Zafran API

Details

ID	`Zafran API`
Provider	Zafran Security
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

In today’s complex security landscape, resource-constrained teams struggle to efficiently mitigate exposure risks across large infrastructures. The Zafran Integration with Palo XSOAR helps you implement Automated, High Impact Mitigations at scale. With this integration, teams can prioritize mitigation actions, trigger playbooks with a single click, and streamline their response efforts, all from within the Palo XSOAR environment.

Configure Zafran API on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Zafran API.

Click Add instance to create and configure a new integration instance.

Parameter	Required
Server URL (e.g. api.zafran.io)	True
API Key	True
Trust any certificate (not secure)	False
Use system proxy settings	False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

zafran-mitigation-performed

Update on mitigations performed

Base Command

zafran-mitigation-performed

Input

Argument Name	Description	Required
external_ticket_id	External service ticket ID.	Optional
external_ticket_url	External service ticket link.	Optional
id	Mitigation ID.	Required
state	Mitigation status new - New mitigation pending_approval - Waiting for mitigation approval rejected - Mitigative action was rejected. in_progress - Mitigation approved and in progress. completed - Mitigation applied successfully. Possible values are: new, pending_approval, rejected, in_progress, completed.	Required

Context Output

Path	Type	Description
Zafran.MitigationsPerformedResponse.internal_status_code	Number	Internal status code.
Zafran.MitigationsPerformedResponse.message	String	Error message.

zafran-mitigations-export

Export recommended mitigations

Base Command

zafran-mitigations-export

Input

Argument Name	Description	Required
filter	ZQL filter.	Optional

Context Output

Path	Type	Description
Zafran.UpstreamMitigation.assets_count	Number	Assets count.
Zafran.UpstreamMitigation.control_product	String	Control Product.
Zafran.UpstreamMitigation.exposure	Number	Exposure in days.
Zafran.UpstreamMitigation.id	String	Zafran mitigation unique id.
Zafran.UpstreamMitigation.mitigation_type	String	Mitigation type.
Zafran.UpstreamMitigation.recommendation	String	Recommendation.
Zafran.UpstreamMitigation.title	String	Title.
Zafran.UpstreamMitigation.vulnerabilities_count	Number	Vulnerabilities count.
Zafran.UpstreamMitigation.internal_status_code	Number	Internal status code.
Zafran.UpstreamMitigation.message	String	Error message

zafran-mitigations-performed

Update on mitigations performed

Base Command

zafran-mitigations-performed

Input

Argument Name	Description	Required
mitigation_id	Mitigation ID.	Optional
mitigation_ids	Mitigation IDs.	Optional
state	Mitigation status new - New mitigation pending_approval - Waiting for mitigation approval rejected - Mitigative action was rejected. in_progress - Mitigation approved and in progress. completed - Mitigation applied successfully. Possible values are: new, pending_approval, rejected, in_progress, completed.	Required

Context Output

Path	Type	Description
Zafran.MitigationsPerformedResponse.internal_status_code	Number	Internal status code.
Zafran.MitigationsPerformedResponse.message	String	Error message.

Configuration parameters

url — Server URL (e.g. api.zafran.io) (required)
api_key — API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (3)

zafran-mitigation-performed
Update on mitigations performed
zafran-mitigations-export
Export recommended mitigations.
zafran-mitigations-performed
Update on mitigations performed

Source

Zafran.py Zafran_test.py Zafran.yml Zafran_description.md command_examples.txt

Download History Raw

commonfields:
  id: Zafran API
  version: -1
name: Zafran API
display: Zafran API
category: Utilities
provider: Zafran Security
description: 'The Zafran API provides a programmatic way to interact with the Zafran Exposure Management Platform for various use cases.'
configuration:
- name: url
  display: Server URL (e.g. api.zafran.io)
  defaultvalue: https://api.zafran.io
  type: 0
  required: true
- name: api_key
  display: API Key
  defaultvalue: ''
  type: 4
  required: true
- name: insecure
  display: Trust any certificate (not secure)
  defaultvalue: 'false'
  type: 8
  required: false
- name: proxy
  display: Use system proxy settings
  defaultvalue: 'false'
  type: 8
  required: false
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: false
  commands:
  - name: zafran-mitigation-performed
    description: Update on mitigations performed
    arguments:
    - name: external_ticket_id
      description: 'External service ticket ID.'
      required: false
      isArray: false
    - name: external_ticket_url
      description: 'External service ticket link.'
      required: false
      isArray: false
    - name: id
      description: 'Mitigation ID.'
      required: true
      isArray: false
    - name: state
      description: 'Mitigation status     new - New mitigation     pending_approval - Waiting for mitigation approval     rejected - Mitigative action was rejected.     in_progress - Mitigation approved and in progress.     completed - Mitigation applied successfully.'
      required: true
      isArray: false
      auto: PREDEFINED
      predefined:
      - new
      - pending_approval
      - rejected
      - in_progress
      - completed
    outputs:
    - type: Number
      contextPath: Zafran.MitigationsPerformedResponse.internal_status_code
      description: 'Internal status code.'
    - type: String
      contextPath: Zafran.MitigationsPerformedResponse.message
      description: 'Error message.'
  - name: zafran-mitigations-export
    description: Export recommended mitigations.
    arguments:
    - name: filter
      description: ZQL filter.
      required: false
      isArray: false
    outputs:
    - type: Number
      contextPath: Zafran.UpstreamMitigation.assets_count
      description: 'Assets count.'
    - type: String
      contextPath: Zafran.UpstreamMitigation.control_product
      description: 'Control Product.'
    - type: Number
      contextPath: Zafran.UpstreamMitigation.exposure
      description: 'Exposure in days.'
    - type: String
      contextPath: Zafran.UpstreamMitigation.id
      description: 'Zafran mitigation unique id.'
    - type: String
      contextPath: Zafran.UpstreamMitigation.mitigation_type
      description: 'Mitigation type.'
    - type: String
      contextPath: Zafran.UpstreamMitigation.recommendation
      description: 'Recommendation.'
    - type: String
      contextPath: Zafran.UpstreamMitigation.title
      description: 'Title.'
    - type: Number
      contextPath: Zafran.UpstreamMitigation.vulnerabilities_count
      description: 'Vulnerabilities count.'
    - type: Number
      contextPath: Zafran.UpstreamMitigation.internal_status_code
      description: 'Internal status code.'
    - type: String
      contextPath: Zafran.UpstreamMitigation.message
      description: 'Error message.'
  - name: zafran-mitigations-performed
    description: Update on mitigations performed
    arguments:
    - name: mitigation_id
      description: 'Mitigation ID.'
      required: false
      isArray: false
    - name: mitigation_ids
      description: 'Mitigation IDs.'
      required: false
      isArray: true
    - name: state
      description: 'Mitigation status     new - New mitigation     pending_approval - Waiting for mitigation approval     rejected - Mitigative action was rejected.     in_progress - Mitigation approved and in progress.     completed - Mitigation applied successfully.'
      required: true
      isArray: false
      auto: PREDEFINED
      predefined:
      - new
      - pending_approval
      - rejected
      - in_progress
      - completed
    outputs:
    - type: Number
      contextPath: Zafran.MitigationsPerformedResponse.internal_status_code
      description: 'Internal status code.'
    - type: String
      contextPath: Zafran.MitigationsPerformedResponse.message
      description: 'Error message.'
tests:
- No tests
fromversion: 6.0.0