Open topic with navigation

# Integrating SOAR with Intelligence

Micro Focus ArcSight Intelligence uses unsupervised machine learning to calculate probabilistic risk assessments based on behavioral analytics from millions of events, ultimately generating a short list of high value targets to allow security teams to detect, investigate, and respond to threats that might hide in the enterprise before any case occurs.

SOAR has the following integration capabilities with Intelligence:

- Ingest Anomalies as Alert

- Get Entity Details

## Use Cases

Use Case #1: Prioritizing Cases

SOAR is integrated with Intelligence, to help prioritization and investigation of cases as well as remediation of cases. When an alert is received, a new case is created in the Case Management Service Desk of SOAR. SOAR then automatically checks the risk scores of entities and prioritizes the case based on these risk scores. Get Entity Details enrichment results return latest 1000 records maximum.

Use Case #2: Mitigating Account Compromise

SOAR ingests anomaly data from Intelligence and creates case tickets in the Case Management Service Desk. With its broad integration portfolio, orchestration, and automation capabilities, SOAR investigates, ascertains the case, and takes necessary actions to prevent the compromise.

The bidirectional integration of Intelligence and SOAR requires configuration at both the capabilities.

## Configuration

Prerequisites

- SOAR connects to Micro Focus ArcSight Intelligence API via HTTPS. By default, the interface works on 443/tcp port. Make sure that you have access permission to this port.

- A user account for SOAR to connect to the Intelligence API.

### Configuring ArcSight Intelligence

No specific configuration is needed on Intelligence.

### Configuring SOAR

1. Click Configuration > Credentials > Create Credential.

2. If the use.basic.authentication configuration parameter value is False, then get the Client id and Client secret from Intelligence to ensure that the Intelligence Alert Source and Intelligence Integration work as expected.

   Note: The default value of use.basic.authentication parameter is False.

   To get the Client ID and Client Secret for Micro Focus Intelligence open a command prompt and:

   1. Specify the name of the server on which Intelligence works.

   2. Run the following command to get Client ID and Client Secret from Intelligence:

          osp-client-id and osp-client-secret : kubectl get secret osp-secret -n arcsight-installer-tyoib -o yaml

      The output is displayed in the following format:

          data:
          osp-client-id: NTZjODkyYWE3NDMzZThiOTYzZGVkMjE5ZGIzODU3ZDg=
          osp-client-secret:
          ZjRiZDUzODBiZjQ2NTY5MWQ4NDAzMTFhZTJmMjY1ZGJlZGRjOWU0NDhlZmE3ZDhjN2Q5YzJlY2VjMDkzMmExNw==

   3. Run the following command to decode the Client ID and Client Secret:

          echo 'NTZjODkyYWE3NDMzZThiOTYzZGVkMjE5ZGIzODU3ZDg=' | base64 --decode
          echo 'ZjRiZDUzODBiZjQ2NTY5MWQ4NDAzMTFhZTJmMjY1ZGJlZGRjOWU0NDhlZmE3ZDhjN2Q5YzJlY2VjMDkzMmExNw==' | base64 --decode

   4. Run the following command to add the Client ID to the Alert Source / Integration configuration on Intelligence.

          # Client id that defined in OSP
          client.id=id

3. Specify the following parameter values in the Credential Editor:

   Parameter | Value
   --- | ---
   Type | Internal Credential
   Name | Display name of credential set (For example, Intelligence Credentials)
   Username | Name of the SOAR user created on Intelligence.
   Password | Password of the SOAR user created on Intelligence.
   Private Key | Client secret that has been defined in OSP

### Configuring Intelligence as an Alert Source

1. Click Configuration > Integrations > Create Alert Source.

2. Specify the following parameter values in the Configuration form:

   Parameter | Value
   --- | ---
   Name | Display name of Intelligence Alert Source on SOAR.
   Type | Micro Focus ArcSight Intelligence.
   Address | Address of the Intelligence server (the format must be https://172.16.11.9).
   Configuration | Specify the following configuration parameters:
       tenant.id=
       # ID of the proxy integration to use when connecting to current source.
       # If not provided, ArcSight SOAR will try to use a direct connection.
       #proxy.id=123
       # configure how far (in minutes) into the past this enrichment will look.
       #cache.reusing.duration=20
       # Base path of the Micro Focus Intelligence. SOAR adds it to end of the URL to access Micro Focus Intelligence.
       interset.context.path=/interset
       # Client id that defined in OSP
       client.id=id
   Note: By default,Intelligence uses 0 for tenant id. However, Intelligence - SOAR integration supports different tenants.
   Credential | Name of the credential set you have created (For example, Micro Focus ArcSight Credentials)
   Trust Invalid SSL Certificates | Select this if Web UI’s certificate is self-signed or is not recognized by browsers
   Visible Alert Fields | You might define the alarm fields that will be displayed on the Case Management Service Desk

3. Click Save to complete the integration.

4. Click Test to test the integration.

### Configuring Intelligence as Integration

1. Click Configuration > Integrations > Create Integration.

2. Specify the following parameter values in the Configuration form:

   Parameter | Value
   --- | ---
   Name | Display name of Intelligence integration on SOAR.
   Type | Micro Focus ArcSight Intelligence.
   Address | Address of the Intelligence server (the format must be https://172.16.11.9).
   Configuration | Specify the following configuration parameters:
       tenant.id=
       # ID of the proxy integration to use when connecting to current source.
       # If not provided, ArcSight SOAR will try to use a direct connection.
       #proxy.id=123
       # configure how far (in minutes) into the past this enrichment will look.
       #cache.reusing.duration=20
       # Base path of the Micro Focus Intelligence. SOAR adds it to end of the URL to access Micro Focus Intelligence.
       interset.context.path=/interset
       # Client id that defined in OSP
       client.id=id
   Credential | Name of the credential set you have created (For example, Micro Focus ArcSight Credentials)
   Trust Invalid SSL Certificates | Select this if Web UI’s certificate is self-signed or is not recognized by browsers
   Require Approval From | Select user(s) from the list to request for approval before executing actions on this integration. Because SOAR only executes enrichments on Intelligence, leave it empty.
   Notify | Select user(s) from the list to notify when SOAR performs an action on this integration. Because SOAR only executes enrichments on Intelligence, leave it empty.

3. Click Save to complete the integration.

4. Click Test to test the integration.

## Additional Notes

- The following configuration parameters can be used for fine tuning the integration. You must consult the SOAR field engineering team before editing them:

  - MicroFocusIntelligenceListenerMaxRetrySeconds Micro Focus Interset listener queue max message retry in seconds 1800

  - MicroFocusIntelligenceListenerQueueConcurrency Upper limit of Micro Focus Interset Listener consumer thread count 3

  - MicroFocusIntelligenceSyncPeriod Period in seconds to sync Micro Focus Interset anomalies 60

## Capabilities

1. Get Details

   Enrichment capability to get the risk score of a given entity and related alert details.

   The following table presents the Get Details capability details:

   Input Parameter | Description | Type | Scope Rescticted (Yes/No) | Required (Yes/No)
   --- | --- | --- | --- | ---
   Integration | Name of the third party integration. | Integration | N/A | Yes
   Entity | Entity to be queried on ArcSight Intelligence. | Network Address Host File Name URL | Yes | Yes
   Do not use cache | SOAR does not use cached results if this box is checked. | Checkbox | N/A | No

   Output:

   Case Scope:

   Action | Type | Category/ Value
   --- | --- | ---
   Add Scope Item Property | Integer | Micro Focus Intelligence Entity Risk
   Add Scope Item Property | TEXT | Micro Focus Intelligence Entity Hash
   Add Scope Item Property | TEXT | Micro Focus Intelligence Entity Type

   Human Readable Output:

   1. Risk tab:

   2. Alerts tab: