Skip to content

Commit 0e25e01

Browse files
content-botxsoar-bot
content-bot
authored and
xsoar-bot
committed
[Marketplace Contribution] Picus NG Content Pack (demisto#24551)
1 parent 5690933 commit 0e25e01

35 files changed

+3697
-0
lines changed

‎Packs/PicusNGAutomation/.pack-ignore

Whitespace-only changes.

‎Packs/PicusNGAutomation/.secrets-ignore

Whitespace-only changes.

‎Packs/PicusNGAutomation/Author_image.png

9.34 KB
Loading

‎Packs/PicusNGAutomation/Integrations/PicusNG/PicusNG.py

Lines changed: 596 additions & 0 deletions
Large diffs are not rendered by default.

‎Packs/PicusNGAutomation/Integrations/PicusNG/PicusNG.yml

Lines changed: 346 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,346 @@
1+
category: Network Security
2+
commonfields:
3+
id: PicusNG
4+
version: -1
5+
configuration:
6+
- display: Picus Manager URL
7+
name: picus_server
8+
required: true
9+
type: 0
10+
- display: Trust any certificate (not secure)
11+
name: insecure
12+
required: false
13+
type: 8
14+
- display: Use system proxy settings
15+
name: proxy
16+
required: false
17+
type: 8
18+
- display: Picus Refresh Token
19+
hidden: false
20+
name: picus_apikey
21+
required: true
22+
type: 4
23+
description: Picus - The Complete Security Control Validation NG Platform
24+
display: Picus Security
25+
name: PicusNG
26+
script:
27+
commands:
28+
- deprecated: false
29+
description: This command returns the simulation agent list with agent name, id, status, agent type and platform information as in Picus platform > Agents.
30+
execution: false
31+
name: picus-get-agent-list
32+
- arguments:
33+
- default: false
34+
description: Agent id
35+
isArray: false
36+
name: id
37+
required: true
38+
secret: false
39+
deprecated: false
40+
description: This command returns agent name, status, agent type, platform and also mitigation devices and attack modules using the agent ID.
41+
execution: false
42+
name: picus-get-agent-detail
43+
- arguments:
44+
- default: false
45+
description: ID of the agent
46+
isArray: false
47+
name: agent_id
48+
required: true
49+
secret: false
50+
- default: false
51+
defaultValue: this simulation created with cortex app
52+
description: Description of the simulation
53+
isArray: false
54+
name: description
55+
required: false
56+
secret: false
57+
- default: false
58+
description: Name of the simulation
59+
isArray: false
60+
name: name
61+
required: true
62+
secret: false
63+
- auto: PREDEFINED
64+
default: false
65+
description: Schedule now state
66+
isArray: false
67+
name: schedule_now
68+
predefined:
69+
- 'True'
70+
- 'False'
71+
required: true
72+
secret: false
73+
- default: false
74+
description: Id of the template
75+
isArray: false
76+
name: template_id
77+
required: true
78+
secret: false
79+
deprecated: false
80+
description: |-
81+
This command creates and runs a simulation as requested; scheduled or instant.
82+
You can create a simulation by giving your simulation a name and adding the template ID, agent ID.
83+
execution: false
84+
name: picus-create-simulation
85+
- arguments:
86+
- default: false
87+
description: Pagination value
88+
isArray: false
89+
name: offset
90+
required: false
91+
secret: false
92+
- default: false
93+
description: Pagination value
94+
isArray: false
95+
name: limit
96+
required: false
97+
secret: false
98+
deprecated: false
99+
description: This command returns template list that contains template name, id, description, content type, category as in Picus Platform> Threat Templates.
100+
execution: false
101+
name: picus-get-template-list
102+
- deprecated: false
103+
description: This command returns the agent name, id, status, agent installation information and the token expiration information.
104+
execution: false
105+
name: picus-get-integration-agent-list
106+
- arguments:
107+
- default: false
108+
description: Pagination value
109+
isArray: false
110+
name: offset
111+
required: false
112+
secret: false
113+
- default: false
114+
description: Pagination value
115+
isArray: false
116+
name: limit
117+
required: false
118+
secret: false
119+
deprecated: false
120+
description: This command returns the list of you latest simulation result overview as in Picus Platform > Simulations tab. Latest simulation run results are included.
121+
execution: false
122+
name: picus-get-simulation-list
123+
outputs:
124+
- contextPath: Picus.simulationlist.simulation_id
125+
description: ID of the simulation
126+
type: Number
127+
- arguments:
128+
- default: false
129+
description: Simulation ID
130+
isArray: false
131+
name: id
132+
required: true
133+
secret: false
134+
deprecated: false
135+
description: This command runs the existing simulation using the Simulation ID.
136+
execution: false
137+
name: picus-simulate-now
138+
- arguments:
139+
- default: false
140+
description: Simulation ID
141+
isArray: false
142+
name: id
143+
required: true
144+
secret: false
145+
deprecated: false
146+
description: This command returns the information about a specific simulation.
147+
execution: false
148+
name: picus-get-simulation-detail
149+
- arguments:
150+
- default: false
151+
description: Simulation ID
152+
isArray: false
153+
name: id
154+
required: true
155+
secret: false
156+
deprecated: false
157+
description: This command returns detailed information about simulation results including Prevention and Detection result details for the latest simulation run.
158+
execution: false
159+
name: picus-get-latest-simulation-result
160+
outputs:
161+
- contextPath: Picus.latestSimulationResult.simulation_run_id
162+
description: Simulation Run ID
163+
type: String
164+
- contextPath: Picus.latestSimulationResult.simulation_id
165+
description: Simulation ID
166+
type: String
167+
- contextPath: Picus.latestSimulationResult.status
168+
description: Simulation Status
169+
type: String
170+
- arguments:
171+
- default: false
172+
description: Simulation ID
173+
isArray: false
174+
name: id
175+
required: true
176+
secret: false
177+
- default: false
178+
description: Simulation Run ID
179+
isArray: false
180+
name: run_id
181+
required: true
182+
secret: false
183+
deprecated: false
184+
description: This command returns detailed information about simulation results including Prevention and Detection result details for a specific simulation run with run id.
185+
execution: false
186+
name: picus-get-simulation-result
187+
- arguments:
188+
- default: false
189+
description: Simulation ID
190+
isArray: false
191+
name: id
192+
required: true
193+
secret: false
194+
- default: false
195+
description: Simulation Run ID
196+
isArray: false
197+
name: run_id
198+
required: true
199+
secret: false
200+
- default: false
201+
description: Pagination value
202+
isArray: false
203+
name: limit
204+
required: false
205+
secret: false
206+
- default: false
207+
description: Pagination value
208+
isArray: false
209+
name: offset
210+
required: false
211+
secret: false
212+
deprecated: false
213+
description: This command returns simulation result based on threats. Threat result includes threat id and name, prevention result and action count.
214+
execution: false
215+
name: picus-get-simulation-threats
216+
outputs:
217+
- contextPath: Picus.SimulationThreats
218+
description: Threat list of simulation
219+
type: String
220+
- arguments:
221+
- default: false
222+
description: Simulation ID
223+
isArray: false
224+
name: id
225+
required: true
226+
secret: false
227+
- default: false
228+
description: Simulation Run ID
229+
isArray: false
230+
name: run_id
231+
required: true
232+
secret: false
233+
- default: false
234+
description: Threat ID list ("111,222,333,...") or single threat ID can be given.
235+
isArray: false
236+
name: threat_ids
237+
required: true
238+
secret: false
239+
- default: false
240+
description: Pagination value
241+
isArray: false
242+
name: limit
243+
required: false
244+
secret: false
245+
- default: false
246+
description: Pagination value
247+
isArray: false
248+
name: offset
249+
required: false
250+
secret: false
251+
deprecated: false
252+
description: This command returns simulation result based on action list using threat ID, simulation ID and simulation run ID.
253+
execution: false
254+
name: picus-get-simulation-actions
255+
outputs:
256+
- contextPath: Picus.SimulationActions
257+
description: Action Results(ID and result combination)
258+
type: String
259+
- arguments:
260+
- default: false
261+
description: Simulation ID list ("111,222,333,...") or single simulation ID can be given.
262+
isArray: false
263+
name: ids
264+
required: false
265+
secret: false
266+
deprecated: false
267+
description: This command returns mitigation device information as obtained under Picus platform > Mitigation > Vendor Based Mitigations. Vendor based mitigation devices can be fetched using this command.
268+
execution: false
269+
name: picus-get-mitigation-devices
270+
- arguments:
271+
- default: false
272+
description: Mitigation Device ID
273+
isArray: false
274+
name: device_id
275+
required: true
276+
secret: false
277+
- default: false
278+
description: Action ID list ("111,222,333,...") or single action ID can be given.
279+
isArray: false
280+
name: action_ids
281+
required: true
282+
secret: false
283+
deprecated: false
284+
description: This command returns action based signature suggestions.
285+
execution: false
286+
name: picus-get-signature-list
287+
- arguments:
288+
- default: false
289+
description: Simulation Agent ID
290+
isArray: false
291+
name: agent_id
292+
required: true
293+
secret: false
294+
- default: false
295+
description: 'Device ID '
296+
isArray: false
297+
name: device_id
298+
required: false
299+
secret: false
300+
- default: false
301+
description: Simulation ID
302+
isArray: false
303+
name: simulation_id
304+
required: true
305+
secret: false
306+
deprecated: false
307+
description: Set parameter on playbook. (This command is only used on playbook)
308+
execution: false
309+
name: picus-set-paramPB
310+
outputs:
311+
- contextPath: Picus.param.agent_id
312+
description: Agent ID
313+
type: String
314+
- contextPath: Picus.param.device_id
315+
description: Device ID
316+
type: String
317+
- contextPath: Picus.param.simulation_id
318+
description: Simulation ID
319+
type: String
320+
- arguments:
321+
- default: false
322+
description: Threat id and result combine. Used for playbook.
323+
isArray: false
324+
name: threatinfo
325+
required: true
326+
secret: false
327+
deprecated: false
328+
description: Filter insecure attacks on playbook. (This command is only used on playbook)
329+
execution: false
330+
name: picus-filter-insecure-attacks
331+
outputs:
332+
- contextPath: Picus.filterinsecure
333+
description: Insecure Attack List
334+
type: String
335+
dockerimage: demisto/python3:3.10.10.47713
336+
feed: false
337+
isfetch: false
338+
longRunning: false
339+
longRunningPort: false
340+
runonce: false
341+
script: '-'
342+
subtype: python3
343+
type: python
344+
tests:
345+
- No tests (auto formatted)
346+
fromversion: 6.5.0

‎Packs/PicusNGAutomation/Integrations/PicusNG/PicusNG_description.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
## Picus NG Validation Automation
2+
3+
Run commands on Picus NG and automate security validation with playbooks.
4+
5+
## Authentication
6+
7+
To use this integration, you need a Picus refresh token.
8+
9+
- Login to Picus NG
10+
- Go to **Settings** > **Advanced** > **Rest API Token**
11+
- Click generate token button and copy refresh token.

‎Packs/PicusNGAutomation/Integrations/PicusNG/PicusNG_image.png

4.65 KB
Loading

0 commit comments

Comments
 (0)