Endace

The EndaceProbe Analytics Platform provides 100% accurate, continuous packet capture on network links up to 100Gbps, with unparalleled depth of storage and retrieval performance. Coupled with the Endace InvestigationManager, this provides a central search and data-mining capability across a fabric of EndaceProbes deployed in a network.

This integration uses Endace APIs to search, archive and download PCAP file from either a single EndaceProbe or many via the InvestigationManager and enables integration of full historical packet capture into security automation workflows. This integration was integrated and tested with version 6.5.7 & 7.0.0 of Endace

Configure Endace on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Endace.
  3. Click Add instance to create and configure a new integration instance.
ParameterDescriptionRequired
applianceurlEndaceProbe URL e.g. https://<fqdn/ip[:port]>True
credentialsUsernameTrue
insecureTrust any certificate (not secure)False
proxyUse system proxy settingsFalse
hostnameEndaceProbe System HostnameTrue
  1. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

endace-create-search


Create a search task on EndaceProbe. Search is issued against all Rotation Files on EndaceProbe.

Base Command

endace-create-search

Input
Argument NameDescriptionRequired
startUTC StartTime in ISO 8601 format as in 2020-04-08T15:46:30Optional
endUTC EndTime in ISO 8601 format as in 2020-04-08T15:46:30Optional
ipdirectionless ip address. For valid search either a IP or Src Host or a Dest Host value is required.Optional
portdirectionless port.Optional
src_host_listList of comma delimited Source IP addresses to search with a maximum of 10 IP addresses per search. For valid search either a Src Host or a Dest Host value is required.Optional
dest_host_listList of comma delimited Destination IP addresses to search with a maximum of 10 IP addresses per search. For valid search either a Src Host or a Dest Host value is required.Optional
src_port_listList of comma delimited Source Port addresses to search with a maximum of 10 Port addresses per search.Optional
dest_port_listList of comma delimited Destination Port addresses to search with a maximum of 10 Port addresses per search.Optional
protocolIANA defined IP Protocol Name or Number. For example: either use TCP or tcp or 6 for tcp protocolOptional
timeframeEvent timeframe to search. Select one of the values from 30seconds, 1minute, 5minutes, 10minutes, 30minutes, 1hour, 2hours, 5hours, 10hours, 12hours, 1day, 3days, 5days, 1week. Timeframe works as search for last n seconds if start and end time is not provided. For example, by specifying 1hour as the timeframe, analyst can schedule a search for last 3600s. If both start and end time is provided, timeframe value is ignored. If either start or end time is provided along with timeframe, the respective start or end time is calculated accordingly. Initial value of timeframe is 1hour.Optional
Context Output
PathTypeDescription
Endace.Search.Task.JobIDStringSearch Job ID
Endace.Search.Task.StatusStringStatus of Search Task
Endace.Search.Task.ErrorStringSearch Error
Command Example

!endace-create-search start="2020-04-15T14:48:12" ip="1.1.1.1" timeframe="1hour"

Context Example
{
"Endace": {
"Search": {
"Task": {
"Error": "NoError",
"JobID": "c944a329-bf16-4e51-ac58-900f17fa1a52",
"Status": "Started",
"Task": "CreateSearchTask"
}
}
}
}
Human Readable Output

EndaceResult

TaskJobIDStatusError
CreateSearchTaskc944a329-bf16-4e51-ac58-900f17fa1a52StartedNoError

endace-get-search-status


Get search status from EndaceProbe. This command can be polled in a loop until response is received or polling timer is over.

Base Command

endace-get-search-status

Input
Argument NameDescriptionRequired
jobidThis is the job ID returned by endace-create-search commandRequired
Context Output
PathTypeDescription
Endace.Search.Response.JobIDStringThis is the job ID of search query which we polled to get search status
Endace.Search.Response.JobProgressStringProgress of this search Job
Endace.Search.Response.DataSourcesStringList of Data Sources where packets of interest were found.
Endace.Search.Response.TotalBytesStringTotal data matching this search across all Data Sources.
Endace.Search.Response.StatusStringTask status
Endace.Search.Response.ErrorStringSearch response error
Command Example

!endace-get-search-status jobid="c944a329-bf16-4e51-ac58-900f17fa1a52"

Context Example
{
"Endace": {
"Search": {
"Response": {
"DataSources": [endaceprobe-1:datasource1],
"Error": "NoError",
"JobID": "c944a329-bf16-4e51-ac58-900f17fa1a52",
"JobProgress": "100",
"Status": "complete",
"Task": "GetSearchStatus",
"TotalBytes": 5526100
}
}
}
}
Human Readable Output

EndaceSearch

TaskJobIDStatusErrorJobProgressDataSourcesTotalBytes
GetSearchStatusc944a329-bf16-4e51-ac58-900f17fa1a52completeNoError100endaceprobe-1:datasource15526100

endace-delete-search-task


Delete search task

Base Command

endace-delete-search-task

Input
Argument NameDescriptionRequired
jobidJob ID obtained from endace-create-search commandRequired
Context Output
PathTypeDescription
Endace.Search.Delete.JobIDStringJobID of the task that needs to be deleted
Endace.Search.Delete.ErrorStringError message
Endace.Search.Delete.StatusStringdelete status, queryNotFound indicates that the search query has already expired before this operation, which is expected as EndaceProbe purges inactive tasks after api timer expire. Deleted indicates an active search query is now deleted.
Command Example

!endace-delete-search-task jobid="c944a329-bf16-4e51-ac58-900f17fa1a52"

Context Example
{
"Endace": {
"Search": {
"Delete": {
"Error": "NoError",
"JobID": "c944a329-bf16-4e51-ac58-900f17fa1a52",
"Status": "Deleted",
"Task": "DeleteSearchTask"
}
}
}
}
Human Readable Output

EndaceSearch

TaskJobIDStatusError
DeleteSearchTaskc944a329-bf16-4e51-ac58-900f17fa1a52DeletedNoError

endace-create-archive


Create an archive task to archive packets of interest on EndaceProbe. Archived packets can later be downloaded from EndaceProbe as a PCAP file. Archived Files never expire. Allowed chars are text, numbers, dash and underscore.

Base Command

endace-create-archive

Input
Argument NameDescriptionRequired
startUTC StartTime in ISO 8601 format as in 2020-04-08T15:46:30Optional
endUTC EndTime in ISO 8601 format as in 2020-04-08T15:46:30Optional
ipdirectionless ip address.Optional
portdirectionless port. For valid search either a Src Host or a Dest Host value is required.Optional
timeframeEvent timeframe to search. Select one of the values from 30seconds, 1minute, 5minutes, 10minutes, 30minutes, 1hour, 2hours, 5hours, 10hours, 12hours, 1day, 3days, 5days, 1week. Timeframe works as search for last n seconds if start and end time is not provided. For example, by specifying 1hour as the timeframe, analyst can schedule a search for last 3600s. If both start and end time is provided, timeframe value is ignored. If either start or end time is provided along with timeframe, the respective start or end time is calculated accordingly. Initial value of timeframe is 1hour.Optional
src_host_listList of comma delimited Source IP addresses to search with a maximum of 10 IP addresses per search. For valid search either a Src Host or a Dest Host value is required.Optional
dest_host_listList of comma delimited Destination IP addresses to search with a maximum of 10 IP addresses per search. For valid search either a Src Host or a Dest Host value is required.Optional
src_port_listList of comma delimited Source Port addresses to search with a maximum of 10 Port addresses per search.Optional
dest_port_listList of comma delimited Destination Port addresses to search with a maximum of 10 Port addresses per search.Optional
protocolIANA defined IP Protocol Name or Number. For example: either use TCP or tcp or 6 for tcp protocolOptional
archive_filenameName of the archive file. For example, archive_filename could be an event ID. To keep archive filename unique, value of epoch seconds at the time of execution of the command is appended to this filename argument. For example - if the event id is eventid, then archive_filename is eventid-[epochtime].Required
Context Output
PathTypeDescription
Endace.Archive.Task.FileNameStringName of the archived File
Endace.Archive.Task.P2VurlStringEndace Pivot to Vision URL to archived packets that links to an Investigation Dashboard on EndaceProbe. This enables an analyst to utilize tools available on EndaceProbe for further drill down on packets of interests without needing to download a PCAP.
Endace.Archive.Task.StatusStringStatus of archived task
Endace.Archive.Task.ErrorStringArchive error
Endace.Archive.Task.JobIDStringArchive Task Job ID
Command Example

!endace-create-archive start="2020-04-15T14:48:12" archive_filename="event" ip="1.1.1.1" timeframe="1hour"

Context Example
{
"Endace": {
"Archive": {
"Task": {
"End": 1586965692,
"Error": "NoError",
"FileName": "event-1586976954",
"JobID": "495f1899-6f27-4ed9-85c9-2af19a4e55d8",
"P2Vurl": "[Endace PivotToVision URL](https://endaceprobe-1/vision2/pivotintovision/?datasources=tag:rotation-file&title=event-1586976954&start=1586962092000&end=1586965692000&tools=trafficOverTime_by_app%2Cconversations_by_ipaddress&ip=1.1.1.1)",
"Start": 1586962092,
"Status": "Started",
"Task": "CreateArchiveTask"
}
}
}
}
Human Readable Output

EndaceResult

TaskFileNameP2VurlStatusErrorJobID
CreateArchiveTaskevent-1586976954Endace PivotToVision URLStartedNoError495f1899-6f27-4ed9-85c9-2af19a4e55d8

endace-get-archive-status


get status of archived task

Base Command

endace-get-archive-status

Input
Argument NameDescriptionRequired
archive_filenameGet status of this archived fileRequired
Context Output
PathTypeDescription
Endace.Archive.Response.FileNameStringArchived File Name
Endace.Archive.Response.FileSizeStringArchived File Size
Endace.Archive.Response.StatusStringStatus of the archive process
Endace.Archive.Response.ErrorStringArchive response error
Command Example

!endace-get-archive-status archive_filename="event-1586976861"

Context Example
{
"Endace": {
"Archive": {
"Response": {
"Error": "NoError",
"FileName": "event-1586976861",
"FileSize": "6.29MB",
"Status": "Finished",
"Task": "GetArchiveStatus"
}
}
}
}
Human Readable Output

EndaceResult

TaskFileNameStatusErrorFileSize
GetArchiveStatusevent-1586976861FinishedNoError6.29MB

endace-delete-archive-task


delete archive task

Base Command

endace-delete-archive-task

Input
Argument NameDescriptionRequired
jobidJob ID of archive taskOptional
Context Output
PathTypeDescription
Endace.Archive.Delete.StatusStringStatus of delete task
Endace.Archive.Delete.ErrorStringDelete task error
Endace.Archive.Delete.JobIDStringDelete Task ID
Command Example

!endace-delete-archive-task jobid="83fec7a8-daec-42fb-9b5a-e742145e85e8"

Context Example
{
"Endace": {
"Archive": {
"Delete": {
"Error": "NoError",
"JobID": "83fec7a8-daec-42fb-9b5a-e742145e85e8",
"Status": "Deleted",
"Task": "DeleteArchiveTask"
}
}
}
}
Human Readable Output

EndaceResult

TaskJobIDStatusError
DeleteArchiveTask83fec7a8-daec-42fb-9b5a-e742145e85e8DeletedNoError

endace-download-pcap


Download a copy of the PCAP file from EndaceProbe if PCAP file size is within the threshold value defined by filesizelimit.

Base Command

endace-download-pcap

Input
Argument NameDescriptionRequired
filenameName of the file (without extension) to download from EndaceProbe. Text, numbers, underscore or dash is supported.Required
filesizelimitUser defined upper size limit on file download (in MegaBytes). A PCAP File with size less than or equal to this limit can be downloaded from EndaceProbe. Minimum size is 1 (MB). Default Upper Limit is 50 (MB).Required
Context Output
PathTypeDescription
Endace.Download.PCAP.FileNameStringName of the File to download from EndaceProbe
Endace.Download.PCAP.FileSizeStringFile size in MegaBytes
Endace.Download.PCAP.FileTypeStringThe file downloaded from EndaceProbe is either a Rotation File or Archive.
Endace.Download.PCAP.FileURLStringURL to PCAP file on EndaceProbe.
Endace.Download.PCAP.FileUserStringUsername of the person who has permission to download this PCAP from EndaceProbe.
Endace.Download.PCAP.StatusStringDownload status of the PCAP file.
Endace.Download.PCAP.ErrorStringError occured during downloading of this file
Command Example

!endace-download-pcap filename="event-1586976861" filesizelimit="50"

Context Example
{
"Endace": {
"Download": {
"PCAP": {
"Error": "NoError",
"FileName": "event-1586976861.pcap",
"FileSize": "6.29MB",
"FileType": "archive_file",
"FileURL": "[Endace PCAP URL](https://endaceprobe-1/vision2/data/files/b20e43e6-2cf7-1af2-3665-01016cb2daba/stream?format=pcap)",
"FileUser": "admin",
"Status": "DownloadFinished",
"Task": "DownloadPCAP"
}
}
},
"InfoFile": {
"EntryID": "4450@59d61022-f169-427a-8767-77ab234fa692",
"Extension": "pcap",
"Info": "pcap",
"Name": "event-1586976861.pcap",
"Size": 5722924,
"Type": "tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 16384)"
}
}
Human Readable Output

EndaceResult

TaskFileNameStatusErrorFileSizeFileTypeFileUserFileURL
DownloadPCAPevent-1586976861.pcapDownloadFinishedNoError6.29MBarchive_fileadminEndace PCAP URL

endace-delete-archived-file


Delete an archived file from EndaceProbe.

Base Command

endace-delete-archived-file

Input
Argument NameDescriptionRequired
archived_filenameBase name of the archived file to be deleted on EndaceProbe. Filename must be without any extension. Refer to Endace.Archive.Response.FileName fieldRequired
Context Output
PathTypeDescription
Endace.ArchivedFile.Delete.FileNameStringFilename of the deleted archived file
Endace.ArchivedFile.Delete.StatusStringArchived File Delete task status
Endace.ArchivedFile.Delete.ErrorStringDelete Error
Command Example

!endace-delete-archived-file archived_filename="event-1586976861"

Context Example
{
"Endace": {
"ArchivedFile": {
"Delete": {
"Error": "NoError",
"FileName": "event-1586976861",
"Status": "FileDeleted",
"Task": "DeleteArchivedFile"
}
}
}
}
Human Readable Output

EndaceResult

TaskFileNameStatusError
DeleteArchivedFileevent-1586976861FileDeletedNoError