VercaraUltraDNS

Vercara UltraDNS integration for Cortex. Leverage UltraDNS's cloud-based DNS event and configuration data for security automation and real-time threat detection in Cortex.

Analytics & SIEM · Vercara UltraDNS

Details

ID	`VercaraUltraDNS`
Provider	DigiCert
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

This integration fetches DNS configuration audit logs from Vercara UltraDNS platform.
This integration was integrated and tested with the 3.18.0 Vercara UltraDNS API.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Vercara UltraDNS in Cortex

Parameter	Description	Required
Server URL	The base URL for the Vercara UltraDNS API. Default is https://api.ultradns.com	True
Username	Username for authentication	True
Password	Password for authentication	True
Trust any certificate (not secure)	Use SSL secure connection or not.	False
Use system proxy settings	Use proxy settings for connection or not.	False
Fetch events	Whether to bring events or not.	False
The maximum number of audit logs per fetch	Maximum number of events to fetch per cycle. Default is 2,500, maximum is 2,500.	False

Vercara UltraDNS Authentication

The integration uses OAuth 2.0 password grant flow for authentication:

Initial Token Request: Uses username/password to obtain access token and refresh token
Token Usage: Access token is used in Authorization header for API requests
Token Refresh: Automatically refreshes tokens when they expire, with fallback to username/password if refresh fails.

For detailed API documentation, see the REST API User Guide.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

vercara-ultradns-get-events

Gets audit events from Vercara UltraDNS. Manual command to fetch and display events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.

Base Command

vercara-ultradns-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command creates events; otherwise, it only displays them. Possible values are true and false. The default value is false.	Required
limit	Maximum number of events to return. Default is 50, maximum is 2,500.	Optional
start_time	Start time for event collection. Supports ISO format (“2023-01-01T00:00:00”) or natural language (“7 days ago”, “yesterday”, “1 week ago”).	Required
end_time	End time for event collection. Supports ISO format (“2023-01-01T23:59:59”) or natural language (“2 hours ago”, “now”). Default is now if not provided.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — Username (required)
isFetchEvents — Fetch events
max_events_per_fetch — The maximum number of audit logs per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

vercara-ultradns-get-events
Gets audit events from Vercara UltraDNS. Manual command to fetch and display events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.

Source

VercaraUltraDNS.py VercaraUltraDNS_test.py VercaraUltraDNS.yml VercaraUltraDNS_description.md

Download History Raw

category: Analytics & SIEM
provider: DigiCert
sectionorder:
- Connect
- Collect
commonfields:
  id: VercaraUltraDNS
  version: -1
configuration:
- display: Server URL
  defaultvalue: https://api.ultradns.com
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Fetch events
  defaultvalue: 'false'
  name: isFetchEvents
  required: false
  type: 8
  section: Collect
- name: max_events_per_fetch
  defaultvalue: '2500'
  display: The maximum number of audit logs per fetch
  required: false
  type: 0
  section: Collect
  additionalinfo: Maximum is 2,500.
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Vercara UltraDNS integration for Cortex. Leverage UltraDNS's cloud-based DNS event and configuration data for security automation and real-time threat detection in Cortex.
display: Vercara UltraDNS
name: VercaraUltraDNS
script:
  commands:
  - arguments:
    - name: should_push_events
      auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command creates events; otherwise, it only displays them.
      predefined:
      - 'true'
      - 'false'
      required: true
    - name: limit
      description: Maximum number of results to return. Maximum is 2,500.
      required: false
      defaultValue: '10'
    - name: start_time
      description: Start time for fetching events. Supports ISO format ("2023-01-01T00:00:00") or natural language ("7 days ago", "yesterday", "1 week ago").
      required: true
    - name: end_time
      description: End time for fetching events. Supports ISO format ("2023-01-01T23:59:59") or natural language ("2 hours ago", "now"). If not provided, defaults to now.
    description: Gets audit events from Vercara UltraDNS. Manual command to fetch and display events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.
    name: vercara-ultradns-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam