Venafi

This Integration is part of the Venafi Pack.#

Retrieves information about certificates stored in Venafi.

This integration was integrated and tested with version 20.3.2.5263 of Venafi.

Configure Venafi on Cortex XSOAR#

Navigate to Settings > Integrations > Servers & Services.
Search for Venafi.
Click Add instance to create and configure a new integration instance.
Parameter Required
Server URL (e.g., https://192.168.0.1) True
Credentials True
Trust any certificate (not secure) False
Use system proxy settings False
Click Test to validate the URLs, token, and connection.

Parameter	Required
Server URL (e.g., https://192.168.0.1)	True
Credentials	True
Trust any certificate (not secure)	False
Use system proxy settings	False

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

venafi-get-certificates#

Gets Venafi certificates query. All dates are in the 2016-11-12T00:00:00.0000000Z format. Additional fields can be used in the query by adding them in a key=value format.

Base Command#

venafi-get-certificates

Input#

Argument Name	Description	Required
CreatedOn	Exact date and time on which the certificate object was created.	Optional
CreatedOnGreater	Date and time after which certificate objects were created.	Optional
CreatedOnLess	Date and time before which certificate objects were created.	Optional
Disabled	Whether to include only certificates that are disabled (1) or enabled (0).	Optional
InError	Whether to include only certificates that are in an error state (1) or not in an error state (0).	Optional
ValidationState	Validation state. Possible values are: Blank, Success, Failure.	Optional
ManagementType	Management type. Possible values are: Unassigned, Monitoring, Enrollment, Provisioning.	Optional
Name	Name of the certificate object.	Optional
NetworkValidationDisabled	Whether to include only certificates with network validation disabled (1) or enabled (0).	Optional
ParentDn	The full path to the parent of the object in Trust Protection Platform (e.g., \VED\Policy\Engineering,\VED\Policy\HR).	Optional
ParentDnRecursive	The specific folder from which to retrieve certificates. (The subfolders will also be scanned.) Accepts a single value.	Optional
PendingWorkflow	Whether to include only certificates that are pending workflow resolution (have an outstanding workflow ticket). This parameter does not require a value to be specified.	Optional
Stage	Comma-separated list of stages in the certificate lifecycle. Will retrieve certificates at one or more of the stages.	Optional
StageGreater	Stage after which to retrieve certificates. Does not include the specified stage.	Optional
StageLess	Stage before which to retrieve certificates.	Optional
ValidationDisabled	Whether to include only certificates with validation disabled (1) or enabled (0).	Optional
C	Country attribute of the Subject Distinguished Name (DN).	Optional
CN	Common name attribute of the Subject Distinguished Name (DN).	Optional
Issuer	Issuer DN. Note, since most Issuer DNs include commas between DN components, it is important to surround the complete Issuer DN within double quotes (“). In addition, if the Issuer DN includes double quotes, each double quote should be prefixed by another double quote.	Optional
KeyAlgorithm	Algorithm for the public key in the certificate (e.g., RSA, DSA).	Optional
KeySize	Comma-separated list of the bit size of the public key in the certificate (e.g., 2048).	Optional
KeySizeGreater	The size for which the public key size is greater than.	Optional
KeySizeLess	The size for which the public key size is less than.	Optional
L	Locality/City attribute of the Subject DN in the certificates.	Optional
O	Organization attribute of the Subject DN in the certificates.	Optional
S	State/Province attribute of the Subject DN in certificates.	Optional
Serial	Serial number of the certificate.	Optional
SignatureAlgorithm	The algorithm used to sign the certificate (e.g. SHA1RSA).	Optional
ValidFrom	Date on which the certificate was issued (e.g., 2015- 10-08T19:15:35.6431456Z or 2015-10-08).	Optional
ValidTo	Date on which the certificate expires (e.g., 2015-10- 08T19:15:35.6431456Z or 2015-10-08).	Optional
ValidToGreater	Date after which the certificates expire.	Optional
ValidToLess	Date before which the certificates expire.	Optional
Limit	The maximum number of certificates to return.	Optional

Context Output#

Path	Type	Description
Venafi.Certificate.CreatedOn	date	The exact date and time when the certificate object was created.
Venafi.Certificate.DN	string	The DN of the certificate.
Venafi.Certificate.Name	string	The name of the certificate.
Venafi.Certificate.ParentDN	string	The full path to the parent of the object in Trust Protection Platform.
Venafi.Certificate.SchemaClass	string	The class name of the certificate object.
Venafi.Certificate.ID	string	The certificate object GUID.

Command Example#

!venafi-get-certificates Limit="1"

Context Example#

{
    "Venafi": {
        "Certificate": {
            "CreatedOn": "2018-07-16T16:35:35.9468326Z",
            "DN": "\\VED\\Policy\\Venafi Operational Certificates\\WIN-MLK71Q10559",
            "ID": "2a25573b-745c-4018-806a-e5c73f424675",
            "Name": "WIN-MLK71Q10559",
            "ParentDN": "\\VED\\Policy\\Venafi Operational Certificates",
            "SchemaClass": "X509 Server Certificate"
        }
    }
}

Human Readable Output#

Venafi certificates query response#
CreatedOn DN ID Name ParentDN SchemaClass
2018-07-16T16:35:35.9468326Z \VED\Policy\Venafi Operational Certificates\WIN-MLK71Q10559 2a25573b-745c-4018-806a-e5c73f424675 WIN-MLK71Q10559 \VED\Policy\Venafi Operational Certificates X509 Server Certificate

CreatedOn	DN	ID	Name	ParentDN	SchemaClass
2018-07-16T16:35:35.9468326Z	\VED\Policy\Venafi Operational Certificates\WIN-MLK71Q10559	2a25573b-745c-4018-806a-e5c73f424675	WIN-MLK71Q10559	\VED\Policy\Venafi Operational Certificates	X509 Server Certificate

venafi-get-certificate-details#

Uses a certificate GUID to extract more details from the cert store.