InferWhetherServiceIsDev

Identify whether the service is a "development" server. Development servers have no external users and run no production workflows. These servers might be named "dev", but they might also be named "qa", "pre-production", "user acceptance testing", or use other non-production terms. This automation uses both public data visible to anyone (`active_classifications` as derived by Xpanse ASM) as well as checking internal data for AI-learned indicators of development systems (`asm_tags` as derived from integrations with non-public systems).

python · Cortex Attack Surface Management

Details

ID	`InferWhetherServiceIsDev`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Identify whether the service is a “development” server. Development servers have no external users and run no production workflows. These servers might be named “dev”, but they might also be named “qa”, “pre-production”, “user acceptance testing”, or use other non-production terms. This automation uses both public data visible to anyone (active_classifications as derived by Xpanse ASM) as well as checking internal data for AI-learned indicators of development systems (asm_tags as derived from integrations with non-public systems).

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.5.0

Used In

This script is used in the following playbooks and scripts.

Cortex ASM - Enrichment

Inputs

Argument Name	Description
asm_tags	Array of key-value objects. Each object within the array must contain the keys “Key” and “Value” to be considered. The values associated with those keys can be arbitrary. Example: [{“Key”: “env”, “Value”: “dev”}, {“Key”: “Name”, “Value”: “ssh-ec2-machine-name”}].
active_classifications	Array of strings representing the Xpanse ASM “active classifications” for the service. Example: [“RdpServer”, “SelfSignedCertificate”].
hierarchy_info	Infrastructure hierarchy information to include CSPs (such GCP folder, AWS account and Azure subscription names, which can indicate the environment is dev).
provider	Provider of the asset as returned by Xpanse.

Outputs

There are no outputs for this script.

Source

InferWhetherServiceIsDev.py InferWhetherServiceIsDev_test.py InferWhetherServiceIsDev.yml

Download History Raw

args:
- description: 'Array of key-value objects. Each object within the array must contain the keys "Key" and "Value" to be considered. The values associated with those keys can be arbitrary. Example: [{"Key": "env", "Value": "dev"}, {"Key": "Name", "Value": "ssh-ec2-machine-name"}].'
  isArray: true
  name: asm_tags
- description: 'Array of strings representing the Xpanse ASM "active classifications" for the service. Example: ["RdpServer", "SelfSignedCertificate"].'
  isArray: true
  name: active_classifications
- description: infrastructure hierarchy information to include CSPs (such GCP folder, AWS account and Azure subscription names, which can indicate the enrivonemnt is dev).
  isArray: true
  name: hierarchy_info
- description: Provider of the asset as returned by Xpanse.
  name: provider
comment: Identify whether the service is a "development" server. Development servers have no external users and run no production workflows. These servers might be named "dev", but they might also be named "qa", "pre-production", "user acceptance testing", or use other non-production terms. This automation uses both public data visible to anyone (`active_classifications` as derived by Xpanse ASM) as well as checking internal data for AI-learned indicators of development systems (`asm_tags` as derived from integrations with non-public systems).
commonfields:
  id: InferWhetherServiceIsDev
  version: -1
dockerimage: demisto/python3:3.12.13.10116658
enabled: true
name: InferWhetherServiceIsDev
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags: []
type: python
fromversion: 6.5.0
tests:
- No tests (auto formatted)
engineinfo: {}
runonce: false