Skip to content

Commit

Permalink
fix(Automation): add missing autogenerated documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
squioc committed Jan 9, 2024
1 parent 216a866 commit 2c1c669
Show file tree
Hide file tree
Showing 15 changed files with 472 additions and 31 deletions.
4 changes: 3 additions & 1 deletion _shared_content/automate/library/atlassian-jira.md
Original file line number Diff line number Diff line change
Expand Up @@ -47,12 +47,14 @@ Create issue in JIRA
| `project_key` | `string` | Project key (e.g. 'PRJ') |
| `summary` | `string` | Summary of an issue (e.g. 'Fix a bug') |
| `issue_type` | `string` | Issue type (e.g. 'Task') |
| `description` | `object` | Description text in ADF (Atlassian Document Format) |
| `due_date` | `string` | Due date (e.g. '2023-10-31')' |
| `labels` | `string` | Comma-separated labels (e.g. 'devops,support') |
| `assignee` | `string` | Exact display name of an assignee (e.g. John Doe) |
| `reporter` | `string` | Exact display name of a reporter (e.g. Jane Doe) |
| `priority` | `string` | Issue priority (e.g. Highest) |
| `parent_key` | `string` | Key of a parent issue (e.g. PRJ-1) |
| `custom_fields` | `object` | JSON with custom fields (e.g. {"Some Field": "2"}) |


**Outputs**
Expand All @@ -64,4 +66,4 @@ Create issue in JIRA

## Extra

Module **`Atlassian JIRA` v1.0.4**
Module **`Atlassian JIRA` v1.1**
30 changes: 30 additions & 0 deletions _shared_content/automate/library/cato-networks.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
# Cato Networks

![Cato Networks](/assets/playbooks/library/cato-networks.png){ align=right width=150 }

Cato Networks is a software company providing solutions to protect cloud applications.

## Configuration

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `api_key` | `string` | Api key to interact with Cato API |
| `account_id` | `string` | Account Id (4 digits) to work with Cato API |

## Triggers

### Collect Cato SASE events

Trigger playbook to get Cato SASE information

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `intake_server` | `string` | Server of the intake server (e.g. 'https://intake.sekoia.io') |
| `intake_key` | `string` | Intake key to use when sending events |


## Extra

Module **`Cato Networks` v1.3**
4 changes: 2 additions & 2 deletions _shared_content/automate/library/crowdstrike.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@

## Triggers

### [ALPHA] Fetch new events from CrowdStrike Data replication
### Fetch new events from CrowdStrike Data replication

Forward Crowdstrike Falcon Data Replication events to Sekoia.io

Expand All @@ -35,4 +35,4 @@ Forward Crowdstrike Falcon Data Replication events to Sekoia.io

## Extra

Module **`CrowdStrike` v1.6.4**
Module **`CrowdStrike` v1.8.2**
3 changes: 2 additions & 1 deletion _shared_content/automate/library/darktrace.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,10 @@ Get the newest logs from Darktrace Threat Visualizer
| `frequency` | `integer` | Batch frequency in seconds |
| `intake_server` | `string` | Server of the intake server (e.g. 'https://intake.sekoia.io') |
| `intake_key` | `string` | Intake key to use when sending events |
| `verify_certificate` | `boolean` | Is the server certificate verified |
| `ratelimit_per_minute` | `integer` | The number of requests allowed to the API in one minute |


## Extra

Module **`Darktrace` v1.3.1**
Module **`Darktrace` v1.5.1**
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Jumpcloud Directory Insights Connector
# Jumpcloud Directory Insights

![Jumpcloud Directory Insights Connector](/assets/playbooks/library/jumpcloud-directory-insights.png){ align=right width=150 }
![Jumpcloud Directory Insights](/assets/playbooks/library/jumpcloud-directory-insights.png){ align=right width=150 }

Directory Insights allows you to read event logs, view activity in your directory, and monitor user authentications to the console, RADIUS, LDAP, and SSO apps. Directory Insights analyzes the audit trails that lead to critical events so you know the what, where, when, how, and who of your directory activities.

Expand All @@ -13,7 +13,7 @@ Directory Insights allows you to read event logs, view activity in your director

## Triggers

### Jumpcloud Directory Insights Connector
### [BETA] Jumpcloud Directory Insights Connector



Expand All @@ -30,4 +30,4 @@ Directory Insights allows you to read event logs, view activity in your director

## Extra

Module **`Jumpcloud Directory Insights` v1.4**
Module **`Jumpcloud Directory Insights` v1.6.1**
18 changes: 17 additions & 1 deletion _shared_content/automate/library/microsoft-azure.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,22 @@ This module accepts no configuration.

## Triggers

### [BETA] Collect Azure Blob Storage events

Trigger p laybook to get Azure Blob Storage events information

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `container_name` | `string` | Container name to interact with Azure Blob Storage |
| `account_name` | `string` | Account name of the Azure Blob Storage |
| `account_key` | `string` | Account key of the Azure Blob Storage |
| `intake_server` | `string` | Server of the intake server (e.g. 'https://intake.sekoia.io') |
| `intake_key` | `string` | Intake key to use when sending events |
| `chunk_size` | `integer` | The max size of chunks for the batch processing |


### Consume Eventhub messages

Consume messages from Microsoft Azure Eventhub
Expand All @@ -30,4 +46,4 @@ Consume messages from Microsoft Azure Eventhub

## Extra

Module **`Microsoft Azure` v1.11**
Module **`Microsoft Azure` v2.2.3**
156 changes: 156 additions & 0 deletions _shared_content/automate/library/microsoft-entra-id.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,156 @@
# Microsoft Entra ID

![Microsoft Entra ID](/assets/playbooks/library/microsoft-entra-id.svg){ align=right width=150 }

[Microsoft Entra ID (formely Azure Active Directory)](https://azure.microsoft.com/en-us/services/active-directory/#overview) is an enterprise identity service that provides single sign-on, multifactor authentication, and conditional access to guard against 99.9 percent of cybersecurity attacks.

## Configuration

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `tenant_id` | `string` | ID of the Microsoft Entra ID tenant |
| `client_id` | `string` | Client ID. An application needs to be created in the Azure Portal and assigned relevent permissions. Its Client ID should then be used in this configuration. |
| `client_secret` | `string` | Client Secret associated with the registered application. Admin Consent has to be granted to the application for it to work. |
| `username` | `string` | The username of the delegated account used for some administrative tasks (eg: reset password) |
| `password` | `string` | The password of the delegated account used for some administrative tasks (eg: reset password) |

## Actions

### Delete app

Delete an app in azure AD. Requires the Application.ReadWrite.OwnedBy or Application.ReadWrite.All.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | Object ID of the app. |

### Disable User

Disable an Azure Active Directory user. Requires the User.ReadWrite.All permission.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | ID of the user. id or userPrincipalName should be specified. |
| `userPrincipalName` | `string` | Principal Name of the user. id or userPrincipalName should be specified. |

### Enable User

Enable an Azure Active Directory user. Requires the User.ReadWrite.All permission.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | ID of the user. id or userPrincipalName should be specified. |
| `userPrincipalName` | `string` | Principal Name of the user. id or userPrincipalName should be specified. |

### Get SignIns

Get the last sign ins of an Azure AD user. Requires the AuditLog.Read.All and Directory.Read.All permissions.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | ID of the user. id or userPrincipalName should be specified. |


**Outputs**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `signIns` | `array` | |

### Get User

Get information about an Azure Active Directory user. Requires the User.Read.All permission.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | ID of the user. id or userPrincipalName should be specified. |
| `userPrincipalName` | `string` | Principal Name of the user. id or userPrincipalName should be specified. |


**Outputs**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | |
| `accountEnabled` | `boolean` | |
| `assignedLicenses` | `array` | |
| `city` | `string` | |
| `companyName` | `string` | |
| `country` | `string` | |
| `createdDateTime` | `string` | |
| `creationType` | `string` | |
| `deletedDateTime` | `string` | |
| `department` | `string` | |
| `displayName` | `string` | |
| `identities` | `array` | |
| `jobTitle` | `string` | |
| `lastPasswordChangeDateTime` | `string` | |
| `mail` | `string` | |
| `mobilePhone` | `string` | |
| `userPrincipalName` | `string` | |

### Get User Authentication Methods

Get information about an user's authentication methods (such as their MFA status). Requires the UserAuthenticationMethod.Read.All permission.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | ID of the user. id or userPrincipalName should be specified. |
| `userPrincipalName` | `string` | Principal Name of the user. id or userPrincipalName should be specified. |


**Outputs**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | |
| `userPrincipalName` | `string` | |
| `userDisplayName` | `string` | |
| `isSsprRegistered` | `boolean` | |
| `isSsprEnabled` | `boolean` | |
| `isSsprCapable` | `boolean` | |
| `isMfaRegistered` | `boolean` | |
| `isMfaCapable` | `boolean` | |
| `isPasswordlessCapable` | `boolean` | |
| `methodsRegistered` | `array` | |
| `defaultMfaMethod` | `string` | |

### Reset User Password

Reset a user's password. You will need UserAuthenticationMethod.ReadWrite.All deleguated permission. And to disable the MFA authentication in your azure AD

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | ID of the user. id or userPrincipalName should be specified. |
| `userPrincipalName` | `string` | Principal Name of the user. id or userPrincipalName should be specified. |
| `userNewPassword` | `string` | New password, required to reset the old one of course. |

### Revoke Sign in

Invalidates all the refresh tokens issued to applications for a user. Requires the User.ReadWrite.All or Directory.ReadWrite.All permissions.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | ID of the app. |
| `userPrincipalName` | `string` | Principal Name of the user. id or userPrincipalName should be specified. |


## Extra

Module **`Microsoft Entra ID` v2.7**
53 changes: 53 additions & 0 deletions _shared_content/automate/library/microsoft-windows-server.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
# Microsoft Windows Server

![Microsoft Windows Server](/assets/playbooks/library/microsoft-windows-server.png){ align=right width=150 }

Microsoft Windows Server is an operating system designed for server-based computing, offering robust server management, data storage, and networking capabilities for businesses and enterprises, facilitating diverse workloads and IT operations.

## Configuration

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `server` | `string` | Remote server dns name or IP address |
| `username` | `string` | Username to do authentication on remote server |
| `password` | `string` | Password to do authentication on remote server |

## Actions

### Change User Password

Changes specified user password on remote server

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `user_to_update` | `string` | Username you want to change password for |
| `new_password` | `string` | New password for user |

### Disable Users

Disable specified users on remote server

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `users` | `array` | List of user names to disable. `sids` or `users` must be specified |
| `sids` | `array` | List of SID`s to disable. `sids` or `users` must be specified |

### Enable Users

Enable specified users on remote server

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `users` | `array` | List of user names to enable. `sids` or `users` must be specified |
| `sids` | `array` | List of SID`s to enable. `sids` or `users` must be specified |


## Extra

Module **`Microsoft Windows Server` v1.0.3**
7 changes: 4 additions & 3 deletions _shared_content/automate/library/salesforce.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,25 +8,26 @@ Salesforce provides users comprehensive tools to manage customer data, automate

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `org_type` | `string` | Organization type. Might be one of the following: 'production', 'sandbox', 'trial', 'developer'. Default is 'production' |
| `client_id` | `string` | Client id to interact with salesforce API |
| `client_secret` | `string` | Client secret to interact with salesforce API |
| `base_url` | `string` | Url of salesforce instance. Consists of https://<instance>.salesforce.com |

## Triggers

### Collect Salesforce events
### [BETA] Collect Salesforce events

Trigger playbook to get Salesforce information

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `ratelimit_per_minute` | `integer` | Maximum number of requests per minute |
| `intake_server` | `string` | Server of the intake server (e.g. 'https://intake.sekoia.io') |
| `intake_key` | `string` | Intake key to use when sending events |
| `chunk_size` | `integer` | The max size of chunks for the batch processing |


## Extra

Module **`Salesforce` v1.2.5**
Module **`Salesforce` v1.4.11**
Loading

0 comments on commit 2c1c669

Please sign in to comment.