Integrate Attivo with Google SecOps

If successful: Successfully connected to the Attivo server with the provided connection parameters!

If not successful: Failed to connect to the Attivo server! Error: {0}".format(exception.stacktrace)

The action should not fail nor stop a playbook execution:

>If data is available for one entity (is_success=true): "Successfully enriched the following entities using information from Attivo: {entity.identifier}".

If data is not available for one entity (is_success=true): "Action wasn't able to enrich the following entities using information from Attivo: {entity.identifier}".

If data is not available for all entities (is_success=false): "None of the provided entities were enriched."

The action should fail and stop a playbook execution:

>If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Enrich Entities". Reason: {0}''.format(error.Stacktrace)

Table Title: {entity.identifier}

Table Columns:

• Key
• Value

Case Wall Table

(If vulnerabilities are available)

Table Name: {entity identifier} Vulnerabilities

Table Column:Name

Case Wall Table

(If threatpaths are available)

Table Name: {entity identifier} ThreatPaths

Table Columns:

• Dest IP
• Src Ip
• Src Host
• Dest Host
• Name
• Credential
• Description
• Critical
• Severity
• Service
• Category

Table Name: {entity identifier} Credentials

Table Columns:

• Deceptive
• Service
• Domain
• Server IP
• Shortcut

Select One

Possible Values:

• Rule Name
• Service
• Severity
• Description
• Category

Not Specified

Possible Values:

• Not Specified
• Equal
• Contains

Specify the filter logic that should be applied.

Filtering logic works based on the value provided in the "Filter Key" parameter.

Specify the value that should be used in the filter.

If "Equal" is selected, the action tries to find the exact match among results.

If "Contains" is selected, the action tries to find results that contain the provided substring.

If nothing is provided in this parameter, the filter is not applied.

Filtering logic works based on the value provided in the "Filter Key" parameter.

Specify the number of records to return.

If nothing is provided, action will return 50 records.

The action should not fail nor stop a playbook execution:

If data is available (is_success=true): "Successfully found critical ThreatPaths for the provided criteria in Attivo".

If data is not available (is_success=false): "No ThreatPaths were found for the provided criteria in Attivo"

If the "Filter Value" parameter is empty (is_success=true): The filter was not applied, because parameter "Filter Value" has an empty value.

The action should fail and stop a playbook execution:

If the "Filter Key" parameter is set to "Select One" and the "Filter Logic" parameter is set to "Equal" or "Contains": "Error executing action "{action name}". Reason: you need to select a field from the "Filter Key" parameter."

If an invalid value is provided for the "Max Records to Return" parameter: "Error executing action "{action name}". Reason: "Invalid value was provided for "Max Records to Return": . Positive number should be provided"."

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)

Table Name: {entity identifier} ThreatPaths

Table Columns:

• Dest IP
• Src Ip
• Src Host
• Dest Host
• Name
• Credential
• Description
• Critical
• Severity
• Service
• Category

Specify the number of hosts to return.

If nothing is provided, action will return 50 hosts.

The action should not fail nor stop a playbook execution:

If data is available for one vulnerability (is_success=true): "Successfully retrieved hosts for the following vulnerabilities: {vulnerabilities}".

If no hosts are related for one vulnerability (is_success=true): "No hosts were found for the following vulnerabilities: {vulnerabilities}"

If no hosts are related for all vulnerabilities (is_success=false): "No hosts were found for the provided vulnerabilities."

If the response is "{}" for one vulnerability (is_success=true): "Action wasn't able to retrieve information about hosts for the following vulnerabilities: {vulnerabilities}"

If the response is "{}" for one vulnerabilities (is_success=false): "Action wasn't able to retrieve information about hosts for the provided vulnerabilities."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)

Table Name: {Vulnerability Name i}

Table Columns: Name

Specify the number of threat paths to return.

If nothing is provided, the action returns 50 ThreatPaths.

The action should not fail nor stop a playbook execution:

If data is available (is_success=true): "Successfully retrieved ThreatPaths for the following services in Attivo: {services}.

If no data is available for one service: "No ThreatPaths were found for the following services in Attivo: {services}.

If no data available for all services: "No ThreatPaths were found for the provided services in Attivo.

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)

Table Name: {entity identifier} ThreatPaths

Table Columns:

• Dest IP
• Src Ip
• Src Host
• Dest Host
• Name
• Credential
• Description
• Severity
• Service
<
• Category

Select One

Possible Values:

• Acknowledge
• Unacknowledge

The action should not fail nor stop a playbook execution:

If the 200 status code is reported (is_success=true): "Successfully updated the event with ID "{event_id}" in Attivo.".

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Update Event". Reason: {0}''.format(error.Stacktrace)

If "Select One" is selected and the "Comment" is not provided: "Error executing action "Update Event". Reason: at least one of the parameters "Status" or "Comment" should have a value.''

The name of the field where the product name is stored.

The default value is Product Name.

The product name primarily impacts mapping. To streamline and improve the mapping process for the connector, the default value resolves to a fallback value that is referenced from the code. Any invalid input for this parameter resolves to a fallback value by default.

The name of the field that determines the event name (subtype).

The name of the field where the environment name is stored.

If the environment field is missing, the connector uses the default value.

A regular expression pattern to run on the value found in the Environment Field Name field. This parameter lets you manipulate the environment field using the regular expression logic.

Use the default value .* to retrieve the required raw Environment Field Name value.

If the regular expression pattern is null or empty, or the environment value is null, the final environment result is the default environment.

The timeout limit, in seconds, for the Python process that runs the current script.

Severity level to use for fetching events. If none is specified, the action will ingest all events. Possible values:

System Activity, Very Low, Low, Medium, High, Very High.

The number of hours before the first connector iteration to retrieve the events.

This parameter can apply to the initial connector iteration after you enable the connector for the first time, or the fallback value for an expired connector timestamp.

If selected, the connector uses the dynamic list as a blocklist.