Skip to content

Commit

Permalink
fix(documentation): update to the last version of automation libraries
Browse files Browse the repository at this point in the history
  • Loading branch information
squioc committed Oct 15, 2024
1 parent 395728b commit ae0fc02
Show file tree
Hide file tree
Showing 11 changed files with 106 additions and 25 deletions.
2 changes: 1 addition & 1 deletion _shared_content/automate/library/aws.md
Original file line number Diff line number Diff line change
Expand Up @@ -174,4 +174,4 @@ Get messages from SQS

## Extra

Module **`AWS` v1.31.5**
Module **`AWS` v1.31.6**
2 changes: 1 addition & 1 deletion _shared_content/automate/library/crowdstrike-falcon.md
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,4 @@ Enable detections on the provided IOCs: md5 / sha256 file hashes, IPv4/v6 addres

## Extra

Module **`CrowdStrike Falcon` v1.20.0**
Module **`CrowdStrike Falcon` v1.21.0**
2 changes: 1 addition & 1 deletion _shared_content/automate/library/crowdstrike.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,4 +34,4 @@ Forward Crowdstrike Falcon Data Replication events to Sekoia.io

## Extra

Module **`CrowdStrike` v1.10.1**
Module **`CrowdStrike` v1.10.2**
2 changes: 1 addition & 1 deletion _shared_content/automate/library/microsoft-azure.md
Original file line number Diff line number Diff line change
Expand Up @@ -81,4 +81,4 @@ Trigger playbook to get Azure Network Watcher events information

## Extra

Module **`Microsoft Azure` v2.5.3**
Module **`Microsoft Azure` v2.5.6**
17 changes: 3 additions & 14 deletions _shared_content/automate/library/microsoft-entra-id.md
Original file line number Diff line number Diff line change
Expand Up @@ -107,25 +107,14 @@ Get information about an user's authentication methods (such as their MFA status

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | ID of the user. id or userPrincipalName should be specified. |
| `userPrincipalName` | `string` | Principal Name of the user. id or userPrincipalName should be specified. |
| `userPrincipalName` | `string` | Principal name of the user, which may correspond to their Azure email address. |


**Outputs**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | |
| `userPrincipalName` | `string` | |
| `userDisplayName` | `string` | |
| `isSsprRegistered` | `boolean` | |
| `isSsprEnabled` | `boolean` | |
| `isSsprCapable` | `boolean` | |
| `isMfaRegistered` | `boolean` | |
| `isMfaCapable` | `boolean` | |
| `isPasswordlessCapable` | `boolean` | |
| `methodsRegistered` | `array` | |
| `defaultMfaMethod` | `string` | |
| `authenticationResults` | `array` | |

### Reset User Password

Expand Down Expand Up @@ -153,4 +142,4 @@ Invalidates all the refresh tokens issued to applications for a user. Requires t

## Extra

Module **`Microsoft Entra ID` v2.8.0**
Module **`Microsoft Entra ID` v2.8.4**
2 changes: 1 addition & 1 deletion _shared_content/automate/library/panda-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -401,4 +401,4 @@ Uninstalls protection from the specified devices.

## Extra

Module **`Panda Security` v1.23.0**
Module **`Panda Security` v1.23.1**
3 changes: 2 additions & 1 deletion _shared_content/automate/library/sekoia-io.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ A comment was added to an existing Alert

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `comment` | `object` | Alert comment (object containing comment uuid, content, author, date). |
| `file_path` | `string` | File path to the alert on disk. |
| `event_type` | `string` | Action that triggered this Sekoia.io Alert notification (could be for example “alert-created”, “alert-status-changed”, etc.) |
| `alert_uuid` | `string` | Unique identifier of the Alert (UUID string). |
Expand Down Expand Up @@ -1304,4 +1305,4 @@ Update a rule

## Extra

Module **`Sekoia.io` v2.64.1**
Module **`Sekoia.io` v2.64.4**
4 changes: 2 additions & 2 deletions _shared_content/automate/library/sentinelone.md
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ Collect activities and threats from SentinelOne

## Actions

### Create IOCs
### [BETA] Create IOCs

Push IOCs in the Threat Intelligence API of SentinelOne

Expand Down Expand Up @@ -227,4 +227,4 @@ Update a threat incident in SentinelOne

## Extra

Module **`SentinelOne` v1.18.3**
Module **`SentinelOne` v1.18.5**
34 changes: 33 additions & 1 deletion _shared_content/automate/library/sophos.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,39 @@ Query last IoCs from the Sophos Data lake
| `intake_server` | `string` | Server of the intake server (e.g. 'https://intake.sekoia.io') |
| `intake_key` | `string` | Intake key to use when sending events |

## Actions

### [BETA] Deisolate endpoint

Turn off endpoint isolation

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `endpoint_id` | `string` | Endpoint ID |

### [BETA] Isolate endpoint

Turn on endpoint isolation

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `endpoint_id` | `string` | Endpoint ID |

### [BETA] Run scan



**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `endpoint_id` | `string` | Endpoint ID |


## Extra

Module **`Sophos` v1.16.5**
Module **`Sophos` v1.17.1**
2 changes: 1 addition & 1 deletion _shared_content/automate/library/trellix.md
Original file line number Diff line number Diff line change
Expand Up @@ -53,4 +53,4 @@ Trigger playbook to get Trellix events information

## Extra

Module **`Trellix` v1.10.0**
Module **`Trellix` v1.10.3**
61 changes: 60 additions & 1 deletion _shared_content/automate/library/withsecure.md
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,24 @@ Add comment on Incident.
| --------- | ------- | --------------------------- |
| `items` | `array` | |

### Enumerate processes

Enumerate processes.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `organization_id` | `string` | UUID of an organization. |
| `target` | `string` | Device identifier on which action is created. |


**Outputs**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | |

### Isolate Device From Network

Isolate a device from network connections.
Expand All @@ -63,6 +81,47 @@ Isolate a device from network connections.
| `multistatus` | `array` | |
| `transactionId` | `string` | |

### Kill process

Kill process.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `organization_id` | `string` | UUID of an organization. |
| `target` | `string` | Device identifier on which action is created. |
| `match` | `string` | Strategy used to match processes (processId,processName,processNameRegex,processPath,processPathRegex) |
| `process_match_values` | `array` | List of values that are used to match process to kill. Depending on selected strategy it might be list of identifiers, names or regular expressions. |
| `process_memory_dump` | `boolean` | Whether to run memory dump on process before killing it. |
| `memory_dump_flag` | `string` | full - memory dump includes all accessible memory of process, pmem - only information necessary to capture process' stack traces |


**Outputs**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | |

### Kill thread

Kill thread.

**Arguments**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `organization_id` | `string` | UUID of an organization. |
| `target` | `string` | Device identifier on which action is created. |
| `thread_id` | `integer` | Thread ID |


**Outputs**

| Name | Type | Description |
| --------- | ------- | --------------------------- |
| `id` | `string` | |

### List Detections For Incident

List Detections For Incident.
Expand Down Expand Up @@ -156,4 +215,4 @@ Update status on Incident.

## Extra

Module **`WithSecure` v2.15.1**
Module **`WithSecure` v2.16.0**

0 comments on commit ae0fc02

Please sign in to comment.