diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Department.json b/Packs/CommonTypes/IncidentFields/incidentfield-Department.json index 2e35ba0055c5..bd3faab69843 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Department.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Department.json @@ -1,41 +1,42 @@ -{ - "id": "incident_department", - "version": -1, - "modified": "2020-09-29T12:43:19.261344539Z", - "name": "Department", - "ownerOnly": false, - "description": "Department", - "cliName": "department", - "type": "shortText", - "closeForm": false, - "editForm": true, - "required": false, - "neverSetAsRequired": false, - "isReadOnly": false, - "useAsKpi": false, - "locked": false, - "system": false, - "content": true, - "group": 0, - "hidden": false, - "associatedTypes": [ - "SysAid Change", - "SysAid Incident", - "SysAid Problem", - "SysAid Request", - "IAM - Rehire User", - "IAM - New Hire", - "IAM - Terminate User", - "IAM - Update User", - "User Profile", - "IAM - Sync User", - "Vectra Account" - ], - "associatedToAll": false, - "unmapped": false, - "unsearchable": false, - "caseInsensitive": true, - "sla": 0, - "threshold": 72, - "fromVersion": "5.0.0" +{ + "id": "incident_department", + "version": -1, + "modified": "2020-09-29T12:43:19.261344539Z", + "name": "Department", + "ownerOnly": false, + "description": "Department", + "cliName": "department", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "SysAid Change", + "SysAid Incident", + "SysAid Problem", + "SysAid Request", + "IAM - Rehire User", + "IAM - New Hire", + "IAM - Terminate User", + "IAM - Update User", + "User Profile", + "IAM - Sync User", + "Vectra Account", + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.0.0" } \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Email.json b/Packs/CommonTypes/IncidentFields/incidentfield-Email.json index 0a1ad43799e5..8659d6dcae6e 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Email.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Email.json @@ -14,7 +14,8 @@ "IAM - AD User Activation", "IAM - AD User Deactivation", "Vectra Account", - "CrowdStrike Falcon Mobile Detection" + "CrowdStrike Falcon Mobile Detection", + "Exabeam Notable User" ], "caseInsensitive": true, "cliName": "email", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-End_Time.json b/Packs/CommonTypes/IncidentFields/incidentfield-End_Time.json index 7aec1834e4a1..92ef86d65529 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-End_Time.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-End_Time.json @@ -3,7 +3,8 @@ "associatedTypes": [ "Guardicore Incident", "Graph Security Alert", - "CrowdStrike Falcon IDP Detection" + "CrowdStrike Falcon IDP Detection", + "Exabeam Notable User" ], "breachScript": "", "caseInsensitive": true, diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-First_Seen.json b/Packs/CommonTypes/IncidentFields/incidentfield-First_Seen.json index 552882073dd5..65b05b3f49e5 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-First_Seen.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-First_Seen.json @@ -7,11 +7,12 @@ "AWS CloudTrail Misconfiguration", "AWS IAM Policy Misconfiguration", "AWS EC2 Instance Misconfiguration", - "Netwitness Incident", + "NetWitness Incident", "Symantec DLP Discover Incident", "Symantec DLP Endpoint Incident", "Symantec DLP Network Incident", - "Prisma Cloud - VM Alert Prioritization" + "Prisma Cloud - VM Alert Prioritization", + "Exabeam Notable User" ], "caseInsensitive": true, "cliName": "firstseen", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Last_Seen.json b/Packs/CommonTypes/IncidentFields/incidentfield-Last_Seen.json index 8397f83d9c50..f782fe6f798b 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Last_Seen.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Last_Seen.json @@ -9,7 +9,8 @@ "Nutanix Hypervisor Alert", "OpsGenie Alert", "Microsoft Sentinel Incident", - "Prisma Cloud - VM Alert Prioritization" + "Prisma Cloud - VM Alert Prioritization", + "Exabeam Notable User" ], "breachScript": "", "caseInsensitive": true, diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Location.json b/Packs/CommonTypes/IncidentFields/incidentfield-Location.json index 7849797641bb..e8a3cf61a337 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Location.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Location.json @@ -1,41 +1,42 @@ -{ - "id": "incident_location", - "version": -1, - "modified": "2020-09-29T12:47:15.280457549Z", - "name": "Location", - "ownerOnly": false, - "description": "Location", - "cliName": "location", - "type": "shortText", - "closeForm": false, - "editForm": true, - "required": false, - "neverSetAsRequired": false, - "isReadOnly": false, - "useAsKpi": false, - "locked": false, - "system": false, - "content": true, - "group": 0, - "hidden": false, - "associatedTypes": [ - "SysAid Change", - "SysAid Incident", - "SysAid Problem", - "SysAid Request", - "IAM - New Hire", - "IAM - Terminate User", - "IAM - Update User", - "User Profile", - "IAM - Sync User", - "IAM - Rehire User", - "Azure Active Directory Identity and Access" - ], - "associatedToAll": false, - "unmapped": false, - "unsearchable": false, - "caseInsensitive": true, - "sla": 0, - "threshold": 72, - "fromVersion": "5.0.0" +{ + "id": "incident_location", + "version": -1, + "modified": "2020-09-29T12:47:15.280457549Z", + "name": "Location", + "ownerOnly": false, + "description": "Location", + "cliName": "location", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "SysAid Change", + "SysAid Incident", + "SysAid Problem", + "SysAid Request", + "IAM - New Hire", + "IAM - Terminate User", + "IAM - Update User", + "User Profile", + "IAM - Sync User", + "IAM - Rehire User", + "Azure Active Directory Identity and Access", + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.0.0" } \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Manager_Name.json b/Packs/CommonTypes/IncidentFields/incidentfield-Manager_Name.json index c5c777e88078..ad54a7f441d9 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Manager_Name.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Manager_Name.json @@ -1,40 +1,41 @@ -{ - "id": "incident_managername", - "version": -1, - "modified": "2020-09-06T10:29:12.223513078Z", - "name": "Manager Name", - "ownerOnly": false, - "description": "Manager Name", - "cliName": "managername", - "type": "shortText", - "closeForm": false, - "editForm": true, - "required": false, - "neverSetAsRequired": false, - "isReadOnly": false, - "useAsKpi": false, - "locked": false, - "system": false, - "content": true, - "group": 0, - "hidden": false, - "associatedTypes": [ - "SysAid Change", - "SysAid Incident", - "SysAid Problem", - "SysAid Request", - "IAM - New Hire", - "IAM - Terminate User", - "IAM - Update User", - "User Profile", - "IAM - Sync User", - "IAM - Rehire User" - ], - "associatedToAll": false, - "unmapped": false, - "unsearchable": true, - "caseInsensitive": true, - "sla": 0, - "threshold": 72, - "fromVersion": "5.0.0" +{ + "id": "incident_managername", + "version": -1, + "modified": "2020-09-06T10:29:12.223513078Z", + "name": "Manager Name", + "ownerOnly": false, + "description": "Manager Name", + "cliName": "managername", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "SysAid Change", + "SysAid Incident", + "SysAid Problem", + "SysAid Request", + "IAM - New Hire", + "IAM - Terminate User", + "IAM - Update User", + "User Profile", + "IAM - Sync User", + "IAM - Rehire User", + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.0.0" } \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Mobile_Phone.json b/Packs/CommonTypes/IncidentFields/incidentfield-Mobile_Phone.json index f6420ba2ae9c..d70cce839f98 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Mobile_Phone.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Mobile_Phone.json @@ -1,34 +1,35 @@ -{ - "associatedToAll": false, - "associatedTypes": [ - "User Profile", - "IAM - New Hire", - "IAM - Update User", - "IAM - Terminate User", - "IAM - Sync User", - "IAM - Rehire User" - ], - "caseInsensitive": true, - "cliName": "mobilephone", - "closeForm": false, - "content": true, - "editForm": true, - "group": 0, - "hidden": false, - "id": "incident_mobilephone", - "isReadOnly": false, - "locked": false, - "name": "Mobile Phone", - "neverSetAsRequired": false, - "ownerOnly": false, - "required": false, - "sla": 0, - "system": false, - "threshold": 72, - "type": "shortText", - "unmapped": false, - "unsearchable": false, - "useAsKpi": false, - "version": -1, - "fromVersion": "5.0.0" +{ + "associatedToAll": false, + "associatedTypes": [ + "User Profile", + "IAM - New Hire", + "IAM - Update User", + "IAM - Terminate User", + "IAM - Sync User", + "IAM - Rehire User", + "Exabeam Notable User" + ], + "caseInsensitive": true, + "cliName": "mobilephone", + "closeForm": false, + "content": true, + "editForm": true, + "group": 0, + "hidden": false, + "id": "incident_mobilephone", + "isReadOnly": false, + "locked": false, + "name": "Mobile Phone", + "neverSetAsRequired": false, + "ownerOnly": false, + "required": false, + "sla": 0, + "system": false, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": false, + "version": -1, + "fromVersion": "5.0.0" } \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Risk_Score.json b/Packs/CommonTypes/IncidentFields/incidentfield-Risk_Score.json index d011c683619c..7c418bda74e2 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Risk_Score.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Risk_Score.json @@ -13,7 +13,8 @@ "Skyhigh Security Alert", "Skyhigh Security Threat", "AWS Security Hub Finding", - "Prisma Cloud - VM Alert Prioritization" + "Prisma Cloud - VM Alert Prioritization", + "Exabeam Notable User" ], "breachScript": "", "caseInsensitive": true, diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Start_Time.json b/Packs/CommonTypes/IncidentFields/incidentfield-Start_Time.json index fd4edfb42e8f..9970284c4837 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Start_Time.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Start_Time.json @@ -13,7 +13,8 @@ "Microsoft Sentinel Incident", "Graph Security Alert", "CrowdStrike Falcon IDP Detection", - "Stamus Networks DoC" + "Stamus Networks DoC", + "Exabeam Notable User" ], "breachScript": "", "caseInsensitive": true, diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Title.json b/Packs/CommonTypes/IncidentFields/incidentfield-Title.json index 1fc48658747c..43ca3a88ca00 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Title.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Title.json @@ -1,56 +1,57 @@ -{ - "id": "incident_title", - "version": -1, - "modified": "2020-09-06T10:29:12.755957238Z", - "name": "Title", - "ownerOnly": false, - "description": "Title", - "cliName": "title", - "type": "shortText", - "closeForm": false, - "editForm": true, - "required": false, - "neverSetAsRequired": false, - "isReadOnly": false, - "useAsKpi": true, - "locked": false, - "system": false, - "content": true, - "group": 0, - "hidden": false, - "associatedTypes": [ - "SysAid Change", - "SysAid Incident", - "SysAid Problem", - "SysAid Request", - "IAM - New Hire", - "IAM - Terminate User", - "IAM - Update User", - "User Profile", - "IAM - Sync User", - "IAM - Rehire User", - "Mandiant Automated Defense Incident", - "OpsGenie Incident", - "ThreatConnect", - "Vectra Account", - "AWS Guard Duty EC2 Finding", - "AWS Guard Duty IAM Finding", - "AWS Guard Duty Kubernetes Finding", - "AWS Guard Duty Malware Protection Finding", - "AWS Guard Duty S3 Finding", - "Exabeam Incident", - "AWS Security Hub Finding", - "FreshworksFreshservice Ticket", - "FreshworksFreshservice Release Request", - "FreshworksFreshservice Problem Request", - "FreshworksFreshservice Change Request", - "Graph Security Alert" - ], - "associatedToAll": false, - "unmapped": false, - "unsearchable": false, - "caseInsensitive": true, - "sla": 0, - "threshold": 72, - "fromVersion": "5.0.0" +{ + "id": "incident_title", + "version": -1, + "modified": "2020-09-06T10:29:12.755957238Z", + "name": "Title", + "ownerOnly": false, + "description": "Title", + "cliName": "title", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": true, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "SysAid Change", + "SysAid Incident", + "SysAid Problem", + "SysAid Request", + "IAM - New Hire", + "IAM - Terminate User", + "IAM - Update User", + "User Profile", + "IAM - Sync User", + "IAM - Rehire User", + "Mandiant Automated Defense Incident", + "OpsGenie Incident", + "ThreatConnect", + "Vectra Account", + "AWS Guard Duty EC2 Finding", + "AWS Guard Duty IAM Finding", + "AWS Guard Duty Kubernetes Finding", + "AWS Guard Duty Malware Protection Finding", + "AWS Guard Duty S3 Finding", + "Exabeam Incident", + "AWS Security Hub Finding", + "FreshworksFreshservice Ticket", + "FreshworksFreshservice Release Request", + "FreshworksFreshservice Problem Request", + "FreshworksFreshservice Change Request", + "Graph Security Alert", + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.0.0" } \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-User_Groups.json b/Packs/CommonTypes/IncidentFields/incidentfield-User_Groups.json index 300b71bd1099..4009e9191098 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-User_Groups.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-User_Groups.json @@ -19,7 +19,8 @@ "hidden": false, "openEnded": true, "associatedTypes": [ - "Data Loss Prevention" + "Data Loss Prevention", + "Exabeam Notable User" ], "associatedToAll": false, "unmapped": false, diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Username.json b/Packs/CommonTypes/IncidentFields/incidentfield-Username.json index 6a2b70fe1a7a..e47724e26e14 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Username.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Username.json @@ -49,7 +49,8 @@ "IAM - Update User", "User Profile", "IAM - Sync User", - "IAM - Rehire User" + "IAM - Rehire User", + "Exabeam Notable User" ], "threshold": 72, "type": "shortText", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Work_Phone.json b/Packs/CommonTypes/IncidentFields/incidentfield-Work_Phone.json index d92f68b688a9..934a94d337c4 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Work_Phone.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Work_Phone.json @@ -1,34 +1,35 @@ -{ - "associatedToAll": false, - "associatedTypes": [ - "User Profile", - "IAM - New Hire", - "IAM - Update User", - "IAM - Terminate User", - "IAM - Sync User", - "IAM - Rehire User" - ], - "caseInsensitive": true, - "cliName": "workphone", - "closeForm": false, - "content": true, - "editForm": true, - "group": 0, - "hidden": false, - "id": "incident_workphone", - "isReadOnly": false, - "locked": false, - "name": "Work Phone", - "neverSetAsRequired": false, - "ownerOnly": false, - "required": false, - "sla": 0, - "system": false, - "threshold": 72, - "type": "shortText", - "unmapped": false, - "unsearchable": false, - "useAsKpi": false, - "version": -1, - "fromVersion": "5.0.0" +{ + "associatedToAll": false, + "associatedTypes": [ + "User Profile", + "IAM - New Hire", + "IAM - Update User", + "IAM - Terminate User", + "IAM - Sync User", + "IAM - Rehire User", + "Exabeam Notable User" + ], + "caseInsensitive": true, + "cliName": "workphone", + "closeForm": false, + "content": true, + "editForm": true, + "group": 0, + "hidden": false, + "id": "incident_workphone", + "isReadOnly": false, + "locked": false, + "name": "Work Phone", + "neverSetAsRequired": false, + "ownerOnly": false, + "required": false, + "sla": 0, + "system": false, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": false, + "version": -1, + "fromVersion": "5.0.0" } \ No newline at end of file diff --git a/Packs/CommonTypes/ReleaseNotes/3_5_9.md b/Packs/CommonTypes/ReleaseNotes/3_5_9.md new file mode 100644 index 000000000000..397ab773ae9c --- /dev/null +++ b/Packs/CommonTypes/ReleaseNotes/3_5_9.md @@ -0,0 +1,43 @@ +#### Incident Fields + +##### Location +Added support for incident type Exabeam Notable User. + +##### Department +Added support for incident type Exabeam Notable User. + +##### End Time +Added support for incident type Exabeam Notable User. + +##### Work Phone +Added support for incident type Exabeam Notable User. + +##### Start Time +Added support for incident type Exabeam Notable User. + +##### First Seen +Added support for incident type Exabeam Notable User. + +##### Last Seen +Added support for incident type Exabeam Notable User. + +##### Mobile Phone +Added support for incident type Exabeam Notable User. + +##### Manager Name +Added support for incident type Exabeam Notable User. + +##### User Groups +Added support for incident type Exabeam Notable User. + +##### Title +Added support for incident type Exabeam Notable User. + +##### Email +Added support for incident type Exabeam Notable User. + +##### Username +Added support for incident type Exabeam Notable User. + +##### Risk Score +Added support for incident type Exabeam Notable User. diff --git a/Packs/CommonTypes/pack_metadata.json b/Packs/CommonTypes/pack_metadata.json index be798c6425cc..1c2afaef5708 100644 --- a/Packs/CommonTypes/pack_metadata.json +++ b/Packs/CommonTypes/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Common Types", "description": "This Content Pack will get you up and running in no-time and provide you with the most commonly used incident & indicator fields and types.", "support": "xsoar", - "currentVersion": "3.5.8", + "currentVersion": "3.5.9", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Exabeam/Classifiers/classifier-Exabeam.json b/Packs/Exabeam/Classifiers/classifier-Exabeam.json new file mode 100644 index 000000000000..4d16a249e723 --- /dev/null +++ b/Packs/Exabeam/Classifiers/classifier-Exabeam.json @@ -0,0 +1,19 @@ +{ + "description": "", + "feed": false, + "id": "Exabeam Classifier", + "keyTypeMap": { + "Exabeam Incident": "Exabeam Incident", + "Exabeam Notable User": "Exabeam Notable User" + }, + "name": "Exabeam Classifier", + "propagationLabels": [ + "all" + ], + "transformer": { + "simple": "incident_type" + }, + "type": "classification", + "version": -1, + "fromVersion": "6.10.0" +} \ No newline at end of file diff --git a/Packs/Exabeam/Classifiers/classifier-exabeam_mapping.json b/Packs/Exabeam/Classifiers/classifier-exabeam_mapping.json index 6f357a07c35c..c71b760e55db 100644 --- a/Packs/Exabeam/Classifiers/classifier-exabeam_mapping.json +++ b/Packs/Exabeam/Classifiers/classifier-exabeam_mapping.json @@ -49,6 +49,217 @@ "simple": "name" } } + }, + "Exabeam Notable User": { + "dontMapEventToLabels": true, + "internalMapping": { + "Account Member Of": { + "simple": "highestRiskSession.accounts" + }, + "Account Status": { + "simple": "user.accessStatus" + }, + "Country": { + "simple": "user.info.country" + }, + "Department": { + "simple": "user.info.department" + }, + "Email": { + "simple": "user.info.email" + }, + "Exabeam Average Risk Score": { + "simple": "user.averageRiskScore" + }, + "Exabeam Highest Session Login Host": { + "simple": "highestRiskSession.loginHost" + }, + "Exabeam Highest Session Number Of Reasons": { + "simple": "highestRiskSession.numOfReasons" + }, + "Exabeam Last Activity Time": { + "simple": "user.lastActivityTime" + }, + "Exabeam Last Activity Type": { + "simple": "user.lastActivityType" + }, + "Exabeam Past Scores": { + "complex": { + "accessor": "pastScores", + "filters": [], + "root": "user", + "transformers": [ + { + "args": { + "item": { + "isContext": true, + "value": { + "simple": "highestRiskScore" + } + } + }, + "operator": "append" + } + ] + } + }, + "Exabeam Session IDs": { + "simple": "notableSessionIds" + }, + "External End Time": { + "simple": "highestRiskSession.endTime" + }, + "External Start Time": { + "simple": "highestRiskSession.startTime" + }, + "First Name": { + "simple": "user.info.fullName" + }, + "First Seen": { + "simple": "user.firstSeen" + }, + "Full Name": { + "simple": "user.info.fullName" + }, + "Last Seen": { + "simple": "user.lastSeen" + }, + "Manager Name": { + "complex": { + "accessor": "manager", + "filters": [], + "root": "user.info", + "transformers": [] + } + }, + "Mobile Phone": { + "simple": "user.info.phoneCell" + }, + "Number Of Found Related Alerts": { + "simple": "highestRiskSession.numOfEvents" + }, + "Number of Related Incidents": { + "simple": "highestRiskSession.numOfSecurityEvents" + }, + "Risk Score": { + "simple": "user.riskScore" + }, + "Tags": { + "simple": "user.labels" + }, + "Team name": { + "simple": "user.info.division" + }, + "Title": { + "simple": "user.info.title" + }, + "User Groups": { + "simple": "user.info.group" + }, + "Username": { + "simple": "user.username" + }, + "Work Phone": { + "simple": "user.info.phoneOffice" + }, + "occurred": { + "complex": { + "accessor": "startTime", + "filters": [], + "root": "highestRiskSession", + "transformers": [] + } + } + } + }, + "Vulnerability": { + "dontMapEventToLabels": true, + "internalMapping": { + "Full Name": { + "complex": { + "filters": [], + "root": "userFullName", + "transformers": [] + } + }, + "Source Username": { + "simple": "user.username" + }, + "name": { + "complex": { + "filters": [], + "root": "name", + "transformers": [] + } + }, + "occurred": { + "complex": { + "accessor": "startTime", + "filters": [], + "root": "highestRiskSession", + "transformers": [] + } + }, + "owner": { + "complex": { + "accessor": "owner", + "filters": [], + "root": "baseFields", + "transformers": [] + } + }, + "severity": { + "complex": { + "accessor": "priority", + "filters": [], + "root": "baseFields", + "transformers": [] + } + } + } + }, + "dbot_classification_incident_type_all": { + "dontMapEventToLabels": false, + "internalMapping": { + "Full Name": { + "complex": { + "filters": [], + "root": "userFullName", + "transformers": [] + } + }, + "name": { + "complex": { + "filters": [], + "root": "name", + "transformers": [] + } + }, + "occurred": { + "complex": { + "accessor": "startTime", + "filters": [], + "root": "highestRiskSession", + "transformers": [] + } + }, + "owner": { + "complex": { + "accessor": "owner", + "filters": [], + "root": "baseFields", + "transformers": [] + } + }, + "severity": { + "complex": { + "accessor": "priority", + "filters": [], + "root": "baseFields", + "transformers": [] + } + } + } } }, "name": "Exabeam mapping", diff --git a/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Average_Risk_Score.json b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Average_Risk_Score.json new file mode 100644 index 000000000000..9309fc857d31 --- /dev/null +++ b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Average_Risk_Score.json @@ -0,0 +1,31 @@ +{ + "id": "incident_exabeamaverageriskscore", + "version": -1, + "modified": "2024-06-23T08:15:03.486366733Z", + "name": "Exabeam Average Risk Score", + "ownerOnly": false, + "cliName": "exabeamaverageriskscore", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "openEnded": false, + "associatedTypes": [ + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.10.0" +} \ No newline at end of file diff --git a/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Login_Host.json b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Login_Host.json new file mode 100644 index 000000000000..9275bb2ac38e --- /dev/null +++ b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Login_Host.json @@ -0,0 +1,31 @@ +{ + "id": "incident_exabeamhighestsessionloginhost", + "version": -1, + "modified": "2024-06-23T09:00:50.674970362Z", + "name": "Exabeam Highest Session Login Host", + "ownerOnly": false, + "cliName": "exabeamhighestsessionloginhost", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "openEnded": false, + "associatedTypes": [ + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.10.0" +} diff --git a/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Number_Of_Asset.json b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Number_Of_Asset.json new file mode 100644 index 000000000000..dd4186ded3ea --- /dev/null +++ b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Number_Of_Asset.json @@ -0,0 +1,31 @@ +{ + "id": "incident_exabeamhighestsessionnumberofasset", + "version": -1, + "modified": "2024-06-23T09:00:26.500910853Z", + "name": "Exabeam Highest Session Number Of Asset", + "ownerOnly": false, + "cliName": "exabeamhighestsessionnumberofasset", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "openEnded": false, + "associatedTypes": [ + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.10.0" +} diff --git a/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Number_Of_Reasons.json b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Number_Of_Reasons.json new file mode 100644 index 000000000000..a69b102abfa3 --- /dev/null +++ b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Highest_Session_Number_Of_Reasons.json @@ -0,0 +1,31 @@ +{ + "id": "incident_exabeamhighestsessionnumberofreasons", + "version": -1, + "modified": "2024-06-23T09:01:03.308095116Z", + "name": "Exabeam Highest Session Number Of Reasons", + "ownerOnly": false, + "cliName": "exabeamhighestsessionnumberofreasons", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "openEnded": false, + "associatedTypes": [ + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.10.0" +} diff --git a/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Last_Activity_Time.json b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Last_Activity_Time.json new file mode 100644 index 000000000000..04fa9a529b8d --- /dev/null +++ b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Last_Activity_Time.json @@ -0,0 +1,31 @@ +{ + "id": "incident_exabeamlastactivitytime", + "version": -1, + "modified": "2024-06-23T08:52:11.469205207Z", + "name": "Exabeam Last Activity Time", + "ownerOnly": false, + "cliName": "exabeamlastactivitytime", + "type": "date", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "openEnded": false, + "associatedTypes": [ + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.10.0" +} \ No newline at end of file diff --git a/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Last_Activity_Type.json b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Last_Activity_Type.json new file mode 100644 index 000000000000..7f15f4853da0 --- /dev/null +++ b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Last_Activity_Type.json @@ -0,0 +1,31 @@ +{ + "id": "incident_exabeamlastactivitytype", + "version": -1, + "modified": "2024-06-23T08:52:37.631645622Z", + "name": "Exabeam Last Activity Type", + "ownerOnly": false, + "cliName": "exabeamlastactivitytype", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "openEnded": false, + "associatedTypes": [ + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.10.0" +} diff --git a/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Past_Scores.json b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Past_Scores.json new file mode 100644 index 000000000000..f3af52d64f56 --- /dev/null +++ b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Past_Scores.json @@ -0,0 +1,31 @@ +{ + "id": "incident_exabeampastscores", + "version": -1, + "modified": "2024-06-23T08:26:37.01054087Z", + "name": "Exabeam Past Scores", + "ownerOnly": false, + "cliName": "exabeampastscores", + "type": "multiSelect", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "openEnded": true, + "associatedTypes": [ + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.10.0" +} diff --git a/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Session_IDs.json b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Session_IDs.json new file mode 100644 index 000000000000..441f84efde53 --- /dev/null +++ b/Packs/Exabeam/IncidentFields/incidentfields-Exabeam_Session_IDs.json @@ -0,0 +1,31 @@ +{ + "id": "incident_exabeamsessionids", + "version": -1, + "modified": "2024-06-30T09:57:24.730584014Z", + "name": "Exabeam Session IDs", + "ownerOnly": false, + "cliName": "exabeamsessionids", + "type": "multiSelect", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "openEnded": true, + "associatedTypes": [ + "Exabeam Notable User" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": true, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.10.0" +} diff --git a/Packs/Exabeam/IncidentTypes/Exabeam_Incident.json b/Packs/Exabeam/IncidentTypes/Exabeam_Incident.json index a8babf74b92a..9084033f796c 100644 --- a/Packs/Exabeam/IncidentTypes/Exabeam_Incident.json +++ b/Packs/Exabeam/IncidentTypes/Exabeam_Incident.json @@ -24,5 +24,6 @@ "mode": "Specific", "fieldCliNameToExtractSettings": {} }, - "fromVersion": "6.5.0" + "fromVersion": "6.5.0", + "layout": "Exabeam Incident" } \ No newline at end of file diff --git a/Packs/Exabeam/IncidentTypes/Exabeam_Notable_User_Incident.json b/Packs/Exabeam/IncidentTypes/Exabeam_Notable_User_Incident.json new file mode 100644 index 000000000000..40418002d071 --- /dev/null +++ b/Packs/Exabeam/IncidentTypes/Exabeam_Notable_User_Incident.json @@ -0,0 +1,29 @@ +{ + "id": "Exabeam Notable User", + "version": -1, + "vcShouldIgnore": false, + "locked": false, + "name": "Exabeam Notable User", + "prevName": "Exabeam Notable User", + "color": "#A3C9FF", + "hours": 0, + "days": 0, + "weeks": 0, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "disabled": false, + "reputationCalc": 0, + "onChangeRepAlg": 0, + "layout": "Exabeam Notable User", + "detached": false, + "extractSettings": { + "mode": "Specific", + "fieldCliNameToExtractSettings": {} + }, + "fromVersion": "6.10.0" +} \ No newline at end of file diff --git a/Packs/Exabeam/Integrations/Exabeam/Exabeam.py b/Packs/Exabeam/Integrations/Exabeam/Exabeam.py index 48eb04ab1775..ceae8c2cbdd1 100644 --- a/Packs/Exabeam/Integrations/Exabeam/Exabeam.py +++ b/Packs/Exabeam/Integrations/Exabeam/Exabeam.py @@ -14,6 +14,10 @@ TOKEN_INPUT_IDENTIFIER = '__token' DAYS_BACK_FOR_FIRST_QUERY_OF_INCIDENTS = 3 DATETIME_FORMAT_MILISECONDS = '%Y-%m-%dT%H:%M:%S.%f' +DEFAULT_LIMIT = 50 +MAX_LENGTH_CONTEXT = 10000 +DEFAULT_FETCH_TYPE = ["Exabeam Incident"] +MAX_LIMIT_FETCH_USERS = 200 class Client(BaseClient): @@ -1184,6 +1188,18 @@ def convert_all_unix_keys_to_date(incident: dict) -> dict: return incident +def convert_all_unix_keys_to_date_user(incident: dict) -> dict: + keys = ['firstSeen', 'lastSeen', 'lastActivityTime', 'endTime', 'startTime'] + if 'user' in incident: + for key in keys: + if key in incident['user']: + incident['user'][key] = convert_unix_to_date(incident['user'][key]).split('.')[0] + 'Z' + if key in incident['highestRiskSession'] and incident['highestRiskSession'][key]: + incident['highestRiskSession'][key] = convert_unix_to_date( + incident['highestRiskSession'][key]).split('.')[0] + 'Z' + return incident + + def build_incident_response_query_params(query: str | None, incident_type: str | None, priority: str | None, @@ -1233,6 +1249,25 @@ def test_module(client: Client, args: dict[str, str], params: dict[str, str]): ok if successful """ client.test_module_request() + + is_fetch = argToBoolean(params.get("isFetch") or False) + if is_fetch: + fetch_type = params.get("fetch_type", DEFAULT_FETCH_TYPE) + if "Exabeam Notable User" in fetch_type: + + fetch_interval = arg_to_number(params.get("notable_users_fetch_interval")) or 60 + if fetch_interval % 60 != 0: + raise ValueError("The Notable Users Fetch Interval must be specified in whole hours") + + max_fetch_users = arg_to_number(params.get("max_fetch_users")) or DEFAULT_LIMIT + if max_fetch_users <= 0 or max_fetch_users > MAX_LIMIT_FETCH_USERS: + raise ValueError("The Max Users Per Fetch must be between 1 and 200") + + client.get_notable_users_request("h", "1", 1) + + if "Exabeam Incident" in fetch_type: + client.get_incidents({}) + demisto.results('ok') @@ -2085,9 +2120,28 @@ def list_incidents(client: Client, args: dict[str, str]): def fetch_incidents(client: Client, args: dict[str, str]) -> tuple[list, dict]: - look_back = arg_to_number(args.get('look_back', '1')) - last_run = demisto.getLastRun() + incidents: list[dict] = [] + last_run: dict[str, Any] = demisto.getLastRun() demisto.debug(f"Last run before the fetch run: {last_run}") + fetch_type = args.get("fetch_type", DEFAULT_FETCH_TYPE) + + if "Exabeam Notable User" in fetch_type: + incidents, last_run = fetch_notable_users(client, args, last_run) + demisto.debug(f'After fetch notable users, there are {len(incidents)} new incidents') + + if "Exabeam Incident" in fetch_type: + exabeam_incidents, updated_last_run = fetch_exabeam_incidents(client, args, last_run) + incidents.extend(exabeam_incidents) + last_run.update(updated_last_run) + + demisto.debug(f"Last run after the fetch run: {last_run}") + return incidents, last_run + + +def fetch_exabeam_incidents(client: Client, args: dict[str, str], last_run: dict[str, Any]) -> tuple[list, dict]: + incidents: list[dict] = [] + look_back = arg_to_number(args.get('look_back')) or 1. + start_time, end_time = get_fetch_run_time_range( last_run=last_run, first_fetch=args.get('first_fetch', '3 days'), @@ -2135,11 +2189,11 @@ def fetch_incidents(client: Client, args: dict[str, str]) -> tuple[list, dict]: ) demisto.debug(f'After filtering, there are {len(incidents_filtered)} incidents') - incidents: list[dict] = [] for incident in incidents_filtered: incident['createdAt'] = datetime.fromtimestamp( incident.get('baseFields', {}).get('createdAt') / 1000.0).strftime(DATETIME_FORMAT_MILISECONDS) incident = convert_all_unix_keys_to_date(incident) + incident['incident_type'] = 'Exabeam Incident' incidents.append({ 'Name': incident.get('name'), 'occurred': incident.get('baseFields', {}).get('createdAt'), @@ -2158,10 +2212,86 @@ def fetch_incidents(client: Client, args: dict[str, str]) -> tuple[list, dict]: date_format=DATETIME_FORMAT_MILISECONDS, increase_last_run_time=True ) - demisto.debug(f"Last run after the fetch run: {last_run}") return incidents, last_run +def fetch_notable_users(client: Client, args: dict[str, str], last_run_obj: dict) -> tuple[list, dict]: + current_time = datetime.now(timezone.utc) + last_run_notable_users: str = last_run_obj.get("last_run_notable_users", "") + demisto.debug(f"Last run notable users: {last_run_notable_users}, before fetch") + + if last_run_notable_users: + last_run_time = datetime.fromisoformat(last_run_notable_users).astimezone(timezone.utc) + difference = current_time - last_run_time + difference_minutes = difference.total_seconds() / 60 + fetch_interval = arg_to_number(args.get("notable_users_fetch_interval")) or 60 + + # Ensure fetch_interval is at least 60 and rounded to the nearest multiple of 60 + fetch_interval = max(60, round(fetch_interval / 60) * 60) + + demisto.debug(f"Difference of {difference_minutes} minutes between the current time and the last run notable users") + if difference_minutes <= fetch_interval: # Check if the time interval is past. + return [], last_run_obj + + else: + time_period = f"{int(fetch_interval/60)} hours" + + else: # In the first run + time_period = args.get("notable_users_first_fetch", "3 months") + + limit = arg_to_number(args.get("max_fetch_users")) or DEFAULT_LIMIT + args_notable_users = {"limit": limit, "time_period": time_period} + demisto.debug(f"Before the request args notable users, limit: {limit}, time period: {time_period}") + _, _, res = get_notable_users(client, args_notable_users) + users = res.get("users", []) + demisto.debug(f"Got {len(users)} users from the API, before filtering") + + minimum_risks = arg_to_number(args.get("minimum_risk_score_to_fetch_users")) + + existing_usernames: list[str] = last_run_obj.get("usernames", []) + + demisto.debug(f"Existing {len(existing_usernames)} usernames in last run") + new_risky_users = [] + new_usernames = [] + for user in users: + user_details = user.get("user", {}) + username = user_details.get("username", "") + risk_score = user_details.get("riskScore", -1) + if risk_score >= minimum_risks and username not in existing_usernames: + new_risky_users.append(user) + new_usernames.append(username) + + demisto.debug(f"After filtering, there are {len(new_risky_users)} new risky users") + + combined_usernames = existing_usernames + new_usernames + + # Calculate the excess length, which is the amount by which the combined list exceeds the maximum allowed length + excess_length = max(len(combined_usernames) - MAX_LENGTH_CONTEXT, 0) + + # Create the new list of usernames, trimming the excess from the existing ones + usernames_to_last_run = existing_usernames[excess_length:] + new_usernames + demisto.debug(f"{excess_length} usernames deleted from the lest run to avoid exceeding the maximum") + + last_run_obj["usernames"] = usernames_to_last_run + demisto.debug(f"After the added lest run contain {len(usernames_to_last_run)} usernames") + + incidents: list[dict] = [] + for user_data in new_risky_users: + user_data_fixed_time = convert_all_unix_keys_to_date_user(user_data) + user_username = user_data.get("user", {}).get("username", "") + user_data_fixed_time['incident_type'] = 'Exabeam Notable User' + incidents.append( + { + "Name": user_username, + "rawJSON": json.dumps(user_data_fixed_time), + } + ) + + last_run_obj["last_run_notable_users"] = current_time.strftime(DATETIME_FORMAT_MILISECONDS) + demisto.debug(f"Last run notable users after the fetch run: {last_run_notable_users}") + return incidents, last_run_obj + + def main(): # pragma: no cover """ PARSE AND VALIDATE INTEGRATION PARAMS diff --git a/Packs/Exabeam/Integrations/Exabeam/Exabeam.yml b/Packs/Exabeam/Integrations/Exabeam/Exabeam.yml index 07c188824209..355b410bc441 100644 --- a/Packs/Exabeam/Integrations/Exabeam/Exabeam.yml +++ b/Packs/Exabeam/Integrations/Exabeam/Exabeam.yml @@ -7,10 +7,12 @@ configuration: name: url required: true type: 0 + section: Connect - display: Username name: credentials type: 9 required: false + section: Connect - additionalinfo: Cluster Authentication Token display: Username displaypassword: API Token @@ -18,6 +20,7 @@ configuration: type: 9 hiddenusername: true required: false + section: Connect - defaultvalue: "generic,abnormalAuth,accountManipulation,accountTampering,ueba,bruteForce,compromisedCredentials, cryptomining,dataAccessAbuse,dataExfiltration,dlp,departedEmployee,dataDestruction,evasion,lateralMovement,alertTriage, malware,phishing,privilegeAbuse,physicalSecurity,privilegeEscalation,privilegedActivity,ransomware,workforceProtection" display: Exabeam Incident Type name: incident_type @@ -48,6 +51,8 @@ configuration: - workforceProtection type: 16 required: false + section: Collect + advanced: true - defaultvalue: low,medium,high,critical display: Priority name: priority @@ -58,6 +63,8 @@ configuration: - critical type: 16 required: false + section: Collect + advanced: true - defaultvalue: closed,closedFalsePositive,inprogress,new,pending,resolved display: Status name: status @@ -74,16 +81,20 @@ configuration: name: isFetch type: 8 required: false + section: Collect + advanced: true - defaultvalue: '50' display: Max incidents per fetch name: max_fetch type: 0 required: false + section: Collect - defaultvalue: 3 days display: First fetch timestamp (