category: Deception & Breach Simulation
sectionorder:
- Connect
- Collect
provider: Zscaler
commonfields:
  id: Smokescreen IllusionBLACK
  version: -1
configuration:
- defaultvalue: https://example.net
  display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: IllusionBLACK API Client Id
  name: client_id
  required: true
  type: 0
  section: Connect
- display: IllusionBLACK External API Token
  name: token
  required: true
  type: 4
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: First fetch time for fetching incidents (2 days, 3 weeks, etc)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
description: Smokescreen IllusionBLACK is a deception-based threat defense platform designed to accurately and efficiently detect targeted threats including reconnaissance, lateral movement, malware-less attacks, social engineering, Man-in-the-Middle attacks, and ransomware in real-time.
display: Smokescreen IllusionBLACK
name: Smokescreen IllusionBLACK
script:
  commands:
  - description: Gets a list of Active Directory decoys.
    name: illusionblack-get-ad-decoys
    outputs:
    - contextPath: IllusionBlack.AdDecoy
      description: IllusionBLACK AD Decoy users.
      type: Unknown
  - description: Gets a list of Network decoys.
    name: illusionblack-get-network-decoys
    outputs:
    - contextPath: IllusionBlack.NetworkDecoy
      description: IllusionBLACK Network decoys.
      type: Unknown
  - description: Gets a list of Threat Intel decoys.
    name: illusionblack-get-ti-decoys
    outputs:
    - contextPath: IllusionBlack.TIDecoy
      description: IllusionBLACK TI Decoys.
      type: Unknown
  - arguments:
    - description: Hostname or IP address to check.
      name: host
      required: true
    description: Checks if a host or IP address is a network decoy.
    name: illusionblack-is-host-decoy
    outputs:
    - contextPath: IllusionBlack.IsHostDecoy.Host
      description: The IP address or hostname submitted to IllusionBLACK to check.
      type: String
    - contextPath: IllusionBlack.IsHostDecoy.Value
      description: The boolean value whether the host is a decoy or not.
      type: Boolean
  - arguments:
    - description: Active Directory user name to check.
      name: user
      required: true
    description: Checks if an Active Directory user is a decoy.
    name: illusionblack-is-user-decoy
    outputs:
    - contextPath: IllusionBlack.IsUserDecoy.User
      description: The AD username submitted to IllusionBLACK to check.
      type: String
    - contextPath: IllusionBlack.IsUserDecoy.Value
      description: The boolean value whether the user is a decoy or not.
      type: Boolean
  - arguments:
    - description: 'Subdomain to check. For example: dec.smokescreen.io.'
      name: subdomain
      required: true
    description: Checks if a subdomain is a Threat Intel decoy.
    name: illusionblack-is-subdomain-decoy
    outputs:
    - contextPath: IllusionBlack.IsSubdomainDecoy.Subdomain
      description: The subdomain submitted to IllusionBLACK to check.
      type: String
    - contextPath: IllusionBlack.IsSubdomainDecoy.Value
      description: The boolean value whether the subdomain is a decoy or not.
      type: Boolean
  - arguments:
    - description: Number of events. It can be between 1 and 1000.
      name: limit
    - description: 'IllusionBLACK query. For example: "attacker.ip is \"1.2.3.4\"".'
      name: query
    - description: ISO 8601 formatted date string.
      name: from
    - description: ISO 8601 formatted date string.
      name: to
    description: Gets events from IllusionBLACK.
    name: illusionblack-get-events
    outputs:
    - contextPath: IllusionBlack.Event
      description: IllusionBLACK Events.
      type: Unknown
  - arguments:
    - description: IllusionBLACK Event ID.
      name: id
      required: true
    description: Gets a single event by the event ID.
    name: illusionblack-get-event-by-id
    outputs:
    - contextPath: IllusionBlack.Event
      description: IllusionBLACK Single Event.
      type: Unknown
    - contextPath: "IllusionBlack.Event.attacker.id"
      description: IllusionBLACK Event Attacker ID.
      type: Unknown
    - contextPath: IllusionBlack.Event.decoy.id
      description: IllusionBLACK Event Decoy ID.
      type: Unknown
    - contextPath: IllusionBlack.Event.id
      description: IllusionBLACK Event ID.
      type: Unknown
    - contextPath: IllusionBlack.Event.severity
      description: IllusionBLACK Event Severity.
      type: Unknown
    - contextPath: IllusionBlack.Event.type
      description: IllusionBLACK Event Attack Type.
      type: Unknown
  dockerimage: demisto/python3:3.12.13.12042988
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
defaultclassifier: Smokescreen IllusionBLACK
defaultmapperin: Smokescreen IllusionBLACK-mapper
tests:
- No tests (auto formatted)