RSA Archer

Details
Content
Version History

The RSA Archer GRC Platform provides a common foundation for managing policies, controls, risks, assessments and deficiencies across lines of business.

PUBLISHER

Cortex XSOAR

INFO

Certification	Certified	Read more
Supported By	Cortex XSOAR
Created	July 26, 2020
Last Release	December 1, 2021

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Automations

Name	Description
ArcherCreateIncidentExample	This script is an example script of how to create Incident in Archer. The script generates the create incident data in JSON format and execute the command archer-create-record.
RSAArcherManualFetch	This automation creates new incidents from RSA Archer.
ArcherUpdateSecurityIncident	This script is used to simplify the process of updating a new record in Archer. You can add fields that you want in the record as script arguments and or in the code and have a newly created record easily. This automation fields are currently used for Archer application 75 (Security Incidents) but can be altered to any other application by modifying the fields in the code. Please note that if you will change it to work with another application some of the argument defined fields might need to be changed as they belong to application 75. Another option would be to duplicate this script and adjust it to the new application Id
ArcherCreateSecurityIncident	This script is used to simplify the process of creating a new record in Archer. You can add fields that you want in the record as script arguments and or in the code and have a newly created record easily. This automation is currently used for Archer application 75 (Security Incidents) but can be altered to any other application by entering another application Id as input and or modifying the default ApplicationId value in the arguments. Another option would be to duplicate this script and adjust it to the new application Id. Please note that if you will change it to work with another application some of the argument defined fields might need to be changed as they belong to application 75.

Playbooks

Name	Description
Archer initiate incident	initiate Archer incident

Integrations

Name	Description
RSA Archer (Deprecated)	Deprecated. Use the RSA Archer v2 integration instead.
RSA Archer v2	The RSA Archer GRC Platform provides a common foundation for managing policies, controls, risks, assessments, and deficiencies across lines of business.

1.1.28 - 2037725 (December 1, 2021)

Scripts

ArcherCreateSecurityIncident

Updated the Docker image to: demisto/python:2.7.18.24398.

ArcherUpdateSecurityIncident

Updated the Docker image to: demisto/python:2.7.18.24398.

RSAArcherManualFetch

Updated the Docker image to: demisto/python:2.7.18.24398.

1.1.27 - 2002259 (November 24, 2021)

Integrations

RSA Archer v2

Updated the Docker image to: demisto/python3:3.9.8.24399.

1.1.26 - 1926804 (November 10, 2021)

Integrations

RSA Archer v2

Breaking changes: Edited the value of the parameter Advanced: API Endpoint. Two possible configuration cases:
1. https://example.com/rsaarcher/api:
  - URL: https://example.com/rsaarcher
  - API Endpoint: /api
2. https://example.com/api:
  - URL: https://example.com/
  - API Endpoint: /api

1.1.25 - 7789574 (September 26, 2021)

Scripts

ArcherCreateSecurityIncident

Updated the Docker image to: demisto/python:2.7.18.24066.

ArcherUpdateSecurityIncident

Updated the Docker image to: demisto/python:2.7.18.24066.

RSAArcherManualFetch

Updated the Docker image to: demisto/python:2.7.18.24066.

1.1.24 - 7740378 (September 23, 2021)

Scripts

ArcherCreateIncidentExample

Updated the Docker image to: demisto/python3:3.9.7.24076.

1.1.23 - 7640590 (September 16, 2021)

Integrations

RSA Archer v2

Updated the Docker image to: demisto/python3:3.9.7.24076.

1.1.22 - 7465883 (September 5, 2021)

Integrations

RSA Archer v2

Updated the Docker image to: demisto/python3:3.9.6.24019.
Fixed an issue where the Advanced: API Endpoint parameter was not added properly to the URL.

1.1.21 - 414705 (August 22, 2021)

Integrations

RSA Archer v2

Fixed an issue of hard coded API endpoints in the code by adding a new API Endpoint parameter to the integration.

Scripts

ArcherCreateIncidentExample

Upgraded the Docker image to: demisto/python3:3.9.6.22912.

ArcherCreateSecurityIncident

Upgraded the Docker image to: demisto/python:2.7.18.22912.

ArcherUpdateSecurityIncident

Upgraded the Docker image to: demisto/python:2.7.18.22912.

RSAArcherManualFetch

Upgraded the Docker image to: demisto/python:2.7.18.22912.

1.1.20 - 410734 (August 12, 2021)

Integrations

RSA Archer v2

Upgraded the Docker image to: demisto/python3:3.9.6.22912.

1.1.19 - 398245 (July 15, 2021)

Scripts

ArcherCreateSecurityIncident

Updated the Docker image to: demisto/python:2.7.18.20958.

RSAArcherManualFetch

Updated the Docker image to: demisto/python:2.7.18.20958.

ArcherUpdateSecurityIncident

Updated the Docker image to: demisto/python:2.7.18.20958.

1.1.18 - 388541 (June 22, 2021)

Integrations

RSA Archer v2

Fixed an issue where the archer-search-records-by-report command failed handling a report with only one record.

1.1.17 - 387494 (June 21, 2021)

Integrations

RSA Archer v2

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

1.1.16 - 378296 (June 6, 2021)

Integrations

RSA Archer v2

Upgraded the Docker image to: demisto/python3:3.9.5.20070.

1.1.15 - 349049 (May 6, 2021)

Integrations

RSA Archer v2

Added the argument levelId to the following commands:
- archer-create-record
- archer-search-records
- archer-update-record
Updated the Docker image to: demisto/python3:3.9.4.18682.

Scripts

ArcherCreateIncidentExample

Updated the Docker image to: demisto/python3:3.9.4.18682.

1.1.14 - 317508 (April 2, 2021)

Integrations

RSA Archer v2

Updated the update session function to better handle errors when a provided URL is invalid and the session fails to create.

1.1.13 - 315644 (March 31, 2021)

Integrations

RSA Archer v2

Added error handling to archer-update-record command when fieldsToValues argument do not match the requirements.
Updated the Docker image to: demisto/python3:3.9.2.17957.

1.1.12 - 294860 (March 3, 2021)

Integrations

RSA Archer v2

Improved implementation of the incident time field comparison to be accurate to a microsecond level.
Added the isDescending argument to the archer-search-records command.
Updated Docker image to demisto/python3:3.9.1.15759.

1.1.11 - R271056 (February 3, 2021)

Integrations

RSA Archer v2

Fixed an issue where duplicate incidents were fetched when they occurred at the same time as the previous fetch.

1.1.10 - 255754 (January 18, 2021)

Integrations

RSA Archer (Deprecated)

Documentation and metadata improvements.

1.1.9 - R253472 (January 16, 2021)

Integrations

RSA Archer v2

Fixed an issue where duplicate incidents were fetched.

1.1.8 - 242050 (January 4, 2021)

Integrations

RSA Archer v2

Removed the fetch filter parameter which was not used.
Fixed an issue where the numericOperator argument in the archer-search-records command was not used correctly.
Updated Docker image to demisto/python3:3.9.1.14969.

1.1.7 - 237835 (December 30, 2020)

Integrations

RSA Archer v2

Fixed an issue where duplicated incidents were created by fetch-incidents.
Removed the Use European Time Format and Timezone Offset integration parameters as they are resolved by Cortex XSOAR.
Updated Docker image to demisto/python3:3.8.6.14516.

1.1.6 - R229790 (December 22, 2020)

Integrations

RSA Archer v2

Fixed an issue in the fetch-incident command where there was a mismatched between timezones.

1.1.5 - 207944 (December 2, 2020)

Integrations

RSA Archer v2

Added support for the Use European Time format integration parameter in fetch-incidents. Use this parameter when RSA Archer is using European date notations (e.g. DD/MM/YYYY).
Added support for associating a file with a record in the archer-upload-file command.

1.1.4 - 204038 (November 29, 2020)

Integrations

RSA Archer v2

Fixed an issue where the archer-create-record command did not create records.
Improving documentation - added explanations and examples for the archer-create-record command.
Upgraded the Docker image to demisto/python3:3.8.6.13358.

1.1.3 - R180529 (November 9, 2020)

Integrations

RSA Archer v2

You can now pass list fields to the fieldsToValues argument without [] in the archer-create-record and the archer-update-record commands. For example: use "fieldsToValues={"Priority":"High"}" instead of "fieldsToValues={"Priority":"[High]"}".

1.1.2 - 162646 (October 27, 2020)

Integrations

RSA Archer v2

Improved error handling in login process.
Upgraded the Docker image to demisto/python3:3.8.6.12176.

1.1.1 - 141641 (October 11, 2020)

Integrations

RSA Archer (Deprecated)

Deprecated. We recommend using RSA Archer v2 instead.

1.1.0 - R124496 (September 23, 2020)

Integrations

New: RSA Archer v2

The RSA Archer GRC Platform provides a common foundation for managing policies, controls, risks, assessments and deficiencies across lines of business.

Scripts

New: ArcherCreateIncidentExample

This script is an example script of how to create an Incident in Archer.
The script generates the create incident data in JSON format and execute the command archer-create-record.

1.0.0 - R74094 (July 26, 2020)

The RSA Archer GRC Platform provides a common foundation for managing policies, controls, risks, assessments and deficiencies across lines of business.