commonfields: id: Nozomi Networks version: -1 name: Nozomi Networks display: Nozomi Networks category: Network Security provider: Mitsubishi Electric fromversion: 5.0.0 tests: - No tests description: "The Nozomi Networks platform, available as a hardware, virtual appliance, or via the Vantage Cloud product, provides comprehensive monitoring for OT, IoT, and IT networks. It combines asset discovery, network visualization, vulnerability assessment, risk monitoring, and advanced threat detection in a unified solution. The integration is designed to gather alerts and asset information from Nozomi, whether deployed on-premises or in the cloud via Vantage, ensuring seamless visibility and security across environments." sectionorder: - Connect - Collect configuration: - display: Endpoint url name: endpoint defaultvalue: https://nozomi_instance.com type: 0 section: Connect required: true additionalinfo: Your Nozomi Networks appliance endpoint URL appliance - display: Username name: credentials type: 9 section: Connect required: true additionalinfo: A user having APIs access privileges credentials. - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect required: false - display: Use system proxy settings name: proxy type: 8 section: Connect required: false - display: Fetch incidents name: isFetch type: 8 section: Collect required: false - display: Incident type name: incidentType type: 13 section: Collect required: false - display: Get incidents from last name: fetchTime defaultvalue: 7 days type: 0 section: Collect required: false additionalinfo: 'Set the time frame to get incidents by. Default is 7 days. Other examples: 30 seconds, 1 minute, 4 hours, 2 days...' - display: Get incidents from risk level name: riskFrom defaultvalue: '1' type: 15 section: Collect required: false options: - '1' - '2' - '3' - '4' - '5' - '6' - '7' - '8' - '9' - '10' additionalinfo: Will only fetch incident with a risk higher or equal to the selected value. - display: Fetch also Nozomi incidents name: fecthAlsoIncidents type: 8 section: Collect required: false additionalinfo: In the Nozomi platform, alerts are single events and incidents are an aggregation of alerts. By default only alerts will be fetched by CORTEX XSOAR, however, if selected, incidents will also be fetched. - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' type: 19 section: Collect required: false - display: Incidents per run name: incidentPerRun defaultvalue: '100' type: 0 section: Collect required: false additionalinfo: Specifies the maximum number of incidents to retrieve during each fetch operation. This value determines the size of the result set fetched from the source system. Default is 100. script: script: '' type: python commands: - name: nozomi-find-assets arguments: - name: filter description: You can add a filter to get exactly the assets you want, to know how to filter assets using the Nozomi query language take a look at the n2os user documentation. For example 'where ip match 10.0.1.10', 'where vendor == Selta Telematica S.p.a'. - name: limit description: Maximun number of assets get from Nozomi, can't be bigger than 100. defaultValue: '50' outputs: - contextPath: Nozomi.Asset.id description: uniq id of an asset. type: String - contextPath: Nozomi.Asset.level description: network layer. type: Number - contextPath: Nozomi.Asset.capture_device description: source from which the asset was captured. type: String - contextPath: Nozomi.Asset.ip description: array of asset ip. type: Unknown - contextPath: Nozomi.Asset.mac_address description: array of asset mac address. type: Unknown - contextPath: Nozomi.asset.mac_vendor description: array of mac vendor. type: Unknown - contextPath: os description: operating system. type: String - contextPath: vendor description: asset vendor. type: String - contextPath: Nozomi.Asset.firmware_version description: firmaware version. type: String - contextPath: serial_number description: serial number. type: String - contextPath: product_name description: product name. type: String - contextPath: type description: asset type as 'OT_device'. type: String - contextPath: protocols description: array of asset protocols. type: Unknown description: This command permits you to get some assets from Nozomi, you can use the query filter to to refine your search. With the limits you can decide the max number of assets you can retrieve from Nozomi, the limit can't be bigger than 100. - name: nozomi-close-incidents-as-security arguments: - name: ids description: List of IDs to close as security. isArray: true description: Close incidents as security. - name: nozomi-close-incidents-as-change arguments: - name: ids description: List of IDs to close as change. isArray: true description: Close incidents as change. - name: nozomi-query arguments: - name: query required: true description: A valid query, to learn how to create a Nozomi query you can take a look into the Nozomi Networks user documentation. defaultValue: alerts | count outputs: - contextPath: Nozomi.Query.Result description: An array of items. type: Unknown description: "Can execute a nozomi query to get all the information you want.\nA query can be something like that: \"alerts | select id name status ack | where status == open\"\nTake a look to n2os manual to know how to do a query." - name: nozomi-find-ip-by-mac arguments: - name: mac required: true description: a mac address. defaultValue: "''" - name: only_nodes_confirmed required: true default: true auto: PREDEFINED predefined: - 'True' - 'False' description: This argument permit you to return only the nodes IPs from a mac address of nodes having the status to "confirmed". Default value is True. defaultValue: 'True' outputs: - contextPath: Nozomi.IpByMac.ips description: Array of ips found for the mac address passed, empty if not found. type: Unknown - contextPath: Nozomi.IpByMac.mac description: Mac found the ips. type: String description: Find a node ip from a mac address. dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false subtype: python3