category: Analytics & SIEM provider: Cisco Systems commonfields: id: Cisco Stealthwatch version: -1 configuration: - additionalinfo: 'Server URL for Cisco Stealthwatch console e.g.: https://ip:port/.' display: Server URL name: server_url required: true type: 0 - display: User Credentials name: credentials required: true type: 9 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: Scalable visibility and security analytics. display: Cisco Secure Network Analytics (Stealthwatch) name: Cisco Stealthwatch script: commands: - arguments: - description: The ID of the tenant for which to initialize its flow search. name: tenant_id required: true - description: 'Start time in the format: YYYY-mm-ddTHH:MM:SSZ. If start_time is provided but end_time is not provided, the end_time will be set to the current time.' name: start_time - description: 'End time in the format: YYYY-mm-ddTHH:MM:SSZ. ' name: end_time - description: 'An optional time range, for example: 3 months, 1 week, 1 day ago, etc.' name: time_range - default: true defaultValue: '20' description: The maximum number of records to retrieve. name: limit - description: The IP address by which to filter the results. name: ip_addresses description: Initializes the flow search based on specified arguments. Must provide a start time, time range, or start time and end time. name: cisco-stealthwatch-query-flows-initialize outputs: - contextPath: CiscoStealthwatch.FlowStatus.id description: The ID of the flow. type: str - contextPath: CiscoStealthwatch.FlowStatus.searchJobStatus description: The search job status of the flow. type: str - contextPath: CiscoStealthwatch.FlowStatus.percentComplete description: The percent of the flow that was completed. type: str - arguments: - description: The ID of the tenant for which to check its flow search status. name: tenant_id required: true - description: The ID of the search from the cisco-stealthwatch-query-flows-initialize command. name: search_id required: true description: Checks the flow search status. name: cisco-stealthwatch-query-flows-status outputs: - contextPath: CiscoStealthwatch.FlowStatus.id description: The ID of the flow. type: str - contextPath: CiscoStealthwatch.FlowStatus.percentComplete description: The percent of the flow that was completed. type: str - arguments: - description: The ID of the tenant for which to retrieve its flow search results. name: tenant_id required: true - description: The ID of the search from the cisco-stealthwatch-query-flows-initialize command. name: search_id required: true description: Retrieves the flow search results. Use this command after the search job completes. name: cisco-stealthwatch-query-flows-results outputs: - contextPath: CiscoStealthwatch.FlowResults.id description: The ID of the flow. type: str - contextPath: CiscoStealthwatch.FlowResults.tenantId description: The tenant ID of the flow. type: str - contextPath: CiscoStealthwatch.FlowResults.flowCollectorId description: The collector ID of the flow. type: str - contextPath: CiscoStealthwatch.FlowResults.protocol description: The protocol of the flow. type: str - contextPath: CiscoStealthwatch.FlowResults.serviceId description: The service ID of the flow. type: str - contextPath: CiscoStealthwatch.FlowResults.statistics description: The statistics of the flow. type: str - contextPath: CiscoStealthwatch.FlowResults.peer description: The peer of the flow. type: str - contextPath: CiscoStealthwatch.FlowResults.subject description: The subject of the flow. type: str - arguments: - description: The ID of the tenant for which to get its tags. name: tenant_id required: true description: Lists the host groups (called tags in the API). name: cisco-stealthwatch-list-tags outputs: - contextPath: CiscoStealthwatch.Tag.id description: The ID of the tag. type: str - contextPath: CiscoStealthwatch.Tag.displayName description: The display name of the tag. type: str - arguments: - description: The ID of the tenant for which to get its tag. name: tenant_id required: true - description: The tag for which to get more information. name: tag_id required: true description: Gets a single host group (called tag in the API). name: cisco-stealthwatch-get-tag outputs: - contextPath: CiscoStealthwatch.Tag.id description: The name of the tag. type: str - contextPath: CiscoStealthwatch.Tag.name description: The ID of the tag. type: str - contextPath: CiscoStealthwatch.Tag.location description: The location of the tag. type: str - contextPath: CiscoStealthwatch.Tag.domainId description: The domain ID of the tag. type: str - arguments: - description: The ID of the tenant for which to retrieve information. name: tenant_id description: Lists all domains if no domain is specified or gets a specified domain (called tenant(s) in the API). name: cisco-stealthwatch-list-tenants outputs: - contextPath: CiscoStealthwatch.Tenant.id description: The ID of the tenant. type: str - contextPath: CiscoStealthwatch.Tenant.displayName description: The display name of the tenant. type: str - arguments: - description: The ID of the tenant for which to get its host information. name: tenant_id required: true - description: The ID of the tag for which to get its information. name: tag_id required: true description: Gets the hourly traffic summary of the byte count for a single host group (called tenant in the API). name: cisco-stealthwatch-get-tag-hourly-traffic-report outputs: - contextPath: CiscoStealthwatch.TagHourlyTraffic.timestamp description: Timestamp of the hourly traffic summary for a single host group (called tag on the API). type: str - contextPath: CiscoStealthwatch.TagHourlyTraffic.inboundByteCount description: Inbound byte count of the hourly traffic summary for a single host group (called tag on the API). type: str - contextPath: CiscoStealthwatch.TagHourlyTraffic.outboundByteCount description: Outbound byte count of the hourly traffic summary for a single host group (called tag on the API). type: str - contextPath: CiscoStealthwatch.TagHourlyTraffic.withinByteCount description: Within the byte count of the hourly traffic summary for a single host group (called tag on the API). type: str - contextPath: CiscoStealthwatch.TagHourlyTraffic.tenant_id description: The tenant ID of the hourly traffic summary for a single host group (called tag on the API). type: str - contextPath: CiscoStealthwatch.TagHourlyTraffic.tag_id description: The tag ID of the hourly traffic summary for a single host group (called tag on the API). type: str - arguments: - description: The ID of the tenant for which to get its top alarming hosts. name: tenant_id required: true description: Gets the top alarming host groups (called tags on the API) for a specific domain (called tenant in the API). name: cisco-stealthwatch-get-top-alarming-tags outputs: - contextPath: CiscoStealthwatch.AlarmingTag.ipAddress description: The IP address of the alarming tag. type: str - contextPath: CiscoStealthwatch.AlarmingTag.hostGroupIds description: The host group IDs of the alarming tag. type: str - contextPath: CiscoStealthwatch.AlarmingTag.typeId description: The type ID of the alarming tag. type: str - contextPath: CiscoStealthwatch.AlarmingTag.severity description: The severity of the alarming tag. type: str - contextPath: CiscoStealthwatch.AlarmingTag.alwaysBadCount description: The always bad count of the alarming tag. type: str - arguments: - description: The ID of the tenant for which to initialize its list security events. name: tenant_id required: true - description: 'Start time. Format: YYYY-mm-ddTHH:MM:SSZ. Given only the start_time, the end_time will be set to the current time.' name: start_time - description: 'End time. Format: YYYY-mm-ddTHH:MM:SSZ.' name: end_time - description: 'An optional time range. For example: 3 months, 1 week, 1 day ago, etc.' name: time_range description: Initializes the list of security events for a domain (called tenant on the API). name: cisco-stealthwatch-list-security-events-initialize outputs: - contextPath: CiscoStealthwatch.SecurityEventStatus.id description: The ID of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventStatus.searchJobStatus description: The status of the search job for the security event. type: str - contextPath: 'CiscoStealthwatch.SecurityEventStatus.percentComplete' description: The percent of the security event that is completed. type: str - arguments: - description: The ID of the tenant for which to get its list of security events status. name: tenant_id required: true - description: The ID of the search from the initialize command. name: search_id required: true description: Lists the security events status. name: cisco-stealthwatch-list-security-events-status outputs: - contextPath: CiscoStealthwatch.SecurityEventStatus.id description: The ID of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventStatus.percentComplete description: The percent of the security event that is completed. type: str - arguments: - description: The ID of the tenant for which to retrieve its list security events results. name: tenant_id required: true - description: The ID of the search from the initialize command. name: search_id required: true - default: true defaultValue: '50' description: The maximum number of security events. name: limit required: true description: Lists the security events results. Use this command after the search job completes. name: cisco-stealthwatch-list-security-events-results outputs: - contextPath: CiscoStealthwatch.SecurityEventResults.id description: The ID of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.domainId description: The domain ID of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.deviceId description: The device ID of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.securityEventType description: The type of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.firstActiveTime description: The first active time of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.lastActiveTime description: The last active time of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.source description: The source of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.target description: The target of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.details description: The details of the security event. type: str - contextPath: CiscoStealthwatch.SecurityEventResults.hitCount description: The hit count of the security event. type: str dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python tests: - Cisco Stealthwatch Test fromversion: 5.5.0