Unisys Stealth

Details

ID	`Unisys Stealth`
Provider	Unisys Corporation
Category	Endpoint
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

This integration is intended to aid companies in integrating with the Stealth EcoAPI service. Using the included commands, security teams can trigger dynamically isolation of users or endpoints from the rest of the Stealth network.

Configure Unisys Stealth in Cortex

Parameter	Required
Stealth Eco API IP Address or Hostname	True
Stealth Eco API Port	True
Credentials	True
Isolation Role ID	False
Trust any certificate (unsecure)	False
Use Proxy?	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

stealth-isolate-machine

This is the command which will isolate an endpoint from the Stealth Network

Base Command

stealth-isolate-machine

Input

Argument Name	Description	Required
endpoint	FQDN of machine to isolate.	Required

Context Output

There is no context output for this command.

stealth-unisolate-machine

This is the command which will un-isolate an endpoint from Stealth Network

Base Command

stealth-unisolate-machine

Input

Argument Name	Description	Required
endpoint	FQDN of machine to isolate.	Required

Context Output

There is no context output for this command.

stealth-get-stealth-roles

Retrieve roles from Stealth Network

Base Command

stealth-get-stealth-roles

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

stealth-isolate-user

This is the command which will isolate an user from the Stealth Network

Base Command

stealth-isolate-user

Input

Argument Name	Description	Required
user	Hostname of machine to isolate.	Optional

Context Output

There is no context output for this command.

stealth-unisolate-user

This is the command which will un-isolate an user from Stealth Network

Base Command

stealth-unisolate-user

Input

Argument Name	Description	Required
user	Username to un-isolate.	Optional

Context Output

There is no context output for this command.

stealth-isolate-machine-and-user

This is the command which will isolate an endpoint and user from the Stealth Network

Base Command

stealth-isolate-machine-and-user

Input

Argument Name	Description	Required
endpoint	FQDN of machine to isolate.	Optional
user	Username to isolate.	Optional

Context Output

There is no context output for this command.

stealth-unisolate-machine-and-user

This is the command which will un-isolate an endpoint and user from Stealth Network

Base Command

stealth-unisolate-machine-and-user

Input

Argument Name	Description	Required
endpoint	FQDN of machine to isolate.	Optional
user	Username to un-isolate.	Optional

Context Output

There is no context output for this command.

Configuration parameters

server_ip — Stealth Eco API IP Address or Hostname (required)
port — Stealth Eco API Port (required)
credentials — Credentials (required)
isolation_id — Isolation Role ID
trust — Trust any certificate (unsecure)
proxy — Use system proxy settings

Commands (7)

stealth-get-stealth-roles
Retrieve roles from Stealth Network
stealth-isolate-machine
This is the command which will isolate an endpoint from the Stealth Network
stealth-isolate-machine-and-user
This is the command which will isolate an endpoint and user from the Stealth Network
stealth-isolate-user
This is the command which will isolate an user from the Stealth Network
stealth-unisolate-machine
This is the command which will un-isolate an endpoint from Stealth Network
stealth-unisolate-machine-and-user
This is the command which will un-isolate an endpoint and user from Stealth Network
stealth-unisolate-user
This is the command which will un-isolate an user from Stealth Network

Source

UnisysStealth.py UnisysStealth.yml UnisysStealth_description.md

Download History Raw

category: Endpoint
provider: Unisys Corporation
commonfields:
  id: Unisys Stealth
  version: -1
configuration:
- display: Stealth Eco API IP Address or Hostname
  name: server_ip
  required: true
  type: 0
- display: Stealth Eco API Port
  name: port
  required: true
  type: 0
- display: Credentials
  name: credentials
  required: true
  type: 9
- display: Isolation Role ID
  name: isolation_id
  type: 0
  required: false
- display: Trust any certificate (unsecure)
  name: trust
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: 'This integration is intended to aid companies in integrating with the Stealth EcoAPI service.  Using the included commands, security teams can trigger dynamically isolation of users or endpoints from the rest of the Stealth network.  '
display: Unisys Stealth
name: Unisys Stealth
script:
  commands:
  - arguments:
    - description: FQDN of machine to isolate.
      name: endpoint
      required: true
    description: This is the command which will isolate an endpoint from the Stealth Network
    name: stealth-isolate-machine
  - arguments:
    - description: FQDN of machine to isolate.
      name: endpoint
      required: true
    description: This is the command which will un-isolate an endpoint from Stealth Network
    name: stealth-unisolate-machine
  - arguments: []
    description: Retrieve roles from Stealth Network
    name: stealth-get-stealth-roles
  - arguments:
    - description: Hostname of machine to isolate.
      name: user
    description: This is the command which will isolate an user from the Stealth Network
    name: stealth-isolate-user
  - arguments:
    - description: Username to un-isolate.
      name: user
    description: This is the command which will un-isolate an user from Stealth Network
    name: stealth-unisolate-user
  - arguments:
    - description: FQDN of machine to isolate.
      name: endpoint
    - description: Username to isolate.
      name: user
    description: This is the command which will isolate an endpoint and user from the Stealth Network
    name: stealth-isolate-machine-and-user
  - arguments:
    - description: FQDN of machine to isolate.
      name: endpoint
    - description: Username to un-isolate.
      name: user
    description: This is the command which will un-isolate an endpoint and user from Stealth Network
    name: stealth-unisolate-machine-and-user
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)