Securonix

Details
Content
Dependencies
Version History

Use the Securonix integration to manage incidents and watchlists.

The Securonix platform collects massive volumes of data in real-time, detects advanced threats using innovative machine learning algorithms, enables you to quickly investigate the alerts that matter the most, and provides actionable security intelligence for an automated response.

Pack use-cases:

Ingest newly created incidents from Securonix.
Ingest newly created threats from Securonix.
Get, update and create Securonix incidents, add comments and perform actions on the Securonix incidents.
Get, update, create and delete records from the whitelist.
Get, update, create and delete records from the lookup table.
Get, update, and create records from the watchlist.

Note: Support for this pack was moved to Securonix as of 05/25/2022

Classifiers

Name	Description
Securonix Incident - Incoming Mapper	Securonix incident incoming mapper.
Securonix Threat - Incoming Mapper	Securonix Threat Incoming Mapper

Incident Fields

Name	Description
Securonix Violation Count	Total number of Violations related to specific threat.
Securonix Tenant Color	Tenant color.
Securonix Reason	The reason that the incident was created. Usually includes the policy name and/or possible threat name.
Securonix Close Incident	Whether to close incident on Securonix after fetching it in XSOAR or not.
Securonix Entity	The incident entity.
Securonix Violator ID	Incident violator ID.
Securonix Resource Type	Resource type.
Securonix Workflow Name	The incident workflow name.
Securonix Violator Text	Incident violator text.
Securonix Threat Generation Time	Time that the threat was generated in Securonix.
Securonix Incident Type	Incident type.
Securonix Incident Status	Incident status.
Securonix Watchlisted	Whether the incident is on a watchlist.
Securonix Last Update Date	Last update date of the incident in Epoch time.
Securonix ResourceGroup Name	Resource group name.
Securonix Tenant ID	Tenant ID.
Securonix Status Completed
Securonix Violator Sub Text	Incident violator sub text.
Securonix Violator	Violator.
Securonix Bulk Action Allowed	Whether bulk action is allowed or not.
Securonix Tenant Short Code	Short code of the tenant.
Securonix Category	Threat category.
Securonix Is Whitelisted	Whether the incident is added to the allow list.
Securonix Case Create Time	Case event start time.
Securonix Case Event End Time	Case event end time.
Securonix Risk Score	The incident risk score.
Securonix Violation Spotter Query	Spotter query to fetch the related violations.
Securonix Sandbox Policy
Securonix Parent Case ID	Parent case ID of the incident.
Securonix Incident ID	Incident ID.
Securonix Policies	List of policies violated.
Securonix Entity ID	The entity ID.
Securonix Resource Name	Resource name.

Layouts

Name	Description
Securonix Incident Information	Securonix Incident Information
Securonix Threat	Layout for Securonix Threat Information.

Incident Types

Name	Description
Securonix Threat
Securonix Incident

Automations

Name	Description
SecuronixGetViolations	Gets a list of violations related to a specific threat from the context data and displays it in the layout.
SecuronixCloseHistoricalXSOARIncidents	Close historical XSOAR incidents that are already closed on Securonix. NOTE: This script will close all the XSOAR incidents which are created from Securonix integration and does not have incident type as "Securonix Incident" in the provided time frame.
UpdateSecuronixIncidentStatus	Update the status of the Securonix incident using the configuration provided in integration configuration.

Playbooks

Name	Description
Update Incident Status And Fetch Attachments - Securonix	This playbook fetches the attachments for the incident. Also, it updates the state of the Securonix incident based on the configuration provided in integration configuration.
Fetch Violations - Securonix	Gets a list of violation data.
Fetch All Violations - Securonix	Gets a list of violations with pagination using queryId parameter.

Integrations

Name	Description
Securonix (Partner Contribution)	Use the Securonix integration to manage incidents and watchlists.

Classifiers

Name	Description
Securonix Incident - Incoming Mapper	Securonix incident incoming mapper.
Securonix Threat - Incoming Mapper	Securonix Threat Incoming Mapper

Incident Fields

Name	Description
Securonix Violation Count	Total number of Violations related to specific threat.
Securonix Tenant Color	Tenant color.
Securonix Reason	The reason that the incident was created. Usually includes the policy name and/or possible threat name.
Securonix Close Incident	Whether to close incident on Securonix after fetching it in XSOAR or not.
Securonix Entity	The incident entity.
Securonix Violator ID	Incident violator ID.
Securonix Resource Type	Resource type.
Securonix Workflow Name	The incident workflow name.
Securonix Violator Text	Incident violator text.
Securonix Threat Generation Time	Time that the threat was generated in Securonix.
Securonix Incident Type	Incident type.
Securonix Incident Status	Incident status.
Securonix Watchlisted	Whether the incident is on a watchlist.
Securonix Last Update Date	Last update date of the incident in Epoch time.
Securonix ResourceGroup Name	Resource group name.
Securonix Tenant ID	Tenant ID.
Securonix Status Completed
Securonix Violator Sub Text	Incident violator sub text.
Securonix Violator	Violator.
Securonix Bulk Action Allowed	Whether bulk action is allowed or not.
Securonix Tenant Short Code	Short code of the tenant.
Securonix Category	Threat category.
Securonix Is Whitelisted	Whether the incident is added to the allow list.
Securonix Case Create Time	Case event start time.
Securonix Case Event End Time	Case event end time.
Securonix Risk Score	The incident risk score.
Securonix Violation Spotter Query	Spotter query to fetch the related violations.
Securonix Sandbox Policy
Securonix Parent Case ID	Parent case ID of the incident.
Securonix Incident ID	Incident ID.
Securonix Policies	List of policies violated.
Securonix Entity ID	The entity ID.
Securonix Resource Name	Resource name.

Incident Types

Name	Description
Securonix Threat
Securonix Incident

Automations

Name	Description
SecuronixGetViolations	Gets a list of violations related to a specific threat from the context data and displays it in the layout.
SecuronixCloseHistoricalXSOARIncidents	Close historical XSOAR incidents that are already closed on Securonix. NOTE: This script will close all the XSOAR incidents which are created from Securonix integration and does not have incident type as "Securonix Incident" in the provided time frame.
UpdateSecuronixIncidentStatus	Update the status of the Securonix incident using the configuration provided in integration configuration.

Playbooks

Name	Description
Update Incident Status And Fetch Attachments - Securonix	This playbook fetches the attachments for the incident. Also, it updates the state of the Securonix incident based on the configuration provided in integration configuration.
Fetch Violations - Securonix	Gets a list of violation data.
Fetch All Violations - Securonix	Gets a list of violations with pagination using queryId parameter.

Integrations

Name	Description
Securonix (Partner Contribution)	Use the Securonix integration to manage incidents and watchlists.

Required Content Packs (3)

Pack Name	Pack By
Common Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (4)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

2.0.1 - 4851609 (March 19, 2023)

Incident Types

Securonix Threat
Updated the default violation playbook.

Integrations

Added a new command securonix-lookup-table-entries-delete to delete specific entries from the lookup table.
Added support for specifying expiration time for a lookup table entry in the securonix-lookup-table-entry-add command.
Added support for 2 new parameters ‘sort’ and ‘order’ to sort the lookup table entries in the securonix-lookup-table-entries-list command.
Added support for pagination in fetching violations in the playbook.
Updated the Docker image to: demisto/python3:3.10.10.49934.

Playbooks

New: Fetch Violations - Securonix

Added a playbook to get a list of violation data. (Available from Cortex XSOAR 6.5.0).

New: Fetch All Violations - Securonix

Added a playbook to get a list of violations with pagination using queryId parameter. (Available from Cortex XSOAR 6.5.0).

Scripts

SecuronixGetViolations

Updated the script to show the latest 200 violation events in the "Violation Events" panel of the "Securonix Threat" incident type's layout.
Updated the Docker image to: demisto/python3:3.10.10.49934.

SecuronixCloseHistoricalXSOARIncidents

Updated the description of the script.
Updated the Docker image to: demisto/python3:3.10.10.49934.

Related pull requests:
- 25374
- 25263

Download

2.0.0 - 4746941 (March 5, 2023)

Incident Fields

Securonix Risk Score
Securonix Category
Securonix Case Create Time
Securonix Tenant Color
Securonix Resource Name
Securonix Violation Count
Securonix Incident ID
Securonix Bulk Action Allowed
Securonix Parent Case ID
Securonix Entity ID
Securonix Policies
Securonix Sandbox Policy
Securonix Watchlisted
Securonix Incident Type
Securonix ResourceGroup Name
Securonix Status Completed
Securonix Case Event End Time
Securonix Reason
Securonix Last Update Date
Securonix Close Incident
Securonix Violator
Securonix Violation Spotter Query
Securonix Is Whitelisted
Securonix Tenant ID
Securonix Tenant Short Code
Securonix Entity
Securonix Workflow Name
Securonix Violator Text
Securonix Threat Generation Time
Securonix Violator ID
Securonix Violator Sub Text
Securonix Incident Status
Securonix Resource Type

Incident Types

Securonix Incident
Securonix Threat

Integrations

Securonix

Added support for Incident Mirroring. With version, 2.0.0 users can mirror the incidents comments, attachments & states across the platforms(Securonix & XSOAR).
Added support for fetching threats from Securonix which will fetch Securonix Threats (with related violations) as XSOAR Incidents.
Added a configurable retry mechanism for fetching incidents and performing actions using commands.
Improved implementation of the token re-generation logic, now will generate a token every 24 hours instead of generating it for each API call.
Added support for CRUD operation on Securonix Whitelist.
securonix-whitelists-get
securonix-whitelist-entry-list
securonix-whitelist-entry-add
securonix-whitelist-entry-delete
securonix-whitelist-create
Added support for CRUD operation on Securonix Lookup tables.
securonix-lookup-table-config-and-data-delete
securonix-lookup-tables-list
securonix-lookup-table-entry-add
securonix-lookup-table-entries-list
securonix-lookup-table-create
Updated the Docker image to: demisto/python3:3.10.10.48392.

Layouts

New: Securonix Incident Information
Added a layout for Securonix Incident Information. (Available from Cortex XSOAR 6.5.0).
New: Securonix Threat
Added a layout for Securonix Threat Information. (Available from Cortex XSOAR 6.5.0).

Mappers

New: Securonix Threat - Incoming Mapper

Added a mapper to map the Securonix threat fields with custom fields. (Available from Cortex XSOAR 6.5.0).

New: Securonix Incident - Incoming Mapper

Added a mapper to map the Securonix incident fields with custom fields. (Available from Cortex XSOAR 6.5.0).

Playbooks

New: Update Incident Status And Fetch Attachments - Securonix

Added a playbook to fetch the attachments for the incident. Also, it updates the state of the Securonix incident based on the configuration provided in integration configuration. (Available from Cortex XSOAR 6.5.0).

New: Fetch Threat Violations - Securonix

Added a playbook to fetch violations related to threat. (Available from Cortex XSOAR 6.5.0).

Scripts

New: SecuronixCloseHistoricalXSOARIncidents

Added an automation script to close historical XSOAR incidents that are already closed on Securonix. (Available from Cortex XSOAR 6.5.0).

New: SecuronixGetViolations

Added an automation script to get a list of violations related to a specific threat from the context data and displays it in the layout. (Available from Cortex XSOAR 6.5.0).

New: UpdateSecuronixIncidentStatus

Added an automation script to update the status of the Securonix incident using the configuration provided in integration configuration. (Available from Cortex XSOAR 6.5.0).

Related pull requests:
- 24771
- 24989

Download

1.2.0 - R4718798 (March 1, 2023)

Integrations

Securonix

Updated the incident name created in the fetch-incidents command.
The incident name will be according to the Threat Model field. If it does not exist, it will be according to the Policy field.
If neither field exists, the incident name will be the incident ID combined with the violator ID.
This update is due to a change in the Securonix API and suggestions from the Securonix support team.
Updated the Docker image to: demisto/python3:3.10.4.30607.

Related pull requests:
- 19697

Download

1.1.12 - 3087003 (June 14, 2022)

Integrations

Securonix

Moved Pack support to partner.

Related pull requests:
- 19536
- 19197

Download

1.1.11 - 2836953 (April 28, 2022)

Integrations

Securonix

Fixed an issue with the tenant header in the REST API requests.
Updated the Docker image to: demisto/python3:3.10.4.28442.

Download

PUBLISHER

Securonix

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	September 9, 2020
Last Release	March 19, 2023

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.