Skip to main content

RSA Archer (Deprecated)

This Integration is part of the RSA Archer Pack.#

Deprecated

Use the RSA Archer v2 integration instead.

Overview

Deprecated. Use the RSA Archer v2 integration instead.

Configure the RSA Archer integration on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services .
  2. Search for RSA Archer.
  3. Click Add instance to create and configure a new integration instance.
    • Name : a textual name for the integration instance.
    • Server URL
    • Instance name
    • Username
    • Password
    • Trust any certificate (not secure)
    • Use system proxy settings
    • Fetch incidents
    • Incident type
    • Timezone offset in minutes of the RSA Archer server machine (+60, -60, in minutes)
    • Application ID for fetch
    • The application's base ID. For example "Incident ID"
    • fetchFilter - Specific filters for fetching in the form of an xml string
    • Use Archer's REST API instead of its SOAP API
    • Use European Time format (dd/mm/yyyy) instead of the American one
  4. Click Test to validate the URLs and connection.

Fetched Incidents Data

Fetches incidents data from RSA Archer, by using the archer-fetch-incidents command. In the first fetch, the program fetches incidents from the previous day until the time you run the command.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Create a record: archer-create-record
  2. Update a record: archer-update-record
  3. Get record information: archer-get-record
  4. Get application details or list of all applications: archer-search-applications
  5. Search for records: archer-search-records
  6. Get all application fields: archer-get-application-fields
  7. Delete a record: archer-delete-record
  8. Map list value name to list value ID: archer-get-field
  9. Get all reports: archer-get-reports
  10. Perform statistic search: archer-execute-statistic-search-by-report
  11. Get search criteria: archer-get-search-options-by-guid
  12. Search records by report: archer-search-records-by-report
  13. Get field mapping by level ID: archer-get-mapping-by-level
  14. Fetch Archer incidents: archer-manually-fetch-incident
  15. Download Archer file to the War Room: archer-get-file
  16. Upload a file from Cortex XSOAR to Archer: archer-upload-file
  17. Add data to the detailed analysis field: archer-add-to-detailed-analysis
  18. Get an Archer user's user ID: archer-get-user-id
  19. Get a list of values for a field: archer-get-valuelist

Create a record

Creates a new content record in a specified application.

Base Command

archer-create-record

Input
Input Parameter Description
applicationId ID of the application to create a record in
fieldsToValues

Record fields in JSON format. Field name is case sensitive.

Example: { Name1: Value1, Name2: Value2 }

Context Data
Path Description
Archer.Record.Id Record Content ID
Archer.Record.Fields Record property fields

Command Example

!archer-create-record applicationId="75" fieldsToValues="{\"Description\":\"Demisto Fraud Referrer \",\"Date/Time Occurred\":\"3/23/2018 7:00 AM\",\"Date/Time Identified\":\"3/23/2018 7:00 AM\",\"Date/Time Reported\":\"3/23/2018 7:00 AM\",\"Executive Summary\":\"test\", \"Incident Report\": \"test incident report from Demisto\"}"

Raw Output 
{  
   "Record":{  
      "Fields":{  
         "Date/Time Identified":"3/23/2018 7:00 AM",
         "Date/Time Occurred":"3/23/2018 7:00 AM",
         "Date/Time Reported":"3/23/2018 7:00 AM",
         "Description":"Demisto Fraud Referrer ",
         "Executive Summary":"test",
         "Incident Report":"test incident report from Demisto"
      },
      "Id":"227645"
   }
}

Update a record

Updates an existing content record in a specified application.

Base Command

archer-update-record

Input
Parameter Description
contentId Content (record) ID to update
applicationId

ID of the application to update a record in

fieldsToValues

Record fields in JSON format. Field name is case sensitive.

Example: { Name1: Value1, Name2: Value2 }

incidentId

Incident ID of the record.

Example: id=12345 for INC-12345

Context Data

There is no context data for this command.

Command Example

!archer-update-record applicationId=433 contentId=227538 fieldsToValues={\"Title\":\"test\"}

Raw Output 
content id = 227538 was updated successfully.

Get record information

Returns information for a content record in a specified application.

Base Command

archer-get-record

Input
Parameter Description
contentId Incident (record) ID to get details for
applicationId ID of the application to get the record from
incidentId

Incident ID of the record.

Example: id=12345 for INC-12345

Context Data
Path Description
Archer.Record.Id Content ID of the record
Archer.Record.Fields Content property fields
Archer.Record.Fields.Incident Status Incident status
Archer.Record.Fields.Record Status Record status
Archer.Record.Fields.Last Updated Last updated
Archer.Record.Fields.Days Open Days open
Archer.Record.Fields.Date Created Date created
Archer.Record.Fields.Title Title
Archer.Record.Fields.Incident Summary Incident summary
Archer.Record.Fields.Threat Category Threat category
Archer.Record.Fields.Threat Valid Threat valid

Command Example

!archer-get-record applicationId=433 contentId=227538

Raw Output 
"Record": {
    "Fields": {
      "Actor, Tactics \u0026 Techniques": null,
      "Affected Facility": null,
      "Archive": null,
      "Attach to InfoSec Briefing": null,
      "Attack Category": null,
      "Automatic Incident Handler Access": "SOC: L2 Incident Handler,SOC: L1 Incident Handler",
      "Count of Risks": "0",
      "Count of Risks Increased": "No",
      "Date Created": "2018-02-18T10:45:47+02:00",
      "Date/Time Assigned": null,
      "Date/Time Closed": null,
      "Date/Time Modified": "2018-02-22T14:32:46+02:00",
      "Date/Time Returned": null,
      "Days Open": "0",
      "Generate Incident Response Tasks": "No",
      "Incident Details": null,
      "Incident ID": "227538",
      "Incident ID (DFM)": "227538",
      "Incident ID (KPI)": "227538",
      "Incident Journal": null,
      "Incident Owner": null,
      "Incident Queue": "L1 Incident Handlers",
      "Incident Response Procedures": null,
      "Incident Status": "New",
      "Incident Summary": "inside_record_test_1_summary"...

Get application details or list of all applications

Returns details for an application or a list of all applications.

Base Command

archer-search-applications

Input
Parameter Description
findByName Get application by the application name. To return all applications, leave this parameter empty.
findById Get application by the application ID. To return all applications, leave this parameter empty.

Context Data
Path Description
Archer.Record.Id Content ID of the record
Archer.Record.Fields Content property fields
Archer.Record.Fields.Incident Status Incident status
Archer.Record.Fields.Record Status Record status
Archer.Record.Fields.Last Updated Last updated
Archer.Record.Fields.Days Open Days open
Archer.Record.Fields.Date Created Date created
Archer.Record.Fields.Title Title
Archer.Record.Fields.Incident Summary Incident summary
Archer.Record.Fields.Threat Category Threat category
Archer.Record.Fields.Threat Valid Threat valid

Command Example

!archer-search-applications findById=433

Raw Output 
[  
   {  
      "Guid":"fa254559-4922-4aea-8d53-66b4e3442585",
      "Id":433,
      "LanguageId":1,
      "Name":"Security Incidents",
      "Status":1,
      "Type":2
   },
   {  
      "Guid":"6fda8f2c-d74d-4bf1-aada-def95cba4aaf",
      "Id":17,
      "LanguageId":1,
      "Name":"Vulnerabilities",
      "Status":1,
      "Type":2
   }   ...
]

Search for records

Search for records within a specified application.

Base Command

archer-search-records

Input
Parameter Description
applicationId ID of the application to search records in
fieldsToDisplay

Fields to display in the search results, in array format.

Example: "Title,Incident Summary"

maxResults

Maximum search results to return. Default is 100.

searchValue

Search value. To search for all, leave this parameter empty.

fieldToSearchOn

Name of field to search on. To search for all, leave this parameter empty.

numericOperator

Numeric search operator

dateOperator

Date search operator

Context Data
Path Description
Archer.Record.Id Content of the record
Archer.Record.ApplicationId Application ID of the record
Archer.Record.Fields Property fields of the record

Command Example

!archer-search-records applicationId=433 maxResults=1

Raw Output 
{
  "Fields": 
  {
    "Incident ID": "225828",
    "Record": 
    {
      "Actor, Tactics \u0026 Techniques": null,
      "Affected Facility": null,
      "Archive": null,
      "Attach to InfoSec Briefing": null,
      "Attack Category": null,
      "Automatic Incident Handler Access": "SOC: L2 Incident Handler,SOC: L1 Incident Handler",...
      "Date Created": "2017-10-14T09:55:25+03:00",
      "Date/Time Assigned": null,
      "Date/Time Closed": null,
      "Date/Time Escalated": null,
      "Date/Time Modified": "2017-10-14T09:55:25+03:00",
      "Date/Time Returned": null,
      "Days Open": "0",
      "Incident ID": "225828",...
      "Record Status": "New",...
    }
  },
  "Id": "225828",
  "ModuleId": "433"
}

Get all application fields

Returns all application fields by application ID.

Base Command

archer-get-application-fields

Input
Parameter Description
applicationId ID of the application to search fields in

Context Data
Path Description
Archer.ApplicationFields Application property fields

Command Example

!archer-get-application-fields applicationId=433

Raw Output 
{
  "ApplicationFields": [
    {
      "FieldId": "15698",
      "FieldName": "Incident Response Procedures",
      "FieldType": 9,
      "LevelId": 232
    },
    {
      "FieldId": "15700",
      "FieldName": "Not Applicable Incident Response Procedures",
      "FieldType": 9,
      "LevelId": 232
    },
    {
      "FieldId": "15742",
      "FieldName": "CAST - SOC Incident Procs - DO NOT DELETE",
      "FieldType": 1001,
      "LevelId": 232
    }...
}

Delete a record

Deletes an existing record from a specified application.

Base Command

archer-delete-record

Input
Parameter Description
applicationId ID of the application to delete a record from
contentId Content (record) ID to delete
incidentId

Incident ID of the record.

Example: id=12345 for INC-12345

Context Data

There is no context data for this command.

Command Example

!archer-delete-record applicationId=423 contentId=227542

Raw Output 
content id = 227542 was deleted successfully

Map list value name to list value ID

Returns mapping from list value name to list value ID.

Base Command

archer-get-field

Input
Parameter Description
fieldId ID of the field
applicationId ID of the application to get the field value from

Context Data

There is no context data for this command.

Command Example

!archer-get-field applicationId=433 fieldID=16107

Raw Output 
{
    "FieldId": "16107",
    "Name": "Last Updated",
    "Type": 22,
    "levelId": 232
}

Get all reports

Returns all reports from Archer.

Base Command

archer-get-reports

Input

There is no input for this command.

Context Data

There is no context data for this command.

Command Example

!archer-get-reports

Raw Output 
{
    "ReportValues":
    {
        "ReportValue":[
            {
                "ApplicationGUID":"4cf0d0c6-4b51-404c-91c2-40ade972e95b",
                "ApplicationName":"Policies",
                "ReportDescription":"This report displays a listing of all security Policies.",
                "ReportGUID":"22961b81-4866-40ea-a298-99afb348598d",
                "ReportName":"Policies - Summary view"
            },
            {
                "ApplicationGUID":"138d3151-c1f5-4e7d-b6c9-4399e1d922ae",...

Perform statistic search

Performs a statistic search by report GUID.

Base Command

archer-execute-statistic-search-by-report

Input
Parameter Description
reportGuid GUID of the report
maxResults Maximum number of pages of the reports

Context Data
Path Description
Archer.StatisticSearch Search results

Command Example

!archer-get-application-fields applicationId=433

Raw Output 
{
    "Groups": {
        "-count": "3",
        "Metadata": {
            "FieldDefinitions": {
                "FieldDefinition": [
                    {
                        "-alias": "Classification",
                        "-guid": "769b2548-6a98-49b6-95c5-03e391f0a40e",
                        "-id": "76",
                        "-name": "Classification"
                    },
                    {
                        "-alias": "Standard_Name",
                        "-guid": "a569fd34-16f9-4965-93b0-889fcb91ba7a",
                        "-id": "1566",
                        "-name": "Standard Name"
                    }
                ]
            }
        },
        "Total": {
            "Aggregate": {
                "-Count": "1497",
                "-FieldId": "1566"
            }
        }
    }
}

Get search criteria

Returns search criteria by report GUID.

Base Command

archer-get-search-options-by-guid

Input
Parameter Description
reportGuid GUID of the report

Context Data

There is no context data for this command.

Command Example

!archer-get-search-options-by-guid reportGuid=246b1d4b294e46c4a4713853456234f7

Raw Output 
{
    "SearchReport": {
        "Criteria": {
            "Filter": {
                "Conditions": {
                    "ValueListFilterCondition": [
                        {
                            "Field": "302",
                            "IncludeChildren": "False",
                            "IsNoSelectionIncluded": "False",
                            "Operator": "DoesNotContain",
                            "Values": {
                                "Value": "470"
                            }
                        },
                        {
                            "Field": "304",
                            "IncludeChildren": "False",
                            "IsNoSelectionIncluded": "False",
                            "Operator": "Contains",
                            "Values": {
                                "Value": "473"
                            }
                        }
                    ]
                },
                "OperatorLogic": ""
            },
            "ModuleCriteria": {
                "BuildoutRelationship": "Union",
                "IsKeywordModule": "False",
                "Module": "75",
                "SortFields": {
                    "SortField": {
                        "Field": "296",
                        "SortType": "Descending"
                    }
                }
            }
        },
        "DisplayFields": {
            "DisplayField": [
                "296",
                "302",
                "304",
                "7850",
                "342"
            ]
        },
        "PageSize": "20"
    }
}

Search records by report

Searches records by report GUID.

Base Command

archer-search-records-by-report

Input
Parameter Description
reportGuid GUID of the report
maxResults Maximum number of pages of the reports

Context Data
Path Description
Archer.StatisticSearch.Records.Record Search results (records)

Command Example

!archer-search-records-by-report reportGuid=365121a3-6145-48ea-8a01-5d000c5c65cf

Raw Output 
{
    "Records": {
        "-count": "20",
        "LevelCounts": {
            "LevelCount": {
                "-count": "20",
                "-guid": "4d664bbf-4f15-4f5c-a81f-888f5901ba26",
                "-id": "3"
            }
        },
        "Metadata": {
            "FieldDefinitions": {
                "FieldDefinition": [
                    {
                        "-alias": "Policy_ID",
                        "-guid": "4b765f84-d381-4543-9d7c-1f9e716d4c4d",
                        "-id": "1578",
                        "-name": "Policy ID"
                    }...

Get field mapping by level ID

Returns mapping of fields by level ID.

Base Command

archer-get-mapping-by-level

Input
Parameter Description
level Level ID

Context Data

There is no context data for this command.

Command Example

!archer-get-mapping-by-level level=232

Raw Output 
{
    "15698": {
        "Name": "Incident Response Procedures",
        "Type": 9,
        "levelId": "232"
    },
    "15700": {
        "Name": "Not Applicable Incident Response Procedures",
        "Type": 9,
        "levelId": "232"
    }...

Fetch Archer incidents

Fetches specific incidents from Archer to the Cortex XSOAR War Room. You can also manually fetch automations.

Base Command

archer-manually-fetch-incident

Input
Parameter Description
applicationId

ID of the application to get the incident from.

incidentIds IDs of incidents to get details for, comma separated

Context Data

There is no context data for this command.

Command Example

!archer-manually-fetch-incident applicationId=433 incidentIds=227536

Raw Output 
{
    "details": "Incident Summary: inside_record_test_0_summary",
    "labels": [
        {
            "Related Security Incidents (Direct Link)-Incident Summary": "inside_record_test_1_summary"
        }...

Download Archer file to the War Room

Downloads a file from Archer to the Cortex XSOAR War Room context.

Base Command

archer-get-file

Input
Parameter Description
fieldId

Archer file ID

Context Data

There is no context data for this command.

Command Example

!archer-get-file fileId=3

Raw Output 
Uploaded file: Screen Shot 2018-02-22 at 11.09.33.png'

Upload a file from Cortex XSOAR to Archer

Uploads a file from Cortex XSOAR to Archer.

Base Command

archer-upload-file

Input
Parameter Description
contentId

Content (record) ID to add the file to

applicationId

ID of the application to upload the file to

incidentId

Incident ID to add the file to

entryId

Entry ID of the file in the Cortex XSOAR context

Context Data

There is no context data for this command.

Command Example

!archer-upload-file applicationId=433 contentId=227610 entryId=61@95

Raw Output 
File uploaded successfully.

Add data to the detailed analysis field

Adds data to the detailed analysis field.

Base Command

archer-add-to-detailed-analysis

Input
Parameter Description
contentId

Incident (record) ID to set the field's data

applicationId

ID of the application to set the record's field

incidentId

Incident ID to add the file to

value

Value to add to the Detailed Analysis

Context Data

There is no context data for this command.

Command Example

!archer-set-detailed-analysis applicationId=433 contentId=227610 value="test string"

Raw Output 
Detailed Analysis updated successfully.

Get an Archer user's user ID

Returns the user ID of an Archer user.

Base Command

archer-get-user-id

Input
Argument Name Description Required
userInfo Username in the form of "Domain\username". For example, userInfo="mydomain\myusername" Required

Context Output
Path Description
Archer.User.UserId User ID of the Archer user

Get a list of values for a field

Returns list of values for a specified field, e.g., fieldID=16114. This command only works for value list fields (type 4).

Base Command

archer-get-valuelist

Input
Argument Name Description Required
fieldID Field ID Required

Context Output

There is no context output for this command.

Edit this page
Report an Issue