Acalvio ShadowPlex

Details

ID	`Acalvio ShadowPlex`
Provider	Acalvio
Category	Deception & Breach Simulation
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Acalvio ShadowPlex is a comprehensive Autonomous Deception Platform that offers Advanced Threat Detection, Investigation and Response capabilities.
This integration was integrated and tested with Acalvio ShadowPlex 5.x and ShadowPlex API 2.0.

Configure Acalvio ShadowPlex in Cortex

Parameter	Description	Required
url	Acalvio API Server URL (e.g. https://example.net)	True
apikey	Acalvio API Key	True
insecure	Trust SSL certificate	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

acalvio-is-deception-host

Check if its a Deception Host

Base Command

acalvio-is-deception-host

Input

Argument Name	Description	Required
host	Hostname or IP Address of Endpoint	Required

Context Output

Path	Type	Description
Acalvio.IsDeceptionHost.is_deception	Boolean	Returns ‘True’ if Host is a Deception else ‘False’
Acalvio.IsDeceptionHost.host	String	Host to be checked if Deception

Command Example

!acalvio-is-deception-host host="10.10.10.10"

Context Example

{
    'is_deception': true, 
    'host': '10.10.10.10'
}

Human Readable Output

Results - Deception Host

Key Value

is_deception true

host 10.10.10.10

Key	Value
is_deception	true
host	10.10.10.10

acalvio-is-deception-user

Check if its a Deception User

Base Command

acalvio-is-deception-user

Input

Argument Name	Description	Required
username	Username of the Domain User	Required
domain	AD Domain Name to which User belongs to	Optional

Context Output

Path	Type	Description
Acalvio.IsDeceptionUser.is_deception	Boolean	Returns ‘True’ if its a Deception User else ‘False’
Acalvio.IsDeceptionUser.username	String	Username to be checked if Deception
Acalvio.IsDeceptionUser.domain	String	Users Domain

Command Example

!acalvio-is-deception-user username="tom" domain="acalvio.com"

Context Example

{
    'is_deception': true, 
    'username': 'tom',
    'domain': 'acalvio.com'
}

Human Readable Output

Results - Deception User

| Key | Value |
| — | — |

is_deception true

username dmusernonadmin2

domain acalvio.com

acalvio-is-deception-file

Check if its a Deception File on the Endpoint

Base Command

acalvio-is-deception-file

Input

Argument Name	Description	Required
endpoint	Hostname or IP Address of Endpoint where file resides	Required
filename	Name of the file to be checked	Required

Context Output

Path	Type	Description
Acalvio.IsDeceptionFile.is_deception	Boolean	Returns ‘True’ if File is a Deception else ‘False’
Acalvio.IsDeceptionFile.filename	String	Filename to be checked if Deception
Acalvio.IsDeceptionFile.endpoint	String	Hostname or IP Address of Endpoint where file resides

Command Example

!acalvio-is-deception-file endpoint="win10-ep" filename="t33.pdf"

Context Example

{
    'is_deception': true, 
    'filename': 't33.pdf',
    'endpoint': 'win10-ep'
}

Human Readable Output

Results - Deception File

| Key | Value |
| — | — |

is_deception true

filename t33.pdf

endpoint win10-ep

acalvio-mute-deception-host

Mute a Deception Host

Base Command

acalvio-mute-deception-host

Input

Argument Name	Description	Required
host	Deception Host to be Muted	Required

Context Output

Path	Type	Description
Acalvio.MuteDeceptionHost.is_mute	Boolean	Returns ‘True’ if Deception is Muted else ‘False’
Acalvio.MuteDeceptionHost.host	String	Deception Host to be Muted

Command Example

acalvio-mute-deception-host host="win10-host"

Context Example

{
    'is_mute': true, 
    'host': 'win10-host'
}

Human Readable Output

Results - Mute Deception

| Key | Value |
| — | — |

is_mute true

host win10-host

acalvio-unmute-deception-host

Unmute a Deception Host

Base Command

acalvio-unmute-deception-host

Input

Argument Name	Description	Required
host	Deception Host to be Unmuted	Required

Context Output

Path	Type	Description
Acalvio.UnmuteDeceptionHost.is_unmute	Boolean	Returns ‘True’ if Deception is Unmuted else ‘False’
Acalvio.UnmuteDeceptionHost.host	String	Deception Host to be Unmuted

Command Example

acalvio-unmute-deception-host host="win10-host"

Context Example

{
    'is_unmute': true, 
    'host': 'win10-host'
}

Human Readable Output

Results - Unute Deception

| Key | Value |
| — | — |

is_unmute true

host win10-host

acalvio-mute-deception-on-endpoint

Mute a Deception on Endpoint

Base Command

acalvio-mute-deception-on-endpoint

Input

Argument Name	Description	Required
endpoint	Hostname or IP Address of Endpoint	Required

Context Output

Path	Type	Description
Acalvio.MuteDeceptionEndpoint.is_mute	Boolean	Returns ‘True’ if Deception is Muted else ‘False’
Acalvio.MuteDeceptionEndpoint.endpoint	String	Hostname or IP Address of Endpoint

Command Example

acalvio-mute-deception-on-endpoint endpoint="win10-ep"

Context Example

{
    'is_mute': true, 
    'endpoint': 'win10-ep'
}

Human Readable Output

Results - Mute Deception

| Key | Value |
| — | — |

is_mute true

endpoint win10-ep

acalvio-unmute-deception-on-endpoint

Unmute a Deception on Endpoint

Base Command

acalvio-unmute-deception-on-endpoint

Input

Argument Name	Description	Required
endpoint	Hostname or IP Address of Endpoint	Required

Context Output

Path	Type	Description
Acalvio.UnmuteDeceptionEndpoint.is_unmute	Boolean	Returns ‘True’ if Deception is Unmuted else ‘False’
Acalvio.UnmuteDeceptionEndpoint.endpoint	String	Hostname or IP Address of Endpoint

Command Example

acalvio-unmute-deception-on-endpoint endpoint="win10-ep"

Context Example

{
    'is_unmute': true, 
    'endpoint': 'win10-ep'
}

Human Readable Output

Results - Unmute Deception

| Key | Value |
| — | — |

is_unmute true

endpoint win10-ep

Configuration parameters

url — Acalvio API Server URL (e.g. https://example.net) (required)
apikey — Acalvio API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (7)

acalvio-is-deception-file
Check for a Deception File on the Endpoint
acalvio-is-deception-host
Check for a Deception Host
acalvio-is-deception-user
Check for a Deception User
acalvio-mute-deception-host
Mute a Deception Host
acalvio-mute-deception-on-endpoint
Mute a Deception on Endpoint
acalvio-unmute-deception-host
Unmute a Deception Host
acalvio-unmute-deception-on-endpoint
Unmute a Deception on Endpoint

Source

acalvioapp.py acalvioapp_test.py acalvioapp.yml acalvioapp_description.md command_examples.txt

Download History Raw

category: Deception & Breach Simulation
provider: Acalvio
commonfields:
  id: Acalvio ShadowPlex
  version: -1
configuration:
- defaultvalue: https://example.net
  display: Acalvio API Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
- display: Acalvio API Key
  name: apikey
  required: true
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Acalvio ShadowPlex is a comprehensive Autonomous Deception Platform that offers Advanced Threat Detection, Investigation and Response capabilities.
display: Acalvio ShadowPlex
name: Acalvio ShadowPlex
script:
  commands:
  - arguments:
    - description: Hostname or IP Address of Endpoint.
      name: host
      required: true
    description: Check for a Deception Host
    name: acalvio-is-deception-host
    outputs:
    - contextPath: Acalvio.IsDeceptionHost.IsDeception
      description: Returns 'True' if Host is a Deception else 'False'.
      type: Boolean
    - contextPath: Acalvio.IsDeceptionHost.Host
      description: Host to be checked if Deception.
      type: String
    - contextPath: Acalvio.IsDeceptionHost.DateTime
      description: Date including Time.
      type: String
  - arguments:
    - description: Username of the Domain User.
      name: username
      required: true
    - description: AD Domain Name to which User belongs to.
      name: domain
    description: Check for a Deception User
    name: acalvio-is-deception-user
    outputs:
    - contextPath: Acalvio.IsDeceptionUser.IsDeception
      description: Returns 'True' if its a Deception User else 'False'.
      type: Boolean
    - contextPath: Acalvio.IsDeceptionUser.Username
      description: Username to be checked if Deception.
      type: String
    - contextPath: Acalvio.IsDeceptionUser.Domain
      description: Users Domain.
      type: String
    - contextPath: Acalvio.IsDeceptionUser.DateTime
      description: Date including Time.
      type: String
  - arguments:
    - description: Hostname or IP Address of Endpoint where file resides.
      name: endpoint
      required: true
    - description: Name of the file to be checked.
      name: filename
      required: true
    description: Check for a Deception File on the Endpoint
    name: acalvio-is-deception-file
    outputs:
    - contextPath: Acalvio.IsDeceptionFile.IsDeception
      description: Returns 'True' if File is a Deception else 'False'.
      type: Boolean
    - contextPath: Acalvio.IsDeceptionFile.Filename
      description: Filename to be checked if Deception.
      type: String
    - contextPath: Acalvio.IsDeceptionFile.Endpoint
      description: Hostname or IP Address of Endpoint where file resides.
      type: String
    - contextPath: Acalvio.IsDeceptionFile.DateTime
      description: Date including Time.
      type: String
  - arguments:
    - description: Hostname or IP Address of Deception Host.
      name: host
      required: true
    description: Mute a Deception Host
    name: acalvio-mute-deception-host
    outputs:
    - contextPath: Acalvio.MuteDeceptionHost.Host
      description: Deception Host to be Muted.
      type: String
    - contextPath: Acalvio.MuteDeceptionHost.IsMute
      description: Returns 'True' if Deception is Muted else 'False'.
      type: Boolean
    - contextPath: Acalvio.MuteDeceptionHost.DateTime
      description: Date including Time.
      type: String
  - arguments:
    - description: Hostname or IP Address of Deception Host.
      name: host
      required: true
    description: Unmute a Deception Host
    name: acalvio-unmute-deception-host
    outputs:
    - contextPath: Acalvio.UnmuteDeceptionHost.Host
      description: Deception Host to be Unmuted.
      type: String
    - contextPath: Acalvio.UnmuteDeceptionHost.IsUnmute
      description: Returns 'True' if Deception is Unmuted else 'False'.
      type: Boolean
    - contextPath: Acalvio.UnmuteDeceptionHost.DateTime
      description: Date including Time.
      type: String
  - arguments:
    - description: Hostname or IP Address of Endpoint.
      name: endpoint
      required: true
    description: Mute a Deception on Endpoint
    name: acalvio-mute-deception-on-endpoint
    outputs:
    - contextPath: Acalvio.MuteDeceptionEndpoint.Endpoint
      description: Endpoint on which Deception is to be Muted.
      type: String
    - contextPath: Acalvio.MuteDeceptionEndpoint.IsMute
      description: Returns 'True' if Deception is Muted else 'False'.
      type: Boolean
    - contextPath: Acalvio.MuteDeceptionEndpoint.DateTime
      description: Date including Time.
      type: String
  - arguments:
    - description: Hostname or IP Address of Endpoint.
      name: endpoint
      required: true
    description: Unmute a Deception on Endpoint
    name: acalvio-unmute-deception-on-endpoint
    outputs:
    - contextPath: Acalvio.UnmuteDeceptionEndpoint.Endpoint
      description: Endpoint on which Deception is to be Unmuted.
      type: String
    - contextPath: Acalvio.UnmuteDeceptionEndpoint.IsUnmute
      description: Returns 'True' if Deception is Unmuted else 'False'.
      type: Boolean
    - contextPath: Acalvio.UnmuteDeceptionEndpoint.DateTime
      description: Date including Time.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- no test
fromversion: 5.0.0