Cisco Secure Cloud Analytics

Adds a domain to a watchlist in Cisco Secure Cloud Analytics.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Build the JSON payload to POST
[] Request the domain be added to the watchlist
[] Check if the request was successful:
[]> If it was, extract the entry ID and set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3

Cisco Secure Cloud Analytics - Add Domain to Watchlist

prod-nam

prod-eu

prod-apjc

Gets alerts from Cisco Secure Cloud Analytics based on the search string and status provided and within a specified time range.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Format the start and end dates
[] Request alerts
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3

Cisco Secure Cloud Analytics - Get Alerts

Gets details about devices from Cisco Secure Cloud Analytics using a device ID.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Request device details from Secure Cloud Analytics
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3

Cisco Secure Cloud Analytics - Get Device Details by ID

Gets flows from Cisco Secure Cloud Analytics based on a source IP, destination IP, and time frame.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Format the start and end dates
[] Request flows from Secure Cloud Analytics
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3

Cisco Secure Cloud Analytics - Get Flows by IPs

Gets details about an observation from Cisco Secure Cloud Analytics using a observation ID.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Request observation details from Secure Cloud Analytics
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3

Cisco Secure Cloud Analytics - Get Observation Details by ID

Gets observations from Cisco Secure Cloud Analytics based on the observations type withing a specified time range.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Format the start and end dates
[] Request observations from Secure Cloud Analytics
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3

Cisco Secure Cloud Analytics - Get Observations

Gets roles from Cisco Secure Cloud Analytics for a given IP address newer than the start date provided.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Search the for the device ID of the IP address provided
[] Check if the request was successful:
[]> If it was, attempt to extract the device ID of the first source result and get its roles
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3

Cisco Secure Cloud Analytics - Get Roles by IP Address

Gets a list of domains in the Cisco Secure Cloud Analytics watchlist.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Request the list of domains in the watchlist
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3

Cisco Secure Cloud Analytics - List Domains in Watchlist

Removes the domain provided from the Cisco Secure Cloud Analytics watchlist.

Target: Secure Cloud Analytics - v3 integration target or an HTTP Endpoint for "<your tenant>.obsrvbl.com" with a path of "/api"

Account Key: None if using an integration-provided target, API key if using an HTTP Endpoint target

Steps:
[] Validate the API path
[] Build the authorization header
[] Search the watchlist for the domain provided
[] Check if the request was successful:
[]> If it was, attempt to extract the first entry's ID and remove it from the watchlist
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/stealthwatch/cloud/#!stealthwatch-cloud-api-version-3