Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Traceable AI API Security Platform Integration #27626

Merged
merged 40 commits into from
Jul 2, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
40 commits
Select commit Hold shift + click to select a range
5c048ae
Initial Commit for Traceable Pack
mtraceable May 2, 2023
09358fe
Merge branch 'demisto:master' into master
mtraceable May 3, 2023
7a8aa4a
Update .devcontainer.json name
mtraceable May 3, 2023
070e879
Merge branch 'demisto:master' into master
mtraceable May 5, 2023
f651565
Merge remote-tracking branch 'upstream/master'
mtraceable Jun 19, 2023
c5242c8
Remove unnecessary fields from the integration.
mtraceable Jun 20, 2023
a09b932
Some final changes
mtraceable Jun 21, 2023
af259b3
Merge branch 'demisto:master' into master
mtraceable Jun 21, 2023
74b90e8
- Changed support type for Integration
mtraceable Jun 22, 2023
0c34a6a
Doc Changes
mtraceable Jun 22, 2023
558b2ad
Flake8 changes and formatting changes.
mtraceable Jun 22, 2023
5684ace
Use mocks for tests.
mtraceable Jun 22, 2023
a2c29c1
Merge branch 'contrib/mtraceable_dev' into dev
mtraceable Jun 22, 2023
b96c8be
Changing test data to more dummy like data as
mtraceable Jun 22, 2023
efa5025
Updating according to validation changes
mtraceable Jun 22, 2023
c3ace61
Changes based on validations
mtraceable Jun 22, 2023
1efa665
Added Pack README.md contents.
mtraceable Jun 22, 2023
5b2b2bb
Adding README.md in the proper format
mtraceable Jun 22, 2023
a92f60f
Linter changes
mtraceable Jun 22, 2023
b502d81
Removing dead code
mtraceable Jun 22, 2023
4fb4fd0
Added unused code and added tests and other cleanups.
mtraceable Jun 22, 2023
26b3ccc
Unused import cleanup
mtraceable Jun 22, 2023
081d81d
Merge branch 'contrib/mtraceable_dev' into dev
mtraceable Jun 22, 2023
386b792
More tests and code restructuring
mtraceable Jun 23, 2023
039285e
Including Review comments
mtraceable Jun 26, 2023
6fd63ba
Flake8, Lint and Validate corrections.
mtraceable Jun 27, 2023
e823ae8
Review comments
mtraceable Jun 27, 2023
d8c2ec0
Merge branch 'demisto:master' into dev
mtraceable Jun 27, 2023
94dcf6f
More review changes and added unit tests
mtraceable Jun 27, 2023
2b71b2f
Changes based on more review comments.
mtraceable Jun 27, 2023
b2bf576
Merge branch 'contrib/mtraceable_dev' into dev
ilaner Jun 27, 2023
9f45380
Review comments and recommendations from running:
mtraceable Jun 27, 2023
6a006d6
Mypy errors fix
mtraceable Jun 27, 2023
cfd3b47
Merge branch 'demisto:master' into dev
mtraceable Jun 27, 2023
3969ee1
README changes
mtraceable Jun 27, 2023
e669ab8
Merge branch 'demisto:master' into dev
mtraceable Jun 28, 2023
e0121b9
Corrections from the output of:
mtraceable Jun 28, 2023
4e54c09
Merge branch 'demisto:master' into dev
mtraceable Jun 28, 2023
00222bb
Merge branch 'demisto:master' into dev
mtraceable Jun 29, 2023
2ca4c2e
- Changing the author image
mtraceable Jun 29, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Empty file added Packs/Traceable/.pack-ignore
Empty file.
3 changes: 3 additions & 0 deletions Packs/Traceable/.secrets-ignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
e::De
xxx@outlook.zz
https://mock.url
Binary file added Packs/Traceable/Author_image.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
39 changes: 39 additions & 0 deletions Packs/Traceable/Integrations/Traceable/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# Traceable AI API Security Platform Integration
## Overview
Traceable Platform monitors Application APIs and detects Threat Activities. These Threat Events consist of the details about the Threat Activity, the Actor performing the threat activity and the Request/Response Payloads.

With this integration, an Incident can be raised in Cortex Xsoar when an Event is detected by Traceable Platform. This enables the Security Teams to orchestrate actions through Cortex Xsoar with meaningful information about the detected Threat Activities.

## Setup
To use the integration the following mandatory parameters need to be set:
|Parameter Name|Default Value|Description|
|------|------|------|
|Traceable Platform URL|https://api.traceable.ai|URL of Traceable Platform API Endpoint.|
|API Token|-|API Token. Used for Authenticating against the Traceable Platform|
|Trust any certificate (not secure)|false|Trust any SSL certificate while connecting to Platform API Endpoint|
|Use system proxy settings|false|Use the system proxy setup using the environment variables `http_proxy`/`https_proxy`|

The API Token can be generated as described in the [Traceable Documentation](https://docs.traceable.ai/docs/public-apis#step-1-%E2%80%93-copy-the-platform-api-token)

## Customize Event/Activity Collection
The following parameters can be used to customize what Events should be exported from the Traceable Platform and brought over into Xsoar as Security Incidents.

|Parameter name|Type|Required (Yes/No)|Default Value|Description|
|------|------|------|------|------|
|First fetch timestamp|Short Text|No|1 days|Duration in the past to query the Events when querying for the first time.|
|max_fetch|Short Text|No|100|Number of records to return from Platform per query|
|span_fetch_threadpool|Short Text|No|10|Number of threads to use for querying `spans` in parallel|
|Comma Separated Environment List To Process|Long Text|No|-|Comma separated list of environments to query.|
|Security Score Category|Multi Select|No|CRITICAL, HIGH, MEDIUM|Security Score Category to query|
|Threat Category|Multi Select|No|Malicious Activities, API Abuse, Malicious Sources|Threat Categories to query|
|IP Reputation Level|Multi Select|No|CRITICAL, HIGH, MEDIUM|IP Reputations to query|
|IP Abuse Velocity|Multi Select|No|CRITICAL, HIGH, MEDIUM|IP Abuse Velocity to query|

## Incident Types
The integration generates _Exploit_ type of Inidents.

## Official Traceable Documentation
https://docs.traceable.ai/

## Issues?
Reach out to support@traceable.ai
Loading