WootCloud

Append HyperContext™ insights to your SIEM data and feed them into your orchestration workflows.

Data Enrichment & Threat Intelligence · WootCloud

Details

IDWootCloud
ProviderNetskope
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Overview

Append HyperContext™ insights to your SIEM data and feed them into your orchestration workflows.
This integration was integrated and tested with version 1.0 of WootCloud

WootCloud Playbook

Configure WootCloud on XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for WootCloud.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Client ID
    • API Key
    • Time to retrieve the first fetch (number time unit, e.g., 12 hours, 7 days)
    • Alert Type
    • Severity Type
    • Trust any certificate (not secure)
  4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. wootcloud-get-pkt-alerts
  2. wootcloud-get-bt-alerts
  3. wootcloud-get-anomaly-alerts
  4. wootcloud-fetch-packet-alert
  5. wootcloud-fetch-bluetooth-alert
  6. wootcloud-fetch-anomaly-alert

1. wootcloud-get-pkt-alerts

list packet alerts generated in requested time span

Base Command

wootcloud-get-pkt-alerts

Input
Argument Name Description Required
date_range Examples are (2 hours, 4 minutes, 6 month, 1 day, etc.) Required
severity severity with values of ‘notice’, ‘warning’, ‘critical’ Optional
skip integer value for pagination. Default value: 0 Optional
limit Integer value for pagination. Default value: 10. Max Value: 500 Optional
site_id Array of site ids. Only entered if you want results for a particular site(s) (building, city, region) Optional
Context Output
Path Type Description
WootCloud.PacketAlert.id String ID of alert
WootCloud.PacketAlert.address String Mac Address of device
WootCloud.PacketAlert.timestamp Date Alert timestamp
WootCloud.PacketAlert.severity String Severity level
WootCloud.PacketAlert.category String Alert Category
WootCloud.PacketAlert.signature String signature
WootCloud.PacketAlert.source.city String source city
WootCloud.PacketAlert.source.continent String source continent
WootCloud.PacketAlert.source.country String source country
WootCloud.PacketAlert.source.ip String source ip
WootCloud.PacketAlert.source.latitude Number source latitude
WootCloud.PacketAlert.source.longitude Number source longitude
WootCloud.PacketAlert.source.mac String source mac address
WootCloud.PacketAlert.source.network String source network
WootCloud.PacketAlert.source.port Number source port
WootCloud.PacketAlert.source.state String source state
WootCloud.PacketAlert.source.subnet String source subnet
WootCloud.PacketAlert.source.time_zone String source time zone
WootCloud.PacketAlert.source.zip String source zip
WootCloud.PacketAlert.source.inferred.device_id String source inferred device ID
WootCloud.PacketAlert.source.inferred.asset String source inferred asset
WootCloud.PacketAlert.source.inferred.managed Number source inferred managed
WootCloud.PacketAlert.source.inferred.category String source inferred category
WootCloud.PacketAlert.source.inferred.control String source inferred control
WootCloud.PacketAlert.source.inferred.host_name String source inferred host name
WootCloud.PacketAlert.source.inferred.os String source inferred OS
WootCloud.PacketAlert.source.inferred.os_version String source inferred OS version
WootCloud.PacketAlert.source.inferred.ownership String source inferred ownership
WootCloud.PacketAlert.source.inferred.total_risk Number source inferred total risk score
WootCloud.PacketAlert.source.inferred.type String source inferred type
WootCloud.PacketAlert.source.inferred.username String source inferred username
WootCloud.PacketAlert.source.inferred.managed_info.host_name String source inferred managed host name
WootCloud.PacketAlert.destination.city String destination city
WootCloud.PacketAlert.destination.continent String destination continent
WootCloud.PacketAlert.destination.country String destination country
WootCloud.PacketAlert.destination.ip String destination ip
WootCloud.PacketAlert.destination.latitude Number destination latitude
WootCloud.PacketAlert.destination.longitude Number destination longitude
WootCloud.PacketAlert.destination.mac String destination mac address
WootCloud.PacketAlert.destination.network String destination network
WootCloud.PacketAlert.destination.port Number destination port
WootCloud.PacketAlert.destination.state String destination state
WootCloud.PacketAlert.destination.subnet String destination subnet
WootCloud.PacketAlert.destination.time_zone String destination time zone
WootCloud.PacketAlert.destination.zip String destination zip
WootCloud.PacketAlert.destination.inferred.device_id String destination inferred device ID
WootCloud.PacketAlert.destination.inferred.asset String destination inferred asset
WootCloud.PacketAlert.destination.inferred.managed Number destination inferred managed
WootCloud.PacketAlert.destination.inferred.category String destination inferred category
WootCloud.PacketAlert.destination.inferred.control String destination inferred control
WootCloud.PacketAlert.destination.inferred.host_name String destination inferred host name
WootCloud.PacketAlert.destination.inferred.os String destination inferred OS
WootCloud.PacketAlert.destination.inferred.os_version String destination inferred OS version
WootCloud.PacketAlert.destination.inferred.ownership String destination inferred ownership
WootCloud.PacketAlert.destination.inferred.total_risk Number destination inferred total risk score
WootCloud.PacketAlert.destination.inferred.type String destination inferred type
WootCloud.PacketAlert.destination.inferred.username String destination inferred username
WootCloud.PacketAlert.destination.inferred.managed_info.host_name String destination inferred managed info hostname
WootCloud.PacketAlert.payload String payload
WootCloud.PacketAlert.http.hostname String http hostname
WootCloud.PacketAlert.http.http_method String http methon
WootCloud.PacketAlert.http.http_user_agent String http user agent
WootCloud.PacketAlert.http.length Number http length
WootCloud.PacketAlert.http.protocol String http protocol
WootCloud.PacketAlert.http.redirect String http redirect
WootCloud.PacketAlert.http.http_refer String http referal
WootCloud.PacketAlert.http.status Number http status code
WootCloud.PacketAlert.http.url String http url
WootCloud.PacketAlert.type String http type
WootCloud.PacketAlert.group String group
WootCloud.PacketAlert.subtype String subtype
WootCloud.PacketAlert.title String title
WootCloud.PacketAlert.description String description
WootCloud.PacketAlert.references String references
Command Example

!wootcloud-get-pkt-alerts date_range="30 days" severity="info" limit="1"

Context Example
{
    "WootCloud.PacketAlert": {
        "total": 936, 
        "packet_alerts": [
            {
                "category": "User Activity Detected", 
                "http": null, 
                "description": "ET POLICY Dropbox.com Offsite File Backup in Use", 
                "subtype": "policy-violation", 
                "timestamp": "2020-10-05T13:24:27Z", 
                "destination": {
                    "city": "Unknown", 
                    "network": "internal", 
                    "zip": "Unknown", 
                    "state": "Unknown", 
                    "ip": "10.10.10.10", 
                    "inferred": {
                        "category": "computer", 
                        "control": "user", 
                        "managed_info": {
                            "host_name": "DESKTOP-73OV7ML"
                        }, 
                        "managed": true, 
                        "type": "computer", 
                        "username": "7c67a2377751", 
                        "os_version": "10", 
                        "host_name": "DESKTOP-73OV7ML", 
                        "ownership": "corporate", 
                        "total_risk": 0, 
                        "device_id": "5b589f43e4b58d191f7e017c", 
                        "os": "windows", 
                        "asset": "managed"
                    }, 
                    "longitude": -1, 
                    "port": 50859, 
                    "mac": "7c:67:a2:37:77:51", 
                    "time_zone": "Unknown", 
                    "country": "Unknown", 
                    "latitude": -1, 
                    "subnet": "10.10.10.10/24", 
                    "continent": "Unknown"
                }, 
                "payload": "FgMBAD8CAAA7AwFfex6KaCWAHK2PAn+AeXKn7gdl3rBlmgEppmvBPra35wDAEwAAE/8BAAEAABcAAAAjAAAACwACAQAWAwELtwsAC7MAC7AABvUwggbxMIIF2aADAgECAhAOMaF7icLT8WQSEL2/oQ1SMA0GCSqGSIb3DQEBCwUAMHAxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xLzAtBgNVBAMTJkRpZ2lDZXJ0IFNIQTIgSGlnaCBBc3N1cmFuY2UgU2VydmVyIENBMB4XDTE4MDgxNjAwMDAwMFoXDTIwMTEwNTEyMDAwMFowfzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xFTATBgNVBAoTDERyb3Bib3gsIEluYzEUMBIGA1UECxMLRHJvcGJveCBPcHMxFjAUBgNVBAMMDSouZHJvcGJveC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDbMZ4kqSOyakq5klpRxzam+Wt1NDdrU7K6adUNPKo5HAvhDTMX5qx20CidioaD7VGtkDcfCnuqhQeuyiThaZppvw+nXjEBZ9FBvSlrvaqtABGMIVFxPeQ0Ak86OGu9KxYoti3vgM6wLUYxm1WdOT985okPvUmJBdi1DE2nzUlBCodJPrKuH9zxJzEWgvXZ68oUn8c6XTqXSbZk2MdubvU3jGci5GIxMfoGFrgIOPlFSlM1iAnKqzF117I2eL29knjj5cuecQpAhH4OrIhJIcirr3t+6HURbkdry/P9Q0dy5/Ne8Xn2t2wj/feIPHgmVqyo8+fQoBLZSjypNw63Sqi/AgMBAAGjggN2MIIDcjAfBgNVHSMEGDAWgBRRaP+QrwIHdTzM2WVkYqISuFlyOzAdBgNVHQ4EFgQU03y5xdpYdTODesRSBFJVHvRuOJ0wJQYDVR0RBB4wHIINKi5kcm9wYm94LmNvbYILZHJvcGJveC5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjB1BgNVHR8EbjBsMDSgMqAwhi5odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vc2hhMi1oYS1zZXJ2ZXItZzYuY3JsMDSgMqAwhi5odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc2hhMi1oYS1zZXJ2ZXItZzYuY3JsMEwGA1UdIARFMEMwNwYJYIZIAYb9bAEBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQICMIGDBggrBgEFBQcBAQR3MHUwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBNBggrBgEFBQcwAoZBaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkhpZ2hBc3N1cmFuY2VTZXJ2ZXJDQS5jcnQwDAYDVR0TAQH/BAIwADCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHcApLkJkLQYWBSHuxOizGdwCjw1mAT5G9+443fNDsgN3BAAAAFlQ9RzuAAABAMASDBGAiEAmkh2i+QsT/lfcmS314gHZ5FDKo6x686OqlYXAGN3tGUCIQC6Nowtjr26Eaa964nnSzxBIuxb2Lk9BRIBtRWymKyAMQB3AId1v+dZfPiMQ5lfvfNu/1aNR1Y2/0q1YMG06v9eoIMPAAABZUPUdJAAAAQDAEgwRgIhANNg1DudKCwm53UCQgMkUyi3s+8zk95CI5afqVg0v4OJAiEAqZPgFVhbt0RQUdwZWWhXH9guhvlqxsP7OOkvCtM25R0AdQC72d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAWVD1HSqAAAEAwBGMEQCIHbIeTdHc/Y2Wt/lNygmKHrmxyt0AeMLd4mBEJh0YXkPAiBfuRw2aRORLrr8ybKkfTYkhAybRNuKPzeYGq+r8b6PgDANBgkqhkiG9w0BAQsFAAOCAQEADSK2wlLwkklQBYZpmmzu3uA1GmTBEW0DWJZoI8TOz+LR4gm+Of8VVDy/7RNA6MLVQq5yHEJLICPvjv8k+8V6LxMfIHWQFhuyfkmlcvrPlO5flKZ78DB8MTJHpLAy2CGcve97gtjKWpLvQ5yOIDfi5ZKIoD7MDKcKKEZej6xZDAJ6tEg23QJgOeGIEJeVXKWsDXu9W24y2vyi5UmEuIe1ipG4AImiUJWA8rXRK/72xph+zLkP/+sTtz3Kl8Dk43Ct845i82BGcFJyrUXWwXW4BHOshVRHvwyXBV/Ow27uDNoZ/7n7sKV8yKRLbc6iJC91GfY7ckhMZbvTGQI8DmfuVQAEtTCCBLEwggOZoAMCAQICEATh56TcXPLzbcArQrhdFZ8wDQYJKoZIhvcNAQELBQAwbDELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2UgRVYgUm9vdCBDQTAeFw0xMzEwMjIxMjAwMDBaFw0yODEwMjIxMjAwMDBaMHAxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xLzAtBgNVBAMTJkRpZ2lDZXJ0IFNIQTIgSGlnaCBBc3N1cmFuY2UgU2VydmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuAvwiQGyG0EX9fvCmQGsn0iJmUWrkJAm87cn592Bz7DMFWHGblPlA5alB9VVrTCAiqv0JjuC0DXxNA7csgUnu+QsRGprtLIuEM62QsL1dWV9UCvyB3tTZxfV7eGUGiZ9Yra0scFH6iXydyksYKELcatpZzHGYKmhQ9eRFgqN4/9NfELCCcyWvW7i56kvVHQJ+LdO0IzowUoxLsozJqsKyMNeMZ75l5xt0o+CPuBtxYWoZ0jEk3l15IIrHWknLrNF7IeRDVlf1MlOdEcCppjGxmSdGgKN8LCUkjLOVqituFdwd2gILghopMmbxRKIUHH7W2b8kgv8wP1omiSUy9e4wIDAQABo4IBSTCCAUUwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEsGA1UdHwREMEIwQKA+oDyGOmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEhpZ2hBc3N1cmFuY2VFVlJvb3RDQS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFFFo/5CvAgd1PMzZZWRiohK4WXI7MB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBCwUAA4IBAQAYipWJA+Zt31z8HWjqSo+D1lEvjWtEFp6sY/XSbmyEmYuqgXGEW+00TrC3eZIpzC2AavCOIOF5pP4DRxPq9YbKWXF99ASWa9NZWD3+0zElXBg4hKPmn4L9jFuYMU7NeJ4a/YXLSaryJw==", 
                "source": {
                    "city": "San Francisco", 
                    "network": "external", 
                    "zip": "94107", 
                    "state": "California", 
                    "ip": "4.4.4.4", 
                    "inferred": {
                        "category": "networking_equipment", 
                        "control": "auto", 
                        "managed_info": {
                            "host_name": ""
                        }, 
                        "managed": false, 
                        "type": "network infrastructure", 
                        "username": "", 
                        "os_version": "", 
                        "host_name": "", 
                        "ownership": "corporate-unmanaged", 
                        "total_risk": 0, 
                        "device_id": "5d73f6a3c250255491ce3839", 
                        "os": "linux", 
                        "asset": "unmanaged"
                    }, 
                    "longitude": -122.3933, 
                    "port": 443, 
                    "mac": "c4:24:56:87:ef:11", 
                    "time_zone": "America/Los_Angeles", 
                    "country": "United States", 
                    "latitude": 37.7697, 
                    "subnet": "", 
                    "continent": "North America"
                }, 
                "type": "pkt_alert", 
                "references": [], 
                "title": "User Activity Detected", 
                "address": "7c:12:a2:45:77:51", 
                "group": "alert", 
                "signature": "ET POLICY Dropbox.com Offsite File Backup in Use", 
                "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxXzQxMTYzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDUifQ==", 
                "severity": "info"
            }
        ]
    }
}
Human Readable Output

Results for alerts

id severity signature timestamp
eyJpIjoiU05XT09UQVBQUFJPRDAxXzQxMTYzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDUifQ== info ET POLICY Dropbox.com Offsite File Backup in Use 2020-10-05T13:24:27Z

2. wootcloud-get-bt-alerts

list bluetooth alerts generated in requested time span

Base Command

wootcloud-get-bt-alerts

Input
Argument Name Description Required
date_range Examples are (2 hours, 4 minutes, 6 month, 1 day, etc.) Required
severity severity with values of ‘notice’, ‘warning’, ‘critical’ Optional
skip integer value for pagination. Default value: 0 Optional
limit Integer value for pagination. Default value: 10. Max Value: 500 Optional
site_id Array of site ids. Only entered if you want results for a particular site(s) (building, city, region) Optional
Context Output
Path Type Description
WootCloud.BluetoothAlert.id String ID
WootCloud.BluetoothAlert.timestamp Date timestamp
WootCloud.BluetoothAlert.severity String severity
WootCloud.BluetoothAlert.signature String signature
WootCloud.BluetoothAlert.description String description
WootCloud.BluetoothAlert.address String address
WootCloud.BluetoothAlert.inferred.device_id String inferred device ID
WootCloud.BluetoothAlert.inferred.asset String inferred asset
WootCloud.BluetoothAlert.inferred.managed Number inferred managed
WootCloud.BluetoothAlert.inferred.category String inferred category
WootCloud.BluetoothAlert.inferred.control String inferred control
WootCloud.BluetoothAlert.inferred.host_name String inferred host name
WootCloud.BluetoothAlert.inferred.os String inferred OS
WootCloud.BluetoothAlert.inferred.os_version String inferred OS version
WootCloud.BluetoothAlert.inferred.ownership String inferred ownership
WootCloud.BluetoothAlert.inferred.total_risk Number inferred total risk score
WootCloud.BluetoothAlert.inferred.type String inferred type
WootCloud.BluetoothAlert.inferred.username String inferred username
WootCloud.BluetoothAlert.inferred.managed_info.host_name String inferred managed info host name
WootCloud.BluetoothAlert.type String type
WootCloud.BluetoothAlert.group String group
WootCloud.BluetoothAlert.subtype String subtype
WootCloud.BluetoothAlert.title String title
Command Example

!wootcloud-get-bt-alerts date_range="30 days" limit="1"

Context Example
{
    "WootCloud.BluetoothAlert": {
        "total": 0, 
        "alerts": []
    }
}
Human Readable Output

Results

alerts total
  0

3. wootcloud-get-anomaly-alerts

list anomaly alerts generated in requested time span

Base Command

wootcloud-get-anomaly-alerts

Input
Argument Name Description Required
date_range Examples are (2 hours, 4 minutes, 6 month, 1 day, etc.) Required
severity severity with values of ‘info, ‘‘notice’, ‘warning’, ‘critical’ Optional
skip integer value for pagination. Default value: 0 Optional
limit Integer value for pagination. Default value: 10. Max Value: 500 Optional
site_id Array of site ids. Only entered if you want results for a particular site(s) (building, city, region) Optional
Context Output
Path Type Description
WootCloud.AnomalyAlert.id String ID
WootCloud.AnomalyAlert.timestamp Date timestamp
WootCloud.AnomalyAlert.anomaly_type String anomaly type
WootCloud.AnomalyAlert.signature String signature
WootCloud.AnomalyAlert.description String description
WootCloud.AnomalyAlert.severity String severity
WootCloud.AnomalyAlert.count Number count
WootCloud.AnomalyAlert.average Number average
WootCloud.AnomalyAlert.minimum Number minimum
WootCloud.AnomalyAlert.maximum Number maximum
WootCloud.AnomalyAlert.standard_deviation Number standard deviation
WootCloud.AnomalyAlert.anomaly_score Number anomaly score
WootCloud.AnomalyAlert.observed_value Number observed value
WootCloud.AnomalyAlert.deviation_from_norm String deviation from the norm
WootCloud.AnomalyAlert.units String units
WootCloud.AnomalyAlert.address String address
WootCloud.AnomalyAlert.type String type
WootCloud.AnomalyAlert.group String group
WootCloud.AnomalyAlert.subtype String subtype
WootCloud.AnomalyAlert.title String title
WootCloud.AnomalyAlert.device_details.device_id String device details device ID
WootCloud.AnomalyAlert.device_details.asset String device details asset
WootCloud.AnomalyAlert.device_details.managed Number device details managed
WootCloud.AnomalyAlert.device_details.category String device details category
WootCloud.AnomalyAlert.device_details.control String device details control
WootCloud.AnomalyAlert.device_details.host_name String device details host name
WootCloud.AnomalyAlert.device_details.os String device details OS
WootCloud.AnomalyAlert.device_details.os_version String device details OS version
WootCloud.AnomalyAlert.device_details.ownership String device details ownership
WootCloud.AnomalyAlert.device_details.total_risk Number device details total risk score
WootCloud.AnomalyAlert.device_details.type String device details type
WootCloud.AnomalyAlert.device_details.username String device details username
WootCloud.AnomalyAlert.device_details.managed_info.host_name String device details managed info host name
WootCloud.AnomalyAlert.connections.ip String connections ip
WootCloud.AnomalyAlert.connections.port Number connections port
WootCloud.AnomalyAlert.connections.connection_count Number connections connection count
Command Example

!wootcloud-get-anomaly-alerts date_range="30 days" limit="5"

Context Example
{
    "WootCloud.AnomalyAlert": {
        "total": 11, 
        "alerts": [
            {
                "anomaly_type": "Connection", 
                "maximum": 0, 
                "connections": [
                    {
                        "ip": "2.2.2.2", 
                        "connection_count": 0, 
                        "port": 443
                    }, 
                    {
                        "ip": "3.3.3.3", 
                        "connection_count": 0, 
                        "port": 443
                    }, 
                    {
                        "ip": "4.4.4.4", 
                        "connection_count": 0, 
                        "port": 443
                    }
                ], 
                "deviation_from_norm": "2", 
                "minimum": 0, 
                "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxV4JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDE3NDQ4OTcuNzg0NTg0LDI2ODkzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDMifQ==", 
                "group": "anomaly", 
                "severity": "low", 
                "title": "Connection Anomaly", 
                "standard_deviation": 0, 
                "units": "", 
                "type": "realtime-anomaly", 
                "observed_value": 0, 
                "description": "Realtime Connection anomaly (1-min) triggered based on combination of 3 attributes:\nnumber of connections:15 (normally:2.44+/-1.40)\nnumber of destination ips:14 (normally:1.93+/-1.05)\nnumber of destination ports:3 (normally:1.89+/-0.96)\nnormal is based on 26,893 observations.", 
                "timestamp": "2020-10-03T17:08:17Z", 
                "address": "3c:a9:f4:64:06:e0", 
                "count": 26893, 
                "average": 0, 
                "anomaly_score": 0.41364444218713525, 
                "subtype": "realtime_p002", 
                "device_details": {
                    "category": "computer", 
                    "control": "auto", 
                    "managed_info": {
                        "host_name": "DESKTOP-EV123JG"
                    }, 
                    "managed": true, 
                    "type": "computer", 
                    "username": "3ca9f46406e0", 
                    "os_version": "10", 
                    "host_name": "DESKTOP-EV123JG", 
                    "ownership": "corporate", 
                    "total_risk": 0, 
                    "device_id": "5b4c3c91072c98142d308b29", 
                    "os": "windows", 
                    "asset": "managed"
                }, 
                "signature": "realtime_p002:pktstats3|1-min|"
            }, 
            {
                "anomaly_type": "Connection", 
                "maximum": 0, 
                "connections": [
                    {
                        "ip": "4.4.4.4", 
                        "connection_count": 0, 
                        "port": 443
                    }, 
                    {
                        "ip": "3.3.3.3", 
                        "connection_count": 0, 
                        "port": 443
                    }
                ], 
                "deviation_from_norm": "2", 
                "minimum": 0, 
                "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDE2NjM0MTIuNzQ4MiwyNTYzM18wMDAiLCJ4IjoiNWEwMGIxNzU5Yzc5NjQ4ODBmYTFjMWE2X2NfZDIwMjAxMDAyIn0=", 
                "group": "anomaly", 
                "severity": "low", 
                "title": "Connection Anomaly", 
                "standard_deviation": 0, 
                "units": "", 
                "type": "realtime-anomaly", 
                "observed_value": 0, 
                "description": "Realtime Connection anomaly (1-min) triggered based on combination of 3 attributes:\nnumber of connections:16 (normally:2.58+/-1.52)\nnumber of destination ips:14 (normally:2.03+/-1.14)\nnumber of destination ports:3 (normally:1.92+/-0.93)\nnormal is based on 25,633 observations.", 
                "timestamp": "2020-10-02T18:30:12Z", 
                "address": "3c:a9:f4:64:06:e0", 
                "count": 25633, 
                "average": 0, 
                "anomaly_score": 0.41364444218713525, 
                "subtype": "realtime_p002", 
                "device_details": {
                    "category": "computer", 
                    "control": "auto", 
                    "managed_info": {
                        "host_name": "DESKTOP-EV607JG"
                    }, 
                    "managed": true, 
                    "type": "computer", 
                    "username": "3ca9f46406e0", 
                    "os_version": "10", 
                    "host_name": "DESKTOP-EV607JG", 
                    "ownership": "corporate", 
                    "total_risk": 0, 
                    "device_id": "5b4c3c91072c98142d308b29", 
                    "os": "windows", 
                    "asset": "managed"
                }, 
                "signature": "realtime_p002:pktstats3|1-min|"
            }, 
            {
                "anomaly_type": "Connection", 
                "maximum": 0, 
                "connections": [
                    {
                        "ip": "8.8.8.8", 
                        "connection_count": 0, 
                        "port": 53
                    }, 
                    {
                        "ip": "2.2.2.2", 
                        "connection_count": 0, 
                        "port": 80
                    }, 
                    {
                        "ip": "3.3.3.3", 
                        "connection_count": 0, 
                        "port": 80
                    },
                ], 
                "deviation_from_norm": "4", 
                "minimum": 0, 
                "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDAwOjBjOjI5OjBjOjY0Ojk2LDE2MDE1NTkxODcuMTE1MjY1LDI1NTAyXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDEifQ==", 
                "group": "anomaly", 
                "severity": "medium", 
                "title": "Connection Anomaly", 
                "standard_deviation": 0, 
                "units": "", 
                "type": "realtime-anomaly", 
                "observed_value": 0, 
                "description": "Realtime Connection anomaly (1-min) triggered based on combination of 3 attributes:\nnumber of connections:28 (normally:1.67+/-1.88)\nnumber of destination ips:11 (normally:1.15+/-0.57)\nnumber of destination ports:3 (normally:1.07+/-0.27)\nnormal is based on 25,502 observations.", 
                "timestamp": "2020-10-01T13:33:07Z", 
                "address": "00:0c:29:0c:64:96", 
                "count": 25502, 
                "average": 0, 
                "anomaly_score": 0.7064193203972353, 
                "subtype": "realtime_p002", 
                "device_details": {
                    "category": "computer", 
                    "control": "user", 
                    "managed_info": {
                        "host_name": ""
                    }, 
                    "managed": false, 
                    "type": "computer", 
                    "username": "", 
                    "os_version": "", 
                    "host_name": "WOOTAPP", 
                    "ownership": "visiting", 
                    "total_risk": 0, 
                    "device_id": "5ea36ccd5c727ddfb1742471", 
                    "os": "windows", 
                    "asset": "unmanaged"
                }, 
                "signature": "realtime_p002:pktstats3|1-min|"
            }, 
            {
                "anomaly_type": "Connection", 
                "maximum": 0, 
                "connections": [
                    {
                        "ip": "3.3.3.3", 
                        "connection_count": 0, 
                        "port": 80
                    }, 
                    {
                        "ip": "8.8.4.4", 
                        "connection_count": 0, 
                        "port": 443
                    }, 
                    {
                        "ip": "8.8.8.8", 
                        "connection_count": 0, 
                        "port": 53
                    }
                ], 
                "deviation_from_norm": "2", 
                "minimum": 0, 
                "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDEzODg4NTAuMjQ0ODM5LDIzMjQzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDA5MjkifQ==", 
                "group": "anomaly", 
                "severity": "low", 
                "title": "Connection Anomaly", 
                "standard_deviation": 0, 
                "units": "", 
                "type": "realtime-anomaly", 
                "observed_value": 0, 
                "description": "Realtime Connection anomaly (1-min) triggered based on combination of 3 attributes:\nnumber of connections:17 (normally:2.70+/-1.43)\nnumber of destination ips:16 (normally:2.15+/-1.11)\nnumber of destination ports:3 (normally:2.09+/-0.97)\nnormal is based on 23,243 observations.", 
                "timestamp": "2020-09-29T14:14:10Z", 
                "address": "3c:a9:f4:64:06:e0", 
                "count": 23243, 
                "average": 0, 
                "anomaly_score": 0.41364444218713525, 
                "subtype": "realtime_p002", 
                "device_details": {
                    "category": "computer", 
                    "control": "auto", 
                    "managed_info": {
                        "host_name": "DESKTOP-EV607JG"
                    }, 
                    "managed": true, 
                    "type": "computer", 
                    "username": "3ca9f46406e0", 
                    "os_version": "10", 
                    "host_name": "DESKTOP-EV607JG", 
                    "ownership": "corporate", 
                    "total_risk": 0, 
                    "device_id": "5b4c3c91072c98142d308b29", 
                    "os": "windows", 
                    "asset": "managed"
                }, 
                "signature": "realtime_p002:pktstats3|1-min|"
            }, 
            {
                "anomaly_type": "Connection", 
                "maximum": 0, 
                "connections": [
                    {
                        "ip": "8.8.8.8", 
                        "connection_count": 0, 
                        "port": 53
                    }, 
                    {
                        "ip": "3.3.3.3", 
                        "connection_count": 0, 
                        "port": 80
                    }, 
                    {
                        "ip": "4.4.4.4", 
                        "connection_count": 0, 
                        "port": 80
                    }, 
                    {
                        "ip": "5.5.5.5", 
                        "connection_count": 0, 
                        "port": 80
                    }
                ], 
                "deviation_from_norm": "4", 
                "minimum": 0, 
                "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDAwOjBjOjI5OjFhOjdmOmU5LDE2MDEzMzQ1NzQuNTQ1MzAzLDQzMzgzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDA5MjgifQ==", 
                "group": "anomaly", 
                "severity": "medium", 
                "title": "Connection Anomaly", 
                "standard_deviation": 0, 
                "units": "", 
                "type": "realtime-anomaly", 
                "observed_value": 0, 
                "description": "Realtime Connection anomaly (1-min) triggered based on combination of 3 attributes:\nnumber of connections:48 (normally:4.17+/-1.60)\nnumber of destination ips:10 (normally:1.29+/-0.47)\nnumber of destination ports:4 (normally:1.29+/-0.46)\nnormal is based on 43,383 observations.", 
                "timestamp": "2020-09-28T23:09:34Z", 
                "address": "00:0c:29:1a:7f:e9", 
                "count": 43383, 
                "average": 0, 
                "anomaly_score": 0.7064193203972353, 
                "subtype": "realtime_p002", 
                "device_details": {
                    "category": "computer", 
                    "control": "user", 
                    "managed_info": {
                        "host_name": ""
                    }, 
                    "managed": false, 
                    "type": "computer", 
                    "username": "", 
                    "os_version": "", 
                    "host_name": "WOOTAPP", 
                    "ownership": "visiting", 
                    "total_risk": 0, 
                    "device_id": "5ecd43f95c727ddfb186fac0", 
                    "os": "windows", 
                    "asset": "unmanaged"
                }, 
                "signature": "realtime_p002:pktstats3|1-min|"
            }
        ]
    }
}
Human Readable Output

Results for alerts

id severity signature timestamp
eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDE3NDQ4OTcuNzg0NTg0LDI2ODkzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDMifQ== low realtime_p002:pktstats3|1-min| 2020-10-03T17:08:17Z
eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDE2NjM0MTIuNzQ4MiwyNTYzM18wMDAiLCJ4IjoiNWEwMGIxNzU5Yzc5NjQ4ODBmYTFjMWE2X2NfZDIwMjAxMDAyIn0= low realtime_p002:pktstats3|1-min| 2020-10-02T18:30:12Z
eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDAwOjBjOjI5OjBjOjY0Ojk2LDE2MDE1NTkxODcuMTE1MjY1LDI1NTAyXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDEifQ== medium realtime_p002:pktstats3|1-min| 2020-10-01T13:33:07Z
eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDEzODg4NTAuMjQ0ODM5LDIzMjQzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDA5MjkifQ== low realtime_p002:pktstats3|1-min| 2020-09-29T14:14:10Z
eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDAwOjBjOjI5OjFhOjdmOmU5LDE2MDEzMzQ1NzQuNTQ1MzAzLDQzMzgzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDA5MjgifQ== medium realtime_p002:pktstats3|1-min| 2020-09-28T23:09:34Z

4. wootcloud-fetch-packet-alert

retrieve single packet alert given packet id

Base Command

wootcloud-fetch-packet-alert

Input
Argument Name Description Required
alert_id the ID of the packet alert Required
Context Output
Path Type Description
WootCloud.PacketAlert.id String ID of alert
WootCloud.PacketAlert.address String Mac Address of device
WootCloud.PacketAlert.timestamp Date Alert timestamp
WootCloud.PacketAlert.severity String Severity level
WootCloud.PacketAlert.category String Alert Category
WootCloud.PacketAlert.signature String signature
WootCloud.PacketAlert.source.city String source city
WootCloud.PacketAlert.source.continent String source continent
WootCloud.PacketAlert.source.country String source country
WootCloud.PacketAlert.source.ip String source ip
WootCloud.PacketAlert.source.latitude Number source latitude
WootCloud.PacketAlert.source.longitude Number source longitude
WootCloud.PacketAlert.source.mac String source mac address
WootCloud.PacketAlert.source.network String source network
WootCloud.PacketAlert.source.port Number source port
WootCloud.PacketAlert.source.state String source state
WootCloud.PacketAlert.source.subnet String source subnet
WootCloud.PacketAlert.source.time_zone String source time zone
WootCloud.PacketAlert.source.zip String source zip
WootCloud.PacketAlert.source.inferred.device_id String source inferred device ID
WootCloud.PacketAlert.source.inferred.asset String source inferred asset
WootCloud.PacketAlert.source.inferred.managed Number source inferred managed
WootCloud.PacketAlert.source.inferred.category String source inferred category
WootCloud.PacketAlert.source.inferred.control String source inferred control
WootCloud.PacketAlert.source.inferred.host_name String source inferred host name
WootCloud.PacketAlert.source.inferred.os String source inferred OS
WootCloud.PacketAlert.source.inferred.os_version String source inferred OS version
WootCloud.PacketAlert.source.inferred.ownership String source inferred ownership
WootCloud.PacketAlert.source.inferred.total_risk Number source inferred total risk score
WootCloud.PacketAlert.source.inferred.type String source inferred type
WootCloud.PacketAlert.source.inferred.username String source inferred username
WootCloud.PacketAlert.source.inferred.managed_info.host_name String source inferred managed host name
WootCloud.PacketAlert.destination.city String destination city
WootCloud.PacketAlert.destination.continent String destination continent
WootCloud.PacketAlert.destination.country String destination country
WootCloud.PacketAlert.destination.ip String destination ip
WootCloud.PacketAlert.destination.latitude Number destination latitude
WootCloud.PacketAlert.destination.longitude Number destination longitude
WootCloud.PacketAlert.destination.mac String destination mac address
WootCloud.PacketAlert.destination.network String destination network
WootCloud.PacketAlert.destination.port Number destination port
WootCloud.PacketAlert.destination.state String destination state
WootCloud.PacketAlert.destination.subnet String destination subnet
WootCloud.PacketAlert.destination.time_zone String destination time zone
WootCloud.PacketAlert.destination.zip String destination zip
WootCloud.PacketAlert.destination.inferred.device_id String destination inferred device ID
WootCloud.PacketAlert.destination.inferred.asset String destination inferred asset
WootCloud.PacketAlert.destination.inferred.managed Number destination inferred managed
WootCloud.PacketAlert.destination.inferred.category String destination inferred category
WootCloud.PacketAlert.destination.inferred.control String destination inferred control
WootCloud.PacketAlert.destination.inferred.host_name String destination inferred host name
WootCloud.PacketAlert.destination.inferred.os String destination inferred OS
WootCloud.PacketAlert.destination.inferred.os_version String destination inferred OS version
WootCloud.PacketAlert.destination.inferred.ownership String destination inferred ownership
WootCloud.PacketAlert.destination.inferred.total_risk Number destination inferred total risk score
WootCloud.PacketAlert.destination.inferred.type String destination inferred type
WootCloud.PacketAlert.destination.inferred.username String destination inferred username
WootCloud.PacketAlert.destination.inferred.managed_info.host_name String destination inferred managed info hostname
WootCloud.PacketAlert.payload String payload
WootCloud.PacketAlert.http.hostname String http hostname
WootCloud.PacketAlert.http.http_method String http methon
WootCloud.PacketAlert.http.http_user_agent String http user agent
WootCloud.PacketAlert.http.length Number http length
WootCloud.PacketAlert.http.protocol String http protocol
WootCloud.PacketAlert.http.redirect String http redirect
WootCloud.PacketAlert.http.http_refer String http referal
WootCloud.PacketAlert.http.status Number http status code
WootCloud.PacketAlert.http.url String http url
WootCloud.PacketAlert.type String http type
WootCloud.PacketAlert.group String group
WootCloud.PacketAlert.subtype String subtype
WootCloud.PacketAlert.title String title
WootCloud.PacketAlert.description String description
WootCloud.PacketAlert.references String references
Command Example

!wootcloud-fetch-packet-alert alert_id="eyJpIjoiU05XT09UQVBQUFJPRDAxXzI2MzY1XzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDQifQ=="

Context Example
{
    "WootCloud.PacketAlert": {
        "category": "Generic Protocol Command Decode", 
        "http": {
            "redirect": "https://api-wootuno-1606049077.us-west-2.elb.amazonaws.com:443/wpad.dat", 
            "status": 301, 
            "http_user_agent": "WinHttp-Autoproxy-Service/5.1", 
            "protocol": "HTTP/1.1", 
            "http_refer": "", 
            "url": "/wpad.dat", 
            "hostname": "api-wootuno-1606049077.us-west-2.elb.amazonaws.com", 
            "length": 134, 
            "http_method": "GET"
        }, 
        "description": "ET INFO WinHttp AutoProxy Request wpad.dat Possible BadTunnel", 
        "subtype": "protocol-command-decode", 
        "timestamp": "2020-10-04T04:09:05Z", 
        "destination": {
            "city": "Boardman", 
            "network": "external", 
            "zip": "97818", 
            "state": "Oregon", 
            "ip": "3.3.3.3", 
            "inferred": {
                "category": "networking_equipment", 
                "control": "auto", 
                "managed_info": {
                    "host_name": ""
                }, 
                "managed": false, 
                "type": "network infrastructure", 
                "username": "", 
                "os_version": "", 
                "host_name": "", 
                "ownership": "corporate-unmanaged", 
                "total_risk": 0, 
                "device_id": "5d73f6a3c250255491ce3839", 
                "os": "linux", 
                "asset": "unmanaged"
            }, 
            "longitude": -119.688, 
            "port": 80, 
            "mac": "c4:24:56:87:ef:11", 
            "time_zone": "America/Los_Angeles", 
            "country": "United States", 
            "latitude": 45.8696, 
            "subnet": "", 
            "continent": "North America"
        }, 
        "payload": "R0VUIC93cGFkLmRhdCBIVFRQLzEuMQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KQWNjZXB0OiAqLyoNClVzZXItQWdlbnQ6IFdpbkh0dHAtQXV0b3Byb3h5LVNlcnZpY2UvNS4xDQpIb3N0OiBhcGktd29vdHVuby0xNjA2MDQ5MDc3LnVzLXdlc3QtMi5lbGIuYW1hem9uYXdzLmNvbQ0KDQo=", 
        "source": {
            "city": "Unknown", 
            "network": "internal", 
            "zip": "Unknown", 
            "state": "Unknown", 
            "ip": "10.10.10.10", 
            "inferred": {
                "category": "computer", 
                "control": "auto", 
                "managed_info": {
                    "host_name": "DESKTOP-EV607JG"
                }, 
                "managed": true, 
                "type": "computer", 
                "username": "3ca9f46406e0", 
                "os_version": "10", 
                "host_name": "DESKTOP-EV607JG", 
                "ownership": "corporate", 
                "total_risk": 0, 
                "device_id": "5b4c3c91072c98142d308b29", 
                "os": "windows", 
                "asset": "managed"
            }, 
            "longitude": -1, 
            "port": 63202, 
            "mac": "3c:a9:f4:64:06:e0", 
            "time_zone": "Unknown", 
            "country": "Unknown", 
            "latitude": -1, 
            "subnet": "10.10.10.10/24", 
            "continent": "Unknown"
        }, 
        "type": "pkt_alert", 
        "references": [], 
        "title": "Generic Protocol Command Decode", 
        "address": "3c:a9:f4:64:06:e0", 
        "group": "alert", 
        "signature": "ET INFO WinHttp AutoProxy Request wpad.dat Possible BadTunnel", 
        "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxXzI2MzY1XzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDQifQ==", 
        "severity": "info"
    }
}
Human Readable Output

Results

address category description destination group http id payload references severity signature source subtype timestamp title type
3c:a9:f4:64:06:e0 Generic Protocol Command Decode ET INFO WinHttp AutoProxy Request wpad.dat Possible BadTunnel city: Boardman
continent: North America
country: United States
ip: 3.3.3.3
latitude: 45.8696
longitude: -119.688
mac: c4:24:56:87:ef:11
network: external
port: 80
state: Oregon
subnet:
time_zone: America/Los_Angeles
zip: 97818
inferred: {“device_id”: “5d73f6a3c250255491ce3839”, “asset”: “unmanaged”, “managed”: false, “category”: “networking_equipment”, “control”: “auto”, “host_name”: “”, “os”: “linux”, “os_version”: “”, “ownership”: “corporate-unmanaged”, “total_risk”: 0, “type”: “network infrastructure”, “username”: “”, “managed_info”: {“host_name”: “”}}		 alert hostname: api-wootuno-1606049077.us-west-2.elb.amazonaws.com
http_method: GET
http_user_agent: WinHttp-Autoproxy-Service/5.1
length: 134
protocol: HTTP/1.1
redirect: https://api-wootuno-1606049077.us-west-2.elb.amazonaws.com:443/wpad.dat
http_refer:
status: 301
url: /wpad.dat		 eyJpIjoiU05XT09UQVBQUFJPRDAxXzI2MzY1XzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDQifQ== R0VUIC93cGFkLmRhdCBIVFRQLzEuMQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KQWNjZXB0OiAqLyoNClVzZXItQWdlbnQ6IFdpbkh0dHAtQXV0b3Byb3h5LVNlcnZpY2UvNS4xDQpIb3N0OiBhcGktd29vdHVuby0xNjA2MDQ5MDc3LnVzLXdlc3QtMi5lbGIuYW1hem9uYXdzLmNvbQ0KDQo=   info ET INFO WinHttp AutoProxy Request wpad.dat Possible BadTunnel city: Unknown
continent: Unknown
country: Unknown
ip: 10.10.10.10
latitude: -1
longitude: -1
mac: 3c:a9:f4:64:06:e0
network: internal
port: 63202
state: Unknown
subnet: 10.10.10.10/24
time_zone: Unknown
zip: Unknown
inferred: {“device_id”: “5b4c3c91072c98142d308b29”, “asset”: “managed”, “managed”: true, “category”: “computer”, “control”: “auto”, “host_name”: “DESKTOP-EV607JG”, “os”: “windows”, “os_version”: “10”, “ownership”: “corporate”, “total_risk”: 0, “type”: “computer”, “username”: “3ca9f46406e0”, “managed_info”: {“host_name”: “DESKTOP-EV607JG”}}		 protocol-command-decode 2020-10-04T04:09:05Z Generic Protocol Command Decode pkt_alert

5. wootcloud-fetch-bluetooth-alert

retrieve single bluetooth alert given packet id

Base Command

wootcloud-fetch-bluetooth-alert

Input
Argument Name Description Required
alert_id the ID of the bluetooth alert Required
Context Output
Path Type Description
WootCloud.BluetoothAlert.id String ID
WootCloud.BluetoothAlert.timestamp Date timestamp
WootCloud.BluetoothAlert.severity String severity
WootCloud.BluetoothAlert.signature String signature
WootCloud.BluetoothAlert.description String description
WootCloud.BluetoothAlert.address String address
WootCloud.BluetoothAlert.inferred.device_id String inferred device ID
WootCloud.BluetoothAlert.inferred.asset String inferred asset
WootCloud.BluetoothAlert.inferred.managed Number inferred managed
WootCloud.BluetoothAlert.inferred.category String inferred category
WootCloud.BluetoothAlert.inferred.control String inferred control
WootCloud.BluetoothAlert.inferred.host_name String inferred host name
WootCloud.BluetoothAlert.inferred.os String inferred OS
WootCloud.BluetoothAlert.inferred.os_version String inferred OS version
WootCloud.BluetoothAlert.inferred.ownership String inferred ownership
WootCloud.BluetoothAlert.inferred.total_risk Number inferred total risk score
WootCloud.BluetoothAlert.inferred.type String inferred type
WootCloud.BluetoothAlert.inferred.username String inferred username
WootCloud.BluetoothAlert.inferred.managed_info.host_name String inferred managed info host name
WootCloud.BluetoothAlert.type String type
WootCloud.BluetoothAlert.group String group
WootCloud.BluetoothAlert.subtype String subtype
WootCloud.BluetoothAlert.title String title
Command Example

!wootcloud-fetch-bluetooth-alert alert_id="EXMP001"

Human Readable Output

6. wootcloud-fetch-anomaly-alert

retrieve single anomaly alert given packet id

Base Command

wootcloud-fetch-anomaly-alert

Input
Argument Name Description Required
alert_id the ID of the anomaly alert Required
Context Output
Path Type Description
WootCloud.AnomalyAlert.id String ID
WootCloud.AnomalyAlert.timestamp Date timestamp
WootCloud.AnomalyAlert.anomaly_type String anomaly type
WootCloud.AnomalyAlert.signature String signature
WootCloud.AnomalyAlert.description String description
WootCloud.AnomalyAlert.severity String severity
WootCloud.AnomalyAlert.count Number count
WootCloud.AnomalyAlert.average Number average
WootCloud.AnomalyAlert.minimum Number minimum
WootCloud.AnomalyAlert.maximum Number maximum
WootCloud.AnomalyAlert.standard_deviation Number standard deviation
WootCloud.AnomalyAlert.anomaly_score Number anomaly score
WootCloud.AnomalyAlert.observed_value Number observed value
WootCloud.AnomalyAlert.deviation_from_norm String deviation from the norm
WootCloud.AnomalyAlert.units String units
WootCloud.AnomalyAlert.address String address
WootCloud.AnomalyAlert.type String type
WootCloud.AnomalyAlert.group String group
WootCloud.AnomalyAlert.subtype String subtype
WootCloud.AnomalyAlert.title String title
WootCloud.AnomalyAlert.device_details.device_id String device details device ID
WootCloud.AnomalyAlert.device_details.asset String device details asset
WootCloud.AnomalyAlert.device_details.managed Number device details managed
WootCloud.AnomalyAlert.device_details.category String device details category
WootCloud.AnomalyAlert.device_details.control String device details control
WootCloud.AnomalyAlert.device_details.host_name String device details host name
WootCloud.AnomalyAlert.device_details.os String device details OS
WootCloud.AnomalyAlert.device_details.os_version String device details OS version
WootCloud.AnomalyAlert.device_details.ownership String device details ownership
WootCloud.AnomalyAlert.device_details.total_risk Number device details total risk score
WootCloud.AnomalyAlert.device_details.type String device details type
WootCloud.AnomalyAlert.device_details.username String device details username
WootCloud.AnomalyAlert.device_details.managed_info.host_name String device details managed info host name
WootCloud.AnomalyAlert.connections.ip String connections ip
WootCloud.AnomalyAlert.connections.port Number connections port
WootCloud.AnomalyAlert.connections.connection_count Number connections connection count
Command Example

!wootcloud-fetch-anomaly-alert alert_id="eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDE3NDQ4OTcuNzg0NTg0LDI2ODkzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDMifQ==" "

Context Example
{
    "WootCloud.AnomalyAlert": {
        "anomaly_type": "Connection", 
        "maximum": 0, 
        "connections": [
            {
                "ip": "2.2.2.2", 
                "connection_count": 0, 
                "port": 443
            }, 
            {
                "ip": "3.3.3.3", 
                "connection_count": 0, 
                "port": 443
            }, 
            {
                "ip": "4.4.4.4", 
                "connection_count": 0, 
                "port": 443
            }
        ], 
        "deviation_from_norm": "2", 
        "minimum": 0, 
        "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDE3NDQ4OTcuNzg0NTg0LDI2ODkzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDMifQ==", 
        "group": "anomaly", 
        "severity": "low", 
        "title": "Connection Anomaly", 
        "standard_deviation": 0, 
        "units": "", 
        "type": "realtime-anomaly", 
        "observed_value": 0, 
        "description": "Realtime Connection anomaly (1-min) triggered based on combination of 3 attributes:\nnumber of connections:15 (normally:2.44+/-1.40)\nnumber of destination ips:14 (normally:1.93+/-1.05)\nnumber of destination ports:3 (normally:1.89+/-0.96)\nnormal is based on 26,893 observations.", 
        "timestamp": "2020-10-03T17:08:17Z", 
        "address": "3c:a9:f4:64:06:e0", 
        "count": 26893, 
        "average": 0, 
        "anomaly_score": 0.41364444218713525, 
        "subtype": "realtime_p002", 
        "device_details": {
            "category": "computer", 
            "control": "auto", 
            "managed_info": {
                "host_name": "DESKTOP-EV607JG"
            }, 
            "managed": true, 
            "type": "computer", 
            "username": "3ca9f46406e0", 
            "os_version": "10", 
            "host_name": "DESKTOP-EV607JG", 
            "ownership": "corporate", 
            "total_risk": 0, 
            "device_id": "5b4c3c91072c98142d308b29", 
            "os": "windows", 
            "asset": "managed"
        }, 
        "signature": "realtime_p002:pktstats3|1-min|"
    }
}
Human Readable Output

Results

address anomaly_score anomaly_type average connections count description deviation_from_norm device_details group id maximum minimum observed_value severity signature standard_deviation subtype timestamp title type units
3c:a9:f4:64:06:e0 0.41364444218713525 Connection 0 {‘ip’: ‘2.2.2.2’, ‘port’: 443, ‘connection_count’: 0},
{‘ip’: ‘3.3.3.3’, ‘port’: 443, ‘connection_count’: 0},
{‘ip’: ‘4.4.4.4’, ‘port’: 443, ‘connection_count’: 0},
{‘ip’: ‘2.2.2.2’, ‘port’: 443, ‘connection_count’: 0}		 26893 Realtime Connection anomaly (1-min) triggered based on combination of 3 attributes:
number of connections:15 (normally:2.44+/-1.40)
number of destination ips:14 (normally:1.93+/-1.05)
number of destination ports:3 (normally:1.89+/-0.96)
normal is based on 26,893 observations.		 2 device_id: 5b4c3c91072c98142d308b29
asset: managed
managed: true
category: computer
control: auto
host_name: DESKTOP-EV607JG
os: windows
os_version: 10
ownership: corporate
total_risk: 0
type: computer
username: 3ca9f46406e0
managed_info: {“host_name”: “DESKTOP-EV607JG”}		 anomaly eyJpIjoiU05XT09UQVBQUFJPRDAxX3JlYWx0aW1lX3AwMDIscGt0c3RhdHMzLDNjOmE5OmY0OjY0OjA2OmUwLDE2MDE3NDQ4OTcuNzg0NTg0LDI2ODkzXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDEwMDMifQ== 0 0 0 low realtime_p002:pktstats3|1-min| 0 realtime_p002 2020-10-03T17:08:17Z Connection Anomaly realtime-anomaly  

Configuration parameters

  • client_id — Client ID (required)
  • secret_key — API Key (required)
  • fetch_time — Time to retrieve the first fetch (<number> <time unit>, e.g., 12 hours, 7 days)
  • alert_type — Alert Type (required)
  • severity_type — Severity Type
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • insecure — Trust any certificate (not secure)

Commands (6)

  • wootcloud-fetch-anomaly-alert

    retrieve single anomaly alert given packet id

  • wootcloud-fetch-bluetooth-alert

    retrieve single bluetooth alert given packet id

  • wootcloud-fetch-packet-alert

    retrieve single packet alert given packet id

  • wootcloud-get-anomaly-alerts

    list anomaly alerts generated in requested time span

  • wootcloud-get-bt-alerts

    list bluetooth alerts generated in requested time span

  • wootcloud-get-pkt-alerts

    list packet alerts generated in requested time span

Source

WootCloud.py WootCloud_test.py WootCloud.yml WootCloud_description.md command_examples.txt
Download History Raw 
from WootCloud import Client, fetch_incidents, fetch_single_alert

MOCK_URL = "https://api_mock.wootcloud.com"
MOCK_START = "2019-06-25T08:00:00Z"
MOCK_END = "2019-06-27T08:00:00Z"

MOCK_HEADERS = {"Content-Type": "application/json", "Accept": "application/json", "Host": "api.wootuno.wootcloud.com"}

MOCK_PKT_ALERT = {
    "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxXzEzMzIxNThfMDAwIiwidCI6IjIwMTktMDYtMjZUMjA6MjQ6MjZaIn0=",
    "timestamp": "2019-06-26T20:24:26Z",
    "severity": "warning",
    "category": "Adminstrator Privilege gain attempted",
    "signature": "ET POLICY IP Check Domain (whatismyip in HTTP Host)",
    "source": {
        "city": "Unknown",
        "continent": "Unknown",
        "country": "Unknown",
        "ip": "192.168.1.193",
        "latitude": -1,
        "longitude": -1,
        "mac": "cc:cc:cc:bc:7c:01",
        "network": "internal",
        "port": 61079,
        "state": "Unknown",
        "subnet": "192.168.1.0/24",
        "time_zone": "Unknown",
        "zip": "Unknown",
        "inferred": {
            "device_id": "5b4c3c91072c98142d308c31",
            "asset": "managed",
            "managed": "true",
            "category": "mobile_phone",
            "control": "user",
            "host_name": "Shahabs-iPhone",
            "os": "ios",
            "os_version": "12.1.4",
            "ownership": "corporate",
            "total_risk": 18.188051551163394,
            "type": "smart phone",
            "username": "",
            "managed_info": {"host_name": "Shahabs-iPhone"},
        },
    },
    "destination": {
        "city": "Cambridge",
        "continent": "North America",
        "country": "United States",
        "ip": "192.168.1.22",
        "latitude": 42.3626,
        "longitude": -71.0843,
        "mac": "cc:cc:cc:cc:c3:c0",
        "network": "external",
        "port": 80,
        "state": "Massachusetts",
        "subnet": "",
        "time_zone": "America/New_York",
        "zip": "02142",
        "inferred": {
            "device_id": "",
            "asset": "unmanaged",
            "managed": "false",
            "category": "",
            "control": "",
            "host_name": "",
            "os": "",
            "os_version": "",
            "ownership": "",
            "total_risk": 0,
            "type": "",
            "username": "",
            "managed_info": {"host_name": ""},
        },
    },
    "payload": "",
}


ANOMALY_ALERT = {
    "id": "eyJpIjoibWxub2RlX3AwMDhfY2F0LGY4OjJkOjdjOjJmOjQzOjdjLHVua==",
    "timestamp": "2019-05-02T08:00:00Z",
    "anomaly_type": "bytes_received",
    "signature": "60 (minutes) 'bytes_received'",
    "description": "Anomaly: 60 minutes unknown-protocol was significantly more than average during this time",
    "severity": "warning",
    "count": 1,
    "average": 0,
    "minimum": 0,
    "maximum": 0,
    "standard_deviation": 0,
    "anomaly_score": 1,
    "observed_value": 805,
    "deviation_from_norm": "8050.0",
    "units": "bytes",
    "address": "f8:2d:7c:2f:43:7c",
    "device_details": {
        "device_id": "5cc31d4b954fbc0e96c84eff",
        "asset": "unmanaged",
        "managed": "false",
        "category": "mobile_phone",
        "control": "user",
        "host_name": "iPhone",
        "os": "ios",
        "os_version": "",
        "ownership": "employee-owned",
        "total_risk": 0.008771929824570352,
        "type": "smart phone",
        "username": "",
        "managed_info": {"host_name": ""},
        "ip": "",
        "network": "",
    },
}


FETCH_ALERTS = {
    "total": 199,
    "packet_alerts": [
        {
            "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxXzEyNzY5XzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDAzMTQifQ==",
            "address": "7c:67:a2:37:77:51",
            "timestamp": "2020-03-14T03:00:27Z",
            "severity": "info",
            "category": "User Activity Detected",
            "signature": "ET POLICY Dropbox.com Offsite File Backup in Use",
            "source": {
                "city": "San Francisco",
                "continent": "North America",
                "country": "United States",
                "ip": "4.4.4.4",
                "latitude": 37.7697,
                "longitude": -122.3933,
                "mac": "c4:24:56:87:ef:11",
                "network": "external",
                "port": 443,
                "state": "California",
                "subnet": "",
                "time_zone": "America/Los_Angeles",
                "zip": "94107",
                "inferred": {
                    "device_id": "",
                    "asset": "unmanaged",
                    "managed": "false",
                    "category": "",
                    "control": "",
                    "host_name": "",
                    "os": "",
                    "os_version": "",
                    "ownership": "",
                    "total_risk": 0,
                    "type": "",
                    "username": "",
                    "managed_info": {"host_name": ""},
                },
            },
            "destination": {
                "city": "Unknown",
                "continent": "Unknown",
                "country": "Unknown",
                "ip": "2.2.2.2",
                "latitude": -1,
                "longitude": -1,
                "mac": "7c:67:a2:37:77:51",
                "network": "internal",
                "port": 54250,
                "state": "Unknown",
                "subnet": "10.10.10.10/24",
                "time_zone": "Unknown",
                "zip": "Unknown",
                "inferred": {
                    "device_id": "5b589f43e4b58d191f7e017c",
                    "asset": "managed",
                    "managed": "true",
                    "category": "computer",
                    "control": "user",
                    "host_name": "DESKTOP-73OV7ML",
                    "os": "windows",
                    "os_version": "10",
                    "ownership": "corporate",
                    "total_risk": 11.9,
                    "type": "computer",
                    "username": "7c67a2377751",
                    "managed_info": {"host_name": "DESKTOP-73OV7ML"},
                },
            },
            "payload": """....C...?..^lH.....b.R.]...?..J..~.^....Lr1...........
            .........#.......................0...0...........1.{....d.....\rR0\r
            ..*.H..\r.....0p1.0...U....US1.0...U.\n..Example Inc1.0...U....www.e
            xample.com1/0-..U...&Example SHA2 High Assurance Server CA0..\r18081
            6000000Z.\r201105120000Z0.1.0...U....US1.0...U...\nCalifornia1.0...U
            ...\rSan Francisco1.0...U.\n..Dropbox, Inc1.0...U....Dropbox Ops1.0.
            ..U...\r*.dropbox.com0..\"0\r..*.H..\r..........0..\n......1.$.#.jJ.
            .ZQ.6..ku47kS..i.\r<.9...\r3...v.(.....Q..7.\n{.....$.i.i...^1.g.A.)
            k......!Qq=.4.O:8k.+.(.-....-F1.U.9?|....I.....M..IA\n.I>.....'1....
            .....:]:.I.d..nn.7.g\".b11.....8.EJS5....1u..6x...x....q\n@.~...I!..
            .{~.u.nGk...CGr..^.y..l#...<x&V........J<.7..J..........v0..r0...U.#
            ..0...Qh.....u<..edb...Yr;0...U.......|...Xu3.z.R.RU..n8.0%..U....0.
            .\r*.dropbox.com..dropbox.com0...U...........0...U.%..0...+.........
            +.......0u..U...n0l04.2.0..http://crl3.example.com/sha2-ha-server-g6
            .crl04.2.0..http://crl4.example.com/sha2-ha-server-g6.crl0L..U. .E0C
            07..`.H...l..0*0(..+.........https://www.example.com/CPS0...g.....0.
            ...+........w0u0$..+.....0...http://ocsp.example.com0M..+.....0..Aht
            tp://cacerts.example.com/ExampleSHA2HighAssuranceServerCA.crt0...U..
            .....0.0....\n+.....y......o...k.i.w.......X......gp\n<5.......w...\
            r.....eC.s......H0F.!..Hv..,O._rd....g.C*......V..cw.e.!..6.-.......
            ..K<A\".[..=.........1.w..u..Y|..C._..n.V.GV6.J.`....^......eC.t....
            ..H0F.!..`.;.(,&.u.B.$S(...3..B#...X4....!.....X[.DPQ..YhW.....j...8
            ./\n.6...u.......q...#...{G8W.\n.R....d6.......eC.t......F0D. v.y7Gs
            .6Z..7(&(z..+t...w....tay.. _..6i........}6$...D..?7........0\r..*.H
            ..\r..........\r\"..R..IP..i.l...5.d..m.X.h#........9..T<...@...B.r.
            BK #...$..z/.. u....~I.r...._..{.0|12G..2.!...{...Z..C.. 7.....>...\
            n(F^..Y..z.H6..`9.....\\..\r{.[n2....I..........P.....+....~.......=
            .....p...b.`FpRr.E..u..s..TG...._..n.........|..Km..$/u..;rHLe....<.
            g.U...0...0...............\\..m.+B.]..0\r..*.H..\r.....0l1.0...U....
            US1.0...U.\n..Example Inc1.0...U....www.example.com1+0)..U...\"Examp
            le High Assurance EV Root CA0..\r131022120000Z.\r281022120000Z0p1.0.
            ..U....US1.0...U.\n..Example Inc1.0...U....www.example.com1/0-..U...
            &Example SHA2 High Assurance Server CA0..\"0\r..*.H..\r..........0..
            \n......./.$..m._..\nd..}\"&e..B@.....v.>.0U...O..Z..UV...*.....@...
            ;r............C:.......@....M._W..Ph................-..........^DX*7
            ..5...'2Z......Q.'..;B3..(..(...+#\rx.{.^q.J>........#.M.....u......
            .D5e.S%9..\n.c...th\n7..RH.9Z...]... .!..&o.J!A..m..H/....h.S/^.....
            ....I0..E0...U.......0.......0...U...........0...U.%..0...+.........
            +.......04..+........(0&0$..+.....0...http://ocsp.example.com0K..U..
            .D0B0@.>.<.:http://crl4.example.com/ExampleHighAssuranceEVRootCA.crl
            0=..U. .60402..U. .0*0(..+.........https://www.example.com/CPS0...U.
            .....Qh.....u<..edb...Yr;0...U.#..0....>.i...G...&....cd+.0\r..*.H..
            \r................m.\\..h.J...Q/.kD...c..nl.....q.[.4N..y.).-.j.. .y
            ...G.....Yq}...k.YX=..1%\\.8.......[.1N.x.....I..'..r.>..A...6...nGI
            .^.H|....I..&B@.....d\nWT.....^k......r.V....0..0...N.W..$...+..u..-
            ..}y'............ (AYC(......{;redacted>..3.g.a.r..i...W@.p........*
            ...&... P..y&.U......0.....],..i...E.1@{...........\n...J.c32NO...j.
            .'S7.N.in..,Q..[..~..eI#.w.O5./....G.M:..z.*..;`-....s'A.<Ce.;5\rE!.
            (..\ng|TY.\r..RX..Db.,*.~...D...`...:Om....Pr6..(w@....w..$.GB7.Um..
            .......X5....b......y).......C..2...../.W#.....Z....h\r..C....5^....
            ........AZ.....tw...).L..8b.............""",
            "http": "null",
            "type": "pkt_alert",
            "group": "alert",
            "subtype": "policy-violation",
            "title": "User Activity Detected",
            "description": "ET POLICY Dropbox.com Offsite File Backup in Use",
            "references": ["www.dropbox.com", "dereknewton.com/2011/04/dropbox-authentication-static-host-ids/"],
        },
        {
            "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxXzEwOTAxXzAwMCIsIngiOiI1YTAwYjE3NTljNzk2NDg4MGZhMWMxYTZfY19kMjAyMDAzMTMifQ==",
            "address": "7c:67:a2:37:77:51",
            "timestamp": "2020-03-13T23:46:14Z",
            "severity": "info",
            "category": "User Activity Detected",
            "signature": "ET POLICY Dropbox.com Offsite File Backup in Use",
            "source": {
                "city": "San Francisco",
                "continent": "North America",
                "country": "United States",
                "ip": "4.4.4.4",
                "latitude": 37.7697,
                "longitude": -122.3933,
                "mac": "c4:24:56:87:ef:11",
                "network": "external",
                "port": 443,
                "state": "California",
                "subnet": "",
                "time_zone": "America/Los_Angeles",
                "zip": "94107",
                "inferred": {
                    "device_id": "",
                    "asset": "unmanaged",
                    "managed": "false",
                    "category": "",
                    "control": "",
                    "host_name": "",
                    "os": "",
                    "os_version": "",
                    "ownership": "",
                    "total_risk": 0,
                    "type": "",
                    "username": "",
                    "managed_info": {"host_name": ""},
                },
            },
            "destination": {
                "city": "Unknown",
                "continent": "Unknown",
                "country": "Unknown",
                "ip": "2.2.2.2",
                "latitude": -1,
                "longitude": -1,
                "mac": "7c:67:a2:37:77:51",
                "network": "internal",
                "port": 54131,
                "state": "Unknown",
                "subnet": "10.10.10.10/24",
                "time_zone": "Unknown",
                "zip": "Unknown",
                "inferred": {
                    "device_id": "5b589f43e4b58d191f7e017c",
                    "asset": "managed",
                    "managed": "true",
                    "category": "computer",
                    "control": "user",
                    "host_name": "DESKTOP-73OV7ML",
                    "os": "windows",
                    "os_version": "10",
                    "ownership": "corporate",
                    "total_risk": 11.9,
                    "type": "computer",
                    "username": "7c67a2377751",
                    "managed_info": {"host_name": "DESKTOP-73OV7ML"},
                },
            },
            "payload": """....C...?..^l.Fy.5.7.k..t..............:..............
            .........#.......................0...0...........1.{....d.....\rR0\r
            ..*.H..\r.....0p1.0...U....US1.0...U.\n..Example Inc1.0...U....www.e
            xample.com1/0-..U...&Example SHA2 High Assurance Server CA0..\r18081
            6000000Z.\r201105120000Z0.1.0...U....US1.0...U...\nCalifornia1.0...U
            ...\rSan Francisco1.0...U.\n..Dropbox, Inc1.0...U....Dropbox Ops1.0.
            ..U...\r*.dropbox.com0..\"0\r..*.H..\r..........0..\n......1.$.#.jJ.
            .ZQ.6..ku47kS..i.\r<.9...\r3...v.(.....Q..7.\n{.....$.i.i...^1.g.A.)
            k......!Qq=.4.O:8k.+.(.-....-F1.U.9?|....I.....M..IA\n.I>.....'1....
            .....:]:.I.d..nn.7.g\".b11.....8.EJS5....1u..6x...x....q\n@.~...I!..
            .{~.u.nGk...CGr..^.y..l#...<x&V........J<.7..J..........v0..r0...U.#
            ..0...Qh.....u<..edb...Yr;0...U.......|...Xu3.z.R.RU..n8.0%..U....0.
            .\r*.dropbox.com..dropbox.com0...U...........0...U.%..0...+.........
            +.......0u..U...n0l04.2.0..http://crl3.example.com/sha2-ha-server-g6
            .crl04.2.0..http://crl4.example.com/sha2-ha-server-g6.crl0L..U. .E0C
            07..`.H...l..0*0(..+.........https://www.example.com/CPS0...g.....0.
            ...+........w0u0$..+.....0...http://ocsp.example.com0M..+.....0..Aht
            tp://cacerts.example.com/ExampleSHA2HighAssuranceServerCA.crt0...U..
            .....0.0....\n+.....y......o...k.i.w.......X......gp\n<5.......w...\
            r.....eC.s......H0F.!..Hv..,O._rd....g.C*......V..cw.e.!..6.-.......
            ..K<A\".[..=.........1.w..u..Y|..C._..n.V.GV6.J.`....^......eC.t....
            ..H0F.!..`.;.(,&.u.B.$S(...3..B#...X4....!.....X[.DPQ..YhW.....j...8
            ./\n.6...u.......q...#...{G8W.\n.R....d6.......eC.t......F0D. v.y7Gs
            .6Z..7(&(z..+t...w....tay.. _..6i........}6$...D..?7........0\r..*.H
            ..\r..........\r\"..R..IP..i.l...5.d..m.X.h#........9..T<...@...B.r.
            BK #...$..z/.. u....~I.r...._..{.0|12G..2.!...{...Z..C.. 7.....>...\
            n(F^..Y..z.H6..`9.....\\..\r{.[n2....I..........P.....+....~.......=
            .....p...b.`FpRr.E..u..s..TG...._..n.........|..Km..$/u..;rHLe....<.
            g.U...0...0...............\\..m.+B.]..0\r..*.H..\r.....0l1.0...U....
            US1.0...U.\n..Example Inc1.0...U....www.example.com1+0)..U...\"Examp
            le High Assurance EV Root CA0..\r131022120000Z.\r281022120000Z0p1.0.
            ..U....US1.0...U.\n..Example Inc1.0...U....www.example.com1/0-..U...
            &Example SHA2 High Assurance Server CA0..\"0\r..*.H..\r..........0..
            \n......./.$..m._..\nd..}\"&e..B@.....v.>.0U...O..Z..UV...*.....@...
            ;r............C:.......@....M._W..Ph................-..........^DX*7
            ..5...'2Z......Q.'..;B3..(..(...+#\rx.{.^q.J>........#.M.....u......
            .D5e.S%9..\n.c...th\n7..RH.9Z...]... .!..&o.J!A..m..H/....h.S/^.....
            ....I0..E0...U.......0.......0...U...........0...U.%..0...+.........
            +.......04..+........(0&0$..+.....0...http://ocsp.example.com0K..U..
            .D0B0@.>.<.:http://crl4.example.com/ExampleHighAssuranceEVRootCA.crl
            0=..U. .60402..U. .0*0(..+.........https://www.example.com/CPS0...U.
            .....Qh.....u<..edb...Yr;0...U.#..0....>.i...G...&....cd+.0\r..*.H..
            \r................m.\\..h.J...Q/.kD...c..nl.....q.[.4N..y.).-.j.. .y
            ...G.....Yq}...k.YX=..1%\\.8.......[.1N.x.....I..'..r.>..A...6...nGI
            .^.H|....I..&B@.....d\nWT.....^k......r.V....0..0...N.W..$...+..u..-
            ..}y'............ (AYC(......{;redacted>..3.g.a.r..i...W@.p........*
            ...&... .wf.\n$2..[..@&km...7m...~.B.......@8^.t.,..;.;...D..2..G'..
            .G\"...=..E\\..44.........J.R+....Ms.c.w......%J.(K.gl.;\\.....Um..Z
            ....kR)...m[...N..k...&..D<.Y.\".....K...\n.......J.&.S{rX...5.H...#
            >.`8-G....7..s..@...q^... .Y.....*dHW......:.....7..|.(...O..c.r^..I
            ct..........5......x...G...\\h.B..........""",
            "http": "null",
            "type": "pkt_alert",
            "group": "alert",
            "subtype": "policy-violation",
            "title": "User Activity Detected",
            "description": "ET POLICY Dropbox.com Offsite File Backup in Use",
            "references": ["www.dropbox.com", "dereknewton.com/2011/04/dropbox-authentication-static-host-ids/"],
        },
        {
            "id": "eyJpIjoiU05XT09UQVBQUFJPRDAxXzk2MTlfMDAwIiwieCI6IjVhMDBiMTc1OWM3OTY0ODgwZmExYzFhNl9jX2QyMDIwMDMxMyJ9",
            "address": "34:f6:4b:b9:97:4a",
            "timestamp": "2020-03-13T22:14:32Z",
            "severity": "medium",
            "category": "User Activity Detected",
            "signature": "ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound",
            "source": {
                "city": "Unknown",
                "continent": "North America",
                "country": "United States",
                "ip": "2.2.2.2",
                "latitude": 37.751,
                "longitude": -97.822,
                "mac": "c4:24:56:87:ef:11",
                "network": "external",
                "port": 443,
                "state": "Unknown",
                "subnet": "",
                "time_zone": "Unknown",
                "zip": "Unknown",
                "inferred": {
                    "device_id": "",
                    "asset": "unmanaged",
                    "managed": "false",
                    "category": "",
                    "control": "",
                    "host_name": "",
                    "os": "",
                    "os_version": "",
                    "ownership": "",
                    "total_risk": 0,
                    "type": "",
                    "username": "",
                    "managed_info": {"host_name": ""},
                },
            },
            "destination": {
                "city": "Unknown",
                "continent": "Unknown",
                "country": "Unknown",
                "ip": "4.4.4.4",
                "latitude": -1,
                "longitude": -1,
                "mac": "34:f6:4b:b9:97:4a",
                "network": "internal",
                "port": 56402,
                "state": "Unknown",
                "subnet": "10.10.10.10/24",
                "time_zone": "Unknown",
                "zip": "Unknown",
                "inferred": {
                    "device_id": "5a0b2a3eccd47205deb12fb3",
                    "asset": "managed",
                    "managed": "true",
                    "category": "computer",
                    "control": "user",
                    "host_name": "DESKTOP-BEJRPN4",
                    "os": "windows",
                    "os_version": "10",
                    "ownership": "corporate",
                    "total_risk": 0.11,
                    "type": "computer",
                    "username": "sakella",
                    "managed_info": {"host_name": "DESKTOP-BEJRPN4"},
                },
            },
            "payload": """....L...H..^l....?B....e....I.BP...DOWNGRD...+.. .....
            ...............#.........h2...............0...0..L.............V..+$
            .....0\n..*.H.=...0L1.0...U....US1.0...U.\n..Example Inc1&0$..U....E
            xample ECC Secure Server CA0..\r190128000000Z.\r210201120000Z0r1.0..
            .U....US1.0...U...\nCalifornia1.0...U...\rSan Francisco1.0...U.\n..C
            loudflare, Inc.1.0...U....cloudflare-dns.com0Y0...*.H.=....*.H.=....
            B... p. BP(.}DA|0y).c^.D...q:+.....l=j.w....PS...&.a7......].~....t.
            ...0...0...U.#..0.........9O.n......1.\n.0...U......p..\\..f........
            ..E..0....U.....0....cloudflare-dns.com..*.cloudflare-dns.com..one.o
            ne.one.one.................5..&.G.G.............&.G.G.............&.
            G.G..........d..&.G.G.........d.....$.......0...U...........0...U.%.
            .0...+.........+.......0i..U...b0`0..,.*.(http://crl3.example.com/ss
            ca-ecc-g1.crl0..,.*.(http://crl4.example.com/ssca-ecc-g1.crl0L..U. .
            E0C07..`.H...l..0*0(..+.........https://www.example.com/CPS0...g....
            .0{..+........o0m0$..+.....0...http://ocsp.example.com0E..+.....0..9
            http://cacerts.example.com/ExampleECCSecureServerCA.crt0...U.......0
            .0..~.\n+.....y......n...j.h.v.......X......gp\n<5.......w...\r.....
            h.........G0E.!.....1{E..2.[4z......Mq...t.fA1H.. p...T..l..g..6I...
            .F....o....1.J.u..u..Y|..C._..n.V.GV6.J.`....^......h...l.....F0D. P
            ..BL......B'1w.e..;..?.M#..\\.... ...'..b2...Ht.d. .Mn&.3...E..C...w
            .......q...#...{G8W.\n.R....d6.......h.........H0F.!...=0s9.R......0
            ...!P...L....Sp...!....?=?.Aq..;..\nv...]a.#.3f.c....0\n..*.H.=....h
            .0e.0{>..}.L.....F..vehk.zeQ.....N...{.^.4.>.......U..1..G.....';.X.
            .p.,.:p.Vo7.....?...^ ..c8.O@.m........0...0..........\n.(.F^.9.vtp.
            ...0\r..*.H..\r.....0a1.0...U....US1.0...U.\n..Example Inc1.0...U...
            .www.example.com1 0...U....Example Global Root CA0..\r130308120000Z.
            \r230308120000Z0L1.0...U....US1.0...U.\n..Example Inc1&0$..U....Exam
            ple ECC Secure Server CA0v0...*.H.=....+...\".b....B.w.$..,d...@.#r.
            .\n.7?!6..S.....K....q......^....Z...So...?..[?G$......./.W..q..x:..
            [<kd.+.4+....!0...0...U.......0.......0...U...........04..+........(
            0&0$..+.....0...http://ocsp.example.com0B..U...;0907.5.3.1http://crl
            3.example.com/ExampleGlobalRootCA.crl0=..U. .60402..U. .0*0(..+.....
            ....https://www.example.com/CPS0...U............9O.n......1.\n.0...U
            .#..0.....P5V.L.f........=.U0\r..*.H..\r.............CK.t.....056n.V
            {H..c.{.W$W.o...m........sd...7\n.I.?.&... ....*.f7.0...$.EH-..PJ1..
            .._.*.I<a.y..f...*.{6X.,A.t...H.....Eq3.0zz.!.$..........j.w.5...'d.
            C...wV....G.._(..hL..`...y.jv&... ..>.z(edf.....t.nM}........N..U..8
            .4...?..Oj.t./*.s._..C.l.}...\".O..w....s...o... ...i)..8.I.bD.....q
            <...].......S...G0E. p....#..u.._l.>..3xb.FV......{...!........\"...
            ...{_&k.d....!...n..#.........""",
            "http": "null",
            "type": "pkt_alert",
            "group": "alert",
            "subtype": "policy-violation",
            "title": "User Activity Detected",
            "description": "ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound",
            "references": ["developers.cloudflare.com/1.1.1.1/dns-over-https/request-structure/"],
        },
    ],
}


def test_first_fetch_incidents(requests_mock, mocker):
    client = Client(MOCK_URL + "/v1/", verify=True, headers=MOCK_HEADERS, auth=("test_user", "test123"))
    requests_mock.post(MOCK_URL + "/v1/events/packetalerts", json=FETCH_ALERTS)
    fetch_incidents(client, "packet")


def test_fetch_single_alert(requests_mock):
    ID = "eyJpIjoiU05XT09UQVBQUFJPRDAxXzEzMzIxNThfMDAwIiwidCI6IjIwMTktMDYtMjZUMjA6MjQ6MjZaIn0="
    requests_mock.get(MOCK_URL + "/v1/events/packetalerts/" + ID, json=MOCK_PKT_ALERT)
    client = Client(MOCK_URL + "/v1/", verify=True, headers=MOCK_HEADERS, auth=("test_user", "test123"))
    alert_type = "packet"
    assert fetch_single_alert(client, ID, alert_type).raw_response == MOCK_PKT_ALERT


def test_get_woot_alerts(requests_mock):
    client = Client(MOCK_URL + "/v1/", verify=True, headers=MOCK_HEADERS, auth=("test_user", "test123"))
    requests_mock.post(MOCK_URL + "/v1/events/anomalies", json=ANOMALY_ALERT)
    assert client.get_woot_alerts("anomaly", MOCK_START, MOCK_END, limit="1").raw_response == ANOMALY_ALERT