Fortinet Document Library

Version:


Table of Contents

1.0.0
Copy Link

About the connector

ProtectWise™ provides Cloud-Powered Network Detection & Response (NDR).

This document provides information about the ProtectWise connector, which facilitates automated interactions with a ProtectWise server using FortiSOAR™ playbooks. Add the ProtectWise connector as a step in FortiSOAR™ playbooks and perform automated operations, such as retrieving the reputation for a specified IP address or Domain name, and retreieving PCAP information for an event or an observation.

Version information

Connector Version: 1.0.0

Authored By: Fortinet

Certified: No

Installing the connector

All connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and use the yum command to install connectors:

yum install cyops-connector-protectwise

For the detailed procedure to install a connector, click here.

Configuring the connector

For the procedure to configure a connector, click here.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onwards:

Function Description Annotation and Category
Get PCAP Retrieves PCAP information for a specific event or observation and adds that information as a FortiSOAR™ attachment. get_packets
Investigation
IP Reputation Retrieves reputation information for the specified IP address. ip_reputation
Investigation
Domain Reputation Retrieves reputation information for the specified domain name. domain_reputation
Investigation
File Reputation Retrieves reputation information for the specified filehash. file_reputation
Investigation

Included playbooks

The Sample - ProtectWise - 1.0.0 playbook collection comes bundled with the ProtectWise connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the ProtectWise connector.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection, since the sample playbook collection gets deleted during connector upgrade and delete.

 

About the connector

ProtectWise™ provides Cloud-Powered Network Detection & Response (NDR).

This document provides information about the ProtectWise connector, which facilitates automated interactions with a ProtectWise server using FortiSOAR™ playbooks. Add the ProtectWise connector as a step in FortiSOAR™ playbooks and perform automated operations, such as retrieving the reputation for a specified IP address or Domain name, and retreieving PCAP information for an event or an observation.

Version information

Connector Version: 1.0.0

Authored By: Fortinet

Certified: No

Installing the connector

All connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and use the yum command to install connectors:

yum install cyops-connector-protectwise

For the detailed procedure to install a connector, click here.

Configuring the connector

For the procedure to configure a connector, click here.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onwards:

Function Description Annotation and Category
Get PCAP Retrieves PCAP information for a specific event or observation and adds that information as a FortiSOAR™ attachment. get_packets
Investigation
IP Reputation Retrieves reputation information for the specified IP address. ip_reputation
Investigation
Domain Reputation Retrieves reputation information for the specified domain name. domain_reputation
Investigation
File Reputation Retrieves reputation information for the specified filehash. file_reputation
Investigation

Included playbooks

The Sample - ProtectWise - 1.0.0 playbook collection comes bundled with the ProtectWise connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the ProtectWise connector.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection, since the sample playbook collection gets deleted during connector upgrade and delete.