Cisco Orbital
Overview
Orbital is available for customers with Secure Endpoint Advantage. Orbital is a service that uses osquery to provide you with information about your hosts. osquery exposes an entire operating system as a relational database that you can query with SQL to gather information about the hosts wherever Orbital has been deployed.
D3 SOAR is providing REST operations to function with Cisco Orbital.
Cisco Orbital is available for use in:
Connection
To connect to Cisco Orbital from D3 SOAR, please follow this part to collect the required information below:
Parameter | Description | Example |
Server URL | The server URL of the Cisco Orbital instance.
| https://orbital.amp.cisco.com |
Client ID | The client ID to authenticate the API connection. | CLIENT_ID |
Client Secret | The client secret to authenticate the API connection. | CLIENT_SECRET |
API Version | The API version to use for the connection. | v0 |
Configuring Cisco Orbital to Work with D3 SOAR
Obtaining API Credentials
Creating API credentials is now done through SecureX. Refer to the API Clients topic of the SecureX online documentation for information on Creating API Client Credentials. To access this topic, follow the path: SecureX Help > Administration > API Clients.
Configuring D3 SOAR to Work with Cisco Orbital
Log in to D3 SOAR.
Find the Cisco Orbital integration.
Navigate to Configuration on the top header menu.
Click on the Integration icon on the left sidebar.
Type Cisco Orbital in the search box to find the integration, then click it to select it.
Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Cisco Orbital.
Connection Name: The desired name for the connection.
Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
Description (Optional): Add your desired description for the connection.
Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.
Configure User Permissions: Defines which users have access to the connection.
Active: Check the tick box to ensure the connection is available for use.
System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
1. Input the Server URL. The default value is https://orbital.amp.cisco.com.
2. Input the Client ID.
3. Input the Client Secret.
4. Input the API Version. The default value is v0.Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
To set up a connection health check, check the Connection Health Check tickbox. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
Test the connection.
Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.
Click OK to close the alert window.
Click + Add to create and add the configured connection.
Commands
Cisco Orbital includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.
Integration API Note
For more information about the Cisco Orbital API, please refer to the Cisco Orbital API reference.
Note for Time-related parameters
The input format of time-related parameters may vary based on your account settings. As a result, the sample data provided in our commands is different from what you see. To set your preferred time format, follow these steps:
Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose your desired date and time format.
After that, you will be able to view your preferred time format when configuring the DateTime input parameters for commands.
Get Query Results
Collects results from Orbital from the query created either by the Orbital User Interface, your applications, or the Query API. Orbital will provide results as soon as they are received from a node, and will retain them for at least 24 hours but no longer than 48 hours.
Reader Note
The parameter Job IDs is required to run this command.
Run the Scheduled Query or Live Query command to obtain Job IDs.
Input
Input Parameter | Required/Optional | Description | Example |
Job IDs | Required | The ID(s) for the query job(s). Job ID can be obtained using the Scheduled Query or Live Query commands, or from the Orbital user interface. | [ "JOB_ID" ] |
Limit | Optional | The limit on the number of results Orbital will return for each Job ID. If not specified, the default number will be 100. | 10 |
Output
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Get Query Results failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cisco Orbital portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Could not find credentials in request. |
Error Sample Data Get Query Results failed. Status Code: 401. Message: Could not find credentials in request. |
Live Query
Runs live queries immediately and returns information from only the nodes that are connected at the time the query is run. Orbital will retain the results of all queries for a maximum of 48 hours.
Input
Input Parameter | Required/Optional | Description | Example |
Name | Optional | The descriptive name for the query, used by the UI to help users distinguish queries. | My Custom Query |
osQuery | Required | The list of osQuery objects. | [ { "label": "list_processess", "name": "List Processes", "sql": "SELECT * FROM processes;" } ] |
Nodes | Required | The list of Orbital node identifiers. In order to have a valid query, one or more of the following four prefixes must be used: nodes, os, nodeversion, or netmask. Refer to Query API for more details. | [ "host:FRONT-DESK-123" ] |
Expiry | Required | The time when the query will expire, after which, no nodes will be asked to answer the query. This field is required and must be set to at least one minute in the future. | 2023-06-21 00:00 |
Operating Systems | Optional | The list of operating systems, such as ["windows"]. If present, Orbital will add all hosts with the given operating systems to the list of nodes. Having an explicit node in the list along with its os will not cause queries to run twice on that node. The available options are windows, linux and darwin. | [ "windows" ] |
Context | Optional | The table of strings which will be stored with each result. Used to pass opaque metadata on to webhooks, such as a CTR or Threat Grid URL for more information. | { "description": "front desk", "value": "anything" } |
Output
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Live Query failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cisco Orbital portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Could not find credentials in request. |
Error Sample Data Live Query failed. Status Code: 401. Message: Could not find credentials in request. |
Scheduled Query
Schedules a query and returns an object that provides information needed to collect the results. Scheduled queries can have a duration (interval) assigned to them specifying how long the query will run for. If one or more nodes come online after the query has started running, the results for those new nodes will be created when the nodes connect. Orbital will retain the results of all queries for a maximum of 48 hours.
Input
Input Parameter | Required/Optional | Description | Example |
Name | Optional | The descriptive name for the query, used by the UI to help users distinguish queries. | My Custom Query |
osQuery | Required | The list of osQuery objects. | [ { "label": "list_processess", "name": "List Processes", "sql": "SELECT * FROM processes;" } ] |
Nodes | Required | The list of Orbital node identifiers. In order to have a valid query, one or more of the following four prefixes must be used: nodes, os, nodeversion, or netmask. Refer to Query API for more details. | [ "host:FRONT-DESK-123" ] |
Expiry | Required | The time when the query will expire, after which, no nodes will be asked to answer the query. This field is required and must be at least one minute in the future. | 2023-06-21 00:00 |
Interval | Required | The period in seconds which determines how long until Orbital will request a new result from a node for the query. This field is required and must be set to at least a value of 0. If the value has been set to 0, it causes the query to run on each applicable node only once, for up to a maximum of 24 hours. Using this parameter allows the user to define a scheduled query, but have it only run once on each organizational endpoint that matches the query criteria. | 600 |
Operating Systems | Optional | The list of operating systems, such as ["windows"]. If present, Orbital will add all hosts with the given operating systems to the list of nodes. Having an explicit node in the list along with its os will not cause queries to run twice on that node. The available options are windows, linux and darwin. | [ "windows" ] |
Context | Optional | The table of strings which will be stored with each result. Used to pass opaque metadata on to webhooks, such as a CTR or Threat Grid URL for more information. | { "description": "front desk", "value": "anything" } |
Webhook IDs | Optional | The ID(s) of the existing Webhook(s) via which scheduled query results get sent. | [ "***" ] |
Output
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Scheduled Query failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cisco Orbital portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Could not find credentials in request. |
Error Sample Data Scheduled Query failed. Status Code: 401. Message: Could not find credentials in request. |
Test Connection
Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.
Input
N/A
Output
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Test Connection failed. Failed to check the connector. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cisco Orbital portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Could not find credentials in request. |
Error Sample Data Test Connection failed. Failed to check the connector. Status Code: 401. Message: Could not find credentials in request. |