Traceable

Traceable Platform Integration enables publishing Traceable Detected Security Events to be published to Cortex Xsoar for further action.

Analytics & SIEM · Traceable

Details

IDTraceable
ProviderHarness
CategoryAnalytics & SIEM
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Traceable AI API Security Platform Integration

Overview

Traceable platform monitors application APIs and detects Threat Events. These Threat Events consist of the details about the Threat Activity, the Actor performing the threat activity and the request/response payloads.

With this integration, an Incident can be raised in Cortex Xsoar when an event is detected by Traceable platform. This enables the security teams to orchestrate actions through Cortex Xsoar with meaningful information about the detected Threat Activities.

Setup

To use the integration the following mandatory parameters need to be set:

Parameter Name Default Value Description
Traceable Platform API Endpoint URL https://api.traceable.ai Base URL of the Traceable platform API endpoint.
API Token - API token used for authenticating against the Traceable platform.
Trust any certificate (not secure) false Trust any SSL certificate while connecting to the Traceable platform API endpoint.
Use system proxy settings false Use the system proxy using the environment variables http_proxy/https_proxy.

The API token can be generated as described in the Traceable Documentation

Customize Event/Activity Collection

The following parameters can be used to select the events that should be imported from the Traceable platform into Cortex Xsoar as security incidents.

Parameter name Type Required (Yes/No) Default Value Description
First fetch timestamp Short text No 1 days Duration in the past to query the events, when querying for the first time.
Max number of records to fetch per API call to Traceable API Endpoint Short text No 100 Number of records to return from Traceable platform per query.
Number of span queries to run in parallel Short text No 5 Number of threads to use for querying spans in parallel.
Max spans per thread Short text No 50 Number of spans to query per span thread. Value can be an integer between 1 to 1000.
Comma Separated Environment List To Process Long text No - Comma separated list of environments to query.
Security Score Category Multi select No CRITICAL,
HIGH,
MEDIUM		 Security Score Category of the events to be queried.
Threat Category Multi select No Malicious Activities,
API Abuse,
Malicious Sources		 Threat Category of the events to be queried.
IP Reputation Level Multi select No CRITICAL,
HIGH,
MEDIUM		 IP Reputation Level of the events to be queried.
IP Abuse Velocity Multi select No CRITICAL,
HIGH,
MEDIUM		 IP Abuse Velocity of the events to queried.
IP Location Type Multi select No - IP Location type of the events to be queried.
Traceable Platform Endpoint URL Long text No https://app.traceable.ai Base URL of the Traceable platform UI endpoint.
Ignore Status Codes Long text No 400-499 Ignore incidents for which the HTTP status codes fall in the range of the given comma-separated list of HTTP status codes and/or status code ranges. eg. 301, 400-499.
Incident optional field list Multi select No actorDevice,
actorEntityId,
actorId,
actorScoreCategory,
actorSession,
apiName,
apiUri,
category,
ipAbuseVelocity,
ipReputationLevel,
securityEventType,
securityScore,
serviceId,
actorScore,
threatCategory,
type		 Optional fields to pull from the Traceable event.
Additional API Attributes Multi select No isExternal,
isAuthenticated,
riskScore,
riskScoreCategory,
isLearnt		 Additional API attributes to query for the affected API in the incident.
Fetch unique incidents Boolean No true Select if the integration should only fetch unique occurrences of a given incident from Traceable Platform.

Incident Types

The integration generates Exploit type of incidents.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

list_incident_cache

List the entries present in the Traceable instance cache.

Base Command

list_incident_cache

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Traceable.Instancecache.id string Cache entry ID.
Traceable.Instancecache.expiry date Cache entry expiration date.

purge_incident_cache

Delete all entries in the incident cache.

Base Command

purge_incident_cache

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Traceable.Instancecache.id string Cache entry ID.
Traceable.Instancecache.expiry date Cache entry expiration date.
Traceable.Instancecache.deletion_status string Cache entry deletion status.

Official Traceable Documentation

https://docs.traceable.ai/

Issues?

Reach out to support@traceable.ai

Configuration parameters

  • url — Traceable Platform API Endpoint URL (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Max number of records to fetch per API call to Traceable API Endpoint
  • span_fetch_threadpool — Number of span queries to run in parallel
  • span_query_batch_size — Max spans per thread (1 to 1000)
  • environment — Comma Separated Environment List To Process
  • securityScoreCategory — Security Score Category
  • threatCategory — Threat Category
  • ipReputationLevel — IP Reputation Level
  • ipAbuseVelocity — IP Abuse Velocity
  • ipCategories — IP Location Type
  • app_url — Traceable Platform Endpoint URL
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • ignoreStatusCodes — Ignore Status Codes (eg. 301, 400-499)
  • optionalDomainEventFieldList — Incident optional field list
  • optionalAPIAttributes — Additional API Attributes
  • isFetchUniqueIncidents — Fetch unique incidents
  • timegap_between_repeat_incidents — Time between raising similar incidents (in <number> <time unit>, e.g., in 12 hours, in 7 days)

Commands (2)

  • list_incident_cache

    List the entries present in the Traceable instance cache.

  • purge_incident_cache

    Delete all entries in the incident cache.

Source

Traceable.py Traceable_test.py Traceable.yml Traceable_description.md command_examples.txt
Download History Raw 
# Traceable AI API Security Platform Integration

## Overview

Traceable platform monitors application APIs and detects _Threat Events_. These _Threat Events_ consist of the details about the _Threat Activity_, the _Actor_ performing the threat activity and the request/response payloads.

With this integration, an _Incident_ can be raised in Cortex Xsoar when an event is detected by Traceable platform. This enables the security teams to orchestrate actions through Cortex Xsoar with meaningful information about the detected _Threat Activities_.

## Setup

To use the integration the following mandatory parameters need to be set:

|Parameter Name|Default Value|Description|
|------|------|------|
|Traceable Platform API Endpoint URL|<https://api.traceable.ai>| Base URL of the Traceable platform API endpoint. |
|API Token|-| API token used for authenticating against the Traceable platform. |
|Trust any certificate (not secure)|false| Trust any SSL certificate while connecting to the Traceable platform API endpoint. |
|Use system proxy settings|false| Use the system proxy using the environment variables `http_proxy`/`https_proxy`. |

The API token can be generated as described in the [Traceable Documentation](https://docs.traceable.ai/docs/public-apis#step-1-%E2%80%93-copy-the-platform-api-token)

## Customize Event/Activity Collection

The following parameters can be used to select the events that should be imported from the Traceable platform into Cortex Xsoar as security incidents.

|Parameter name|Type|Required (Yes/No)|Default Value|Description|
|------|------|------|------|------|
|First fetch timestamp|Short text|No|1 days| Duration in the past to query the events, when querying for the first time. |
|Max number of records to fetch per API call to Traceable API Endpoint|Short text|No|100| Number of records to return from Traceable platform per query. |
|Number of span queries to run in parallel|Short text|No|5| Number of threads to use for querying `spans` in parallel. |
|Max spans per thread|Short text|No|50| Number of `spans` to query per span thread. Value can be an integer between 1 to 1000. |
|Comma Separated Environment List To Process|Long text|No|-| Comma separated list of environments to query. |
|Security Score Category|Multi select|No|CRITICAL,<br/>HIGH,<br/>MEDIUM| `Security Score Category` of the events to be queried. |
|Threat Category|Multi select|No|Malicious Activities,<br/>API Abuse,<br/>Malicious Sources| `Threat Category` of the events to be queried. |
|IP Reputation Level|Multi select|No|CRITICAL,<br/>HIGH,<br/>MEDIUM| `IP Reputation Level` of the events to be queried. |
|IP Abuse Velocity|Multi select|No|CRITICAL,<br/>HIGH,<br/>MEDIUM| `IP Abuse Velocity` of the events to queried. |
|IP Location Type|Multi select|No|-| `IP Location` type of the events to be queried. |
|Traceable Platform Endpoint URL|Long text|No|<https://app.traceable.ai>| Base URL of the Traceable platform UI endpoint. |
|Ignore Status Codes|Long text|No|400-499| Ignore incidents for which the HTTP status codes fall in the range of the given comma-separated list of HTTP status codes and/or status code ranges. eg. `301, 400-499`. |
|Incident optional field list|Multi select|No|actorDevice,<br/>actorEntityId,<br/>actorId,<br/>actorScoreCategory,<br/>actorSession,<br/>apiName,<br/>apiUri,<br/>category,<br/>ipAbuseVelocity,<br/>ipReputationLevel,<br/>securityEventType,<br/>securityScore,<br/>serviceId,<br/>actorScore,<br/>threatCategory,<br/>type| Optional fields to pull from the Traceable event. |
|Additional API Attributes|Multi select|No|isExternal,<br/>isAuthenticated,<br/>riskScore,<br/>riskScoreCategory,<br/>isLearnt| Additional API attributes to query for the affected API in the incident. |
|Fetch unique incidents|Boolean|No|true| Select if the integration should only fetch unique occurrences of a given incident from Traceable Platform. |

## Incident Types

The integration generates _Exploit_ type of incidents.

## Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

### list_incident_cache

***
List the entries present in the Traceable instance cache.

#### Base Command

`list_incident_cache`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Traceable.Instancecache.id | string | Cache entry ID. | 
| Traceable.Instancecache.expiry | date | Cache entry expiration date. | 

### purge_incident_cache

***
Delete all entries in the incident cache.

#### Base Command

`purge_incident_cache`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Traceable.Instancecache.id | string | Cache entry ID. | 
| Traceable.Instancecache.expiry | date | Cache entry expiration date. | 
| Traceable.Instancecache.deletion_status | string | Cache entry deletion status. | 

## Official Traceable Documentation

<https://docs.traceable.ai/>

## Issues?

Reach out to support@traceable.ai