Skip to main content

Cyware Orchestrate

Configure Cyware Agent with Apps and Playbooks

Analysts can configure the Cyware Agent with the apps to establish communication between the app resources hosted on-premise. For example, your Orchestrate is hosted on the public cloud, while your SIEM application is hosted on-premise. You can use Cyware Agent to execute actions on the on-premise SIEM application using Appstore apps configured with Cyware Agent.

You can identify the Cyware Agent compatible apps, app instances, and playbooks using the Cyware_Orchestrate_-_Agent_Enabled_Icon.png icon indicating that the instance is ready for use.

Before you Start

  • Ensure that your Orchestrate tenant is Cyware Agent enabled. For more information about enabling the Cyware Agent, contact the Cyware customer support team.

  • Ensure that the Cyware Agent is installed and configured at your on-premise location. For more information about installing and configuring the Cyware Agent at your on-premise location, contact the Cyware customer support team.

  • Ensure that an API key is created using Open API for the Orchestrate tenant to communicate with the Cyware Agent.

Steps

  1. Configure App with Cyware Agent

  2. Configure App Instance with Cyware Agent

  3. Use Cyware Agent Configured App Instance in a Playbook

Configure App with Cyware Agent

You can configure an app that is installed from Appstore or the apps that you have created or imported with Cyware Agent to help the app communicate with the customer resources that are hosted on-premise.

Note

If you need to add an app to a Playbook that is published by Cyware and is not configured with Cyware Agent, you can contact the Customer Support team to configure it. Security analysts cannot configure a Cyware app if it is not compatible with the Cyware Agent.

To configure an app to be Cyware Agent compatible, perform the following steps:

  1. Click the Main menu.

  2. Click the Apps and navigate to My Apps.

  3. Select an app, and click the ellipsis icon on the top right corner of the page.

  4. Click Edit app.

  5. From App Details > App Information toggle on Agent Compatibility.

Configure App Instance with Cyware Agent

When adding an app to a playbook, it must have at least one compatible instance of Cyware Agent.

To configure an app instance with Cyware Agent:

  1. Select the Cyware Agent compatible app for which you want to configure an agent-compatible instance.

  2. Click the Instances tab.

  3. Click the + icon to add an instance for the selected app version.

  4. Toggle on Agent Compatible to enable the agent for the instance.

    Note

    If an app instance is already compatible with Cyware Agent, then you cannot turn off the Agent Compatible toggle.

  5. Select an agent from the installed agents.

  6. Configure the remaining fields and click Create.

Use Cyware Agent Configured App Instance in a Playbook

The app instances that are Cyware Agent compatible can be used in a playbook to make the playbook node compatible with Cyware Agent.

Note

You can use either app instances that are Cyware Agent compatible or normal app instances in a node of a playbook. Do not use a combination of Cyware Agent compatible app instances and normal instances in a node of a playbook.

To use Cyware Agent Configured App instances in a Playbook:

  1. Go to Main Menu > Manage Playbooks.

  2. Click the New Playbook icon in the top right corner.

  3. Configure the Playbook Overview details.

  4. In the Playbook canvas, drag and drop an app action node to build a Playbook.

  5. Choose an App-Action from the list.

  6. Click the Edit node.

  7. Select the App Instance field and add the required app instances that are Cyware Agent from the list. You can identify the Cyware Agent compatible app instances using the Cyware_Orchestrate_-_Agent_Enabled_Icon.png icon.

  8. Add the remaining nodes to the playbook and click Save.