HCL BigFix Inventory

Integration version: 2.0

Configure HCL BigFix Inventory integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name Type Default Value Is Mandatory Description
API Root String https://{{ip address}}:9081 Yes API root of the HCL BigFix Inventory instance.
API Token Password N/A Yes API Token of the HCL BigFix Inventory account.
Verify SSL Checkbox Checked Yes If enabled, verifies that the SSL certificate for the connection to the HCL BigFix Inventory server is valid.

Where to find API Token

To view the token, log in to BigFix Inventory, hover the cursor over User
icon, and click Profile. Then, click Show token.

Uses Cases

Enrich entities.

Actions

Ping

Description

Test connectivity to HCL BigFix Inventory with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run On

This action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success=False
JSON Result
N/A
Entity Enrichment

N/A

Insights

N/A

Case Wall
Result type Value/Description Type
Output message*

The action should not fail nor stop a playbook execution:

If successful: "Successfully connected to the HCL BigFix Inventory server with the provided connection parameters!"

The action should fail and stop a playbook execution:

If not successful: "Failed to connect to the HCL BigFix Inventory server! Error is {0}".format(exception.stacktrace)

General

Enrich Entities

Description

Enrich entities using information from HCL BigFix Inventory. Supported entities: Hostname, IP Address.

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Custom Fields CSV N/A No Specify a comma-separated list of fields that needs to be returned in addition to the ones that are returned by default.
Create Insight Checkbox Checked No If enabled, the action creates an insight containing all of the retrieved information about the entity.

Run on

This action runs on the following entities:

  • IP Address
  • Hostname

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success=False
JSON Result
{
  "id": 1,
  "bigfix_id": 1055452,
  "computer_group_id": 0,
  "name": "BIGFIX-SRV",
  "dns_name": "BIGFIX-SRV.bigfix.local",
  "ip_address": [
      "172.30.202.178"
  ],
  "os": "Win2016 10.0.14393.5066 (1607)",
  "os_type": "WINDOWS",
  "first_seen": "2022-05-11T07:22:30Z",
  "last_seen": "2022-05-23T06:58:08Z",
  "is_deleted": 0,
  "deletion_date": null,
  "is_managed_by_vm_manager": 0,
  "computer_health": {
      "agent_version": "10.0.6.84",
      "catalog_version": 2638693,
      "is_catalog_scan_successful": true,
      "is_filesys_scan_successful": true,
      "is_idtag_scan_successful": true,
      "is_low_on_disk_space": false,
      "is_missing_prereqs": false,
      "is_out_of_date": false,
      "is_out_of_sync": false,
      "is_package_scan_successful": true,
      "last_scan_attempt": "2022-05-18T07:59:39Z"
  },
  "computer_hardware": {
      "shared_pool_id": null,
      "system_model": "VMware7,1",
      "cluster_name": null,
      "cluster_cores_count": null,
      "partition_cores": "8.0",
      "status": "4",
      "server_id": 1,
      "server_name": "TLM_VM_4222eeb3-28a8-d59e-b8a2-d1a70361fed4",
      "server_serial_number": "TLM_VM_4222eeb3-28a8-d59e-b8a2-d1a70361fed4",
      "server_type": "-",
      "server_vendor": "-",
      "server_model": "-",
      "node_total_processors": 1,
      "server_cores": 8,
      "pvu_per_core": 120,
      "default_pvu_value": "0",
      "parent_hostname": null
  }
}
Entity Enrichment - Prefix HCLBigFixInv_
Enrichment Field Name Source (JSON Key) Logic - When to apply
name name When available in JSON
dns_name dns_name When available in JSON
ip_address CSV of ip_address When available in JSON
os os When available in JSON
first_seen first_seen When available in JSON
last_seen last_seen When available in JSON
is_deleted is_deleted When available in JSON
deletion_date deletion_date When available in JSON
last_scan_attempt computer_health/last_scan_attempt When available in JSON
is_out_of_date computer_health/is_out_of_date When available in JSON
is_out_of_sync computer_health/is_out_of_sync When available in JSON
is_missing_prereqs computer_health/is_missing_prereqs When available in JSON
is_low_on_disk_space computer_health/is_low_on_disk_space When available in JSON
Insights

N/A

Case Wall
Result type Value/Description Type
Output message*

The action should not fail nor stop a playbook execution:

If data is available for one entity (is_success=true): "Successfully enriched the following entities using information from HCL BigFix Inventory: {entity.identifier}."

If data is not available for one entity (is_success=true): "Action wasn't able to enrich the following entities using information from HCL BigFix Inventory: {entity.identifier}."

If data is not available for all entities (is_success=false): "None of the provided entities were enriched."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Enrich Entities". Reason: {0}''.format(error.Stacktrace)

General
Case Wall Table

Table Title: {entity.identifier}

Table Columns:

  • Key
  • Value
Entity