XSOAR (Independent Publisher) (#1546)
* Created XSOAR connector * Updated contact info * Delete .gitignore * Updated the Website propertyValue Per request updated to a more specific URL for the XSOAR product. * Removed duplicate publisher property publisher property was defined on line 57 and was removed as it was a duplicate. * Added more API token details Added more details around obtaining the necessary key to communicate using the Generic Webhook integration.
This commit is contained in:
Landon Chelf
GitHub
Родитель
2e0cdf63bb
Коммит
29e3329c52
|
|
@ -0,0 +1,25 @@
|
|||
## XSOAR Connector
|
||||
XSOAR provides a security orchestration, automation, and remediation platform. Using this integration you can submit data to XSOAR for usage in security automations.
|
||||
|
||||
## Publisher: Landon Chelf | FIS
|
||||
|
||||
## Prerequisites
|
||||
You will need the following to proceed:
|
||||
* A XSOAR with an integration instance available over HTTPS via [TODO HERE].
|
||||
* An API key for the integration instance
|
||||
|
||||
## Supported Operations
|
||||
The connector supports the following operation:
|
||||
* `Send to XSOAR`: Send JSON data to XSOAR
|
||||
|
||||
## Obtaining Credentials
|
||||
To generate an API key in XSOAR:
|
||||
* Install the Generic Webhook integration
|
||||
* Add a new instance configuration of the Generic Webhook integration configured to use token authentication as documented in the instance configuration wizard.
|
||||
|
||||
## Known issues and limitations
|
||||
### Limitations
|
||||
* Only supports API Key based authentication.
|
||||
* Only works with integrations instances configured to be exposed over HTTPS via server rerouting using the instance.execute.external config setting in XSOAR.
|
||||
### Issues
|
||||
There are no known issues at this time.
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
{
|
||||
"swagger": "2.0",
|
||||
"info": {
|
||||
"description": "Provides the ability to submit content to XSOAR integrations when using instance.execute.external to expose integration instances over HTTPS. Tested to work with the Generic Webhook integration.",
|
||||
"version": "1.0.0",
|
||||
"title": "XSOAR",
|
||||
"contact": {
|
||||
"name": "Landon Chelf",
|
||||
"email": "landon.chelf@fisglobal.com"
|
||||
"url": "https://fisglobal.com"
|
||||
},
|
||||
"license": {
|
||||
"name": "Apache 2.0",
|
||||
"url": "http://www.apache.org/licenses/LICENSE-2.0.html"
|
||||
}
|
||||
},
|
||||
"host": "demisto.live",
|
||||
"basePath": "/instance/execute",
|
||||
"schemes": [
|
||||
"https"
|
||||
],
|
||||
"x-ms-connector-metadata": [
|
||||
{
|
||||
"propertyName": "Website",
|
||||
"propertyValue": "https://start.paloaltonetworks.com/sign-up-for-community-edition.html"
|
||||
},
|
||||
{
|
||||
"propertyName": "Privacy policy",
|
||||
"propertyValue": "https://www.paloaltonetworks.com/legal-notices/privacy"
|
||||
},
|
||||
{
|
||||
"propertyName": "Categories",
|
||||
"propertyValue": "IT Operations"
|
||||
}
|
||||
],
|
||||
"consumes": [
|
||||
"application/json"
|
||||
],
|
||||
"produces": [
|
||||
"application/json"
|
||||
],
|
||||
"paths": {
|
||||
"/": {
|
||||
"post": {
|
||||
"summary": "Send to XSOAR",
|
||||
"description": "Send JSON data to XSOAR.",
|
||||
"operationId": "SendToXSOAR",
|
||||
"parameters": [
|
||||
{
|
||||
"in": "body",
|
||||
"name": "request_body",
|
||||
"description": "Valid JSON content",
|
||||
"required": true,
|
||||
"schema": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "Success"
|
||||
},
|
||||
"401": {
|
||||
"description": "API key is missing or invalid",
|
||||
"headers": {
|
||||
"Authorization": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"definitions": {},
|
||||
"parameters": {},
|
||||
"responses": {
|
||||
"UnauthorizedError": {
|
||||
"description": "API key is missing or invalid",
|
||||
"headers": {
|
||||
"Authorization": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"securityDefinitions": {
|
||||
"ApiKeyAuth": {
|
||||
"type": "apiKey",
|
||||
"name": "Authorization",
|
||||
"in": "header"
|
||||
}
|
||||
},
|
||||
"security": [
|
||||
{
|
||||
"ApiKeyAuth": []
|
||||
}
|
||||
],
|
||||
"tags": []
|
||||
}
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
{
|
||||
"properties": {
|
||||
"connectionParameters": {
|
||||
"domain_name": {
|
||||
"type": "string",
|
||||
"uiDefinition": {
|
||||
"displayName": "Host Name",
|
||||
"description": "The FQDN of the URL. Example: 9999999.demisto.live",
|
||||
"tooltip": "Host Name",
|
||||
"constraints": {
|
||||
"clearText": true,
|
||||
"required": "true"
|
||||
}
|
||||
}
|
||||
},
|
||||
"instance_name": {
|
||||
"type": "string",
|
||||
"uiDefinition": {
|
||||
"displayName": "Instance Name",
|
||||
"description": "The XSOAR integration instance name.",
|
||||
"tooltip": "Instance Name",
|
||||
"constraints": {
|
||||
"clearText": true,
|
||||
"required": "true"
|
||||
}
|
||||
}
|
||||
},
|
||||
"api_key": {
|
||||
"type": "securestring",
|
||||
"uiDefinition": {
|
||||
"displayName": "API Key",
|
||||
"description": "The API Key for this api",
|
||||
"tooltip": "Provide your API Key",
|
||||
"constraints": {
|
||||
"clearText": false,
|
||||
"required": "true"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"iconBrandColor": "#000000",
|
||||
"capabilities": [ "actions" ],
|
||||
"publisher": "Landon Chelf",
|
||||
"stackOwner": "Palo Alto Networks",
|
||||
"policyTemplateInstances": [
|
||||
{
|
||||
"templateId": "dynamichosturl",
|
||||
"title": "SetHostURL",
|
||||
"parameters": {
|
||||
"x-ms-apimTemplateParameter.urlTemplate": "https://@connectionParameters('domain_name')/instance/execute/@connectionParameters('instance_name')",
|
||||
"x-ms-apimTemplate-operationName": [
|
||||
"SendToXSOAR"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Загрузка…
Ссылка в новой задаче