XMCyber

The XM Cyber integration creates unique incidents with valuable data collected daily, and enriches your existing incidents with attack simulation context. This enables you to prioritize your responses based on XM Cyber’s insights.

Data Enrichment & Threat Intelligence · XM Cyber

Details

IDXMCyber
ProviderSchwarz Group
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

The XM Cyber integration creates unique incidents with valuable data collected daily, and enriches your existing incidents with attack simulation context. This enables you to prioritize your responses based on XM Cyber’s insights.
This integration was integrated and tested with version 1.43.0.355 of XMCyber

Configure XM Cyber in Cortex

Parameter Description Required
API Key   True
URL   True
Use system proxy settings   False
Trust any certificate (not secure)   False
Fetch incidents   False
Incident type   False
Maximum number of incidents per fetch   False
First fetch   False
Source Reliability Reliability of the source providing the intelligence data. False
    False
    False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xmcyber-affected-critical-assets-list

List critical assets at risk from an entity and the complexity of the attack

Base Command

xmcyber-affected-critical-assets-list

Input

Argument Name Description Required
timeId The relevant period of time. The options are timeAgo_days_7 (past 7 days) timeAgo_days_14, timeAgo_days_30, or monthly_YYYY_MM for a given year and month. Optional
entityId Entity ID. Required

Context Output

Path Type Description
XMCyber.Entity.id String XMCyber Entity ID
XMCyber.Entity.criticalAssetsAtRiskList.name String Compromising Technique name
XMCyber.Entity.criticalAssetsAtRiskList.average Number Average attack complexity
XMCyber.Entity.criticalAssetsAtRiskList.minimum Number Minimum attack complexity

xmcyber-affected-entities-list

List all entities at risk from an entity and the complexity of the attack

Command Example

!xmcyber-affected-critical-assets-list entityId=872743867762485580

Context Example

{
    "XMCyber": {
        "criticalAssetsAtRiskList": [
            {
                "average": 2,
                "minimum": 2,
                "name": "SQLSERVERB"
            },
            {
                "average": 2,
                "minimum": 2,
                "name": "USERAA35"
            },
            {
                "average": 4,
                "minimum": 4,
                "name": "USERAA03"
            },
            {
                "average": 4,
                "minimum": 4,
                "name": "USERBB37"
            },
            {
                "average": 4,
                "minimum": 4,
                "name": "WSUSA"
            },
            {
                "average": 4.67,
                "minimum": 4,
                "name": "FileServerA"
            },
        ],
        "entityId": "872743867762485580"
    }
}

Human Readable Output

found 6 affected critical assets from 872743867762485580. Top 5:

Asset Display Name Average Complexity Minimum Complexity
SQLSERVERB 2 2
USERAA35 2 2
USERAA03 4 4
USERBB37 4 4
WSUSA 4 4

Base Command

xmcyber-affected-entities-list

Input

Argument Name Description Required
timeId The relevant period of time. The options are timeAgo_days_7 (past 7 days) timeAgo_days_14, timeAgo_days_30, or monthly_YYYY_MM for a given year and month. Optional
entityId Entity ID. Required

Context Output

Path Type Description
XMCyber.Entity.id String XMCyber Entity ID
XMCyber.Entity.entitiesAtRiskList.name String Compromising Techinique Name
XMCyber.Entity.entitiesAtRiskList.technique String The attack technique which compromised the entity

Command Example

!xmcyber-affected-entities-list entityId=872743867762485580

Context Example

{
    "XMCyber": {
        "entitiesAtRiskList": [
            {
                "name": "SQLSERVERB",
                "technique": "Microsoft SQL Credentials Usage"
            },
            {
                "name": "share",
                "technique": "Taint Shared Content"
            }
        ],
        "entityId": "872743867762485580"
    }
}

Human Readable Output

found 2 affected entities from 872743867762485580. Top 5:

Display Name Technique
SQLSERVERB Microsoft SQL Credentials Usage
share Taint Shared Content

xmcyber-version-supported

Check if current XM version supports Cortex Xsoar integration

Base Command

xmcyber-version-supported

Input

There are no input arguments for this command.

Context Output

Path Type Description
XMCyber.Version.valid Boolean Flag that indicates if the version is valid

Command Example


#### Context Example

```json
{
    "XMCyber": {
        "IsVersion": {
            "valid": true
        }
    }
}

Human Readable Output

Results

valid
true

xmcyber-version-get

Get current xm version

Base Command

xmcyber-version-get

Input

There are no input arguments for this command.

Context Output

Path Type Description
XMCyber.Version.system String Get current system version

Command Example


#### Context Example

```json
{
    "XMCyber": {
        "Version": {
            "db": "4.2.3",
            "north": "1.0.3369+6514",
            "south": "2.1.967.352",
            "system": "1.38.0.12861",
            "updater": "1.4.134.11886"
        }
    }
}

Human Readable Output

Results

db north south system updater
4.2.3 1.0.3369+6514 2.1.967.352 1.38.0.12861 1.4.134.11886

xmcyber-enrich-from-ip

Return data on Entity by IP from XM Cyber

Base Command

xmcyber-enrich-from-ip

Input

Argument Name Description Required
ip List of IPs. Optional

Context Output

Path Type Description
XMCyber.Entity.id String XMCyber Entity ID
XMCyber.Entity.name String Entity Name
XMCyber.Entity.isAsset Boolean Entity is a critical asset
XMCyber.Entity.affectedEntities Number Number of unique entities at risk from this entity
XMCyber.Entity.averageComplexity Number Average complexity to compromise this entity
XMCyber.Entity.criticalAssetsAtRisk Number Number of unique critical assets at risk from this entity
XMCyber.Entity.averageComplexityLevel String Level of the average complexity to compromise this entity
XMCyber.Entity.compromisingTechniques.technique String Technique compromising this entity
XMCyber.Entity.compromisingTechniques.count Number Number of vectors with this technique compromising this entity
XMCyber.Entity.type String Entity Type
XMCyber.Entity.report String Link to the Entity Report
IP.Address String IP address.
Endpoint.Hostname String The hostname to matching the IP in XM Cyber
Endpoint.IP String IP address
Endpoint.OS String OS of the matched endpoint

xmcyber-enrich-from-entityId

Return data on Entity by entityId from XM Cyber

Base Command

xmcyber-enrich-from-entityId

Input

Argument Name Description Required
entityId List of entityIds. Optional

Context Output

Path Type Description
XMCyber.Entity.id String XMCyber Entity ID
XMCyber.Entity.name String Entity Name
XMCyber.Entity.isAsset Boolean Entity is a critical asset
XMCyber.Entity.affectedEntities Number Number of unique entities at risk from this entity
XMCyber.Entity.averageComplexity Number Average complexity to compromise this entity
XMCyber.Entity.criticalAssetsAtRisk Number Number of unique critical assets at risk from this entity
XMCyber.Entity.averageComplexityLevel String Level of the average complexity to compromise this entity
XMCyber.Entity.compromisingTechniques.technique String Technique compromising this entity
XMCyber.Entity.compromisingTechniques.count Number Number of vectors with this technique compromising this entity
XMCyber.Entity.type String Entity Type
XMCyber.Entity.report String Link to the Entity Report
Host.Hostname String The name of the host.
Host.ID String The unique ID within the tool retrieving the host.
Host.IP String The IP address of the host.

xmcyber-enrich-from-hostname

Return data on Entity by hostname from XM Cyber

Base Command

xmcyber-enrich-from-hostname

Input

Argument Name Description Required
entityId List of entityIds. Optional

Context Output

Path Type Description
XMCyber.Entity.id String XMCyber Entity ID
XMCyber.Entity.name String Entity Name
XMCyber.Entity.isAsset Boolean Entity is a critical asset
XMCyber.Entity.affectedEntities Number Number of unique entities at risk from this entity
XMCyber.Entity.averageComplexity Number Average complexity to compromise this entity
XMCyber.Entity.criticalAssetsAtRisk Number Number of unique critical assets at risk from this entity
XMCyber.Entity.averageComplexityLevel String Level of the average complexity to compromise this entity
XMCyber.Entity.compromisingTechniques.technique String Technique compromising this entity
XMCyber.Entity.compromisingTechniques.count Number Number of vectors with this technique compromising this entity
XMCyber.Entity.type String Entity Type
XMCyber.Entity.report String Link to the Entity Report
Host.Hostname String The name of the host.
Host.ID String The unique ID within the tool retrieving the host.
Host.IP String The IP address of the host.

xmcyber-enrich-from-fields

Return data on an XM entity

Base Command

xmcyber-enrich-from-fields

Input

Argument Name Description Required
fields Comma-separated list of fields to search for the entity. Required
values Comma-separated list of values (in the same order than the fields list) used to search for the entity. Required

Context Output

Path Type Description
XMCyber.Entity.id String XMCyber Entity ID
XMCyber.Entity.name String Entity Name
XMCyber.Entity.isAsset Boolean Entity is a critical asset
XMCyber.Entity.affectedEntities Number Number of unique entities at risk from this entity
XMCyber.Entity.averageComplexity Number Average complexity to compromise this entity
XMCyber.Entity.criticalAssetsAtRisk Number Number of unique critical assets at risk from this entity
XMCyber.Entity.averageComplexityLevel String Level of the average complexity to compromise this entity
XMCyber.Entity.compromisingTechniques.technique String Technique compromising this entity
XMCyber.Entity.compromisingTechniques.count Number Number of vectors with this technique compromising this entity
XMCyber.Entity.type String Entity Type
XMCyber.Entity.report String Link to the Entity Report
Host.Hostname String The name of the host.
Host.ID String The unique ID within the tool retrieving the host.
Host.IP String The IP address of the host.

Configuration parameters

  • apikey — API Key (required)
  • url — URL (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (8)

  • xmcyber-affected-critical-assets-list

    List critical assets at risk from an entity and the complexity of the attack.

  • xmcyber-affected-entities-list

    List all entities at risk from an entity and the complexity of the attack.

  • xmcyber-enrich-from-entityId

    Return data on Entity by entityId from XM Cyber.

  • xmcyber-enrich-from-fields

    Return data on an XM entity.

  • xmcyber-enrich-from-hostname

    Return data on Entity by hostname from XM Cyber.

  • xmcyber-enrich-from-ip

    Return data on Entity by IP from XM Cyber.

  • xmcyber-version-get

    Get current xm version.

  • xmcyber-version-supported

    Check if current XM version supports Cortex Xsoar integration.

Source

XMCyberIntegration.py XMCyberIntegration_test.py XMCyberIntegration.yml XMCyberIntegration_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
sectionorder:
- Connect
- Collect
provider: Schwarz Group
commonfields:
  id: XMCyber
  version: -1
configuration:
- display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- display: URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- defaultvalue: '30'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: First fetch
  name: first_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  section: Collect
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
  section: Collect
description: The XM Cyber integration creates unique incidents with valuable data collected daily, and enriches your existing incidents with attack simulation context. This enables you to prioritize your responses based on XM Cyber’s insights.
display: XM Cyber
name: XMCyber
script:
  commands:
  - arguments:
    - description: The relevant period of time. The options are timeAgo_days_7 (past 7 days) timeAgo_days_14, timeAgo_days_30, or monthly_YYYY_MM for a given year and month.
      name: timeId
    - description: Entity ID.
      isArray: true
      name: entityId
      required: true
    description: List critical assets at risk from an entity and the complexity of the attack.
    name: xmcyber-affected-critical-assets-list
    outputs:
    - contextPath: XMCyber.Entity.id
      description: XMCyber Entity ID.
      type: String
    - contextPath: XMCyber.Entity.criticalAssetsAtRiskList.name
      description: Compromising Technique name.
      type: String
    - contextPath: XMCyber.Entity.criticalAssetsAtRiskList.average
      description: Average attack complexity.
      type: Number
    - contextPath: XMCyber.Entity.criticalAssetsAtRiskList.minimum
      description: Minimum attack complexity.
      type: Number
  - arguments:
    - description: The relevant period of time. The options are timeAgo_days_7 (past 7 days) timeAgo_days_14, timeAgo_days_30, or monthly_YYYY_MM for a given year and month.
      name: timeId
    - description: Entity ID.
      isArray: true
      name: entityId
      required: true
    description: List all entities at risk from an entity and the complexity of the attack.
    name: xmcyber-affected-entities-list
    outputs:
    - contextPath: XMCyber.Entity.id
      description: XMCyber Entity ID.
      type: String
    - contextPath: XMCyber.Entity.entitiesAtRiskList.name
      description: Compromising Techinique Name.
      type: String
    - contextPath: XMCyber.Entity.entitiesAtRiskList.technique
      description: The attack technique which compromised the entity.
      type: String
  - description: Check if current XM version supports Cortex Xsoar integration.
    name: xmcyber-version-supported
    outputs:
    - contextPath: XMCyber.Version.valid
      description: Flag that indicates if the version is valid.
      type: Boolean
  - description: Get current xm version.
    name: xmcyber-version-get
    outputs:
    - contextPath: XMCyber.Version.system
      description: Get current system version.
      type: String
  - arguments:
    - default: true
      description: List of IPs.
      isArray: true
      name: ip
    description: Return data on Entity by IP from XM Cyber.
    name: xmcyber-enrich-from-ip
    outputs:
    - contextPath: XMCyber.Entity.id
      description: XMCyber Entity ID.
      type: String
    - contextPath: XMCyber.Entity.name
      description: Entity Name.
      type: String
    - contextPath: XMCyber.Entity.isAsset
      description: Entity is a critical asset.
      type: Boolean
    - contextPath: XMCyber.Entity.affectedEntities
      description: Number of unique entities at risk from this entity.
      type: Number
    - contextPath: XMCyber.Entity.averageComplexity
      description: Average complexity to compromise this entity.
      type: Number
    - contextPath: XMCyber.Entity.criticalAssetsAtRisk
      description: Number of unique critical assets at risk from this entity.
      type: Number
    - contextPath: XMCyber.Entity.averageComplexityLevel
      description: Level of the average complexity to compromise this entity.
      type: String
    - contextPath: XMCyber.Entity.compromisingTechniques.technique
      description: Technique compromising this entity.
      type: String
    - contextPath: XMCyber.Entity.compromisingTechniques.count
      description: Number of vectors with this technique compromising this entity.
      type: Number
    - contextPath: XMCyber.Entity.type
      description: Entity Type.
      type: String
    - contextPath: XMCyber.Entity.report
      description: Link to the Entity Report.
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname to matching the IP in XM Cyber.
      type: String
    - contextPath: Endpoint.IP
      description: IP address.
      type: String
    - contextPath: Endpoint.OS
      description: OS of the matched endpoint.
      type: String
  - arguments:
    - default: true
      description: List of entityIds.
      isArray: true
      name: entityId
    description: Return data on Entity by entityId from XM Cyber.
    name: xmcyber-enrich-from-entityId
    outputs:
    - contextPath: XMCyber.Entity.id
      description: XMCyber Entity ID.
      type: String
    - contextPath: XMCyber.Entity.name
      description: Entity Name.
      type: String
    - contextPath: XMCyber.Entity.isAsset
      description: Entity is a critical asset.
      type: Boolean
    - contextPath: XMCyber.Entity.affectedEntities
      description: Number of unique entities at risk from this entity.
      type: Number
    - contextPath: XMCyber.Entity.averageComplexity
      description: Average complexity to compromise this entity.
      type: Number
    - contextPath: XMCyber.Entity.criticalAssetsAtRisk
      description: Number of unique critical assets at risk from this entity.
      type: Number
    - contextPath: XMCyber.Entity.averageComplexityLevel
      description: Level of the average complexity to compromise this entity.
      type: String
    - contextPath: XMCyber.Entity.compromisingTechniques.technique
      description: Technique compromising this entity.
      type: String
    - contextPath: XMCyber.Entity.compromisingTechniques.count
      description: Number of vectors with this technique compromising this entity.
      type: Number
    - contextPath: XMCyber.Entity.type
      description: Entity Type.
      type: String
    - contextPath: XMCyber.Entity.report
      description: Link to the Entity Report.
      type: String
    - contextPath: Host.Hostname
      description: The name of the host.
      type: String
    - contextPath: Host.ID
      description: The unique ID within the tool retrieving the host.
      type: String
    - contextPath: Host.IP
      description: The IP address of the host.
      type: String
  - arguments:
    - default: true
      description: List of hostnames.
      isArray: true
      name: hostname
    description: Return data on Entity by hostname from XM Cyber.
    name: xmcyber-enrich-from-hostname
    outputs:
    - contextPath: XMCyber.Entity.id
      description: XMCyber Entity ID.
      type: String
    - contextPath: XMCyber.Entity.name
      description: Entity Name.
      type: String
    - contextPath: XMCyber.Entity.isAsset
      description: Entity is a critical asset.
      type: Boolean
    - contextPath: XMCyber.Entity.affectedEntities
      description: Number of unique entities at risk from this entity.
      type: Number
    - contextPath: XMCyber.Entity.averageComplexity
      description: Average complexity to compromise this entity.
      type: Number
    - contextPath: XMCyber.Entity.criticalAssetsAtRisk
      description: Number of unique critical assets at risk from this entity.
      type: Number
    - contextPath: XMCyber.Entity.averageComplexityLevel
      description: Level of the average complexity to compromise this entity.
      type: String
    - contextPath: XMCyber.Entity.compromisingTechniques.technique
      description: Technique compromising this entity.
      type: String
    - contextPath: XMCyber.Entity.compromisingTechniques.count
      description: Number of vectors with this technique compromising this entity.
      type: Number
    - contextPath: XMCyber.Entity.type
      description: Entity Type.
      type: String
    - contextPath: XMCyber.Entity.report
      description: Link to the Entity Report.
      type: String
    - contextPath: Host.Hostname
      description: The name of the host.
      type: String
    - contextPath: Host.ID
      description: The unique ID within the tool retrieving the host.
      type: String
    - contextPath: Host.IP
      description: The IP address of the host.
      type: String
  - arguments:
    - description: Comma-separated list of fields to search for the entity.
      isArray: true
      name: fields
      required: true
    - description: Comma-separated list of values (in the same order than the fields list) used to search for the entity.
      isArray: true
      name: values
      required: true
    description: Return data on an XM entity.
    name: xmcyber-enrich-from-fields
    outputs:
    - contextPath: XMCyber.Entity.id
      description: XMCyber Entity ID.
      type: String
    - contextPath: XMCyber.Entity.name
      description: Entity Name.
      type: String
    - contextPath: XMCyber.Entity.isAsset
      description: Entity is a critical asset.
      type: Boolean
    - contextPath: XMCyber.Entity.affectedEntities
      description: Number of unique entities at risk from this entity.
      type: Number
    - contextPath: XMCyber.Entity.averageComplexity
      description: Average complexity to compromise this entity.
      type: Number
    - contextPath: XMCyber.Entity.criticalAssetsAtRisk
      description: Number of unique critical assets at risk from this entity.
      type: Number
    - contextPath: XMCyber.Entity.averageComplexityLevel
      description: Level of the average complexity to compromise this entity.
      type: String
    - contextPath: XMCyber.Entity.compromisingTechniques.technique
      description: Technique compromising this entity.
      type: String
    - contextPath: XMCyber.Entity.compromisingTechniques.count
      description: Number of vectors with this technique compromising this entity.
      type: Number
    - contextPath: XMCyber.Entity.type
      description: Entity Type.
      type: String
    - contextPath: XMCyber.Entity.report
      description: Link to the Entity Report.
      type: String
    - contextPath: Host.Hostname
      description: The name of the host.
      type: String
    - contextPath: Host.ID
      description: The unique ID within the tool retrieving the host.
      type: String
    - contextPath: Host.IP
      description: The IP address of the host.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 6.0.0