category: Network Security sectionorder: - Connect - Collect provider: Bastille Networks commonfields: id: Bastille Networks version: -1 configuration: - additionalinfo: 'Example: https://api.demisto-example.com' display: Server URL name: api_url type: 0 required: false section: Connect - display: API Key name: api_key required: true type: 4 section: Connect - additionalinfo: Enter site name of deployment area display: Site name: site required: true type: 0 section: Connect - additionalinfo: Enter concentrator name of deployment area display: Concentrator name: concentrator required: true type: 0 section: Connect - additionalinfo: Enter map name of deployment area display: Map name: map required: true type: 0 section: Collect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 advanced: true section: Collect - additionalinfo: Fetch only events with listed tags display: Tags name: tags type: 0 required: false section: Collect - additionalinfo: Fetch only events with selected event types defaultvalue: zone_event display: Event types name: event_types options: - zone_event - device_event - all required: true type: 16 section: Collect - defaultvalue: 5 minutes display: First fetch time name: first_fetch type: 0 required: false section: Collect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect description: RF monitoring for wireless intrusion detection and policy enforcement. Visit https://www.bastille.net for details. display: Bastille Networks name: Bastille Networks script: commands: - arguments: - auto: PREDEFINED description: Filter by transmitter protocol name. name: protocol predefined: - BT - BTLE - WIFI - LTE - description: Earliest time to return incidents from. name: since - description: Latest time to return incidents from. name: until - defaultValue: '5' description: Limit the number of fetched events. name: limit - description: List of tags to filter events by. isArray: true name: tags - description: Unique identifier of the zone detection event. name: event_id - description: Device identifier to query the detections for. name: transmitter_id description: Command to fetch device detection events name: bastille-get-device-events outputs: - contextPath: Bastille.DeviceEvent.event_id description: Unique identifier of the event. type: String - contextPath: Bastille.DeviceEvent.event_type description: Type of the event. type: String - contextPath: Bastille.DeviceEvent.time_s description: Event detection timestamp. type: Date - contextPath: Bastille.DeviceEvent.tags description: Tags attached to the zone event. type: String - contextPath: Bastille.DeviceEvent.zone_name description: Zone name where the incident took place. type: String - contextPath: Bastille.DeviceEvent.area.site_id description: Deployment site identifier. type: String - contextPath: Bastille.DeviceEvent.area.concentrator_id description: Deployment concentrator identifier. type: String - contextPath: Bastille.DeviceEvent.area.map_id description: Deployment map identifier. type: String - contextPath: Bastille.DeviceEvent.emitter.protocol description: Wireless protcol used by the detected transmitter. type: String - contextPath: Bastille.DeviceEvent.emitter.transmitter_id description: Wireless transmitter identifier. type: String - contextPath: Bastille.DeviceEvent.emitter.vendor description: Wireless transmitter vendor. type: String - contextPath: Bastille.DeviceEvent.emitter.network.name description: Name of the network the transmitter is connected to. type: String - contextPath: Bastille.DeviceEvent.device_info.manufacturer description: Manufacturer associated with device in the deployment. type: String - contextPath: Bastille.DeviceEvent.device_info.user description: User associated with device in the deployment. type: String - contextPath: Bastille.DeviceEvent.device_info.model description: Model associated with device in the deployment. type: String - contextPath: Bastille.DeviceEvent.device_info.name description: Name associated with device in the deployment. type: String - contextPath: Bastille.DeviceEvent.first_seen.time description: Event first seen timestamp. type: Number - contextPath: Bastille.DeviceEvent.first_seen.position description: Event first seen coordinates. type: Unknown - contextPath: Bastille.DeviceEvent.last_seen.time description: Event last seen timestamp. type: Number - contextPath: Bastille.DeviceEvent.last_seen.position description: Event last seen coordinates. type: Unknown - arguments: - description: Filter by zone name. name: zone - auto: PREDEFINED description: Filter by transmitter protocol name. name: protocol predefined: - BT - BTLE - WIFI - LTE - description: Earliest time to return incidents from. name: since - description: Latest time to return incidents from. name: until - defaultValue: '5' description: Limit the number of fetched events. name: limit - description: List of tags to filter events by. isArray: true name: tags - description: Unique identifier of the zone detection event. name: event_id description: Command to fetch zone detection events name: bastille-get-zone-events outputs: - contextPath: Bastille.ZoneEvent.event_id description: Unique identifier of the event. type: String - contextPath: Bastille.ZoneEvent.event_type description: Type of the event. type: String - contextPath: Bastille.ZoneEvent.time_s description: Event detection timestamp. type: Date - contextPath: Bastille.ZoneEvent.tags description: Tags attached to the zone event. type: String - contextPath: Bastille.ZoneEvent.zone_name description: Zone name where the incident took place. type: String - contextPath: Bastille.ZoneEvent.area.site_id description: Deployment site identifier. type: String - contextPath: Bastille.ZoneEvent.area.concentrator_id description: Deployment concentrator identifier. type: String - contextPath: Bastille.ZoneEvent.area.map_id description: Deployment map identifier. type: String - contextPath: Bastille.ZoneEvent.emitter.protocol description: Wireless protcol used by the detected transmitter. type: String - contextPath: Bastille.ZoneEvent.emitter.transmitter_id description: Wireless transmitter identifier. type: String - contextPath: Bastille.ZoneEvent.emitter.vendor description: Wireless transmitter vendor. type: String - contextPath: Bastille.ZoneEvent.emitter.network.name description: Name of the network the transmitter is connected to. type: String - contextPath: Bastille.ZoneEvent.device_info.manufacturer description: Manufacturer associated with device in the deployment. type: String - contextPath: Bastille.ZoneEvent.device_info.user description: User associated with device in the deployment. type: String - contextPath: Bastille.ZoneEvent.device_info.model description: Model associated with device in the deployment. type: String - contextPath: Bastille.ZoneEvent.device_info.name description: Name associated with device in the deployment. type: String - contextPath: Bastille.ZoneEvent.first_seen.time description: Event first seen timestamp. type: Number - contextPath: Bastille.ZoneEvent.first_seen.position description: Event first seen coordinates. type: Unknown - contextPath: Bastille.ZoneEvent.last_seen.time description: Event last seen timestamp. type: Number - contextPath: Bastille.ZoneEvent.last_seen.position description: Event last seen coordinates. type: Unknown - arguments: - description: Unique identifier of an existing admin devices entry. name: transmitter_id required: true - description: Tag to append to the admin devices entry. name: tag required: true description: Command to add tag to an existing device name: bastille-add-device-tag - arguments: - description: Unique identifier of an existing admin devices entry. name: transmitter_id predefined: - '' required: true - description: Tag to be removed from the admin devices entry. name: tag required: true description: Command to remove tag from an existing device name: bastille-remove-device-tag dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '-' subtype: python3 type: python tests: - No tests fromversion: 5.0.0