Skip to content

Commit f5686cb

Browse files
ishans-crestishans-crest
authored
Merge pull request #5 from splunk-soar-connectors/next
Merging next to main for release 1.2.0
2 parents 6bbee80 + 1239775 commit f5686cb

File tree

9 files changed

+1553
-84
lines changed

9 files changed

+1553
-84
lines changed

‎.github/workflows/generate-doc.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Generate Readme Doc
2+
on:
3+
workflow_dispatch:
4+
push:
5+
paths:
6+
- '*.json'
7+
- 'readme.html'
8+
tags-ignore:
9+
- '**'
10+
branches-ignore:
11+
- next
12+
- main
13+
jobs:
14+
generate-doc:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: 'phantomcyber/dev-cicd-tools/github-actions/generate-doc@main'
18+
with:
19+
GITHUB_TOKEN: ${{ secrets.SOAR_APPS_TOKEN }}

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/phantomcyber/dev-cicd-tools
3-
rev: v1.15
3+
rev: v1.16
44
hooks:
55
- id: org-hook
66
- id: package-app-dependencies

‎README.md‎

Lines changed: 213 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,36 @@
11
[comment]: # "Auto-generated SOAR connector documentation"
22
# Sandfly Security
33

4-
Publisher: Sandfly Security, Ltd\.
5-
Connector Version: 1\.0\.1
4+
Publisher: Sandfly Security, Ltd.
5+
Connector Version: 1.2.0
66
Product Vendor: Sandfly Security
77
Product Name: Sandfly Security Agentless Linux Security
8-
Product Version Supported (regex): "\.\*"
9-
Minimum Product Version: 5\.4\.0
10-
11-
Sandfly Security app to trigger system scans and other actions on the Sandfly Server
8+
Product Version Supported (regex): ".\*"
9+
Minimum Product Version: 5.5.0
1210

11+
Sandfly Security app to gather information, initiate system scans and other actions on the Sandfly Server
1312

13+
[comment]: # " File: README.md"
14+
[comment]: # ""
15+
[comment]: # "Copyright (c) Sandfly Security, Ltd., 2023"
16+
[comment]: # ""
17+
[comment]: # "This unpublished material is proprietary to Recorded Future. All"
18+
[comment]: # "rights reserved. The methods and techniques described herein are"
19+
[comment]: # "considered trade secrets and/or confidential. Reproduction or"
20+
[comment]: # "distribution, in whole or in part, is forbidden except by express"
21+
[comment]: # "written permission of Sandfly Security."
22+
[comment]: # ""
23+
[comment]: # "Licensed under the Apache License, Version 2.0 (the 'License');"
24+
[comment]: # "you may not use this file except in compliance with the License."
25+
[comment]: # "You may obtain a copy of the License at"
26+
[comment]: # ""
27+
[comment]: # " http://www.apache.org/licenses/LICENSE-2.0"
28+
[comment]: # ""
29+
[comment]: # "Unless required by applicable law or agreed to in writing, software distributed under"
30+
[comment]: # "the License is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,"
31+
[comment]: # "either express or implied. See the License for the specific language governing permissions"
32+
[comment]: # "and limitations under the License."
33+
[comment]: # ""
1434
## Authentication
1535

1636
You must have an active Sandfly Security account in order to trigger actions. The account must also
@@ -20,7 +40,7 @@ actions or retrieve the information.
2040

2141
## Port Information
2242

23-
The app uses HTTP/ HTTPS protocol for communicating with the Cisco Umbrella server. Below are the
43+
The app uses HTTP/ HTTPS protocol for communicating with the Sandfly Security server. Below are the
2444
default ports used by Splunk SOAR.
2545

2646
|         Service Name | Transport Protocol | Port |
@@ -40,7 +60,14 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION
4060

4161
### Supported Actions
4262
[test connectivity](#action-test-connectivity) - Validate the asset configuration for connectivity using supplied configuration
43-
[scan host](#action-scan-host) - Trigger a scan of the specified host
63+
[scan host](#action-scan-host) - Run a Sandfly investigation
64+
[sandfly full investigation](#action-sandfly-full-investigation) - Run a full Sandfly investigation
65+
[sandfly process investigation](#action-sandfly-process-investigation) - Run a Sandfly process investigation
66+
[sandfly file investigation](#action-sandfly-file-investigation) - Run a Sandfly file investigation
67+
[sandfly directory investigation](#action-sandfly-directory-investigation) - Run a Sandfly directory investigation
68+
[sandfly log tamper investigation](#action-sandfly-log-tamper-investigation) - Run a Sandfly log tamper investigation
69+
[sandfly user investigation](#action-sandfly-user-investigation) - Run a Sandfly user investigation
70+
[sandfly recon investigation](#action-sandfly-recon-investigation) - Run a Sandfly recon investigation
4471

4572
## action: 'test connectivity'
4673
Validate the asset configuration for connectivity using supplied configuration
@@ -55,40 +82,193 @@ No parameters are required for this action
5582
No Output
5683

5784
## action: 'scan host'
58-
Trigger a scan of the specified host
85+
Run a Sandfly investigation
86+
87+
Type: **investigate**
88+
Read only: **False**
89+
90+
Run a Sandfly investigation against the target host for the selected types.
91+
92+
#### Action Parameters
93+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
94+
--------- | -------- | ----------- | ---- | --------
95+
**ip_hostname** | required | IP or name of the host | string |
96+
**directory** | optional | Sandfly Type - directory | boolean |
97+
**file** | optional | Sandfly Type - file | boolean |
98+
**incident** | optional | Sandfly Type - incident | boolean |
99+
**log** | optional | Sandfly Type - log | boolean |
100+
**policy** | optional | Sandfly Type - policy | boolean |
101+
**process** | optional | Sandfly Type - process | boolean |
102+
**recon** | optional | Sandfly Type - recon | boolean |
103+
**user** | optional | Sandfly Type - user | boolean |
104+
105+
#### Action Output
106+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
107+
--------- | ---- | -------- | --------------
108+
action_result.parameter.ip_hostname | string | |
109+
action_result.parameter.directory | boolean | |
110+
action_result.parameter.file | boolean | |
111+
action_result.parameter.incident | boolean | |
112+
action_result.parameter.log | boolean | |
113+
action_result.parameter.policy | boolean | |
114+
action_result.parameter.process | boolean | |
115+
action_result.parameter.recon | boolean | |
116+
action_result.parameter.user | boolean | |
117+
action_result.status | string | | success failed
118+
action_result.message | string | |
119+
summary.total_objects | numeric | |
120+
summary.total_objects_successful | numeric | |
121+
122+
## action: 'sandfly full investigation'
123+
Run a full Sandfly investigation
124+
125+
Type: **investigate**
126+
Read only: **False**
127+
128+
Run a full Sandfly investigation for all process, file, directory, log, user, incident, policy and recon types.
129+
130+
#### Action Parameters
131+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
132+
--------- | -------- | ----------- | ---- | --------
133+
**ip_hostname** | required | IP or Hostname | string |
134+
135+
#### Action Output
136+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
137+
--------- | ---- | -------- | --------------
138+
action_result.parameter.ip_hostname | string | |
139+
action_result.status | string | | success failed
140+
action_result.message | string | |
141+
summary.total_objects | numeric | |
142+
summary.total_objects_successful | numeric | |
143+
144+
## action: 'sandfly process investigation'
145+
Run a Sandfly process investigation
146+
147+
Type: **investigate**
148+
Read only: **False**
149+
150+
Run a Sandfly investigation against the target system for the process type.
151+
152+
#### Action Parameters
153+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
154+
--------- | -------- | ----------- | ---- | --------
155+
**ip_hostname** | required | IP or Hostname of the target system | string |
156+
157+
#### Action Output
158+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
159+
--------- | ---- | -------- | --------------
160+
action_result.parameter.ip_hostname | string | |
161+
action_result.status | string | | success failed
162+
action_result.message | string | |
163+
summary.total_objects | numeric | |
164+
summary.total_objects_successful | numeric | |
165+
166+
## action: 'sandfly file investigation'
167+
Run a Sandfly file investigation
168+
169+
Type: **investigate**
170+
Read only: **False**
171+
172+
Run a Sandfly investigation against the target system for the file type.
173+
174+
#### Action Parameters
175+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
176+
--------- | -------- | ----------- | ---- | --------
177+
**ip_hostname** | required | IP or Hostname of the target system | string |
178+
179+
#### Action Output
180+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
181+
--------- | ---- | -------- | --------------
182+
action_result.parameter.ip_hostname | string | |
183+
action_result.status | string | | success failed
184+
action_result.message | string | |
185+
summary.total_objects | numeric | |
186+
summary.total_objects_successful | numeric | |
187+
188+
## action: 'sandfly directory investigation'
189+
Run a Sandfly directory investigation
190+
191+
Type: **investigate**
192+
Read only: **False**
193+
194+
Run a Sandfly investigation against the target system for the directory type.
195+
196+
#### Action Parameters
197+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
198+
--------- | -------- | ----------- | ---- | --------
199+
**ip_hostname** | required | IP or Hostname of the target system | string |
200+
201+
#### Action Output
202+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
203+
--------- | ---- | -------- | --------------
204+
action_result.parameter.ip_hostname | string | |
205+
action_result.status | string | | success failed
206+
action_result.message | string | |
207+
summary.total_objects | numeric | |
208+
summary.total_objects_successful | numeric | |
209+
210+
## action: 'sandfly log tamper investigation'
211+
Run a Sandfly log tamper investigation
212+
213+
Type: **investigate**
214+
Read only: **False**
215+
216+
Run a Sandfly investigation against the target system for the log type.
217+
218+
#### Action Parameters
219+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
220+
--------- | -------- | ----------- | ---- | --------
221+
**ip_hostname** | required | IP or Hostname of the target system | string |
222+
223+
#### Action Output
224+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
225+
--------- | ---- | -------- | --------------
226+
action_result.parameter.ip_hostname | string | |
227+
action_result.status | string | | success failed
228+
action_result.message | string | |
229+
summary.total_objects | numeric | |
230+
summary.total_objects_successful | numeric | |
231+
232+
## action: 'sandfly user investigation'
233+
Run a Sandfly user investigation
234+
235+
Type: **investigate**
236+
Read only: **False**
237+
238+
Run a Sandfly investigation against the target system for the user type.
239+
240+
#### Action Parameters
241+
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
242+
--------- | -------- | ----------- | ---- | --------
243+
**ip_hostname** | required | IP or Hostname of the target system | string |
244+
245+
#### Action Output
246+
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
247+
--------- | ---- | -------- | --------------
248+
action_result.parameter.ip_hostname | string | |
249+
action_result.status | string | | success failed
250+
action_result.message | string | |
251+
summary.total_objects | numeric | |
252+
summary.total_objects_successful | numeric | |
253+
254+
## action: 'sandfly recon investigation'
255+
Run a Sandfly recon investigation
59256

60257
Type: **investigate**
61258
Read only: **False**
62259

63-
Send a request to the Sandfly Server to trigger a scan of the specified host\.
260+
Run a Sandfly investigation against the target system for the recon type.
64261

65262
#### Action Parameters
66263
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
67264
--------- | -------- | ----------- | ---- | --------
68-
**ip\_hostname** | required | IP or name of the host | string |
69-
**directory** | optional | Sandfly Type \- directory | boolean |
70-
**file** | optional | Sandfly Type \- file | boolean |
71-
**incident** | optional | Sandfly Type \- incident | boolean |
72-
**log** | optional | Sandfly Type \- log | boolean |
73-
**policy** | optional | Sandfly Type \- policy | boolean |
74-
**process** | optional | Sandfly Type \- process | boolean |
75-
**recon** | optional | Sandfly Type \- recon | boolean |
76-
**user** | optional | Sandfly Type \- user | boolean |
265+
**ip_hostname** | required | IP or Hostname of the target system | string |
77266

78267
#### Action Output
79268
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
80269
--------- | ---- | -------- | --------------
81-
action\_result\.parameter\.ip\_hostname | string | |
82-
action\_result\.parameter\.directory | boolean | |
83-
action\_result\.parameter\.file | boolean | |
84-
action\_result\.parameter\.incident | boolean | |
85-
action\_result\.parameter\.log | boolean | |
86-
action\_result\.parameter\.policy | boolean | |
87-
action\_result\.parameter\.process | boolean | |
88-
action\_result\.parameter\.recon | boolean | |
89-
action\_result\.parameter\.user | boolean | |
90-
action\_result\.data | string | |
91-
action\_result\.status | string | | success failed
92-
action\_result\.message | string | |
93-
summary\.total\_objects | numeric | |
94-
summary\.total\_objects\_successful | numeric | |
270+
action_result.parameter.ip_hostname | string | |
271+
action_result.status | string | | success failed
272+
action_result.message | string | |
273+
summary.total_objects | numeric | |
274+
summary.total_objects_successful | numeric | |

‎readme.html‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,24 @@
1+
<!-- File: readme.html
2+
3+
Copyright (c) Sandfly Security, Ltd., 2023
4+
5+
This unpublished material is proprietary to Recorded Future. All
6+
rights reserved. The methods and techniques described herein are
7+
considered trade secrets and/or confidential. Reproduction or
8+
distribution, in whole or in part, is forbidden except by express
9+
written permission of Sandfly Security.
10+
11+
Licensed under the Apache License, Version 2.0 (the "License");
12+
you may not use this file except in compliance with the License.
13+
You may obtain a copy of the License at
14+
15+
http://www.apache.org/licenses/LICENSE-2.0
16+
17+
Unless required by applicable law or agreed to in writing, software distributed under
18+
the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
19+
either express or implied. See the License for the specific language governing permissions
20+
and limitations under the License.
21+
-->
122
<html>
223
<head></head>
324
<body>
@@ -7,7 +28,7 @@ <h2>Authentication</h2>
728
The configuration below will require your Sandfly Security Server portal URL and a username and password that can trigger the actions or retrieve the information.
829
<h2>Port Information</h2>
930
<p>
10-
The app uses HTTP/ HTTPS protocol for communicating with the Cisco Umbrella server. Below are the default ports used by Splunk SOAR.
31+
The app uses HTTP/ HTTPS protocol for communicating with the Sandfly Security server. Below are the default ports used by Splunk SOAR.
1132
<table>
1233
<tr class=plain>
1334
<th>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Service Name</th>

‎release_notes/1.2.0.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
* Added several new actions to run a specific subset of Sandfly types:
2+
* sandfly full investigation - run a full Sandfly investigation scan for all process, file, directory, log, user, incident, policy and recon types.
3+
* sandfly process investigation - run an investigation scan for the Sandfly process type.
4+
* sandfly file investigation - run an investigation scan for the Sandfly file type.
5+
* sandfly directory investigation - run an investigation scan for the Sandfly directory type.
6+
* sandfly log tamper investigation - run an investigation scan for the Sandfly log type.
7+
* sandfly user investigation - run an investigation scan for the Sandfly user type.
8+
* sandfly recon investigation - run an invesgitation scan for the Sandfly recon type.

0 commit comments

Comments
 (0)