SafeNet Trusted Access
This pack includes Cortex XSIAM content.
SafeNet Trusted Access prevents data breaches, helps with compliance with regulations, and supports migration to the cloud in a simple and secure fashion.
Thales SafeNet Trusted Access
- Details
- Content
- Dependencies
- Version History
SafeNet Trusted Access by Thales is an access management solution that allows organizations to centrally manage and secure access to business applications.
SafeNet Trusted Access
This pack includes Cortex XSIAM content.
SafeNet Trusted Access prevents data breaches, helps with compliance with regulations, and supports migration to the cloud in a simple and secure fashion.
- Pay attention: Timestamp parsing is supported for UTC +0000 format- yyyy-MM-ddTHH:mm:ss.fffZ (2019-12-04T21:37:20.2677353Z).
This pack enables you to
- Receive and process SafeNet Trusted Access alerts that indicate security risks to end user accounts.
- Apply security remediation actions on SafeNet Trusted Access.
For information about the configuration steps, visit our Help Documentation.
Automations
| Name | Description |
|---|---|
| STA-FetchListContent | This script will get the Unusual Activity Group from "sta_unusual_activity_group" List. |
| STA-PostProcessing | Post processing script to remove the user from the Unusual Activity Group on Close Form. |
Classifiers
| Name | Description |
|---|---|
SafeNet Trusted Access – Push Reject Alert Classifier | Deprecated - Please use SafeNet Trusted Access – Alert Classifier instead. |
SafeNet Trusted Access – Alert Classifier | Classifies SafeNet Trusted Access alerts. |
SafeNet Trusted Access – Push Reject Alert Mapper | Deprecated - Please use SafeNet Trusted Access – Alert Mapper instead. |
SafeNet Trusted Access – Alert Mapper | Maps incoming SafeNet Trusted Access alert fields. |
Incident Fields
| Name | Description |
|---|---|
SafeNet Trusted Access - User in Unusual Activity Group (Hours) | The amount of time in hours for which the user remains in the Unusual Activity Group. |
SafeNet Trusted Access - Instance Name | Name of the SafeNet Trusted Access integration instance. |
SafeNet Trusted Access - Remove User from Unusual Activity Group | If no option is selected, you need to remove user from the group manually. |
SafeNet Trusted Access - Username | Username of the user. |
SafeNet Trusted Access - Unusual Activity Group | Name of the Unusual Activity Group. |
Incident Types
| Name | Description |
|---|---|
SafeNet Trusted Access Push Reject Alert | |
SafeNet Trusted Access Account Lockout Alert |
Integrations
| Name | Description |
|---|---|
| Thales SafeNet Trusted Access (Partner Contribution) | This integration enables you to process alerts from SafeNet Trusted Access (STA) indicating security risks to end user accounts, and apply security remediation actions on SafeNet Trusted Access through security orchestration playbooks. |
Layouts
| Name | Description |
|---|---|
SafeNet Trusted Access - Incident Layout | SafeNet Trusted Access Alert Incident Layout |
SafeNet Trusted Access – Account Lockout Incident Layout | SafeNet Trusted Access incident layout for lockout alert. |
Playbooks
| Name | Description |
|---|---|
| SafeNet Trusted Access - Add to Unusual Activity Group | This playbook adds the user to a group that was created to identify unusual activity. SafeNet Trusted Access policies can be configured to take this into account and provide stronger protection when handling access events from users who are members of the group. The user is added to this group for a configurable period of time. |
| SafeNet Trusted Access - Terminate User SSO Sessions | This playbook terminates user SSO sessions so that upon the next login attempt following the unlocking of the account, authentication is required. |
Automations
| Name | Description |
|---|---|
| STA-FetchListContent | This script will get the Unusual Activity Group from "sta_unusual_activity_group" List. |
| STA-PostProcessing | Post processing script to remove the user from the Unusual Activity Group on Close Form. |
Classifiers
| Name | Description |
|---|---|
SafeNet Trusted Access – Push Reject Alert Classifier | Deprecated - Please use SafeNet Trusted Access – Alert Classifier instead. |
SafeNet Trusted Access – Alert Classifier | Classifies SafeNet Trusted Access alerts. |
SafeNet Trusted Access – Push Reject Alert Mapper | Deprecated - Please use SafeNet Trusted Access – Alert Mapper instead. |
SafeNet Trusted Access – Alert Mapper | Maps incoming SafeNet Trusted Access alert fields. |
Incident Fields
| Name | Description |
|---|---|
SafeNet Trusted Access - Unusual Activity Group | Name of the Unusual Activity Group. |
SafeNet Trusted Access - User in Unusual Activity Group (Hours) | The amount of time in hours for which the user remains in the Unusual Activity Group. |
SafeNet Trusted Access - Remove User from Unusual Activity Group | If no option is selected, you need to remove user from the group manually. |
SafeNet Trusted Access - Instance Name | Name of the SafeNet Trusted Access integration instance. |
Incident Types
| Name | Description |
|---|---|
SafeNet Trusted Access Push Reject Alert | |
SafeNet Trusted Access Account Lockout Alert |
Integrations
| Name | Description |
|---|---|
| Thales SafeNet Trusted Access Event Collector | Retrieve access, authentication, and audit logs and store them on a Security Information and Event Management (SIEM) system, local repository, or syslog file server. You can retrieve the logs only for the tenant that is associated with the API key, or for a direct or delegated child of that tenant. |
| Thales SafeNet Trusted Access (Partner Contribution) | This integration enables you to process alerts from SafeNet Trusted Access (STA) indicating security risks to end user accounts, and apply security remediation actions on SafeNet Trusted Access through security orchestration playbooks. |
Modeling Rules
| Name | Description |
|---|---|
SafeNetTrustedAccess Modeling Rule |
Parsing Rules
| Name | Description |
|---|---|
safenet_trusted_access_parsing_rule |
Playbooks
| Name | Description |
|---|---|
| SafeNet Trusted Access - Terminate User SSO Sessions | This playbook terminates user SSO sessions so that upon the next login attempt following the unlocking of the account, authentication is required. |
| SafeNet Trusted Access - Add to Unusual Activity Group | This playbook adds the user to a group that was created to identify unusual activity. SafeNet Trusted Access policies can be configured to take this into account and provide stronger protection when handling access events from users who are members of the group. The user is added to this group for a configurable period of time. |
Required Content Packs (3)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Common Types | By: Cortex XSOAR |
Optional Content Packs (0)
| Pack Name | Pack By |
|---|
All level dependencies (5)
| Pack Name | Pack By |
|---|---|
| Cortex REST API | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Common Types | By: Cortex XSOAR |
| Aggregated Scripts | By: Cortex XSOAR |
2.0.3 - 2641705 (March 24, 2022)
Integrations
Thales SafeNet Trusted Access
- Documentation and metadata improvements.
2.0.2 - 2303329 (January 25, 2022)
Incident Fields
- SafeNet Trusted Access - Username
Maintenance and stability enhancements.
2.0.1 - 2262088 (January 16, 2022)
Integrations
Thales SafeNet Trusted Access
- Documentation and metadata improvements.
- Updated Product display name.
2.0.0 - R2146019 (December 21, 2021)
Incident Fields
- SafeNet Trusted Access - Unusual Activity Group
- SafeNet Trusted Access - Username
- SafeNet Trusted Access - User in Unusual Activity Group (Hours)
- SafeNet Trusted Access - Remove User from Unusual Activity Group
- SafeNet Trusted Access - Instance Name
Incident Types
- SafeNet Trusted Access Account Lockout Alert
- SafeNet Trusted Access Push Reject Alert
- Breaking Change: Updated SafeNet Trusted Access Alert name to SafeNet Trusted Access Push Reject Alert.
Integrations
SafeNet Trusted Access
- Updated the Docker image to: demisto/python3:3.9.8.24399.
Added 5 commands:
- sta-get-application-list
- sta-get-application-info
- sta-get-user-applications
- sta-get-user-sessions
- sta-delete-user-sessions
Classifier
- SafeNet Trusted Access – Alert Classifier
- SafeNet Trusted Access – Alert Mapper
- Breaking Change: Deprecated SafeNet Trusted Access – Push Reject Alert Classifier and SafeNet Trusted Access – Push Reject Alert Mapper.
Playbooks
Updated: SafeNet Trusted Access - Add to Unusual Activity Group
- Breaking Change: Updated input parameters for SafeNet Trusted Access - Add to Unusual Activity Group playbook.
New: SafeNet Trusted Access - Terminate User SSO Sessions
- This playbook terminates user SSO sessions so that upon the next login attempt following the unlocking of the account, authentication is required. (Available from Cortex XSOAR 6.0.0).
Scripts
STA-PostProcessing
STA-FetchListContent
1.0.2 - 7813647 (September 28, 2021)
Integrations
SafeNet Trusted Access
- Updated configuration guide links.
2.0.44 - 4761438 (September 4, 2025)
- 41158
Download
Integrations
Thales SafeNet Trusted Access Event Collector
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
Scripts
STA-FetchListContent
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
STA-PostProcessing
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
- 41158
Download
2.0.43 - R3392471 (May 13, 2025)
- 39144
Download
Integrations
Thales SafeNet Trusted Access
- Metadata and documentation improvements.
Thales SafeNet Trusted Access Event Collector
- Metadata and documentation improvements.
Scripts
STA-PostProcessing
- Metadata and documentation improvements.
STA-FetchListContent
- Metadata and documentation improvements.
- 39144
Download
2.0.41 - 1748140 (December 4, 2024)
- 37528
- 37524
- 37525
- 37526
- 37527
Download
Integrations
Thales SafeNet Trusted Access Event Collector
- Updated the Docker image to: demisto/python3:3.11.10.115186.
Scripts
STA-PostProcessing
- Updated the Docker image to: demisto/python3:3.11.10.115186.
STA-FetchListContent
- Updated the Docker image to: demisto/python3:3.11.10.115186.
- 37528
- 37524
- 37525
- 37526
- 37527
Download
2.0.39 - R1164474 (July 10, 2024)
- 33675
Download
Integrations
Thales SafeNet Trusted Access Event Collector
- Updated the Docker image to: demisto/python3:3.10.14.91134.
Scripts
STA-FetchListContent
- Updated the Docker image to: demisto/python3:3.10.14.90585.
STA-PostProcessing
- Updated the Docker image to: demisto/python3:3.10.14.90585.
- 33675
Download
2.0.12 - 5189071 (May 4, 2023)
- 26246
Download
Integrations
Thales SafeNet Trusted Access Event Collector
- Improved the fetch-events command by ensuring that all events are successfully sent to the XSIAM server prior to setting the details of the last run within the event collector's scope.
- Updated the Docker image to: demisto/python3:3.10.11.56082.
- 26246
Download
2.0.10 - R4718798 (March 1, 2023)
- 24749
Download
Integrations
Thales SafeNet Trusted Access
- Updated the pack category to Authentication & Identity Management.
- Updated the Docker image to: demisto/python3:3.10.10.48392.
Thales SafeNet Trusted Access Event Collector
- Updated the pack category to Authentication & Identity Management.
- Updated the Docker image to: demisto/python3:3.10.10.48392.
- 24749
Download
2.0.4 - R3917401 (October 26, 2022)
- 20151
Download
Integrations
New: Thales SafeNet Trusted Access Event Collector
Retrieve access, authentication, and audit logs and store them on a Security Information and Event Management (SIEM) system, local repository, or syslog file server. You can retrieve the logs only for the tenant that is associated with the API key, or for a direct or delegated child of that tenant. (Available from Cortex XSOAR 6.8.0).
Modeling Rules
New: SafeNetTrustedAccess Modeling Rule
Added the Auth and Audit modeling rules. (Available from Cortex XSOAR 6.8.0).
- 20151
Download
2.0.3 - 2641705 (March 24, 2022)
Integrations
Thales SafeNet Trusted Access
- Documentation and metadata improvements.
2.0.2 - 2316504 (January 27, 2022)
Incident Fields
- SafeNet Trusted Access - Username
Maintenance and stability enhancements.
Integrations
Thales SafeNet Trusted Access
- Documentation and metadata improvements.
- Updated Product display name.
2.0.0 - R2146019 (December 21, 2021)
Incident Fields
- SafeNet Trusted Access - Unusual Activity Group
- SafeNet Trusted Access - Username
- SafeNet Trusted Access - User in Unusual Activity Group (Hours)
- SafeNet Trusted Access - Remove User from Unusual Activity Group
- SafeNet Trusted Access - Instance Name
Incident Types
- SafeNet Trusted Access Account Lockout Alert
- SafeNet Trusted Access Push Reject Alert
- Breaking Change: Updated SafeNet Trusted Access Alert name to SafeNet Trusted Access Push Reject Alert.
Integrations
SafeNet Trusted Access
- Updated the Docker image to: demisto/python3:3.9.8.24399.
Added 5 commands:
- sta-get-application-list
- sta-get-application-info
- sta-get-user-applications
- sta-get-user-sessions
- sta-delete-user-sessions
Classifier
- SafeNet Trusted Access – Alert Classifier
- SafeNet Trusted Access – Alert Mapper
- Breaking Change: Deprecated SafeNet Trusted Access – Push Reject Alert Classifier and SafeNet Trusted Access – Push Reject Alert Mapper.
Playbooks
Updated: SafeNet Trusted Access - Add to Unusual Activity Group
- Breaking Change: Updated input parameters for SafeNet Trusted Access - Add to Unusual Activity Group playbook.
New: SafeNet Trusted Access - Terminate User SSO Sessions
- This playbook terminates user SSO sessions so that upon the next login attempt following the unlocking of the account, authentication is required. (Available from Cortex XSOAR 6.0.0).
Scripts
STA-PostProcessing
STA-FetchListContent
1.0.2 - 7813647 (September 28, 2021)
Integrations
SafeNet Trusted Access
- Updated configuration guide links.
PUBLISHER
PLATFORMS
Cortex XSOARCortex XSIAM
INFO
| Certification | Certified | Read more |
| Supported By | Partner | |
| Created | September 9, 2021 | |
| Last Release | April 27, 2026 |
WORKS WITH THE FOLLOWING INTEGRATIONS:
