Securonix SNYPR v2.2.0

About the connector

Securonix SNYPR is an open and modular next-generation security intelligence platform that combines log management, security information and event management, user and entity behavior analytics and fraud detection, serving as a foundation for a broad portfolio of specialized security analytics solutions.

This document provides information about the Securonix SNYPR connector, which facilitates automated interactions, with a Securonix SNYPR server using FortiSOAR™ playbooks. Add the Securonix SNYPR connector as a step in FortiSOAR™ playbooks and perform automated operations with Securonix SNYPR.

Version information

Connector Version: 2.2.0

Authored By: Fortinet

Certified: No

Release Notes for version 2.2.0

Following enhancements have been made to the Securonix SNYPR connector in version 2.2.0:

• Added data ingestion support to ingest Securonix incidents as alerts in FortiSOAR.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-securonix-snypr

Prerequisites to configuring the connector

• You must have the credentials of Securonix SNYPR server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Securonix SNYPR server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Securonix SNYPR connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

You can use the following automated operations in playbooks and also use the annotations to access operations:

operation: Add Comment

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "messages": [],
    "result": ""
}

operation: Create Incident

Input parameters

Output

The output contains the following populated JSON schema:

{
    "totalIncidents": "",
    "incidentItems": [
        {
            "violatorText": "",
            "lastUpdateDate": "",
            "violatorId": "",
            "incidentType": "",
            "incidentId": "",
            "incidentStatus": "",
            "riskscore": "",
            "assignedUser": "",
            "priority": "",
            "reason": [],
            "violatorSubText": "",
            "entity": "",
            "workflowName": "",
            "url": "",
            "isWhitelisted": "",
            "watchlisted": "",
            "statusCompleted": ""
        }
    ]
}

operation: Check Task on Incident

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": [
        {
            "status": "",
            "actionName": "",
            "actionDetails": [
                {
                    "title": "",
                    "sections": {
                        "attributes": [
                            {
                                "required": "",
                                "attribute": "",
                                "displayName": "",
                                "attributeType": ""
                            }
                        ],
                        "sectionName": ""
                    }
                }
            ]
        }
    ],
    "status": "",
    "messages": []
}

operation: Get Available Threat Action

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "messages": [],
    "result": []
}

operation: Get Incident Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "messages": [],
    "result": {
        "data": {
            "totalIncidents": "",
            "incidentItems": [
                {
                    "violatorText": "",
                    "lastUpdateDate": "",
                    "violatorId": "",
                    "incidentType": "",
                    "incidentId": "",
                    "incidentStatus": "",
                    "riskscore": "",
                    "assignedUser": "",
                    "assignedGroup": "",
                    "priority": "",
                    "reason": [],
                    "violatorSubText": "",
                    "entity": "",
                    "workflowName": "",
                    "url": "",
                    "isWhitelisted": "",
                    "watchlisted": "",
                    "statusCompleted": ""
                }
            ]
        }
    }
}

operation: Get Incident Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "messages": [],
    "result": {
        "status": ""
    }
}

operation: Get Incident Workflow

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "messages": [],
    "result": {
        "workflow": ""
    }
}

operation: Get Possible Actions for Incident

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": [
        {
            "status": "",
            "actionName": "",
            "actionDetails": [
                {
                    "title": "",
                    "sections": {
                        "attributes": [
                            {
                                "required": "",
                                "attribute": "",
                                "displayName": "",
                                "attributeType": ""
                            }
                        ],
                        "sectionName": ""
                    }
                }
            ]
        }
    ],
    "status": "",
    "messages": []
}

operation: Get Risk Score

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Risk History

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Top Threats

Input parameters

Output

The output contains the following populated JSON schema:

{
    "Response": {
        "Date range": [],
        "Docs": [
            {
                "Threat model id": "",
                "Threat nodel name": "",
                "Criticality": "",
                "No of violator": "",
                "Description": "",
                "Generation time": ""
            }
        ],
        "Total records": ""
    }
}

operation: Get Top Violations

Input parameters

Output

The output contains the following populated JSON schema:

{
    "Response": {
        "Date range": [],
        "Docs": [
            {
                "Criticality": "",
                "No of violator": "",
                "Description": "",
                "Generation time": "",
                "Policy id": "",
                "Policy name": "",
                "Violation entity": "",
                "Policy category": "",
                "Threat indicator": ""
            }
        ],
        "Total records": ""
    }
}

operation: Get Top Violators

Input parameters

Output

The output contains the following populated JSON schema:

{
    "Response": {
        "Date range": [],
        "Docs": [
            {
                "Violator entity": "",
                "Department": "",
                "Name": "",
                "Risk score": "",
                "Generation time": ""
            }
        ],
        "Total records": ""
    }
}

operation: Get Workflows

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "result": {
        "workflows": [
            {
                "type": "",
                "value": "",
                "workflow": ""
            }
        ]
    },
    "status": "",
    "messages": []
}

operation: Get Workflow Default Assignee

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "messages": [],
    "result": {
        "type": "",
        "value": ""
    }
}

operation: List Incidents

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": {
        "data": {
            "totalIncidents": "",
            "incidentItems": [
                {
                    "violatorText": "",
                    "lastUpdateDate": "",
                    "violatorId": "",
                    "incidentType": "",
                    "incidentId": "",
                    "incidentStatus": "",
                    "riskscore": "",
                    "assignedUser": "",
                    "priority": "",
                    "reason": [],
                    "violatorSubText": "",
                    "entity": "",
                    "workflowName": "",
                    "url": "",
                    "isWhitelisted": "",
                    "watchlisted": ""
                }
            ]
        }
    }
}

operation: List All Peer Groups

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "peerGroups": {
        "peerGroup": [
            {
                "criticality": "",
                "name": ""
            }
        ]
    }
}

operation: List All Policies

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "policies": {
        "policy": [
            {
                "createdBy": "",
                "description": "",
                "criticality": "",
                "id": "",
                "createdOn": "",
                "name": "",
                "hql": ""
            }
        ]
    }
}

operation: List All Resource Groups

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "resourceGroups": {
        "resourceGroup": [
            {
                "name": "",
                "type": ""
            }
        ]
    }
}

operation: List All Users

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "users": {
        "user": [
            {
                "approverEmployeeId": "",
                "costCenterCode": "",
                "criticality": "",
                "department": "",
                "disableDate": "",
                "division": "",
                "email": "",
                "employeeId": "",
                "employeeType": "",
                "enableDate": "",
                "firstName": "",
                "hireDate": "",
                "jobCode": "",
                "lastName": "",
                "location": "",
                "managerEmployeeId": "",
                "managerFirstname": "",
                "managerLastname": "",
                "masked": "",
                "riskscore": "",
                "skipEncryption": "",
                "status": "",
                "title": ""
            }
        ]
    }
}

operation: Custom Query

Input parameters

Output

The output contains the following populated JSON schema:

{
    "available": "",
    "error": "",
    "events": [],
    "from": "",
    "offset": "",
    "query": "",
    "searchViolations": "",
    "to": "",
    "totalDocuments": ""
}

operation: Query Third Party Intelligence

Input parameters

Output

The output contains the following populated JSON schema:

{
    "available": "",
    "error": "",
    "events": [
        {
            "directImport": " ",
            "hour": "",
            "ignored": "",
            "invalid": "",
            "invalidEventAction": "",
            "tenantid": "",
            "tenantname": "",
            "u_id": "",
            "u_userid": "",
            "result": {
                "entry": [
                    {
                        "key": "",
                        "value": ""
                    }
                ]
            }
        }
    ],
    "from": "",
    "offset": "",
    "query": "",
    "searchViolations": "",
    "to": "",
    "totalDocuments": ""
}

operation: Query Violations

Input parameters

Output

The output contains a non-dictionary value.

operation: Query Users

Input parameters

Output

The output contains the following populated JSON schema:

{
    "available": "",
    "error": "",
    "events": [
        {
            "directImport": "",
            "hour": "",
            "ignored": "",
            "invalid": "",
            "invalidEventAction": "",
            "tenantid": "",
            "tenantname": "",
            "u_id": "",
            "u_userid": "",
            "result": {
                "entry": [
                    {
                        "key": "",
                        "value": ""
                    }
                ]
            }
        }
    ],
    "from": "",
    "offset": "",
    "query": "",
    "searchViolations": "",
    "to": "",
    "totalDocuments": ""
}

operation: Query Watchlist

Input parameters

Output

The output contains the following populated JSON schema:

{
    "available": "",
    "error": "",
    "events": [
        {
            "directImport": "",
            "hour": "",
            "ignored": "",
            "invalid": "",
            "invalidEventAction": "",
            "tenantid": "",
            "tenantname": "",
            "u_id": "",
            "u_userid": "",
            "result": {
                "entry": [
                    {
                        "key": "",
                        "value": ""
                    }
                ]
            }
        }
    ],
    "from": "",
    "offset": "",
    "query": "",
    "searchViolations": "",
    "to": "",
    "totalDocuments": ""
}

operation: Task Action on Incident

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

Included playbooks

The Sample - Securonix SNYPR - 2.2.0 playbook collection comes bundled with the Securonix SNYPR connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Securonix SNYPR connector.

• Add Comment
• Check Task on Incident
• Create Incident
• Custom Query
• Get Available Threat Action
• Get Incident Details
• Get Incident Status
• Get Incident Workflow
• Get Possible Actions for Incident
• Get Risk History
• Get Risk Score
• Get Top Threats
• Get Top Violations
• Get Top Violators
• Get Workflow Default Assignee
• Get Workflows
• List All Peer Groups
• List All Policies
• List All Resource Groups
• List Incidents
• List Users
• Query Third Party Intelligence
• Query Users
• Query Violations
• Query Watchlist
• Take Action on Incident

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling incidents from Securonix SNYPR. Currently, incidents ingested from Securonix SNYPR is mapped to Alerts in FortiSOAR™. For more information on the Data Ingestion Wizard, see the Connectors Guide in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the Data Ingestion Wizard to seamlessly map the incoming Securonix SNYPR incidents to FortiSOAR™'s Alerts.

The Data Ingestion Wizard helps you to configure the scheduled pulling of data from Securonix SNYPR into FortiSOAR™. It also lets you pull some sample data from Securonix SNYPR using which you can define the mapping of data between Securonix SNYPR and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the Securonix SNYPR incidents.

1. To begin configuring data ingestion, click Configure Data Ingestion on the Securonix SNYPR connector's Configurations page.

   Click Let's Start by fetching some data, to open the Fetch Data screen.

   

   Sample data is required to create a field mapping between Securonix SNYPR data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.

2. On the Fetch Data screen, provide the configurations required to fetch incidents from Securonix SNYPR.

   Users can pull incidents from Securonix SNYPR by selecting the time and date, from Securonix SNYPR from the Fetch Incidents Since drop-down list, for which they want to retrieve incidents. Additionally, you can also specify a number in the Limit field, to limit the incident records being pulled from Securonix SNYPR.

   The fetched data is used to create a mapping between the incidents from Securonix SNYPR and FortiSOAR Alerts. Once you have completed specifying the configurations, click Fetch Data.

   

3. On the Field Mapping screen, map the fields of the ingested incidents Securonix SNYPR to the fields of a Alerts present in FortiSOAR™.

   To map a field, click the key in the sample data to add the Jinja value of the field. For example, to map the name parameter of an ingested incident from Securonix SNYPR to the Alert Name parameter of a FortiSOAR™ alert, click the Alert Name field and then click the name field to populate its keys:

   

   For more information on field mapping, see the Data Ingestion chapter in the Connectors Guide in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. (Optional) Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to Securonix SNYPR, so that the content gets pulled from the Securonix SNYPR integration into FortiSOAR™

   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.

   In the Configure Schedule Settings section, specify the Cron expression for the schedule. For example, if you want to pull data from Securonix SNYPR every day at 5 AM, click Daily, and in the minute, hour, and day of month boxes enter 0, 5, and * respectively. This means that the incidents will be pulled from Securonix SNYPR daily at 5:00 AM:

   

   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.