Lacework FortiCNAPP v1.1.0

About the connector

Lacework delivers end-to-end visibility into what's happening across your cloud environment, including detecting threats, vulnerabilities, misconfigurations, and unusual activity, so you can innovate with speed and safety.

This document provides information about the Lacework connector, which facilitates automated interactions, with a Lacework server using FortiSOAR™ playbooks. Add the Lacework connector as a step in FortiSOAR™ playbooks and perform automated operations with Lacework.

Version information

Connector Version: 1.1.0

FortiSOAR™ Version Tested on: 7.6.0-5012

Lacework Version Tested on: v2

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.1.0

The following enhancements have been made to the Lacework FortiCNAPP Connector in version 1.1.0:

• Added the following new actions:
  • Search Configuration
  • Search Container Vulnerabilities
  • Search Host Vulnerabilities
  • Run LQL Query
  • Execute an API Call

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-lacework

Prerequisites to configuring the connector

• You must have the credentials of the Lacework server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Lacework server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Lacework connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

You can use the following automated operations in playbooks and also use the annotations to access operations:

operation: Search Alerts

Input parameters

Output

The output contains the following populated JSON schema:

[
    {
        "alertId": "",
        "startTime": "",
        "alertType": "",
        "severity": "",
        "internetExposure": "",
        "reachability": "",
        "derivedFields": {
            "category": "",
            "sub_category": "",
            "source": ""
        },
        "endTime": "",
        "lastUserUpdatedTime": "",
        "status": "",
        "alertName": "",
        "alertInfo": {
            "subject": "",
            "description": ""
        },
        "policyId": ""
    }
]

operation: Get Alerts Details

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Scope as Details:

{
    "data": {
        "alertId": "",
        "startTime": "",
        "alertType": "",
        "severity": "",
        "endTime": "",
        "lastUserUpdatedTime": "",
        "status": "",
        "alertName": "",
        "alertInfo": {
            "subject": "",
            "description": "",
            "isExpectedLWBehavior": "",
            "customerCount": "",
            "supportingFacts": [
                {
                    "supportingFactText": "",
                    "subElements": []
                }
            ]
        },
        "entityMap": {
            "API": "",
            "CT_User": "",
            "CT_RawTime": "",
            "Region": "",
            "Resource": "",
            "RulesTriggered": "",
            "SourceIpAddress": ""
        }
    }
}

Output schema when you choose Scope as Investigation:

{
    "data": [
        {
            "question": "",
            "answer": ""
        }
    ]
}

Output schema when you choose Scope as Events:

{
    "data": [
        {
            "awsRegion": "",
            "eventName": "",
            "eventSource": "",
            "sourceIpAddress": "",
            "recipientAccountId": "",
            "mfa": "",
            "eventTime": "",
            "userIdentity": "",
            "additionalEventInfo": {
                "errorCode": "",
                "errorMessage": "",
                "eventID": "",
                "eventTime": "",
                "eventType": "",
                "eventVersion": "",
                "readOnly": "",
                "requestID": "",
                "userAgent": ""
            },
            "requestParameters": "",
            "compositeEventId": "",
            "id": "",
            "name": "",
            "descriptionText": "",
            "compositeStartTime": "",
            "compositeEndTime": "",
            "entityKeys": [],
            "tagMetadata": [
                {
                    "tagMetadata": {
                        "customerFacingId": "",
                        "id": "",
                        "name": "",
                        "orderIndex": "",
                        "parentId": "",
                        "type": "",
                        "url": "",
                        "version": ""
                    }
                }
            ]
        }
    ]
}

Output schema when you choose Scope as RelatedAlerts:

{
    "data": [
        {
            "eventType": "",
            "eventId": "",
            "severity": "",
            "startTime": "",
            "endTime": "",
            "eventModel": "",
            "eventProps": {
                "description": "",
                "dstEntities": "",
                "eventActor": "",
                "srcEntities": ""
            },
            "keys": "",
            "rank": "",
            "eventInfo": {
                "subject": "",
                "description": ""
            },
            "eventName": ""
        }
    ]
}

Output schema when you choose Scope as Integrations:

{
    "data": [
        {
            "alertChannel": "",
            "alertIntegrationId": "",
            "createdTime": "",
            "alertId": "",
            "integrationType": "",
            "integrationContext": {
                "id": "",
                "link": ""
            },
            "intgGuid": "",
            "lastSyncTime": "",
            "alertIntegrationStatus": "",
            "status": "",
            "isBidirectional": ""
        }
    ]
}

Output schema when you choose Scope as Timeline:

{
    "data": [
        {
            "alertChannel": "",
            "id": "",
            "alertId": "",
            "createdTime": "",
            "entryType": "",
            "entryAuthorType": "",
            "intgGuid": "",
            "message": {},
            "externalTime": "",
            "user": "",
            "updateContext": {
                "newIntegration": {
                    "createdTime": "",
                    "alertId": "",
                    "lastSyncTime": "",
                    "alertIntegrationStatus": "",
                    "status": "",
                    "isBidirectional": ""
                }
            },
            "alertIntegration": ""
        }
    ]
}

operation: Get Alert Entities

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": [
        {
            "entities": [
                {
                    "entityValue": "",
                    "contextEntityType": ""
                }
            ],
            "countOfEntities": ""
        }
    ]
}

operation: Get Alert Entity Details

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Entity Type as IpAddress:

{
    "data": {
        "isAgentInstalled": "",
        "isInternalIp": "",
        "laceworkLabs": {
            "customerCount": "",
            "badIpAddress": "",
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "virusTotal": {
            "securityVendorsCount": "",
            "source": "",
            "network": "",
            "autonomousSystemNumber": "",
            "autonomousSystemLabel": "",
            "regionalInternalRegistry": "",
            "country": "",
            "continent": "",
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "ipAddressSummary": {
            "country": "",
            "region": "",
            "city": "",
            "countryCode": "",
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "resolvedIpInformation": {
            "resolvedIPInfo": [
                {
                    "dnsResolverIp": "",
                    "dnsName": "",
                    "resolvedIp": ""
                }
            ],
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "uniqueProcessDetails": {
            "uniqueProcesses": [
                {
                    "cmdLine": "",
                    "launchTime": "",
                    "hostname": ""
                }
            ],
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "networkActivityOverview": {
            "externalServerConn": {
                "count": ""
            },
            "externalClientConn": {
                "count": ""
            },
            "externalInBytes": {
                "count": ""
            },
            "externalOutBytes": {
                "count": ""
            },
            "startTimeRange": "",
            "endTimeRange": ""
        }
    }
}

Output schema when you choose Entity Type as Machine:

{
    "data": {
        "criticalAndHighRisk": {
            "vulnerabilities": {
                "criticalCount": "",
                "highCount": "",
                "startTimeRange": "",
                "endTimeRange": ""
            },
            "alerts": {
                "criticalCount": "",
                "highCount": "",
                "startTimeRange": "",
                "endTimeRange": ""
            },
            "attackPaths": {
                "criticalCount": "",
                "otherCount": "",
                "startTimeRange": "",
                "endTimeRange": ""
            }
        },
        "customResourceGroups": {
            "resourceGroups": [
                {
                    "name": "",
                    "guid": ""
                }
            ],
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "cloudServiceProvider": {
            "cloudServiceProvider": "",
            "accountAlias": "",
            "accountId": "",
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "machineProperties": {
            "name": "",
            "ipAddress": "",
            "lastBootTime": "",
            "cpu": "",
            "osType": "",
            "memoryInfo": "",
            "kernelRelease": "",
            "kernelVersion": "",
            "macAddress": "",
            "defaultRouter": "",
            "promiscuous": "",
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "machineTagSummary": {
            "amiId": "",
            "instanceId": "",
            "subnetId": "",
            "vmInstanceType": "",
            "vmProvider": "",
            "lwTokenShort": "",
            "internalIp": "",
            "arch": "",
            "vpcId": "",
            "zone": "",
            "os": "",
            "account": "",
            "startTimeRange": "",
            "endTimeRange": ""
        },
        "networkActivityOverview": {
            "externalServerConn": {
                "count": ""
            },
            "externalClientConn": {
                "count": ""
            },
            "externalInBytes": {
                "count": ""
            },
            "externalOutBytes": {
                "count": ""
            },
            "startTimeRange": "",
            "endTimeRange": ""
        }
    }
}

operation: Add Comment to Alert

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
        "id": "",
        "alertId": "",
        "createdTime": "",
        "entryType": "",
        "entryAuthorType": "",
        "message": {
            "format": "",
            "value": ""
        },
        "externalTime": "",
        "user": {
            "userGuid": "",
            "username": ""
        },
        "updateContext": {}
    }
}

operation: Close Alert

Input parameters

Output

The output contains the following populated JSON schema:

{
    "message": ""
}

operation: Run LQL Query

Input parameters

Output

The output contains a non-dictionary value.

operation: Search Host Vulnerabilities

Input parameters

Output

The output contains the following populated JSON schema:

[
    {
        "cveProps": {},
        "cveRiskInfo": {},
        "cveRiskScore": {},
        "endTime": "",
        "evalCtx": {},
        "evalGuid": {},
        "featureKey": {},
        "fixInfo": {},
        "hostRiskInfo": {},
        "hostRiskScore": "",
        "machineTags": {},
        "mid": "",
        "packageStatus": "",
        "props": {},
        "region": "",
        "riskInfo": {},
        "riskScore": "",
        "severity": "",
        "startTime": "",
        "status": "",
        "vulnId": ""
    }
]

operation: Search Container Vulnerabilities

Input parameters

Output

The output contains the following populated JSON schema:

[
    {
        "cveProps": {
            "description": "",
            "link": "",
            "source": ""
        },
        "cveRiskInfo": {
            "HOST_COUNT": "",
            "IMAGE_COUNT": "",
            "PKG_COUNT": "",
            "SEVERITY_LEVEL": "",
            "score": ""
        },
        "cveRiskScore": "",
        "evalCtx": {
            "collector_type": "",
            "cve_batch_info": [
                {
                    "cve_created_time": ""
                }
            ],
            "image_info": {
                "created_time": "",
                "digest": "",
                "id": "",
                "registry": "",
                "repo": "",
                "scan_created_time": "",
                "size": "",
                "status": "",
                "tags": [],
                "type": ""
            },
            "integration_props": {},
            "is_reeval": "",
            "request_source": "",
            "scan_batch_id": "",
            "scan_request_props": {
                "data_format_version": "",
                "props": {
                    "data_format_version": "",
                    "scanner_version": ""
                },
                "scanCompletionUtcTime": "",
                "scan_start_time": "",
                "scanner_version": ""
            },
            "vuln_batch_id": "",
            "vuln_created_time": ""
        },
        "evalGuid": "",
        "featureKey": {
            "name": "",
            "namespace": "",
            "version": ""
        },
        "featureProps": {
            "feed": "",
            "introduced_in": "",
            "layer": "",
            "src": "",
            "version_format": ""
        },
        "fixInfo": {
            "fix_available": "",
            "fixed_version": ""
        },
        "imageId": "",
        "imageRiskInfo": {
            "factors": [],
            "factors_breakdown": {
                "active_containers": "",
                "cve_counts": {
                    "Critical": "",
                    "High": "",
                    "Medium": "",
                    "Other": ""
                },
                "exploit_summary": {
                    "disclosure_in_wild": "",
                    "exploit_public": "",
                    "exploit_virus_malware": "",
                    "exploit_wormified": ""
                },
                "internet_reachability": ""
            }
        },
        "imageRiskScore": "",
        "packageStatus": "",
        "riskInfo": {
            "factors": [],
            "factors_breakdown": {
                "active_containers": "",
                "cve_counts": {
                    "Critical": "",
                    "High": "",
                    "Medium": "",
                    "Other": ""
                },
                "exploit_summary": {
                    "disclosure_in_wild": "",
                    "exploit_public": "",
                    "exploit_virus_malware": "",
                    "exploit_wormified": ""
                },
                "internet_reachability": ""
            }
        },
        "riskScore": "",
        "severity": "",
        "startTime": "",
        "status": "",
        "vulnId": ""
    }
]

operation: Search Configuration

Input parameters

Output

The output contains the following populated JSON schema:

[
    {
        "account": {
            "AccountId": "",
            "Account_Alias": ""
        },
        "evalType": "",
        "id": "",
        "reason": "",
        "recommendation": "",
        "region": "",
        "reportTime": "",
        "resource": "",
        "section": "",
        "severity": "",
        "status": ""
    }
]

operation: Execute an API Call

Input parameters

Output

The output contains a non-dictionary value.

Included playbooks

The Sample - Lacework FortiCNAPP - 1.1.0 playbook collection comes bundled with the Lacework connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Lacework connector.

• Add Comment to Alert
• Close Alert
• Get Alert Entities
• Get Alert Entity Details
• Get Alerts Details
• Lacework FortiCNAPP > Fetch and Create
• Lacework FortiCNAPP > Ingest
• Run LQL Query
• Search Alerts
• Search Configuration
• Search Container Vulnerabilities
• Search Host Vulnerabilities
• Execute an API Call

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling data from Lacework FortiCNAPP. Currently, alerts ingested from Lacework FortiCNAPP are mapped to Alerts in FortiSOAR™. For more information on the Data Ingestion Wizard, see the Connectors Guide in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the Data Ingestion Wizard to seamlessly map the incoming Lacework FortiCNAPP alerts to FortiSOAR™'s Alerts.

The Data Ingestion Wizard helps you to configure the scheduled pulling of data from Lacework FortiCNAPP into FortiSOAR™. It also lets you pull some sample data from Lacework FortiCNAPP using which you can define the mapping of data between Lacework FortiCNAPP and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the Lacework FortiCNAPP alerts.

1. To begin configuring data ingestion, click Configure Data Ingestion on the Lacework FortiCNAPP connector's Configurations page.

   Click Let's Start by fetching some data, to open the Fetch Data screen.

   

   Sample data is required to create a field mapping between Lacework FortiCNAPP data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.

2. On the Fetch Data screen, provide the configurations required to fetch alerts from Lacework FortiCNAPP. You can specify the Fetch Alerts Since, Alert Type, Severity, Status, etc. to fetch alerts from Lacework FortiCNAPP.

   The fetched data is used to create a mapping between the alerts from Lacework FortiCNAPP and FortiSOAR Alerts. Once you have completed specifying the configurations, click Fetch Data.

   

3. On the Field Mapping screen, map the fields of the ingested alerts Lacework FortiCNAPP to the fields of Alerts present in FortiSOAR™.

   NOTE: The selected date and time must be within the last 7 days.

   To map a field, click the key in the sample data to add the Jinja value of the field. For example, to map the severity parameter of an ingested alert from Lacework FortiCNAPP to the Severity parameter of a FortiSOAR™ Alert, click the Severity field and then click the severity field to populate its keys:

   

   For more information on field mapping, see the Data Ingestion chapter in the Connectors Guide in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. (Optional) Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to Lacework FortiCNAPP, so that the content gets pulled from the Lacework FortiCNAPP integration into FortiSOAR™

   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.

   In the Configure Schedule Settings section, specify the Cron expression for the schedule. For example, if you want to pull data from Lacework FortiCNAPP every 5 minutes, click Every X Minute, and in the minute box enter */5. This would mean that based on the configuration you have set up, data, i.e., alerts will be pulled from Lacework FortiCNAPP every 5 minutes.

   

   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.