server configuration:

1. Go to Settings > About > Troubleshooting.
2. Add new server configuration as “task.auto.quiet.mode.enabled” and enter the value as “false” and save. Refer to this XSOAR documentation
3. After this configuration, all the output entries for the execution of the playbook gets displayed in the war room.

The following are tips for handling issues with mirroring incidents between Securonix and Cortex XSOAR.

The securonix-list-violation-data command not returning the violations

1. Check the from and to arguments provided to the command. It should be ranging in the violations’ generation time.

Note: The following steps are compatible with the Securonix Build version 6.4_Apr2024_R1.

1. If the query arguments contain the special characters, then check and follow the below steps:
   1. Use the XSOAR automation browser to run the command.
   2. Don’t add the extra backslashes for the *, ? and \ characters. This is handled by the command itself. Before upgrading, revert any temporary backslash solutions that may have been provided.
2. If the Securonix Policy Type incident field is one of these (Land Speed, DIRECTIVE, BEACONING, TIER2) then try to execute command again with the additional ‘policy_type’ argument. The value for the policy_type argument should be the same as the value for the Securonix Policy Type incident field.

The securonix-list-activity-data command not returning the activity data

1. Check the from and to arguments provided to the command. It should be ranging in the activity data generation time.

Note: The following steps are compatible with the Securonix Build version 6.4_Apr2024_R1.

1. If the query arguments contain the special characters, then check and follow the below steps:
   1. Use the XSOAR automation browser to run the command.
   2. Don’t add the extra backslashes for the *, ? and \ characters. This is handled by the command itself. Before upgrading, revert any temporary backslash solutions that may have been provided.

Command HR or War room entries are breaking in the table view

1. There might be some special characters (restricted by Markdown viewer i.e, \*_{}[]()#+-!`|) in the value of field which is breaking the view.
2. Impact is in only on the HR output, however user can get exact values from the command context for such fields if any.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

securonix-list-workflows

Gets a list of all available workflows.

Base Command

securonix-list-workflows

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
{
    "Securonix": {
        "Workflows": [
            {
                "Type": "USER",
                "Value": "admin",
                "Workflow": "SOCTeamReview"
            },
            {
                "Type": "USER",
                "Value": "admin",
                "Workflow": "ActivityOutlierWorkflow"
            },
            {
                "Type": "USER",
                "Value": "admin",
                "Workflow": "AccessCertificationWorkflow"
            },
            {
                "Type": "USER",
                "Value": "admin",
                "Workflow": "test"
            }
        ]
    }
}

Human Readable Output

Available workflows

Workflow	Type	Value
SOCTeamReview	USER	admin
ActivityOutlierWorkflow	USER	admin
AccessCertificationWorkflow	USER	admin
test	USER	admin

securonix-get-default-assignee-for-workflow

Gets the default assignee for the specified workflow.

Base Command

securonix-get-default-assignee-for-workflow

Input

Context Output

Command Example

!securonix-get-default-assignee-for-workflow workflow=SOCTeamReview

Context Example

{
    "Securonix": {
        "Workflows": {
            "Type": "USER",
            "Value": "admin",
            "Workflow": "SOCTeamReview"
        }
    }
}

Human Readable Output

Default assignee for the workflow SOCTeamReview is: admin.

securonix-list-possible-threat-actions

Gets a list available threat actions.

Base Command

securonix-list-possible-threat-actions

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
{
    "Securonix": {
        "ThreatActions": [
            "Mark as concern and create incident",
            "Non-Concern",
            "Mark in progress (still investigating)"
        ]
    }
}

Human Readable Output

Possible threat actions are: Mark as concern and create incident, Non-Concern, Mark in progress (still investigating).

securonix-list-policies

Gets a list of all policies.

Base Command

securonix-list-policies

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
{
    "Securonix": {
        "Policies": [
            {
                "CreatedBy": "admin",
                "CreatedOn": "2013-11-09T16:13:23Z",
                "Criticality": "Low",
                "Description": null,
                "Hql": "FROM AccessAccount AS accessaccount, Resources AS resources, AccessAccountUser AS accessaccountuser WHERE ((accessaccount.resourceid  = resources.id  AND accessaccountuser.id.accountid  = accessaccount.id )) AND ((accessaccountuser.id.userid  = '-1'))",
                "ID": "1",
                "Name": "Accounts that dont have Users"
            },
            {
                "CreatedBy": "admin",
                "CreatedOn": "2013-11-09T16:31:09Z",
                "Criticality": "Medium",
                "Description": null,
                "Hql": "FROM Users AS users, AccessAccountUser AS accessaccountuser, AccessAccount AS accessaccount, Resources AS resources WHERE ((users.id  = accessaccountuser.id.userid  AND accessaccountuser.id.accountid  = accessaccount.id  AND accessaccount.resourceid  = resources.id )) AND ((users.status  = '0'))",
                "ID": "2",
                "Name": "Accounts that belong to terminated user"
            },
           
        ]
    }
}

Human Readable Output

Policies

ID	Name	Criticality	Created On	Created By	Description
1	Accounts that dont have Users	Low	2013-11-09T16:13:23Z	admin
2	Accounts that belong to terminated user	Medium	2013-11-09T16:31:09Z	admin

securonix-list-resource-groups

Gets a list of resource groups.

Base Command

securonix-list-resource-groups

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
{
    "Securonix": {
        "ResourceGroups": [
            {
                "Name": "Windows-CST1",
                "Type": "Microsoft Windows SNARE"
            },
            {
                "Name": "Websense Proxy",
                "Type": "Websense Proxy Server"
            },
            {
                "Name": "Palo Alto",
                "Type": "Palo Alto Next-Generation Firewall"
            },
            {
                "Name": "CDS1",
                "Type": "ControlsDS1"
            },
            {
                "Name": "Bluecoat",
                "Type": "Bluecoat Proxy"
            },
            {
                "Name": "Symantec-Email",
                "Type": "Symantec Message Security Gateway"
            },
            {
                "Name": "Proofpoint Email Gateway",
                "Type": "Proofpoint Email Gateway"
            },
            {
                "Name": "CiscoASA",
                "Type": "Cisco ASA"
            },
            {
                "Name": "CiscoAMP",
                "Type": "Cisco FireAMP"
            },
            {
                "Name": "PA800-adam",
                "Type": "Palo Alto Next-Generation Firewall"
            },
            {
                "Name": "CrowdStrike-PartnerAPI",
                "Type": "Crowdstrike Alerts Streaming"
            },
            {
                "Name": "squid-partners",
                "Type": "Squid Proxy"
            },
            {
                "Name": "Bluecoat_OP",
                "Type": "Bluecat_DHCP"
            },
            {
                "Name": "Bluecoat - Test",
                "Type": "Bluecoat Proxy"
            },
            {
                "Name": "Bluecoat_New",
                "Type": "Bluecoat Proxy"
            }
        ]
    }
}

Human Readable Output

Resource groups

Name	Type
Windows-CST1	Microsoft Windows SNARE
Websense Proxy	Websense Proxy Server
Palo Alto	Palo Alto Next-Generation Firewall
CDS1	ControlsDS1
Bluecoat	Bluecoat Proxy
Symantec-Email	Symantec Message Security Gateway
Proofpoint Email Gateway	Proofpoint Email Gateway
CiscoASA	Cisco ASA
CiscoAMP	Cisco FireAMP
PA800-adam	Palo Alto Next-Generation Firewall
CrowdStrike-PartnerAPI	Crowdstrike Alerts Streaming
squid-partners	Squid Proxy
Bluecoat_OP	Bluecat_DHCP
Bluecoat - Test	Bluecoat Proxy
Bluecoat_New	Bluecoat Proxy

securonix-list-users

Gets a list of users.

Base Command

securonix-list-users

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
{
    "Securonix": {
        "Users": [
            {
                "ContractEndDate": "2020-01-14T00:40:44Z",
                "Criticality": "Low",
                "Department": "Data Services",
                "Division": "Global Technology",
                "Email": "jon.doe@test.com",
                "EmployeeID": "1001",
                "FirstName": "jon",
                "LastName": "doe",
                "Masked": "false",
                "Riskscore": "0.0",
                "SkipEncryption": "false",
                "Status": "1",
                "Title": "Associate-Data Services"
            }
        ]
    }
}

Human Readable Output

Resource groups

First Name	Last Name	Criticality	Title	Email
jon	doe	Low	Associate-Data Services	jon.doe@test.com

securonix-list-activity-data

Gets a list of activity data for the specified resource group.

Base Command

securonix-list-activity-data

Input

Context Output

| Path | Type | Description |
|—————————————————-| — | — |
| Securonix.ActivityData.Accountname | String | Account name. |
| Securonix.ActivityData.Accountresourcekey | String | Account source key. |
| Securonix.ActivityData.Agentfilename | String | Agent file name. |
| Securonix.ActivityData.Baseeventid | String | Base event ID. |
| Securonix.ActivityData.Categorizedtime | String | Categorized time. |
| Securonix.ActivityData.Categorybehavior | String | Category behavior. |
| Securonix.ActivityData.Categoryobject | String | Category object. |
| Securonix.ActivityData.Categoryseverity | String | Category severity. |
| Securonix.ActivityData.Collectionmethod | String | Collection method. |
| Securonix.ActivityData.Collectiontimestamp | String | Collection timestamp. |
| Securonix.ActivityData.Customnumber1 | Number | Custom number. |
| Securonix.ActivityData.Customstring13 | String | Custom string. |
| Securonix.ActivityData.Customstring17 | String | Custom string. |
| Securonix.ActivityData.Customtime1 | String | Custom time. |
| Securonix.ActivityData.Customtime2 | String | Custom time. |
| Securonix.ActivityData.Datetime | String | Date time. |
| Securonix.ActivityData.Dayofmonth | String | Day of month. |
| Securonix.ActivityData.Dayofweek | String | Day of week. |
| Securonix.ActivityData.Dayofyear | String | Day of year. |
| Securonix.ActivityData.Destinationntdomain | String | Destination NT domain. |
| Securonix.ActivityData.Destinationprocessname | String | Destination process name. |
| Securonix.ActivityData.Destinationservicename | String | Destination service name. |
| Securonix.ActivityData.Destinationuserid | String | Destination user ID. |
| Securonix.ActivityData.Destinationusername | String | Destination username. |
| Securonix.ActivityData.Deviceaddress | String | Device address. |
| Securonix.ActivityData.Destinationuserprivileges | String | Destination user privileges. |
| Securonix.ActivityData.Devicecustomstring4 | String | Device custom string. |
| Securonix.ActivityData.Deviceeventcategory | String | Device event category. |
| Securonix.ActivityData.Deviceexternalid | String | Device external ID. |
| Securonix.ActivityData.Devicehostname | String | Device hostname. |
| Securonix.ActivityData.Ehash | String | Event hash. |
| Securonix.ActivityData.EventID | String | Event ID. |
| Securonix.ActivityData.Eventoutcome | String | Event outcome. |
| Securonix.ActivityData.Eventtime | String | Time the event occurred. |
| Securonix.ActivityData.Filepath | String | File path. |
| Securonix.ActivityData.Filepermission | String | File permission. |
| Securonix.ActivityData.Hour | String | Date time hour. |
| Securonix.ActivityData.ID | String | Activity ID. |
| Securonix.ActivityData.Ingestionnodeid | String | Ingestion node ID. |
| Securonix.ActivityData.Ipaddress | String | IP address. |
| Securonix.ActivityData.Ipaddress_Long | String | IP address long. |
| Securonix.ActivityData.JobID | String | Deprecated. Use the Securonix.ActivityData.Jobid field. |
| Securonix.ActivityData.Jobid | String | Job ID. |
| Securonix.ActivityData.Jobstarttime | String | Job start time. |
| Securonix.ActivityData.Message | String | Message. |
| Securonix.ActivityData.Minute | String | Date time minute. |
| Securonix.ActivityData.Month | String | Month. |
| Securonix.ActivityData.Oldfileid | String | Old file ID. |
| Securonix.ActivityData.Oldfilepath | String | Old file path. |
| Securonix.ActivityData.Others | String | Others. |
| Securonix.ActivityData.Poprocessedtime | String | PO processed time. |
| Securonix.ActivityData.Publishedtime | String | Published time. |
| Securonix.ActivityData.Rawevent | String | Raw event. |
| Securonix.ActivityData.Raweventsize | String | Raw event size. |
| Securonix.ActivityData.Receivedtime | String | Received time. |
| Securonix.ActivityData.Resourcename | String | Resource name. |
| Securonix.ActivityData.ResourceGroupCategory | String | Resource group category. |
| Securonix.ActivityData.ResourceGroupFunctionality | String | Resource group functionality. |
| Securonix.ActivityData.ResourceGroupID | String | Resource group ID. |
| Securonix.ActivityData.ResourceGroupName | String | Resource group name. |
| Securonix.ActivityData.ResourceGroupTimezoneoffset | String | Resource Group Timezone offset. |
| Securonix.ActivityData.ResourceGroupTypeID | String | Resource group resource type ID. |
| Securonix.ActivityData.ResourceGroupVendor | String | Resource group vendor. |
| Securonix.ActivityData.Resourcegroupid | String | Resource Group ID. |
| Securonix.ActivityData.Resourcegroupname | String | Resource Group Name. |
| Securonix.ActivityData.Resourcehostname | String | Resource host name. |
| Securonix.ActivityData.Resourcehostname_Long | String | Resource host name long. |
| Securonix.ActivityData.Resourcename | String | Resource name. |
| Securonix.ActivityData.Resourcetype | String | Resource type. |
| Securonix.ActivityData.Sessionid | String | Session ID. |
| Securonix.ActivityData.Sourceaddress | String | Source address. |
| Securonix.ActivityData.Sourceaddress_Long | String | Source address long. |
| Securonix.ActivityData.Sourcehostname | String | Source hostname. |
| Securonix.ActivityData.Sourcentdomain | String | Source domain. |
| Securonix.ActivityData.Sourceport | String | Source port. |
| Securonix.ActivityData.Sourceprocessname | String | Source process name. |
| Securonix.ActivityData.Sourceuserid | String | Source user ID. |
| Securonix.ActivityData.Sourceusername | String | Source username. |
| Securonix.ActivityData.TenantID | String | Tenant ID. |
| Securonix.ActivityData.Tenantname | String | Tenant name. |
| Securonix.ActivityData.Timeline | String | Time when the activity occurred, in Epoch time. |
| Securonix.ActivityData.Timeline_By_Hour | String | Timeline by hour. |
| Securonix.ActivityData.Timeline_By_Minute | String | Timeline by minute. |
| Securonix.ActivityData.Timeline_By_Month | String | Timeline by month. |
| Securonix.ActivityData.Timeline_By_Week | String | Timeline by week. |
| Securonix.ActivityData.Timestamp | String | Timestamp. |
| Securonix.ActivityData.Transactionstring1 | String | Transaction string 1. |
| Securonix.ActivityData.Userid | String | User ID. |
| Securonix.ActivityData.Week | String | Week. |
| Securonix.ActivityData.Year | String | Year. |
| Securonix.ActivityData.Indexed_At_Tdt | String | Indexed at TDT. |
| Securonix.ActivityData._Version | String | Activity version. |
| Securonix.Activity.totalDocuments | Number | Total number of events. |
| Securonix.Activity.message | String | Message from the API. |
| Securonix.Activity.queryId | String | Query Id for the pagination. |
| Securonix.Activity.command_name | String | The command name. |

Command example

!securonix-list-activity-data from="01/12/2024 10:00:00" to="01/15/2024 12:01:00"

Context Example

{
    "Securonix": {
        "Activity": {
            "queryId": "spotter_web_service_00000000-0000-0000-0000-000000000001",
            "totalDocuments": 1182,
            "command_name": "securonix-list-activity-data"
        },
        "ActivityData": [
            {
                "Accountname": "ACCOUNT_001",
                "Accountresourcekey": "00000000000~000000000.0000.com~pipe_line_test~0000~-1",
                "Agentfilename": "test.txt",
                "Categorybehavior": "Account Create",
                "Categoryobject": "Account Management",
                "Categoryseverity": "0",
                "Collectionmethod": "file",
                "Collectiontimestamp": "1690803374000",
                "Destinationusername": "TEST134044",
                "Devicehostname": "HOST.com",
                "EventID": "00000000-0000-0000-0000-000000000001",
                "Eventoutcome": "Success",
                "Filepath": "N/A",
                "Ingestionnodeid": "CONSOLE",
                "Jobstarttime": "1690803374000",
                "Message": "A user account was created.",
                "Publishedtime": "1690803374572",
                "Receivedtime": "1690803420706",
                "Resourcename": "HOST.com",
                "Sourceusername": "USER",
                "TenantID": "2",
                "Tenantname": "Response-Automation",
                "Timeline": "1670911200000"
            },
            {
                "Accountname": "ACCOUNT_002",
                "Accountresourcekey": "00000000000~000000000.0000.com~pipe_line_test~0000~-2",
                "Agentfilename": "test.txt",
                "Categorybehavior": "Account Create",
                "Categoryobject": "Account Management",
                "Categoryseverity": "0",
                "Collectionmethod": "file",
                "Collectiontimestamp": "1690803374000",
                "Destinationusername": "TEST134044",
                "Devicehostname": "HOST.com",
                "EventID": "00000000-0000-0000-0000-000000000002",
                "Eventoutcome": "Success",
                "Filepath": "N/A",
                "Ingestionnodeid": "CONSOLE",
                "Jobstarttime": "1690803374000",
                "Message": "A user account was created.",
                "Publishedtime": "1690803374572",
                "Receivedtime": "1690803420500",
                "Resourcename": "HOST.com",
                "Sourceusername": "USER",
                "TenantID": "2",
                "Tenantname": "Response-Automation",
                "Timeline": "1670911200000"
            }
        ]
    }
}

Human Readable Output

Activity data

EventID	Message	Accountname	Timeline	Devicehostname	Accountresourcekey
00000000-0000-0000-0000-000000000001	A user account was created.	ACCOUNT_001	2024-01-13T06:00:00.000Z	HOST.com	00000000000~000000000.0000.com~pipe_line_test~0000~-1
00000000-0000-0000-0000-000000000002	A user account was created.	ACCOUNT_002	2024-01-13T06:00:00.000Z	HOST.com	00000000000~000000000.0000.com~pipe_line_test~0000~-2

securonix-list-violation-data

Gets a list activity data for an account name.

Base Command

securonix-list-violation-data

Input

Context Output

Command Example

!securonix-list-violation-data from="01/01/2023 00:00:00" to="03/10/2023 00:00:00"

Context Example

{
    "Securonix": {
        "ViolationData": [
        {
            "Accountname": "TESTDPB30",
            "Categorizedtime": "Morning",
            "Category": "Account Compromise",
            "Categoryseverity": "0",
            "Datetime": "1676960205747",
            "Dayofmonth": "21",
            "Dayofweek": "3",
            "Dayofyear": "52",
            "Eventid": "test_event",
            "GenerationTime": "02/21/2023 00:17:19",
            "Hour": "0",
            "ID": "-1",
            "Invalid": "false",
            "Ipaddress": "IP Address",
            "Jobid": "140",
            "Jobstarttime": "1676960199000",
            "Month": "1",
            "Policyname": "Policy1",
            "Resourcecomments": "ingestion_2.0",
            "Resourcegroupid": "6",
            "Resourcegroupname": "test",
            "Resourcename": "mac30",
            "Resourcetype": "mvk",
            "Riskthreatname": "Abnormal amount of data egressed compared to peer",
            "TenantID": "2",
            "Tenantname": "test_tenant",
            "Timeline": "1676959200000",
            "Timeline_By_Hour": "1676980800000",
            "Timeline_By_Minute": "1676960100000",
            "Timeline_By_Month": "1675231200000",
            "Timeline_By_Week": "1676786400000",
            "Transactionstring1": "Logon failure 30",
            "Userid": "-1",
            "Violator": "RTActivityAccount",
            "Week": "8",
            "Year": "2023"
        },
        {
            "Accountname": "TESTDPB30",
            "Categorizedtime": "Morning",
            "Category": "Account Compromise",
            "Categoryseverity": "0",
            "Datetime": "1676960205747",
            "Dayofmonth": "21",
            "Dayofweek": "3",
            "Dayofyear": "52",
            "Eventid": "Event ID",
            "GenerationTime": "02/21/2023 00:17:19",
            "Hour": "0",
            "ID": "-1",
            "Invalid": "false",
            "Ipaddress": "IP Address",
            "Jobid": "140",
            "Jobstarttime": "1676960199000",
            "Month": "1",
            "Policyname": "Policy2",
            "Resourcecomments": "ingestion_2.0",
            "Resourcegroupid": "6",
            "Resourcegroupname": "tets",
            "Resourcename": "mac30",
            "Resourcetype": "mvk",
            "Riskthreatname": "Abnormal attempts to reset domain admin password",
            "TenantID": "2",
            "Tenantname": "test_tenant",
            "Timeline": "1676959200000",
            "Timeline_By_Hour": "1676980800000",
            "Timeline_By_Minute": "1676960100000",
            "Timeline_By_Month": "1675231200000",
            "Timeline_By_Week": "1676786400000",
            "Transactionstring1": "Logon failure 30",
            "Userid": "-1",
            "Violator": "RTActivityAccount",
            "Week": "8",
            "Year": "2023"
        }
        ],
        "Violation": {
            "totalDocuments": 2,
            "message": "",
            "queryId": "abcd1234"
        }
    }
}

Human Readable Output

Activity data

Policyname	Accountname
Policy1	TESTDPB30
Policy2	TESTDPB30

Next page query id: abcd1234

securonix-list-incidents

Gets a list of incidents.

Base Command

securonix-list-incidents

Input

Context Output

Command Example

!securonix-list-incidents from="5 days" incident_types=opened

Context Example

{
    "Securonix": {
        "Incidents": [
            {
                "AssignedUser": "Admin Admin",
                "Bulkactionallowed": true,
                "CaseEventEndTime": 1675849673983,
                "CaseEventStartTime": 1675845486324,
                "Casecreatetime": 1675849649900,
                "Entity": "RTActivityAccount",
                "IncidentID": "30107",
                "IncidentStatus": "COMPLETED",
                "IncidentType": "HighRiskRTActivityAccount",
                "IsWhitelisted": false,
                "LastUpdateDate": 1675849674032,
                "ParentCaseId": "",
                "Priority": "None",
                "Reason": [
                    "ResourceType: mvk",
                    "Policy: SandboxFeb8",
                    "Threat: Abnormal attempts to reset domain admin password"
                ],
                "Riskscore": 0,
                "SandBoxPolicy": true,
                "StatusCompleted": true,
                "TenantInfo": {
                "tenantid": 2,
                "tenantname": "test_tenant"
                },
                "Type": "HighRiskRTActivityAccount",
                "Url": "url",
                "ViolatorID": "TESTING2",
                "ViolatorText": "TESTING2",
                "Watchlisted": false,
                "WorkflowName": "SOCTeamReview",
                "Policystarttime": 1692950376801,
                "Policyendtime": 1695613655539,
                "Solrquery": "index = violation and ( ( @policyname = \"Response-PB-Resources-AutoPlay\" and @resourcename=\"Activityres17-Resource-549829\" )  ) AND @tenantname=\"Response-Automation\" AND datetime between \"02/07/2023 15:52:12\" \"02/07/2023 15:52:13\""
            },
            {
                "AssignedUser": "Admin Admin",
                "Bulkactionallowed": true,
                "CaseEventEndTime": 1675851019318,
                "CaseEventStartTime": 1675850440699,
                "Casecreatetime": 1675850942351,
                "Entity": "RTActivityAccount",
                "IncidentID": "30108",
                "IncidentStatus": "COMPLETED",
                "IncidentType": "HighRiskRTActivityAccount",
                "IsWhitelisted": true,
                "LastUpdateDate": 1675851019367,
                "ParentCaseId": "",
                "Priority": "None",
                "Reason": [
                    "ResourceType: mvk",
                    "Policy: SandboxFeb8",
                    "Threat: Abnormal attempts to reset domain admin password"
                ],
                "Riskscore": 0,
                "SandBoxPolicy": true,
                "StatusCompleted": true,
                "TenantInfo": {
                "tenantid": 2,
                "tenantname": "test_tenant"
                },
                "Type": "HighRiskRTActivityAccount",
                "Url": "url",
                "ViolatorID": "TESTING4",
                "ViolatorText": "TESTING4",
                "Watchlisted": false,
                "WorkflowName": "SOCTeamReview",
                "Policystarttime": 1692950376801,
                "Policyendtime": 1695613655539,
                "Solrquery": "index = violation and ( ( @policyname = \"Response-PB-Resources-AutoPlay\" and @resourcename=\"Activityres17-Resource-549829\" )  ) AND @tenantname=\"Response-Automation\" AND datetime between \"02/07/2023 15:52:12\" \"02/07/2023 15:52:13\""
            }
        ]
    }
}

Human Readable Output

Incidents

IncidentID	Incident Status	Incident Type	Priority	Reason
30107	COMPLETED	HighRiskRTActivityAccount	None	ResourceType: mvk, Policy: SandboxFeb8, Threat: Abnormal attempts to reset domain admin password
30108	COMPLETED	HighRiskRTActivityAccount	None	ResourceType: mvk, Policy: SandboxFeb8, Threat: Abnormal attempts to reset domain admin password

securonix-get-incident

Gets details of the specified incident.

Base Command

securonix-get-incident

Input

Context Output

Command Example

!securonix-get-incident incident_id=30107

Context Example

{
    "Securonix": {
        "Incidents": {
            "AssignedUser": "Admin Admin",
            "Casecreatetime": 1579687173702,
            "Entity": "Users",
            "IncidentID": "30107",
            "IncidentStatus": "Open",
            "IncidentType": "Policy",
            "IsWhitelisted": false,
            "LastUpdateDate": 1579687173702,
            "ParentCaseId": "",
            "Priority": "Critical",
            "Reason": [
                "Resource: BLUECOAT",
                "Policy: Uploads to personal websites",
                "Threat: Data egress via network uploads"
            ],
            "Riskscore": 0,
            "SandBoxPolicy": false,
            "StatusCompleted": false,
            "TenantInfo": {
                "tenantcolor": "#000000",
                "tenantid": 1,
                "tenantname": "Securonix",
                "tenantshortcode": "SE"
            },
            "Url": "url",
            "ViolatorID": "9",
            "ViolatorSubText": "1009",
            "ViolatorText": "Judi Mcabee",
            "Watchlisted": false,
            "WorkflowName": "SOCTeamReview",
            "Policystarttime": 1692950376801,
            "Policyendtime": 1695613655539,
            "Solrquery": "index = violation and ( ( @policyname = \"Response-PB-Resources-AutoPlay\" and @resourcename=\"Activityres17-Resource-549829\" )  ) AND @tenantname=\"Response-Automation\" AND datetime between \"02/07/2023 15:52:12\" \"02/07/2023 15:52:13\""
        }
    }
}

Human Readable Output

Incident

Assigned User	Casecreatetime	Entity	Incident Status	Incident Type	IncidentID	Is Whitelisted	Last Update Date	Priority	Reason	Riskscore	Sand Box Policy	Status Completed	Tenant Info	Url	Violator Sub Text	Violator Text	ViolatorID	Watchlisted	Workflow Name	Policystarttime	Policyendtime	Solrquery
Admin Admin	1579687173702	Users	Open	Policy	30107	false	1579687173702	Critical	Resource: BLUECOAT,Policy: Uploads to personal websites,Threat: Data egress via network uploads	0.0	false	false	tenantid: 1 tenantname: {name}	url	1009	john smith	9	false	SOCTeamReview	1692950376801	1695613655539	index = violation and ( ( @policyname = "Response-PB-Resources-AutoPlay" and @resourcename="Activityres17-Resource-549829" ) ) AND @tenantname="Response-Automation" AND datetime between "02/07/2023 15:52:12" "02/07/2023 15:52:13"

securonix-get-incident-status

Gets the status of the specified incident.

Base Command

securonix-get-incident-status

Input

Context Output

Command Example

!securonix-get-incident-status incident_id=30107

Context Example

{
    "Securonix": {
        "Incidents": {
            "IncidentID": "30107",
            "IncidentStatus": "Open"
        }
    }
}

Human Readable Output

Incident 30107 status is Open.

securonix-get-incident-workflow

Gets the workflow of the specified incident.

Base Command

securonix-get-incident-workflow

Input

Context Output

Command Example

!securonix-get-incident-workflow incident_id=30107

Context Example

{
    "Securonix": {
        "Incidents": {
            "IncidentID": "30107",
            "WorkflowName": "SOCTeamReview"
        }
    }
}

Human Readable Output

Incident 30107 workflow is SOCTeamReview.

securonix-get-incident-available-actions

Gets a list of available actions for the specified incident.

Base Command

securonix-get-incident-available-actions

Input

Context Output

There is no context output for this command.

Command Example

!securonix-get-incident-available-actions incident_id=30107

Context Example

{
    "Securonix": {
        "Incidents": {
            "AvailableActions": [
                "CLAIM",
                "ASSIGN TO ANALYST",
                "ASSIGN TO SECOPS"
            ],
            "IncidentID": "30107"
        }
    }
}

Human Readable Output

Incident 30107 available actions: [‘CLAIM’, ‘ASSIGN TO ANALYST’, ‘ASSIGN TO SECOPS’].

securonix-perform-action-on-incident

Performs an action on the specified incident.

Base Command

securonix-perform-action-on-incident

Input

Context Output

There is no context output for this command.

Command Example

!securonix-perform-action-on-incident action="Close Incident" incident_id=330365

Context Example

{}

Human Readable Output

Action Close Incident was performed on incident 330365.

securonix-add-comment-to-incident

Adds a comment to the specified incident.

Base Command

securonix-add-comment-to-incident

Input

Context Output

There is no context output for this command.

Command Example

!securonix-add-comment-to-incident incident_id=30107 comment="Just a comment"

Context Example

{}

Human Readable Output

Comment was added to the incident 30107 successfully.

securonix-list-watchlists

Gets a list of watchlists.

Base Command

securonix-list-watchlists

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
{
    "Securonix": {
        "WatchlistsNames": {
            "Bad_Performance_Review": "0",
            "Contractors-UpComing_Termination": "0",
            "Domain_Admin": "0",
            "Employees-UpComing_Terminations": "0",
            "Exiting_Behavior_Watchlist": "0",
            "Flight_Risk_Users_Watchlist": "0",
            "Privileged_Accounts": "0",
            "Privileged_Users": "0",
            "Recent_Hires": "0",
            "Recent_Transfers": "0",
            "Terminated_Contractors": "0",
            "Terminated_Employees": "0",
            "Test_watchlist": "0",
            "Test_watchlist2": "0"
        }
    }
}

Human Readable Output

Watchlists: Domain_Admin, Flight_Risk_Users_Watchlist, Recent_Transfers, Exiting_Behavior_Watchlist, Test_watchlist2, Bad_Performance_Review, Terminated_Contractors, Contractors-UpComing_Termination, Privileged_Accounts, Terminated_Employees, Test_watchlist, Privileged_Users, Recent_Hires, Employees-UpComing_Terminations.

securonix-get-watchlist

Gets information for the specified watchlist.

Base Command

securonix-get-watchlist

Input

Context Output

Command Example

!securonix-get-watchlist watchlist_name="test_watchlist"

Context Example

{
    "Securonix": {
        "Watchlists": {
            "Events": [{
                "Createdate": "1678438310720",
                "Entityname": "123",
                "Expired": "false",
                "Expirydate": "1681084799000",
                "Reason": "Added from web service..!",
                "Resourcegroupid": "-1",
                "Resourcename": "123",
                "Uniqueid": "2^~R^~-1|123",
                "Updatedate": "1678438310720"
            }],
            "TenantID": "2",
            "TenantName": "test_tenant",
            "Type": "Resources",
            "Watchlistname": "test_watchlist"
          }
    }
}

Human Readable Output

Watchlist test_watchlist of type Resources

Entityname	Expired
123	false

securonix-create-watchlist

Creates a watchlist in Securonix.

Base Command

securonix-create-watchlist

Input

Context Output

Command Example

!securonix-create-watchlist watchlist_name=test_watchlist

Context Example

{
    "Securonix": {
        "Watchlists": "test_watchlist"
    }
}

Human Readable Output

Watchlist test_watchlist was created successfully.

securonix-check-entity-in-watchlist

Checks if the specified entity is in a watchlist.

Base Command

securonix-check-entity-in-watchlist

Input

Context Output

Command Example

!securonix-check-entity-in-watchlist entity_name=1002 watchlist_name=test_watchlist

Context Example

{
    "Securonix": {
        "EntityInWatchlist": {
            "Entityname": "1002"
        }
    }
}

Human Readable Output

Entity unique identifier 1002 provided is not in the watchlist: test_watchlist.

securonix-add-entity-to-watchlist

Adds an entity to a watchlist.

Base Command

securonix-add-entity-to-watchlist

Input

Context Output

There is no context output for this command.

Command Example

!securonix-add-entity-to-watchlist entity_type=Resources entity_name=123 watchlist_name=test_watchlist

Context Example

{}

Human Readable Output

Added successfully the entity 123 to the watchlist test_watchlist.

securonix-create-incident

Creates an incident. For more information about the required arguments, see the Securonix documentation.

Base Command

securonix-create-incident

Input

Context Output

Command Example

!securonix-create-incident action_name="Mark as concern and create incident" entity_name=MH1014 entity_type=Users resource_group="BLUECOAT" resource_name="BLUECOAT" violation_name="Uploads to personal Websites" workflow=SOCTeamReview comment=bgdfs criticality=Critical

Context Example

{
    "Securonix": {
        "Incidents": {
            "AssignedUser": "Admin Admin",
            "Casecreatetime": 1579687771677,
            "Entity": "Users",
            "IncidentID": "30134",
            "IncidentStatus": "Open",
            "IncidentType": "Policy",
            "IsWhitelisted": false,
            "LastUpdateDate": 1579687771677,
            "ParentCaseId": "",
            "Priority": "Critical",
            "Reason": [
                "Resource: BLUECOAT",
                "Policy: Uploads to personal websites",
                "Threat: Data egress via network uploads"
            ],
            "Riskscore": 0,
            "SandBoxPolicy": false,
            "StatusCompleted": false,
            "TenantInfo": {
                "tenantcolor": "#000000",
                "tenantid": 1,
                "tenantname": "Securonix",
                "tenantshortcode": "SE"
            },
            "Url": "{url}",
            "ViolatorID": "14",
            "ViolatorSubText": "1014",
            "ViolatorText": "john doe",
            "Watchlisted": false,
            "WorkflowName": "SOCTeamReview"
        }
    }
}

Human Readable Output

Incident was created successfully

Entity	Incident Status	Incident Type	IncidentID	Priority	Reason	Url
Users	Open	Policy	30134	Critical	Resource: BLUECOAT,Policy: Uploads to personal websites,Threat: Data egress via network uploads	url

securonix-threats-list

Retrieve a list of threats violated within a specified time range and get details about
the threat models and policies violated.

Base Command

securonix-threats-list

Input

Context Output

Command Example

!securonix-threats-list date_from="1 day"

Context Example

{
    "Securonix": {
        "Threats": {
            "TenantID": 2,
            "Tenantname": "Response-Automation",
            "Violator": "Activityaccount",
            "EntityID": "VIOLATOR5-1673852881421",
            "Resourcegroupname": "RES-PLAYBOOK-DS-AUTOMATION",
            "ThreatName": "TM_Response-PB-ActivityAccount-Manual",
            "Category": "NONE",
            "Resourcename": "RES10-RESOURCE-302184",
            "Resourcetype": "Res-Playbook",
            "GenerationTime": "Mon, 16 Jan 2023 @ 01:53:31 AM",
            "GenerationTime_Epoch": 1673855611090,
            "Policies": [
                "Response-PB-ActivityAccount-Manual"
            ],
            "policystarttime": 1661161072000,
            "policyendtime": 1661161072000,
            "solrquery": "index = violation and ( ( @policyname = \"Response-PB-ActivityAccount-Manual\" and @ipaddress=\"127.0.0.1\" )  ) AND @tenantname=\"Response-Automation\" AND datetime between \"08/22/2022 04:37:52\" \"08/22/2022 04:37:53\""
        }
    }
}

Human Readable Output

Threats

ThreatName	EntityID	Violator	Category	Resourcegroupname	Resourcename	Resourcetype	GenerationTime	Policies	TenantID	Tenantname
TM_Response-PB-ActivityAccount-Manual	VIOLATOR5-1673852881421	Activityaccount	NONE	RES-PLAYBOOK-DS-AUTOMATION	RES10-RESOURCE-302184	Res-Playbook	Mon, 16 Jan 2023 @ 01:53:31 AM	Response-PB-ActivityAccount-Manual	2	Response-Automation

securonix-incident-activity-history-get

Retrieves incident activity history for a specified incident.

Base Command

securonix-incident-activity-history-get

Input

Context Output

Command example

!securonix-incident-activity-history-get incident_id=3235505

Context Example

{
    "Securonix": {
        "IncidentHistory": [
            {
                "caseid": "3235505",
                "eventTime": "Jan 18, 2023 2:34:21 AM",
                "isPlayBookOutAvailable": true,
                "playBookOutput": {
                    "executor": "Admin Admin",
                    "executorId": 41,
                    "playBookId": 104,
                    "playBookName": "Create Security Incident",
                    "playRunId": "Playbook Run ID",
                    "tasksForParticularRun": [
                        {
                            "connectionMetadata": "{\"source\":\"test\"}",
                            "description": "Create Security incidents",
                            "executedTask": {
                                "executionId": "104-c08be5e4-480d-4105-9ed7-232cf902fa83",
                                "status": "FINISHED",
                                "taskEndTime": 1674009264968,
                                "taskInfo": {
                                    "Incident created": [
                                        {
                                            "highlight": false,
                                            "isurl": false,
                                            "key": "INCIDENT NUMBER",
                                            "showonui": true,
                                            "value": "0724324"
                                        },
                                        {
                                            "highlight": false,
                                            "isurl": false,
                                            "key": "sys_id",
                                            "showonui": false,
                                            "value": "61a6b780dbeca910dabd266e13961933"
                                        },
                                        {
                                            "highlight": false,
                                            "isurl": false,
                                            "key": "lastViolationTime",
                                            "showonui": false,
                                            "value": "1674009261355"
                                        },
                                        {
                                            "highlight": false,
                                            "isurl": true,
                                            "key": "INCIDENT URL",
                                            "showonui": true,
                                            "value": "<URL of Securonix platform>"
                                        },
                                        {
                                            "highlight": false,
                                            "isurl": false,
                                            "key": "VIOLATION_COUNT",
                                            "showonui": true,
                                            "value": "15"
                                        }
                                    ]
                                },
                                "taskStartTime": 1674009261396
                            },
                            "icon": "test",
                            "lastExecutedTime": 1674009261396,
                            "lastStatus": "FINISHED",
                            "taskId": 104,
                            "taskName": "Create Security Incident"
                        }
                    ]
                }
            },
            {
                "actiontaken": "CREATED",
                "caseid": "3235505",
                "comment": [
                    {
                        "Comments": "Incident created while executing playbook - Create Security Incident"
                    }
                ],
                "commentType": [
                    "text"
                ],
                "creator": "admin",
                "currWorkflow": "SOCTeamReview",
                "currentassignee": "API_TEST_SS",
                "eventTime": "Jan 18, 2023 2:34:22 AM",
                "isPlayBookOutAvailable": false,
                "status": "Open",
                "username": "Admin Admin"
            },
            {
                "actiontaken": "CLOSE AS FIXED",
                "caseid": "3235505",
                "comment": [
                    {
                        "Comments": "Incident closed as part of AutoClosure"
                    }
                ],
                "commentType": [
                    "text"
                ],
                "creator": "admin",
                "currWorkflow": "DEFAULTWORKFLOW",
                "currentassignee": "API_TEST_SS",
                "eventTime": "Jan 20, 2023 5:08:42 AM",
                "isPlayBookOutAvailable": false,
                "lastStatus": "Open",
                "pastassignee": "API_TEST_SS",
                "prevWorkflow": "SOCTeamReview",
                "status": "COMPLETED",
                "username": "Admin Admin"
            }
        ]
    }
}

Human Readable Output

Incident activity history for ID: 3235505

Action Taken	Username	Event Time	Status	Last Status	Comment	Playbook ID	Playbook Name	Playbook Executor
CLOSE AS FIXED	Admin Admin	Jan 20, 2023 5:08:42 AM	COMPLETED	Open	Incident closed as part of AutoClosure
CREATED	Admin Admin	Jan 18, 2023 2:34:22 AM	Open		Incident created while executing playbook - Create Security Incident
		Jan 18, 2023 2:34:21 AM				104	Create Security Incident	Admin Admin

securonix-incident-attachment-get

Retrieves the attachments available on the Securonix platform.

Base Command

securonix-incident-attachment-get

Input

Context Output

Command example

!securonix-incident-attachment-get incident_id=12345678 from=2023-01-27T07:25:00Z to=2023-01-27T08:25:00Z

Context Example

{
    "Securonix": {
        "Incidents": {
            "Attachments": [
                {
                    "Files": "REST_API_Categories___SNYPR_6.4.pdf",
                    "IncidentID": 3422464053
                }
            ]
        }
    },
    "File": {
        "Type": "application/pdf",
        "Size": "6,157,973 bytes",
        "Info": "PDF document, version 1.4",
        "MD5": "ee0e57a311beb1c9a326b921625d31e4",
        "SHA1": "e60bb6364981039bca21285a5c35a41afcbcdbb",
        "SHA256": "b1c383bb218218b5a816841a7a91f1dcab08c1034d434fcefab70b4d804b7cc",
        "SHA512": "0c2208f9dd5c65b18fb88dc8dec81c412e2b22b6122f837827079c7dad9b27c5d691a4d09edf3583a8313fae2a7a620c86ff4a186e46273970e542d42ca4bb0",
        "SSDeep": "98304:EIkHaH04jKTu8dEp/i6fVm+RG9de2VaqhEIrST6k2WLcJVHvLx4jO1mzPyX:BYgjfyE46fbRGze2gTILk+VHvLx719",
    }
}

Human Readable Output

Incident ID: 3235505

Uploaded file: REST_API_Categories___SNYPR_6.4.pdfDownload

Property	Type	Size	Info	MD5	SHA1	SHA256	SHA512	SSDeep
Value	application/pdf	6,157,973 bytes	PDF document, version 1.4	ee0e57a311beb1c9a326b921625d31e4	ae60bb6364981039bca21285a5c35a41afcbcdbb	8b1c383bb218218b5a816841a7a91f1dcab08c1034d434fcefab70b4d804b7cc	60c2208f9dd5c65b18fb88dc8dec81c412e2b22b6122f837827079c7dad9b27c5d691a4d09edf3583a8313fae2a7a620c86ff4a186e46273970e542d42ca4bb0	98304:EIkHaH04jKTu8dEp/i6fVm+RG9de2VaqhEIrST6k2WLcJVHvLx4jO1mzPyX:BYgjfyE46fbRGze2gTILk+VHvLx719

securonix-whitelists-get

Gets a list of whitelists.

Base Command

securonix-whitelists-get

Input

Context Output

Command example

#### Context Example

```json
{
    "Securonix": {
        "Whitelist": [{
        "WhitelistName": "Dummy Whitelist 1",
        "WhitelistType": "Automated",
        "TenantName": "test_tenant"
      },
      {
        "WhitelistName": "Dummy Whitelist 2",
        "WhitelistType": "Automated",
        "TenantName": "test_tenant"
      }]
    }
}

Human Readable Output

Whitelists

WhitelistName	WhitelistType	TenantName
Dummy Whitelist 1	Automated	test_tenant
Dummy Whitelist 2	Automated	test_tenant

securonix-whitelist-entry-list

Gets information for the specified whitelist.

Base Command

securonix-whitelist-entry-list

Input

Context Output

Command example

!securonix-whitelist-entry-list whitelist_name="test_whitelist"

Context Example

{
    "Securonix": {
        "Whitelist": {
            "Entries": [
              {
                "Entity/Attribute": "TEST123",
                "ExpiryDate": "09/28/2035 21:21:19"
              }
            ],
            "TenantName": "TenantAug02",
            "Whitelistname": "test_whitelist"
        }
    }
}

Human Readable Output

Whitelist: Dummy Threat Model MM

Entity/Attribute	ExpiryDate
TEST123	09/28/2035 21:21:19

securonix-xsoar-state-mapping-get

Returns the state mapping of XSOAR with Securonix.

Base Command

securonix-xsoar-state-mapping-get

Input

This command does not have any arguments.

Context Output

Command example

#### Context Example

```json
{
  "Securonix": {
    "StateMapping": {
      "ACTIVE": {
        "action": "Start Investigation",
        "status": "in progress"
      },
      "DONE": {
        "action": "Close Incident",
        "status": "completed"
      }
    }
  }
}

Human Readable Output

State Mapping

XSOAR Status	Securonix Status	Securonix Action Name
Active	in progress	Start Investigation
Closed	completed	Close Incident

securonix-whitelist-create

Creates a whitelist in Securonix.

Base Command

securonix-whitelist-create

Input

Context Output

There is no context output for this command.

Command Example

!securonix-whitelist-create whitelistname="test_whitelist" entity_type="Users"

Context Example

{}

Human Readable Output

Whitelist test_whitelist was created successfully.

securonix-whitelist-entry-add

Add entity or attribute to the specified whitelist entry.

Base Command

securonix-whitelist-entry-add

Input

Context Output

There is no context output for this command.

Command example

!securonix-whitelist-entry-add whitelist_name=whitelistdemo_Activityip whitelist_type=Global tenant_name=test_tenant entity_type=Activityip entity_id=0.0.0.1 expiry_date=04/02/2023

Context example

{}

Human Readable Output

Entity added to global whitelist Successfully.

securonix-lookup-table-create

Creates a lookup table.

Base Command

securonix-lookup-table-create

Input

Context Output

There is no context output for this command.

Command Example

!securonix-lookup-table-create name=test_lookup_table field_names="samplefield,samplefield2" key="samplefield" tenant_name=test_tenant scope=Global

Context Example

{}

Human Readable Output

Lookup Table test_lookup_table created successfully

securonix-lookup-table-config-and-data-delete

Deletes the data and configuration of the provided lookup table.

Base Command

securonix-lookup-table-config-and-data-delete

Input

Context Output

Command Example

!securonix-lookup-table-config-and-data-delete name="test"

Context Example

{
  "Securonix": {
    "LookupTable": {
      "lookupTableName": "test",
      "isDeleted": true
    }
  }    
}

Human Readable Output

test and data deleted successfully

securonix-lookup-tables-list

Retrieves a list of lookup tables available within the Securonix platform.

Base Command

securonix-lookup-tables-list

Input

Context Output

Command example

!securonix-lookup-tables-list max=2 offset=0

Context Example

{
    "Securonix": {
        "LookupTable": [
            {
                "lookupTableName": "NonBusinessDomains",
                "scope": "global",
                "tenantName": "All Tenants",
                "totalRecords": 2213,
                "type": "system"
            },
            {
                "lookupTableName": "CompressedFileExtensions",
                "scope": "meta",
                "tenantName": "All Tenants",
                "totalRecords": 240,
                "type": "system"
            }
        ]
    }
}

Human Readable Output

Lookup Tables

Tenant Name	Lookup Table Name	Total Records	Scope	Type of Lookup Table
All Tenants	NonBusinessDomains	2213	global	system
All Tenants	CompressedFileExtensions	240	meta	system

securonix-whitelist-entry-delete

Remove entity or attribute from the specified whitelist entry.

Base Command

securonix-whitelist-entry-delete

Input

Context Output

There is no context output for this command.

Command Example

!securonix-whitelist-entry-delete whitelistname="test_whitelist" entity_id="test_user"

Context Example

{}

Human Readable Output

test_user Item removed from whitelist Successfully.

securonix-lookup-table-entries-list

Retrieves the entries stored in a specified lookup table.

Base Command

securonix-lookup-table-entries-list

Input

Context Output

Command example

!securonix-lookup-table-entries-list name="TEST_M" max=2 sort="ip" order=desc

Context Example

{
    "Securonix": {
        "LookupTableEntries": [
            {
                "defaultenrichedevent": [
                    "127.0.0.9",
                    "B5E3195FB4E1EB3BE797077CEE398C04",
                    "bad"
                ],
                "entry": [
                    {
                        "key": "reputation",
                        "value": "bad"
                    },
                    {
                        "key": "ip",
                        "value": "127.0.0.9"
                    },
                    {
                        "key": "id",
                        "value": "B5E3195FB4E1EB3BE797077CEE398C04"
                    }
                ],
                "key": "B5E3195FB4E1EB3BE797077CEE398C04",
                "lookupname": "TEST_M",
                "lookupuniquekey": "2^~TEST_M|B5E3195FB4E1EB3BE797077CEE398C04",
                "tenantid": 2,
                "tenantname": "novr3nonmssp",
                "timestamp": "Feb 18, 2023 5:50:16 AM"
            },
            {
                "defaultenrichedevent": [
                    "127.0.0.8",
                    "497B9EC67354A28D62A98E82299871CC",
                    "good"
                ],
                "entry": [
                    {
                        "key": "reputation",
                        "value": "good"
                    },
                    {
                        "key": "ip",
                        "value": "127.0.0.8"
                    },
                    {
                        "key": "id",
                        "value": "497B9EC67354A28D62A98E82299871CC"
                    }
                ],
                "key": "497B9EC67354A28D62A98E82299871CC",
                "lookupname": "TEST_M",
                "lookupuniquekey": "2^~TEST_M|497B9EC67354A28D62A98E82299871CC",
                "tenantid": 2,
                "tenantname": "novr3nonmssp",
                "timestamp": "Feb 18, 2023 5:50:16 AM"
            }
        ]
    }
}

Human Readable Output

Entries

Key	Lookup Unique Key	Tenant Name	Timestamp	id	ip	reputation
B5E3195FB4E1EB3BE797077CEE398C04	2^~TEST_M|B5E3195FB4E1EB3BE797077CEE398C04	novr3nonmssp	Feb 18, 2023 5:50:16 AM	B5E3195FB4E1EB3BE797077CEE398C04	127.0.0.9	bad
497B9EC67354A28D62A98E82299871CC	2^~TEST_M|497B9EC67354A28D62A98E82299871CC	novr3nonmssp	Feb 18, 2023 5:50:16 AM	497B9EC67354A28D62A98E82299871CC	127.0.0.8	good

securonix-lookup-table-entries-delete

Deletes the entries from the lookup table.

Base Command

securonix-lookup-table-entries-delete

Input

Context Output

There is no context output for this command.

Command example

!securonix-lookup-table-entries-delete name=TEST_M lookup_unique_keys=2^~TEST_M|158267F0BC6E7484E3C0F5964ABE9D2B,2^~TEST_M|175A9FFD55480ED376C992AC86ABE3D7

Context Example

{}

Human Readable Output

Successfully deleted following entries from TEST_M: 2^~TEST_M

158267F0BC6E7484E3C0F5964ABE9D2B, 2^~TEST_M

175A9FFD55480ED376C992AC86ABE3D7.

securonix-lookup-table-entry-add

Add entries to the provided lookup table.

Base Command

securonix-lookup-table-entry-add

Input

Context Output

There is no context output for this command.

Command example

!securonix-lookup-table-entry-add name="TEST_TABLE" json_data="[{\"id\": \"1\",\"ip\": \"127.0.0.1\",\"reputation\": \"bad\",\"expiryDate\":\"02/13/2023\"},{\"id\": \"2\",\"ip\": \"127.0.0.2\",\"reputation\": \"good\"}]"

Human Readable Output

Entries added to TEST_TABLE successfully