WithSecureEventCollector

Details

ID	`WithSecureEventCollector`
Provider	WithSecure Corporation
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

WithSecure event collector integration for Cortex XSIAM.
This integration was integrated and tested with version 1.0 of WithSecure API

Authentication Process

To create a Client ID and Client Secret, see this documentation.

Configure WithSecure Event Collector in Cortex

Parameter	Description	Required
Server URL		True
Client ID	Client ID and Client Secret.	True
Client Secret		True
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)		False
Maximum number of events per fetch, Max 1000		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

with-secure-get-events

Manual command used to fetch events and display them.

Base Command

with-secure-get-events

Input

Argument Name	Description	Required
fetch_from	The date to start collecting the events from.	Optional
limit	The maximum amount of events to return.	Optional

Context Output

There is no context output for this command.

Command example

!with-secure-get-events limit=2 fetch_from="90 days"

Human Readable Output

With Secure Events

action	clientTimestamp	details	device	engine	id	organization	persistenceTimestamp	serverTimestamp	severity
created	2023-03-15T21:58:34Z	incidentPublicId: 4550314-13 fingerprint: 10e34c3d5a3b531505140351b515e5d0f563b761 initialDetectionTimestamp: 1678917621712 risk: MEDIUM categories: LATERAL_MOVEMENT incidentId: b7ffb469-44c2-4cc0-9adb-6a3663bba393 clientTimestamp: 1678917514000 resolution: UNCONFIRMED userSam: NT AUTHORITY\SYSTEM	name: WIN10-TMPLT id: 45581e9d-266c-4676-9f55-1ff36f7519f9	edr	dae559cd-37fe-3fc8-8fb1-7098c8a4d368_0	name: Palo Alto_comp id: b856d1ab-29c1-4803-b9b5-91ec7b24f94c	2023-03-15T22:00:22.985Z	2023-03-15T22:00:22.574Z	critical
created	2023-03-15T14:01:29Z	incidentPublicId: 4550314-5 fingerprint: 3a653902d97ee6aa241b3e4ae18b0c01a32b97fe initialDetectionTimestamp: 1678891152183 risk: HIGH categories: SYSTEM_OR_TOOL_MISUSE incidentId: 3b519e5d-addd-440f-b2b6-d8ab5bb0f4ff clientTimestamp: 1678888889000 resolution: UNCONFIRMED userSam: A-WIN81X64-TEMP\admin	name: A-WIN81X64-TEMP id: fb939719-e4b5-4fb0-bfd9-3e7079833cec	edr	1efd19d1-64db-3a56-b8fd-8da2cb87dc20_0	name: Palo Alto_comp id: b856d1ab-29c1-4803-b9b5-91ec7b24f94c	2023-03-15T14:39:15.695Z	2023-03-15T14:39:13.022Z	critical

Configuration parameters

url — Server URL (required)
credentials — Client ID (required)
first_fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
limit — Maximum number of events per fetch. Max 1000
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

with-secure-get-events
Manual command used to fetch events and display them.

Source

WithSecureEventCollector.py WithSecureEventCollector_test.py WithSecureEventCollector.yml WithSecureEventCollector_description.md command_examples.txt

Download History Raw

import json
import pytest
import demistomock as demisto
from WithSecureEventCollector import Client, get_events_command, fetch_events_command


def mock_client():
    return Client(base_url="https://test.com", verify=False, proxy=False, client_id="client_id", client_secret="client_secret")


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


TOKEN_TEST = [
    ({"access_token": "integration_context_token", "valid_until": 1000}, "integration_context_token"),
    ({}, "new_access_token"),
    ({"access_token": "integration_context_token", "valid_until": -1}, "new_access_token"),
]


@pytest.mark.parametrize("integration_context, expected_token", TOKEN_TEST)
def test_get_access_token(mocker, requests_mock, integration_context, expected_token):
    client = mock_client()
    import WithSecureEventCollector

    mocker.patch.object(WithSecureEventCollector, "get_integration_context", return_value=integration_context)
    mocker.patch.object(WithSecureEventCollector, "time", return_value=0)
    requests_mock.post("https://test.com/as/token.oauth2", json={"access_token": "new_access_token", "expires_in": 1})
    result = client.get_access_token()
    assert result == expected_token


def test_get_events_command(requests_mock, mocker):
    """Tests get-events command function.

    Checks the output of the command function with the expected output.
    """
    client = mock_client()
    mock_response = util_load_json("test_data/get_events.json")
    args = {"fetch_from": "2022-12-26T00:00:00Z", "limit": 2}
    mocker.patch.object(Client, "get_access_token", return_value={"access_token": "access_token"})
    requests_mock.get(
        "https://test.com/security-events/v1/security-events?limit=2&serverTimestampStart=2022-12-26T00:00:00Z",
        json=mock_response,
    )
    events, response = get_events_command(client, args)

    assert len(events) == 2
    assert events == mock_response.get("items")


def test_fetch_events_command(requests_mock, mocker):
    """Tests fetch-events command function.
    Given: and already fetched event id, and a latested fetched event timestamp
    When: running fetch-event command
    Check: the already fetched event does not get fetched again
    """

    client = mock_client()
    mock_response = util_load_json("test_data/fetch_events.json")
    mocker.patch.object(Client, "get_access_token", return_value={"access_token": "access_token"})
    mocker.patch.object(demisto, "getLastRun", return_value={"fetch_from": "2023-03-15T14:39:13Z", "event_id": "test_id"})
    requests_mock.get(
        "https://test.com/security-events/v1/security-events?serverTimestampStart=2023-03-15T14:39:13Z&limit=100",
        json=mock_response,
    )
    events, _ = fetch_events_command(client, first_fetch="1 day", limit=100)
    for ev in mock_response.get("items"):
        ev["_time"] = ev.get("clientTimestamp")
    expected = [mock_response.get("items")[0]]
    assert len(events) == 1
    assert events == expected