ZeroNetworksSegmentEventCollector

Details

ID	`ZeroNetworksSegmentEventCollector`
Provider	Zero Networks
Category	Network Security
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

This is the Zero Networks event collector integration for Cortex XSIAM.

Configure Zero Networks Segment Event Collector in Cortex

Parameter	Description	Required
Server URL		True
API Key	The API key to use for connection.	True
Fetch network events		False
Network Activity Filters	Use filters to reduce the amount of events.	False
Maximum audit events to fetch	Maximum number of audit events per fetch. The default value is 10000.	False
Maximum network activities events to fetch	Maximum number of network activities events per fetch. The default value is 2000.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

zero-networks-segment-get-events

Gets events from Zero Networks Segment.

Base Command

zero-networks-segment-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command will create events, otherwise it will only display them. Warning: Using this argument may lead to duplicate events. Possible values are: true, false. Default is false.	Required
from_date	Date from which to get events.	Optional

Context Output

There is no context output for this command.

Command Example

!zero-networks-segment-get-events from_date="2024-08-29T12:00:15.000Z"

Human Readable Output

Audit Events

timestamp	auditType	destinationEntitiesList	details	enforcementSource	isoTimestamp
1724928222479	1	{“id”: “fake_id”}	{“rule”:”fake_rule”, “id”:”fake_id”}	1	2024-08-29T10:43:42.479Z

Network Activities Events

timestamp	protocol	state	trafficType	dst	src
1724924207581	6	2	1	{“assetId”:”fake_dst”, “ip”:”1.2.3.4”}	{“assetId”:”fake_src”, “ip”:”1.1.1.1”}

Configuration parameters

url — Server URL (required)
credentials — (required)
event_types_to_fetch — Event Types To Fetch
network_activity_filters — Network Activity Filters
max_fetch_audit — Maximum audit events to fetch
max_fetch_network — Maximum network activities events to fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

zero-networks-segment-get-events
Gets events from Zero Networks Segment.

Source

ZeroNetworksSegmentEventCollector.py ZeroNetworksSegmentEventCollector_test.py ZeroNetworksSegmentEventCollector.yml ZeroNetworksSegmentEventCollector_description.md command_examples.txt

Download History Raw

category: Network Security
provider: Zero Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: ZeroNetworksSegmentEventCollector
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  defaultvalue: "https://portal.zeronetworks.com"
  section: Connect
- displaypassword: API Key
  additionalinfo: The API key to use for connection.
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Event Types To Fetch
  section: Collect
  name: event_types_to_fetch
  type: 16
  required: false
  additionalinfo: 'Event types to fetch. Default is Audit.'
  defaultvalue: Audit
  options:
  - Audit
  - Network Activities
- defaultvalue: '[{"id":"dstRiskLevel","includeValues":["2"]}]'
  display: Network Activity Filters
  additionalinfo: "To create Network Activity Filters:\n 1. Sign in to the Zero Networks platform.\n 2. Go to Activities page.\n 3. Under Network tab, apply the required filters.\n 4. Copy the filters from the URL.\n Use filters to reduce amount of events."
  name: network_activity_filters
  type: 0
  required: false
  section: Collect
- additionalinfo: Maximum number of audit events per fetch. The default value is 10000.
  defaultvalue: '10000'
  display: Maximum audit events to fetch
  name: max_fetch_audit
  type: 0
  required: false
  section: Collect
- additionalinfo: Maximum number of network activities events per fetch. The default value is 2000.
  defaultvalue: '2000'
  display: Maximum network activities events to fetch
  name: max_fetch_network
  type: 0
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Integrates with Zero Networks Segment API to fetch and process audit and network events.
display: Zero Networks Segment
name: ZeroNetworksSegmentEventCollector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: "If true, the command will create events, otherwise it will only display them. Warning: Using this argument may lead to duplicate events."
      isArray: false
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
      hidden: true
    - default: false
      description: Date from which to get events.
      name: from_date
      required: false
    - description: Maximum audit events to fetch.
      name: max_fetch_audit
    - description: Maximum network activities events to fetch.
      name: max_fetch_network
    description: Gets events from Zero Networks Segment.
    name: zero-networks-segment-get-events
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
fromversion: 6.10.0
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
supportedModules:
- xsiam