TeamViewer Event Collector

Details

ID	`TeamViewer Event Collector`
Provider	TeamViewer
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

TeamViewer event collector integration for Cortex XSIAM.
This integration was integrated and tested with version 15.40 of TeamViewer.
User access token scope: Event logging - Allow requesting all event logs.
A Tensor license is required.

Configure TeamViewer Event Collector in Cortex

Parameter	Description	Required
Your server URL		True
Script Token	The script token to use for connection	True
Trust any certificate (not secure)		False
Use system proxy settings		False
First fetch time		False
The maximum number of alerts per fetch		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

teamviewer-get-events

Gets events from TeamViewer.

Base Command

teamviewer-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of results to return.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days) - within the last 12 months. Recommended time is 3 days.
max_fetch — The maximum number of alerts per fetch

Commands (1)

teamviewer-get-events
Gets events from TeamViewer.

Source

TeamViewerEventCollector.py TeamViewerEventCollector_test.py TeamViewerEventCollector.yml TeamViewerEventCollector_description.md

Download History Raw

## TeamViewer
Use this integration to collect events automatically from TeamViewer.
You can also use the ***teamviewer-get-events*** command to manually collect events.

TeamViewer event collector collects the following event types:
* AuditEvents 
* CompanyAdministration
* GroupManagement
* UserProfile
* Session
* CustomModules
* Policy

### Script Token
To use the TeamViewer collector, you would need to create a script token.
Notice that A Tensor license is required.

1. Log in to the Management Console: https://login.teamviewer.com/
2. Click on your user in the upper right corner and select **Edit profile**.
3. Select **Apps**.
4. Select **Create script token**.
5. Tick all the permissions you need for your token (User access token scope: Event logging - is needed ).
6. Select **Create**.
7. The token has now been added to the Apps and Scripts list. To get your token, click on the newly created token. The token will be displayed under the token name.

[For more information, click here](https://community.teamviewer.com/English/kb/articles/109647-use-the-teamviewer-api).