appNovi

Details

ID	`appNovi`
Provider	Fenix24
Category	Analytics & SIEM
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Search across meshed network, security, and business data in appNovi to make efficient informed security decisions for risk management and incident response. Gain immediate intelligence on assets, visualize risk and threats across your network, and undertake interactive investigations across the network to reduce MTTR for incident response.

This integration was integrated and tested with appNovi v2.0

Configure appNovi in Cortex

Parameter	Description	Required
Full URL of appNovi instance API.		True
API Token	appNovi token URL for authentication	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

search-appnovi-components

Search for Components by name or value

Base Command

search-appnovi-components

Input

Argument Name	Description	Required
search_term	The string to use to search for Components.	Required
max_results	Number of results. Default is 25.	Optional

Context Output

Path	Type	Description
appnovi.components.name	String	Name of thing
appnovi.components.coll	String	Collection containing thing
appnovi.components.u._id	String	appNovi Database ID.
appnovi.components.u._key	String	appNovi Database Key.
appnovi.components.u.identity.company	String	Company ID
appnovi.components.u.identity.type	String	Thing type
appnovi.components.u.identity.value	String	Thing name
appnovi.components.u.identity.datacenter	String	Datacenter ID
appnovi.components.u.identity.domain	String	Domain ID
appnovi.components.u.lastSeen	Date	Time thing was last seen.
appnovi.components.u.source	Date	This is information about the source of the entity.
appnovi.components.u.userProperties	String	These are the custom properties of the entity.
appnovi.components.connections	Number	Number of connections.
appnovi.time	Number	Query time (for diagnostics)

search-appnovi-connected

Search for Components connected to supplied identity

Base Command

search-appnovi-connected

Input

Argument Name	Description	Required
identity	appNovi identifier key-value or use key “_id” when searching via appNovi ID.	Required
category	Optional category of components to return. Possible values are: BaseComponent, Identity, IPAddress, Interface, Server, Storage, Hypervisor, CloudInfra, CloudService, NetworkInfra, Cluster, Container, MessageQueue, Vulnerability, CVE, Employee, Client, Software, Policy, Databases.	Optional
type	Optional type of components to return. Possible values are: genericcomponent, genericmetadata, rdns, user, machine, iamrole, iamuser, ip, ipv4, ipv6, mac, eni, interface, vmwarevm, ec2, azurevm, vm, server, physical, s3, datastore, bucket, storage, esx, vcenter, hypervisor, vpc, subscription, account, resourcegroup, region, availabilityzone, autoscalinggroup, elasticloadbalancer, org, folder, project, vnet, rds, ecr, lambda, redshift, dynamodbtable, router, firewall, switch, loadbalancer, proxy, middleware, kubernetes, aks, eks, swarm, mesos, nomad, docker, containerd, messagetopic, messageserver, vulnerability, cve, employee, contractor, desktop, laptop, pc, vdi, mobile, client, software, ami, securitygroup, iampolicy, column, database, table, view.	Optional
max_results	Number of results. Default is 25.	Optional

Context Output

Path	Type	Description
appnovi._key	String	appNovi database key
appnovi._id	String	appNovi database ID.
appnovi.category	String	appNovi Category (e.g. Interface, Server)
appnovi.firstSeen	Date	When was this Thing first seen?
appnovi.identity.company	String	Company ID
appnovi.identity.datacenter	String	Datacenter ID
appnovi.identity.domain	String	Domain ID
appnovi.identity.type	String	Thing type
appnovi.identity.value	String	Identity value
appnovi.lastSeen	Date	Last time thing was seen
appnovi.name	String	Name of entity.
appnovi.source	Unknown	This is information about the source of the entity.
appnovi.userProperties	String	These are the custom properties of the entity.
appnovi.applications	String	List of applications

search-appnovi-cve

Search for servers with matching CVE

Base Command

search-appnovi-cve

Input

Argument Name	Description	Required
cve	CVE e.g. “CVE-2017-0143”.	Required

Context Output

Path	Type	Description
appnovi._key	String	appNovi database key
appnovi._id	String	appNovi database ID.
appnovi.category	String	appNovi Category (e.g. Interface, Server)
appnovi.firstSeen	Date	When was this Thing first seen?
appnovi.identity.company	String	Company ID
appnovi.identity.datacenter	String	Datacenter ID
appnovi.identity.domain	String	Domain ID
appnovi.identity.type	String	Thing type
appnovi.identity.value	String	Identity value
appnovi.lastSeen	Date	Last time thing was seen
appnovi.name	String	Name of entity.
appnovi.source	Unknown	This is information about the source of the entity.
appnovi.userProperties	String	These are the custom properties of the entity.
appnovi.applications	String	List of applications

search-appnovi-component-property

Search for Components by property and value

Base Command

search-appnovi-component-property

Input

Argument Name	Description	Required
property	Name of property.	Required
value	Value of property.	Required
max_results	Number of results. Default is 25.	Optional

Context Output

Path	Type	Description
appnovi.components.name	String	Name of thing
appnovi.components.coll	String	Collection containing thing
appnovi.components.u._id	String	appNovi Database ID.
appnovi.components.u._key	String	appNovi Database Key.
appnovi.components.u.identity.company	String	Company ID
appnovi.components.u.identity.type	String	Thing type
appnovi.components.u.identity.value	String	Thing name
appnovi.components.u.identity.datacenter	String	Datacenter ID
appnovi.components.u.identity.domain	String	Domain ID
appnovi.components.u.lastSeen	Date	Time thing was last seen.
appnovi.components.u.source	Date	This is information about the source of the entity.
appnovi.components.u.userProperties	String	These are the custom properties of the entity.
appnovi.components.connections	Number	Number of connections.
appnovi.time	Number	Query time (for diagnostics)

search-appnovi-server-by-ip

Search for servers using IP address

Base Command

search-appnovi-server-by-ip

Input

Argument Name	Description	Required
ip	Server IP to search.	Required

Context Output

Path	Type	Description
appnovi._key	String	appNovi database key
appnovi._id	String	appNovi database ID.
appnovi.category	String	appNovi Category (e.g. Interface, Server)
appnovi.firstSeen	Date	When was this Thing first seen?
appnovi.identity.company	String	Company ID
appnovi.identity.datacenter	String	Datacenter ID
appnovi.identity.domain	String	Domain ID
appnovi.identity.type	String	Thing type
appnovi.identity.value	String	Identity value
appnovi.lastSeen	Date	Last time thing was seen
appnovi.name	String	Name of entity.
appnovi.source	Unknown	This is information about the source of the entity.
appnovi.userProperties	String	These are the custom properties of the entity.
appnovi.applications	String	List of applications

Configuration parameters

appnovi_url — Full URL of appNovi instance. (required)
appnovi_token — API Token (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (5)

search-appnovi-component-property
Search for Components by property and value.
search-appnovi-components
Search for Components by name or value.
search-appnovi-connected
Search for Components connected to supplied identity.
search-appnovi-cve
Search for servers with matching CVE.
search-appnovi-server-by-ip
Search for servers using IP address.

Source

appNovi.py appNovi_test.py appNovi.yml appNovi_description.md command_examples.txt

Download History Raw

commonfields:
  id: appNovi
  version: -1
name: appNovi
display: appNovi
category: Analytics & SIEM
provider: Fenix24
description: "Search across meshed network, security, and business data in appNovi to make efficient informed security decisions for risk management and incident response. Gain immediate intelligence on assets, visualize risk and threats across your network, and undertake interactive investigations across the network to reduce MTTR for incident response. \n"
configuration:
- display: Full URL of appNovi instance.
  name: appnovi_url
  defaultvalue: https://my.appnovi.server
  type: 0
  required: true
- display: API Token
  name: appnovi_token
  type: 4
  required: true
  additionalinfo: appNovi token URL for authentication
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: '-'
  type: python
  subtype: python3
  commands:
  - name: search-appnovi-components
    arguments:
    - name: search_term
      required: true
      type: textArea
      description: The string to use to search for Components.
    - name: max_results
      default: true
      defaultValue: "25"
      description: Number of results.
    outputs:
    - contextPath: appnovi.components.name
      description: Name of thing.
      type: String
    - contextPath: appnovi.components.coll
      description: Collection containing thing.
      type: String
    - contextPath: appnovi.components.u._id
      description: appNovi Database ID.
      type: String
    - contextPath: appnovi.components.u._key
      description: appNovi Database Key.
      type: String
    - contextPath: appnovi.components.u.identity.company
      description: Company ID.
      type: String
    - contextPath: appnovi.components.u.identity.type
      description: Thing type.
      type: String
    - contextPath: appnovi.components.u.identity.value
      description: Thing name.
      type: String
    - contextPath: appnovi.components.u.identity.datacenter
      description: Datacenter ID.
      type: String
    - contextPath: appnovi.components.u.identity.domain
      description: Domain ID.
      type: String
    - contextPath: appnovi.components.u.lastSeen
      description: Time thing was last seen.
      type: Date
    - contextPath: appnovi.components.u.source
      description: This is information about the source of the entity.
      type: Date
    - contextPath: appnovi.components.u.userProperties
      description: These are the custom properties of the entity.
      type: String
    - contextPath: appnovi.components.connections
      description: Number of connections.
      type: Number
    - contextPath: appnovi.time
      description: Query time (for diagnostics).
      type: Number
    description: Search for Components by name or value.
  - name: search-appnovi-connected
    outputs:
    - contextPath: appnovi._key
      description: 'appNovi database key.'
      type: String
    - contextPath: appnovi._id
      description: appNovi database ID.
      type: String
    - contextPath: appnovi.category
      description: appNovi Category (e.g. Interface, Server).
      type: String
    - contextPath: appnovi.firstSeen
      description: When was this Thing first seen?
      type: Date
    - contextPath: appnovi.identity.company
      description: Company ID.
      type: String
    - contextPath: appnovi.identity.datacenter
      description: Datacenter ID.
      type: String
    - contextPath: appnovi.identity.domain
      description: Domain ID.
      type: String
    - contextPath: appnovi.identity.type
      description: Thing type.
      type: String
    - contextPath: appnovi.identity.value
      description: Identity value.
      type: String
    - contextPath: appnovi.lastSeen
      description: Last time thing was seen.
      type: Date
    - contextPath: appnovi.name
      description: Name of entity.
      type: String
    - contextPath: appnovi.source
      description: This is information about the source of the entity.
      type: Unknown
    - contextPath: appnovi.userProperties
      description: These are the custom properties of the entity.
      type: String
    - contextPath: appnovi.applications
      description: List of applications.
      type: String
    arguments:
    - name: identity
      required: true
      description: appNovi identifier key-value or use key "_id" when searching via appNovi ID.
      type: keyValue
    - name: category
      auto: PREDEFINED
      predefined:
      - BaseComponent
      - Identity
      - IPAddress
      - Interface
      - Server
      - Storage
      - Hypervisor
      - CloudInfra
      - CloudService
      - NetworkInfra
      - Cluster
      - Container
      - MessageQueue
      - Vulnerability
      - CVE
      - Employee
      - Client
      - Software
      - Policy
      - Databases
      description: Optional category of components to return.
      isArray: true
      type: textArea
    - name: type
      auto: PREDEFINED
      predefined:
      - genericcomponent
      - genericmetadata
      - rdns
      - user
      - machine
      - iamrole
      - iamuser
      - ip
      - ipv4
      - ipv6
      - mac
      - eni
      - interface
      - vmwarevm
      - ec2
      - azurevm
      - vm
      - server
      - physical
      - s3
      - datastore
      - bucket
      - storage
      - esx
      - vcenter
      - hypervisor
      - vpc
      - subscription
      - account
      - resourcegroup
      - region
      - availabilityzone
      - autoscalinggroup
      - elasticloadbalancer
      - org
      - folder
      - project
      - vnet
      - rds
      - ecr
      - lambda
      - redshift
      - dynamodbtable
      - router
      - firewall
      - switch
      - loadbalancer
      - proxy
      - middleware
      - kubernetes
      - aks
      - eks
      - swarm
      - mesos
      - nomad
      - docker
      - containerd
      - messagetopic
      - messageserver
      - vulnerability
      - cve
      - employee
      - contractor
      - desktop
      - laptop
      - pc
      - vdi
      - mobile
      - client
      - software
      - ami
      - securitygroup
      - iampolicy
      - column
      - database
      - table
      - view
      description: Optional type of components to return.
      isArray: true
      type: textArea
    - name: max_results
      default: true
      defaultValue: "25"
      description: Number of results.
    description: Search for Components connected to supplied identity.
  - name: search-appnovi-cve
    outputs:
    - contextPath: appnovi._key
      description: 'appNovi database key.'
      type: String
    - contextPath: appnovi._id
      description: appNovi database ID.
      type: String
    - contextPath: appnovi.category
      description: appNovi Category (e.g. Interface, Server).
      type: String
    - contextPath: appnovi.firstSeen
      description: When was this Thing first seen?
      type: Date
    - contextPath: appnovi.identity.company
      description: Company ID.
      type: String
    - contextPath: appnovi.identity.datacenter
      description: Datacenter ID.
      type: String
    - contextPath: appnovi.identity.domain
      description: Domain ID.
      type: String
    - contextPath: appnovi.identity.type
      description: Thing type.
      type: String
    - contextPath: appnovi.identity.value
      description: Identity value.
      type: String
    - contextPath: appnovi.lastSeen
      description: Last time thing was seen.
      type: Date
    - contextPath: appnovi.name
      description: Name of entity.
      type: String
    - contextPath: appnovi.source
      description: This is information about the source of the entity.
      type: Unknown
    - contextPath: appnovi.userProperties
      description: These are the custom properties of the entity.
      type: String
    - contextPath: appnovi.applications
      description: List of applications.
      type: String
    arguments:
    - name: cve
      required: true
      description: CVE e.g. "CVE-2017-0143".
    description: Search for servers with matching CVE.
  - name: search-appnovi-component-property
    outputs:
    - contextPath: appnovi.components.name
      description: Name of thing.
      type: String
    - contextPath: appnovi.components.coll
      description: Collection containing thing.
      type: String
    - contextPath: appnovi.components.u._id
      description: appNovi Database ID.
      type: String
    - contextPath: appnovi.components.u._key
      description: appNovi Database Key.
      type: String
    - contextPath: appnovi.components.u.identity.company
      description: Company ID.
      type: String
    - contextPath: appnovi.components.u.identity.type
      description: Thing type.
      type: String
    - contextPath: appnovi.components.u.identity.value
      description: Thing name.
      type: String
    - contextPath: appnovi.components.u.identity.datacenter
      description: Datacenter ID.
      type: String
    - contextPath: appnovi.components.u.identity.domain
      description: Domain ID.
      type: String
    - contextPath: appnovi.components.u.lastSeen
      description: Time thing was last seen.
      type: Date
    - contextPath: appnovi.components.u.source
      description: This is information about the source of the entity.
      type: Date
    - contextPath: appnovi.components.u.userProperties
      description: These are the custom properties of the entity.
      type: String
    - contextPath: appnovi.components.connections
      description: Number of connections.
      type: Number
    - contextPath: appnovi.time
      description: Query time (for diagnostics).
      type: Number
    arguments:
    - name: property
      required: true
      description: Name of property.
    - name: value
      required: true
      description: Value of property.
    - name: max_results
      default: true
      description: Number of results.
      defaultValue: "25"
    description: Search for Components by property and value.
  - name: search-appnovi-server-by-ip
    outputs:
    - contextPath: appnovi._key
      description: 'appNovi database key.'
      type: String
    - contextPath: appnovi._id
      description: appNovi database ID.
      type: String
    - contextPath: appnovi.category
      description: appNovi Category (e.g. Interface, Server).
      type: String
    - contextPath: appnovi.firstSeen
      description: When was this Thing first seen?
      type: Date
    - contextPath: appnovi.identity.company
      description: Company ID.
      type: String
    - contextPath: appnovi.identity.datacenter
      description: Datacenter ID.
      type: String
    - contextPath: appnovi.identity.domain
      description: Domain ID.
      type: String
    - contextPath: appnovi.identity.type
      description: Thing type.
      type: String
    - contextPath: appnovi.identity.value
      description: Identity value.
      type: String
    - contextPath: appnovi.lastSeen
      description: Last time thing was seen.
      type: Date
    - contextPath: appnovi.name
      description: Name of entity.
      type: String
    - contextPath: appnovi.source
      description: This is information about the source of the entity.
      type: Unknown
    - contextPath: appnovi.userProperties
      description: These are the custom properties of the entity.
      type: String
    - contextPath: appnovi.applications
      description: List of applications.
      type: String
    arguments:
    - name: ip
      required: true
      type: textArea
      description: Server IP to search.
    description: Search for servers using IP address.
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)
fromversion: 6.5.0