Cyware Orchestrate

Cisco Stealthwatch solution provides enterprise-wide network visibility to detect and respond to threats in real-time. The application continuously analyzes network activities to create a baseline of normal network behavior. It then uses this baseline, along with non–signature-based advanced analytics that includes behavioral modeling and machine learning algorithms, as well as global threat intelligence to identify anomalies and detect and respond to threats in real-time.

Cisco Stealthwatch can quickly and with high confidence detect threats such as Command-and-Control (C&C) attacks, ransomware, Distributed-Denial-of-Service (DDoS) attacks, illicit crypto mining, unknown malware, and insider threats.

The Cisco Stealthwatch app is configured with Orchestrate application to perform the following actions:

This action retrieves all the incidents of a particular tenant in the Cisco Stealthwatch application.

Action Input Parameters

Example Request

[
    {
        "tenant_id": "8xxxxx82-fxx6-4xx6-9xxx-978xxxxxx8"
    }
]

This action retrieves specific incidents by passing the tenant ID and the incident origin ID from the Cisco Stealthwatch application.

Action Input Parameters

Example Request

[
    {
        "tenant_id": "8xxxxx82-fxx6-4xx6-9xxx-978xxxxxx8",
        "incident_id": "eyJhbGciOxxxxxxiIsInR5cCIxxxVCJ9"
    }
]

This action adds a particular IP address to a tag in the Cisco Stealthwatch application.

Action Input Parameters

Example Request

[
    {
        "tenant_id": "8xxxxx82-fxx6-4xx6-9xxx-978xxxxxx8",
        "tag_id": "58c163a760bxxxxe707e8b",
        "ip_address": "1.1.1.1"
    }
]

This action retrieves alerts from custom hosts of the Cisco Stealthwatch application.

Action Input Parameters

Example Request

[
    {
        "tenant_id": "8xxxxx82-fxx6-4xx6-9xxx-978xxxxxx8",
        "tag_id": "58c163a760bxxxxe707e8b",
    }
]

This action retrieves alerts from external hosts of the Cisco Stealthwatch application.

Action Input Parameters

Example Request

[
    {
        "tenant_id": "8xxxxx82-fxx6-4xx6-9xxx-978xxxxxx8",
        "tag_id": "58c163a760bxxxxe707e8b",
    }
]

This action retrieves alerts from internal hosts of the Cisco Stealthwatch application.

Action Input Parameters

Example Request

[
    {
        "tenant_id": "8xxxxx82-fxx6-4xx6-9xxx-978xxxxxx8",
        "tag_id": "58c163a760bxxxxe707e8b",
    }
]

This action retrieves all tenant details from the Cisco Stealthwatch application.

Action Input Parameters

This action does not require any input parameter.