Cynerio
Cynerio is a cybersecurity platform focused on protecting connected medical devices within healthcare organizations.
Cynerio is a leading platform for healthcare IoT security, offering real-time risk management and asset protection. This connector allows Swimlane Turbine users to automate the management of incidents, risks, and assets within Cynerio, enhancing security operations. By integrating with Cynerio, users can streamline incident response, improve risk assessment, and efficiently manage healthcare IoT assets, all within the Swimlane Turbine platform.
Limitations
None to the date.
Supported Version
It supports the latest version of Cynerio.
Configuration
Prerequisites
Before you can use the Cynerio connector for Turbine, you'll need access to the Cynerio API. This requires the following:
- Custom authentication using a pair of client ID and authentication secret or Refresh token:
- URL: The endpoint URL for accessing Cynerio's API services.
Authentication Methods
Custom Authentication
Setup Instructions
- Download the Cynerio Token Generator folder in your system.
- Run the get_cynerio_token.py file and follow the instructions.
Capabilities
- Change Incident Instances
- Change Risk Status
- Get Appliances
- Get Connection Filter by Incident ID
- Get Customer Events by Incident ID
- Get Customer Assets
- Get Customer Events
- Get Incident Instances
- Get Risk Instances
- Set Risk Response
Change Incident Instances
Update the Status of an Incident Instance Click Here.
Change Risk Status
Update the Status of a Specific Risk Click Here.
Get Appliances
Retrieve all Appliances associated with the Customer Click Here.
Get Connection Filter by Incident ID
Retrieve Connection Filter for a specific Incident Click Here.
Get Customer Asset
Retrieve Customer Assets using various Filters Click Here.
Get Customer Events
Retrieve Customer Events filtered by specified Criteria Click Here.
Get Customer Events by Incident ID
Retrieve Customer Events filtered by Incident ID Click Here.
Get Incident Instances
Retrieve all incident Instances associated with the Customer Click Here.
Get Risk Instances
Retrieve all Risk Instances associated with the Customer Click Here.
Set Risk Response
Short Description of the Action to set Risk Response Click Here.
Additional Documentation
Configurations
Cynerio Authentication
Authenticates using a pair of client ID and authentication secret or Refresh token.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
clientId | Client ID. This field is public and is used to identify you. | string | Optional |
secret | Clinet authentication password. Cynerio doesn't have access to it and it is private to you. | string | Optional |
refreshToken | The refresh token for the target host. | string | Optional |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Change Incident Instances
Update the status of an incident instance in Cynerio using a JSON body input with relevant details.
Endpoint
- URL: /outbound-integrations/integration/v1/incidents/change_status
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
status | string | Optional | Current Status of the Incident. |
id | string | Optional | Unique Identifier for the Incident. |
comment | string | Optional | Comment regarding the Status Change. |
updated_by | string | Optional | User who updated the Incident. |
metadata | object | Optional | Additional Metadata for the Incident. |
Input Example
{"status":"active","id":"12345678-1234-1234-1234-123456789abc","comment":"string","updated_by":"string","metadata":{}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{}}
Change Risk Status
Update the status of a specific risk in Cynerio by providing necessary details in the JSON body.
Endpoint
- URL: /outbound-integrations/integration/v1/risks/change_status
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
status | string | Optional | The new Status of the Risk. |
id | string | Optional | Unique Identifier of the Risk. |
comment | string | Optional | Comment regarding the Status Change. |
updated_by | string | Optional | User who updated the Risk Status. |
metadata | object | Optional | Additional Metadata for the Request. |
Input Example
{"status":"active","id":"12345678-1234-1234-1234-123456789abc","comment":"string","updated_by":"string","metadata":{}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{}}
Get Appliances
Retrieve all appliances associated with the customer from Cynerio, requiring a JSON body input.
Endpoint
- URL: /outbound-integrations/integration/v1/appliances
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
page | number | Optional | Page Number for Pagination. |
per_page | number | Optional | Number of Items per Page. |
Input Example
{"page":1,"per_page":100}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | array | Output field: items |
items._id | number | Unique identifier |
items.appliance_name | string | Name of the resource |
items.cloud_connectivity | number | Output field: items.cloud_connectivity |
items.id | string | Unique identifier |
items.last_seen | string | Output field: items.last_seen |
items.location | string | Output field: items.location |
items.mgmt_ip | string | Output field: items.mgmt_ip |
items.ntp_servers | object | Output field: items.ntp_servers |
items.ntp_servers.data | array | Response data |
items.ntp_servers.status | number | Status value |
items.port | string | Output field: items.port |
items.serial | string | Output field: items.serial |
items.site_name | string | Name of the resource |
items.span_1 | object | Output field: items.span_1 |
items.span_1.data | string | Response data |
items.span_1.status | number | Status value |
items.span_2 | string | Output field: items.span_2 |
items.span_3 | string | Output field: items.span_3 |
items.status | number | Status value |
page | number | Output field: page |
pages | number | Output field: pages |
per_page | number | Output field: per_page |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"items":[{},{}],"page":1,"pages":1,"per_page":10,"total":2}}
Get Connection Filter by Incident ID
Retrieve connection filter details associated with a specific incident ID in Cynerio. Requires path parameters including incident_id.
Endpoint
- URL: /outbound-integrations/integration/v1/incidents/{{incident_id}}/connections
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.incident_id | string | Required | Unique Identifier for the Incident. |
per_page | number | Optional | Number of Items per Page. |
page | number | Optional | Page Number to retrieve. |
filters | object | Optional | The Connection by incident Filtration Query. |
filters.updated_to | string | Optional | Fetch Incidents updated up to this Time. |
filters.updated_from | string | Optional | Fetch Incidents updated from this Time. |
filters.created_from | string | Optional | Fetch Incidents beginning at this Time. |
filters.created_to | string | Optional | Fetch Incidents up to this Time. |
filters.status | string | Optional | Incident Status Filter. |
filters.incident_type | string | Optional | Filter by specific Incident Type. |
filters.incident_id | string | Optional | Get only the Incident by ID. |
Input Example
{"path_parameters":{"incident_id":"string"},"per_page":100,"page":1,"filters":{"updated_to":"string","updated_from":"string","created_from":"string","created_to":"string","status":"active","incident_type":"string","incident_id":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | array | Output field: items |
items.dst_asset_id | string | Unique identifier |
items.dst_ip | string | Output field: items.dst_ip |
items.dst_model | string | Output field: items.dst_model |
items.dst_name | string | Name of the resource |
items.dst_type | string | Type of the resource |
items.dst_type_name | string | Name of the resource |
items.dst_vendor | string | Output field: items.dst_vendor |
items.id | string | Unique identifier |
items.port | string | Output field: items.port |
items.protocol | string | Output field: items.protocol |
items.src_asset_id | string | Unique identifier |
items.src_ip | string | Output field: items.src_ip |
items.src_model | string | Output field: items.src_model |
items.src_name | string | Name of the resource |
items.src_type | string | Type of the resource |
items.src_type_name | string | Name of the resource |
items.src_vendor | string | Output field: items.src_vendor |
items.transport | string | Output field: items.transport |
items.type | string | Type of the resource |
items.user_agent | string | Output field: items.user_agent |
page | number | Output field: page |
pages | number | Output field: pages |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"items":[{}],"page":1,"pages":1,"per_page":10,"total":1}}
Get Customer Assets
Retrieve customer assets from Cynerio using specified filters to streamline asset management and security processes.
Endpoint
- URL: /outbound-integrations/integration/v1/assets
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
per_page | number | Optional | Number of Assets per Page. |
page | number | Optional | Page Number for Pagination. |
fields | array | Optional | Asset Fields to be returned. |
sort | string | Optional | Sorting Order of the Assets. |
filters | object | Optional | The Assets filtration Query. |
filters.ir_classification_code | array | Optional | List of IR Code or Codes as strings - ['1']. |
filters.vertical_display_name | array | Optional | List of Class Type or Types IoT, IoMT, IT. |
filters.type_display_name | array | Optional | List of Asset Type or Types. |
filters.id | array | Optional | List of single or multiple Asset IDs. |
Input Example
{"per_page":100,"page":1,"fields":["string"],"sort":"string","filters":{"ir_classification_code":["string"],"vertical_display_name":["string"],"type_display_name":["string"],"id":["string"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | array | Output field: items |
items.category | string | Output field: items.category |
items.department | string | Output field: items.department |
items.display_name | string | Name of the resource |
items.first_seen | string | Output field: items.first_seen |
items.id | string | Unique identifier |
items.ip | string | Output field: items.ip |
items.ir_classification_code | number | Output field: items.ir_classification_code |
items.last_seen | string | Output field: items.last_seen |
items.mac | string | Output field: items.mac |
items.model | string | Output field: items.model |
items.network.ip_allocation | string | Output field: items.network.ip_allocation |
items.network.vlan | string | Output field: items.network.vlan |
items.os | string | Output field: items.os |
items.phi | boolean | Output field: items.phi |
items.severity | number | Output field: items.severity |
items.status | string | Status value |
items.type_display_name | string | Name of the resource |
items.vendor | string | Output field: items.vendor |
items.vertical_display_name | string | Name of the resource |
page | number | Output field: page |
pages | number | Output field: pages |
per_page | number | Output field: per_page |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"items":[{}],"page":1,"pages":52,"per_page":100,"total":5175}}
Get Customer Events
Retrieve customer events from Cynerio filtered by specified criteria. Requires a JSON body input.
Endpoint
- URL: /outbound-integrations/integration/v2/events
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | The Event Filtration Query. |
filters.event_id | string | Optional | Unique Cynerio Identifier of the Event. |
filters.date_from | string | Optional | Fetch Events beginning at this Timestamp Inclusive. |
filters.date_to | string | Optional | Fetch Events up to this Time exclusive. |
filters.title | array | Optional | Filter by Event Name or List of Names. |
filters.module | array | Optional | Filter by Module or List of Modules. |
filters.severity | array | Optional | Filter by Severity Level or List of Levels. |
filters.device_class | string | Optional | Filter Device by Class Iot or Iomt. |
page | number | Optional | The Page to return for the given Page Size. |
per_page | number | Optional | How many Results to return in every Page. |
Input Example
{"filters":{"event_id":"string","date_from":"string","date_to":"string","title":["string"],"module":["string"],"severity":["string"],"device_class":"string"},"page":1,"per_page":100}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | array | Output field: items |
items.asset_id | string | Unique identifier |
items.asset_type | string | Type of the resource |
items.details | string | Output field: items.details |
items.event_id | string | Unique identifier |
items.ip | string | Output field: items.ip |
items.model | string | Output field: items.model |
items.module | string | Output field: items.module |
items.severity | string | Output field: items.severity |
items.timestamp | string | Output field: items.timestamp |
items.title | string | Output field: items.title |
page | number | Output field: page |
pages | number | Output field: pages |
per_page | number | Output field: per_page |
total | number | Output field: total |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"items":[{},{}],"page":1,"pages":500,"per_page":2,"total":1000}}
Get Customer Events by Incident ID
Retrieve customer events associated with a specific incident ID in Cynerio using path parameters.
Endpoint
- URL: /outbound-integrations/integration/v1/events/{{incident_id}}
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.incident_id | string | Required | Unique Identifier for the Incident. |
filters | object | Optional | The Event Filtration Query. |
filters.event_id | string | Optional | Unique Cynerio Identifier of the Event. |
filters.date_from | string | Optional | Fetch Events beginning at this Timestamp. |
filters.date_to | string | Optional | Fetch Events up to this Time. |
filters.title | array | Optional | Filter by Event Name or List of Names. |
filters.module | array | Optional | Filter by Module or List of Modules. |
filters.severity | array | Optional | Filter by Severity Level or List. |
filters.device_class | string | Optional | Filter Device by Class Iot or Iomt. |
page | number | Optional | The Page to return for the given Size. |
per_page | number | Optional | Number of Results per Page. |
Input Example
{"path_parameters":{"incident_id":"string"},"filters":{"event_id":"string","date_from":"string","date_to":"string","title":["string"],"module":["string"],"severity":["string"],"device_class":"string"},"page":1,"per_page":100}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | array | Output field: items |
items.asset_id | string | Unique identifier |
items.asset_type | string | Type of the resource |
items.details | string | Output field: items.details |
items.event_id | string | Unique identifier |
items.ip | string | Output field: items.ip |
items.model | string | Output field: items.model |
items.module | string | Output field: items.module |
items.severity | string | Output field: items.severity |
items.timestamp | string | Output field: items.timestamp |
items.title | string | Output field: items.title |
page | number | Output field: page |
pages | number | Output field: pages |
per_page | number | Output field: per_page |
total | number | Output field: total |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"items":[{},{}],"page":1,"pages":500,"per_page":2,"total":1000}}
Get Incident Instances
Retrieve all incident instances associated with the customer from Cynerio, requiring a JSON body input.
Endpoint
- URL: /outbound-integrations/integration/v1/incidents
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
per_page | number | Optional | Number of Incidents per Page. |
page | number | Optional | Page Number for Pagination. |
filters | object | Optional | The Incidents Filtration Query. |
filters.updated_to | string | Optional | Fetch Incidents updated up to this Time. |
filters.updated_from | string | Optional | Fetch Incidents updated from this Time. |
filters.created_from | string | Optional | Fetch Incidents beginning at this Time. |
filters.created_to | string | Optional | Fetch Incidents up to this Time. |
filters.status | string | Optional | Incident Status Filter. |
filters.incident_type | string | Optional | Filter by specific Incident Type. |
filters.incident_id | string | Optional | Get only the Incident by ID. |
Input Example
{"per_page":100,"page":1,"filters":{"updated_to":"string","updated_from":"string","created_from":"string","created_to":"string","status":"active","incident_type":"string","incident_id":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | array | Output field: items |
items.bad_actor_asset | string | Output field: items.bad_actor_asset |
items.bad_actor_external_ip | string | Output field: items.bad_actor_external_ip |
items.bad_actor_internal_ip | array | Output field: items.bad_actor_internal_ip |
items.bad_actor_proxy_asset | string | Output field: items.bad_actor_proxy_asset |
items.bad_actor_proxy_ip_internal | string | Output field: items.bad_actor_proxy_ip_internal |
items.benign | string | Output field: items.benign |
items.child_incident_ids | array | Unique identifier |
items.created_on | string | Output field: items.created_on |
items.cynerio_live_notes | string | Output field: items.cynerio_live_notes |
items.description | string | Output field: items.description |
items.incident_id | string | Unique identifier |
items.incident_type | string | Unique identifier |
items.sos_actions | string | Output field: items.sos_actions |
items.status | string | Status value |
items.target_assets | array | Output field: items.target_assets |
items.target_ips | array | Output field: items.target_ips |
page | number | Output field: page |
pages | number | Output field: pages |
per_page | number | Output field: per_page |
total | number | Output field: total |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"items":[{}],"page":1,"pages":1,"per_page":10,"total":1}}
Get Risk Instances
Retrieve all risk instances associated with the customer from Cynerio, requiring a JSON body input.
Endpoint
- URL: /outbound-integrations/integration/v1/risks
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
per_page | number | Optional | Number of Results per Page. |
page | number | Optional | Page Number for Pagination. |
filters | object | Optional | The Risks Asset Filtration Query. |
filters.id | string | Optional | Unique Cynerio Identifier of the Risk. |
filters.asset_id | string | Optional | Unique Cynerio Identifier of the Asset. |
filters.event_id | string | Optional | Unique Cynerio Identifier of the Event. |
filters.risk_score_level | ['string', 'array'] | Optional | Identifier of Risk Score Level. |
filters.risk_score | number | Optional | Minimum Value of Risk Score. |
filters.device_class | string | Optional | Filter Device by Class Iot or Iomt. |
filters.site | string | Optional | Filter by Site Name or List. |
filters.detected_on_start | string | Optional | Filter by Creation Date after provided Date. |
filters.detected_on_end | string | Optional | Filter by Creation Date until provided Date. |
filters.vlan | string | Optional | Filter by VLAN. |
filters.status | string | Optional | Filter by Risk Status. |
filters.latest_status_update | string | Optional | Show Risks updated after provided Date. |
Input Example
{"per_page":100,"page":1,"filters":{"id":"12345678-1234-1234-1234-123456789abc","asset_id":"string","event_id":"string","risk_score":123,"device_class":"string","site":"string","detected_on_start":"string","detected_on_end":"string","vlan":"string","status":"active","latest_status_update":"active"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | array | Output field: items |
items.asset_id | string | Unique identifier |
items.availability_score | string | Score value |
items.category | string | Output field: items.category |
items.confidentiality_score | string | Unique identifier |
items.cvss | string | Output field: items.cvss |
items.description | string | Output field: items.description |
items.device_class | string | Output field: items.device_class |
items.display_name | string | Name of the resource |
items.epss | string | Output field: items.epss |
items.has_malware | string | Output field: items.has_malware |
items.id | string | Unique identifier |
items.impact_confidentiality | string | Unique identifier |
items.impact_patient_safety | string | Output field: items.impact_patient_safety |
items.impact_service_disruption | string | Output field: items.impact_service_disruption |
items.integrity_score | string | Score value |
items.link | array | Output field: items.link |
items.link.0 | string | Output field: items.link.0 |
items.link.1 | string | Output field: items.link.1 |
items.name | string | Name of the resource |
items.nhs_published_date | string | Date value |
items.nhs_severity | string | Output field: items.nhs_severity |
items.nhs_threat_id | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{"items":[{}],"page":1,"pages":1,"per_page":100,"total":1}}
Set Risk Response
Update the risk response status for a specified entity in Cynerio by providing its ID and new status.
Endpoint
- URL: /outbound-integrations/integration/v1/risks/set_risk_response
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
status | string | Optional | The Status of the Risk Response. |
id | array | Optional | List of Risk IDs. |
comment | string | Optional | Comment regarding the Risk Response. |
updated_by | string | Optional | User who updated the Risk Response. |
due_date | string | Optional | Due Date for the Risk Response. |
metadata | object | Optional | Additional Metadata for the Risk Response. |
Input Example
{"status":"active","id":["string"],"comment":"string","updated_by":"string","due_date":"2024-01-15","metadata":{}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 16 Jan 2025 20:37:23 GMT"},"reason":"OK","json_body":{}}
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 140 |
content-type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 16 Jan 2025 20:37:23 GMT |