Details

ID	`Traceable`
Provider	Harness
Category	Analytics & SIEM
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Traceable AI API Security Platform Integration

Overview

Traceable platform monitors application APIs and detects Threat Events. These Threat Events consist of the details about the Threat Activity, the Actor performing the threat activity and the request/response payloads.

With this integration, an Incident can be raised in Cortex Xsoar when an event is detected by Traceable platform. This enables the security teams to orchestrate actions through Cortex Xsoar with meaningful information about the detected Threat Activities.

Setup

To use the integration the following mandatory parameters need to be set:

Parameter Name	Default Value	Description
Traceable Platform API Endpoint URL	https://api.traceable.ai	Base URL of the Traceable platform API endpoint.
API Token	-	API token used for authenticating against the Traceable platform.
Trust any certificate (not secure)	false	Trust any SSL certificate while connecting to the Traceable platform API endpoint.
Use system proxy settings	false	Use the system proxy using the environment variables `http_proxy`/`https_proxy`.

The API token can be generated as described in the Traceable Documentation

Customize Event/Activity Collection

The following parameters can be used to select the events that should be imported from the Traceable platform into Cortex Xsoar as security incidents.

Parameter name	Type	Required (Yes/No)	Default Value	Description
First fetch timestamp	Short text	No	1 days	Duration in the past to query the events, when querying for the first time.
Max number of records to fetch per API call to Traceable API Endpoint	Short text	No	100	Number of records to return from Traceable platform per query.
Number of span queries to run in parallel	Short text	No	5	Number of threads to use for querying `spans` in parallel.
Max spans per thread	Short text	No	50	Number of `spans` to query per span thread. Value can be an integer between 1 to 1000.
Comma Separated Environment List To Process	Long text	No	-	Comma separated list of environments to query.
Security Score Category	Multi select	No	CRITICAL, HIGH, MEDIUM	`Security Score Category` of the events to be queried.
Threat Category	Multi select	No	Malicious Activities, API Abuse, Malicious Sources	`Threat Category` of the events to be queried.
IP Reputation Level	Multi select	No	CRITICAL, HIGH, MEDIUM	`IP Reputation Level` of the events to be queried.
IP Abuse Velocity	Multi select	No	CRITICAL, HIGH, MEDIUM	`IP Abuse Velocity` of the events to queried.
IP Location Type	Multi select	No	-	`IP Location` type of the events to be queried.
Traceable Platform Endpoint URL	Long text	No	https://app.traceable.ai	Base URL of the Traceable platform UI endpoint.
Ignore Status Codes	Long text	No	400-499	Ignore incidents for which the HTTP status codes fall in the range of the given comma-separated list of HTTP status codes and/or status code ranges. eg. `301, 400-499`.
Incident optional field list	Multi select	No	actorDevice, actorEntityId, actorId, actorScoreCategory, actorSession, apiName, apiUri, category, ipAbuseVelocity, ipReputationLevel, securityEventType, securityScore, serviceId, actorScore, threatCategory, type	Optional fields to pull from the Traceable event.
Additional API Attributes	Multi select	No	isExternal, isAuthenticated, riskScore, riskScoreCategory, isLearnt	Additional API attributes to query for the affected API in the incident.
Fetch unique incidents	Boolean	No	true	Select if the integration should only fetch unique occurrences of a given incident from Traceable Platform.

Incident Types

The integration generates Exploit type of incidents.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

list_incident_cache

List the entries present in the Traceable instance cache.

Base Command

list_incident_cache

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
Traceable.Instancecache.id	string	Cache entry ID.
Traceable.Instancecache.expiry	date	Cache entry expiration date.

purge_incident_cache

Delete all entries in the incident cache.

Base Command

purge_incident_cache

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
Traceable.Instancecache.id	string	Cache entry ID.
Traceable.Instancecache.expiry	date	Cache entry expiration date.
Traceable.Instancecache.deletion_status	string	Cache entry deletion status.

Official Traceable Documentation

https://docs.traceable.ai/

Issues?

Reach out to support@traceable.ai

Configuration parameters

url — Traceable Platform API Endpoint URL (required)
credentials — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — Max number of records to fetch per API call to Traceable API Endpoint
span_fetch_threadpool — Number of span queries to run in parallel
span_query_batch_size — Max spans per thread (1 to 1000)
environment — Comma Separated Environment List To Process
securityScoreCategory — Security Score Category
threatCategory — Threat Category
ipReputationLevel — IP Reputation Level
ipAbuseVelocity — IP Abuse Velocity
ipCategories — IP Location Type
app_url — Traceable Platform Endpoint URL
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
ignoreStatusCodes — Ignore Status Codes (eg. 301, 400-499)
optionalDomainEventFieldList — Incident optional field list
optionalAPIAttributes — Additional API Attributes
isFetchUniqueIncidents — Fetch unique incidents
timegap_between_repeat_incidents — Time between raising similar incidents (in <number> <time unit>, e.g., in 12 hours, in 7 days)

Commands (2)

list_incident_cache
List the entries present in the Traceable instance cache.
purge_incident_cache
Delete all entries in the incident cache.

Source

Traceable.py Traceable_test.py Traceable.yml Traceable_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: Harness
commonfields:
  id: Traceable
  version: -1
configuration:
- display: Traceable Platform API Endpoint URL
  name: url
  defaultvalue: https://api.traceable.ai
  type: 0
  required: true
  section: Connect
- display: ""
  displaypassword: API Token
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  defaultvalue: 'true'
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  defaultvalue: 1 days
  type: 0
  required: false
  section: Collect
- name: max_fetch
  display: Max number of records to fetch per API call to Traceable API Endpoint
  required: false
  type: 0
  defaultvalue: '100'
  section: Collect
- name: span_fetch_threadpool
  display: Number of span queries to run in parallel
  required: false
  type: 0
  defaultvalue: '5'
  section: Collect
- display: "Max spans per thread (1 to 1000)"
  name: span_query_batch_size
  type: 0
  required: false
  additionalinfo: Provide a value between 1 and 1000.
  defaultvalue: '50'
  section: Connect
- display: "Comma Separated Environment List To Process"
  name: environment
  type: 12
  required: false
  section: Connect
- display: "Security Score Category"
  name: securityScoreCategory
  defaultvalue: CRITICAL,HIGH,MEDIUM
  type: 16
  required: false
  options:
  - CRITICAL
  - HIGH
  - MEDIUM
  - LOW
  section: Collect
- display: "Threat Category"
  name: threatCategory
  defaultvalue: Malicious Activities,API Abuse,Malicious Sources
  type: 16
  required: false
  options:
  - Malicious Activities
  - API Abuse
  - Malicious Sources
  section: Collect
- display: "IP Reputation Level"
  name: ipReputationLevel
  defaultvalue: CRITICAL,HIGH,MEDIUM
  type: 16
  required: false
  options:
  - CRITICAL
  - HIGH
  - MEDIUM
  - LOW
  - UNKNOWN
  section: Collect
- display: "IP Abuse Velocity"
  name: ipAbuseVelocity
  type: 16
  required: false
  options:
  - CRITICAL
  - HIGH
  - MEDIUM
  - LOW
  - UNKNOWN
  defaultvalue: CRITICAL,HIGH,MEDIUM
  section: Collect
- display: "IP Location Type"
  name: ipCategories
  required: false
  type: 16
  options:
  - Anonymous VPN
  - Hosting Provider
  - Public Proxy
  - TOR Exit Node
  - BOT
  - Unknown
  section: Collect
- display: Traceable Platform Endpoint URL
  defaultvalue: https://app.traceable.ai
  name: app_url
  required: false
  type: 0
  section: Connect
- display: Incident type
  name: incidentType
  defaultvalue: Exploit
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Ignore Status Codes (eg. 301, 400-499)
  name: ignoreStatusCodes
  defaultvalue: 400-499
  type: 0
  required: false
  additionalinfo: Provide comma-separated HTTP Status ranges or individual status codes to ignore. Eg. 301, 400-499.
  section: Collect
- display: Incident optional field list
  name: optionalDomainEventFieldList
  defaultvalue: actorDevice,actorEntityId,actorId,actorScoreCategory,actorSession,apiName,apiUri,category,ipAbuseVelocity,ipReputationLevel,securityEventType,securityScore,serviceId,actorScore,threatCategory,type
  options:
  - actorDevice
  - actorEntityId
  - actorId
  - actorScoreCategory
  - actorSession
  - apiName
  - apiUri
  - category
  - ipAbuseVelocity
  - ipReputationLevel
  - securityEventType
  - securityScore
  - serviceId
  - actorScore
  - threatCategory
  - type
  type: 16
  required: false
  section: Collect
- display: Additional API Attributes
  name: optionalAPIAttributes
  defaultvalue: isExternal,isAuthenticated,riskScore,riskScoreCategory,isLearnt
  options:
  - isExternal
  - isAuthenticated
  - riskScore
  - riskScoreCategory
  - isLearnt
  type: 16
  required: false
  section: Collect
- display: Fetch unique incidents
  additionalinfo: Ignores repeat occurrences of a given incidence for a specified time.
  defaultvalue: "true"
  name: isFetchUniqueIncidents
  type: 8
  required: false
  section: Collect
- name: timegap_between_repeat_incidents
  display: Time between raising similar incidents (in <number> <time unit>, e.g., in 12 hours, in 7 days)
  additionalinfo: Specifies a timeframe in the future until which a repeat incidence will be ignored.
  required: false
  type: 0
  defaultvalue: 'in 7 days'
  section: Collect
description: "Traceable Platform Integration enables publishing Traceable Detected Security Events to be published to Cortex Xsoar for further action."
display: "Traceable"
name: Traceable
script:
  isfetch: true
  isFetchSamples: true
  runonce: false
  script: "-"
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: list_incident_cache
    description: List the entries present in the Traceable instance cache.
    arguments: []
    outputs:
    - contextPath: Traceable.Instancecache.id
      description: Cache entry ID.
      type: string
    - contextPath: Traceable.Instancecache.expiry
      description: Cache entry expiration date.
      type: date
  - name: purge_incident_cache
    description: Delete all entries in the incident cache.
    arguments: []
    outputs:
    - contextPath: Traceable.Instancecache.id
      description: Cache entry ID.
      type: string
    - contextPath: Traceable.Instancecache.expiry
      description: Cache entry expiration date.
      type: date
    - contextPath: Traceable.Instancecache.deletion_status
      description: Cache entry deletion status.
      type: string
fromversion: 5.5.0
tests:
- No tests (auto formatted)