epo

Integrations/integration-epo.json

@@ -0,0 +1,65 @@
+{
+  "id": "epo",
+  "version": -1,
+  "system": true,
+  "modified": "2016-08-28T14:26:09.941606022+03:00",
+  "name": "epo",
+  "display": "epo",
+  "brand": "",
+  "category": "SIEM & Analytics",
+  "icon": "",
+  "image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGwAAAAtCAYAAABLYo4EAAAH6klEQVR4nO1bXWwbRRD+9u7s2M5P67Rx6iNEqktDW35KZX5fEEiOEAjKAzTwAg+gtgIhgeChET9CCJBSIYTET0X7AhICiVQoIChCNFAoSBWiBgS0ECCB/jnUae3ECU18tm95uNveentO7Ivd2G4+yTp7b253Zmd3bnZmTKZTKRdpbGwlwEnoelcumxmTFFdSURToAHRdB6FYKREkshltAoR49FMpN9xyCr4GEC3rJYTkaIOiEUIVIrsJTWcynkYfFlF+yI+0r31w4q2BV73XXv7eyd6Xv9EnJq9q2nDZBzlNgyTLoOkZZezF1/doR/+9rWF15974U699PP72nhcoTd+W/f3I7fFn33wx8/fRuyWvu2Psidd3TH68f3PDms5fG4KBowstXD1Cyvzz79LJT/avT0d/eW7ys29XZv884UkfOR6IP7fj+fTh4Rvo1Mz6xLufXZca+LID6eylMwd/u9F/b/ehlpuv//TMFz90+dZ3yW0P3LU1NxLPZuPJNe2P3/eK62L1l4UWrF4hudTWhGvNSqQ+P/CYvCJASItvVXLnwCcz3w89nXh74KXc0dG25vDlRHK7l2YmJv6TW5ecPHPg5wldy7wnty3br/11IqAlxtuU9rYhmprBzKGhO6Umz38LLVi9QnF1rFjmWr4E2oEheLo6QLX0FdnhUbQ/s/UlubN1R/q7Q9foUzPQKe3MxU9vJrJM4XYTObBUk5t9aS2TaSCNno3ylHYYudwUFPkP6JQstGD1CgU6eUJpaYK8ygPJ3wSaTkPyuDD942930F/phtzJ5MpcbAKk0Qvtpz8fIm4JrfffesTbFtiQGJ+8yXvFangCgUcnh45BWtYy6rvmyn10PLUEPt/YQgtXj5Cf3PJwXJLJWu/NG2KSv/mU3NQ04A2veyPxzp573B2BZnn50saWjTe+33LL9X/kxk63SS3e8YZ1lxxzty//IhMfa0x99PV1Zw4ePua+rDOm/TyM1If7NivBJce967q+X2jh6hEkk06DZrNu4vVoNJuVCYVMFEWjY+MXobU5DiAEQk4RSZrWNa0FEskQSKchEejTZ9wSkVfn0pkjkMmU7G3w6lPTdxGf5yuX13t8oYWrRxCdUgAAZQ3cVReIGQ3N5gCJAASQiQQA0CmFRAgAtAFIEiBbScYvVBBK6dxUi6gaSAvNwCJKAwmuCM5FEwGwV2gbAbAbQC/X5gfQZ9KHAERNmu0cDdvO3QAGbcYqdH8bgE0Awmb7INfvQa692xx72LzXY/JQlYiNxkp+RnE4VgjGJCZhTVw/DGUlYUxeBMZEAvlKKxXbYCwEcP1GYCyQXhgKCXNjhbln7RZFTaNUk0jMD1PAJu5exLz2wFjpvUK7U7Dne4V+t5hXphQ/DGWFzN9RGIunriDBELAfQAKGedlWxHNskthqjtjci9rccwL2fFS4+rnfIxw/jL5qTeF8IAHYCWOnjMBQXh+s1VsrYMrhTWO0AG1NQ4K1IrthmbqwPflZiKv+fGIQlmlm4HezH9Z7tO7AOx28vQ+JhCbEQ1u1mJ3dMPhnfNelsgDn57AojJf/fLy/cmOwwPe6Ar/Digl5VHPaZBCW13pBKIwXsppf2Mx9B/J5Hinwva7AK4xFCUKo7vNLGFbkpZp3fEUgvsM2wZiMPhvaRVQBCjkdpe4w3jQxl9/ObDmBeEhn12q2AhWDBGtC+CiHk0lmz/Qjf5fa9bUXhpPDPrNFQ9jzfUK/uxzwWPNQAGyFFWVnUXgnk9HD9ROBfbTeCfi4ZQTnRusvKBSTXllEheAkvbKYwKwxLCqsxrCosBoDU5gfRpplGIbXZpcXiyDfs6MwPEIxss/3lYDh2W0SaETvkO97tvFEGr/JZyG+t83SBzt8FyvXFoFGDJCLni//EXk6CICqQXVYDao71aDKcntQg2pEDapU+PSrQTUMWJEOp+l9Vmeximvj+xqB5TVWor6CHyuK/HzYfLxIO7n8Ak0IpYfAxHKHMIyFEIIRaZqTH7bDSk3vE5OWMc6vNr6vq2Gdo8RdVgqI8GHj8rm8q2EpibVvx7m5s27zt90EFSMXO7CLO9CuX7GkQix36BHa8xAbjeXxowbVkATn6X1+tzDB7Priay7KCX4yGb/liH7YycV/j9rcKxZ5id/YaOxsUEENqoWUlsdPLTsdvDliu5eZ9EpkG8TkqBOFzRvzURjP8GyhLGaWZrPRTjDCjbsThonahXyT7gR2cvGrv1zFRUVBDapn+YmNxgadKmwvDE8HMEJbTsE8K7FQVYSddwdYivGb7fOdxEJy8eYwatNeEahB9Rx+nCqMFbsAcxfsVBJRWBPrh707XgoKycXakiiu9qVcOIcfpwojsCZqC5xP0mwemzgeKUC7C4YnlYS105w6OIXkYjtXdKQqulhNL/EsP2pQDc/nHcZH9GebIOZ+l1s4P6wz3m5YimQ1/k5hJxfbSX3IP/BX3PGIjcby+DkfXmKlstisVIC901glF1B+h6CQYs67p1jLbr0d5nNGKgRe+auQbzbPi6fIg8848ww4Te/b9SVGCMoF/hwm8l3Oqile+SPCVbw/F/LeffxhmT9Ezwa2w0pJ7xfLVD8Ml7Qcf06wC/7y5zA2ViXKB/g/XcDmuxOFsXKHfqF9TjCF9cAQMgkrvV9KZS/vdPB9hUxmKvXHOn6sMMpfkcwcGyDfQvDfS3GmtsPgLworaM283KL4+R84iagJl2UUdgAAAABJRU5ErkJggg==",
+  "description": "epo",
+  "detailedDescription": "Integration with Intel Security's ePolicy Orchestrator using the official API. ",
+  "configuration": [
+    {
+      "display": "https://<address>:port",
+      "name": "address",
+      "defaultValue": "",
+      "type": 0,
+      "required": true
+    },
+    {
+      "display": "Authentication",
+      "name": "authentication",
+      "defaultValue": "",
+      "type": 9,
+      "required": true
+    },
+    {
+      "display": "Trust certifcate",
+      "name": "insecure",
+      "defaultValue": "false",
+      "type": 8,
+      "required": false
+    }
+  ],
+  "integrationScript": {
+    "script": "// The command input arg holds the command sent from the user.\n// You can use args[argName] or args.argName to get a specific arg. args are strings.\n// You can use params[paramName] or params.paramName to get a specific params.\n// Params are of the type given in the integration page creation.\nvar callEpo = function(qParams, qArgs) {\n    p = qArgs['params'] ? qArgs['params']+'&' : '';\n    url = qParams['address'] + '/remote/' + qArgs['command'] + '?' + p + ':output=json';\n    res = http(\n    url, \n    {\n        Method: 'GET',\n        Username: qParams['authentication']['identifier'],\n        Password: qParams['authentication']['password']\n    },\n    qParams['insecure']\n    );\n    return res;\n};\n\nvar isResponseOK = function(response) {\n    // EPO response if of format:\n    // OK:\n    // data\n    // Or in format\n    // Error:\n    // error string\n    if (res.StatusCode === 200) {\n        okStr = 'OK:';\n        if (res.Body.indexOf(okStr) === 0) {    \n            return true;\n        }\n    }\n    return false;\n};\n\nvar test = function(params) {\n    tmp = {};\n    tmp['command']  = 'core.help';\n    res = callEpo(params, tmp);\n    if (isResponseOK(res)) {\n        return 'ok';\n    }\n    if (res.Status) {\n        return res.Status;\n    }\n    return res;\n}\n\nswitch (command) {\n    // This is the call made when pressing the integration test button.\n    case 'test-module':\n        return test(params);\n    default:\n        res = callEpo(params, args);\n        if (isResponseOK(res)) {\n            trimmedRes = res.Body.substring(okStr.length);\n            parsedRes = JSON.parse(trimmedRes);\n            //We need the response to be a single object\n            readyRes = {response: parsedRes};\n            return readyRes;\n        } else if (res.StatusCode == 200){\n            throw res.Body;\n        } else {\n            throw JSON.stringify(res);\n        }\n}",
+    "type": "javascript",
+    "commands": [
+      {
+        "name": "epo-command",
+        "arguments": [
+          {
+            "name": "command",
+            "required": true,
+            "default": true,
+            "secret": false,
+            "description": "The command to run. (Run \"core.help\" to get a list of available commands in your environment)"
+          },
+          {
+            "name": "params",
+            "required": false,
+            "default": false,
+            "secret": false,
+            "description": "Command parameters (e.g. param1=value&param2=value)"
+          }
+        ],
+        "description": "Run a remote command on EPO",
+        "execution": true
+      }
+    ],
+    "isFetch": false
+  }
+}