Integrate Anomali STAXX with Google SecOps

This document explains how to integrate Anomali STAXX with Google Security Operations (Google SecOps).

Integration version: 4.0

Integration parameters

Use the following parameters to configure the integration:

Parameter name	Type	Default value	Is mandatory	Description
Instance Name	String	N/A	No	Name of the Instance you intend to configure integration for.
Description	String	N/A	No	Description of the Instance.
Server Address	String	https://<ip>:<port>	Yes	Server address of the Anomali STAXX instance.
Username	String	N/A	Yes	Username of the Anomali STAXX account.
Password	Password	N/A	Yes	Password of the Anomali STAXX account.
Verify SSL	Checkbox	Unchecked	No	If enabled, verifies that the SSL certificate for the connection to the Anomali STAXX server is valid.
Run Remotely	Checkbox	Checked	No	Check the field in order to run the configured integration remotely. Once checked, the option appears to select the remote user (agent).

For instructions about how to configure an integration in Google SecOps, see Configure integrations .

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances .

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action .

Ping

Test connectivity to Anomali STAXX with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

None.

Run on

This action doesn't run on entities, nor has mandatory input parameters.

Action results

Script result

Script result name	Value options	Example
is_success	True or False	is_success:False

Case wall

Result type	Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: "Successfully connected to the Anomali STAXX server with the provided connection parameters!" The action should fail and stop a playbook execution: If not successful: "Failed to connect to the Anomali STAXX server! Error is {0}".format(exception.stacktrace)	General

Result type

Description

Type

Output message*

The action should not fail nor stop a playbook execution:

if successful: "Successfully connected to the Anomali STAXX server with the provided connection parameters!"

The action should fail and stop a playbook execution:

If not successful: "Failed to connect to the Anomali STAXX server! Error is {0}".format(exception.stacktrace)

General

Connectors

For more detail about how to configure connectors in Google SecOps, see Ingest your data (connectors) .

Anomali STAXX - Indicators Connector

Pull indicators from Anomali STAXX.

Connector parameters

Use the following parameters to configure the connector:

Parameter name

Type

Default value

Is mandatory

Description

Product Field Name

String

Product Name

Yes

The name of the field where the product name is stored.

The default value is Product Name .

The product name primarily impacts mapping. To streamline and improve the mapping process for the connector, the default value resolves to a fallback value that is referenced from the code. Any invalid input for this parameter resolves to a fallback value by default.

Event Field Name

String

itype

Yes

The name of the field that determines the event name (subtype).

Environment Field Name

String

The name of the field where the environment name is stored.

If the environment field is missing, the connector uses the default value.

Environment Regex Pattern

String

A regular expression pattern to run on the value found in the Environment Field Name field. This parameter lets you manipulate the environment field using the regular expression logic.

Use the default value .* to retrieve the required raw Environment Field Name value.

If the regular expression pattern is null or empty, or the environment value is null, the final environment result is the default environment.

Script Timeout (Seconds)

Int

180

Yes

The timeout limit, in seconds, for the Python process that runs the current script.

Server Address

String

https://<ip>:<port>

Yes

Server address of the Anomali STAXX instance.

Username

String

N/A

Yes

Username of the Anomali STAXX account.

Password

N/A

Yes

Password of the Anomali STAXX account.

Server Timezone

String

N/A

Specify which timezone is set on the Anomali STAXX server in regards to UTC, such as +1 or -1 . If nothing is specified, the connector uses UTC as a default timezone.

Lowest Severity To Fetch

String

Medium

Yes

Lowest severity that will be used to fetch Indicators.

Possible values:

Low
Medium
High
Critical

Lowest Confidence To Fetch

Integer

Lowest confidence that will be used to fetch indicators.

Fetch Max Hours Backwards

Integer

The number of hours prior to now to retrieve indicators.

This parameter can apply to the initial connector iteration after you enable the connector for the first time, or the fallback value for an expired connector timestamp.

Max Indicators To Fetch

Integer

How many indicators to process per one connector iteration.

Use whitelist as a blacklist

Checkbox

Unchecked

Yes

If selected, the connector uses the dynamic list as a blocklist.

Verify SSL

Checkbox

Unchecked

Yes

If selected, the integration validates the SSL certificate when connecting to the Anomali STAXX server.

Proxy Server Address

String

N/A

The address of the proxy server to use.

Proxy Username

String

N/A

The proxy username to authenticate with.

Proxy Password

Password

N/A

The proxy password to authenticate with.

Connector rules

The connector supports proxies.

Need more help? Get answers from Community members and Google SecOps professionals.