category: Network Security
sectionorder:
- Connect
- Collect
provider: Stamus Networks
commonfields:
  id: Stamus
  version: -1
configuration:
- defaultvalue: https://example.com/
  display: Stamus Central Server
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  additionalinfo: The API Key to use for connection
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
- display: Incident type
  name: incidentType
  required: false
  type: 13
  defaultvalue: 'Stamus Networks DoC'
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Collect
- defaultvalue: '200'
  display: Maximum number of incidents per fetch
  name: max_fetch
  required: false
  type: 0
  section: Collect
- defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  required: false
  type: 0
  section: Collect
description: '[Get Declaration of Compromises from Stamus Security Platform and build Incidents. Then get related artifacts, events and Host Insight information].'
display: 'Stamus'
name: Stamus
script:
  commands:
  - arguments:
    - name: indicator_key
      default: false
      description: '[Indicator of Compromise key].'
      isArray: false
      required: true
      secret: false
    - name: indicator_value
      default: false
      description: '[Indicator of Compromise value].'
      isArray: false
      required: true
      secret: false
    deprecated: false
    description: '[Get events with IOC key/value filter].'
    execution: false
    name: stamus-check-ioc
    outputs:
    - contextPath: StamusIntegration.IOC
      description: '[Fetch events matching an IOC].'
      type: String
    - contextPath: StamusIntegration.IOC.timestamp
      description: '[Timestamp of the event].'
      type: String
    - contextPath: StamusIntegration.IOC.src_ip
      description: '[Source IP of the event].'
      type: String
    - contextPath: StamusIntegration.IOC.dest_ip
      description: '[Destination IP of the event].'
      type: String
    - contextPath: StamusIntegration.IOC.event_type
      description: '[Type of the event - can be multitude, example: HTTP,SMB,DNS,Flow,TLS,KRB5,FTP etc].'
      type: String
  - arguments:
    - default: false
      description: '[IP to get Host Insights information].'
      isArray: false
      name: ip
      required: true
      secret: false
    deprecated: false
    description: '[Get Host Insights information].'
    execution: false
    name: stamus-get-host-insight
    outputs:
    - contextPath: StamusIntegration.HostInsights
      description: '[Fetch information about a host known by Host Insight module].'
      type: String
    - contextPath: StamusIntegration.HostInsights.ip
      description: '[Stamus Host Insights IP address].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.client_service.first_seen
      description: '[Timestamp of first time seen].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.client_service
      description: '[Client network service detected].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.services.proto
      description: '[Network services protocol].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.services.port
      description: '[Network services port].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.services.values.first_seen
      description: '[Network services for the corresponding application protocol first time seen].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.services.values.last_seen
      description: '[Network services for the corresponding application protocol last time seen].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.services.values.app_proto
      description: '[Network services application layer protocol].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.services.services_count
      description: '[Number of network services detected on the host].'
      type: Number
    - contextPath: StamusIntegration.HostInsights.host_id.client_service.name
      description: '[Type of client network service detected - can be HTTP,KRB5,TLS,DCERPC,SMB etc].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.hostname.host
      description: '[Hostname detected on the host].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.username.user
      description: '[Username detected loggin in on the host].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.http\.user_agent.agent
      description: '[HTTP User-Agent detected being used from the host].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.tls\.ja3.hash
      description: '[TLS JA3 hash detected being used from the host].'
      type: String
    - contextPath: StamusIntegration.HostInsights.host_id.tls\.ja3s.hash
      description: '[TLS JA3S hash detected being used from the host].'
      type: String
  - arguments:
    - default: false
      description: '[Stamus ID used to get related information].'
      isArray: false
      name: id
      required: true
      secret: false
    deprecated: false
    description: '[Get events for a Declaration of Compromise using the Stamus ID].'
    execution: false
    name: stamus-get-doc-events
    outputs:
    - contextPath: StamusIntegration.RelatedEvents
      description: '[Get events for a Declaration of Compromise].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.timestamp
      description: '[Timestamp of the Stamus event].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.stamus.asset
      description: '[Stamus asset].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.offender
      description: '[Offender, against the Stamus asset].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.killchain
      description: '[Killchain stage].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.method
      description: '[Stamus method triggered].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.info
      description: '[Extra Information].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.src_ip
      description: '[Source IP of the event].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.dest_ip
      description: '[Destination IP of the event].'
      type: String
    - contextPath: StamusIntegration.RelatedEvents.app_proto
      description: '[Application protocol of the event].'
      type: String
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.9.0
defaultmapperin: Stamus Networks incoming mapper
tests:
- No tests (auto formatted)