VaronisSaaS

Streamline alerts and related forensic information from Varonis SaaS.

Analytics & SIEM · Varonis SaaS

Details

IDVaronisSaaS
ProviderVaronis
CategoryAnalytics & SIEM
From Version6.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Streamline alerts and related forensic information from Varonis SaaS

Configure Varonis SaaS in Cortex

Parameter Description Required
Fetch incidents   False
Incident type   False
The FQDN/IP the integration should connect to   True
X-API-Key   True
Use system proxy settings   False
Trust any certificate (not secure)   False
Maximum number of incidents per fetch   False
First fetch time   False
Minimum severity of alerts to fetch   False
Varonis threat model name Pipe-separated list of threat model names of alerts to fetch. Use “varonis-get-threat-models” command to retrieve the full list False
Varonis alert status   False
Incident Mirroring Direction Choose the direction to mirror the incident: Outgoing (from Cortex XSOAR to Varonis SaaS). Cortex XSOAR only parameter. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

varonis-get-threat-models

Get Varonis threat models

Base Command

varonis-get-threat-models

Input

Argument Name Description Required
name List of requested threat model names. Pipe (\|) separated and wildcards (*) supported. Optional

Context Output

Path Type Description
ID Number ID of the threat model
Name String Name of the threat model

Command example

```!varonis-get-threat-models name="*access to*|Domain controller*"```

#### Context Example

```json
[
    {
        "ThreatModel.Name": "Abnormal service behavior: access to atypical folders",
        "ThreatModel.Category": "Exfiltration",
        "ThreatModel.Severity": "3 - Error",
        "ThreatModel.Source": "Predefined",
        "ThreatModel.ID": 1
    },
    {
        "ThreatModel.Name": "Abnormal service behavior: access to atypical files",
        "ThreatModel.Category": "Exfiltration",
        "ThreatModel.Severity": "3 - Error",
        "ThreatModel.Source": "Predefined",
        "ThreatModel.ID": 2
    }
]

Human Readable Output

Varonis Alerts

ID Name Category Severity Source            
1 Abnormal service behavior: access to atypical folders Exfiltration 3 - Error Predefined \n 2 Abnormal service behavior: access to atypical files Exfiltration 3 - Error Predefined

varonis-get-alerts

Get alerts from Varonis DA

Base Command

varonis-get-alerts

Input

Argument Name Description Required
threat_model_name List of requested threat models to retrieve. Optional
start_time Start time (UTC) of alert range. Optional
end_time End time (UTC) of alert range. Optional
alert_status List of required alerts status. Optional
alert_severity List of required alerts severity. Optional
device_name List of required alerts device name. Optional
user_name User domain name (cannot be provided without user_name). Optional
last_days Number of days you want the search to go back to. Optional
extra_fields Extra fields. Optional
descending_order Indicates whether alerts should be ordered in newest to oldest order. Optional

Context Output

Path Type Description
Varonis.Alert.ID Number Varonis ID for alert
Varonis.Alert.Rule.Name String Name of retrieved alert
Varonis.Alert.TimeUTC Date When was the alert triggered
Varonis.Alert.Rule.Severity.Name String Alert severity
Varonis.Alert.Rule.Category.Name String Alert category.
Options are:
- Reconnaissance
- Intrusion
- Exploitation
- Privilege Escalation
- Lateral Movement
Varonis.Alert.Location.CountryName String Name of the country from which the event occurred
Varonis.Alert.Location.SubdivisionName String Name of the state or regional subdivision from which the event occurred
Varonis.Alert.Status.Name String Alert state. Options are:
- New
- Under investigation
- Closed
Varonis.Alert.CloseReason.Name String Reason the alert was closed. Options are:
- Other
- Benign activity
- True positive
- Environment misconfiguration
- Alert recently customized
- Inaccurate alert logic
- Authorized activity
Varonis.Alert.Location.BlacklistedLocation Boolean Whether any of the geographical locations from which an alerted activity originated was on the blacklist at the time the activity occurred
Varonis.Alert.Location.AbnormalLocation Boolean Whether any of the geographical locations from which an alerted activity originated is new or abnormal to the organization, the user and peers, or only the user
Varonis.Alert.EventsCount Number Number of events with alerts
Varonis.Alert.User.Name String Name of the users triggered alerts
Varonis.Alert.User.SamAccountName String Logon name used to support clients and servers running earlier versions of Windows operating system, such as Windows NT 4.0. In the dashboards (other than the Alert dashboard), this is the SAM account name of the user or group
Varonis.Alert.User.AccountType.Name String Privileged account associated with the user in the alert. Options are:
- Service accounts
- Admin accounts
- Executive accounts
Varonis.Alert.Data.IsFlagged Boolean Whether the data affected by the alerted events has global flags
Varonis.Alert.Data.IsSensitive Boolean Filters according to whether the resource on which the event was performed is sensitive (including subfolders)
Varonis.Alert.Filer.Platform.Name String Type of platform on which the server resides. For example, Windows, Exchange, or SharePoint
Varonis.Alert.Asset.Path String Path of the alerted asset
Varonis.Alert.Filer.Name String Associated file server/domain
Varonis.Alert.Device.HostName String Name of the device from which the user generated the event
Varonis.Alert.Device.IsMaliciousExternalIP Boolean Whether the alert contains IPs known to be malicious
Varonis.Alert.Device.ExternalIPThreatTypesName String Whether the alert contains IPs known to be malicious
Varonis.Alert.Status.ID String Id for the status of the alert
Varonis.Alert.Rule.ID String Id for the rule that triggered the alert
Varonis.Alert.Rule.Severity.ID String Severity level identifier
Varonis.Alert.Initial.Event.TimeUTC Date UTC time of the initial event that triggered the alert
Varonis.Alert.User.SidID String Security Identifier (SID) of the user associated with the alert
Varonis.Alert.IngestTime Date Time when the alert was ingested into the system

Command example

!varonis-get-alerts start_time="2023-12-01T09:58:00" end_time="2023-12-07T04:16:00" alert_status="New" alert_severity="High" device_name="intfc35adh" threat_model_name="Deletion: Active Directory containers, Foreign Security Principal, or GPO" extra_fields="Alert.MitreTactic.*"

Context Example

[
  {
    "Alert.Rule.Name": "Deletion: Multiple directory service objects",
    "Alert.Rule.Severity.Name": "Medium",
    "Alert.TimeUTC": "2023-12-11T03:50:00",
    "Alert.Rule.Category.Name": "Denial of Service",
    "Alert.User.Name": "varadm (intaf6fb.com)",
    "Alert.Status.Name": "New",
    "Alert.ID": "A5F4B69A-F5C0-494F-B5B4-185185BC3FBE",
    "Alert.Rule.ID": "140",
    "Alert.Rule.Severity.ID": "1",
    "Alert.Location.CountryName": "",
    "Alert.Location.SubdivisionName": "",
    "Alert.Status.ID": "1",
    "Alert.EventsCount": "14",
    "Alert.Initial.Event.TimeUTC": "2023-12-11T03:41:00",
    "Alert.User.SamAccountName": "varadm",
    "Alert.User.AccountType.Name": "Admin,Executive",
    "Alert.Device.HostName": "intaf6fbdh",
    "Alert.Device.IsMaliciousExternalIP": "",
    "Alert.Device.ExternalIPThreatTypesName": "",
    "Alert.Data.IsFlagged": "0",
    "Alert.Data.IsSensitive": "0",
    "Alert.Filer.Platform.Name": "Active Directory",
    "Alert.Asset.Path": "intaf6fb.com(AD-intaf6fb.com)",
    "Alert.Filer.Name": "AD-intaf6fb.com",
    "Alert.CloseReason.Name": "",
    "Alert.Location.BlacklistedLocation": "",
    "Alert.Location.AbnormalLocation": "",
    "Alert.User.SidID": "971",
    "Alert.IngestTime": "2023-12-11T03:52:46",
    "Url": "/#/app/analytics/entity/Alert/A5F4B69A-F5C0-494F-B5B4-185185BC3FBE"
  }
]

Human Readable Output

Varonis Alerts

Alert.Rule.Name Alert.Rule.Severity.Name Alert.TimeUTC Alert.Rule.Category.Name Alert.User.Name Alert.Status.Name Alert.ID
Deletion: Multiple directory service objects Medium 2023-12-11T03:50:00 Denial of Service varadm (intaf6fb.com) New A5F4B69A-F5C0-494F-B5B4-185185BC3FBE

varonis-get-alerted-events

Get events applied to specific alerts

Base Command

varonis-get-alerted-events

Input

Argument Name Description Required
alert_id List of alert IDs. Required
start_time Start UTC time of alert range. Optional
end_time End UTC time of alert range. Optional
last_days Number of days you want the search to go back to. Optional
extra_fields Extra fields. Optional
descending_order Indicates whether events should be ordered in newest to oldest order. Optional

Context Output

Path Type Description
Varonis.Event.ID String Event ID
Varonis.Event.Alert.ID String Alert ID
Varonis.Event.Type.Name String Event type
Varonis.Event.TimeUTC Date Event time in UTC format
Varonis.Event.Status.Name String Filters according to the status of the event. Options are:
- Fail
- Success
Varonis.Event.Description String Description of the activity
Varonis.Event.Location.Country.Name String Name of the country from which the event occurred
Varonis.Event.Location.Subdivision.Name String Name of the state or regional subdivision from which the event occurred
Varonis.Event.Device.ExternalIP.IP String Device external IP address
Varonis.Event.Location.BlacklistedLocation Boolean Indicates whether the geographical location from which the event originated was blacklisted
Varonis.Event.Operation.Name String Type of operation that occurred during the event. Options are:
- Accessed
- Added
- Changed
- Removed
- Sent
- Received
- Requested
Varonis.Event.ByAccount.Identity.Name String Name of the user that triggered the event
Varonis.Event.ByAccount.Type.Name String Type of account, i.e., user or computer
Varonis.Event.ByAccount.SamAccountName String SAM account name of the user or group for clients and servers running earlier versions of Windows
Varonis.Event.ByAccount.Domain.Name String Domain of the user that triggered the event
Varonis.Event.ByAccount.IsDisabled Boolean Indicates whether the account is disabled
Varonis.Event.ByAccount.IsStale Boolean Indicates whether the account is stale
Varonis.Event.ByAccount.IsLockout Boolean Indicates whether the account is locked out
Varonis.Event.IP String Source IP address of the device that triggered the event
Varonis.Event.Device.ExternalIP.IsMalicious Boolean Indicates whether the external IP is known to be malicious
Varonis.Event.Device.ExternalIP.Reputation.Name Number Reputation score of the external IP, a numeric value from 1-100
Varonis.Event.Device.ExternalIP.ThreatTypes.Name String List of threat types associated with the external IP
Varonis.Event.OnObjectName String Name of the object on which the event was performed
Varonis.Event.OnResource.ObjectType.Name String Type of the object on which the event was performed
Varonis.Event.Filer.Platform.Name String Type of platform on which the server resides, like Windows, Exchange, SharePoint
Varonis.Event.OnResource.IsSensitive Boolean Indicates whether the resource on which the event was performed is sensitive
Varonis.Event.Filer.Name String File server of the object on which the event was performed
Varonis.Event.OnAccount.IsDisabled Boolean Indicates whether the account is disabled
Varonis.Event.OnAccount.IsLockout Boolean Indicates whether the account is locked out
Varonis.Event.OnAccount.SamAccountName Boolean SAM account name of the user or group for clients and servers running earlier versions of Windows
Varonis.Event.Destination.IP String Destination IP address within the organization
Varonis.Event.Device.Name String Name of the device that triggered the event
Varonis.Event.Destination.DeviceName String Destination host name for relevant services
Varonis.Event.OnResource.Path String Path of the resource

Command example

varonis-get-alerted-events alert_id="C98A3E72-99E9-4E5C-A560-7D04FA60686E,C83D55F0-EC63-41FC-B8C6-A5A66CB51372" last_days=7 extra_fields="Event.ByAccount.DistinguishedName"

Context Example

[
  {
    "Event.Type.Name": "DS object deleted",
    "Event.Description": "Organizational Unit \"CommitOu_a9c42\" was deleted",
    "Event.Filer.Platform.Name": "Active Directory",
    "Event.Filer.Name": "AD-intaf6fb.com",
    "Event.ByAccount.SamAccountName": "varadm",
    "Event.OnObjectName": "CommitOu_a9c42",
    "Event.Alert.ID": "A5F4B69A-F5C0-494F-B5B4-185185BC3FBE",
    "Event.ID": "7D87B6A2-C9C2-4859-A076-DD4D0EFC8276",
    "Event.TimeUTC": "2023-12-11T03:41:08.000Z",
    "Event.Status.Name": "Success",
    "Event.Location.Country.Name": "",
    "Event.Location.Subdivision.Name": "",
    "Event.Location.BlacklistedLocation": "",
    "Event.Operation.Name": "Deleted",
    "Event.ByAccount.Type.Name": "User",
    "Event.ByAccount.Domain.Name": "intaf6fb.com",
    "Event.ByAccount.Identity.Name": "varadm",
    "Event.IP": "",
    "Event.Device.ExternalIP.IP": "",
    "Event.Destination.IP": "",
    "Event.Device.Name": "intaf6fbdh",
    "Event.Destination.DeviceName": "",
    "Event.ByAccount.IsDisabled": "No",
    "Event.ByAccount.IsStale": "No",
    "Event.ByAccount.IsLockout": "No",
    "Event.Device.ExternalIP.ThreatTypes.Name": "",
    "Event.Device.ExternalIP.IsMalicious": "",
    "Event.Device.ExternalIP.Reputation.Name": "",
    "Event.OnResource.ObjectType.Name": "Organizational unit",
    "Event.OnAccount.SamAccountName": "51d4ee86-db4a-4d4a-baaa-1b84e02afd59",
    "Event.OnResource.IsSensitive": "",
    "Event.OnAccount.IsDisabled": "",
    "Event.OnAccount.IsLockout": "",
    "Event.OnResource.Path": "intaf6fb.com\\CommitOu_a9c42"
  }
]

Human Readable Output

Varonis Alerted Events

Event.Type.Name Event.Description Event.Filer.Platform.Name Event.Filer.Name Event.ByAccount.SamAccountName Event.OnObjectName Event.Alert.ID Event.ID Event.TimeUTC Event.Status.Name Event.Location.Country.Name Event.Location.Subdivision.Name Event.Location.BlacklistedLocation Event.Operation.Name Event.ByAccount.Type.Name Event.ByAccount.Domain.Name Event.ByAccount.Identity.Name Event.IP Event.Device.ExternalIP.IP Event.Destination.IP Event.Device.Name Event.Destination.DeviceName Event.ByAccount.IsDisabled Event.ByAccount.IsStale Event.ByAccount.IsLockout Event.Device.ExternalIP.ThreatTypes.Name Event.Device.ExternalIP.IsMalicious Event.Device.ExternalIP.Reputation.Name Event.OnResource.ObjectType.Name Event.OnAccount.SamAccountName Event.OnResource.IsSensitive Event.OnAccount.IsDisabled Event.OnAccount.IsLockout Event.OnResource.Path                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
DS object deleted Organizational Unit “CommitOu_a9c42” was deleted Active Directory AD-intaf6fb.com varadm CommitOu_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE 7D87B6A2-C9C2-4859-A076-DD4D0EFC8276 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       Organizational unit 51d4ee86-db4a-4d4a-baaa-1b84e02afd59       intaf6fb.com\CommitOu_a9c42 \n DS object deleted User “intaf6fb.com\PolWinRolU_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\PolWinRolU_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE B75C4ECE-48BA-4172-BBB1-68B85E3ABB6F 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User PolWinRolU_a9c42   No No intaf6fb.com\Users\PolWinRolU_a9c42 \n DS object deleted User “intaf6fb.com\Add_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\Add_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE 4800A52F-F8C2-483A-BC39-A68D1AF13D98 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User Add_a9c42   No No intaf6fb.com\Users\Add_a9c42 \n DS object deleted Organizational Unit “CommitOu_a9c42” was deleted Active Directory AD-intaf6fb.com varadm CommitOu_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE,0AB569DA-B58E-4DC5-9FC2-8793BA118C88 DFEE2A16-E0DF-4777-BA8A-390DD869D413 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       Organizational unit 51d4ee86-db4a-4d4a-baaa-1b84e02afd59       intaf6fb.com\CommitOu_a9c42 \n DS object deleted “intaf6fb.com\CommitAdGroup_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\CommitAdGroup_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE FA2F5005-6EFC-46B9-BC95-E88CD3838D1A 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       Group CommitAdGroup_a9c42       intaf6fb.com\Users\CommitAdGroup_a9c42 \n DS object deleted User “intaf6fb.com\RollbackRemove_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\RollbackRemove_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE 0A5A616D-D3CA-4623-A248-18DC0E7AB67A 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User RollbackRemove_a9c42   No No intaf6fb.com\Users\RollbackRemove_a9c42 \n DS object deleted User “intaf6fb.com\Remove_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\Remove_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE 59E8DE00-7F0F-4637-B5DA-BC8842B2533F 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User Remove_a9c42   No No intaf6fb.com\Users\Remove_a9c42 \n DS object deleted “CommitNewGroup_a9c42” was deleted Active Directory AD-intaf6fb.com varadm CommitNewGroup_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE 5CC0C582-C5D6-4ED2-8596-BBBFD0ABB746 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       Group a9dde0e5-1346-4d15-a9dc-0c1337ddab2f       intaf6fb.com\CommitOu_a9c42\CommitNewGroup_a9c42 \n DS object deleted User “intaf6fb.com\CommitAdUser_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\CommitAdUser_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE AD3642A0-B90B-4349-ADB1-206749BF18E8 2023-12-11T03:41:08.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User CommitAdUser_a9c42   No No intaf6fb.com\Users\CommitAdUser_a9c42 \n DS object deleted User “intaf6fb.com\RollbackRemove_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\RollbackRemove_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE 015579AF-E357-4D16-AAC0-50B76E7D7104 2023-12-11T03:41:05.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User RollbackRemove_a9c42   No No intaf6fb.com\Users\RollbackRemove_a9c42 \n DS object deleted User “intaf6fb.com\Add_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\Add_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE B38D714B-8D20-4E68-8EFC-709C128C136C 2023-12-11T03:41:05.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User Add_a9c42   No No intaf6fb.com\Users\Add_a9c42 \n DS object deleted User “intaf6fb.com\Remove_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\Remove_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE E5F15080-A7C0-42CF-A911-05627FF26179 2023-12-11T03:41:05.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User Remove_a9c42   No No intaf6fb.com\Users\Remove_a9c42 \n DS object deleted User “intaf6fb.com\CommitAdUser_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\CommitAdUser_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE A9673047-6CDD-4404-805F-38B5CACAC047 2023-12-11T03:41:05.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User CommitAdUser_a9c42   No No intaf6fb.com\Users\CommitAdUser_a9c42 \n DS object deleted User “intaf6fb.com\PolWinRolU_a9c42” was deleted Active Directory AD-intaf6fb.com varadm intaf6fb.com\PolWinRolU_a9c42 A5F4B69A-F5C0-494F-B5B4-185185BC3FBE 967A5AA4-391C-4AB6-BB33-592AACCFB4D2 2023-12-11T03:41:04.000Z Success       Deleted User intaf6fb.com varadm       intaf6fbdh   No No No       User PolWinRolU_a9c42   No No intaf6fb.com\Users\PolWinRolU_a9c42

varonis-alert-add-note

Add note to alerts

Base Command

varonis-alert-add-note

Input

Argument Name Description Required
alert_id Requested alerts. Required
note Note. Required

Context Output

There is no context output for this command.

Command example

!varonis-alert-add-note alert_id=C98A3E72-99E9-4E5C-A560-7D04FA60686E note="This needs to be invested ASAP"

varonis-update-alert-status

Update alert status

Base Command

varonis-update-alert-status

Input

Argument Name Description Required
alert_id Requested alerts. Required
status Alert new status. Possible values are: New, Under Investigation. Required
note Note. Optional

Context Output

There is no context output for this command.

Command example

!varonis-update-alert-status alert_id=C98A3E72-99E9-4E5C-A560-7D04FA60686E status="Under Investigation" note="Waiting for feedback from security team"

varonis-close-alert

Close the alert

Base Command

varonis-close-alert

Input

Argument Name Description Required
alert_id Requested alerts. Required
close_reason The reason the alert was closed. Possible values are: Other, Benign activity, True positive, Environment misconfiguration, Alert recently customized, Inaccurate alert logic, Authorized activity. Required
note Note. Optional

Context Output

There is no context output for this command.

Command example

!varonis-close-alert alert_id=C98A3E72-99E9-4E5C-A560-7D04FA60686E close_reason="Inaccurate alert logic" note="Alert is irrelevant. Closed"

get-mapping-fields

Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Incident Mirroring

You can enable outgoing incident mirroring between Cortex XSOAR incidents and Varonis alerts (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

  1. Enable Fetching incidents in your instance configuration.

  2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored (currently only outgoing mirroring is available):

    Option Description
    None Turns off incident mirroring.
    Outgoing Any changes in Cortex XSOAR incidents will be reflected in Varonis SaaS service (outgoing mirrored fields).

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.

Mirroring Out Notes

The supported fields in the mirroring out process are:

  • Varonis Alert Status.
  • Varonis Close Reason
  • Incident Close Notes

Important Note:
You have two options how to close Varonis Alert:

  • The first option is to change the Varonis Alert Status field in the XSOAR incident. In this case, the status of the alert in Varonis SaaS service will be change by the mirroring functionality, but the Incident in XSOAR won’t be closed.
  • The second one is to close the incident in XSOAR. In this case, the Varonis Alert will be closed on the Varonis side by the post-processing script.

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • url — The FQDN/IP the integration should connect to (required)
  • apiKey — (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time
  • severity — Minimum severity of alerts to fetch
  • threat_model — Varonis threat model name
  • status — Varonis alert status
  • mirror_direction — Incident Mirroring Direction

Commands (8)

  • get-mapping-fields

    Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.

  • update-remote-system

    Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.

  • varonis-alert-add-note

    Add note to alerts.

  • varonis-close-alert

    Close the alert.

  • varonis-get-alerted-events

    Get events applied to specific alerts.

  • varonis-get-alerts

    Get alerts from Varonis DA.

  • varonis-get-threat-models

    Get Varonis threat models.

  • varonis-update-alert-status

    Update alert status.

Source

VaronisSaaS.py VaronisSaaS_test.py VaronisSaaS.yml VaronisSaaS_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
provider: Varonis
sectionorder:
- Connect
- Collect
commonfields:
  id: VaronisSaaS
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Collect
- display: Incident type
  name: incidentType
  required: false
  type: 13
  defaultvalue: Varonis SaaS Incident
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: The FQDN/IP the integration should connect to
  hidden: false
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: X-API-Key
  hidden: false
  name: apiKey
  required: true
  type: 9
  hiddenusername: true
  section: Connect
- display: Use system proxy settings
  hidden: false
  name: proxy
  required: false
  type: 8
  section: Connect
- display: Trust any certificate (not secure)
  hidden: false
  name: insecure
  required: false
  type: 8
  section: Connect
- defaultvalue: '1000'
  display: Maximum number of incidents per fetch
  additionalinfo:
  name: max_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: 1 week
  display: First fetch time
  hidden: false
  name: first_fetch
  required: false
  type: 0
  section: Collect
- defaultvalue: Low
  display: Minimum severity of alerts to fetch
  hidden: false
  name: severity
  options:
  - Low
  - Medium
  - High
  - Informational
  required: false
  type: 15
  section: Collect
- display: Varonis threat model name
  additionalinfo: Pipe-separated list of threat model names of alerts to fetch. Use "varonis-get-threat-models" command to retrieve the full list
  hidden: false
  name: threat_model
  required: false
  type: 0
  section: Collect
- defaultvalue: New
  display: Varonis alert status
  hidden: false
  name: status
  options:
  - New
  - Under Investigation
  - Closed
  required: false
  type: 15
  section: Collect
- additionalinfo: 'Choose the direction to mirror the incident: Outgoing (from Cortex XSOAR to Varonis SaaS). Cortex XSOAR only parameter.'
  defaultvalue: None
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Outgoing
  type: 15
  required: false
  section: Collect
  hidden:
  - marketplacev2
  - platform
description: Streamline alerts and related forensic information from Varonis SaaS.
display: Varonis SaaS
name: VaronisSaaS
script:
  commands:
  - arguments:
    - default: false
      description: List of requested threat models to retrieve (pipe-separated).
      isArray: true
      name: threat_model_name
      required: false
      secret: false
    - default: false
      description: Start time of alert range.
      isArray: false
      name: start_time
      required: false
      secret: false
    - default: false
      description: End time of alert range.
      isArray: false
      name: end_time
      required: false
      secret: false
    - default: false
      description: List of requested alerts status (pipe-separated).
      isArray: true
      name: alert_status
      required: false
      secret: false
    - default: false
      description: List of requested alerts severity (pipe-separated).
      isArray: true
      name: alert_severity
      required: false
      secret: false
    - default: false
      description: List of required alerts device name (pipe-separated).
      isArray: true
      name: device_name
      required: false
      secret: false
    - default: false
      description: User domain name.
      isArray: false
      name: user_name
      required: false
      secret: false
    - default: false
      description: Number of days you want the search to go back to.
      isArray: false
      name: last_days
      required: false
      secret: false
    - default: false
      description: Extra fields.
      isArray: false
      name: extra_fields
      required: false
      secret: false
    - auto: PREDEFINED
      default: true
      description: Indicates whether alerts should be ordered in newest to oldest order.
      predefined:
      - 'True'
      - 'False'
      isArray: false
      name: descending_order
      required: false
      secret: false
    deprecated: false
    description: Get alerts from Varonis DA.
    execution: false
    name: varonis-get-alerts
    outputs:
    - contextPath: Varonis.Alert.ID
      description: Varonis ID for alert.
      type: Number
    - contextPath: Varonis.Alert.Rule.Name
      description: Name of retrieved alert.
      type: String
    - contextPath: Varonis.Alert.TimeUTC
      description: When was the alert triggered.
      type: Date
    - contextPath: Varonis.Alert.Rule.Severity.Name
      description: Alert severity.
      type: String
    - contextPath: Varonis.Alert.Rule.Category.Name
      description: |-
        Alert category. Options are:
        - Reconnaissance 
        - Intrusion 
        - Exploitation 
        - Privilege Escalation 
        - Lateral Movement.
      type: String
    - contextPath: Varonis.Alert.Location.CountryName
      description: Name of the country from which the event occurred.
      type: String
    - contextPath: Varonis.Alert.Location.SubdivisionName
      description: Name of the state or regional subdivision from which the event occurred.
      type: String
    - contextPath: Varonis.Alert.Status.Name
      description: |-
        Alert state. Options are:
        - New
        - Under investigation
        - Closed.
      type: String
    - contextPath: Varonis.Alert.CloseReason.Name
      description: |-
        Reason the alert was closed. Options are:
        - Other
        - Benign activity
        - True positive
        - Environment misconfiguration
        - Alert recently customized
        - Inaccurate alert logic
        - Authorized activity.
      type: String
    - contextPath: Varonis.Alert.Location.BlacklistedLocation
      description: Whether any of the geographical locations from which an alerted activity originated was on the blacklist at the time the activity occurred.
      type: Boolean
    - contextPath: Varonis.Alert.Location.AbnormalLocation
      description: Whether any of the geographical locations from which an alerted activity originated is new or abnormal to the organization, the user and peers, or only the user.
      type: Boolean
    - contextPath: Varonis.Alert.EventsCount
      description: Number of events with alerts.
      type: Number
    - contextPath: Varonis.Alert.User.Name
      description: Name of the users triggered alerts.
      type: String
    - contextPath: Varonis.Alert.User.SamAccountName
      description: |-
        Logon name used to support clients and servers running earlier versions of Windows operating system, such as Windows NT 4.0.
        In the dashboards (other than the Alert dashboard), this is the SAM account name of the user or group.
      type: String
    - contextPath: Varonis.Alert.User.AccountType.Name
      description: |-
        Privileged account associated with the user in the alert. Options are:
        - Service accounts
        - Admin accounts
        - Executive accounts.
      type: String
    - contextPath: Varonis.Alert.Data.IsFlagged
      description: Whether the data affected by the alerted events has global flags.
      type: Boolean
    - contextPath: Varonis.Alert.Data.IsSensitive
      description: Filters according to whether the resource on which the event was performed is sensitive (including subfolders).
      type: Boolean
    - contextPath: Varonis.Alert.Filer.Platform.Name
      description: Type of platform on which the server resides. For example, Windows, Exchange, or SharePoint.
      type: String
    - contextPath: Varonis.Alert.Asset.Path
      description: Path of the alerted asset.
      type: String
    - contextPath: Varonis.Alert.Filer.Name
      description: Associated file server/domain.
      type: String
    - contextPath: Varonis.Alert.Device.HostName
      description: Name of the device from which the user generated the event.
      type: String
    - contextPath: Varonis.Alert.Device.IsMaliciousExternalIP
      description: Whether the alert contains IPs known to be malicious.
      type: Boolean
    - contextPath: Varonis.Alert.Device.ExternalIPThreatTypesName
      description: Whether the alert contains IPs known to be malicious.
      type: String
    - contextPath: Varonis.Alert.Status.ID
      description: Id for the status of the alert.
      type: String
    - contextPath: Varonis.Alert.Rule.ID
      description: Id for the rule that triggered the alert.
      type: String
    - contextPath: Varonis.Alert.Rule.Severity.ID
      description: Severity level identifier.
      type: String
    - contextPath: Varonis.Alert.Initial.Event.TimeUTC
      description: UTC time of the initial event that triggered the alert.
      type: Date
    - contextPath: Varonis.Alert.User.SidID
      description: Security Identifier (SID) of the user associated with the alert.
      type: String
    - contextPath: Varonis.Alert.IngestTime
      description: Time when the alert was ingested into the system.
      type: Date
  - arguments:
    - default: false
      description: Requested alerts (pipe-separated).
      isArray: true
      name: alert_id
      required: true
      secret: false
    - default: false
      description: Note.
      isArray: false
      name: note
      required: true
      secret: false
    deprecated: false
    description: Add note to alerts.
    execution: false
    name: varonis-alert-add-note
  - arguments:
    - default: false
      description: Requested alerts (pipe-separated).
      isArray: true
      name: alert_id
      required: true
      secret: false
    - auto: PREDEFINED
      predefined:
      - New
      - Under Investigation
      default: false
      description: Alert new status.
      isArray: false
      name: status
      required: true
      secret: false
    - default: false
      description: Note.
      isArray: false
      name: note
      required: false
      secret: false
    deprecated: false
    description: Update alert status.
    execution: false
    name: varonis-update-alert-status
  - arguments:
    - default: false
      description: Requested alerts.
      isArray: true
      name: alert_id
      required: true
      secret: false
    - auto: PREDEFINED
      default: false
      description: The reason the alert was closed.
      predefined:
      - Other
      - Benign activity
      - True positive
      - Environment misconfiguration
      - Alert recently customized
      - Inaccurate alert logic
      - Authorized activity
      isArray: false
      name: close_reason
      required: true
      secret: false
    - default: false
      description: Note.
      isArray: false
      name: note
      required: false
      secret: false
    deprecated: false
    description: Close the alert.
    execution: false
    name: varonis-close-alert
  - arguments:
    - default: false
      description: List of alert IDs (pipe-separated).
      isArray: true
      name: alert_id
      required: true
      secret: false
    - default: false
      description: Start UTC time of alert range.
      isArray: false
      name: start_time
      required: false
      secret: false
    - default: false
      description: End UTC time of alert range.
      isArray: false
      name: end_time
      required: false
      secret: false
    - default: false
      description: Number of days you want the search to go back to.
      isArray: false
      name: last_days
      required: false
      secret: false
    - default: false
      description: Extra fields (pipe-separated).
      isArray: false
      name: extra_fields
      required: false
      secret: false
    - auto: PREDEFINED
      default: true
      description: Indicates whether events should be ordered in newest to oldest order.
      predefined:
      - 'True'
      - 'False'
      isArray: false
      name: descending_order
      required: false
      secret: false
    deprecated: false
    description: Get events applied to specific alerts.
    execution: false
    name: varonis-get-alerted-events
    outputs:
    - contextPath: Varonis.Event.ID
      description: Event ID.
      type: String
    - contextPath: Varonis.Event.Alert.ID
      description: Alert ID.
      type: String
    - contextPath: Varonis.Event.Type.Name
      description: Event type.
      type: String
    - contextPath: Varonis.Event.TimeUTC
      description: Event time in UTC format.
      type: Date
    - contextPath: Varonis.Event.Status.Name
      description: |-
        Filters according to the status of the event. Options are:
        - Fail
        - Success.
      type: String
    - contextPath: Varonis.Event.Description
      description: Description of the activity.
      type: String
    - contextPath: Varonis.Event.Location.Country.Name
      description: Name of the country from which the event occurred.
      type: String
    - contextPath: Varonis.Event.Location.Subdivision.Name
      description: Name of the state or regional subdivision from which the event occurred.
      type: String
    - contextPath: Varonis.Event.Device.ExternalIP.IP
      description: Device external IP address.
      type: String
    - contextPath: Varonis.Event.Location.BlacklistedLocation
      description: Indicates whether the geographical location from which the event originated was blacklisted.
      type: Boolean
    - contextPath: Varonis.Event.Operation.Name
      description: |-
        Type of operation that occurred during the event. Options are:
        - Accessed
        - Added
        - Changed
        - Removed
        - Sent
        - Received
        - Requested.
      type: String
    - contextPath: Varonis.Event.ByAccount.Identity.Name
      description: Name of the user that triggered the event.
      type: String
    - contextPath: Varonis.Event.ByAccount.Type.Name
      description: Type of account, i.e., user or computer.
      type: String
    - contextPath: Varonis.Event.ByAccount.SamAccountName
      description: SAM account name of the user or group for clients and servers running earlier versions of Windows.
      type: String
    - contextPath: Varonis.Event.ByAccount.Domain.Name
      description: Domain of the user that triggered the event.
      type: String
    - contextPath: Varonis.Event.ByAccount.IsDisabled
      description: Indicates whether the account is disabled.
      type: Boolean
    - contextPath: Varonis.Event.ByAccount.IsStale
      description: Indicates whether the account is stale.
      type: Boolean
    - contextPath: Varonis.Event.ByAccount.IsLockout
      description: Indicates whether the account is locked out.
      type: Boolean
    - contextPath: Varonis.Event.IP
      description: Source IP address of the device that triggered the event.
      type: String
    - contextPath: Varonis.Event.Device.ExternalIP.IsMalicious
      description: Indicates whether the external IP is known to be malicious.
      type: Boolean
    - contextPath: Varonis.Event.Device.ExternalIP.Reputation.Name
      description: Reputation score of the external IP, a numeric value from 1-100.
      type: Number
    - contextPath: Varonis.Event.Device.ExternalIP.ThreatTypes.Name
      description: List of threat types associated with the external IP.
      type: String
    - contextPath: Varonis.Event.OnObjectName
      description: Name of the object on which the event was performed.
      type: String
    - contextPath: Varonis.Event.OnResource.ObjectType.Name
      description: Type of the object on which the event was performed.
      type: String
    - contextPath: Varonis.Event.Filer.Platform.Name
      description: Type of platform on which the server resides, like Windows, Exchange, SharePoint.
      type: String
    - contextPath: Varonis.Event.OnResource.IsSensitive
      description: Indicates whether the resource on which the event was performed is sensitive.
      type: Boolean
    - contextPath: Varonis.Event.Filer.Name
      description: File server of the object on which the event was performed.
      type: String
    - contextPath: Varonis.Event.OnAccount.IsDisabled
      description: Indicates whether the account is disabled.
      type: Boolean
    - contextPath: Varonis.Event.OnAccount.IsLockout
      description: Indicates whether the account is locked out.
      type: Boolean
    - contextPath: Varonis.Event.OnAccount.SamAccountName
      description: SAM account name of the user or group for clients and servers running earlier versions of Windows.
      type: Boolean
    - contextPath: Varonis.Event.Destination.IP
      description: Destination IP address within the organization.
      type: String
    - contextPath: Varonis.Event.Device.Name
      description: Name of the device that triggered the event.
      type: String
    - contextPath: Varonis.Event.Destination.DeviceName
      description: Destination host name for relevant services.
      type: String
    - contextPath: Varonis.Event.OnResource.Path
      description: Path of the resource.
      type: String
  - arguments:
    - default: false
      description: List of requested threat model names (pipe-separated and wildcard supported).
      isArray: true
      name: name
      required: false
      secret: false
    deprecated: false
    description: Get Varonis threat models.
    execution: false
    outputs:
    - contextPath: ID
      description: ID of the threat model.
      type: String
    - contextPath: Name
      description: Name of the threat model.
      type: String
    name: varonis-get-threat-models
  - description: Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
    name: get-mapping-fields
  - description: Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.
    name: update-remote-system
  dockerimage: demisto/python3:3.12.13.10116658
  feed: false
  isfetch: true
  ismappable: true
  isremotesyncin: false
  isremotesyncout: true
  longRunning: false
  longRunningPort: false
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 6.5.0
defaultmapperin: Varonis SaaS Incident - Incoming Mapper