Acalvio ShadowPlex

Details

ID	`Acalvio ShadowPlex`
Provider	Acalvio
Category	Deception & Breach Simulation
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Acalvio ShadowPlex is a comprehensive Autonomous Deception Platform that offers Advanced Threat Detection, Investigation and Response capabilities.
This integration was integrated and tested with Acalvio ShadowPlex 5.x and ShadowPlex API 2.0.

Configure Acalvio ShadowPlex in Cortex

Parameter	Description	Required
url	Acalvio API Server URL (e.g. https://example.net)	True
apikey	Acalvio API Key	True
insecure	Trust SSL certificate	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

acalvio-is-deception-host

Check if its a Deception Host

Base Command

acalvio-is-deception-host

Input

Argument Name	Description	Required
host	Hostname or IP Address of Endpoint	Required

Context Output

Path	Type	Description
Acalvio.IsDeceptionHost.is_deception	Boolean	Returns ‘True’ if Host is a Deception else ‘False’
Acalvio.IsDeceptionHost.host	String	Host to be checked if Deception

Command Example

!acalvio-is-deception-host host="10.10.10.10"

Context Example

{
    'is_deception': true, 
    'host': '10.10.10.10'
}

Human Readable Output

Results - Deception Host

Key Value

is_deception true

host 10.10.10.10

Key	Value
is_deception	true
host	10.10.10.10

acalvio-is-deception-user

Check if its a Deception User

Base Command

acalvio-is-deception-user

Input

Argument Name	Description	Required
username	Username of the Domain User	Required
domain	AD Domain Name to which User belongs to	Optional

Context Output

Path	Type	Description
Acalvio.IsDeceptionUser.is_deception	Boolean	Returns ‘True’ if its a Deception User else ‘False’
Acalvio.IsDeceptionUser.username	String	Username to be checked if Deception
Acalvio.IsDeceptionUser.domain	String	Users Domain

Command Example

!acalvio-is-deception-user username="tom" domain="acalvio.com"

Context Example

{
    'is_deception': true, 
    'username': 'tom',
    'domain': 'acalvio.com'
}

Human Readable Output

Results - Deception User

| Key | Value |
| — | — |

is_deception true

username dmusernonadmin2

domain acalvio.com

acalvio-is-deception-file

Check if its a Deception File on the Endpoint

Base Command

acalvio-is-deception-file

Input

Argument Name	Description	Required
endpoint	Hostname or IP Address of Endpoint where file resides	Required
filename	Name of the file to be checked	Required

Context Output

Path	Type	Description
Acalvio.IsDeceptionFile.is_deception	Boolean	Returns ‘True’ if File is a Deception else ‘False’
Acalvio.IsDeceptionFile.filename	String	Filename to be checked if Deception
Acalvio.IsDeceptionFile.endpoint	String	Hostname or IP Address of Endpoint where file resides

Command Example

!acalvio-is-deception-file endpoint="win10-ep" filename="t33.pdf"

Context Example

{
    'is_deception': true, 
    'filename': 't33.pdf',
    'endpoint': 'win10-ep'
}

Human Readable Output

Results - Deception File

| Key | Value |
| — | — |

is_deception true

filename t33.pdf

endpoint win10-ep

acalvio-mute-deception-host

Mute a Deception Host

Base Command

acalvio-mute-deception-host

Input

Argument Name	Description	Required
host	Deception Host to be Muted	Required

Context Output

Path	Type	Description
Acalvio.MuteDeceptionHost.is_mute	Boolean	Returns ‘True’ if Deception is Muted else ‘False’
Acalvio.MuteDeceptionHost.host	String	Deception Host to be Muted

Command Example

acalvio-mute-deception-host host="win10-host"

Context Example

{
    'is_mute': true, 
    'host': 'win10-host'
}

Human Readable Output

Results - Mute Deception

| Key | Value |
| — | — |

is_mute true

host win10-host

acalvio-unmute-deception-host

Unmute a Deception Host

Base Command

acalvio-unmute-deception-host

Input

Argument Name	Description	Required
host	Deception Host to be Unmuted	Required

Context Output

Path	Type	Description
Acalvio.UnmuteDeceptionHost.is_unmute	Boolean	Returns ‘True’ if Deception is Unmuted else ‘False’
Acalvio.UnmuteDeceptionHost.host	String	Deception Host to be Unmuted

Command Example

acalvio-unmute-deception-host host="win10-host"

Context Example

{
    'is_unmute': true, 
    'host': 'win10-host'
}

Human Readable Output

Results - Unute Deception

| Key | Value |
| — | — |

is_unmute true

host win10-host

acalvio-mute-deception-on-endpoint

Mute a Deception on Endpoint

Base Command

acalvio-mute-deception-on-endpoint

Input

Argument Name	Description	Required
endpoint	Hostname or IP Address of Endpoint	Required

Context Output

Path	Type	Description
Acalvio.MuteDeceptionEndpoint.is_mute	Boolean	Returns ‘True’ if Deception is Muted else ‘False’
Acalvio.MuteDeceptionEndpoint.endpoint	String	Hostname or IP Address of Endpoint

Command Example

acalvio-mute-deception-on-endpoint endpoint="win10-ep"

Context Example

{
    'is_mute': true, 
    'endpoint': 'win10-ep'
}

Human Readable Output

Results - Mute Deception

| Key | Value |
| — | — |

is_mute true

endpoint win10-ep

acalvio-unmute-deception-on-endpoint

Unmute a Deception on Endpoint

Base Command

acalvio-unmute-deception-on-endpoint

Input

Argument Name	Description	Required
endpoint	Hostname or IP Address of Endpoint	Required

Context Output

Path	Type	Description
Acalvio.UnmuteDeceptionEndpoint.is_unmute	Boolean	Returns ‘True’ if Deception is Unmuted else ‘False’
Acalvio.UnmuteDeceptionEndpoint.endpoint	String	Hostname or IP Address of Endpoint

Command Example

acalvio-unmute-deception-on-endpoint endpoint="win10-ep"

Context Example

{
    'is_unmute': true, 
    'endpoint': 'win10-ep'
}

Human Readable Output

Results - Unmute Deception

| Key | Value |
| — | — |

is_unmute true

endpoint win10-ep

Configuration parameters

url — Acalvio API Server URL (e.g. https://example.net) (required)
apikey — Acalvio API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (7)

acalvio-is-deception-file
Check for a Deception File on the Endpoint
acalvio-is-deception-host
Check for a Deception Host
acalvio-is-deception-user
Check for a Deception User
acalvio-mute-deception-host
Mute a Deception Host
acalvio-mute-deception-on-endpoint
Mute a Deception on Endpoint
acalvio-unmute-deception-host
Unmute a Deception Host
acalvio-unmute-deception-on-endpoint
Unmute a Deception on Endpoint

Source

acalvioapp.py acalvioapp_test.py acalvioapp.yml acalvioapp_description.md command_examples.txt

Download History Raw

import pytest
from acalvioapp import Client
from test_data.api_request_data import BASE_URL, apikey, content_type, decoy_filename, decoy_host, decoy_user, domain, ep_host
from test_data.api_responses import (
    test_connection_failure,
    test_connection_invalid_api_key,
    test_connection_success,
    test_decoy_file_false,
    test_decoy_file_true,
    test_decoy_host_false,
    test_decoy_host_true,
    test_decoy_user_false,
    test_decoy_user_true,
    test_missing_parameter,
    test_mute_again_already_muted_decoy,
    test_mute_already_muted_host,
    test_mute_decoy_false,
    test_mute_decoy_true,
    test_mute_host_false,
    test_mute_host_true,
    test_server_error,
    test_unmute_again_already_unmuted_decoy,
    test_unmute_already_unmuted_host,
    test_unmute_decoy_false,
    test_unmute_decoy_true,
    test_unmute_host_false,
    test_unmute_host_true,
)

headers = {"api_key": apikey, "content-type": content_type}

client = Client(base_url=BASE_URL, verify=False, headers=headers)


class MockRequestsResponse:
    def __init__(self, json_data, status_code, reason, text=""):
        self.json_data = json_data
        self.status_code = status_code
        self.reason = reason
        self.text = text

    def json(self):
        return self.json_data


def test_do_test_connection_success(mocker):
    from acalvioapp import do_test_connection

    mock_response = MockRequestsResponse(
        json_data=test_connection_success.__getitem__("HTTP Body"),
        status_code=test_connection_success.__getitem__("HTTP Status Code"),
        reason=test_connection_success.__getitem__("HTTP Reason"),
        text=test_connection_success.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_test_connection(client)
    assert result.lower() == "ok"


def test_do_test_connection_failure(mocker):
    from acalvioapp import do_test_connection

    mock_response = MockRequestsResponse(
        json_data=test_connection_failure.__getitem__("HTTP Body"),
        status_code=test_connection_failure.__getitem__("HTTP Status Code"),
        reason=test_connection_failure.__getitem__("HTTP Reason"),
        text=test_connection_failure.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    with pytest.raises(SystemExit):
        result = do_test_connection(client)
        assert result is None


def test_do_test_connection_unauthorized(mocker):
    from acalvioapp import do_test_connection

    mock_response = MockRequestsResponse(
        json_data=test_connection_invalid_api_key.__getitem__("HTTP Body"),
        status_code=test_connection_invalid_api_key.__getitem__("HTTP Status Code"),
        reason=test_connection_invalid_api_key.__getitem__("HTTP Reason"),
        text=test_connection_invalid_api_key.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    with pytest.raises(SystemExit):
        result = do_test_connection(client)
        assert result is None


def test_do_test_connection_error(mocker):
    from acalvioapp import do_test_connection

    mock_response = MockRequestsResponse(
        json_data=test_server_error.__getitem__("HTTP Body"),
        status_code=test_server_error.__getitem__("HTTP Status Code"),
        reason=test_server_error.__getitem__("HTTP Reason"),
        text=test_server_error.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    with pytest.raises(SystemExit):
        result = do_test_connection(client)
        assert result is None


def test_do_deception_host_command_decoy_exists(mocker):
    from acalvioapp import do_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_decoy_host_true.__getitem__("HTTP Body"),
        status_code=test_decoy_host_true.__getitem__("HTTP Status Code"),
        reason=test_decoy_host_true.__getitem__("HTTP Reason"),
        text=test_decoy_host_true.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_deception_host_command(client, {"Host": decoy_host})
    assert result.outputs["IsDeception"] is True


def test_do_deception_host_command_decoy_not_exists(mocker):
    from acalvioapp import do_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_decoy_host_false.__getitem__("HTTP Body"),
        status_code=test_decoy_host_false.__getitem__("HTTP Status Code"),
        reason=test_decoy_host_false.__getitem__("HTTP Reason"),
        text=test_decoy_host_false.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_deception_host_command(client, {"Host": decoy_host})
    assert result.outputs["IsDeception"] is False


def test_do_deception_file_command_decoy_file_exists(mocker):
    from acalvioapp import do_deception_file_command

    mock_response = MockRequestsResponse(
        json_data=test_decoy_file_true.__getitem__("HTTP Body"),
        status_code=test_decoy_file_true.__getitem__("HTTP Status Code"),
        reason=test_decoy_file_true.__getitem__("HTTP Reason"),
        text=test_decoy_file_true.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_deception_file_command(client, {"Filename": decoy_filename, "Endpoint": ep_host})
    assert result.outputs["IsDeception"] is True


def test_do_deception_file_command_decoy_file_not_exists(mocker):
    from acalvioapp import do_deception_file_command

    mock_response = MockRequestsResponse(
        json_data=test_decoy_file_false.__getitem__("HTTP Body"),
        status_code=test_decoy_file_false.__getitem__("HTTP Status Code"),
        reason=test_decoy_file_false.__getitem__("HTTP Reason"),
        text=test_decoy_file_false.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_deception_file_command(client, {"Filename": decoy_filename, "Endpoint": ep_host})
    assert result.outputs["IsDeception"] is False


def test_do_deception_user_command_user_exists(mocker):
    from acalvioapp import do_deception_user_command

    mock_response = MockRequestsResponse(
        json_data=test_decoy_user_true.__getitem__("HTTP Body"),
        status_code=test_decoy_user_true.__getitem__("HTTP Status Code"),
        reason=test_decoy_user_true.__getitem__("HTTP Reason"),
        text=test_decoy_user_true.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_deception_user_command(client, {"Username": decoy_user, "Domain": domain})
    assert result.outputs["IsDeception"] is True


def test_do_deception_user_command_user_not_exists(mocker):
    from acalvioapp import do_deception_user_command

    mock_response = MockRequestsResponse(
        json_data=test_decoy_user_false.__getitem__("HTTP Body"),
        status_code=test_decoy_user_false.__getitem__("HTTP Status Code"),
        reason=test_decoy_user_false.__getitem__("HTTP Reason"),
        text=test_decoy_user_false.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_deception_user_command(client, {"Username": decoy_user, "Domain": domain})
    assert result.outputs["IsDeception"] is False


def test_do_mute_deception_host_command_decoy_exists(mocker):
    from acalvioapp import do_mute_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_mute_decoy_true.__getitem__("HTTP Body"),
        status_code=test_mute_decoy_true.__getitem__("HTTP Status Code"),
        reason=test_mute_decoy_true.__getitem__("HTTP Reason"),
        text=test_mute_decoy_true.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_mute_deception_host_command(client, {"Host": decoy_host})
    assert result.outputs["IsMute"] is True


def test_do_mute_deception_host_command_decoy_not_exists(mocker):
    from acalvioapp import do_mute_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_mute_decoy_false.__getitem__("HTTP Body"),
        status_code=test_mute_decoy_false.__getitem__("HTTP Status Code"),
        reason=test_mute_decoy_false.__getitem__("HTTP Reason"),
        text=test_mute_decoy_false.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_mute_deception_host_command(client, {"Host": decoy_host})
    assert result.outputs["IsMute"] is False


def test_do_mute_deception_host_command_decoy_already_muted(mocker):
    from acalvioapp import do_mute_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_mute_again_already_muted_decoy.__getitem__("HTTP Body"),
        status_code=test_mute_again_already_muted_decoy.__getitem__("HTTP Status Code"),
        reason=test_mute_again_already_muted_decoy.__getitem__("HTTP Reason"),
        text=test_mute_again_already_muted_decoy.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_mute_deception_host_command(client, {"Host": decoy_host})
    assert result.outputs["IsMute"] is True


def test_do_unmute_deception_host_command_decoy_exists(mocker):
    from acalvioapp import do_unmute_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_unmute_decoy_true.__getitem__("HTTP Body"),
        status_code=test_unmute_decoy_true.__getitem__("HTTP Status Code"),
        reason=test_unmute_decoy_true.__getitem__("HTTP Reason"),
        text=test_unmute_decoy_true.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_unmute_deception_host_command(client, {"Host": decoy_host})
    assert result.outputs["IsUnmute"] is True


def test_do_unmute_deception_host_command_decoy_not_exists(mocker):
    from acalvioapp import do_unmute_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_unmute_decoy_false.__getitem__("HTTP Body"),
        status_code=test_unmute_decoy_false.__getitem__("HTTP Status Code"),
        reason=test_unmute_decoy_false.__getitem__("HTTP Reason"),
        text=test_unmute_decoy_false.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_unmute_deception_host_command(client, {"Host": decoy_host})
    assert result.outputs["IsUnmute"] is False


def test_do_unmute_deception_host_command_decoy_already_unmuted(mocker):
    from acalvioapp import do_unmute_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_unmute_again_already_unmuted_decoy.__getitem__("HTTP Body"),
        status_code=test_unmute_again_already_unmuted_decoy.__getitem__("HTTP Status Code"),
        reason=test_unmute_again_already_unmuted_decoy.__getitem__("HTTP Reason"),
        text=test_unmute_again_already_unmuted_decoy.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_unmute_deception_host_command(client, {"Host": decoy_host})
    assert result.outputs["IsUnmute"] is True


def test_do_mute_deception_ep_command_ep_exists(mocker):
    from acalvioapp import do_mute_deception_ep_command

    mock_response = MockRequestsResponse(
        json_data=test_mute_host_true.__getitem__("HTTP Body"),
        status_code=test_mute_host_true.__getitem__("HTTP Status Code"),
        reason=test_mute_host_true.__getitem__("HTTP Reason"),
        text=test_mute_host_true.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_mute_deception_ep_command(client, {"Endpoint": ep_host})
    assert result.outputs["IsMute"] is True


def test_do_mute_deception_ep_command_ep_not_exists(mocker):
    from acalvioapp import do_mute_deception_ep_command

    mock_response = MockRequestsResponse(
        json_data=test_mute_host_false.__getitem__("HTTP Body"),
        status_code=test_mute_host_false.__getitem__("HTTP Status Code"),
        reason=test_mute_host_false.__getitem__("HTTP Reason"),
        text=test_mute_host_false.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_mute_deception_ep_command(client, {"Endpoint": ep_host})
    assert result.outputs["IsMute"] is False


def test_do_mute_deception_ep_command_ep_already_muted(mocker):
    from acalvioapp import do_mute_deception_ep_command

    mock_response = MockRequestsResponse(
        json_data=test_mute_already_muted_host.__getitem__("HTTP Body"),
        status_code=test_mute_already_muted_host.__getitem__("HTTP Status Code"),
        reason=test_mute_already_muted_host.__getitem__("HTTP Reason"),
        text=test_mute_already_muted_host.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_mute_deception_ep_command(client, {"Endpoint": ep_host})
    assert result.outputs["IsMute"] is True


def test_do_unmute_deception_ep_command_ep_exists(mocker):
    from acalvioapp import do_unmute_deception_ep_command

    mock_response = MockRequestsResponse(
        json_data=test_unmute_host_true.__getitem__("HTTP Body"),
        status_code=test_unmute_host_true.__getitem__("HTTP Status Code"),
        reason=test_unmute_host_true.__getitem__("HTTP Reason"),
        text=test_unmute_host_true.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_unmute_deception_ep_command(client, {"Endpoint": ep_host})
    assert result.outputs["IsUnmute"] is True


def test_do_unmute_deception_ep_command_ep_not_exists(mocker):
    from acalvioapp import do_unmute_deception_ep_command

    mock_response = MockRequestsResponse(
        json_data=test_unmute_host_false.__getitem__("HTTP Body"),
        status_code=test_unmute_host_false.__getitem__("HTTP Status Code"),
        reason=test_unmute_host_false.__getitem__("HTTP Reason"),
        text=test_unmute_host_false.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_unmute_deception_ep_command(client, {"Endpoint": ep_host})
    assert result.outputs["IsUnmute"] is False


def test_do_unmute_deception_ep_command_ep_already_unmuted(mocker):
    from acalvioapp import do_unmute_deception_ep_command

    mock_response = MockRequestsResponse(
        json_data=test_unmute_already_unmuted_host.__getitem__("HTTP Body"),
        status_code=test_unmute_already_unmuted_host.__getitem__("HTTP Status Code"),
        reason=test_unmute_already_unmuted_host.__getitem__("HTTP Reason"),
        text=test_unmute_already_unmuted_host.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    result = do_unmute_deception_ep_command(client, {"Endpoint": ep_host})
    assert result.outputs["IsUnmute"] is True


def test_do_deception_host_command_missing_parameter(mocker):
    from acalvioapp import do_deception_host_command

    mock_response = MockRequestsResponse(
        json_data=test_missing_parameter.__getitem__("HTTP Body"),
        status_code=test_missing_parameter.__getitem__("HTTP Status Code"),
        reason=test_missing_parameter.__getitem__("HTTP Reason"),
        text=test_missing_parameter.__getitem__("HTTP Body"),
    )
    mocker.patch.object(Client, "_http_request", return_value=mock_response)
    with pytest.raises(SystemExit):
        result = do_deception_host_command(client, {})
        assert result is None