Integrate Orchestrate with CTIX
Orchestrate is an any-to-any vendor-agnostic orchestration platform for connecting and automating cyber, IT, and DevOps workflows across cloud, on-premise, and hybrid environments. Integrate CTIX with Orchestrate application using Open APIs. You can leverage Orchestrate Playbooks and perform various orchestration tasks on the threat indicators that it received from the CTIX application.
To integrate Orchestrate with CTIX:
Create Open API credentials in Orchestrate
Create Open API credentials in Orchestrate to integrate it with CTIX.
Sign in to Orchestrate as an administrator.
Navigate to Admin Panel and select Open API.
Click Add Open API.
Enter the API Title as CTIX integration.
Choose an Expiration Date for your API credentials.
For Bot User, choose your name. Bot Users can access Orchestrate Open API endpoints based on the permissions assigned.
Toggle the status to Active.
Click Create.
Click Download credentials to download API authentication credentials such as API URL, Access ID, and API Key. Save the credentials as you will not be able to recover them again after you navigate away from this page.
Configure Orchestrate Integration in CTIX
Add Orchestrate credentials in CTIX and enable Trigger Playbook action.
Sign in to CTIX as an administrator.
Navigate to Administration and click Integration Management.
From Tool Integrations, select Cyware Products to see the Orchestrate integration.
Click CSOL.
Click Add Account.
Enter a name for the integration. For example, Block Hashes.
Provide Orchestrate API credentials that you generated such as API URL, Access ID, and Secret Key.
Click Save.
Click on the ellipse in the top-right corner and select Manage to view the successful configuration.
Now click on Manage Actions to see the available endpoints.
Enable the Trigger Playbook V3 for Orchestrate and Trigger Playbook for CSOL. You can also enable these actions from the integration details page.
Create Label in Orchestrate
A label serves as a link between events and playbooks, initiating the playbooks when the events occur. Labels are attached to playbooks to automatically trigger the execution of the playbook. These events are received as event data in Orchestrate or from external platforms such as CFTR, CTIX, Splunk, and more.
To create a label, do the following:
Sign in to the Orchestrate application as an administrator.
From Main Menu and navigate to Triggers > Labels.
Click Add Label.
Enter a title and description for the label.
Choose a color for the label and set the Status to Active.
Click Create.
Configure Trigger in Orchestrate
Configure a trigger in the Orchestrate application to automatically execute a playbook on the occurrence of an event. When the configured trigger details match with the incoming event data, the playbooks execute automatically.
Sign in to the Orchestrate application as an administrator.
From Main Menu, navigate to Triggers > Configure Triggers.
Click Add Configure Event.
Enter Event Source App as ctix.
Important
Make sure to enter this value as ctix only. If you enter anything else, this trigger will not be visible in CTIX.
Enter an Event Type. For example, block_ctix_hash.
Attach the label that you created in the previous topic to this trigger. You can choose one or more labels. When the Event Source App and Source Event Type details match with the incoming event data, all the Playbooks associated with the chosen label will execute automatically.
Make sure the status toggle is Active.
Click Create.
Create a Rule in CTIX to trigger the playbook
Create a rule in CTIX to trigger Orchestrate Playbooks. Rules are automation tasks in CTIX that execute a configured action based on incoming data and the conditions you set up in CTIX.
For example, you can create a rule in CTIX to trigger Orchestrate playbooks to block a particular malicious IP address, when that IP address is received in CTIX.
Sign in to CTIX as an administrator.
From the Main Menu, navigate to Actions > Rules.
Click New Rule.
Enter a rule name.
Configure a source and collection for your rule.
Specify your conditions.
Select the following values in Actions.
Action as Trigger Playbook V3 to trigger a Playbook in Orchestrate.
Action as Trigger Playbook to trigger Playbook in CSOL.
Application as CSOL or CO as required.
Choose your configured Orchestrate account. In this example, you can select Block Hashes.
Choose the Event Type you have configured in Orchestrate. In this example, you can select block_ctix_hash.
Click Save.
Result
After configuring this workflow, CTIX automatically sends the event date to the required playbook in Orchestrate.