Skip to content

Commit 527cbcf

Browse files
thinkst-louisthinkst-louis
committed
Add Thinkst Canary Console integration
This is the first release of the Thinkst Canary Console integration into the market place. A connector was implemented to poll the Canary Console API to get the latests incidents from the Console. This is then translated into AlertInfo objects, which will generate cases. A 'Ping' action is added to check that the API credentials has been entered correctly, and that the API endpoint is reachable. A 'Acknowledge Console Alert' action is implemented, this can be used to acknowledge incidents on the Canary Console. Signed-off-by: Louis Peens <[email protected]>
1 parent cc14d70 commit 527cbcf

File tree

24 files changed

+2151
-0
lines changed

24 files changed

+2151
-0
lines changed

‎content/response_integrations/third_party/thinkst_canary/.python-version‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
3.11

‎content/response_integrations/third_party/thinkst_canary/__init__.py‎

Whitespace-only changes.

‎content/response_integrations/third_party/thinkst_canary/actions/AckAlert.py‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
from soar_sdk.ScriptResult import EXECUTION_STATE_COMPLETED, EXECUTION_STATE_FAILED
2+
from soar_sdk.SiemplifyAction import SiemplifyAction
3+
from soar_sdk.SiemplifyUtils import output_handler
4+
5+
from ..core.constants import (
6+
THINKST_DEFAULT_API_KEY,
7+
THINKST_DEFAULT_CONSOLE,
8+
THINKST_INTEGRATION_NAME,
9+
)
10+
from ..core.ThinkstManager import ThinkstActionManager, str_to_bool
11+
12+
13+
@output_handler
14+
def main():
15+
status = EXECUTION_STATE_COMPLETED
16+
result_value = False
17+
output_message = ""
18+
19+
siemplify = SiemplifyAction()
20+
21+
console_api_key = siemplify.extract_configuration_param(
22+
provider_name=THINKST_INTEGRATION_NAME,
23+
param_name="API Key",
24+
default_value=THINKST_DEFAULT_API_KEY,
25+
)
26+
if console_api_key == THINKST_DEFAULT_API_KEY:
27+
status = EXECUTION_STATE_FAILED
28+
output_message = "Please provide a valid API Key"
29+
siemplify.end(output_message, result_value, status)
30+
return
31+
32+
console_hash = siemplify.extract_configuration_param(
33+
provider_name=THINKST_INTEGRATION_NAME,
34+
param_name="Console Hash",
35+
default_value=THINKST_DEFAULT_CONSOLE,
36+
)
37+
if console_hash == THINKST_DEFAULT_CONSOLE:
38+
status = EXECUTION_STATE_FAILED
39+
output_message = "Please provide a valid Console Hash"
40+
siemplify.end(output_message, result_value, status)
41+
return
42+
43+
ssl_verify = siemplify.extract_configuration_param(
44+
provider_name=THINKST_INTEGRATION_NAME, param_name="Verify SSL"
45+
)
46+
47+
ssl = str_to_bool(ssl_verify)
48+
manager = ThinkstActionManager(console_api_key, console_hash, siemplify, ssl)
49+
status, output_message = manager.ack_alert()
50+
siemplify.end(output_message, True, status)
51+
52+
53+
if __name__ == "__main__":
54+
main()

‎content/response_integrations/third_party/thinkst_canary/actions/AckAlert.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
creator: Thinkst
2+
default_result_value: ''
3+
description: Set an alert as acknowledged on the Canary console
4+
dynamic_results_metadata:
5+
- result_example_path: null
6+
result_name: JsonResult
7+
show_result: true
8+
integration_identifier: THINKST
9+
name: Acknowledge Console Alert
10+
parameters: []
11+
script_result_name: ScriptResult

‎content/response_integrations/third_party/thinkst_canary/actions/Ping.py‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
from soar_sdk.ScriptResult import EXECUTION_STATE_COMPLETED, EXECUTION_STATE_FAILED
2+
from soar_sdk.SiemplifyAction import SiemplifyAction
3+
from soar_sdk.SiemplifyUtils import output_handler
4+
5+
from ..core.constants import (
6+
THINKST_DEFAULT_API_KEY,
7+
THINKST_DEFAULT_CONSOLE,
8+
THINKST_INTEGRATION_NAME,
9+
)
10+
from ..core.ThinkstManager import ThinkstActionManager, str_to_bool
11+
12+
13+
@output_handler
14+
def main():
15+
status = EXECUTION_STATE_COMPLETED
16+
result_value = False
17+
output_message = ""
18+
19+
siemplify = SiemplifyAction()
20+
21+
console_api_key = siemplify.extract_configuration_param(
22+
provider_name=THINKST_INTEGRATION_NAME,
23+
param_name="API Key",
24+
default_value=THINKST_DEFAULT_API_KEY,
25+
)
26+
if console_api_key == THINKST_DEFAULT_API_KEY:
27+
status = EXECUTION_STATE_FAILED
28+
output_message = "Please provide a valid API Key"
29+
siemplify.end(output_message, result_value, status)
30+
return
31+
32+
console_hash = siemplify.extract_configuration_param(
33+
provider_name=THINKST_INTEGRATION_NAME,
34+
param_name="Console Hash",
35+
default_value=THINKST_DEFAULT_CONSOLE,
36+
)
37+
if console_hash == THINKST_DEFAULT_CONSOLE:
38+
status = EXECUTION_STATE_FAILED
39+
output_message = "Please provide a valid Console Hash"
40+
siemplify.end(output_message, result_value, status)
41+
return
42+
43+
ssl_verify = siemplify.extract_configuration_param(
44+
provider_name=THINKST_INTEGRATION_NAME, param_name="Verify SSL"
45+
)
46+
47+
try:
48+
ssl = str_to_bool(ssl_verify)
49+
manager = ThinkstActionManager(console_api_key, console_hash, siemplify, ssl)
50+
ping_res = manager.ping()
51+
52+
if ping_res:
53+
output_message = f"Successfully connected to Canary Console '{console_hash}'."
54+
result_value = True
55+
else:
56+
output_message = f"Failed to connect to Canary Console '{console_hash}'."
57+
58+
except Exception as e:
59+
status = EXECUTION_STATE_FAILED
60+
output_message = f"Ping failed: {str(e)}"
61+
siemplify.LOGGER.exception(e)
62+
63+
siemplify.LOGGER.info(f"Action finished: {output_message}")
64+
siemplify.end(output_message, result_value, status)
65+
66+
67+
if __name__ == "__main__":
68+
main()

‎content/response_integrations/third_party/thinkst_canary/actions/Ping.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
creator: Thinkst
2+
default_result_value: ''
3+
description: Uses the /ping endpoint to verify that API key and console hash is correct
4+
dynamic_results_metadata:
5+
- result_example_path: null
6+
result_name: JsonResult
7+
show_result: true
8+
integration_identifier: THINKST
9+
name: Ping
10+
parameters: []
11+
script_result_name: ScriptResult

‎content/response_integrations/third_party/thinkst_canary/actions/__init__.py‎

Whitespace-only changes.

‎content/response_integrations/third_party/thinkst_canary/connectors/ThinkstAlertConnector.py‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# ==============================================================================
2+
# This connector retrieves Incidents from a Thinkst Canary Console and creates
3+
# alerts/cases in Google SecOps SOAR. Each Canary Incident generates one alert.
4+
# ==============================================================================
5+
import sys
6+
7+
from soar_sdk.SiemplifyConnectors import SiemplifyConnectorExecution
8+
from soar_sdk.SiemplifyUtils import output_handler
9+
10+
from ..core.constants import (
11+
THINKST_CONNECTOR_NAME,
12+
THINKST_DEFAULT_API_KEY,
13+
THINKST_DEFAULT_CONSOLE,
14+
)
15+
from ..core.ThinkstManager import ThinkstConnectorManager, str_to_bool
16+
17+
18+
@output_handler
19+
def main(is_test_run):
20+
alerts = []
21+
siemplify = SiemplifyConnectorExecution()
22+
siemplify.script_name = THINKST_CONNECTOR_NAME
23+
24+
if is_test_run:
25+
siemplify.LOGGER.info(
26+
'***** This is an "IDE Play Button"\\"Run Connector once" test run ******'
27+
)
28+
29+
siemplify.LOGGER.info("==================== Main - Param Init ====================")
30+
31+
console_api_key = siemplify.extract_connector_param("API Key", THINKST_DEFAULT_API_KEY)
32+
if console_api_key == THINKST_DEFAULT_API_KEY:
33+
siemplify.LOGGER.error("Please provide a valid API Key")
34+
return
35+
36+
console_hash = siemplify.extract_connector_param("Console Hash", THINKST_DEFAULT_CONSOLE)
37+
if console_hash == THINKST_DEFAULT_CONSOLE:
38+
siemplify.LOGGER.error("Please provide a valid Console Hash")
39+
return
40+
41+
ssl_verify = siemplify.extract_connector_param("Verify SSL")
42+
ssl = str_to_bool(ssl_verify)
43+
44+
manager = ThinkstConnectorManager(console_api_key, console_hash, siemplify, ssl)
45+
alerts = manager.fetch_alerts()
46+
siemplify.return_package(alerts)
47+
48+
49+
if __name__ == "__main__":
50+
# Connectors are run in iterations. The interval is configurable from the ConnectorsScreen UI.
51+
is_test_run = not (len(sys.argv) < 2 or sys.argv[1] == "True")
52+
main(is_test_run)

‎content/response_integrations/third_party/thinkst_canary/connectors/ThinkstAlertConnector.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Thinkst - Alert Connector
2+
parameters:
3+
- name: API Key
4+
default_value: <API_KEY>
5+
type: password
6+
description: The API key for your console. If not specified will try and
7+
get it from integration configuration.
8+
is_mandatory: true
9+
is_advanced: false
10+
mode: script
11+
integration_identifier: THINKST
12+
13+
- name: Console Hash
14+
default_value: <CONSOLE_HASH>
15+
type: string
16+
description: The hash for your console (the part before .canary.tools). If
17+
not specified will try and get it from integration configuration.
18+
is_mandatory: true
19+
integration_identifier: THINKST
20+
is_advanced: false
21+
mode: script
22+
23+
- name: Last Id
24+
default_value: '0'
25+
type: integer
26+
description: Debug value - grab incidents since this update_id
27+
is_mandatory: false
28+
mode: script
29+
is_advanced: false
30+
31+
- name: Verify SSL
32+
type: boolean
33+
description: Whether to verify SSL certificates when connecting to the console
34+
is_mandatory: false
35+
default_value: true
36+
integration_identifier: THINKST
37+
is_advanced: false
38+
mode: script
39+
40+
- name: Ignore Informative
41+
type: boolean
42+
description: Do not create cases for informative incidents
43+
is_mandatory: false
44+
default_value: false
45+
integration_identifier: THINKST
46+
is_advanced: false
47+
mode: script
48+
49+
- name: PythonProcessTimeout
50+
default_value: '60'
51+
type: string
52+
description: The timeout limit (in seconds) for the python process running current
53+
script
54+
is_mandatory: true
55+
is_advanced: false
56+
mode: regular
57+
58+
- name: DeviceProductField
59+
default_value: device_product
60+
type: string
61+
description: The field name used to determine the device product
62+
is_mandatory: true
63+
is_advanced: false
64+
mode: regular
65+
66+
- name: EventClassId
67+
default_value: name
68+
type: string
69+
description: The field name used to determine the event name (sub-type)
70+
is_mandatory: true
71+
is_advanced: false
72+
mode: regular
73+
74+
description: 'Gets security incidents from the Canary Console'
75+
integration: THINKST
76+
rules: []
77+
is_connector_rules_supported: true
78+
creator: Thinkst

‎content/response_integrations/third_party/thinkst_canary/connectors/__init__.py‎

Whitespace-only changes.

0 commit comments

Comments
 (0)