Zafran API

Details

ID	`Zafran API`
Provider	Zafran Security
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

In today’s complex security landscape, resource-constrained teams struggle to efficiently mitigate exposure risks across large infrastructures. The Zafran Integration with Palo XSOAR helps you implement Automated, High Impact Mitigations at scale. With this integration, teams can prioritize mitigation actions, trigger playbooks with a single click, and streamline their response efforts, all from within the Palo XSOAR environment.

Configure Zafran API on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Zafran API.

Click Add instance to create and configure a new integration instance.

Parameter	Required
Server URL (e.g. api.zafran.io)	True
API Key	True
Trust any certificate (not secure)	False
Use system proxy settings	False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

zafran-mitigation-performed

Update on mitigations performed

Base Command

zafran-mitigation-performed

Input

Argument Name	Description	Required
external_ticket_id	External service ticket ID.	Optional
external_ticket_url	External service ticket link.	Optional
id	Mitigation ID.	Required
state	Mitigation status new - New mitigation pending_approval - Waiting for mitigation approval rejected - Mitigative action was rejected. in_progress - Mitigation approved and in progress. completed - Mitigation applied successfully. Possible values are: new, pending_approval, rejected, in_progress, completed.	Required

Context Output

Path	Type	Description
Zafran.MitigationsPerformedResponse.internal_status_code	Number	Internal status code.
Zafran.MitigationsPerformedResponse.message	String	Error message.

zafran-mitigations-export

Export recommended mitigations

Base Command

zafran-mitigations-export

Input

Argument Name	Description	Required
filter	ZQL filter.	Optional

Context Output

Path	Type	Description
Zafran.UpstreamMitigation.assets_count	Number	Assets count.
Zafran.UpstreamMitigation.control_product	String	Control Product.
Zafran.UpstreamMitigation.exposure	Number	Exposure in days.
Zafran.UpstreamMitigation.id	String	Zafran mitigation unique id.
Zafran.UpstreamMitigation.mitigation_type	String	Mitigation type.
Zafran.UpstreamMitigation.recommendation	String	Recommendation.
Zafran.UpstreamMitigation.title	String	Title.
Zafran.UpstreamMitigation.vulnerabilities_count	Number	Vulnerabilities count.
Zafran.UpstreamMitigation.internal_status_code	Number	Internal status code.
Zafran.UpstreamMitigation.message	String	Error message

zafran-mitigations-performed

Update on mitigations performed

Base Command

zafran-mitigations-performed

Input

Argument Name	Description	Required
mitigation_id	Mitigation ID.	Optional
mitigation_ids	Mitigation IDs.	Optional
state	Mitigation status new - New mitigation pending_approval - Waiting for mitigation approval rejected - Mitigative action was rejected. in_progress - Mitigation approved and in progress. completed - Mitigation applied successfully. Possible values are: new, pending_approval, rejected, in_progress, completed.	Required

Context Output

Path	Type	Description
Zafran.MitigationsPerformedResponse.internal_status_code	Number	Internal status code.
Zafran.MitigationsPerformedResponse.message	String	Error message.

Configuration parameters

url — Server URL (e.g. api.zafran.io) (required)
api_key — API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (3)

zafran-mitigation-performed
Update on mitigations performed
zafran-mitigations-export
Export recommended mitigations.
zafran-mitigations-performed
Update on mitigations performed

Source

Zafran.py Zafran_test.py Zafran.yml Zafran_description.md command_examples.txt

Download History Raw

import pytest
from CommonServerPython import *
from Zafran import (
    Client,
    mitigation_performed_command,
    mitigations_export_command,
    mitigations_performed_command,
    api_test_connection,
)

SERVER_URL = "https://api.zafran.io"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


@pytest.fixture()
def client():
    return Client(server_url=SERVER_URL, verify=None, proxy=None, headers=None, auth=None)


def test_mitigation_performed_command(client, requests_mock):
    """
    When:
    Given:
    Then:
    """
    args = {"external_ticket_id": "ticketid", "external_ticket_url": "ticketurl", "id": "id", "state": "in_progress"}
    mock_response_mitigation_performed_request = util_load_json("./test_data/outputs/mitigation_performed_request.json")
    requests_mock.post(f"{SERVER_URL}/mitigations/performed", json=mock_response_mitigation_performed_request)
    results = mitigation_performed_command(client=client, args=args)
    assert results.outputs_prefix == "Zafran.MitigationsPerformedResponse"
    assert results.outputs_key_field == ""
    assert results.readable_output == "Mitigation status updated successfully"
    assert results.raw_response == mock_response_mitigation_performed_request


def test_mitigations_export_command(client, requests_mock):
    """
    When:
    Given:
    Then:
    """
    args = {}
    mock_response_mitigations_export_request = util_load_json("./test_data/outputs/mitigations_export_request.json")
    mock_results = util_load_json("./test_data/outputs/mitigations_export_command.json")
    requests_mock.get(f"{SERVER_URL}/mitigations", json=mock_response_mitigations_export_request)
    results = mitigations_export_command(client=client, args=args)
    assert results.outputs_prefix == "Zafran.UpstreamMitigation"
    assert results.outputs_key_field == "id"
    assert results.outputs == mock_results.get("outputs")
    assert results.raw_response == mock_response_mitigations_export_request


def test_mitigations_performed_command(client, requests_mock):
    """
    When:
    Given:
    Then:
    """
    args = {"mitigation_id": None, "mitigation_ids": "id1,id2", "state": "in_progress"}
    mock_response_mitigations_performed_request = util_load_json("./test_data/outputs/mitigations_performed_request.json")
    requests_mock.post(f"{SERVER_URL}/mitigations", json=mock_response_mitigations_performed_request)
    results = mitigations_performed_command(client=client, args=args)
    assert results.outputs_prefix == "Zafran.MitigationsPerformedResponse"
    assert results.outputs_key_field == ""
    assert results.readable_output == "Mitigations status updated successfully"
    assert results.raw_response == mock_response_mitigations_performed_request


def test_api_test_connection(client, requests_mock):
    requests_mock.post(f"{SERVER_URL}/findings?count=0", status_code=204)
    result = api_test_connection(client)
    assert result == "ok"

    requests_mock.post(f"{SERVER_URL}/findings?count=0", status_code=403)
    result = api_test_connection(client)
    assert result == "API test failed"