Stealthwatch Cloud

Protect your cloud assets and private network.

Network Security · Cisco Secure Cloud Analytics (Stealthwatch Cloud)

Details

ID	`Stealthwatch Cloud`
Provider	Cisco Systems
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10325753`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Overview

Use the Cisco Secure Cloud Analytics (Stealthwatch Cloud) integration to manage threats to your networks.

This integration was integrated and tested with Cisco Secure Cloud Analytics (Stealthwatch Cloud) v1.0.0.

Use cases

Fetch incidents
Block domains (Block list)
Update alerts

Configure Cisco Secure Cloud Analytics (Stealthwatch Cloud) on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Stealthwatch Cloud.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Stealthwatch server URL
- Stealthwatch Cloud API key. Should be in the form of "ApiKey :<api_key>"
- Use system proxy settings
- Trust any certificate (not secure)
- Fetch incidents
- Incident type
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get information for an alert: sw-show-alert
Update an alert: sw-update-alert
Get a list of all alerts: sw-list-alerts
Block a domain or IP: sw-block-domain-or-ip
Unblock a domain: sw-unblock-domain
Get a list of blocked domains: sw-list-blocked-domains
Get a list of observations: sw-list-observations
Get a list of sessions by session occurrence time: sw-list-sessions

1. Get information for an alert

Returns information about a specific alert by the alert ID.

Base Command

sw-show-alert

Input

Argument Name	Description	Required
alertID	The id of the required alert	Required
addComments	Add comments information, can be long	Optional

Context Output

Path	Type	Description
Stealthwatch.Alert.id	number	Alert ID
Stealthwatch.Alert.assigned_to	string	Alert assignee
Stealthwatch.Alert.obj_created	date	Alert creation date
Stealthwatch.Alert.last_modified	date	Alert last modification
Stealthwatch.Alert.resolved	boolean	Alert state
Stealthwatch.Alert.source_info.ips	string	IP of the alert's source
Stealthwatch.Alert.source_info.hostnames	string	Hostname of the alert's source

Command Example

!sw-show-alert alertID=275

Context Example

{
  "assigned_to": null,
  "assigned_to_username": null,
  "created": "2018-07-23T15:30:00Z",
  "description": "Source has started a port scan on a device internal to your network.",
  "hostname": "",
  "id": 275,
  "ips_when_created": [],
  "last_modified": "2018-10-02T22:41:07.749868Z",
  "merit": 3,
  "natural_time": "1 month ago",
  "obj_created": "2018-07-23T16:34:01.566717Z",
  "priority": 2,
  "publish_time": "2018-07-23T16:34:01.531458+00:00",
  "resolved": true,
  "resolved_time": "2018-11-17T05:00:01.458445Z",
  "resolved_user": null,
  "rules_matched": null,
  "snooze_settings": null,
  "source": 48858,
  "source_info": {
    "created": "2018-09-23T15:49:39.025415+00:00",
    "hostnames": [],
    "ips": [
      "5.5.255.25"
    ],
    "name": "test.com",
    "namespace": "default"
  },
  "source_name": "5.5.255.25",
  "source_params": {
    "id": 48852,
    "meta": "net-link",
    "name": "test.com"
  },
  "tags": [],
  "text": "Internal Port Scanner on 5.5.255.25",
  "time": "2018-10-02T21:49:00Z",
  "type": "Internal Port Scanner"
}

2. Update an alert

Updates an alert.

Base Command

sw-update-alert

Input

Argument Name	Description	Required
alertID	The ID of the alert to update	Required
resolved	Set the resolved field to true and set the merit field to close an alert. merit can be 8 ("helpful") or 9 ("not helpful")	Optional
merit	Set the resolved field to true and set the merit field to close an alert. merit can be 8 ("helpful") or 9 ("not helpful")	Optional
tags	Tags (string)	Optional
new_comment	Set the new_comment field to add a comment to the alert	Optional
publish_time	Publish time (string), e.g., publish_time=2018-08-01T07:54:39Z	Optional
snooze_settings	Snooze settings (string)	Optional
resolved_user	Username (string)	Optional
assigned_to	Assigned to (integer)	Optional

Context Output

Path	Type	Description
Stealthwatch.Alert.id	number	Alert ID
Stealthwatch.Alert.assigned_to	string	Alert assignee
Stealthwatch.Alert.obj_created	date	Alert creation date
Stealthwatch.Alert.last_modified	date	Date the alert was last modified
Stealthwatch.Alert.resolved	boolean	Alert state
Stealthwatch.Alert.source_info.ips	string	IP of the alert's source
Stealthwatch.Alert.source_info.hostname	string	Hostname of the alert's source

Command Example

!sw-update-alert alertID=275 merit=8 tags=test

3. Get a list of all alerts

Get the list of Stealthwatch alerts.

Base Command

sw-list-alerts

Input

Argument Name	Description	Required
status	Filters alerts by status: open, closed, or all. Default is open. The all status enables you to see an individual alert whether it is open or closed.	Optional
search	Finds a particular string in the alerts, e.g., a particular IP address, hostname, or alert type.	Optional
assignee	Filter to only display alerts assigned to a specific user	Optional
tags	Tags shows alerts that are assigned a particular incident tag	Optional
limit	Number of alerts to list, default is 5	Optional
addComments	Add comment to an alert, long-text supported	Optional

Context Output

Path	Type	Description
Stealthwatch.Alert.id	number	Alert ID
Stealthwatch.Alert.assigned_to	string	Alert assignee
Stealthwatch.Alert.obj_created	date	Alert creation date
Stealthwatch.Alert.last_modified	date	Date the alert was last modified
Stealthwatch.Alert.resolved	boolean	Alert state
Stealthwatch.Alert.source_info.ips	string	IP of the alert's source
Stealthwatch.Alert.source_info.hostname	string	Hostname of the alert's source

Command Example

{
  "assigned_to": null,
  "assigned_to_username": null,
  "created": "2018-07-23T15:30:00Z",
  "description": "Source has started a port scan on a device internal to your network.",
  "hostname": "",
  "id": 275,
  "ips_when_created": [],
  "last_modified": "2018-10-02T22:41:07.749868Z",
  "merit": 3,
  "natural_time": "1 month ago",
  "obj_created": "2018-07-23T16:34:01.566717Z",
  "priority": 2,
  "publish_time": "2018-07-23T16:34:01.531458+00:00",
  "resolved": true,
  "resolved_time": "2018-11-17T05:00:01.458445Z",
  "resolved_user": null,
  "rules_matched": null,
  "snooze_settings": null,
  "source": 48858,
  "source_info": {
    "created": "2018-09-23T15:49:39.025415+00:00",
    "hostnames": [],
    "ips": [
      "5.5.255.25"
    ],
    "name": "test.com",
    "namespace": "default"
  },
  "source_name": "5.5.255.25",
  "source_params": {
    "id": 48852,
    "meta": "net-link",
    "name": "test.com"
  },
  "tags": [],
  "text": "Internal Port Scanner on 5.5.255.25",
  "time": "2018-10-02T21:49:00Z",
  "type": "Internal Port Scanner"
}

4. Block a domain or IP

Adds a domain or IP to the block list.

Base Command

sw-block-domain-or-ip

Input

Argument Name	Description	Required
domain	Domain to add to the block list	Optional
ip	IP to add to the block list	Optional

Context Output

Path	Type	Description
Stealthwatch.Domain.identifier	string	Domain name
Stealthwatch.Domain.title	string	Domain title
Stealthwatch.Domain.id	number	Domain ID
Stealthwatch.IP.identifier	string	IP address
Stealthwatch.IP.title	string	IP title
Stealthwatch.IP.id	string	IP ID

Command Example

!sw-block-domain-or-ip domain=test.com

5. Unblock a domain

Removes a domain from the block list.

Base Command

sw-unblock-domain

Input

Argument Name	Description	Required
id	ID of the domain to remove from the block list. You can find the id by running the sw-list-blocked-domains command.	True

Context Output

There is no context output for this command.

Command Example

!sw-unblock-domain id=5

6. Get a list of blocked domains

Returns a list of blocked domains.

Base Command

sw-list-blocked-domains

Input

Argument Name	Description	Required
search	Finds a particular string in the alerts, e.g., a particular IP address, hostname, or alert type.	Optional
domain	Search for a specific domain	Optional
limit	Number of domains to list, default is 5	Optional

Context Output

Path	Type	Description
Stealthwatch.Domain.identifier	string	Domain name
Stealthwatch.Domain.title	string	Domain title
Stealthwatch.Domain.id	number	Domain ID

Command Example

!sw-list-blocked-domains limit=5

7. Get a list of observations

Returns observations by alert ID, observation ID, or a free search.

Base Command

sw-list-observations

Input

Argument Name	Description	Required
search	Finds a particular string amongst the alerts. For example, a particular IP address, hostname, or alert type.	False
alert	Use the alert query parameter with an alert id to only show observations referenced by the alert	False
id	Get a specific observation by its ID	False
limit	Amount of observations to list. Default is 5	False

Context Output

Path	Type	Description
Stealthwatch.Observation.id	number	Observation ID
Stealthwatch.Observation.port_count	number	Observation port count
Stealthwatch.Observation.creation_time	string	Observation creation time
Stealthwatch.Observation.end_time	string	Observation end time
Stealthwatch.Observation.scanned_ip	string	Observation scanned ip
Stealthwatch.Observation.scanner_ip	string	Observation scanner ip
Stealthwatch.Observation.source	unknown	Observation source

Command Example

!sw-list-observations alert=222

Context Example

{
 "cidr_range": "5.5.5.179/32",
 "connected_ip": null,
 "connected_ip_country_code": "",
 "creation_time": "2018-07-23T15:30:00Z",
 "end_time": "2018-07-23T15:30:00Z",
 "id": 12345,
 "observation_name": "Port Scanner",
 "port_count": 24,
 "port_ranges": "0-1023",
 "resource_name": "port_scanner_v1",
 "scan_type": "internal",
 "scanned_packets": 5,
 "scanner_packets": 75,
 "source": 48822,
 "time": "2018-07-23T15:30:00Z"
}

8. Get a list of sessions by session occurrence time

Get sessions by the session's occurrence time ( Time format: YYYY-MM-DDTHH:MM:SSZ)

Base Command

sw-list-sessions

Input

Argument Name	Description	Required
startTime	Session start time (UTC), e.g., startTime="2018-09-30T12:00:00Z"	Required
endTime	Session end time (UTC), e.g., endTime="2018-07-31T15:00:00Z"	Optional
limit	Number of observations to list, default is 400	Optional
ip	Source IP address to filter by	Optional
connectedIP	Connected IP to filter by	Optional
connectedDeviceId	Connected device ID	Optional
sessionType	Type of session - select external/internal to receive data only about this type of session	Optional

Context Output

Path	Type	Description
Stealthwatch.Session.id	number	Session ID
Stealthwatch.Session.port	number	Session port
Stealthwatch.Session.start_timestamp_utc	string	Session start time
Stealthwatch.Session.ip	string	Session IP
Stealthwatch.Session.connected_ip	string	Session connected IP
Stealthwatch.Session.device_id	number	Source device ID
Stealthwatch.Session.connected_device_id	number	Connected device ID
Stealthwatch.Session.connected_device_is_external	boolean	Is the connected device external

Command Example

!sw-list-sessions startTime="2018-10-30T12:00:00Z" endTime="2018-11-01T12:00:00Z"

Configuration parameters

serverURL — Stealthwatch's server URL (required)
APIKey — Stealthwatch Cloud API key. Should be in the form of "ApiKey <username>:<apikey>"
credentials_api_key —
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (8)

sw-block-domain-or-ip
Add a domain or IP to the block list
sw-list-alerts
Get the list of Stealthwatch alerts
sw-list-blocked-domains
Returns list of the blocked domains
sw-list-observations
Get observations by alert ID, observation ID, or free search
sw-list-sessions
Get sessions by the session's occurrence time ( Time format: YYYY-MM-DDTHH:MM:SSZ)
sw-show-alert
Get info about a specific alert by its ID
sw-unblock-domain
Remove a domain from the block list
sw-update-alert
Update an alert

Source

Stealthwatch_Cloud.py Stealthwatch_Cloud_test.py Stealthwatch_Cloud.yml Stealthwatch_Cloud_description.md

Download History Raw

category: Network Security
provider: Cisco Systems
commonfields:
  id: Stealthwatch Cloud
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Stealthwatch's server URL
  name: serverURL
  required: true
  type: 0
  section: Connect
- display: Stealthwatch Cloud API key. Should be in the form of "ApiKey <username>:<apikey>"
  name: APIKey
  type: 4
  hidden: true
  required: false
  section: Connect
- name: credentials_api_key
  type: 9
  displaypassword: Stealthwatch Cloud API key. Should be in the form of "ApiKey <username>:<apikey>"
  hiddenusername: true
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  defaultvalue: 'false'
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
description: Protect your cloud assets and private network.
display: Cisco Secure Cloud Analytics (Stealthwatch Cloud)
name: Stealthwatch Cloud
script:
  commands:
  - arguments:
    - description: The id of the required alert.
      name: alertID
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Add comments information, can be long.
      name: addComments
      predefined:
      - 'true'
      - 'false'
    description: Get info about a specific alert by its ID
    name: sw-show-alert
    outputs:
    - contextPath: Stealthwatch.Alert.id
      description: Alert's id.
      type: number
    - contextPath: Stealthwatch.Alert.assigned_to
      description: Alert's assignee.
      type: string
    - contextPath: Stealthwatch.Alert.obj_created
      description: Alert's creation date.
      type: date
    - contextPath: Stealthwatch.Alert.last_modified
      description: Alert's last modification.
      type: date
    - contextPath: Stealthwatch.Alert.resolved
      description: 'Alert''s state.'
      type: boolean
    - contextPath: Stealthwatch.Alert.source_info.ips
      description: IP of the alert's source.
      type: string
    - contextPath: Stealthwatch.Alert.source_info.hostnames
      description: Hostname of the alert's source.
      type: string
  - arguments:
    - description: The id of the alert for update.
      name: alertID
      required: true
    - auto: PREDEFINED
      description: Set the resolved field to true and set the merit field to close an alert. merit can be 8 ("helpful") or 9 ("not helpful").
      name: resolved
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Set the resolved field to true and set the merit field to close an alert. merit can be 8 ("helpful") or 9 ("not helpful").
      name: merit
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '8'
      - '9'
    - description: Tags (string).
      name: tags
    - description: Set the new_comment field to add a comment to the alert.
      name: new_comment
    - description: Publish time (string). Example, publish_time=2018-08-01T07:54:39Z.
      name: publish_time
    - description: Snooze settings (string).
      name: snooze_settings
    - description: 'Username (string).'
      name: resolved_user
    - description: Assigned to (integer).
      name: assigned_to
    description: Update an alert
    name: sw-update-alert
    outputs:
    - contextPath: Stealthwatch.Alert.id
      description: Alert's id.
      type: number
    - contextPath: Stealthwatch.Alert.assigned_to
      description: Alert's assignee.
      type: string
    - contextPath: Stealthwatch.Alert.obj_created
      description: Alert's creation date.
      type: date
    - contextPath: Stealthwatch.Alert.last_modified
      description: Alert's last modification.
      type: date
    - contextPath: Stealthwatch.Alert.resolved
      description: 'Alert''s state.'
      type: boolean
    - contextPath: Stealthwatch.Alert.source_info.ips
      description: IP of the alert's source.
      type: string
    - contextPath: Stealthwatch.Alert.source_info.hostname
      description: Hostname of the alert's source.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: 'status filters alerts by status: open, closed, or all. Default is open. all allows you to see an individual alert regardless of whether it''s open or closed.'
      name: status
      predefined:
      - open
      - closed
      - all
    - description: search finds a particular string amongst the alerts. For example, a particular IP address, hostname, or alert type.
      name: search
    - description: assignee filters shows only alerts assigned to a particular user.
      name: assignee
    - description: tags shows alerts that are assigned a particular incident tag.
      name: tags
    - defaultValue: '5'
      description: Amount of alerts to list. Default is 5.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Add comments information, can be long.
      name: addComments
      predefined:
      - 'true'
      - 'false'
    description: Get the list of Stealthwatch alerts
    name: sw-list-alerts
    outputs:
    - contextPath: Stealthwatch.Alert.id
      description: Alert's id.
      type: number
    - contextPath: Stealthwatch.Alert.assigned_to
      description: Alert's assignee.
      type: string
    - contextPath: Stealthwatch.Alert.obj_created
      description: Alert's creation date.
      type: date
    - contextPath: Stealthwatch.Alert.last_modified
      description: Alert's last modification.
      type: date
    - contextPath: Stealthwatch.Alert.resolved
      description: 'Alert''s state.'
      type: boolean
    - contextPath: Stealthwatch.Alert.source_info.ips
      description: IP of the alert's source.
      type: string
    - contextPath: Stealthwatch.Alert.source_info.hostname
      description: Hostname of the alert's source.
      type: string
  - arguments:
    - description: Domain to add to the block list.
      name: domain
    - description: IP to add to the block list.
      name: ip
    description: Add a domain or IP to the block list
    name: sw-block-domain-or-ip
    outputs:
    - contextPath: Stealthwatch.Domain.identifier
      description: Domain name.
      type: string
    - contextPath: Stealthwatch.Domain.title
      description: Domain title.
      type: string
    - contextPath: Stealthwatch.Domain.id
      description: Domain id.
      type: number
    - contextPath: Stealthwatch.IP.identifier
      description: IP address.
      type: string
    - contextPath: Stealthwatch.IP.title
      description: IP title.
      type: string
    - contextPath: Stealthwatch.IP.id
      description: IP id.
      type: string
  - arguments:
    - description: ID of the domain to remove from the block list. You can find the id using 'sw-list-blocked-domains'.
      name: id
      required: true
    description: Remove a domain from the block list
    name: sw-unblock-domain
  - arguments:
    - description: search finds a particular string amongst the alerts. For example, a particular IP address, hostname, or alert type.
      name: search
    - description: Search for specific domain.
      name: domain
    - defaultValue: '5'
      description: Amount of domains to list. Default is 5.
      name: limit
    description: Returns list of the blocked domains
    name: sw-list-blocked-domains
    outputs:
    - contextPath: Stealthwatch.Domain.identifier
      description: Domain name.
      type: string
    - contextPath: Stealthwatch.Domain.title
      description: Domain title.
      type: string
    - contextPath: Stealthwatch.Domain.id
      description: Domain id.
      type: number
  - arguments:
    - description: search finds a particular string amongst the alerts. For example, a particular IP address, hostname, or alert type.
      name: search
    - description: Use the alert query parameter with an alert id to only show observations referenced by the alert.
      name: alert
    - description: Get a specific observation by its id.
      name: id
    - defaultValue: '5'
      description: Amount of observations to list. Default is 5.
      name: limit
    description: Get observations by alert ID, observation ID, or free search
    name: sw-list-observations
    outputs:
    - contextPath: Stealthwatch.Observation.id
      description: Observation ID.
      type: number
    - contextPath: Stealthwatch.Observation.port_count
      description: Observation port count.
      type: number
    - contextPath: Stealthwatch.Observation.creation_time
      description: Observation creation time.
      type: string
    - contextPath: Stealthwatch.Observation.end_time
      description: Observation end time.
      type: string
    - contextPath: Stealthwatch.Observation.scanned_ip
      description: Observation scanned ip.
      type: string
    - contextPath: Stealthwatch.Observation.scanner_ip
      description: Observation scanner ip.
      type: string
    - contextPath: Stealthwatch.Observation.source
      description: Observation source.
      type: unknown
  - arguments:
    - description: Session's start time (UTC). For example, startTime="2018-09-30T12:00:00Z".
      name: startTime
      required: true
    - description: Session's end time (UTC). For example, endTime="2018-07-31T15:00:00Z".
      name: endTime
    - defaultValue: '400'
      description: Amount of observations to list. Default is 400.
      name: limit
    - description: Source IP address to filter by.
      name: ip
    - description: Connected IP to filter by.
      name: connectedIP
    - description: Connected device ID.
      name: connectedDeviceId
    - auto: PREDEFINED
      defaultValue: all
      description: Select type of session - external/internal to receive data only about this kind of session.
      name: sessionType
      predefined:
      - all
      - external
      - internal
    description: 'Get sessions by the session''s occurrence time ( Time format: YYYY-MM-DDTHH:MM:SSZ)'
    name: sw-list-sessions
    outputs:
    - contextPath: Stealthwatch.Session.id
      description: Session ID.
      type: number
    - contextPath: Stealthwatch.Session.port
      description: Session port.
      type: number
    - contextPath: Stealthwatch.Session.start_timestamp_utc
      description: Session start time.
      type: string
    - contextPath: Stealthwatch.Session.ip
      description: Session IP.
      type: string
    - contextPath: Stealthwatch.Session.connected_ip
      description: Session connected IP.
      type: string
    - contextPath: Stealthwatch.Session.device_id
      description: Source device ID.
      type: number
    - contextPath: Stealthwatch.Session.connected_device_id
      description: Connected device ID.
      type: number
    - contextPath: Stealthwatch.Session.connected_device_is_external
      description: Is the connected device external.
      type: boolean
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10325753
tests:
- No test
fromversion: 5.0.0