Skyhigh Secure Web Gateway (On Prem)

Manages the block and allow lists within Skyhigh Secure Web Gateway.
This integration was integrated and tested with version 11.2.9 of Skyhigh Secure Web Gateway (On Prem)

Configure Skyhigh Secure Web Gateway (On Prem) in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

swg-get-available-lists

Get all available lists.

Base Command

swg-get-available-lists

Input

Context Output

Command example

!swg-get-available-lists name=blocklist

Context Example

{
    "SWG": {
        "List": {
            "ID": "com.scur.type.regex.386",
            "Title": "blocklist",
            "Type": "regex"
        }
    }
}

Human Readable Output

Lists

Title	ID	Type
blocklist	com.scur.type.regex.386	regex
Category Blocklist	5145	category
Upload Media Type Blocklist	5146	mediatype

swg-get-list

Retrieve a specific list.

Base Command

swg-get-list

Input

Context Output

Command example

!swg-get-list list_id=com.scur.type.regex.386

Context Example

{
    "SWG": {
        "List": {
            "Description": "blocklist",
            "ID": "com.scur.type.regex.386",
            "Title": "blocklist",
            "Type": "regex",
            "ListEntries": [
                {
                    "Description": "this is really evil",
                    "ListID": "com.scur.type.regex.386",
                    "Name": "http*://test.evil/*",
                    "Position": 0
                },
                {
                    "Description": "this is really evil",
                    "ListID": "com.scur.type.regex.386",
                    "Name": "http*://test-more.evil/*",
                    "Position": 1
                }
            ]
        }
    }
}

Human Readable Output

List Properties

Title	ID	Description	Type
blocklist	com.scur.type.regex.386	blocklist	regex

blocklist

Position	Name	Description
0	http://test.evil/	this is really evil
1	http://test-more.evil/	this is really evil

swg-get-list-entry

Retrieve a specific entry from a list.

Base Command

swg-get-list-entry

Input

Context Output

Command example

!swg-get-list-entry list_id=com.scur.type.regex.386 entry_pos=0

Context Example

{
    "SWG": {
        "List": {
            "ID": "com.scur.type.regex.386",
            "ListEntries": {
                "Description": "this is really evil",
                "ListID": "com.scur.type.regex.386",
                "Name": "http*://test.evil/*",
                "Position": "0"
            }
        }
    }
}

Human Readable Output

List entry at position 0

ListID	Position	Name	Description
com.scur.type.regex.386	0	http://test.evil/	this is really evil

swg-insert-entry

Insert a new entry to a list.

Base Command

swg-insert-entry

Input

Context Output

Command example

!swg-insert-entry list_id=com.scur.type.regex.386 entry_pos=0 name="http*://evil.corp/*" description="ticket #1: This is an evil domain"

Context Example

{
    "SWG": {
        "List": {
            "ID": "com.scur.type.regex.386",
            "ListEntries": {
                "Description": "ticket #1: This is an evil domain",
                "ListID": "com.scur.type.regex.386",
                "Name": "http*://evil.corp/*",
                "Position": "0"
            }
        }
    }
}

Human Readable Output

Added List entry at position 0

ListID	Position	Name	Description
com.scur.type.regex.386	0	http://evil.corp/	ticket #1: This is an evil domain

swg-delete-entry

Insert a new entry to a list.

Base Command

swg-delete-entry

Input

Context Output

There is no context output for this command.

Command example

!swg-delete-entry list_id=com.scur.type.regex.386 entry_pos=0

Human Readable Output

Deleted List entry at position 0

ListID	Position	Name	Description
com.scur.type.regex.386	0	http://evil.corp	ticket #1: This is an evil domain

swg-modify-list

Overwrites the complete XML configuration of a list.

Base Command

swg-modify-list

Input

Context Output

Command example

!swg-modify-list list_id=com.scur.type.regex.386 config=`<list version="1.0.3.46" mwg-version="11.2.9-44482" name="blocklist" id="com.scur.type.regex.386" typeId="com.scur.type.regex" classifier="Other" systemList="false" structuralList="false" defaultRights="2"><description>blocklist</description><content><listEntry><entry>http*://evil.corp/*</entry><description>ticket #1: This is an evil domain</description></listEntry></content></list>`

Context Example

{
    "SWG": {
        "List": {
            "Description": "blocklist",
            "ID": "com.scur.type.regex.386",
            "Title": "blocklist",
            "Type": "regex",
            "ListEntries": [
                {
                    "Description": "ticket #1: This is an evil domain",
                    "ListID": "com.scur.type.regex.386",
                    "Name": "http*://evil.corp/*",
                    "Position": 0
                }
            ]
        }
    }
}

Human Readable Output

Modified blocklist

Title	ID	Description	Type
blocklist	com.scur.type.regex.386	blocklist	regex

swg-create-list

Create a new list.

Base Command

swg-create-list

Input

Context Output

Command example

!swg-create-list name="blocklist" type=regex

Context Example

{
    "SWG": {
        "List": {
            "Description": "",
            "ID": "com.scur.type.regex.460",
            "Title": "blocklist",
            "Type": "regex"
        }
    }
}

Human Readable Output

Created List Properties

Title	ID	Description	Type
blocklist	com.scur.type.regex.460		regex

swg-delete-list

Delete a list.

Base Command

swg-delete-list

Input

Context Output

There is no context output for this command.

Command example

!swg-delete-list list_id=com.scur.type.regex.460

Human Readable Output

Deleted List Properties

Title	ID	Description	Type
blocklist	com.scur.type.regex.460		regex