VaronisDataSecurityPlatform

category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: Varonis
commonfields:
  id: VaronisDataSecurityPlatform
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  defaultvalue: Varonis DSP Incident
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: The FQDN/IP the integration should connect to
  name: url
  required: true
  type: 0
  section: Connect
- display: Name of Varonis user
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- defaultvalue: '50'
  display: Maximum number of incidents per fetch
  additionalinfo: Maximum value is 50
  name: max_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: 1 week
  display: First fetch time
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: Low
  display: Minimum severity of alerts to fetch
  name: severity
  options:
  - Low
  - Medium
  - High
  type: 15
  required: false
  section: Collect
- display: Varonis threat model name
  additionalinfo: Comma-separated list of threat model names of alerts to fetch
  name: threat_model
  type: 0
  required: false
  section: Collect
- defaultvalue: Open
  display: Varonis alert status
  name: status
  options:
  - Open
  - Under Investigation
  - Closed
  type: 15
  required: false
  section: Collect
description: Streamline alerts and related forensic information from Varonis DSP.
display: Varonis Data Security Platform
name: VaronisDataSecurityPlatform
script:
  commands:
  - arguments:
    - description: List of requested threat models to retrieve.
      isArray: true
      name: threat_model_name
    - defaultValue: '50'
      description: The max number of alerts to retrieve (up to 50).
      name: max_results
    - description: Start time of alert range.
      name: start_time
    - description: End time of alert range.
      name: end_time
    - description: List of required alerts status.
      isArray: true
      name: alert_status
    - description: List of required alerts severity.
      isArray: true
      name: alert_severity
    - description: List of required alerts device name.
      isArray: true
      name: device_name
    - description: User domain name (cannot be provided without user_name).
      name: user_domain_name
    - description: List of users (up to 5).
      isArray: true
      name: user_name
    - description: List of sam account names (up to 5).
      isArray: true
      name: sam_account_name
    - description: List of emails (up to 5).
      isArray: true
      name: email
    - description: Number of days you want the search to go back to.
      name: last_days
    - description: Indicates whether alerts should be ordered in newest to oldest order.
      name: descending_order
    - default: true
      defaultValue: '1'
      description: Page number.
      name: page
    description: Get alerts from Varonis DA.
    name: varonis-get-alerts
    outputs:
    - contextPath: Varonis.Alert.ID
      description: Varonis ID for alert.
      type: Number
    - contextPath: Varonis.Alert.Name
      description: Name of retrieved alert.
      type: String
    - contextPath: Varonis.Alert.Time
      description: When was the alert triggered.
      type: Date
    - contextPath: Varonis.Alert.Severity
      description: Alert severity.
      type: String
    - contextPath: Varonis.Alert.Category
      description: "Alert category.\nOptions are:\n- Reconnaissance \n- Intrusion \n- Exploitation \n- Privilege Escalation \n- Lateral Movement."
      type: String
    - contextPath: Varonis.Alert.Country
      description: Name of the country from which the event occurred.
      type: String
    - contextPath: Varonis.Alert.State
      description: Name of the state or regional subdivision from which the event occurred.
      type: String
    - contextPath: Varonis.Alert.Status
      description: |-
        Alert state. Options are:
        - Open
        - Under investigation
        - Closed.
      type: String
    - contextPath: Varonis.Alert.CloseReason
      description: |-
        Reason the alert was closed. Options are:
        - Resolved
        - Misconfiguration
        - Threat model disabled or deleted
        - Account misclassification
        - Legitimate activity
        - Other.
      type: String
    - contextPath: Varonis.Alert.BlacklistLocation
      description: Whether any of the geographical locations from which an alerted activity originated was on the blacklist at the time the activity occurred.
      type: Boolean
    - contextPath: Varonis.Alert.AbnormalLocation
      description: Whether any of the geographical locations from which an alerted activity originated is new or abnormal to the organization, the user and peers, or only the user.
      type: Boolean
    - contextPath: Varonis.Alert.NumOfAlertedEvents
      description: Number of events with alerts.
      type: Number
    - contextPath: Varonis.Alert.UserName
      description: Name of the users triggered alerts.
      type: String
    - contextPath: Varonis.Alert.By.SamAccountName
      description: |-
        Logon name used to support clients and servers running earlier versions of Windows operating system, such as Windows NT 4.0.
        In the dashboards (other than the Alert dashboard), this is the SAM account name of the user or group.
      type: String
    - contextPath: Varonis.Alert.By.PrivilegedAccountType
      description: |-
        Privileged account. Options are:
        - Service accounts
        - Admin accounts
        - Executive accounts.
      type: String
    - contextPath: Varonis.Alert.By.Department
      description: User`s department.
      type: String
    - contextPath: Varonis.Alert.On.ContainsFlaggedData
      description: Whether the data affected by the alerted events has global flags.
      type: Boolean
    - contextPath: Varonis.Alert.On.ContainsSensitiveData
      description: Filters according to whether the resource on which the event was performed is sensitive (including subfolders).
      type: Boolean
    - contextPath: Varonis.Alert.On.Platform
      description: Type of platform on which the server resides. For example, Windows, Exchange, or SharePoint.
      type: String
    - contextPath: Varonis.Alert.On.Asset
      description: Path of the alerted asset.
      type: String
    - contextPath: Varonis.Alert.On.FileServerOrDomain
      description: Associated file server/domain.
      type: String
    - contextPath: Varonis.Alert.Device.Name
      description: Name of the device from which the user generated the event.
      type: String
    - contextPath: Varonis.Alert.Device.ContainMaliciousExternalIP
      description: Whether the alert contains IPs known to be malicious.
      type: Boolean
    - contextPath: Varonis.Alert.Device.IPThreatTypes
      description: Whether the alert contains IPs known to be malicious.
      type: String
    - contextPath: Varonis.Pagination.Page
      description: Current page number requested by user.
      type: Number
    - contextPath: Varonis.Pagination.PageSize
      description: Number of records on the page.
      type: Number
  - arguments:
    - description: Requested alerts.
      isArray: true
      name: alert_id
      required: true
    - auto: PREDEFINED
      predefined:
      - Open
      - Under Investigation
      description: Alert new status.
      name: status
      required: true
    description: Update alert status.
    name: varonis-update-alert-status
  - arguments:
    - description: Requested alerts.
      isArray: true
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: The reason the alert was closed.
      predefined:
      - Resolved
      - Misconfiguration
      - Threat model disabled or deleted
      - Account misclassification
      - Legitimate activity
      - Other
      name: close_reason
      required: true
    description: Close the alert.
    name: varonis-close-alert
  - arguments:
    - description: List of alert IDs.
      isArray: true
      name: alert_id
      required: true
    - description: Maximum number of alerts to retrieve (up to 5k).
      name: max_results
    - default: true
      defaultValue: '1'
      description: Page number.
      name: page
    - description: Indicates whether events should be ordered in newest to oldest order.
      name: descending_order
    description: Get events applied to specific alerts.
    name: varonis-get-alerted-events
    outputs:
    - contextPath: Varonis.Event.Type
      description: Event type.
      type: String
    - contextPath: Varonis.Event.UTCTime
      description: Event time UTC format.
      type: Date
    - contextPath: Varonis.Event.Status
      description: |-
        Filters according to the status of the event. Options are:
        - Fail
        - Success.
      type: String
    - contextPath: Varonis.Event.Description
      description: Description of the activity.
      type: String
    - contextPath: Varonis.Event.Country
      description: Name of the country from which the event occurred.
      type: String
    - contextPath: Varonis.Event.State
      description: Name of the state or regional subdivision from which the event occurred.
      type: String
    - contextPath: Varonis.Event.ExternalIP
      description: Device external IP.
      type: String
    - contextPath: Varonis.Event.Details.IsBlacklist
      description: Whether any of the geographical locations from which an alerted activity originated was on the blacklist at the time the activity occurred.
      type: Boolean
    - contextPath: Varonis.Event.Details.Operation
      description: |-
        Type of operation that occurred during the event. Options are:
        - Accessed
        - Added
        - Changed
        - Removed
        - Sent
        - Received
        - Requested.
      type: String
    - contextPath: Varonis.Event.ByUser.Name
      description: Name of the user that triggered the event.
      type: String
    - contextPath: Varonis.Event.ByUser.UserType
      description: Type of account, i.e., user or computer.
      type: String
    - contextPath: Varonis.Event.ByUser.UserAccountType
      description: |-
        Logon name used to support clients and servers running earlier versions of the Windows operating system, such as Windows NT 4.0.
        In the dashboards (other than the Alert dashboard), this is the SAM account name of the user or group.
      type: String
    - contextPath: Varonis.Event.ByUser.Domain
      description: Domain of the user that triggered the event.
      type: String
    - contextPath: Varonis.Event. ByUser.DisabledAccount
      description: Whether the account is disabled.
      type: Boolean
    - contextPath: Varonis.Event.ByUser.StaleAccount
      description: Whether the account is stale.
      type: Boolean
    - contextPath: Varonis.Event.ByUser.LockoutAccounts
      description: Whether the account is lockout.
      type: Boolean
    - contextPath: Varonis.Event.SourceIP
      description: Source IP of the device triggered the event.
      type: String
    - contextPath: Varonis.Event. IsMaliciousIP
      description: Whether the IP is known to be malicious.
      type: Boolean
    - contextPath: Varonis.Event. IPReputation
      description: Reputation score of the IP. The score is a numeric value from 1-100.
      type: Number
    - contextPath: Varonis.Event.IPThreatType
      description: List of threat types associated with the IP.
      type: String
    - contextPath: Varonis.Event.OnObject.Name
      description: Name of object on which the event was performed.
      type: String
    - contextPath: Varonis.Event.OnObject.ObjectType
      description: Type of object on which the event was performed.
      type: String
    - contextPath: Varonis.Event.OnObject.Platform
      description: Type of platform on which the server resides. For example, Windows, Exchange, or SharePoint.
      type: String
    - contextPath: Varonis.Event.OnObject.IsSensitive
      description: 'Indicates whether the resource on which the event was performed is sensitive.'
      type: Boolean
    - contextPath: Varonis.Event.OnObject.FileServerOrDomain
      description: File server of object on which the event was performed.
      type: String
    - contextPath: Varonis.Event.OnObject.IsDisabledAccount
      description: Whether the account is disabled.
      type: Boolean
    - contextPath: Varonis.Event.OnObject.IsLockOutAccount
      description: Whether the account is lockout.
      type: Boolean
    - contextPath: Varonis.Event.OnObject.SAMAccountName
      description: |-
        Logon name used to support clients and servers running earlier versions of the Windows operating system, such as Windows NT 4.0.
        In the dashboards (other than the Alert dashboard), this is the SAM account name of the user or group.
      type: String
    - contextPath: Varonis.Event.OnObject.UserAccountType
      description: |-
        Specified type of privileged account. Options are:
        - Service accounts
        - Admin accounts
        - Executive accounts
        - Test accounts.
      type: String
    - contextPath: Varonis.Event.OnObject.DestinationIP
      description: Destination IP address within the organization.
      type: String
    - contextPath: Varonis.Event.OnObject.DestinationDevice
      description: Destination host name for relevant services.
      type: String
    - contextPath: Varonis.Event.OnObject.Path
      description: Path of asset.
      type: String
    - contextPath: Varonis.Pagination.Page
      description: Current page number requested by user.
      type: Number
    - contextPath: Varonis.Pagination.PageSize
      description: Number of records on the page.
      type: Number
  dockerimage: demisto/ntlm:1.0.0.9067966
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0
defaultmapperin: Varonis DSP Incident - Incoming Mapper