Zafran API

The Zafran API provides a programmatic way to interact with the Zafran Exposure Management Platform for various use cases.

Utilities · Zafran

Details

IDZafran API
ProviderZafran Security
CategoryUtilities
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

In today’s complex security landscape, resource-constrained teams struggle to efficiently mitigate exposure risks across large infrastructures. The Zafran Integration with Palo XSOAR helps you implement Automated, High Impact Mitigations at scale. With this integration, teams can prioritize mitigation actions, trigger playbooks with a single click, and streamline their response efforts, all from within the Palo XSOAR environment.

Configure Zafran API on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Zafran API.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Required
    Server URL (e.g. api.zafran.io) True
    API Key True
    Trust any certificate (not secure) False
    Use system proxy settings False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

zafran-mitigation-performed

Update on mitigations performed

Base Command

zafran-mitigation-performed

Input

Argument Name Description Required
external_ticket_id External service ticket ID. Optional
external_ticket_url External service ticket link. Optional
id Mitigation ID. Required
state Mitigation status new - New mitigation pending_approval - Waiting for mitigation approval rejected - Mitigative action was rejected. in_progress - Mitigation approved and in progress. completed - Mitigation applied successfully. Possible values are: new, pending_approval, rejected, in_progress, completed. Required

Context Output

Path Type Description
Zafran.MitigationsPerformedResponse.internal_status_code Number Internal status code.
Zafran.MitigationsPerformedResponse.message String Error message.

zafran-mitigations-export

Export recommended mitigations

Base Command

zafran-mitigations-export

Input

Argument Name Description Required
filter ZQL filter. Optional

Context Output

Path Type Description
Zafran.UpstreamMitigation.assets_count Number Assets count.
Zafran.UpstreamMitigation.control_product String Control Product.
Zafran.UpstreamMitigation.exposure Number Exposure in days.
Zafran.UpstreamMitigation.id String Zafran mitigation unique id.
Zafran.UpstreamMitigation.mitigation_type String Mitigation type.
Zafran.UpstreamMitigation.recommendation String Recommendation.
Zafran.UpstreamMitigation.title String Title.
Zafran.UpstreamMitigation.vulnerabilities_count Number Vulnerabilities count.
Zafran.UpstreamMitigation.internal_status_code Number Internal status code.
Zafran.UpstreamMitigation.message String Error message

zafran-mitigations-performed

Update on mitigations performed

Base Command

zafran-mitigations-performed

Input

Argument Name Description Required
mitigation_id Mitigation ID. Optional
mitigation_ids Mitigation IDs. Optional
state Mitigation status new - New mitigation pending_approval - Waiting for mitigation approval rejected - Mitigative action was rejected. in_progress - Mitigation approved and in progress. completed - Mitigation applied successfully. Possible values are: new, pending_approval, rejected, in_progress, completed. Required

Context Output

Path Type Description
Zafran.MitigationsPerformedResponse.internal_status_code Number Internal status code.
Zafran.MitigationsPerformedResponse.message String Error message.

Configuration parameters

  • url — Server URL (e.g. api.zafran.io) (required)
  • api_key — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (3)

  • zafran-mitigation-performed

    Update on mitigations performed

  • zafran-mitigations-export

    Export recommended mitigations.

  • zafran-mitigations-performed

    Update on mitigations performed

Source

Zafran.py Zafran_test.py Zafran.yml Zafran_description.md command_examples.txt
Download History Raw 
!zafran-mitigations-export
!zafran-mitigation-performed mitigationstatus_id="id" mitigationstatus_external_ticket_id="ticketid" mitigationstatus_external_ticket_url="ticketurl" mitigationstatus_state=in_progress
!zafran-mitigations-performed mitigationsstatus_mitigation_ids=id1,id2 mitigationsstatus_state=in_progress