Unisys Stealth

This integration is intended to aid companies in integrating with the Stealth EcoAPI service. Using the included commands, security teams can trigger dynamically isolation of users or endpoints from the rest of the Stealth network.

Endpoint · Unisys Stealth

Details

IDUnisys Stealth
ProviderUnisys Corporation
CategoryEndpoint
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

This integration is intended to aid companies in integrating with the Stealth EcoAPI service. Using the included commands, security teams can trigger dynamically isolation of users or endpoints from the rest of the Stealth network.

Configure Unisys Stealth in Cortex

Parameter Required
Stealth Eco API IP Address or Hostname True
Stealth Eco API Port True
Credentials True
Isolation Role ID False
Trust any certificate (unsecure) False
Use Proxy? False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

stealth-isolate-machine

This is the command which will isolate an endpoint from the Stealth Network

Base Command

stealth-isolate-machine

Input

Argument Name Description Required
endpoint FQDN of machine to isolate. Required

Context Output

There is no context output for this command.

stealth-unisolate-machine

This is the command which will un-isolate an endpoint from Stealth Network

Base Command

stealth-unisolate-machine

Input

Argument Name Description Required
endpoint FQDN of machine to isolate. Required

Context Output

There is no context output for this command.

stealth-get-stealth-roles

Retrieve roles from Stealth Network

Base Command

stealth-get-stealth-roles

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

stealth-isolate-user

This is the command which will isolate an user from the Stealth Network

Base Command

stealth-isolate-user

Input

Argument Name Description Required
user Hostname of machine to isolate. Optional

Context Output

There is no context output for this command.

stealth-unisolate-user

This is the command which will un-isolate an user from Stealth Network

Base Command

stealth-unisolate-user

Input

Argument Name Description Required
user Username to un-isolate. Optional

Context Output

There is no context output for this command.

stealth-isolate-machine-and-user

This is the command which will isolate an endpoint and user from the Stealth Network

Base Command

stealth-isolate-machine-and-user

Input

Argument Name Description Required
endpoint FQDN of machine to isolate. Optional
user Username to isolate. Optional

Context Output

There is no context output for this command.

stealth-unisolate-machine-and-user

This is the command which will un-isolate an endpoint and user from Stealth Network

Base Command

stealth-unisolate-machine-and-user

Input

Argument Name Description Required
endpoint FQDN of machine to isolate. Optional
user Username to un-isolate. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • server_ip — Stealth Eco API IP Address or Hostname (required)
  • port — Stealth Eco API Port (required)
  • credentials — Credentials (required)
  • isolation_id — Isolation Role ID
  • trust — Trust any certificate (unsecure)
  • proxy — Use system proxy settings

Commands (7)

  • stealth-get-stealth-roles

    Retrieve roles from Stealth Network

  • stealth-isolate-machine

    This is the command which will isolate an endpoint from the Stealth Network

  • stealth-isolate-machine-and-user

    This is the command which will isolate an endpoint and user from the Stealth Network

  • stealth-isolate-user

    This is the command which will isolate an user from the Stealth Network

  • stealth-unisolate-machine

    This is the command which will un-isolate an endpoint from Stealth Network

  • stealth-unisolate-machine-and-user

    This is the command which will un-isolate an endpoint and user from Stealth Network

  • stealth-unisolate-user

    This is the command which will un-isolate an user from Stealth Network

Source

UnisysStealth.py UnisysStealth.yml UnisysStealth_description.md
Download History Raw 
This ingratiation requires a Stealth account with the Portal Administrator role. Also, you must ensure that a Global isolation role has been created. Please see EcoAPI documentation for you specific Stealth version. 

## Setting Up XOAR Engine: 
1. Ensure that you have at least one XSOAR engine installed on your corporate network. 
2. Install Stealth Client on XSOAR Engine. 
3. If #2 does not work, you may need to create an exception of the engine within Stealth EM console. 

Recommended to have at least one XSOAR engine that is installed on your corporate network. Under `Run on` select the XSOAR engine you wish to use for the integration. 

## Setting up the Stealth XSOAR Integration: 
1. Enter your EM IP Address or hostname (without port number or http:// or HTTPS://) `Example: 172.168.1.1`
2. Enter the Stealth EcoAPI Port (default 8448)
3. Enter your Stealth username (must have Portal Administrator role) and password. 
4. Run the `!stealth-get-stealth-roles` command within the playground and copy the `ID` of the Global Isolation role. 
5. Enter the ID copied in step #4 into the Isolation Role ID parameter.