From c18b7e8eaacceb2d9da400ba4a45225332eb898f Mon Sep 17 00:00:00 2001 From: "idan.noy" Date: Mon, 15 Jun 2026 17:48:58 +0300 Subject: [PATCH] Updated Scenarios and Security Score API endpoints and app version Signed-off-by: idan.noy --- .../XM Cyber/XM-Cyber-Parameter-Values.xml | 54 +- .../XM Cyber/XMCyber-AuditTrails-Workflow.xml | 806 ++++++------- .../XM Cyber/XMCyber-Devices-Workflow.xml | 662 +++++------ .../XM Cyber/XMCyber-Entities-Workflow.xml | 1024 ++++++++--------- .../XMCyber-FindingsExposures-Workflow.xml | 658 +++++------ .../XM Cyber/XMCyber-Products-Workflow.xml | 676 +++++------ .../XM Cyber/XMCyber-Scenarios-Workflow.xml | 638 +++++----- .../XMCyber-SecurityScore-Workflow.xml | 743 ++++++------ .../XM Cyber/XMCyber-Sensors-Workflow.xml | 638 +++++----- .../XMCyber-Vulnerabilities-Workflow.xml | 676 +++++------ Community Developed/XM Cyber/readMe.md | 180 +-- 11 files changed, 3377 insertions(+), 3378 deletions(-) diff --git a/Community Developed/XM Cyber/XM-Cyber-Parameter-Values.xml b/Community Developed/XM Cyber/XM-Cyber-Parameter-Values.xml index d7d1586..e8b855c 100644 --- a/Community Developed/XM Cyber/XM-Cyber-Parameter-Values.xml +++ b/Community Developed/XM Cyber/XM-Cyber-Parameter-Values.xml @@ -1,27 +1,27 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-AuditTrails-Workflow.xml b/Community Developed/XM Cyber/XMCyber-AuditTrails-Workflow.xml index fc81b60..88f0dd5 100644 --- a/Community Developed/XM Cyber/XMCyber-AuditTrails-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-AuditTrails-Workflow.xml @@ -1,403 +1,403 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-Devices-Workflow.xml b/Community Developed/XM Cyber/XMCyber-Devices-Workflow.xml index 3fdcd31..7c6120b 100644 --- a/Community Developed/XM Cyber/XMCyber-Devices-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-Devices-Workflow.xml @@ -1,331 +1,331 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-Entities-Workflow.xml b/Community Developed/XM Cyber/XMCyber-Entities-Workflow.xml index 8eb262a..0bed92a 100644 --- a/Community Developed/XM Cyber/XMCyber-Entities-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-Entities-Workflow.xml @@ -1,512 +1,512 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-FindingsExposures-Workflow.xml b/Community Developed/XM Cyber/XMCyber-FindingsExposures-Workflow.xml index 24371f8..4a7fc6a 100644 --- a/Community Developed/XM Cyber/XMCyber-FindingsExposures-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-FindingsExposures-Workflow.xml @@ -1,329 +1,329 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-Products-Workflow.xml b/Community Developed/XM Cyber/XMCyber-Products-Workflow.xml index 94bb151..393c4a9 100644 --- a/Community Developed/XM Cyber/XMCyber-Products-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-Products-Workflow.xml @@ -1,338 +1,338 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-Scenarios-Workflow.xml b/Community Developed/XM Cyber/XMCyber-Scenarios-Workflow.xml index c842b08..07f2fb2 100644 --- a/Community Developed/XM Cyber/XMCyber-Scenarios-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-Scenarios-Workflow.xml @@ -1,319 +1,319 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-SecurityScore-Workflow.xml b/Community Developed/XM Cyber/XMCyber-SecurityScore-Workflow.xml index a660e95..4e8dbf5 100644 --- a/Community Developed/XM Cyber/XMCyber-SecurityScore-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-SecurityScore-Workflow.xml @@ -1,372 +1,371 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-Sensors-Workflow.xml b/Community Developed/XM Cyber/XMCyber-Sensors-Workflow.xml index 967542e..e604d95 100644 --- a/Community Developed/XM Cyber/XMCyber-Sensors-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-Sensors-Workflow.xml @@ -1,319 +1,319 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/XMCyber-Vulnerabilities-Workflow.xml b/Community Developed/XM Cyber/XMCyber-Vulnerabilities-Workflow.xml index 4b7fc1a..9fbb3ad 100644 --- a/Community Developed/XM Cyber/XMCyber-Vulnerabilities-Workflow.xml +++ b/Community Developed/XM Cyber/XMCyber-Vulnerabilities-Workflow.xml @@ -1,338 +1,338 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "refreshToken": "${/refreshToken}" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - { - "Accept": "application/json", - "content-type": "application/x-www-form-urlencoded" - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "refreshToken": "${/refreshToken}" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + { + "Accept": "application/json", + "content-type": "application/x-www-form-urlencoded" + } + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Community Developed/XM Cyber/readMe.md b/Community Developed/XM Cyber/readMe.md index ec3377e..ab00354 100644 --- a/Community Developed/XM Cyber/readMe.md +++ b/Community Developed/XM Cyber/readMe.md @@ -1,91 +1,91 @@ -# Collect authentication info from XM Cyber # - -To integrate with QRadar, you need to add a XM Cyber log source with QRadar's Universal REST protocol. To do so, you'll need to first collect the following authentication information from XM Cyber: - -- XM Cyber Hostname -- XM Cyber API Key - -# XM Cyber Hostname # - -To find your XM Cyber Hostname: - -1. Log in to XM Cyber, then take the hostname from the URL. -2. If XM Cyber URL is https://your-tenant.clients.xmcyber.com/login, enter hostname as **your-tenant.clients.xmcyber.com** - -# API Key # - -To create an API Key, follow the below steps: -1. Log in to XM Cyber. -2. Go to System Config > Integrations > XM API. -3. Click View/generate API keys. The API keys table appears. -4. Click + Create API key -5. Complete the following fields: - 1. Application name: Enter the name of the key, which is how it will appear in the API keys table. - 2. Description: Describe the purpose or usage of the API key. - 3. Expiration: Select the number of months until the key expires. -6. Click Assign Roles. -7. For each API scope, assign the roles Read. -8. Click Create. The Copy & Save tab appears with your key. -9. Copy and save your key now. Important: Once you close the window, you will not be able to recover the key for security - - -# QRadar Log Source Configuration # - -If you want to ingest data from an endpoint using Universal Rest API Protocol, configure a log source on the QRadar® Console using the Workflow field so that the defined endpoint can communicate with QRadar by using the Universal Rest API protocol. - -1. Log in to QRadar. -2. Click the *Admin* tab. -3. To open the app, click the *QRadar Log Source Management* app icon. -4. Click *New Log Source* > Single Log Source. - - -## 1. Select Log Source Type ## -1. Select *XM Cyber* log source type. -2. Click *Select Protocol Type* to go to the next section. - -## 2. Select Protocol Type ## -1. Select *Universal Cloud Rest API* protocol type. -2. Click *Configure Log Source Parameters* to go to the next section. -3. If option "Universal Cloud Rest API" is not available in protocol type, then uninstall the XM Cyber app from extensions management, install the Universal Cloud Rest API Protocol and then install the XM Cyber app. - -## 3. Configure Log Source Parameters ## -1. Name is the name of the Log Source and it can be kept anything based on the user's choice. -2. Select "XMCyberCustom_ext" Extension. It is used for post processing of events. -3. Disable *Coalescing Events* to avoid grouping of the events on the basis of Source and Destination IP. -4. Except for the above fields everything can be kept as their default values or if needed can be changed by the QRadar admin. -5. Click *Configure Protocol Parameters* to go to the next section. - -## 4. Configure Protocol Parameters ## -1. Add "Log Source Identifier" of user's choice. -2. Copy the content of the any workflow file in "Workflow". List of the workflow files can be found [here](#supported-events-types). -3. Modify the content as per user specification in the file XM-Cyber-Workflow-Parameter-Values.xml and add in "Workflow Parameter Values". -4. Create new log sources and repeat **QRadar Log Source Configuration** steps to collect other data and use the files as Workflow listed [here](#supported-events-types). -5. Recurrence is the time interval between each execution of the workflow. Input the value as 1D, default value would be 10 minutes. -6. Except for the above fields everything can be kept as their default values or if needed can be changed by the QRadar admin. -7. Click *Test Protocol Parameters* to test the entered workflow files. - -## 5. Test Protocol Parameters ## -1. Click *Start Test* to start the testing of the entered workflows, once it is finished click *Finish*. -2. Deploy the configuration from admin panel. - -# Workflow Parameter Description # -1. tenantName: The API Endpoint Hostname to fetch the events from XM Cyber. If your URL is https://your-tenant.clients.xmcyber.com/login then enter **your-tenant.clients.xmcyber.com** -2. apiKey: The API Key obtained from XM Cyber portal. -3. auditTrailsStartTime: Required for Audit Trails collection. Defines the start time for collecting Audit Trails data. Provide the Audit Trails start time in the format YYYY-MM-DDTHH:MM:SS.SSSZ -4. ingestChokepointStats: Required for Entities collection. If set to True, entities chokepoint statistics will also be ingested into QRadar as an event after entity data collection. -5. ingestScenarios: Required for Security Score collection. If set to True, scenarios data collected during Security Score data collection will also be ingested into QRadar. -6. timeId: Required for Security Score collection. Defines the start time for collecting Security Score data. Must be from [timeAgo_days_7, timeAgo_days_14, timeAgo_days_30, timeAgo_days_365]. - -# Supported Events Types # - -| Workflow Name | Events will be collected | API Endpoint | -| --- | --- | --- | -| XMCyber-AuditTrails-Workflow.xml | Audit Trail | /api/audit-trail/auditRecords | -| XMCyber-Entities-Workflow.xml | Compromised Entity, Entity, Entity Chokepoint | /api/v2/reports/data/scenariosCriticalAssetsReport/entities, /api/entityInventory/entities, /api/v2/reports/data/scenariosChokePointsReport/chokePointsEntities | -| XMCyber-Devices-Workflow.xml | Device | /api/v2/vavm/devices | -| XMCyber-FindingsExposures-Workflow.xml | Finding and Exposure | /api/v2/reports/data/scenariosExposureReport/exposures | -| XMCyber-Products-Workflow.xml | Products | /api/v2/vavm/public/products | -| XMCyber-Scenarios-Workflow.xml | Scenario | /api/scenariosInfo/scenarios | -| XMCyber-SecurityScore-Workflow.xml | Security Score, Security Score Scenario | /api/systemReport/riskScoreV2 | -| XMCyber-Sensors-Workflow.xml | Sensor | /api/sensors | +# Collect authentication info from XM Cyber # + +To integrate with QRadar, you need to add a XM Cyber log source with QRadar's Universal REST protocol. To do so, you'll need to first collect the following authentication information from XM Cyber: + +- XM Cyber Hostname +- XM Cyber API Key + +# XM Cyber Hostname # + +To find your XM Cyber Hostname: + +1. Log in to XM Cyber, then take the hostname from the URL. +2. If XM Cyber URL is https://your-tenant.clients.xmcyber.com/login, enter hostname as **your-tenant.clients.xmcyber.com** + +# API Key # + +To create an API Key, follow the below steps: +1. Log in to XM Cyber. +2. Go to System Config > Integrations > XM API. +3. Click View/generate API keys. The API keys table appears. +4. Click + Create API key +5. Complete the following fields: + 1. Application name: Enter the name of the key, which is how it will appear in the API keys table. + 2. Description: Describe the purpose or usage of the API key. + 3. Expiration: Select the number of months until the key expires. +6. Click Assign Roles. +7. For each API scope, assign the roles Read. +8. Click Create. The Copy & Save tab appears with your key. +9. Copy and save your key now. Important: Once you close the window, you will not be able to recover the key for security + + +# QRadar Log Source Configuration # + +If you want to ingest data from an endpoint using Universal Rest API Protocol, configure a log source on the QRadar® Console using the Workflow field so that the defined endpoint can communicate with QRadar by using the Universal Rest API protocol. + +1. Log in to QRadar. +2. Click the *Admin* tab. +3. To open the app, click the *QRadar Log Source Management* app icon. +4. Click *New Log Source* > Single Log Source. + + +## 1. Select Log Source Type ## +1. Select *XM Cyber* log source type. +2. Click *Select Protocol Type* to go to the next section. + +## 2. Select Protocol Type ## +1. Select *Universal Cloud Rest API* protocol type. +2. Click *Configure Log Source Parameters* to go to the next section. +3. If option "Universal Cloud Rest API" is not available in protocol type, then uninstall the XM Cyber app from extensions management, install the Universal Cloud Rest API Protocol and then install the XM Cyber app. + +## 3. Configure Log Source Parameters ## +1. Name is the name of the Log Source and it can be kept anything based on the user's choice. +2. Select "XMCyberCustom_ext" Extension. It is used for post processing of events. +3. Disable *Coalescing Events* to avoid grouping of the events on the basis of Source and Destination IP. +4. Except for the above fields everything can be kept as their default values or if needed can be changed by the QRadar admin. +5. Click *Configure Protocol Parameters* to go to the next section. + +## 4. Configure Protocol Parameters ## +1. Add "Log Source Identifier" of user's choice. +2. Copy the content of the any workflow file in "Workflow". List of the workflow files can be found [here](#supported-events-types). +3. Modify the content as per user specification in the file XM-Cyber-Workflow-Parameter-Values.xml and add in "Workflow Parameter Values". +4. Create new log sources and repeat **QRadar Log Source Configuration** steps to collect other data and use the files as Workflow listed [here](#supported-events-types). +5. Recurrence is the time interval between each execution of the workflow. Input the value as 1D, default value would be 10 minutes. +6. Except for the above fields everything can be kept as their default values or if needed can be changed by the QRadar admin. +7. Click *Test Protocol Parameters* to test the entered workflow files. + +## 5. Test Protocol Parameters ## +1. Click *Start Test* to start the testing of the entered workflows, once it is finished click *Finish*. +2. Deploy the configuration from admin panel. + +# Workflow Parameter Description # +1. tenantName: The API Endpoint Hostname to fetch the events from XM Cyber. If your URL is https://your-tenant.clients.xmcyber.com/login then enter **your-tenant.clients.xmcyber.com** +2. apiKey: The API Key obtained from XM Cyber portal. +3. auditTrailsStartTime: Required for Audit Trails collection. Defines the start time for collecting Audit Trails data. Provide the Audit Trails start time in the format YYYY-MM-DDTHH:MM:SS.SSSZ +4. ingestChokepointStats: Required for Entities collection. If set to True, entities chokepoint statistics will also be ingested into QRadar as an event after entity data collection. +5. ingestScenarios: Required for Security Score collection. If set to True, scenarios data collected during Security Score data collection will also be ingested into QRadar. +6. timeId: Required for Security Score collection. Defines the start time for collecting Security Score data. Must be from [timeAgo_days_7, timeAgo_days_14, timeAgo_days_30, timeAgo_days_180]. + +# Supported Events Types # + +| Workflow Name | Events will be collected | API Endpoint | +| --- | --- | --- | +| XMCyber-AuditTrails-Workflow.xml | Audit Trail | /api/audit-trail/auditRecords | +| XMCyber-Entities-Workflow.xml | Compromised Entity, Entity, Entity Chokepoint | /api/v2/reports/data/scenariosCriticalAssetsReport/entities, /api/entityInventory/entities, /api/v2/reports/data/scenariosChokePointsReport/chokePointsEntities | +| XMCyber-Devices-Workflow.xml | Device | /api/v2/vavm/devices | +| XMCyber-FindingsExposures-Workflow.xml | Finding and Exposure | /api/v2/reports/data/scenariosExposureReport/exposures | +| XMCyber-Products-Workflow.xml | Products | /api/v2/vavm/public/products | +| XMCyber-Scenarios-Workflow.xml | Scenario | /api/scenarios/v2/scenarios | +| XMCyber-SecurityScore-Workflow.xml | Security Score, Security Score Scenario | /api/scenarios/v2/scenarios/riskScore | +| XMCyber-Sensors-Workflow.xml | Sensor | /api/sensors | | XMCyber-Vulnerabilities-Workflow.xml | Vulnerability | /api/v2/vavm/public/vulnerabilities | \ No newline at end of file