diff --git a/Packs/RsaNetWitnessPacketsAndLogs/.pack-ignore b/Packs/RsaNetWitnessPacketsAndLogs/.pack-ignore index 0541a3fee43b..fac542d34029 100644 --- a/Packs/RsaNetWitnessPacketsAndLogs/.pack-ignore +++ b/Packs/RsaNetWitnessPacketsAndLogs/.pack-ignore @@ -2,4 +2,8 @@ ignore=PA116 [file:RSANetWitnessPacketsAndLogs_image.png] -ignore=IM111 \ No newline at end of file +ignore=IM111 + +[known_words] +renderToContext +useSSL \ No newline at end of file diff --git a/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/README.md b/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/README.md index c68fa6dbc093..9dfabb25b8d4 100644 --- a/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/README.md +++ b/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/README.md @@ -122,11 +122,14 @@ concentratorPort integer -

Port to use with concentratorIP

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

@@ -342,11 +345,14 @@ concentratorPort uint32  -

Port to use with the concentratorIP parameter

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

@@ -448,11 +454,14 @@ concentratorPort uint32  -

Port to use with the concentratorIP parameter

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

@@ -657,11 +666,14 @@ concentratorPort uint32 -

Port to use with the concentratorIP parameter

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

@@ -672,6 +684,13 @@

Examples: pcap, logs, logs (csv), logs (xml), or logs (json)

+ +renderToContext +boolean  + +

If renderToContext is set to True and the render type is set to logs (json), the command will not create a file with the output. It will output to the context data.

+ +

 

@@ -721,11 +740,14 @@ concentratorPort uint32 -

Port to use with the concentratorIP parameter

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

@@ -772,11 +794,14 @@ concentratorPort uint32 -

Port to use with the concentratorIP parameter

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

@@ -922,11 +947,14 @@ concentratorPort uint32  -

Port to use with the concentratorIP parameter

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

@@ -1039,11 +1067,14 @@ concentratorPort uint32  -

Port to use with the concentratorIP parameter

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

@@ -1230,11 +1261,14 @@ concentratorPort uint32  -

Port to use with the concentratorIP parameter

- +

Port to use with concentratorIP. 50105 (SSL/NON-SSL) for concentrator, 50103 (SSL/NON-SSL) for broker.

+ + + +useSSL +boolean + +

Send request in HTTPS instead of HTTP. By default the parameter is set to True but if your appliance is not configured to use SSL you can change it here.

diff --git a/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/RSANetWitnessPacketsAndLogs.js b/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/RSANetWitnessPacketsAndLogs.js index 62559edc69a5..3dd720670968 100644 --- a/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/RSANetWitnessPacketsAndLogs.js +++ b/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/RSANetWitnessPacketsAndLogs.js @@ -5,14 +5,15 @@ var RESPONSE_TYPES = { 'xml': 'text/xml', 'octet-stream': 'application/octet-stream' }; -var SSL_PORT = '56105'; -var NON_SSL_PORT = '50105'; +var API_REST_PORT = '50105'; var LAST_HOURS = 'lastHours'; var LAST_MINUTES = 'lastMinutes'; var QUERY = 'query'; var USER_NAME = params.user_creds ? params.user_creds.identifier : params.username; + var PASSWORD = (params.user_creds || params).password; + function fixUrl(base) { var url = base.trim(); if (base.indexOf('http://') !== 0 && base.indexOf('https://') !== 0) { @@ -33,18 +34,14 @@ function getUrl(currentUrl){ // Check if port was provided, omit it if yes var match = args.concentratorIP.match(/(https{0,1}:\/\/?.*):/); urlToReturn = match ? match[1] : args.concentratorIP; - var port = args.concentratorPort; - if(port){ - if(port === SSL_PORT){ - urlToReturn = urlToReturn.indexOf('https://') === -1 ? 'https://' + urlToReturn : urlToReturn; - } - else{ - urlToReturn = urlToReturn.indexOf('http://') === -1 ? 'http://' + urlToReturn : urlToReturn; - } + var port = args.concentratorPort || API_REST_PORT; + var useSSL = args.useSSL; + + if(useSSL === "true"){ + urlToReturn = urlToReturn.indexOf('https://') === -1 ? 'https://' + urlToReturn : urlToReturn; } else{ urlToReturn = urlToReturn.indexOf('http://') === -1 ? 'http://' + urlToReturn : urlToReturn; - port = NON_SSL_PORT; } urlToReturn = urlToReturn + ":" + port; @@ -511,7 +508,21 @@ function parseDownloadResponse(resp) { if(args && args.fileExt){ extension = args.fileExt; } - return createFileEntry(resp.Bytes, extension); + if (args.renderToContext === "true" && args.render === "application/json"){ + var jsonstr = JSON.parse(resp.Body); + return { + Type: entryTypes.note, + Contents: jsonstr, + ContentsFormat: formats.json, + HumanReadable: jsonstr["logs"], + ReadableContentsFormat: formats.json, + EntryContext: { + 'NetWitness.Packets': jsonstr["logs"] + } + }; + } else{ + return createFileEntry(resp.Bytes, extension); + } } catch (e) { return e; } diff --git a/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/RSANetWitnessPacketsAndLogs.yml b/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/RSANetWitnessPacketsAndLogs.yml index 7cb8024d5fd4..5364b1f4c362 100644 --- a/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/RSANetWitnessPacketsAndLogs.yml +++ b/Packs/RsaNetWitnessPacketsAndLogs/Integrations/RSANetWitnessPacketsAndLogs/RSANetWitnessPacketsAndLogs.yml @@ -8,12 +8,11 @@ description: RSA NetWitness Logs and Packets decoders are responsible for the re configuration: - display: Server URL (e.g. http(s)://192.168.0.1) name: url - defaultvalue: "" type: 0 required: true -- display: Appliance Port - Logs(50102) / Packets(50104) / Concentrator (50105) / Broker (50103) +- display: Appliance Port - Logs(50102) / Packets(50104) / Concentrator (50105) / + Broker (50103) name: port - defaultvalue: "" type: 0 required: true - display: Username @@ -35,19 +34,18 @@ configuration: required: false - display: Validate server certificate name: secure - defaultvalue: 'true' + defaultvalue: "true" type: 8 required: false - display: Use system proxy settings name: proxy - defaultvalue: 'false' + defaultvalue: "false" type: 8 required: false - defaultvalue: '' display: Expiration time name: expiry type: 0 - required: false script: script: '' @@ -71,7 +69,21 @@ script: - name: concentratorIP description: Use the instance that is mapped to this concentrator IP - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" outputs: - contextPath: NetWitness.SearchHits.hit description: all search hits in netwitness @@ -91,7 +103,21 @@ script: - name: concentratorIP description: Use the instance that is mapped to this concentrator address - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" outputs: - contextPath: NetWitness.SearchHits description: all search hits in netwitness @@ -117,7 +143,21 @@ script: - name: concentratorIP description: Use the instance that is mapped to this concentrator address - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" outputs: - contextPath: NetWitness.Events.ipSrc description: Source IP @@ -132,11 +172,11 @@ script: - contextPath: NetWitness.Events.userDst description: Destination user - contextPath: NetWitness.Events.username - description: Field includes any username meta available – both source and destination – as defined by the user. This is an optional field that will only appear if configured by the end user. + description: Field includes any username meta available - both source and destination - as defined by the user. This is an optional field that will only appear if configured by the end user. - contextPath: NetWitness.Events.service description: Field describes the service that created the session (if available) - contextPath: NetWitness.Events.sessionid - description: NW Specific field that contains a NW specific ‘serial number’ of the Session. Allows a user to specify a session to retrieve from a Concentrator. + description: NW specific field that contains a NW specific 'serial number' of the session. Allows a user to specify a session to retrieve from a concentrator. - contextPath: NetWitness.Events.deviceType description: Field describes the type of system that generated a log message (ex. SQUID / Windows / rhlinux) - contextPath: NetWitness.Events.direction @@ -171,9 +211,40 @@ script: - name: concentratorIP description: Use the instance that is mapped to this concentrator address - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" - name: render - description: The render type - pcap, logs, logs (csv), logs (xml) or logs (json) + auto: PREDEFINED + predefined: + - text/plain + - text/csv + - text/xml + - application/json + - application/octet-stream + description: The render type - pcap, logs, logs (csv), logs (xml) or logs (json) + - name: renderToContext + defaultValue: "false" + auto: PREDEFINED + predefined: + - "true" + - "false" + description: If renderToContext is set to True and the render type is set to logs (json), the command will not create a file with the output. It will output to the context data. + outputs: + - contextPath: NetWitness.Packets + description: Raw logs. This output is only available if the renderToContext option is set to true. description: Stream packets back based on the input parameters provided - name: nw-sdk-session arguments: @@ -186,14 +257,42 @@ script: - name: concentratorIP description: Use the instance that is mapped to this concentrator IP - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" description: Retrieves the meta id range for the session range - name: nw-sdk-content arguments: - name: concentratorIP description: Use the instance that is mapped to this concentrator IP - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" - name: session required: true description: The session id that will be returned in the response. @@ -244,7 +343,21 @@ script: - name: concentratorIP description: Use the instance that is mapped to this concentrator IP - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" description: Retrieves summary information from the databases - name: nw-sdk-values arguments: @@ -275,7 +388,21 @@ script: - name: concentratorIP description: Use the instance that is mapped to this concentrator IP - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" outputs: - contextPath: NetWitness.Values.ipSrc description: Source IP @@ -290,11 +417,11 @@ script: - contextPath: NetWitness.Values.userDst description: Destination user - contextPath: NetWitness.Values.username - description: Field includes any username meta available – both source and destination – as defined by the user. This is an optional field that will only appear if configured by the end user. + description: Field includes any username meta available - both source and destination - as defined by the user. This is an optional field that will only appear if configured by the end user. - contextPath: NetWitness.Values.service description: Field describes the service that created the session (if available) - contextPath: NetWitness.Values.sessionid - description: NW Specific field that contains a NW specific ‘serial number’ of the Session. Allows a user to specify a session to retrieve from a Concentrator. + description: NW specific field that contains a NW specific 'serial number' of the session. Allows a user to specify a session to retrieve from a concentrator. - contextPath: NetWitness.Values.deviceType description: Field describes the type of system that generated a log message (ex. SQUID / Windows / rhlinux) - contextPath: NetWitness.Values.direction @@ -321,7 +448,21 @@ script: - name: concentratorIP description: Use the instance that is mapped to this concentrator IP - name: concentratorPort - description: Port to use with concentratorIP, 50105 for Non SSL and 56105 for SSL + auto: PREDEFINED + predefined: + - "50102" + - "50103" + - "50104" + - "50105" + description: Port to use with concentratorIP, usually 50105 but that can be changed by setting the /rest/config/port parameter. + defaultValue: "50105" + - name: useSSL + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Send request using SSL. To enable it in your RSA appliance, go to the setting in /sys/config/ssl. + defaultValue: "true" description: Dumps information out of the database in nwd formatted files fromversion: 5.0.0 tests: diff --git a/Packs/RsaNetWitnessPacketsAndLogs/ReleaseNotes/1_0_6.json b/Packs/RsaNetWitnessPacketsAndLogs/ReleaseNotes/1_0_6.json new file mode 100644 index 000000000000..415a7504e6f6 --- /dev/null +++ b/Packs/RsaNetWitnessPacketsAndLogs/ReleaseNotes/1_0_6.json @@ -0,0 +1,4 @@ +{ + "breakingChanges": true, + "breakingChangesNotes": "By default every RSA request will be send using SSL on the port 50105. To disable SSL use the option 'useSSL=false'. As before you can change the port using the parameter 'concentratorPort' and choose a suggested one or set a specific one not listed." +} \ No newline at end of file diff --git a/Packs/RsaNetWitnessPacketsAndLogs/ReleaseNotes/1_0_6.md b/Packs/RsaNetWitnessPacketsAndLogs/ReleaseNotes/1_0_6.md new file mode 100644 index 000000000000..51cc67f79024 --- /dev/null +++ b/Packs/RsaNetWitnessPacketsAndLogs/ReleaseNotes/1_0_6.md @@ -0,0 +1,6 @@ +#### Integrations + +##### RSA NetWitness Packets and Logs +- Fixed an issue where the only possible option for SSL port was 56105. +- Added support for the *useSSL* parameter in all commands, allowing the selection of SSL with every port. +- Added the ability to output the result of the command ***netwitness-packets*** in the context data with the argument *renderToContext*. diff --git a/Packs/RsaNetWitnessPacketsAndLogs/pack_metadata.json b/Packs/RsaNetWitnessPacketsAndLogs/pack_metadata.json index 4a307068b0fd..5059ad13ed7b 100644 --- a/Packs/RsaNetWitnessPacketsAndLogs/pack_metadata.json +++ b/Packs/RsaNetWitnessPacketsAndLogs/pack_metadata.json @@ -2,7 +2,7 @@ "name": "RSA NetWitness Packets and Logs", "description": "RSA NetWitness Logs and Packets decoders are responsible for the real-time collection of network data. The decode captures data in real time and can normalize and reconstruct data for full session analysis. In addition, the decoder can collect flow and endpoint data.", "support": "xsoar", - "currentVersion": "1.0.5", + "currentVersion": "1.0.6", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -17,4 +17,4 @@ "xsoar", "marketplacev2" ] -} \ No newline at end of file +}