Fortinet FortiRecon EASM v1.1.0

About the connector

FortiRecon is a Digital Risk Protection Service (DRPS) product that provides an outside-the-network view of the risks posed to your enterprise.

This document provides information about the Fortinet FortiRecon EASM Connector, which facilitates automated interactions, with a Fortinet FortiRecon EASM server using FortiSOAR™ playbooks. Add the Fortinet FortiRecon EASM Connector as a step in FortiSOAR™ playbooks and perform automated operations with Fortinet FortiRecon EASM.

Version information

Connector Version: 1.1.0

FortiSOAR™ Version Tested on: 7.5.0-4015

Fortinet FortiRecon EASM Version Tested on: Version: v23.3.a

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.1.0

Following enhancements have been made to the Fortinet FortiRecon EASM Connector in version 1.1.0:

• Added following actions
  • Get Exposed Services
  • Get Cloud Integrations
  • Get FortiGate Integrations
  • Get Security Insights
  • Get Archived Issue Comments
  • Get Issue Comments
  • Get Tags
  • Get Tag Details
  • Get Groups
  • Get Group Details
• Added Get Report Link parameter in Get Report action.
• Added new input parameters to the following action:
  • Get Scan Statistics
  • Generate Report
  • Get Archived Assets
  • Get Archived Issues
  • Get Issue Summary
  • Get Issues Discovered
  • Get Asset ASNs
  • Get Domains
  • Get Prefixes
  • Get IPs
  • Get Subdomains
  • Get Asset Statistics
  • Get Leaked Credentials
• Updated output schemas of all actions.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the following yum command as a root user to install connectors from an SSH session:

yum install cyops-connector-fortinet-fortirecon-easm

Prerequisites to configuring the connector

• You must have the URL of the Fortinet FortiRecon EASM server to which you will connect and perform automated operations and credentials to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Fortinet FortiRecon EASM server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fortinet FortiRecon EASM connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Get Leaked Credentials

Input parameters

Output

The output contains the following populated JSON schema:

{
    "total": "",
    "page": "",
    "size": "",
    "hits": [
        {
            "email": "",
            "domain": "",
            "status": "",
            "added_on": "",
            "breach_id": "",
            "breach_date": "",
            "breach_name": "",
            "has_password": ""
        }
    ]
}

operation: Get Scan Statistics

Input parameters

Output

The output contains the following populated JSON schema:

{
    "current_scan": {
        "assets": {
            "disappeared": {
                "asn": "",
                "domain": "",
                "ip_address": "",
                "ip_block": "",
                "sub_domain": ""
            },
            "live": "",
            "newly_discovered": {
                "asn": "",
                "domain": "",
                "ip_address": "",
                "ip_block": "",
                "sub_domain": ""
            },
            "total": ""
        },
        "completed_ts": ""
    },
    "previous_scan": {
        "assets": {
            "live": "",
            "total": ""
        },
        "completed_ts": ""
    }
}

operation: Get Issues Discovered

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "tags": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "groups": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "id": "",
            "issue_name": "",
            "asset": "",
            "asset_type": "",
            "country": "",
            "severity": "",
            "port": "",
            "bucket": "",
            "status": "",
            "user_name": "",
            "issue_name_identifier": "",
            "bucket_id": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Issue By ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "issue_name": "",
    "asset": "",
    "asset_type": "",
    "country": "",
    "severity": "",
    "port": "",
    "bucket": "",
    "status": "",
    "user_name": "",
    "issue_name_identifier": "",
    "bucket_id": ""
}

operation: Get Issue Summary

Input parameters

Output

The output contains the following populated JSON schema:

{
    "total": "",
    "critical": "",
    "high": "",
    "low": "",
    "medium": ""
}

operation: Get Archived Issues

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "asset": "",
            "asset_type": "",
            "groups": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "id": "",
            "issue_name": "",
            "port": "",
            "status": "",
            "tags": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "user_name": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Archived Assets

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "asset": "",
            "asset_type": "",
            "groups": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "id": "",
            "tags": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "user_action": "",
            "user_name": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Asset ASNs

Input parameters

{
    "cloud_provider": [
      "azure"
    ],
    "region": [
      "westus2"
    ],
    "integration_id": [
      "777408f550e5rrdd1hjf3w90"
    ],
    "resource_name": [
      "TestAssetsPublic"
    ]
}

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "asset": "",
            "assets_linked_count": "",
            "company_name": "",
            "fgt_metadata": {},
            "groups": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "id": "",
            "tags": [
                {
                    "id": "",
                    "name": ""
                }
            ]
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get ASNs by Asset ID

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Linked Assets as false:

{
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "asset": "",
    "assets_linked_count": "",
    "company_name": "",
    "fgt_metadata": {},
    "discovery_path": [
        {
            "source": "",
            "module": "",
            "name": "",
            "target": "",
            "data_type": ""
        }
    ]
}

Output schema when you choose Linked Assets as true:

{
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "asset": "",
    "assets_linked_count": "",
    "company_name": "",
    "fgt_metadata": {},
    "discovery_path": [
        {
            "source": "",
            "module": "",
            "name": "",
            "target": "",
            "data_type": ""
        }
    ],
    "assets_linked": []
}

operation: Get Domains

Input parameters

{
    "cloud_provider": [
        "azure"
    ],
    "region": [
        "westus2"
    ],
    "integration_id": [
        "777408f550e5rrdd1hjf3w90"
    ],
    "resource_name": [
        "TestAssetsPublic"
    ]
}

Output

The output contains the following populated JSON schema:

{
    "asset": "",
    "assets_linked_count": "",
    "cloud_metadata": {
        "region": "",
        "resource_id": "",
        "resource_name": "",
        "resource_type": "",
        "cloud_provider": "",
        "resource_group": "",
        "customer_integration_name": ""
    },
    "confidence": "",
    "domain_expiry": "",
    "fgt_metadata": {
        "virtual_ip": [
            {
                "name": "",
                "protocol": "",
                "mapped_ip": "",
                "mapped_ports": "",
                "external_ports": "",
                "mapped_device_mac": "",
                "mapped_device_os_name": ""
            }
        ],
        "interface_id": "",
        "integration_id": "",
        "interface_name": "",
        "integration_type": "",
        "customer_integration_name": ""
    },
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "ip_address": "",
    "nameserver": [],
    "original_ip": [],
    "ports": [],
    "ssl_cert_org": "",
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "technologies": []
}

operation: Get Domain by Asset ID

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Linked Assets as false:

{
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "asset": "",
    "ports": [],
    "ssl_cert_org": "",
    "ip_address": "",
    "technologies": [],
    "confidence": "",
    "domain_expiry": "",
    "nameserver": [],
    "original_ip": [],
    "cloud_metadata": {
        "region": "",
        "resource_id": "",
        "resource_name": "",
        "resource_type": "",
        "cloud_provider": "",
        "resource_group": "",
        "customer_integration_name": ""
    },
    "fgt_metadata": {
        "customer_integration_name": "",
        "integration_id": "",
        "integration_type": "",
        "interface_id": "",
        "interface_name": "",
        "virtual_ip": [
            {
                "external_ports": "",
                "mapped_device_mac": "",
                "mapped_device_os_name": "",
                "mapped_ip": "",
                "mapped_ports": "",
                "name": "",
                "protocol": ""
            }
        ]
    },
    "assets_linked_count": "",
    "issue_count": "",
    "discovery_path": [
        {
            "source": "",
            "module": "",
            "name": "",
            "target": "",
            "data_type": ""
        }
    ]
}

Output schema when you choose Linked Assets as true:

{
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "asset": "",
    "ports": [],
    "ssl_cert_org": "",
    "ip_address": "",
    "technologies": [],
    "confidence": "",
    "domain_expiry": "",
    "nameserver": [],
    "original_ip": [],
    "cloud_metadata": {
        "region": "",
        "resource_id": "",
        "resource_name": "",
        "resource_type": "",
        "cloud_provider": "",
        "resource_group": "",
        "customer_integration_name": ""
    },
    "fgt_metadata": {
        "customer_integration_name": "",
        "integration_id": "",
        "integration_type": "",
        "interface_id": "",
        "interface_name": "",
        "virtual_ip": [
            {
                "external_ports": "",
                "mapped_device_mac": "",
                "mapped_device_os_name": "",
                "mapped_ip": "",
                "mapped_ports": "",
                "name": "",
                "protocol": ""
            }
        ]
    },
    "assets_linked_count": "",
    "issue_count": "",
    "discovery_path": [
        {
            "source": "",
            "module": "",
            "name": "",
            "target": "",
            "data_type": ""
        }
    ],
    "assets_linked": []
}

operation: Get IPs

Input parameters

{
    "cloud_provider": [
        "azure"
    ],
    "region": [
        "westus2"
    ],
    "integration_id": [
        "777408f550e5rrdd1hjf3w90"
    ],
    "resource_name": [
        "TestAssetsPublic"
    ]
}

Output

The output contains the following populated JSON schema:

{
    "total": "",
    "page": "",
    "size": "",
    "hits": [
        {
            "tags": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "groups": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "id": "",
            "ip_prefix": "",
            "asset": "",
            "ports": [],
            "cloud_metadata": {},
            "fgt_metadata": {},
            "assets_linked_count": "",
            "version": ""
        }
    ]
}

operation: Get IP by Asset ID

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Linked Assets as false:

{
    "tags": [],
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "ip_prefix": "",
    "asset": "",
    "ports": [],
    "cloud_metadata": {},
    "fgt_metadata": {},
    "assets_linked_count": "",
    "version": "",
    "issue_count": "",
    "discovery_path": [
        {
            "source": "",
            "module": "",
            "name": "",
            "target": "",
            "data_type": ""
        }
    ]
}

Output schema when you choose Linked Assets as true:

{
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "ip_prefix": "",
    "asset": "",
    "ports": [],
    "cloud_metadata": {},
    "fgt_metadata": {},
    "assets_linked_count": "",
    "version": "",
    "issue_count": "",
    "discovery_path": [
        {
            "source": "",
            "module": "",
            "name": "",
            "target": "",
            "data_type": ""
        }
    ],
    "assets_linked": []
}

operation: Get Prefixes

Input parameters

{
    "cloud_provider": [
        "azure"
    ],
    "region": [
        "westus2"
    ],
    "integration_id": [
        "777408f550e5rrdd1hjf3w90"
    ],
    "resource_name": [
        "TestAssetsPublic"
    ]
}

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "asn_number": "",
            "asset": "",
            "assets_linked_count": "",
            "company_name": "",
            "fgt_metadata": {},
            "groups": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "id": "",
            "ip_count": "",
            "live_ip_count": "",
            "tags": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "version": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Prefixes by Asset ID

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Linked Assets as false:

{
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "id": "",
    "asn_number": "",
    "asset": "",
    "company_name": "",
    "ip_count": "",
    "assets_linked_count": "",
    "version": "",
    "live_ip_count": "",
    "fgt_metadata": {},
    "discovery_path": [
        {
            "name": "",
            "module": "",
            "source": "",
            "target": "",
            "data_type": ""
        }
    ]
}

Output schema when you choose Linked Assets as true:

{
    "id": "",
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "asset": "",
    "groups": [
        {
            "id": "",
            "name": ""
        }
    ],
    "version": "",
    "ip_count": "",
    "asn_number": "",
    "company_name": "",
    "fgt_metadata": {},
    "assets_linked": [],
    "live_ip_count": "",
    "discovery_path": [
        {
            "name": "",
            "module": "",
            "source": "",
            "target": "",
            "data_type": ""
        }
    ],
    "assets_linked_count": ""
}

operation: Get Subdomains

Input parameters

{
    "cloud_provider": [
        "azure"
    ],
    "region": [
        "westus2"
    ],
    "integration_id": [
        "777408f550e5rrdd1hjf3w90"
    ],
    "resource_name": [
        "TestAssetsPublic"
    ]
}

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "tags": [
                {
                    "id": "",
                    "name": ""
                }
            ],
            "asset": "",
            "ports": [],
            "groups": [],
            "ip_address": "",
            "domain_name": "",
            "fgt_metadata": {},
            "technologies": [],
            "cloud_metadata": {}
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Subdomain by Asset ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "tags": [
        {
            "id": "",
            "name": ""
        }
    ],
    "asset": "",
    "ports": [],
    "groups": [],
    "ip_address": "",
    "domain_name": "",
    "issue_count": "",
    "fgt_metadata": {},
    "technologies": [],
    "cloud_metadata": {},
    "discovery_path": [
        {
            "name": "",
            "module": "",
            "source": "",
            "target": "",
            "data_type": ""
        }
    ]
}

operation: Get Asset Statistics

Input parameters

Output

The output contains the following populated JSON schema:

{
    "org_name": "",
    "asn_count": "",
    "ip_prefix_count": "",
    "live_domain_count": "",
    "total_domain_count": "",
    "billable_assets_count": "",
    "live_ip_address_count": "",
    "live_sub_domain_count": "",
    "total_ip_address_count": "",
    "total_sub_domain_count": ""
}

operation: Get Breaches

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "date": "",
            "name": "",
            "details": "",
            "added_on": "",
            "has_password": "",
            "affected_domains": "",
            "compromised_data": "",
            "compromised_accounts": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Breaches by ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "date": "",
    "name": "",
    "details": "",
    "added_on": "",
    "has_password": "",
    "affected_domains": "",
    "compromised_data": "",
    "compromised_accounts": ""
}

operation: Generate Report

Input parameters

Output

The output contains the following populated JSON schema:

{
    "report_id": ""
}

operation: Get Report

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Get Report Link as true:

{
    "report_url": ""
}

Output schema when you choose Get Report Link as false:

{
    "asn": [],
    "domain": [
        {
            "tags": "",
            "asset": "",
            "groups": "",
            "ip_address": "",
            "open_ports": "",
            "technologies": "",
            "total_issues": "",
            "discovery_path": "",
            "subdomain_count": ""
        }
    ],
    "issues": [
        {
            "port": "",
            "tags": "",
            "asset": "",
            "groups": "",
            "severity": "",
            "issue_name": "",
            "issue_status": "",
            "linked_assets": "",
            "issue_category": "",
            "recommendations": "",
            "additional_details": ""
        }
    ],
    "ip_block": [],
    "ip_address": [
        {
            "tags": "",
            "asset": "",
            "groups": "",
            "country": "",
            "open_ports": "",
            "total_issues": "",
            "linked_assets": "",
            "discovery_path": ""
        }
    ],
    "sub_domain": [
        {
            "tags": "",
            "asset": "",
            "groups": "",
            "open_ports": "",
            "technologies": "",
            "total_issues": "",
            "linked_assets": "",
            "discovery_path": ""
        }
    ],
    "organization": [],
    "disappeared_assets": [
        {
            "asset": "",
            "asset_type": ""
        }
    ],
    "newly_discovered_assets": [
        {
            "asset": "",
            "asset_type": ""
        }
    ]
}

operation: Get Exposed Services

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "cpe": [],
            "domains": [],
            "ip_address": "",
            "os": "",
            "port": "",
            "product": "",
            "service": "",
            "service_banner": "",
            "ssl": {},
            "subdomains": [],
            "version": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Cloud Integrations

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "name": "",
            "provider": "",
            "account_id": "",
            "policy_errors": [],
            "connection_status": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get FortiGate Integrations

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "host": "",
            "name": "",
            "port": "",
            "is_ssl": "",
            "verify_ssl": "",
            "policy_errors": [],
            "connection_status": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Security Insights

Input parameters

Output

The output contains the following populated JSON schema:

{
    "authoritative": [
        {
            "comments": "",
            "info": "",
            "severity_on_fail": "",
            "status": "",
            "title": ""
        }
    ],
    "parent": [
        {
            "comments": "",
            "info": "",
            "severity_on_fail": "",
            "status": "",
            "title": ""
        }
    ],
    "soa": [
        {
            "comments": "",
            "info": "",
            "severity_on_fail": "",
            "status": "",
            "title": ""
        }
    ]
}

operation: Get Archived Issue Comments

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "text": "",
            "user_name": "",
            "comment_type": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Issue Comments

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "text": "",
            "user_name": "",
            "comment_type": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Tags

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "name": "",
            "scope": "",
            "description": "",
            "linked_assets_count": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Tag Details

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Linked Asset as false:

{
    "id": "",
    "name": "",
    "scope": "",
    "description": "",
    "linked_assets": [],
    "linked_assets_count": ""
}

Output schema when you choose Linked Asset as false:

{
    "id": "",
    "name": "",
    "scope": "",
    "description": "",
    "linked_assets_count": ""
}

operation: Get Groups

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hits": [
        {
            "id": "",
            "name": "",
            "scope": "",
            "description": "",
            "linked_assets_count": ""
        }
    ],
    "page": "",
    "size": "",
    "total": ""
}

operation: Get Group Details

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Linked Asset as true:

{
    "id": "",
    "name": "",
    "scope": "",
    "description": "",
    "linked_assets": [],
    "linked_assets_count": ""
}

Output schema when you choose Linked Asset as false:

{
    "id": "",
    "name": "",
    "scope": "",
    "description": "",
    "linked_assets_count": ""
}

Included playbooks

The Sample - Fortinet FortiRecon EASM - 1.1.0 playbook collection comes bundled with the Fortinet FortiRecon EASM connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiRecon EASM connector.

• Generate Report
• Get ASNs by Asset ID
• Get Archived Assets
• Get Archived Issue Comments
• Get Archived Issues
• Get Asset ASNs
• Get Asset Statistics
• Get Breaches
• Get Breaches by ID
• Get Cloud Integrations
• Get Domain by Asset ID
• Get Domains
• Get Exposed Services
• Get FortiGate Integrations
• Get Group Details
• Get Groups
• Get IP by Asset ID
• Get IPs
• Get Issue By ID
• Get Issue Comments
• Get Issue Summary
• Get Issues Discovered
• Get Leaked Credentials
• Get Prefixes
• Get Prefixes by Asset ID
• Get Report
• Get Scan Statistics
• Get Security Insights
• Get Subdomain by Asset ID
• Get Subdomains
• Get Tag Details
• Get Tags

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.