Tufin

Details

ID	`Tufin`
Provider	Turn River Capital
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/netutils:1.0.0.10187688`
Supported Modules	Agentix XSIAM

README

Overview

Retrieve and analyze network access controls across Tufin-managed firewalls, SDN, and public cloud to identify vulnerable access paths of an attack
This integration was integrated and tested with version 19.3 of Tufin Orchestration Suite

Tufin Playbook

Use Cases

Gather network intelligence from SecureTrack and SecureApp, perform topology queries in SecureTrack, and submit change tickets from SecureChange.

Configure Tufin on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Tufin.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- TOS IP or FQDN
- TOS User Credentials
- Trust any certificate (not secure)
- Use system proxy settings
- Maximum number of rules returned from device durring a policy search
Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

tufin-search-topology
tufin-search-topology-image
tufin-object-resolve
tufin-policy-search
tufin-get-zone-for-ip
tufin-submit-change-request
tufin-search-devices
tufin-get-change-info
tufin-search-applications
tufin-search-application-connections

1. tufin-search-topology

Search the Tufin Topology Map

Base Command

tufin-search-topology

Input

Argument Name	Description	Required
source	Source address/addresses (may contain multiple, comma separated values) e.g. 192.168.100.32 or 192.168.100.32/32,192.168.100.33	Required
destination	Destination address/addresses (may contain multiple, comma separated values) e.g. 192.168.100.32 or 192.168.100.32/32,192.168.100.33	Required
service	Service parameter can be a port (for example, “tcp:80”, “any”) or an application (for example, “Skype”, “Facebook”).	Optional

Context Output

Path	Type	Description
Tufin.Topology.TrafficAllowed	boolean	Traffic Permitted
Tufin.Topology.TrafficDevices	string	List of devices in path

Command Example

!tufin-search-topology destination=10.2.2.0/24 source=192.168.60.0/24

Human Readable Output

2. tufin-search-topology-image

Search the Tufin Topology Map, returning an image

Base Command

tufin-search-topology-image

Input

Argument Name	Description	Required
source	Source address/addresses (may contain multiple, comma separated values)	Required
destination	Destination address/addresses (may contain multiple, comma separated values)	Required
service	Service parameter can be a port (for example, “tcp:80”, “any”) or an application (for example, “Skype”, “Facebook”).	Optional

Context Output

There is no context output for this command.

Command Example

!tufin-search-topology-image destination=10.2.2.0/24 source=192.168.60.0/24

Human Readable Output

3. tufin-object-resolve

Resolve IP address to Network Object

Base Command

tufin-object-resolve

Input

Argument Name	Description	Required
ip	IP Address to Resolve to Network Object	Required

Context Output

Path	Type	Description
Tufin.ObjectResolve.NumberOfObjects	number	Number of objects that resolve to given IP address.

Command Example

!tufin-object-resolve ip=10.3.3.3

Human Readable Output

4. tufin-policy-search

Search the policies of all devices managed by Tufin

Base Command

tufin-policy-search

Input

Argument Name	Description	Required
search	The text format is for a field is fieldname:text for example source:192.168.1.1 or bareword for free text search. See the search info documentation in Securetrack Policy Browser page for more information.	Required

Context Output

Path	Type	Description
Tufin.Policysearch.NumberRulesFound	number	Number of rules found via search

Command Example

!tufin-policy-search search="source:192.168.1.1"

Human Readable Output

5. tufin-get-zone-for-ip

Match the IP address to the assigned Tufin Zone

Base Command

tufin-get-zone-for-ip

Input

Argument Name	Description	Required
ip	IP Address	Required

Context Output

Path	Type	Description
Tufin.Zone.ID	string	Tufin Zone ID
Tufin.Zone.Name	unknown	Tufin Zone Name

Command Example

!tufin-get-zone-for-ip ip=10.10.12.1

Human Readable Output

6. tufin-submit-change-request

Submit a change request to SecureChange

Base Command

tufin-submit-change-request

Input

Argument Name	Description	Required
request-type	Request Type	Required
priority	Request Priority	Required
source	Source or Target	Required
destination	Destination (Mandatory for FW Change)	Optional
protocol	Protocol (Mandatory for FW Change)	Optional
port	Port (Mandatory for FW Change)	Optional
action	Action (Mandatory for FW Change)	Optional
comment	Comment	Optional
subject	Ticket Subject	Required

Context Output

Path	Type	Description
Tufin.Request.Status	unknown	Status of the request submission

Command Example

!tufin-submit-change-request request-type="Decommission Request" priority=High source=192.168.1.1 subject="This host is infected with ransomware"

Human Readable Output

7. tufin-search-devices

Search SecureTrack devices

Base Command

tufin-search-devices

Input

Argument Name	Description	Required
name	Device name	Optional
ip	Device IP	Optional
vendor	Device vendor	Optional
model	Device model	Optional

Context Output

Path	Type	Description
Tufin.Device.ID	unknown	Device ID
Tufin.Device.Name	unknown	Device name
Tufin.Device.Vendor	unknown	Device vendor
Tufin.Device.Model	unknown	Device model
Tufin.Device.IP	unknown	Device IP

Command Example

!tufin-search-devices vendor=Cisco

Human Readable Output

8. tufin-get-change-info

Get information on a SecureChange Ticket (Ticket ID retrieved from Tufin UI)

Base Command

tufin-get-change-info

Input

Argument Name	Description	Required
ticket-id	SecureChange Ticket ID	Required

Context Output

Path	Type	Description
Tufin.Ticket.ID	unknown	Ticket ID
Tufin.Ticket.Subject	unknown	Ticket subject
Tufin.Ticket.Priority	unknown	Ticket priority
Tufin.Ticket.Status	unknown	Ticket status
Tufin.Ticket.Requester	unknown	Ticket requester
Tufin.Ticket.WorkflowID	unknown	Ticket workflow ID
Tufin.Ticket.WorkflowName	unknown	Ticket workflow name
Tufin.Ticket.CurrentStep	unknown	Ticket current step

Command Example

!tufin-get-change-info ticket-id=250

Human Readable Output

9. tufin-search-applications

Search SecureApp applications

Base Command

tufin-search-applications

Input

Argument Name	Description	Required
name	Application name	Optional

Context Output

Path	Type	Description
Tufin.App.ID	unknown	Application ID
Tufin.App.Name	unknown	Application name
Tufin.App.Status	unknown	Application status
Tufin.App.Decommissioned	unknown	Is the application decommissioned
Tufin.App.OwnerID	unknown	Application owner ID
Tufin.App.OwnerName	unknown	Application owner name
Tufin.App.Comments	unknown	Application comments

Command Example

!tufin-search-applications name="3Rivers"

Human Readable Output

10. tufin-search-application-connections

Get SecureApp application connections

Base Command

tufin-search-application-connections

Input

Argument Name	Description	Required
application-id	Application ID	Required

Context Output

Path	Type	Description
Tufin.AppConnections.ID	unknown	Connection ID
Tufin.AppConnections.Name	unknown	Connection name
Tufin.AppConnections.Status	unknown	Connection status
Tufin.AppConnections.Source.ID	unknown	Connection source ID
Tufin.AppConnections.Source.Type	unknown	Connection source type
Tufin.AppConnections.Source.Name	unknown	Connection source name
Tufin.AppConnections.Destination.ID	unknown	Connection destination ID
Tufin.AppConnections.Destination.Type	unknown	Connection destination type
Tufin.AppConnections.Destination.Name	unknown	Connection destination name
Tufin.AppConnections.Service.ID	unknown	Connection service ID
Tufin.AppConnections.Service.Name	unknown	Connection service name
Tufin.AppConnections.Comment	unknown	Connection comment
Tufin.AppConnections.ApplicationID	unknown	Application ID

Command Example

!tufin-search-application-connections app_id=215

Human Readable Output

Troubleshooting

Contact Tufin support via the Tufin User Portal, or by going to https://www.tufin.com/support

Configuration parameters

SecureTrack-Server — SecureTrack IP or FQDN (required)
SecureTrack-User — SecureTrack User Credentials (required)
SecureChange-Server — SecureChange IP or FQDN
SecureChange-User — SecureChange User Credentials
SecureApp-Server — SecureApp IP or FQDN
SecureApp-User — SecureApp User Credentials
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings
MaxRules — Maximum number of rules returned from device durring a policy search

Commands (10)

tufin-get-change-info
Get information on a SecureChange Ticket (ID retrieved from SecureChange UI).
tufin-get-zone-for-ip
Match the IP address to the assigned Tufin Zone.
tufin-object-resolve
Resolve IP address to Network Object.
tufin-policy-search
Search the policies of all devices managed by Tufin.
tufin-search-application-connections
Get SecureApp application connections.
tufin-search-applications
Search SecureApp applications.
tufin-search-devices
Search SecureTrack devices.
tufin-search-topology
Search the Tufin Topology Map.
tufin-search-topology-image
Search the Tufin Topology Map, returning an image.
tufin-submit-change-request
Submit a change request to SecureChange.

Source

Tufin.py Tufin.yml Tufin_description.md

Download History Raw

commonfields:
  id: Tufin
  version: -1
name: Tufin
display: Tufin
category: Network Security
sectionorder:
  - Connect
  - Collect
provider: Turn River Capital
description: Retrieve and analyze network access controls across Tufin-managed firewalls, SDN, and public cloud to identify vulnerable access paths of an attack.
configuration:
- display: SecureTrack IP or FQDN
  name: SecureTrack-Server
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: SecureTrack User Credentials
  name: SecureTrack-User
  defaultvalue: ""
  type: 9
  required: true
  section: Connect
- display: SecureChange IP or FQDN
  name: SecureChange-Server
  defaultvalue: ""
  type: 0
  required: false
  section: Connect
- display: SecureChange User Credentials
  name: SecureChange-User
  defaultvalue: ""
  type: 9
  required: false
  section: Connect
- display: SecureApp IP or FQDN
  name: SecureApp-Server
  defaultvalue: ""
  type: 0
  required: false
  section: Connect
- display: SecureApp User Credentials
  name: SecureApp-User
  defaultvalue: ""
  type: 9
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Maximum number of rules returned from device durring a policy search
  name: MaxRules
  defaultvalue: "100"
  type: 0
  required: false
  section: Connect
script:
  script: ''
  type: python
  commands:
  - name: tufin-search-topology
    arguments:
    - name: source
      required: true
      description: Source address/addresses (may contain multiple, comma separated values) e.g. 192.168.100.32 or 192.168.100.32/32,192.168.100.33.
    - name: destination
      required: true
      description: Destination address/addresses (may contain multiple, comma separated values) e.g. 192.168.100.32 or 192.168.100.32/32,192.168.100.33.
    - name: service
      description: Service parameter can be a port (for example, “tcp:80”, “any”) or an application (for example, “Skype”, “Facebook”).
    outputs:
    - contextPath: Tufin.Topology.TrafficAllowed
      description: Traffic Permitted.
      type: boolean
    - contextPath: Tufin.Topology.TrafficDevices
      description: List of devices in path.
      type: string
    description: Search the Tufin Topology Map.
  - name: tufin-search-topology-image
    arguments:
    - name: source
      required: true
      description: Source address/addresses (may contain multiple, comma separated values).
    - name: destination
      required: true
      description: Destination address/addresses (may contain multiple, comma separated values).
    - name: service
      description: Service parameter can be a port (for example, “tcp:80”, “any”) or an application (for example, “Skype”, “Facebook”).
    description: Search the Tufin Topology Map, returning an image.
  - name: tufin-object-resolve
    arguments:
    - name: ip
      required: true
      description: IP Address to Resolve to Network Object.
    outputs:
    - contextPath: Tufin.ObjectResolve.NumberOfObjects
      description: Number of objects that resolve to given IP address.
      type: number
    description: Resolve IP address to Network Object.
  - name: tufin-policy-search
    arguments:
    - name: search
      required: true
      description: The text format is for a field is <fieldname>:<text> for example source:192.168.1.1 or bareword for free text search. See the search info documentation in Securetrack Policy Browser page for more information.
    outputs:
    - contextPath: Tufin.Policysearch.NumberRulesFound
      description: Number of rules found via search.
      type: number
    description: Search the policies of all devices managed by Tufin.
  - name: tufin-get-zone-for-ip
    arguments:
    - name: ip
      required: true
      description: IP Address.
    outputs:
    - contextPath: Tufin.Zone.ID
      description: Tufin Zone ID.
      type: number
    - contextPath: Tufin.Zone.Name
      description: Tufin Zone Name.
      type: string
    description: Match the IP address to the assigned Tufin Zone.
  - name: tufin-submit-change-request
    arguments:
    - name: request-type
      required: true
      auto: PREDEFINED
      predefined:
      - Firewall Change Request
      - Server Decommission Request
      description: Request Type.
    - name: priority
      required: true
      auto: PREDEFINED
      predefined:
      - Critical
      - High
      - Normal
      - Low
      description: Request Priority.
    - name: source
      required: true
      description: Source or Target.
    - name: destination
      description: Destination (Mandatory for FW Change).
    - name: protocol
      auto: PREDEFINED
      predefined:
      - TCP
      - UDP
      description: Protocol (Mandatory for FW Change).
    - name: port
      description: Port (Mandatory for FW Change).
    - name: action
      auto: PREDEFINED
      predefined:
      - Accept
      - Drop
      - Remove
      description: Action (Mandatory for FW Change).
    - name: comment
      description: Comment.
    - name: subject
      required: true
      description: Ticket Subject.
    outputs:
    - contextPath: Tufin.Request.Status
      description: Status of the request submission.
      type: string
    description: Submit a change request to SecureChange.
  - name: tufin-search-devices
    arguments:
    - name: name
      description: Device name.
    - name: ip
      description: Device IP.
    - name: vendor
      description: Device vendor.
    - name: model
      description: Device model.
    outputs:
    - contextPath: Tufin.Device.ID
      description: Device ID.
      type: number
    - contextPath: Tufin.Device.Name
      description: Device name.
      type: string
    - contextPath: Tufin.Device.Vendor
      description: Device vendor.
      type: string
    - contextPath: Tufin.Device.Model
      description: Device model.
      type: string
    - contextPath: Tufin.Device.IP
      description: Device IP.
      type: string
    description: Search SecureTrack devices.
  - name: tufin-get-change-info
    arguments:
    - name: ticket-id
      description: SecureChange Ticket ID.
      required: true
    outputs:
    - contextPath: Tufin.Ticket.ID
      description: Ticket ID.
      type: number
    - contextPath: Tufin.Ticket.Subject
      description: Ticket subject.
      type: string
    - contextPath: Tufin.Ticket.Priority
      description: Ticket priority.
      type: string
    - contextPath: Tufin.Ticket.Status
      description: Ticket status.
      type: string
    - contextPath: Tufin.Ticket.Requester
      description: Ticket requester.
      type: string
    - contextPath: Tufin.Ticket.WorkflowID
      description: Ticket workflow ID.
      type: number
    - contextPath: Tufin.Ticket.WorkflowName
      description: Ticket workflow name.
      type: string
    - contextPath: Tufin.Ticket.CurrentStep
      description: Ticket current step.
      type: string
    description: Get information on a SecureChange Ticket (ID retrieved from SecureChange UI).
  - name: tufin-search-applications
    arguments:
    - name: name
      description: Application name.
    outputs:
    - contextPath: Tufin.App.ID
      description: Application ID.
      type: number
    - contextPath: Tufin.App.Name
      description: Application name.
      type: string
    - contextPath: Tufin.App.Status
      description: Application status.
      type: string
    - contextPath: Tufin.App.Decommissioned
      description: Is the application decommissioned.
      type: string
    - contextPath: Tufin.App.OwnerID
      description: Application owner ID.
      type: string
    - contextPath: Tufin.App.OwnerName
      description: Application owner name.
      type: string
    - contextPath: Tufin.App.Comments
      description: Application comments.
      type: string
    description: Search SecureApp applications.
  - name: tufin-search-application-connections
    arguments:
    - name: application-id
      required: true
      description: Application ID.
    outputs:
    - contextPath: Tufin.AppConnection.ID
      description: Connection ID.
      type: number
    - contextPath: Tufin.AppConnection.Name
      description: Connection name.
      type: string
    - contextPath: Tufin.AppConnection.AppID
      description: Application ID.
      type: number
    - contextPath: Tufin.AppConnection.Status
      description: Connection status.
      type: string
    - contextPath: Tufin.AppConnection.Source
      description: Connection source list.
      type: string
    - contextPath: Tufin.AppConnection.Destination
      description: Connection destination list.
      type: string
    - contextPath: Tufin.AppConnection.Service
      description: Connection service list.
      type: string
    - contextPath: Tufin.AppConnection.Comment
      description: Connection comment.
      type: string
    description: Get SecureApp application connections.
  dockerimage: demisto/netutils:1.0.0.10187688
  subtype: python3
fromversion: 5.0.0
tests:
- no tests