XMCyber

The XM Cyber integration creates unique incidents with valuable data collected daily, and enriches your existing incidents with attack simulation context. This enables you to prioritize your responses based on XM Cyber’s insights.
This integration was integrated and tested with version 1.43.0.355 of XMCyber

Configure XM Cyber in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xmcyber-affected-critical-assets-list

List critical assets at risk from an entity and the complexity of the attack

Base Command

xmcyber-affected-critical-assets-list

Input

Context Output

xmcyber-affected-entities-list

List all entities at risk from an entity and the complexity of the attack

Command Example

!xmcyber-affected-critical-assets-list entityId=872743867762485580

Context Example

{
    "XMCyber": {
        "criticalAssetsAtRiskList": [
            {
                "average": 2,
                "minimum": 2,
                "name": "SQLSERVERB"
            },
            {
                "average": 2,
                "minimum": 2,
                "name": "USERAA35"
            },
            {
                "average": 4,
                "minimum": 4,
                "name": "USERAA03"
            },
            {
                "average": 4,
                "minimum": 4,
                "name": "USERBB37"
            },
            {
                "average": 4,
                "minimum": 4,
                "name": "WSUSA"
            },
            {
                "average": 4.67,
                "minimum": 4,
                "name": "FileServerA"
            },
        ],
        "entityId": "872743867762485580"
    }
}

Human Readable Output

found 6 affected critical assets from 872743867762485580. Top 5:

Asset Display Name	Average Complexity	Minimum Complexity
SQLSERVERB	2	2
USERAA35	2	2
USERAA03	4	4
USERBB37	4	4
WSUSA	4	4

Base Command

xmcyber-affected-entities-list

Input

Context Output

Command Example

!xmcyber-affected-entities-list entityId=872743867762485580

Context Example

{
    "XMCyber": {
        "entitiesAtRiskList": [
            {
                "name": "SQLSERVERB",
                "technique": "Microsoft SQL Credentials Usage"
            },
            {
                "name": "share",
                "technique": "Taint Shared Content"
            }
        ],
        "entityId": "872743867762485580"
    }
}

Human Readable Output

found 2 affected entities from 872743867762485580. Top 5:

Display Name	Technique
SQLSERVERB	Microsoft SQL Credentials Usage
share	Taint Shared Content

xmcyber-version-supported

Check if current XM version supports Cortex Xsoar integration

Base Command

xmcyber-version-supported

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
    "XMCyber": {
        "IsVersion": {
            "valid": true
        }
    }
}

Human Readable Output

Results

valid
true

xmcyber-version-get

Get current xm version

Base Command

xmcyber-version-get

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
    "XMCyber": {
        "Version": {
            "db": "4.2.3",
            "north": "1.0.3369+6514",
            "south": "2.1.967.352",
            "system": "1.38.0.12861",
            "updater": "1.4.134.11886"
        }
    }
}

Human Readable Output

Results

db	north	south	system	updater
4.2.3	1.0.3369+6514	2.1.967.352	1.38.0.12861	1.4.134.11886

xmcyber-enrich-from-ip

Return data on Entity by IP from XM Cyber

Base Command

xmcyber-enrich-from-ip

Input

Context Output

xmcyber-enrich-from-entityId

Return data on Entity by entityId from XM Cyber

Base Command

xmcyber-enrich-from-entityId

Input

Context Output

xmcyber-enrich-from-hostname

Return data on Entity by hostname from XM Cyber

Base Command

xmcyber-enrich-from-hostname

Input

Context Output

xmcyber-enrich-from-fields

Return data on an XM entity

Base Command

xmcyber-enrich-from-fields

Input

Context Output