Securonix SNYPR is an open and modular next-generation security intelligence platform that combines log management, security information and event management, user and entity behavior analytics, and fraud detection, serving as a foundation for a broad portfolio of specialized security analytics solutions.
This document provides information about the Securonix SNYPR connector, which facilitates automated interactions, with a Securonix SNYPR server using FortiSOAR™ playbooks. Add the Securonix SNYPR connector as a step in FortiSOAR™ playbooks and perform automated operations, such as automatically retrieving a list of all users from Securonix SNYPR, or retrieving the top violations from Securonix SNYPR based on the filter criteria you have specified.
Connector Version: 2.1.0
FortiSOAR™ Version Tested on: 7.3.0-2034
Securonix SNYPR Version Tested on: 6.4
Authored By: Community
Certified: Yes
The following enhancements have been made to the Securonix SNYPR connector in version 2.1.0:
Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root
user to install connectors from an SSH session:
yum install cyops-connector-securonix-snypr
For the procedure to configure a connector, click here.
In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Securonix SNYPR connector card. On the connector popup, click the Configurations tab to enter the required configuration details:
Parameter | Description |
---|---|
Server URL | URL of the Securonix SNYPR server to which you will connect and perform the automated operations. |
Username | Username to access the Securonix SNYPR server to which you will connect and perform the automated operations. |
Password | Password to access the Securonix SNYPR server to which you will connect and perform the automated operations. |
Tenant | Tenant ID that has been configured for your account to access the Securonix SNYPR server. |
Verify SSL | Specifies whether the SSL certificate for the server is to be verified or not. By default, this option is set as True. |
The following automated operations can be included in playbooks, and you can also use the annotations to access operations:
Function | Description | Annotation and Category |
---|---|---|
List All Users | Retrieves a list of all users from Securonix SNYPR. | list_users Investigation |
List All Peer Groups | Retrieves a list of all peer groups from Securonix SNYPR. | list_peer_groups Investigation |
List All Resource Groups | Retrieves a list of all resource groups from Securonix SNYPR. | list_resource_groups Investigation |
List All Policies | Retrieves a list of all policies from Securonix SNYPR. | list_policies Investigation |
Get Top Threats | Retrieves the top threats from Securonix SNYPR based on when the threat was last seen and other input parameters that you have specified. | get_top_threats Investigation |
Get Top Violations | Retrieves the top violations from Securonix SNYPR based on when the violation was last seen and other input parameters that you have specified. | get_top_violations Investigation |
Get Top Violators | Retrieves the top violators from Securonix SNYPR based on when the violator was last seen and other input parameters that you have specified. | get_top_violators Investigation |
Get Risk Score | Retrieves risk scores for all users or risk scores from Securonix SNYPR based on the query attributes and other input parameters that you have specified. | get_risk_score Investigation |
Get Risk History | Retrieves risk history for all users or risk history from Securonix SNYPR based on the query attributes and other input parameters that you have specified. | get_risk_history Investigation |
Query Users | Retrieves details of all users or specific users from Securonix SNYPR based on the query attributes that you have specified. | query_for_users Investigation |
Query Violations | Retrieves details of all violations or specific violations from Securonix SNYPR based on the query attributes and other input parameters that you have specified. | query_for_violations Investigation |
Query Watchlist | Retrieves details of all watchlists or specific watchlists from Securonix SNYPR based on the query attributes that you have specified. | query_for_watchlist Investigation |
Query Third Party Intelligence | Retrieves details of all TPIs or specific TPIs from Securonix SNYPR based on the query attributes that you have specified. | query_third_party_intelligence Investigation |
Custom Query | Runs a search on Securonix SNYPR and retrieves details based on the query attributes and other input parameters that you have specified. | custom_query Investigation |
Add Comment | Adds a comment on a Securonix SNYPR incident based on the incident ID you have specified. | add_comment Investigation |
Take Action on Incident | Takes a specified action on a Securonix SNYPR incident based on the incident ID, action, and other input parameters you have specified. | take_action_on_incident Investigation |
Create Incident | Creates a new incident in the Securonix SNYPR platform based on the policy name, entity type, and other input parameters you have specified. Note: If the case is already created and is present in the Securonix SNYPR platform, then return the details of the existing incident. |
create_incident Investigation |
List Incidents | Retrieves a list of incidents from the Securonix SNYPR platform based on the range type, date range, and other filter parameters that you have specified. | get_incident_details Investigation |
Get Incident Details | Retrieves details of a specific incident from Securonix SNYPR based on the incident ID you have specified. | get_incident_details Investigation |
Get Incident Status | Retrieves the status of a specific incident from Securonix SNYPR based on the incident ID you have specified. | get_incident_status Investigation |
Get Incident Workflow | Retrieves the workflow of a specific incident from Securonix SNYPR based on the incident ID you have specified. | get_incident_workflow Investigation |
Get Possible Actions for Incident | Retrieves a list of all possible actions associated with a specific incident from Securonix SNYPR based on the incident ID you have specified. | get_possible_action_for_incident Investigation |
Check Task on Incident | Checks if the action that you have specified is allowed on the specified Securonix SNYPR incident based on the incident ID and action name you have specified. | check_task_on_incident Investigation |
Get Workflows | Retrieves a list of all existing workflows from Securonix SNYPR. | get_workflows Investigation |
Get Available Threat Action | Retrieves a list of all available threat actions from Securonix SNYPR. | get_available_threat_action Investigation |
Get Workflow Default Assignee |
Retrieves the default assignee details for a specified workflow from Securonix SNYPR based on the workflow name you have specified. |
get_workflow_default_assignee |
None.
The output contains the following populated JSON schema:
{
"users": {
"user": [
{
"department": "",
"lastName": "",
"costCenterCode": "",
"skipEncryption": "",
"email": "",
"masked": "",
"enableDate": "",
"disableDate": "",
"hireDate": "",
"employeeType": "",
"title": "",
"criticality": "",
"location": "",
"firstName": "",
"employeeId": "",
"managerFirstname": "",
"status": "",
"riskscore": "",
"division": "",
"approverEmployeeId": "",
"jobCode": "",
"managerEmployeeId": "",
"managerLastname": ""
}
]
}
}
None.
The output contains the following populated JSON schema:
{
"peerGroups": {
"peerGroup": [
{
"name": "",
"criticality": ""
},
{
"name": "",
"criticality": ""
}
]
}
}
None.
The output contains the following populated JSON schema:
{
"resourceGroups": {
"resourceGroup": [
{
"name": "",
"type": ""
},
{
"name": "",
"type": ""
},
{
"name": "",
"type": ""
},
{
"name": "",
"type": ""
}
]
}
}
None.
The output contains the following populated JSON schema:
{
"policies": {
"policy": [
{
"createdBy": "",
"criticality": "",
"hql": "",
"createdOn": "",
"id": "",
"name": "",
"description": ""
}
]
}
}
Parameter | Description |
---|---|
Last Seen | The time period for which you want to retrieve the top threats from Securonix SNYPR. You can choose one of the following: Hours, Days, or Years. Based on the option that you select in the Last Seen drop-down list, you must specify the value for the Hours, Days, or Years. For example, if you select Hours from the Last Seen drop-down list, then you must choose the value of the hours from the Last Hours drop-down list, for example, Last 24 hours, Last 1 hour, etc. |
Offset | 0 based index of the page that this operation should return. |
Limit | The maximum number of results per page, that this operation should return. |
The output contains the following populated JSON schema:
{
"Response": {
"Docs": [
{
"Threat model name": "",
"Criticality": "",
"Generation time": "",
"No of violator": "",
"Threat model id": "",
"Description": ""
}
],
"Date range": [],
"Total records": ""
}
}
Parameter | Description |
---|---|
Last Seen | The time period for which you want to retrieve the top violations from Securonix SNYPR. You can choose one of the following: Hours, Days, or Years. Based on the option that you select in the Last Seen drop-down list, you must specify the value for the Hours, Days, or Years. For example, if you select Hours from the Last Seen drop-down list, then you must choose the value of the hours from the Last Hours drop-down list, for example, Last 24 hours, Last 1 hour, etc. |
Offset | 0 based index of the page that this operation should return. |
Limit | The maximum number of results per page, that this operation should return. |
The output contains the following populated JSON schema:
{
"Response": {
"Docs": [
{
"Criticality": "",
"Violation entity": "",
"Generation time": "",
"No of violator": "",
"Threat indicator": "",
"Policy name": "",
"Policy id": "",
"Description": "",
"Policy category": ""
}
],
"Date range": [],
"Total records": ""
}
}
Parameter | Description |
---|---|
Last Seen | The time period for which you want to retrieve the top violators from Securonix SNYPR. You can choose one of the following: Hours, Days, or Years. Based on the option that you select in the Last Seen drop-down list, you must specify the value for the Hours, Days, or Years. For example, if you select Hours from the Last Seen drop-down list, then you must choose the value of the hours from the Last Hours drop-down list, for example, Last 24 hours, Last 1 hour, etc. |
Offset | 0 based index of the page that this operation should return. |
Limit | The maximum number of results per page, that this operation should return. |
The output contains the following populated JSON schema:
{
"Response": {
"Docs": [
{
"Generation time": "",
"Risk score": "",
"Department": "",
"Name": "",
"Violator entity": ""
}
],
"Date range": [],
"Total records": ""
}
}
Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.
Parameter | Description |
---|---|
Query | Query attributes based on which you want to retrieve the risk score from Securonix SNYPR. Note: If you do not specify any query attribute, then the risk scores of all users are retrieved from Securonix SNYPR. |
Start Time |
Start date and time from when you want to retrieve the risk score from Securonix SNYPR. |
End Time |
End date and time till when you want to retrieve the risk score from Securonix SNYPR. |
The output contains a non-dictionary value.
Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.
Parameter | Description |
---|---|
Query | Query attributes based on which you want to retrieve the risk history from Securonix SNYPR. Note: If you do not specify any query attribute, then the risk history of all users is retrieved from Securonix SNYPR. |
Start Time |
Start date and time from when you want to retrieve details of violations from Securonix SNYPR. |
End Time |
End date and time till when you want to retrieve details of violations from Securonix SNYPR. |
The output contains a non-dictionary value.
Parameter | Description |
---|---|
Query | (Optional) Query attributes based on which you want to retrieve details of users from Securonix SNYPR. Note: If you do not specify any query attribute, then the details of all users are retrieved from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"error": "",
"available": "",
"to": "",
"totalDocuments": "",
"offset": "",
"searchViolations": "",
"from": "",
"events": [
{
"invalidEventAction": "",
"u_userid": "",
"hour": "",
"tenantname": "",
"directImport": "",
"u_id": "",
"tenantid": "",
"invalid": "",
"result": {
"entry": [
{
"key": "",
"value": ""
}
]
},
"ignored": ""
}
],
"query": ""
}
Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.
Parameter | Description |
---|---|
Query | Query attributes based on which you want to retrieve details of violations from Securonix SNYPR. Note: If you do not specify any query attribute, then the details of all violations are retrieved from Securonix SNYPR. |
Start Time |
Start date and time from when you want to retrieve details of violations from Securonix SNYPR. |
End Time |
End date and time till when you want to retrieve details of violations from Securonix SNYPR. |
The output contains a non-dictionary value.
Parameter | Description |
---|---|
Query | (Optional) Query attributes based on which you want to retrieve details of watchlists from Securonix SNYPR. Note: If you do not specify any query attribute, then the details of all watchlists are retrieved from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"error": "",
"available": "",
"to": "",
"totalDocuments": "",
"offset": "",
"searchViolations": "",
"from": "",
"events": [
{
"invalidEventAction": "",
"u_userid": "",
"hour": "",
"tenantname": "",
"directImport": "",
"u_id": "",
"tenantid": "",
"invalid": "",
"result": {
"entry": [
{
"key": "",
"value": ""
}
]
},
"ignored": ""
}
],
"query": ""
}
Parameter | Description |
---|---|
Query | (Optional) Query attributes based on which you want to retrieve details of TPIs from Securonix SNYPR. Note: If you do not specify any query attribute, then the details of all TPIs are retrieved from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"error": "",
"available": "",
"to": "",
"totalDocuments": "",
"offset": "",
"searchViolations": "",
"from": "",
"events": [
{
"invalidEventAction": "",
"u_userid": "",
"hour": "",
"tenantname": "",
"directImport": "",
"u_id": "",
"tenantid": "",
"invalid": "",
"result": {
"entry": [
{
"key": "",
"value": ""
}
]
},
"ignored": ""
}
],
"query": ""
}
Parameter | Description |
---|---|
Query | Query attributes based on which you want to run the search on Securonix SNYPR. |
Start Time |
Start date and time from when you want to run the search on Securonix SNYPR. |
End Time |
End date and time till when you want to run the search on Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"to": "",
"available": "",
"events": [],
"from": "",
"searchViolations": "",
"totalDocuments": "",
"offset": "",
"error": "",
"query": ""
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident in Securonix SNYPR to which you want to add a comment. |
Comment | The comment that you want to add to the specified incident. |
The output contains a non-dictionary value.
Parameter | Description |
---|---|
Incident ID | The ID of the incident in Securonix SNYPR on which you want to take the specified action. |
Action Name | Name of the action that you want to take on the specified Securonix SNYPR incident. |
Other Required Fields | (Optional) Additional required fields, in the JSON format, which you want to add to your request. |
The output contains the following populated JSON schema:
{
"status": "",
"result": ""
}
Parameter | Description |
---|---|
Policy Name | Name of the policy that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Data Source Name | Name of the data source that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Account Name | Name of the account that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Entity Type | Type of entity that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Action Name | Name of the action available in threat management that you want to associate with the new incident that you want to create in Securonix SNYPR. You can choose from the following options: Mark as Concern and create incident, Non-Concern, or Mark in progress (still investigating). |
Resource Name | Name of the resource that you want to associate with the new incident that you want to create in Securonix SNYPR. Note: This parameter is required for the Activity account. |
Employee ID | (Optional) The ID of the employee that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Workflow Name | Name of the workflow that you want to associate with the new incident that you want to create in Securonix SNYPR. Note: This field is required when you specify the action name as Mark as concern and create incident. |
Comment | The comment that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Criticality | Criticality that you want to associate with the new incident that you want to create in Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"incidentItems": [
{
"url": "",
"violatorSubText": "",
"violatorId": "",
"entity": "",
"lastUpdateDate": "",
"reason": [],
"incidentType": "",
"assignedUser": "",
"isWhitelisted": "",
"workflowName": "",
"riskscore": "",
"incidentId": "",
"statusCompleted": "",
"watchlisted": "",
"violatorText": "",
"priority": "",
"incidentStatus": ""
}
],
"totalIncidents": ""
}
Parameter | Description |
---|---|
Range Type | Type of filter based on which you want to retrieve the list of incidents from Securonix SNYPR. You can choose from the following options: Opened, Updated, or Closed. |
Start Time | DateTime from when you want to retrieve the list of incidents from Securonix SNYPR |
End Time | DateTime till when you want to retrieve the list of incidents from Securonix SNYPR |
Status | (Optional) CSV list of status values based on which you want to filter the list of incidents retrieved from Securonix SNYPR. |
Offset | (Optional) 0-based index of the page that this operation should return. |
The output contains the following populated JSON schema:
{
"status": "",
"result": {
"data": {
"incidentItems": [
{
"url": "",
"violatorSubText": "",
"violatorId": "",
"entity": "",
"lastUpdateDate": "",
"reason": [],
"incidentType": "",
"assignedUser": "",
"isWhitelisted": "",
"workflowName": "",
"riskscore": "",
"incidentId": "",
"watchlisted": "",
"violatorText": "",
"priority": "",
"incidentStatus": ""
}
],
"totalIncidents": ""
}
}
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose details you want to retrieve from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"status": "",
"result": {
"data": {
"incidentItems": [
{
"assignedGroup": "",
"url": "",
"violatorSubText": "",
"violatorId": "",
"entity": "",
"lastUpdateDate": "",
"reason": [],
"incidentType": "",
"assignedUser": "",
"isWhitelisted": "",
"workflowName": "",
"riskscore": "",
"incidentId": "",
"statusCompleted": "",
"watchlisted": "",
"violatorText": "",
"priority": "",
"incidentStatus": ""
}
],
"totalIncidents": ""
}
},
"messages": []
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose status you want to retrieve from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"status": "",
"result": {
"status": ""
},
"messages": []
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose workflow you want to retrieve from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"status": "",
"result": {
"workflow": ""
},
"messages": []
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose related actions you want to retrieve from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"result": [
{
"status": "",
"actionName": "",
"actionDetails": [
{
"sections": {
"sectionName": "",
"attributes": [
{
"required": "",
"attributeType": "",
"attribute": "",
"displayName": ""
}
]
},
"title": ""
}
]
}
],
"status": "",
"messages": []
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose associated tasks and actions you want to retrieve from Securonix SNYPR. |
Action Name | The name of the action that you want to execute on the specific Securonix SNYPR incident. |
The output contains the following populated JSON schema:
{
"result": [
{
"status": "",
"actionName": "",
"actionDetails": [
{
"sections": {
"sectionName": "",
"attributes": [
{
"required": "",
"attributeType": "",
"attribute": "",
"displayName": ""
}
]
},
"title": ""
}
]
}
],
"status": "",
"messages": []
}
None.
The output contains the following populated JSON schema:
{
"result": {
"workflows": [
{
"value": "",
"workflow": "",
"type": ""
}
]
},
"status": "",
"messages": []
}
None.
The output contains the following populated JSON schema:
{
"status": "",
"result": [],
"messages": []
}
Parameter | Description |
---|---|
Workflow Name | Name of the workflow whose default assignee details you want to retrieve from Securonix SNYPR. |
The output contains a non-dictionary value.
The Sample - Securonix SNYPR - 2.1.0
playbook collection comes bundled with the Securonix SNYPR connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Securonix SNYPR connector.
Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.
Securonix SNYPR is an open and modular next-generation security intelligence platform that combines log management, security information and event management, user and entity behavior analytics, and fraud detection, serving as a foundation for a broad portfolio of specialized security analytics solutions.
This document provides information about the Securonix SNYPR connector, which facilitates automated interactions, with a Securonix SNYPR server using FortiSOAR™ playbooks. Add the Securonix SNYPR connector as a step in FortiSOAR™ playbooks and perform automated operations, such as automatically retrieving a list of all users from Securonix SNYPR, or retrieving the top violations from Securonix SNYPR based on the filter criteria you have specified.
Connector Version: 2.1.0
FortiSOAR™ Version Tested on: 7.3.0-2034
Securonix SNYPR Version Tested on: 6.4
Authored By: Community
Certified: Yes
The following enhancements have been made to the Securonix SNYPR connector in version 2.1.0:
Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root
user to install connectors from an SSH session:
yum install cyops-connector-securonix-snypr
For the procedure to configure a connector, click here.
In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Securonix SNYPR connector card. On the connector popup, click the Configurations tab to enter the required configuration details:
Parameter | Description |
---|---|
Server URL | URL of the Securonix SNYPR server to which you will connect and perform the automated operations. |
Username | Username to access the Securonix SNYPR server to which you will connect and perform the automated operations. |
Password | Password to access the Securonix SNYPR server to which you will connect and perform the automated operations. |
Tenant | Tenant ID that has been configured for your account to access the Securonix SNYPR server. |
Verify SSL | Specifies whether the SSL certificate for the server is to be verified or not. By default, this option is set as True. |
The following automated operations can be included in playbooks, and you can also use the annotations to access operations:
Function | Description | Annotation and Category |
---|---|---|
List All Users | Retrieves a list of all users from Securonix SNYPR. | list_users Investigation |
List All Peer Groups | Retrieves a list of all peer groups from Securonix SNYPR. | list_peer_groups Investigation |
List All Resource Groups | Retrieves a list of all resource groups from Securonix SNYPR. | list_resource_groups Investigation |
List All Policies | Retrieves a list of all policies from Securonix SNYPR. | list_policies Investigation |
Get Top Threats | Retrieves the top threats from Securonix SNYPR based on when the threat was last seen and other input parameters that you have specified. | get_top_threats Investigation |
Get Top Violations | Retrieves the top violations from Securonix SNYPR based on when the violation was last seen and other input parameters that you have specified. | get_top_violations Investigation |
Get Top Violators | Retrieves the top violators from Securonix SNYPR based on when the violator was last seen and other input parameters that you have specified. | get_top_violators Investigation |
Get Risk Score | Retrieves risk scores for all users or risk scores from Securonix SNYPR based on the query attributes and other input parameters that you have specified. | get_risk_score Investigation |
Get Risk History | Retrieves risk history for all users or risk history from Securonix SNYPR based on the query attributes and other input parameters that you have specified. | get_risk_history Investigation |
Query Users | Retrieves details of all users or specific users from Securonix SNYPR based on the query attributes that you have specified. | query_for_users Investigation |
Query Violations | Retrieves details of all violations or specific violations from Securonix SNYPR based on the query attributes and other input parameters that you have specified. | query_for_violations Investigation |
Query Watchlist | Retrieves details of all watchlists or specific watchlists from Securonix SNYPR based on the query attributes that you have specified. | query_for_watchlist Investigation |
Query Third Party Intelligence | Retrieves details of all TPIs or specific TPIs from Securonix SNYPR based on the query attributes that you have specified. | query_third_party_intelligence Investigation |
Custom Query | Runs a search on Securonix SNYPR and retrieves details based on the query attributes and other input parameters that you have specified. | custom_query Investigation |
Add Comment | Adds a comment on a Securonix SNYPR incident based on the incident ID you have specified. | add_comment Investigation |
Take Action on Incident | Takes a specified action on a Securonix SNYPR incident based on the incident ID, action, and other input parameters you have specified. | take_action_on_incident Investigation |
Create Incident | Creates a new incident in the Securonix SNYPR platform based on the policy name, entity type, and other input parameters you have specified. Note: If the case is already created and is present in the Securonix SNYPR platform, then return the details of the existing incident. |
create_incident Investigation |
List Incidents | Retrieves a list of incidents from the Securonix SNYPR platform based on the range type, date range, and other filter parameters that you have specified. | get_incident_details Investigation |
Get Incident Details | Retrieves details of a specific incident from Securonix SNYPR based on the incident ID you have specified. | get_incident_details Investigation |
Get Incident Status | Retrieves the status of a specific incident from Securonix SNYPR based on the incident ID you have specified. | get_incident_status Investigation |
Get Incident Workflow | Retrieves the workflow of a specific incident from Securonix SNYPR based on the incident ID you have specified. | get_incident_workflow Investigation |
Get Possible Actions for Incident | Retrieves a list of all possible actions associated with a specific incident from Securonix SNYPR based on the incident ID you have specified. | get_possible_action_for_incident Investigation |
Check Task on Incident | Checks if the action that you have specified is allowed on the specified Securonix SNYPR incident based on the incident ID and action name you have specified. | check_task_on_incident Investigation |
Get Workflows | Retrieves a list of all existing workflows from Securonix SNYPR. | get_workflows Investigation |
Get Available Threat Action | Retrieves a list of all available threat actions from Securonix SNYPR. | get_available_threat_action Investigation |
Get Workflow Default Assignee |
Retrieves the default assignee details for a specified workflow from Securonix SNYPR based on the workflow name you have specified. |
get_workflow_default_assignee |
None.
The output contains the following populated JSON schema:
{
"users": {
"user": [
{
"department": "",
"lastName": "",
"costCenterCode": "",
"skipEncryption": "",
"email": "",
"masked": "",
"enableDate": "",
"disableDate": "",
"hireDate": "",
"employeeType": "",
"title": "",
"criticality": "",
"location": "",
"firstName": "",
"employeeId": "",
"managerFirstname": "",
"status": "",
"riskscore": "",
"division": "",
"approverEmployeeId": "",
"jobCode": "",
"managerEmployeeId": "",
"managerLastname": ""
}
]
}
}
None.
The output contains the following populated JSON schema:
{
"peerGroups": {
"peerGroup": [
{
"name": "",
"criticality": ""
},
{
"name": "",
"criticality": ""
}
]
}
}
None.
The output contains the following populated JSON schema:
{
"resourceGroups": {
"resourceGroup": [
{
"name": "",
"type": ""
},
{
"name": "",
"type": ""
},
{
"name": "",
"type": ""
},
{
"name": "",
"type": ""
}
]
}
}
None.
The output contains the following populated JSON schema:
{
"policies": {
"policy": [
{
"createdBy": "",
"criticality": "",
"hql": "",
"createdOn": "",
"id": "",
"name": "",
"description": ""
}
]
}
}
Parameter | Description |
---|---|
Last Seen | The time period for which you want to retrieve the top threats from Securonix SNYPR. You can choose one of the following: Hours, Days, or Years. Based on the option that you select in the Last Seen drop-down list, you must specify the value for the Hours, Days, or Years. For example, if you select Hours from the Last Seen drop-down list, then you must choose the value of the hours from the Last Hours drop-down list, for example, Last 24 hours, Last 1 hour, etc. |
Offset | 0 based index of the page that this operation should return. |
Limit | The maximum number of results per page, that this operation should return. |
The output contains the following populated JSON schema:
{
"Response": {
"Docs": [
{
"Threat model name": "",
"Criticality": "",
"Generation time": "",
"No of violator": "",
"Threat model id": "",
"Description": ""
}
],
"Date range": [],
"Total records": ""
}
}
Parameter | Description |
---|---|
Last Seen | The time period for which you want to retrieve the top violations from Securonix SNYPR. You can choose one of the following: Hours, Days, or Years. Based on the option that you select in the Last Seen drop-down list, you must specify the value for the Hours, Days, or Years. For example, if you select Hours from the Last Seen drop-down list, then you must choose the value of the hours from the Last Hours drop-down list, for example, Last 24 hours, Last 1 hour, etc. |
Offset | 0 based index of the page that this operation should return. |
Limit | The maximum number of results per page, that this operation should return. |
The output contains the following populated JSON schema:
{
"Response": {
"Docs": [
{
"Criticality": "",
"Violation entity": "",
"Generation time": "",
"No of violator": "",
"Threat indicator": "",
"Policy name": "",
"Policy id": "",
"Description": "",
"Policy category": ""
}
],
"Date range": [],
"Total records": ""
}
}
Parameter | Description |
---|---|
Last Seen | The time period for which you want to retrieve the top violators from Securonix SNYPR. You can choose one of the following: Hours, Days, or Years. Based on the option that you select in the Last Seen drop-down list, you must specify the value for the Hours, Days, or Years. For example, if you select Hours from the Last Seen drop-down list, then you must choose the value of the hours from the Last Hours drop-down list, for example, Last 24 hours, Last 1 hour, etc. |
Offset | 0 based index of the page that this operation should return. |
Limit | The maximum number of results per page, that this operation should return. |
The output contains the following populated JSON schema:
{
"Response": {
"Docs": [
{
"Generation time": "",
"Risk score": "",
"Department": "",
"Name": "",
"Violator entity": ""
}
],
"Date range": [],
"Total records": ""
}
}
Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.
Parameter | Description |
---|---|
Query | Query attributes based on which you want to retrieve the risk score from Securonix SNYPR. Note: If you do not specify any query attribute, then the risk scores of all users are retrieved from Securonix SNYPR. |
Start Time |
Start date and time from when you want to retrieve the risk score from Securonix SNYPR. |
End Time |
End date and time till when you want to retrieve the risk score from Securonix SNYPR. |
The output contains a non-dictionary value.
Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.
Parameter | Description |
---|---|
Query | Query attributes based on which you want to retrieve the risk history from Securonix SNYPR. Note: If you do not specify any query attribute, then the risk history of all users is retrieved from Securonix SNYPR. |
Start Time |
Start date and time from when you want to retrieve details of violations from Securonix SNYPR. |
End Time |
End date and time till when you want to retrieve details of violations from Securonix SNYPR. |
The output contains a non-dictionary value.
Parameter | Description |
---|---|
Query | (Optional) Query attributes based on which you want to retrieve details of users from Securonix SNYPR. Note: If you do not specify any query attribute, then the details of all users are retrieved from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"error": "",
"available": "",
"to": "",
"totalDocuments": "",
"offset": "",
"searchViolations": "",
"from": "",
"events": [
{
"invalidEventAction": "",
"u_userid": "",
"hour": "",
"tenantname": "",
"directImport": "",
"u_id": "",
"tenantid": "",
"invalid": "",
"result": {
"entry": [
{
"key": "",
"value": ""
}
]
},
"ignored": ""
}
],
"query": ""
}
Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.
Parameter | Description |
---|---|
Query | Query attributes based on which you want to retrieve details of violations from Securonix SNYPR. Note: If you do not specify any query attribute, then the details of all violations are retrieved from Securonix SNYPR. |
Start Time |
Start date and time from when you want to retrieve details of violations from Securonix SNYPR. |
End Time |
End date and time till when you want to retrieve details of violations from Securonix SNYPR. |
The output contains a non-dictionary value.
Parameter | Description |
---|---|
Query | (Optional) Query attributes based on which you want to retrieve details of watchlists from Securonix SNYPR. Note: If you do not specify any query attribute, then the details of all watchlists are retrieved from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"error": "",
"available": "",
"to": "",
"totalDocuments": "",
"offset": "",
"searchViolations": "",
"from": "",
"events": [
{
"invalidEventAction": "",
"u_userid": "",
"hour": "",
"tenantname": "",
"directImport": "",
"u_id": "",
"tenantid": "",
"invalid": "",
"result": {
"entry": [
{
"key": "",
"value": ""
}
]
},
"ignored": ""
}
],
"query": ""
}
Parameter | Description |
---|---|
Query | (Optional) Query attributes based on which you want to retrieve details of TPIs from Securonix SNYPR. Note: If you do not specify any query attribute, then the details of all TPIs are retrieved from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"error": "",
"available": "",
"to": "",
"totalDocuments": "",
"offset": "",
"searchViolations": "",
"from": "",
"events": [
{
"invalidEventAction": "",
"u_userid": "",
"hour": "",
"tenantname": "",
"directImport": "",
"u_id": "",
"tenantid": "",
"invalid": "",
"result": {
"entry": [
{
"key": "",
"value": ""
}
]
},
"ignored": ""
}
],
"query": ""
}
Parameter | Description |
---|---|
Query | Query attributes based on which you want to run the search on Securonix SNYPR. |
Start Time |
Start date and time from when you want to run the search on Securonix SNYPR. |
End Time |
End date and time till when you want to run the search on Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"to": "",
"available": "",
"events": [],
"from": "",
"searchViolations": "",
"totalDocuments": "",
"offset": "",
"error": "",
"query": ""
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident in Securonix SNYPR to which you want to add a comment. |
Comment | The comment that you want to add to the specified incident. |
The output contains a non-dictionary value.
Parameter | Description |
---|---|
Incident ID | The ID of the incident in Securonix SNYPR on which you want to take the specified action. |
Action Name | Name of the action that you want to take on the specified Securonix SNYPR incident. |
Other Required Fields | (Optional) Additional required fields, in the JSON format, which you want to add to your request. |
The output contains the following populated JSON schema:
{
"status": "",
"result": ""
}
Parameter | Description |
---|---|
Policy Name | Name of the policy that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Data Source Name | Name of the data source that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Account Name | Name of the account that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Entity Type | Type of entity that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Action Name | Name of the action available in threat management that you want to associate with the new incident that you want to create in Securonix SNYPR. You can choose from the following options: Mark as Concern and create incident, Non-Concern, or Mark in progress (still investigating). |
Resource Name | Name of the resource that you want to associate with the new incident that you want to create in Securonix SNYPR. Note: This parameter is required for the Activity account. |
Employee ID | (Optional) The ID of the employee that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Workflow Name | Name of the workflow that you want to associate with the new incident that you want to create in Securonix SNYPR. Note: This field is required when you specify the action name as Mark as concern and create incident. |
Comment | The comment that you want to associate with the new incident that you want to create in Securonix SNYPR. |
Criticality | Criticality that you want to associate with the new incident that you want to create in Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"incidentItems": [
{
"url": "",
"violatorSubText": "",
"violatorId": "",
"entity": "",
"lastUpdateDate": "",
"reason": [],
"incidentType": "",
"assignedUser": "",
"isWhitelisted": "",
"workflowName": "",
"riskscore": "",
"incidentId": "",
"statusCompleted": "",
"watchlisted": "",
"violatorText": "",
"priority": "",
"incidentStatus": ""
}
],
"totalIncidents": ""
}
Parameter | Description |
---|---|
Range Type | Type of filter based on which you want to retrieve the list of incidents from Securonix SNYPR. You can choose from the following options: Opened, Updated, or Closed. |
Start Time | DateTime from when you want to retrieve the list of incidents from Securonix SNYPR |
End Time | DateTime till when you want to retrieve the list of incidents from Securonix SNYPR |
Status | (Optional) CSV list of status values based on which you want to filter the list of incidents retrieved from Securonix SNYPR. |
Offset | (Optional) 0-based index of the page that this operation should return. |
The output contains the following populated JSON schema:
{
"status": "",
"result": {
"data": {
"incidentItems": [
{
"url": "",
"violatorSubText": "",
"violatorId": "",
"entity": "",
"lastUpdateDate": "",
"reason": [],
"incidentType": "",
"assignedUser": "",
"isWhitelisted": "",
"workflowName": "",
"riskscore": "",
"incidentId": "",
"watchlisted": "",
"violatorText": "",
"priority": "",
"incidentStatus": ""
}
],
"totalIncidents": ""
}
}
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose details you want to retrieve from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"status": "",
"result": {
"data": {
"incidentItems": [
{
"assignedGroup": "",
"url": "",
"violatorSubText": "",
"violatorId": "",
"entity": "",
"lastUpdateDate": "",
"reason": [],
"incidentType": "",
"assignedUser": "",
"isWhitelisted": "",
"workflowName": "",
"riskscore": "",
"incidentId": "",
"statusCompleted": "",
"watchlisted": "",
"violatorText": "",
"priority": "",
"incidentStatus": ""
}
],
"totalIncidents": ""
}
},
"messages": []
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose status you want to retrieve from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"status": "",
"result": {
"status": ""
},
"messages": []
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose workflow you want to retrieve from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"status": "",
"result": {
"workflow": ""
},
"messages": []
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose related actions you want to retrieve from Securonix SNYPR. |
The output contains the following populated JSON schema:
{
"result": [
{
"status": "",
"actionName": "",
"actionDetails": [
{
"sections": {
"sectionName": "",
"attributes": [
{
"required": "",
"attributeType": "",
"attribute": "",
"displayName": ""
}
]
},
"title": ""
}
]
}
],
"status": "",
"messages": []
}
Parameter | Description |
---|---|
Incident ID | The ID of the incident whose associated tasks and actions you want to retrieve from Securonix SNYPR. |
Action Name | The name of the action that you want to execute on the specific Securonix SNYPR incident. |
The output contains the following populated JSON schema:
{
"result": [
{
"status": "",
"actionName": "",
"actionDetails": [
{
"sections": {
"sectionName": "",
"attributes": [
{
"required": "",
"attributeType": "",
"attribute": "",
"displayName": ""
}
]
},
"title": ""
}
]
}
],
"status": "",
"messages": []
}
None.
The output contains the following populated JSON schema:
{
"result": {
"workflows": [
{
"value": "",
"workflow": "",
"type": ""
}
]
},
"status": "",
"messages": []
}
None.
The output contains the following populated JSON schema:
{
"status": "",
"result": [],
"messages": []
}
Parameter | Description |
---|---|
Workflow Name | Name of the workflow whose default assignee details you want to retrieve from Securonix SNYPR. |
The output contains a non-dictionary value.
The Sample - Securonix SNYPR - 2.1.0
playbook collection comes bundled with the Securonix SNYPR connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Securonix SNYPR connector.
Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.