commonfields: id: appNovi version: -1 name: appNovi display: appNovi category: Analytics & SIEM provider: Fenix24 description: "Search across meshed network, security, and business data in appNovi to make efficient informed security decisions for risk management and incident response. Gain immediate intelligence on assets, visualize risk and threats across your network, and undertake interactive investigations across the network to reduce MTTR for incident response. \n" configuration: - display: Full URL of appNovi instance. name: appnovi_url defaultvalue: https://my.appnovi.server type: 0 required: true - display: API Token name: appnovi_token type: 4 required: true additionalinfo: appNovi token URL for authentication - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false script: script: '-' type: python subtype: python3 commands: - name: search-appnovi-components arguments: - name: search_term required: true type: textArea description: The string to use to search for Components. - name: max_results default: true defaultValue: "25" description: Number of results. outputs: - contextPath: appnovi.components.name description: Name of thing. type: String - contextPath: appnovi.components.coll description: Collection containing thing. type: String - contextPath: appnovi.components.u._id description: appNovi Database ID. type: String - contextPath: appnovi.components.u._key description: appNovi Database Key. type: String - contextPath: appnovi.components.u.identity.company description: Company ID. type: String - contextPath: appnovi.components.u.identity.type description: Thing type. type: String - contextPath: appnovi.components.u.identity.value description: Thing name. type: String - contextPath: appnovi.components.u.identity.datacenter description: Datacenter ID. type: String - contextPath: appnovi.components.u.identity.domain description: Domain ID. type: String - contextPath: appnovi.components.u.lastSeen description: Time thing was last seen. type: Date - contextPath: appnovi.components.u.source description: This is information about the source of the entity. type: Date - contextPath: appnovi.components.u.userProperties description: These are the custom properties of the entity. type: String - contextPath: appnovi.components.connections description: Number of connections. type: Number - contextPath: appnovi.time description: Query time (for diagnostics). type: Number description: Search for Components by name or value. - name: search-appnovi-connected outputs: - contextPath: appnovi._key description: 'appNovi database key.' type: String - contextPath: appnovi._id description: appNovi database ID. type: String - contextPath: appnovi.category description: appNovi Category (e.g. Interface, Server). type: String - contextPath: appnovi.firstSeen description: When was this Thing first seen? type: Date - contextPath: appnovi.identity.company description: Company ID. type: String - contextPath: appnovi.identity.datacenter description: Datacenter ID. type: String - contextPath: appnovi.identity.domain description: Domain ID. type: String - contextPath: appnovi.identity.type description: Thing type. type: String - contextPath: appnovi.identity.value description: Identity value. type: String - contextPath: appnovi.lastSeen description: Last time thing was seen. type: Date - contextPath: appnovi.name description: Name of entity. type: String - contextPath: appnovi.source description: This is information about the source of the entity. type: Unknown - contextPath: appnovi.userProperties description: These are the custom properties of the entity. type: String - contextPath: appnovi.applications description: List of applications. type: String arguments: - name: identity required: true description: appNovi identifier key-value or use key "_id" when searching via appNovi ID. type: keyValue - name: category auto: PREDEFINED predefined: - BaseComponent - Identity - IPAddress - Interface - Server - Storage - Hypervisor - CloudInfra - CloudService - NetworkInfra - Cluster - Container - MessageQueue - Vulnerability - CVE - Employee - Client - Software - Policy - Databases description: Optional category of components to return. isArray: true type: textArea - name: type auto: PREDEFINED predefined: - genericcomponent - genericmetadata - rdns - user - machine - iamrole - iamuser - ip - ipv4 - ipv6 - mac - eni - interface - vmwarevm - ec2 - azurevm - vm - server - physical - s3 - datastore - bucket - storage - esx - vcenter - hypervisor - vpc - subscription - account - resourcegroup - region - availabilityzone - autoscalinggroup - elasticloadbalancer - org - folder - project - vnet - rds - ecr - lambda - redshift - dynamodbtable - router - firewall - switch - loadbalancer - proxy - middleware - kubernetes - aks - eks - swarm - mesos - nomad - docker - containerd - messagetopic - messageserver - vulnerability - cve - employee - contractor - desktop - laptop - pc - vdi - mobile - client - software - ami - securitygroup - iampolicy - column - database - table - view description: Optional type of components to return. isArray: true type: textArea - name: max_results default: true defaultValue: "25" description: Number of results. description: Search for Components connected to supplied identity. - name: search-appnovi-cve outputs: - contextPath: appnovi._key description: 'appNovi database key.' type: String - contextPath: appnovi._id description: appNovi database ID. type: String - contextPath: appnovi.category description: appNovi Category (e.g. Interface, Server). type: String - contextPath: appnovi.firstSeen description: When was this Thing first seen? type: Date - contextPath: appnovi.identity.company description: Company ID. type: String - contextPath: appnovi.identity.datacenter description: Datacenter ID. type: String - contextPath: appnovi.identity.domain description: Domain ID. type: String - contextPath: appnovi.identity.type description: Thing type. type: String - contextPath: appnovi.identity.value description: Identity value. type: String - contextPath: appnovi.lastSeen description: Last time thing was seen. type: Date - contextPath: appnovi.name description: Name of entity. type: String - contextPath: appnovi.source description: This is information about the source of the entity. type: Unknown - contextPath: appnovi.userProperties description: These are the custom properties of the entity. type: String - contextPath: appnovi.applications description: List of applications. type: String arguments: - name: cve required: true description: CVE e.g. "CVE-2017-0143". description: Search for servers with matching CVE. - name: search-appnovi-component-property outputs: - contextPath: appnovi.components.name description: Name of thing. type: String - contextPath: appnovi.components.coll description: Collection containing thing. type: String - contextPath: appnovi.components.u._id description: appNovi Database ID. type: String - contextPath: appnovi.components.u._key description: appNovi Database Key. type: String - contextPath: appnovi.components.u.identity.company description: Company ID. type: String - contextPath: appnovi.components.u.identity.type description: Thing type. type: String - contextPath: appnovi.components.u.identity.value description: Thing name. type: String - contextPath: appnovi.components.u.identity.datacenter description: Datacenter ID. type: String - contextPath: appnovi.components.u.identity.domain description: Domain ID. type: String - contextPath: appnovi.components.u.lastSeen description: Time thing was last seen. type: Date - contextPath: appnovi.components.u.source description: This is information about the source of the entity. type: Date - contextPath: appnovi.components.u.userProperties description: These are the custom properties of the entity. type: String - contextPath: appnovi.components.connections description: Number of connections. type: Number - contextPath: appnovi.time description: Query time (for diagnostics). type: Number arguments: - name: property required: true description: Name of property. - name: value required: true description: Value of property. - name: max_results default: true description: Number of results. defaultValue: "25" description: Search for Components by property and value. - name: search-appnovi-server-by-ip outputs: - contextPath: appnovi._key description: 'appNovi database key.' type: String - contextPath: appnovi._id description: appNovi database ID. type: String - contextPath: appnovi.category description: appNovi Category (e.g. Interface, Server). type: String - contextPath: appnovi.firstSeen description: When was this Thing first seen? type: Date - contextPath: appnovi.identity.company description: Company ID. type: String - contextPath: appnovi.identity.datacenter description: Datacenter ID. type: String - contextPath: appnovi.identity.domain description: Domain ID. type: String - contextPath: appnovi.identity.type description: Thing type. type: String - contextPath: appnovi.identity.value description: Identity value. type: String - contextPath: appnovi.lastSeen description: Last time thing was seen. type: Date - contextPath: appnovi.name description: Name of entity. type: String - contextPath: appnovi.source description: This is information about the source of the entity. type: Unknown - contextPath: appnovi.userProperties description: These are the custom properties of the entity. type: String - contextPath: appnovi.applications description: List of applications. type: String arguments: - name: ip required: true type: textArea description: Server IP to search. description: Search for servers using IP address. dockerimage: demisto/python3:3.12.13.10116658 tests: - No tests (auto formatted) fromversion: 6.5.0