Claroty
Claroty is an industrial cybersecurity platform designed to protect critical infrastructure and industrial control systems.
Claroty is a leading platform for industrial cybersecurity, providing comprehensive visibility, threat detection, and risk management for industrial control systems (ICS) and operational technology (OT) environments. The Claroty connector for Swimlane Turbine enables seamless integration, allowing users to automate the retrieval and management of alerts and assets within Claroty. This integration enhances incident response capabilities by streamlining the process of resolving alerts and accessing detailed asset information, ultimately improving the efficiency and effectiveness of security operations.
Prerequisites
Before you can use the Claroty connector for Turbine, you'll need access to the Claroty API. This requires the following:
- HTTP Basic authentication using the following parameters:
- URL: The endpoint URL for accessing the Claroty API.
- Username: Your Claroty account username.
- Password: Your Claroty account password.
Capabilities
This connector provides the following capabilities:
- Get Alerts
- Get Asset by Resource ID
- Get Assets
- Resolve Alerts
Additional Documentation
Configurations
HTTP Basic Authentication
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | Username | string | Required |
password | Password | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Alerts
Retrieve a list of alerts in Claroty CTD with optional parameters for filtering and customization.
Endpoint
- URL: /ranger/alerts
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.format | string | Optional | Specifies the type of response (list of fields) returned by the query. If not provided, all Alert properties are returned and could affect performance. |
parameters.page | number | Optional | The page number to be viewed. |
parameters.per_page | number | Optional | Number of Alerts to pull on each page. (The maximum is 500). |
parameters.asset_id__exact | string | Optional | Resource ID of the Asset. |
parameters.asset__exact | string | Optional | Parameters for the Get Alerts action |
parameters.for_asset__exact | string | Optional | Parameters for the Get Alerts action |
parameters.q__exact | string | Optional | Parameters for the Get Alerts action |
parameters.primary_asset__exact | string | Optional | The resource ID of the primary asset that triggered the alert. |
parameters.non_primary_assets__exact | string | Optional | Resource IDs of the non-primary assets involved in the alert. |
parameters.virtual_zone__exact | string | Optional | The resource ID of the Zone that triggered the alert. |
parameters.alert_id__exact | string | Optional | The resource ID of the Alert. You can add multiple IDs. |
parameters.ot_alerts__exact | string | Optional | Returns only OT Alerts. |
parameters.family__exact | string | Optional | Model family of the Asset involved in the Alert, for example Policy Violation. Alert Families appear in the Advanced Options filter of Alerts. |
parameters.story_severity__exact | string | Optional | Parameters for the Get Alerts action |
parameters.id__exact | number | Optional | ID of an Alert. |
parameters.site_id__exact | number | Optional | ID of the Site on which the Alert occurred. |
parameters.data__exact | string | Optional | Parameters for the Get Alerts action |
parameters.description__exact | string | Optional | Description of the alert. |
parameters.type__exact | number | Optional | The type of alert. |
parameters.category__exact | number | Optional | Alert Category. |
parameters.severity__exact | number | Optional | Alert Severity. |
parameters.timestamp__exact | string | Optional | Timestamp on which the Alert occured. |
parameters.last_updated__gte | string | Optional | The timestamp when the latest change on the Alert was made in the EMC. |
parameters.relevant__exact | boolean | Optional | Parameters for the Get Alerts action |
parameters.resolved__exact | boolean | Optional | Parameters for the Get Alerts action |
Input Example
{"parameters":{"format":"string","page":123,"per_page":123,"asset_id__exact":"string","asset__exact":"string","for_asset__exact":"string","q__exact":"string","primary_asset__exact":"string","non_primary_assets__exact":"string","virtual_zone__exact":"string","alert_id__exact":"string","ot_alerts__exact":"string","family__exact":"string","story_severity__exact":"string","id__exact":123,"site_id__exact":123,"data__exact":"string","description__exact":"string","type__exact":123,"category__exact":123,"severity__exact":123,"timestamp__exact":"string","last_updated__gte":"string","relevant__exact":true,"resolved__exact":true,"resolution__exact":123,"protocol__exact":"string","score__exact":123,"is_qualified__exact":true,"network_id__exact":123,"resolved_id__exact":123,"assigned_id__exact":123,"story_id__exact":123,"sort":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count_filtered | number | Output field: count_filtered |
count_in_page | number | Output field: count_in_page |
count_total | number | Output field: count_total |
objects | array | Output field: objects |
objects.actionable_assets | array | Output field: objects.actionable_assets |
objects.actionable_assets.actionable_id | number | Unique identifier |
objects.actionable_assets.asset | object | Output field: objects.actionable_assets.asset |
objects.actionable_assets.asset.asset_type | number | Type of the resource |
objects.actionable_assets.asset.asset_type__ | string | Type of the resource |
objects.actionable_assets.asset.id | number | Unique identifier |
objects.actionable_assets.asset.ipv4 | array | Output field: objects.actionable_assets.asset.ipv4 |
objects.actionable_assets.asset.name | string | Name of the resource |
objects.actionable_assets.asset.network_id | number | Unique identifier |
objects.actionable_assets.asset.resource_id | string | Unique identifier |
objects.actionable_assets.asset.site_id | number | Unique identifier |
objects.actionable_assets.id | number | Unique identifier |
objects.actionable_assets.resource_id | string | Unique identifier |
objects.actionable_assets.role | number | Output field: objects.actionable_assets.role |
objects.actionable_assets.role__ | string | Output field: objects.actionable_assets.role__ |
objects.actionable_assets.site_id | number | Unique identifier |
objects.actionable_caps | array | Output field: objects.actionable_caps |
objects.actionable_caps.file_name | string | Name of the resource |
objects.actionable_caps.file | string | Output field: objects.actionable_caps.file |
Output Example
{"status_code":200,"response_headers":{"Date":"Wed, 13 Mar 2024 15:39:22 GMT","Content-Type":"application/json","Content-Length":"8815","Connection":"keep-alive","Server":"nginx","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Content-Security-Policy":"child-src 'self' app.pendo.io; connect-src 'self' wss://*:* app.pendo.io cdn.pen..."},"reason":"OK","json_body":{"count_filtere...
Get Asset by Resource ID
Get asset details from Claroty using the specified resource ID.
Endpoint
- URL: /ranger/assets/{{resource_id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.resource_id | string | Optional | Resource ID of the asset to return. |
Input Example
{"path_parameters":{"resource_id":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
active_queries_names | array | Name of the resource |
active_tasks_names | array | Name of the resource |
approved | boolean | Output field: approved |
asset_type | number | Type of the resource |
asset_type__ | string | Type of the resource |
children | array | Output field: children |
children.file_name | string | Name of the resource |
children.file | string | Output field: children.file |
class_type | string | Type of the resource |
code_sections | array | Output field: code_sections |
code_sections.file_name | string | Name of the resource |
code_sections.file | string | Output field: code_sections.file |
criticality | number | Output field: criticality |
criticality__ | string | Output field: criticality__ |
custom_attributes | array | Output field: custom_attributes |
custom_attributes.file_name | string | Name of the resource |
custom_attributes.file | string | Output field: custom_attributes.file |
custom_informations | array | Output field: custom_informations |
custom_informations.category | number | Output field: custom_informations.category |
custom_informations.display_key | string | Output field: custom_informations.display_key |
custom_informations.key | string | Output field: custom_informations.key |
custom_informations.priority | number | Output field: custom_informations.priority |
custom_informations.type | number | Type of the resource |
Output Example
{"status_code":200,"response_headers":{"Date":"Wed, 13 Mar 2024 15:40:52 GMT","Content-Type":"application/json","Content-Length":"1720","Connection":"keep-alive","Server":"nginx","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Content-Security-Policy":"child-src 'self' app.pendo.io; connect-src 'self' wss://*:* app.pendo.io cdn.pen..."},"reason":"OK","json_body":{"active_querie...
Get Assets
Retrieve a list of assets in Claroty CTD, with optional parameters for filtering and customization.
Endpoint
- URL: /ranger/assets
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.format | string | Optional | Specifies the type of response (list of fields) returned by the query. If not provided, all Asset properties are returned and could affect performance. |
parameters.page | number | Optional | The page number to be viewed |
parameters.per_page | number | Optional | Number of Assets to pull per page. (Recommended maximum - 500). |
parameters.ipv4__exact | string | Optional | IP address of the asset in IPv4 format |
parameters.ipv6__exact | string | Optional | IP address of the asset in IPv6 format |
parameters.mac__icontains | string | Optional | The MAC address of the device (free text) |
parameters.vlan__exact | string | Optional | The VLAN/s of the device |
parameters.address__exact | string | Optional | The IP address of this device in the network. |
parameters.gateway__exact | string | Optional | IP of the Gateway of the Asset's network. |
parameters.asset_type__exact | string | Optional | CTD Asset type, for example SCADA client, PLC, etc. |
parameters.host_name__exact | string | Optional | The host name of this Asset. |
parameters.os__exact | string | Optional | The name of the operating system. |
parameters.model__icontains | string | Optional | The Model of this asset (free text). |
parameters.vendor__icontains | string | Optional | The Vendor of this asset (free text). |
parameters.state__exact | string | Optional | Asset state as selected in the dropdown - 0 = Training 1 = Maintenance 2 = Guest |
parameters.domain_names__exact | string | Optional | The exact domain name(s) of the Asset |
parameters.firmware__exact | string | Optional | The exact firmware name of the Asset. |
parameters.serial__exact | string | Optional | The exact serial number of the Asset. |
parameters.generic__icontains | string | Optional | Custom information (free text). |
parameters.display_name__icontains | string | Optional | The name of the Asset (free text). |
parameters.criticality__exact | string | Optional | These CTD values represent how critical the asset itself is to the operation. |
parameters.old_ip__exact | string | Optional | Previous IPs used by this Asset. |
parameters.protocol__exact | string | Optional | List of protocols used by this Asset when communicating. |
parameters.last_seen__exact | string | Optional | The timestamp of the last instance when this device was seen in the network. |
parameters.q__icontains | string | Optional | Free text for the following Asset info - Name, IP, Version, Model and MAC |
Input Example
{"parameters":{"format":"string","page":123,"per_page":123,"ipv4__exact":"string","ipv6__exact":"string","mac__icontains":"string","vlan__exact":"string","address__exact":"string","gateway__exact":"string","asset_type__exact":"string","host_name__exact":"Example Name","os__exact":"string","model__icontains":"string","vendor__icontains":"string","state__exact":"string","domain_names__exact":"Example Name","firmware__exact":"string","serial__exact":"string","generic__icontains":"string","display_name__icontains":"Example Name","criticality__exact":"string","old_ip__exact":"string","protocol__exact":"string","last_seen__exact":"string","q__icontains":"string","alert_id__exact":"string","last_updated__gt":"string","baseline__exact":"string","arp_baselines__exact":true,"insight_status__exact":123,"insights_insight_name__exact":"Example Name","insight_timestamp__gte":"string","insight_timestamp__lte":"string","baseline_category__exact":"string","baseline_access_type__exact":"string","insight_name__exact":"Example Name","insight_row_key__exact":"string","ghost__exact":true,"tasks__exact":"string","active_queries__exact":"string","subnet_tag__exact":"string","custom_attributes__exact":"string","class_type__exact":"string","domain_name__exact":"Example Name","involved_in_tags__exact":"string","hosted_tags__icontains":"string","id__exact":"string","site_id__exact":"string","timestamp__exact":"string","approved__exact":true}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count_filtered | number | Output field: count_filtered |
count_in_page | number | Output field: count_in_page |
count_total | number | Output field: count_total |
objects | array | Output field: objects |
objects.active_queries_names | array | Name of the resource |
objects.active_tasks_names | array | Name of the resource |
objects.approved | boolean | Output field: objects.approved |
objects.asset_type | number | Type of the resource |
objects.asset_type__ | string | Type of the resource |
objects.children | array | Output field: objects.children |
objects.children.file_name | string | Name of the resource |
objects.children.file | string | Output field: objects.children.file |
objects.class_type | string | Type of the resource |
objects.code_sections | array | Output field: objects.code_sections |
objects.code_sections.file_name | string | Name of the resource |
objects.code_sections.file | string | Output field: objects.code_sections.file |
objects.criticality | number | Output field: objects.criticality |
objects.criticality__ | string | Output field: objects.criticality__ |
objects.custom_attributes | array | Output field: objects.custom_attributes |
objects.custom_attributes.file_name | string | Name of the resource |
objects.custom_attributes.file | string | Output field: objects.custom_attributes.file |
objects.custom_informations | array | Output field: objects.custom_informations |
objects.custom_informations.category | number | Output field: objects.custom_informations.category |
Output Example
{"status_code":200,"response_headers":{"Date":"Wed, 13 Mar 2024 15:38:30 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Server":"nginx","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Content-Security-Policy":"child-src 'self' app.pendo.io; connect-src 'self' wss://*:* app.pendo.io cdn.pen...","Content-Encoding":"gzip"},"reason":...
Resolve Alerts
Resolve specified alerts in Claroty by providing alert IDs and an optional comment.
Endpoint
- URL: /ranger/ranger_api/resolve_alerts
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
alert_ids | array | Required | Unique identifier |
comment | string | Required | Parameter for Resolve Alerts |
Input Example
{"alert_ids":["269-1"],"comment":"Resolved by Swimlane Turbine."}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
success | boolean | Whether the operation was successful |
Output Example
{"status_code":200,"response_headers":{"Date":"Wed, 13 Mar 2024 16:40:26 GMT","Content-Type":"application/json","Content-Length":"17","Connection":"keep-alive","Server":"nginx","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Content-Security-Policy":"child-src 'self' app.pendo.io; connect-src 'self' wss://*:* app.pendo.io cdn.pen..."},"reason":"OK","json_body":{"success":true}}
Response Headers
Header | Description | Example |
|---|---|---|
Connection | HTTP response header: Connection | keep-alive |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
Content-Length | The length of the response body in bytes | 8815 |
Content-Security-Policy | HTTP response header: Content-Security-Policy | child-src 'self' app.pendo.io; connect-src 'self' wss://: app.pendo.io cdn.pendo.io pendo-static-5700791337353216.storage.googleapis.com data.pendo.io content.statisticsguidance.claroty.com data.statisticsguidance.claroty.com; default-src 'self'; font-src 'self' data:; frame-ancestors app.pendo.io; img-src 'self' data: app.pendo.io cdn.pendo.io pendo-static-5700791337353216.storage.googleapis.com data.pendo.io content.statisticsguidance.claroty.com data.statisticsguidance.claroty.com; media-src * blob:; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' app.pendo.io pendo-io-static.storage.googleapis.com cdn.pendo.io pendo-static-5700791337353216.storage.googleapis.com data.pendo.io content.statisticsguidance.claroty.com data.statisticsguidance.claroty.com; style-src 'self' 'unsafe-inline' app.pendo.io cdn.pendo.io pendo-static-5700791337353216.storage.googleapis.com content.statisticsguidance.claroty.com data.statisticsguidance.claroty.com |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Wed, 13 Mar 2024 15:40:52 GMT |
Server | Information about the software used by the origin server | nginx |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN |
X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |