commonfields:
  id: Thinkst Canary
  version: -1
sectionorder:
- Connect
- Collect
name: Thinkst Canary
display: Thinkst Canary
category: Deception & Breach Simulation
provider: Thinkst Canary
description: By presenting itself as an apparently benign and legitimate service(s), the Canary draws the attention of unwanted activity. When someone trips one of the Canary's triggers, an alert is sent to notify the responsible parties so that action can be taken before valubale systems in your network are compromised.
configuration:
- display: Canary Server URL (e.g., https://***.canary.tools)
  name: server
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: API Authentication Token
  name: auth_token
  defaultvalue: ""
  type: 4
  section: Connect
  hidden: true
  required: false
- name: authentication_token
  type: 9
  displaypassword: API Authentication Token
  hiddenusername: true
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: fetchDelta
  defaultvalue: "24 hours"
  type: 0
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: canarytools-list-canaries
    arguments: []
    outputs:
    - contextPath: CanaryTools.Device.ID
      description: Device ID.
      type: string
    - contextPath: CanaryTools.Device.Name
      description: Device name.
      type: string
    - contextPath: CanaryTools.Device.Description
      description: Device description.
      type: string
    - contextPath: CanaryTools.Device.Address
      description: Device IP address.
      type: string
    - contextPath: CanaryTools.Device.Status
      description: Device status - Live (True/False).
      type: boolean
    - contextPath: CanaryTools.Device.Location
      description: Device location.
      type: string
    - contextPath: CanaryTools.Device.Version
      description: Device version.
      type: string
    - contextPath: CanaryTools.Device.LastSeen
      description: Device last seen time.
      type: date
    - contextPath: CanaryTools.Device.LastUpdated
      description: Device last updated time.
      type: date
    description: Lists all registered Canaries.
  - name: canarytools-list-tokens
    arguments: []
    outputs:
    - contextPath: CanaryTools.Token.CanaryToken
      description: Canary Token.
      type: string
    - contextPath: CanaryTools.Token.CreatedTime
      description: Token Created time.
      type: date
    - contextPath: CanaryTools.token.Enabled
      description: Token status - Enabled (True / False).
      type: boolean
    - contextPath: CanaryTools.Token.Kind
      description: Token Kind.
      type: string
    - contextPath: CanaryTools.Token.Triggered
      description: Token triggered count.
      type: number
    - contextPath: CanaryTools.Token.DocName
      description: Token document name (If the token is from type document).
      type: string
    - contextPath: CanaryTools.Token.TokenURL
      description: Token URL (How the token is presented).
      type: string
    description: Lists all Canary tokens.
  - name: canarytools-check-whitelist
    arguments:
    - name: ip
      required: true
      description: IP address.
    - name: port
      description: Destination port.
    outputs:
    - contextPath: CanaryTools.IP.Address
      description: IP address.
      type: string
    - contextPath: CanaryTools.IP.Port
      description: Destination port for the IP allow list.
      type: string
    - contextPath: CanaryTools.IP.Whitelisted
      description: Is the IP address on allow list (true/false).
      type: boolean
    description: Checks whether a given IP address and port are on allow list.
  - name: canarytools-whitelist-ip
    arguments:
    - name: ip
      required: true
      description: IP address to add to allow list.
    - name: port
      description: Destination port to add to allow list.
    outputs:
    - contextPath: CanaryTools.IP.Address
      description: IP address.
      type: string
    - contextPath: CanaryTools.IP.Port
      description: Destination port for the IP allow list.
      type: string
    - contextPath: CanaryTools.IP.Whitelisted
      description: Is the IP address on allow list (True/False).
      type: boolean
    description: Adds an IP address to the allow list in Canary.
  - name: canarytools-edit-alert-status
    arguments:
    - name: alert_id
      required: true
      description: 'Alert ID (e.g., incident:canarytoken:d6fe0ae4dfd36cc3cc6d9d4f::1548593719, Can be retrieved through fetch incidents).'
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - Acknowledge
      - Unacknowledge
      description: Required status for the alert (Acknowledge, Unacknowledge).
    outputs:
    - contextPath: CanaryTools.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: CanaryTools.Alert.Status
      description: Alert status.
      type: string
    description: Edits the status for an alert in Canary Tools.
  - name: canarytools-get-token
    arguments:
    - name: token
      required: true
      description: Canary Token, Can be retrieved through list-tokens command.
    outputs:
    - contextPath: CanaryTools.Token.CanaryToken
      description: Canary Token.
      type: string
    - contextPath: File.Size
      description: File Size.
      type: string
    - contextPath: File.SHA1
      description: File SHA-1.
      type: string
    - contextPath: File.SHA256
      description: File SHA-256.
      type: string
    - contextPath: File.Name
      description: File name.
      type: string
    - contextPath: File.SSDeep
      description: File SSDeep.
      type: string
    - contextPath: File.EntryID
      description: File EntryID.
      type: string
    - contextPath: File.Info
      description: File info.
      type: string
    - contextPath: File.Type
      description: File type.
      type: string
    - contextPath: File.MD5
      description: File MD5.
      type: string
    - contextPath: File.Extension
      description: File extension.
      type: string
    description: Fetches a Canary Token file from the Canary Tools server.
  isfetch: true
tests:
- CanaryTools Test
fromversion: 5.0.0