OTbase Inventory v1.1.0

About the connector

Enterprise-grade OT asset management software. OTbase is the gold standard for large scale OT asset inventories. It inventories OT devices from PLCs over network switches to sensors and actuators and integrates nicely with your existing tools and platforms.

This document provides information about the OTbase Inventory connector, which facilitates automated interactions, with a OTbase Inventory server using FortiSOAR™ playbooks. Add the OTbase Inventory connector as a step in FortiSOAR™ playbooks and perform automated operations with OTbase Inventory.

Version information

Connector Version: 1.1.0

FortiSOAR™ Version Tested on: 7.6.0-5012

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.1.0

Following enhancements have been made to the OTbase Inventory connector in version 1.1.0:

• Added support for Data Ingestion to ingest and map OTbase Inventory devices to FortiSOAR™ Assets

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-otbase-inventory

Prerequisites to configuring the connector

• You must have the credentials of OTbase Inventory server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the OTbase Inventory server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the OTbase Inventory connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

You can use the following automated operations in playbooks and also use the annotations to access operations:

operation: Get Devices List

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": [
        {
            "name": "",
            "tags": [],
            "zone": "",
            "stage": "",
            "safety": "",
            "context": {
                "location": "",
                "otSystem": "",
                "processes": [
                    {
                        "name": "",
                        "location": "",
                        "locationId": ""
                    }
                ],
                "locationId": "",
                "otSystemId": "",
                "deviceGroup": "",
                "referenceLocation": "",
                "referenceLocationId": ""
            },
            "release": "",
            "deviceId": "",
            "exposure": "",
            "hardware": {
                "type": "",
                "model": "",
                "vendor": "",
                "version": "",
                "endOfLife": "",
                "lifecycle": "",
                "vendorLink": "",
                "description": "",
                "orderNumber": ""
            },
            "hostedOn": "",
            "modified": "",
            "monitors": [],
            "warranty": "",
            "deviceRef": "",
            "last_seen": "",
            "connections": [],
            "criticality": "",
            "description": "",
            "os_firmware": "",
            "last_seen_by": "",
            "serialNumber": "",
            "documentation": "",
            "last_patch_date": "",
            "manufactureDate": "",
            "installationDate": "",
            "days_since_last_patch": ""
        }
    ],
    "info": {
        "user": "",
        "total": "",
        "offset": "",
        "origin": "",
        "next_offset": ""
    }
}

operation: Get Device Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
        "name": "",
        "tags": [],
        "zone": "",
        "stage": "",
        "safety": "",
        "context": {
            "location": "",
            "otSystem": "",
            "processes": [
                {
                    "name": "",
                    "location": "",
                    "locationId": ""
                }
            ],
            "locationId": "",
            "otSystemId": "",
            "deviceGroup": "",
            "referenceLocation": "",
            "referenceLocationId": ""
        },
        "release": "",
        "deviceId": "",
        "exposure": "",
        "hardware": {
            "type": "",
            "model": "",
            "vendor": "",
            "version": "",
            "endOfLife": "",
            "lifecycle": "",
            "vendorLink": "",
            "description": "",
            "orderNumber": ""
        },
        "hostedOn": "",
        "modified": "",
        "monitors": [],
        "warranty": "",
        "deviceRef": "",
        "last_seen": "",
        "connections": [],
        "criticality": "",
        "description": "",
        "os_firmware": "",
        "last_seen_by": "",
        "serialNumber": "",
        "documentation": "",
        "last_patch_date": "",
        "manufactureDate": "",
        "installationDate": "",
        "days_since_last_patch": ""
    },
    "info": {
        "user": "",
        "origin": ""
    }
}

operation: Delete Device Details

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Vulnerabilities List

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": [
        {
            "kev": "",
            "cveId": "",
            "vector": "",
            "devices": [],
            "priority": "",
            "severity": "",
            "baseScore": "",
            "description": "",
            "datePublished": ""
        }
    ],
    "info": {
        "user": "",
        "total": "",
        "offset": "",
        "origin": "",
        "next_offset": ""
    }
}

operation: Get Vulnerability Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
        "kev": "",
        "cveId": "",
        "vector": "",
        "devices": [],
        "priority": "",
        "severity": "",
        "baseScore": "",
        "description": "",
        "datePublished": ""
    },
    "info": {
        "user": "",
        "origin": ""
    }
}

operation: Get Data Flow

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": [],
    "info": {
        "user": "",
        "total": "",
        "offset": "",
        "origin": ""
    }
}

operation: Get Network List

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": [
        {
            "name": "",
            "type": "",
            "vlan": "",
            "group": "",
            "address": "",
            "location": "",
            "networkId": "",
            "groupColor": "",
            "locationId": "",
            "description": "",
            "reserved_addresses": []
        }
    ],
    "info": {
        "user": "",
        "total": "",
        "offset": "",
        "origin": ""
    }
}

operation: Get Network Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
        "name": "",
        "type": "",
        "vlan": "",
        "group": "",
        "address": "",
        "location": "",
        "networkId": "",
        "groupColor": "",
        "locationId": "",
        "description": "",
        "reserved_addresses": []
    },
    "info": {
        "user": "",
        "origin": ""
    }
}

Included playbooks

The Sample - OTbase Inventory - 1.1.0 playbook collection comes bundled with the OTbase Inventory connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the OTbase Inventory connector.

• Delete Device Details
• Get Data Flow
• Get Device Details
• Get Devices List
• Get Network Details
• Get Network List
• Get Vulnerabilities List
• Get Vulnerability Details
• OTbase Inventory > Fetch and Create
• OTbase Inventory > Ingest

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling devices from OTbase Inventory. Currently, devices ingested from OTbase Inventory is mapped to Assets in FortiSOAR™. For more information on the Data Ingestion Wizard, see the Connectors Guide in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the Data Ingestion Wizard to seamlessly map the incoming OTbase Inventory devices to FortiSOAR™'s Assets.

The Data Ingestion Wizard helps you to configure the scheduled pulling of data from OTbase Inventory into FortiSOAR™. It also lets you pull some sample data from OTbase Inventory using which you can define the mapping of data between OTbase Inventory and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the OTbase Inventory devices.

1. To begin configuring data ingestion, click Configure Data Ingestion on the OTbase Inventory connector's Configurations page.

   Click Let's Start by fetching some data, to open the Fetch Data screen.

   

   Sample data is required to create a field mapping between OTbase Inventory data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.

2. On the Fetch Data screen, provide the configurations required to fetch devices from OTbase Inventory.

   You can specify the date from when to pull devices, device location, OT system ID, and other details. The fetched data is used to create a mapping between the OTbase Inventory data and FortiSOAR™ assets.

   The fetched data is used to create a mapping between the devices from OTbase Inventory and FortiSOAR Assets. Once you have completed specifying the configurations, click Fetch Data.

   

3. On the Field Mapping screen, map the fields of the ingested devices OTbase Inventory to the fields of a Assets present in FortiSOAR™.

   To map a field, click the key in the sample data to add the Jinja value of the field. For example, to map the name parameter in properties field of an ingested device from OTbase Inventory to the Name parameter of a FortiSOAR™ Assets, click the Name field and then click the name parameter in properties field to populate its keys:

   

   For more information on field mapping, see the Data Ingestion chapter in the Connectors Guide in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. (Optional) Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to OTbase Inventory, so that the content gets pulled from the OTbase Inventory integration into FortiSOAR™

   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.

   In the Configure Schedule Settings section, specify the Cron expression for the schedule. For example, if you want to pull data from OTbase Inventory every 5 minutes, click Every X Minute, and in the minute box enter */5. This means that the Threat Intelligence Feeds will be pulled from OTbase Inventory every 5 minutes.

   

   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.