Skip to main content
Skip table of contents

Cisco Orbital

LAST UPDATED: OCT 23 2024

Overview

Orbital is available for customers with Secure Endpoint Advantage. Orbital is a service that uses osquery to provide you with information about your hosts. osquery exposes an entire operating system as a relational database that you can query with SQL to gather information about the hosts wherever Orbital has been deployed.

D3 SOAR is providing REST operations to function with Cisco Orbital.

Cisco Orbital is available for use in:

D3 SOAR

V16.0+

Category

Other

Deployment Options

Option II, Option IV

Connection

To connect to Cisco Orbital from D3 SOAR, please follow this part to collect the required information below:

Parameter

Description

Example

Server URL

The server URL of the Cisco Orbital instance.

  • North American customers: https://orbital.amp.cisco.com

  • European customers: https://orbital.eu.amp.cisco.com

  • Asian and Pacific customers: https://orbital.apjc.amp.cisco.com

https://orbital.amp.cisco.com

Client ID

The client ID to authenticate the API connection.

CLIENT_ID

Client Secret

The client secret to authenticate the API connection.

CLIENT_SECRET

API Version

The API version to use for the connection.

v0

Configuring Cisco Orbital to Work with D3 SOAR

Obtaining API Credentials

Creating API credentials is now done through SecureX. Refer to the API Clients topic of the SecureX online documentation for information on Creating API Client Credentials. To access this topic, follow the path: SecureX Help > Administration > API Clients.

Configuring D3 SOAR to Work with Cisco Orbital

  1. Log in to D3 SOAR.

  2. Find the Cisco Orbital integration.

    screenshot_1 (1).png
    1. Navigate to Configuration on the top header menu.

    2. Click on the Integration icon on the left sidebar.

    3. Type Cisco Orbital in the search box to find the integration, then click it to select it.

    4. Click + Connection, on the right side of the Connections section. A new connection window will appear.

  3. Configure the following fields to create a connection to Cisco Orbital.

    screenshot_2 (1).png
    1. Connection Name: The desired name for the connection.

    2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

    3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.

    4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

    5. Description (Optional): Add your desired description for the connection.

    6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.

    7. Configure User Permissions: Defines which users have access to the connection.

    8. Active: Check the tick box to ensure the connection is available for use.

      screenshot_3 (2).png
    9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
      1. Input the Server URL. The default value is https://orbital.amp.cisco.com.
      2. Input the Client ID.
      3. Input the Client Secret.
      4. Input the API Version. The default value is v0.

    10. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
      To set up a connection health check, check the Connection Health Check tickbox. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.

    11. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.

  4. Test the connection.

    1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.

    2. Click OK to close the alert window.

    3. Click + Add to create and add the configured connection.

Commands

Cisco Orbital includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Cisco Orbital API, please refer to the Cisco Orbital API reference.

Note for Time-related parameters

The input format of time-related parameters may vary based on your account settings. As a result, the sample data provided in our commands is different from what you see. To set your preferred time format, follow these steps:

  1. Navigate to Configuration > Application Settings. Select Date/Time Format.

    Frame 4 (25)-20241017-192013.png
  2. Choose your desired date and time format.

    Frame 3 (24)-20241017-192025.png

After that, you will be able to view your preferred time format when configuring the DateTime input parameters for commands.

Get Query Results

Collects results from Orbital from the query created either by the Orbital User Interface, your applications, or the Query API. Orbital will provide results as soon as they are received from a node, and will retain them for at least 24 hours but no longer than 48 hours.

READER NOTE

The parameter Job IDs is required to run this command.

  • Run the Scheduled Query or Live Query command to obtain Job IDs.

Input

Input Parameter

Required/Optional

Description

Example

Job IDs

Required

The ID(s) for the query job(s). Job ID can be obtained using the Scheduled Query or Live Query commands, or from the Orbital user interface.

[ "JOB_ID" ]

Limit

Optional

The limit on the number of results Orbital will return for each Job ID. If not specified, the default number will be 100.

10

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON
No Sample Data
Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE
Successful
Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE
No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get Query Results failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cisco Orbital portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Could not find credentials in request.

Error Sample Data

Get Query Results failed.

Status Code: 401.

Message: Could not find credentials in request.

Live Query

Runs live queries immediately and returns information from only the nodes that are connected at the time the query is run. Orbital will retain the results of all queries for a maximum of 48 hours.

Input

Input Parameter

Required/Optional

Description

Example

Name

Optional

The descriptive name for the query, used by the UI to help users distinguish queries.

My Custom Query

osQuery

Required

The list of osQuery objects.

[

{

"label": "list_processess",

"name": "List Processes",

"sql": "SELECT * FROM processes;"

}

]

Nodes

Required

The list of Orbital node identifiers. In order to have a valid query, one or more of the following four prefixes must be used: nodes, os, nodeversion, or netmask. Refer to Query API for more details.

[ "host:FRONT-DESK-123" ]

Expiry

Required

The time when the query will expire, after which, no nodes will be asked to answer the query. This field is required and must be set to at least one minute in the future.

2023-06-21 00:00

Operating Systems

Optional

The list of operating systems, such as ["windows"]. If present, Orbital will add all hosts with the given operating systems to the list of nodes. Having an explicit node in the list along with its os will not cause queries to run twice on that node. The available options are windows, linux and darwin.

[ "windows" ]

Context

Optional

The table of strings which will be stored with each result. Used to pass opaque metadata on to webhooks, such as a CTR or Threat Grid URL for more information.

{

"description": "front desk",

"value": "anything"

}

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON
No Sample Data
Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE
Successful
Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE
No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Live Query failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cisco Orbital portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Could not find credentials in request.

Error Sample Data

Live Query failed.

Status Code: 401.

Message: Could not find credentials in request.

Scheduled Query

Schedules a query and returns an object that provides information needed to collect the results. Scheduled queries can have a duration (interval) assigned to them specifying how long the query will run for. If one or more nodes come online after the query has started running, the results for those new nodes will be created when the nodes connect. Orbital will retain the results of all queries for a maximum of 48 hours.

Input

Input Parameter

Required/Optional

Description

Example

Name

Optional

The descriptive name for the query, used by the UI to help users distinguish queries.

My Custom Query

osQuery

Required

The list of osQuery objects.

[

{

"label": "list_processess",

"name": "List Processes",

"sql": "SELECT * FROM processes;"

}

]

Nodes

Required

The list of Orbital node identifiers. In order to have a valid query, one or more of the following four prefixes must be used: nodes, os, nodeversion, or netmask. Refer to Query API for more details.

[ "host:FRONT-DESK-123" ]

Expiry

Required

The time when the query will expire, after which, no nodes will be asked to answer the query. This field is required and must be at least one minute in the future.

2023-06-21 00:00

Interval

Required

The period in seconds which determines how long until Orbital will request a new result from a node for the query. This field is required and must be set to at least a value of 0. If the value has been set to 0, it causes the query to run on each applicable node only once, for up to a maximum of 24 hours. Using this parameter allows the user to define a scheduled query, but have it only run once on each organizational endpoint that matches the query criteria.

600

Operating Systems

Optional

The list of operating systems, such as ["windows"]. If present, Orbital will add all hosts with the given operating systems to the list of nodes. Having an explicit node in the list along with its os will not cause queries to run twice on that node. The available options are windows, linux and darwin.

[ "windows" ]

Context

Optional

The table of strings which will be stored with each result. Used to pass opaque metadata on to webhooks, such as a CTR or Threat Grid URL for more information.

{

"description": "front desk",

"value": "anything"

}

Webhook IDs

Optional

The ID(s) of the existing Webhook(s) via which scheduled query results get sent.

[ "***" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON
No Sample Data
Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE
Successful
Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE
No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Scheduled Query failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cisco Orbital portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Could not find credentials in request.

Error Sample Data

Scheduled Query failed.

Status Code: 401.

Message: Could not find credentials in request.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE
Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Test Connection failed. Failed to check the connector.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cisco Orbital portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Could not find credentials in request.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 401.

Message: Could not find credentials in request.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.