Silverfort

Details

ID	`Silverfort`
Provider	Silverfort
Category	Authentication & Identity Management
From Version	5.0.0
Docker Image	`demisto/auth-utils:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

Silverfort protects organizations from data breaches by delivering strong authentication across entire corporate networks and cloud environments, without requiring any modifications to endpoints or servers. Using patent-pending technology, Silverfort’s agentless approach enables multi-factor authentication and AI-driven adaptive authentication even for systems that don’t support it today, including proprietary systems, critical infrastructure, shared folders, IoT devices, and more.

Use Silverfort integration to get & update Silverfort risk severity.

This integration was integrated and tested with Silverfort version 5.2.

Silverfort Playbook

Get risk information and block the user if the risk is ‘high’ or ‘critical’
Update the Silverfort user risk level

Use Cases

Consume Silverfort user and server risk levels
Enrich the Silverfort risk engine and trigger MFA on risky entities

Configure Silverfort in Cortex

Parameter	Description	Required
Name	a textual name for the integration instance	True
url	Server URL	True
apikey	APIKEY	True
insecure	Trust any certificate (not secure)	False

To generate an API token for external access:
1. On the Silverfort Admin Console, navigate to the SETTINGS page, and then select Silverfort API.
2. Enable the Allow 3rd party risk updates switch.
3. Copy the Risk API Key (External Access) value - this will be your API key.
4. For the URL, use one of the following based on your Silverfort region:
  - Global region: https://raven.silverfort.io
  - EU region: https://eu.raven.silverfort.io
  - Singapore region: https://sg.raven.silverfort.io
    // End of Selection

For more information, see the Silverfort documentation.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details. DBot messages provide a structured summary of the command execution, including the inputs, outputs, and any relevant indicators of compromise (IOCs) or risk levels.

silverfort-get-user-risk

User risk commands - get the user entity risk.

Base Command

silverfort-get-user-risk

Input

Argument Name	Description	Required
upn	The user principal name.	Optional
email	The email address.	Optional
sam_account	The sam account.	Optional
domain	The domain.	Optional

Specify one of the following:

upn
email address and domain
sam account and domain

Context Output

Path	Type	Description
Silverfort.UserRisk.Risk	String	The risk level.
Silverfort.UserRisk.Reasons	Unknown	The reasons for the risk.
Silverfort.UserRisk.UPN	String	The user principal name.

Command Example

!silverfort-get-user-risk upn="sfuser@silverfort.io"

Human Readable Output

Silverfort User Risk

UPN	Risk	Reasons
sfuser@silverfort.io	Medium	Suspicious activity, Password never expires

silverfort-get-resource-risk

Gets the resource entity risk information.

Base Command

silverfort-get-resource-risk

Input

Argument Name	Description	Required
resource_name	The hostname.	Required
domain_name	The domain.	Required

Command Example

!silverfort-get-resource-risk resource_name="SF-DC-1" domain_name="silverfort.io"

Human Readable Output

Silverfort Resource Risk

ResourceName	Risk	Reasons
SF-DC-1	Low	Unconstrained Delegation

silverfort-update-user-risk

Updates the user entity risk.

Base Command

silverfort-update-user-risk

Input

Argument Name	Description	Required
upn	The user principal name.	Optional
risk_name	The risk name.	Required
severity	The severity.	Required
valid_for	The number of hours that the risk will be valid for.	Required
description	The risk description.	Required

Command Example

!silverfort-update-user-risk upn="sfuser@silverfort.io" risk_name="activity_risk" severity=medium valid_for=1 description="Suspicious activity"

Human Readable Output

ok

silverfort-update-resource-risk

Update the resource entity risk.

Base Command

silverfort-update-resource-risk

Input

Argument Name	Description	Required
resource_name	The hostname.	Required
domain_name	The domain name.	Required
risk_name	The risk name.	Required
severity	The severity.	Required
valid_for	The number of hours the severity will be relevant for.	Required
description	A short description about the risk.	Required

Command Example

!silverfort-update-resource-risk resource_name="SF-DC-1" domain_name="silverfort.io" risk_name="malware_risk" severity="high" valid_for=1 description="Malware detected"

Human Readable Output

ok

Configuration parameters

url — Server URL (required)
apikey — APIKEY (required)
insecure — Trust any certificate (not secure)
operationalApiKey — Operational API Key
externalApiKey — External API Key

Commands (4)

silverfort-get-resource-risk
Gets the resource entity risk information.
silverfort-get-user-risk
User risk commands - get the user entity risk.
silverfort-update-resource-risk
Update the resource entity risk.
silverfort-update-user-risk
Updates the user entity risk.

Source

Silverfort.py Silverfort_test.py Silverfort.yml Silverfort_description.md

Download History Raw

category: Authentication & Identity Management
provider: Silverfort
sectionorder:
- Connect
commonfields:
  id: Silverfort
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: APIKEY
  additionalinfo: Generate your unique API token from the tower
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Operational API Key
  name: operationalApiKey
  type: 4
  required: false
  section: Connect
  additionalinfo: For Silverfort 5.3 and above, you must include the operational API Key for calls using sam_account/domain instead of UPN. (Format is "Operational User ID:Operational User Secret")
- display: External API Key
  name: externalApiKey
  type: 4
  required: false
  section: Connect
  additionalinfo: For Silverfort 5.3 and above, you must include the external API Key for external calls
description: Use the Silverfort integration to get and update Silverfort risk severity.
display: Silverfort
name: Silverfort
script:
  commands:
  - arguments:
    - description: The user principal name.
      name: upn
    - description: The email address.
      name: email
    - description: The sam account.
      name: sam_account
    - description: The domain.
      name: domain
    description: User risk commands - get the user entity risk.
    name: silverfort-get-user-risk
    outputs:
    - contextPath: Silverfort.UserRisk.Risk
      description: The risk level.
      type: String
    - contextPath: Silverfort.UserRisk.Reasons
      description: The reasons for the risk.
      type: Unknown
    - contextPath: Silverfort.UserRisk.UPN
      description: The user principal name.
      type: String
  - arguments:
    - description: The hostname.
      name: resource_name
      required: true
    - description: The domain.
      name: domain_name
      required: true
    description: Gets the resource entity risk information.
    name: silverfort-get-resource-risk
    outputs:
    - contextPath: Silverfort.ResourceRisk.Risk
      description: The risk level.
      type: String
    - contextPath: Silverfort.ResourceRisk.Reasons
      description: The reasons for the risk.
      type: Unknown
    - contextPath: Silverfort.ResourceRisk.ResourceName
      description: The hostname.
      type: String
  - arguments:
    - description: The user principal name.
      name: upn
    - description: The risk name.
      name: risk_name
      required: true
    - auto: PREDEFINED
      description: The severity.
      name: severity
      predefined:
      - low
      - medium
      - high
      - critical
      required: true
    - description: The number of hours that the risk will be valid for.
      name: valid_for
      required: true
    - description: The risk description.
      name: description
      required: true
    - description: The email address.
      name: email
    - description: The sam account.
      name: sam_account
    - description: The domain.
      name: domain
    description: Updates the user entity risk.
    name: silverfort-update-user-risk
  - arguments:
    - description: The hostname.
      name: resource_name
      required: true
    - description: The domain name.
      name: domain_name
      required: true
    - description: The risk name.
      name: risk_name
      required: true
    - auto: PREDEFINED
      description: The severity.
      name: severity
      predefined:
      - low
      - medium
      - high
      - critical
      required: true
    - description: The number of hours the severity will be relevant for.
      name: valid_for
      required: true
    - description: A short description about the risk.
      name: description
      required: true
    description: Update the resource entity risk.
    name: silverfort-update-resource-risk
  dockerimage: demisto/auth-utils:1.0.0.10133006
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- No tests (auto formatted)