category: Utilities provider: BitSight sectionorder: - Connect - Collect commonfields: id: BitSight for Security Performance Management version: -1 configuration: - display: API Key name: apikey required: true type: 4 section: Connect - additionalinfo: Use "bitsight-companies-guid-get" command to retrieve the company's GUID. display: Company's GUID name: guid type: 0 required: false section: Connect - additionalinfo: Enter the number in days. When the fetch incident runs for first time, incidents will be fetched for a given number of days. defaultvalue: '3' display: First fetch time in days name: first_fetch type: 0 required: false section: Collect - additionalinfo: The mirroring direction in which to mirror the findings. You can mirror "Incoming" (from Bitsight to XSOAR), "Outgoing" (from XSOAR to Bitsight), or in both directions. display: Mirroring Direction name: mirror_direction type: 15 options: - Incoming - Outgoing - Incoming And Outgoing required: false section: Collect - additionalinfo: "The tag value should be used to mirror XSOAR incident notes to Bitsight finding comments by adding the same tag in the notes.\n\nNote: This parameter is required when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'." defaultvalue: note display: Mirror Tag for Notes hidden: false name: note_tag required: false type: 0 section: Collect - additionalinfo: "Provide the Bitsight user email address to be used for sending XSOAR incident notes as Bitsight finding comments.\n\nNote: This parameter is required when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'." display: Bitsight User Email Address name: user_email type: 0 required: false section: Collect - additionalinfo: "Remediation status to set in Bitsight when opening incidents in XSOAR. Default value is 'Open'.\n\nNote: This parameter is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'." display: Bitsight Remediation Status for Incident Opening name: open_status_of_bitsight type: 15 options: - Open - Work In Progress defaultvalue: Open required: false section: Collect - additionalinfo: "If selected, closed incidents will be reopened in XSOAR when finding remediation status on Bitsight platform matches the configured 'Remediation Status for Incident Opening'.\n\nNote: This parameter is only used when the mirroring direction is set to 'Incoming' or 'Incoming And Outgoing'." display: Reopen incident based on Bitsight Remediation Status name: reopen_closed_incident type: 8 defaultvalue: 'false' required: false section: Collect - additionalinfo: "Remediation status to set in Bitsight when closing incidents in XSOAR. Default value is 'Resolved'.\n\nNote: This parameter is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'." display: Bitsight Remediation Status for Incident Closure name: close_status_of_bitsight type: 15 options: - Resolved - Risk Accepted defaultvalue: Resolved required: false section: Collect - additionalinfo: "If selected, active incidents will be closed in XSOAR when finding remediation status on Bitsight platform matches the configured 'Remediation Status for Incident Closure'.\n\nNote: This parameter is only used when the mirroring direction is set to 'Incoming' or 'Incoming And Outgoing'." display: Close incident based on Bitsight Remediation Status name: close_active_incident type: 8 defaultvalue: 'false' required: false section: Collect - additionalinfo: Maximum number of incidents to fetch. The maximum value is 200. defaultvalue: '25' display: Max Fetch name: max_fetch type: 0 required: false section: Collect - additionalinfo: Filter by the affect rating reason of the findings to fetch. display: Findings Affect Rating Reason name: findings_affect_rating_reason options: - "Yes" - "No: Grace Period" - "No: Incubation Period" type: 16 required: false section: Collect - additionalinfo: Minimum severity of the findings to fetch. defaultvalue: Material display: Findings Minimum Severity name: findings_min_severity options: - Minor - Moderate - Material - Severe type: 15 required: false section: Collect - additionalinfo: Filter by the asset category (critical, high, medium, low). defaultvalue: High display: Findings Minimum Asset Category name: findings_min_asset_category options: - Low - Medium - High - Critical type: 15 required: false section: Collect - additionalinfo: Filter the result by the value of grade. defaultvalue: WARN,BAD display: Findings Grade name: findings_grade options: - GOOD - FAIR - WARN - BAD - NEUTRAL - NA type: 16 required: false section: Collect - additionalinfo: This parameter supports comma separated list of values. By default 'All' will be selected, if you need only particular values you can unselect 'All' and select the required values. display: Risk Vector name: risk_vector options: - Web Application Headers - Botnet Infections - Breaches - Desktop Software - DKIM - DNSSEC - File Sharing - Insecure Systems - Malware Servers - Mobile App Publications - Mobile Application Security - Mobile Software - Open Ports - Patching Cadence - Potentially Exploited - Server Software - Spam Propagation - SPF - SSL Certificates - SSL Configurations - Unsolicited Communications - Web Application Security - DMARC - All type: 16 required: false section: Collect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - defaultvalue: '1' display: Incidents Fetch Interval name: incidentFetchInterval required: false type: 19 section: Collect description: Use the "Bitsight for Security Performance Management" Integration to get company guid, details, and findings. This integration also allows to fetch the findings by using the fetch incidents capability. display: Bitsight for Security Performance Management name: BitSight for Security Performance Management script: commands: - arguments: - description: |- GUID of the company to fetch its details. Note: Users can get the list of the GUID by executing the "bitsight-companies-guid-get" command. name: guid required: true description: Bitsight command to get company details based on the provided GUID. The details include rating details, rating history, and grades for individual risk vectors. execution: true name: bitsight-company-details-get outputs: - contextPath: BitSight.Company.guid description: The unique identifier of this company. type: string - contextPath: BitSight.Company.customId description: The customizable ID assigned to this company. type: string - contextPath: BitSight.Company.name description: The name of this company. type: string - contextPath: BitSight.Company.description description: Details about this company, which typically includes its industry and location. type: string - contextPath: BitSight.Company.ipv4Count description: The number of IP addresses attributed to this company. type: number - contextPath: BitSight.Company.peopleCount description: The number of employees in this company. type: number - contextPath: BitSight.Company.shortname description: The abbreviated name of this company. type: string - contextPath: BitSight.Company.industry description: The industry of this company. type: string - contextPath: BitSight.Company.industrySlug description: The industry slug name of this company. type: string - contextPath: BitSight.Company.subIndustry description: The sub-industry of this company. type: string - contextPath: BitSight.Company.subIndustrySlug description: The sub-industry slug name of this company. type: string - contextPath: BitSight.Company.homePage description: The URL of this company's primary external website. type: string - contextPath: BitSight.Company.primaryDomain description: The name of this company's primary domain. type: string - contextPath: BitSight.Company.type description: The type of rating. type: string - contextPath: BitSight.Company.displayURL description: The URL to this company's overview page in the Bitsight platform. type: string - contextPath: BitSight.Company.ratingDetails.name description: The name of this risk vector. type: string - contextPath: BitSight.Company.ratingDetails.rating description: Internal rating of this risk vector. type: number - contextPath: BitSight.Company.ratingDetails.grade description: The letter grade of this risk vector. type: string - contextPath: BitSight.Company.ratingDetails.percentile description: This company's performance on this risk vector against their peers. type: number - contextPath: BitSight.Company.ratingDetails.gradeColor description: The hex code to display letter grade colors in HTML applications. type: string - contextPath: BitSight.Company.ratingDetails.category description: The risk category of this risk vector. type: string - contextPath: BitSight.Company.ratingDetails.categoryOrder description: Used to visually sort this risk category in the Bitsight platform. type: number - contextPath: BitSight.Company.ratingDetails.beta description: A true value indicates this risk vector is in beta and does not affect this company's security rating. type: boolean - contextPath: BitSight.Company.ratingDetails.order description: Used to visually sort this risk vector in the Bitsight platform. type: number - contextPath: BitSight.Company.ratingDetails.displayUrl description: The URL in the Bitsight platform that contains the details of this risk vector. type: string - contextPath: BitSight.Company.ratings.ratingDate description: The date when this Bitsight Security Rating Report was generated. type: date - contextPath: BitSight.Company.ratings.rating description: The Bitsight Security Rating of this company on this day. type: number - contextPath: BitSight.Company.ratings.range description: The rating category of this company on this day. type: string - contextPath: BitSight.Company.ratings.ratingColor description: The hex code to display rating category colors in HTML applications. type: string - contextPath: BitSight.Company.searchCount description: The number of times this company has been listed in search results. type: number - contextPath: BitSight.Company.subscriptionType description: The type of subscription used to monitor this company. type: string - contextPath: BitSight.Company.sparkline description: The URL path to the security rating trend line of this company during the past one year. type: string - contextPath: BitSight.Company.subscriptionTypeKey description: The slug name of the subscription used to monitor this company. type: string - contextPath: BitSight.Company.subscriptionEndDate description: The date when the subscription to this company expires. type: date - contextPath: BitSight.Company.bulkEmailSenderStatus description: A FULL value indicates this company provides bulk email sending services, which excludes this company from the Spam Propagation risk vector. type: string - contextPath: BitSight.Company.serviceProvider description: A true value indicates this company is a service provider. type: boolean - contextPath: BitSight.Company.customerMonitoringCount description: The number of companies that are monitoring this company. type: number - contextPath: BitSight.Company.availableUpgradeTypes description: For internal Bitsight use. type: string - contextPath: BitSight.Company.hasCompanyTree description: A true value indicates this company has a Ratings Tree. type: boolean - contextPath: BitSight.Company.hasPreferredContact description: For internal Bitsight use. type: boolean - contextPath: BitSight.Company.isBundle description: A true value indicates this company is part of a ratings bundle. type: boolean - contextPath: BitSight.Company.ratingIndustryMedian description: Indicates this company's position in the peer group distribution chart. type: string - contextPath: BitSight.Company.primaryCompany.guid description: The unique identifier of this organization's primary company. type: string - contextPath: BitSight.Company.primaryCompany.name description: The name of this organization's primary company. type: string - contextPath: BitSight.Company.permissions.canDownloadCompanyReport description: A true value indicates you can view and download Bitsight Security Rating Reports (PDF). type: boolean - contextPath: BitSight.Company.permissions.canViewForensics description: A true value indicates you have the Event Forensics add-on package. type: boolean - contextPath: BitSight.Company.permissions.canViewServiceProviders description: A true value indicates you can access Bitsight for Fourth Party Risk Management. type: boolean - contextPath: BitSight.Company.permissions.canRequestSelfPublishedEntity description: A true value indicates you can request the creation of a self-published rating. type: boolean - contextPath: BitSight.Company.permissions.canViewInfrastructure description: A true value indicates you can view your infrastructure attribution. type: boolean - contextPath: BitSight.Company.permissions.canAnnotate description: A true value indicates you can identify assets and segment your network with infrastructure tags. type: boolean - contextPath: BitSight.Company.permissions.canViewCompanyReports description: A true value indicates you can view Bitsight Security Rating Reports. type: boolean - contextPath: BitSight.Company.permissions.canManagePrimaryCompany description: A true value indicates you can highlight a primary for your organization. type: boolean - contextPath: BitSight.Company.permissions.hasControl description: For internal Bitsight use. type: boolean - contextPath: BitSight.Company.permissions.canEnableVendorAccess description: A true value indicates you can modify vendor access. type: boolean - contextPath: BitSight.Company.isPrimary description: A true value indicates your company is the primary for your organization. type: boolean - contextPath: BitSight.Company.securityGrade description: For internal Bitsight use. type: string - contextPath: BitSight.Company.inSpmPortfolio description: A true value indicates this company is in your Security Performance Management portfolio (My Company, SPM Subsidiary, etc.). type: boolean - contextPath: BitSight.Company.isMycompMysubsBundle description: For internal Bitsight use. type: string - contextPath: BitSight.Company.companyFeatures description: For internal Bitsight use. type: string - arguments: - description: |- GUID of the company. Note: Users can get the list of the GUID by executing the "bitsight-companies-guid-get" command. name: guid required: true - description: 'Filter the findings that were seen on and after this date. Format accepted: YYYY-MM-DD, Example: 2021-01-01.' name: first_seen required: true - description: 'Filter the findings that were seen on and prior to this date. Format accepted: YYYY-MM-DD, Example: 2021-01-01.' name: last_seen required: true - auto: PREDEFINED description: Minimum Severity of the findings. name: severity predefined: - minor - moderate - material - severe - description: 'Filter by the grade of the findings. Supports comma separated values. Select the values from the list of predefined values: good, fair, warn, bad, neutral and na.' isArray: true name: grade auto: PREDEFINED predefined: - 'good' - 'fair' - 'warn' - 'bad' - 'neutral' - 'na' - auto: PREDEFINED description: |- Minimum Asset Category of the findings. Example: If low is selected from the options then low, medium, high, and critical will be considered in retrieving results. name: asset_category predefined: - low - medium - high - critical - description: 'Risk category of the findings. Supports comma separated values. Select the values from the list of predefined values: Web Application Headers, Botnet Infections, Breaches, Desktop Software, DKIM, DNSSEC, File Sharing, Insecure Systems, Malware Servers, Mobile App Publications, Mobile Application Security, Mobile Software, Open Ports, Patching Cadence, Potentially Exploited, Server Software, Spam Propagation, SPF, SSL Certificates, SSL Configurations, Unsolicited Communications, Web Application Security, DMARC.' isArray: true name: risk_vector_label auto: PREDEFINED predefined: - 'Botnet Infections' - 'Breaches' - 'Desktop Software' - 'DKIM' - 'DMARC' - 'DNSSEC' - 'File Sharing' - 'Insecure Systems' - 'Malware Servers' - 'Mobile App Publications' - 'Mobile Application Security' - 'Mobile Software' - 'Open Ports' - 'Patching Cadence' - 'Potentially Exploited' - 'Server Software' - 'Spam Propagation' - 'SPF' - 'SSL Certificates' - 'SSL Configurations' - 'Unsolicited Communications' - 'Web Application Headers' - 'Web Application Security' - defaultValue: '100' description: |- Set the maximum number of results to be retrieved. The maximum value is 1000. Note: If a negative value is provided then the default value of 100 will be used. name: limit - defaultValue: '0' description: Set the starting point of the results to be returned. A 0 (zero) value starts the results from the first record in the result set. name: offset description: Bitsight command to get company findings. name: bitsight-company-findings-get outputs: - contextPath: BitSight.Company.guid description: The unique identifier of this company. type: string - contextPath: BitSight.Company.CompanyFinding.temporaryId description: A temporary identifier for this finding. type: string - contextPath: BitSight.Company.CompanyFinding.affectsRating description: Indicates if this finding has an impact on the letter grade. type: boolean - contextPath: BitSight.Company.CompanyFinding.assets.asset description: The asset (IP address or domain) associated with this finding. type: string - contextPath: BitSight.Company.CompanyFinding.assets.identifier description: Identifier associated with the asset. type: string - contextPath: BitSight.Company.CompanyFinding.assets.category description: The Bitsight-calculated asset importance. type: string - contextPath: BitSight.Company.CompanyFinding.assets.importance description: For internal Bitsight use. type: number - contextPath: BitSight.Company.CompanyFinding.assets.isIp description: A true value indicates this asset is an IP address. type: boolean - contextPath: BitSight.Company.CompanyFinding.details description: Details of this finding. The included keys vary, depending on the following risk types Compromised Systems, Diligence, File Sharing. type: string - contextPath: BitSight.Company.CompanyFinding.evidenceKey description: The company's asset (domain or IP address) that's attributed to the finding. type: string - contextPath: BitSight.Company.CompanyFinding.firstSeen description: The date of the first observation. type: date - contextPath: BitSight.Company.CompanyFinding.lastSeen description: The date of the most recent observation. type: date - contextPath: BitSight.Company.CompanyFinding.relatedFindings description: Details of related findings. type: string - contextPath: BitSight.Company.CompanyFinding.riskCategory description: The risk category associated with this finding. type: string - contextPath: BitSight.Company.CompanyFinding.riskVector description: The slug name of the risk vector associated with this finding. type: string - contextPath: BitSight.Company.CompanyFinding.riskVectorLabel description: The name of the risk vector associated with this finding. type: string - contextPath: BitSight.Company.CompanyFinding.rolledupObservationId description: A unique identifier for this observation. type: string - contextPath: BitSight.Company.CompanyFinding.severity description: The severity of the finding, which is the measured risk that this finding introduces. type: number - contextPath: BitSight.Company.CompanyFinding.severityCategory description: The slug name of the finding severity. type: string - contextPath: BitSight.Company.CompanyFinding.tags description: Infrastructure tags that help identify this asset. type: string - contextPath: BitSight.Company.CompanyFinding.duration description: For internal Bitsight use. type: string - contextPath: BitSight.Company.CompanyFinding.comments description: A thread of finding comments. type: string - contextPath: BitSight.Company.CompanyFinding.remainingDecay description: For internal Bitsight use. type: number - contextPath: BitSight.Company.CompanyFinding.remediationHistory.lastRequestedRefreshDate description: The date when a record refresh that included this finding was last requested. type: date - contextPath: BitSight.Company.CompanyFinding.remediationHistory.lastRefreshStatusDate description: The date when a refresh of the remediation status of this finding was last requested. type: date - contextPath: BitSight.Company.CompanyFinding.remediationHistory.lastRefreshStatusLabel description: The current record refresh status of this finding. type: string - contextPath: BitSight.Company.CompanyFinding.remediationHistory.lastRefreshReasonCode description: The reason code of the last refresh of this finding. type: string - contextPath: BitSight.Company.CompanyFinding.remediationHistory.lastRemediationStatusLabel description: The current remediation status of this finding. type: string - contextPath: BitSight.Company.CompanyFinding.remediationHistory.lastRemediationStatusDate description: The date when the remediation status of this finding was last changed. type: date - contextPath: BitSight.Company.CompanyFinding.remediationHistory.remediationAssignments description: The users who are assigned to remediate this finding. type: unknown - contextPath: BitSight.Company.CompanyFinding.remediationHistory.lastRemediationStatusUpdatedBy description: The name of the user who updated the remediation status of this finding. type: string - contextPath: BitSight.Company.CompanyFinding.assetOverrides.asset description: The domain or IP address of the overridden asset. type: string - contextPath: BitSight.Company.CompanyFinding.assetOverrides.importance description: The user-assigned asset importance. type: string - contextPath: BitSight.Company.CompanyFinding.assetOverrides.overrideImportance description: For internal Bitsight use. type: unknown - contextPath: BitSight.Company.CompanyFinding.attributedCompanies.guid description: The unique identifier of the company attributed to the finding. type: string - contextPath: BitSight.Company.CompanyFinding.attributedCompanies.name description: The name of the company that is attributed to the finding. type: string - contextPath: BitSight.Page.name description: Name of the command. type: String - contextPath: BitSight.Page.next description: The URL to navigate to the next page of results. type: String - contextPath: BitSight.Page.previous description: The URL to navigate to the previous page of results. type: String - contextPath: BitSight.Page.count description: The number of findings. type: Number - description: Bitsight command to get list of companies and GUID. name: bitsight-companies-guid-get outputs: - contextPath: BitSight.Company.name description: Name of this company. type: String - contextPath: BitSight.Company.shortname description: The abbreviated name of this company. type: String - contextPath: BitSight.Company.guid description: The unique identifier of this company. type: String - contextPath: BitSight.Company.customId description: The customizable ID assigned to this company. type: String - contextPath: BitSight.Company.networkSizeV4 description: The number of IPv4 addresses attributed to this company. type: Number - contextPath: BitSight.Company.rating description: The most recent security rating of this company. type: Number - contextPath: BitSight.Company.ratingDate description: The date when the rating report for this company was generated. type: Date - contextPath: BitSight.Company.dateAdded description: The date when this company was added to your portfolio. type: Date - contextPath: BitSight.Company.industry description: The industry of this company. type: String - contextPath: BitSight.Company.industrySlug description: The slug name of this company's industry. type: String - contextPath: BitSight.Company.subIndustry description: The sub-industry of this company. type: String - contextPath: BitSight.Company.subIndustrySlug description: The slug name of this company's sub-industry. type: String - contextPath: BitSight.Company.type description: The rating type. type: String - contextPath: BitSight.Company.logo description: The URL in the Bitsight platform to this company's logo image. type: String - contextPath: BitSight.Company.sparkline description: The URL in the Bitsight platform to this company's historical ratings trend line. type: String - contextPath: BitSight.Company.externalId description: The external ID assigned to this company. type: Number - contextPath: BitSight.Company.subscriptionType description: The subscription type used to monitor this company. type: String - contextPath: BitSight.Company.subscriptionTypeKey description: The slug name of the subscription type used to monitor this company. type: String - contextPath: BitSight.Company.primaryDomain description: The primary domain of this company. type: String - contextPath: BitSight.Company.securityGrade description: For internal Bitsight use. type: String - contextPath: BitSight.Company.gradeDate description: For internal Bitsight use. type: Date - contextPath: BitSight.Company.displayURL description: The URL in the Bitsight platform to this company's overview page. type: String - contextPath: BitSight.Company.href description: The URL in the Bitsight platform to this company's page. type: String - contextPath: BitSight.MyCompany.guid description: The unique identifier of my company. type: String dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '' subtype: python3 type: python tests: - BitSight for Security Performance Management-Test defaultmapperin: BitSight - Incoming Mapper defaultclassifier: BitSight - Classifier fromversion: 6.0.0