LogsignSiem
This Integration is part of the Logsign SIEM Pack.#
Supported versions
Supported Cortex XSOAR versions: 6.0.0 and later.
Logsign SIEM provides comprehensive visibility and control of your data lake by allowing security analysts to collect and store unlimited data, investigate and detect threats, and respond automatically.
This integration was integrated and tested with version 4.6.x of Logsign SIEM
Configure Logsign SIEM in Cortex#
| Parameter | Description | Required |
|---|---|---|
| Server URL (e.g. https://192.168.0.1) | Logsign SIEM API URL | True |
| API Key | The API Key to use for connection | True |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False | |
| Last Run Time (ISO8601 format with UTC) | Last run time format like '%Y-%m-%dT%H:%M:%SZ' | True |
| First Fetch Time (default 1 hour) | First Fetch Time (e.g 1 hour) | False |
| isFetch | False | |
| Max Fetch | Maximum number of incidents per fetch (Recommended less than 200) | False |
Commands#
You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
logsign-fetch-incidents#
Gets Incidents from Logsign SIEM
Base Command#
logsign-fetch-incidents
Input#
| Argument Name | Description | Required |
|---|---|---|
| last_run | Last Run Fomat: '%Y-%m-%dT%H:%M:%SZ'. Possible values are: . | Required |
| query | Lucene query support | Optional |
Context Output#
| Output Path | Type | Description |
|---|---|---|
| Logsign.Incidents.Severity.Name | String | Incident Severity |
| Logsign.Incidents.Time.Generated | date | Time Generation of incident |
| Logsign.Incidents.EventMap.Context | String | Context of Event |
| Logsign.Incidents.Event.Category | String | Category of triggered event |
| Logsign.Incidents.EventSource.IP | unknown | The eventsource addresses that are associated with the incident |
| Logsign.Incidents.Destination.IP | unknown | The destination addresses that are associated with the incident |
| Logsign.Incidents.Source.IP | unknown | The source addresses that are associated with the incident |
| Logsign.Incidents.Destination.Port | unknown | Destination Port |
| Logsign.Incidents.Source.Port | unknown | Source Port |
| Logsign.Incidents.Alert.Category | String | Category of Incident |
| Logsign.Incidents.Alert.Info | String | Incident Description |
| Logsign.Incidents.Alert.AlertUID | Number | ID of Incident |
| Logsign.Incidents.Alert.TriggerEventID | Number | Trigger Event ID |
| Logsign.Incidents.EventSource.HostName | String | The eventsource hostname that are associated with the incident |
Command Example#
!logsign-fetch-incidents last_run=2021-07-27T10:27:00Z
Context Example#
Human Readable Output#
logsign-get-columns-query#
Gets column values based on your lucene query
Base Command#
logsign-get-columns-query
Input#
| Argument Name | Description | Required |
|---|---|---|
| query | Query Description. | Required |
| grouped_column | Group Column . | Required |
| criteria | Criteria Value. Possible values are: unique, value. | Required |
| time_frame | Time Frame (e.g 1 hour). | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| LogsignSiem.Columns | Unknown | Column list returned as the result of the query |
Command Example#
!logsign-get-columns-query criteria="value" grouped_column="Source.IP" query="*" time_frame="1 day"
Context Example#
Human Readable Output#
Results#
columns 192.168.1.35,
192.168.1.17,
192.168.1.18,
192.168.1.5,
192.168.1.93
logsign-get-count-query#
Gets count of column values.
Base Command#
logsign-get-count-query
Input#
| Argument Name | Description | Required |
|---|---|---|
| query | Query. | Required |
| grouped_column | Grouped Column. | Required |
| criteria | Criteria Value. Possible values are: unique, value. | Required |
| time_frame | Time Frame. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| LogsignSiem.Count | Number | Count number returned as the result of the query |
Command Example#
!logsign-get-count-query criteria="value" grouped_column="Source.IP" query="*" time_frame="1 day"
Context Example#
Human Readable Output#
Results#
count 785554