Lacework

This connector integrates with Lacework API.

Prerequisites

The Lacework connector requires a host, Key ID, and Secret Key.

Capabilities

The Lacework connector has the following capabilities:

Audit Logs Searching

Cloud Accounts Management

Get Events

Get Vulnerabilities

Queries Management

For further information about LQL you can visit the offical LQL documentation.

About Filters

Filters can be optionally specified in the request body. For more information about using filters, see the Simple & Advanced Search section.

This connector was last tested against product version: 2.

Configurations

Lacework Auth

Lacework

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
api_key		string	Required
api_secret		string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Close Alert

Close Lacework Alert with a comment

Endpoint

URL: Queries/execute

Method: GET

Input

Argument Name	Type	Required	Description
alert_id	string	Required	Unique identifier
reason	number	Required	Response reason phrase
comment	string	Optional	Parameter for Close Alert

Input Example

{"alert_id":"12345","reason":0,"comment":"Closing as false positive."}

Output

Parameter	Type	Description
message	string	Response message

Output Example

{"message":"string"}

Create Compliance Exceptions

Create Lacework Compliance Exceptions

Endpoint

URL: /api/v2/VulnerabilityExceptions

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Create Compliance Exceptions
params.exceptionName	string	Optional	Name of the resource
params.exceptionReason	string	Optional	Response reason phrase
params.resourceScope	object	Optional	Parameter for Create Compliance Exceptions
params.resourceScope.imageId	array	Optional	Unique identifier
params.resourceScope.imageTag	array	Optional	Parameter for Create Compliance Exceptions
params.resourceScope.registry	array	Optional	Parameter for Create Compliance Exceptions
params.resourceScope.repository	array	Optional	Parameter for Create Compliance Exceptions
params.resourceScope.namespace	array	Optional	Name of the resource
params.vulnerabilityCriteria	object	Optional	Parameter for Create Compliance Exceptions
params.vulnerabilityCriteria.cve	array	Optional	Parameter for Create Compliance Exceptions
params.vulnerabilityCriteria.package	array	Optional	Parameter for Create Compliance Exceptions
params.vulnerabilityCriteria.severity	array	Optional	Parameter for Create Compliance Exceptions
params.vulnerabilityCriteria.fixable	array	Optional	Parameter for Create Compliance Exceptions
params.expiryTime	string	Optional	Time value
params.state	number	Optional	Parameter for Create Compliance Exceptions
params.props	object	Optional	Parameter for Create Compliance Exceptions
params.props.description	string	Optional	Parameter for Create Compliance Exceptions
params.props.createdBy	string	Optional	Parameter for Create Compliance Exceptions
params.props.updatedBy	string	Optional	Parameter for Create Compliance Exceptions
params.exceptionType	string	Optional	Type of the resource

Input Example

{"params":{"exceptionName":"string","exceptionReason":"False Positive","resourceScope":{"imageId":["string"],"imageTag":["string"],"registry":["string"],"repository":["string"],"namespace":["string"]},"vulnerabilityCriteria":{"cve":["string"],"package":[{}],"severity":["Info"],"fixable":[0]},"expiryTime":"string","state":1,"props":{"description":"string","createdBy":"string","updatedBy":"string"},"exceptionType":"Container"}}

Output

Parameter	Type	Description
data	object	Response data
data.createdTime	string	Response data
data.exceptionGuid	string	Response data
data.exceptionName	string	Response data
data.exceptionReason	string	Response data
data.exceptionType	string	Response data
data.expiryTime	string	Response data
data.props	object	Response data
data.props.description	string	Response data
data.props.createdBy	string	Response data
data.props.updatedBy	string	Response data
data.resourceScope	object	Response data
data.resourceScope.registry	array	Response data
data.state	number	Response data
data.updatedTime	string	Response data
data.vulnerabilityCriteria	object	Response data
data.vulnerabilityCriteria.severity	array	Response data

Output Example

{"data":{"createdTime":"2021-12-18T08:30:00Z","exceptionGuid":"LWABC","exceptionName":"Container Vulnerability Exception","exceptionReason":"Accepted Risk","exceptionType":"Container","expiryTime":"2021-12-28T08:30:00Z","props":{"description":"This is a Container Vulnerability Exception","createdBy":"[email protected]","updatedBy":"[email protected]"},"resourceScope":{"registry":[]},"state":1,"updatedTime":"2021-12-18T08:30:00Z","vulnerabilityCriteria":{"severity":[]}}}

Create Vulnerability Exceptions

Create Lacework Vulnerability Exceptions

Endpoint

URL: /api/v2/VulnerabilityExceptions

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Create Vulnerability Exceptions
params.exceptionName	string	Optional	Name of the resource
params.exceptionReason	string	Optional	Response reason phrase
params.resourceScope	object	Optional	Parameter for Create Vulnerability Exceptions
params.resourceScope.imageId	array	Optional	Unique identifier
params.resourceScope.imageTag	array	Optional	Parameter for Create Vulnerability Exceptions
params.resourceScope.registry	array	Optional	Parameter for Create Vulnerability Exceptions
params.resourceScope.repository	array	Optional	Parameter for Create Vulnerability Exceptions
params.resourceScope.namespace	array	Optional	Name of the resource
params.vulnerabilityCriteria	object	Optional	Parameter for Create Vulnerability Exceptions
params.vulnerabilityCriteria.cve	array	Optional	Parameter for Create Vulnerability Exceptions
params.vulnerabilityCriteria.package	array	Optional	Parameter for Create Vulnerability Exceptions
params.vulnerabilityCriteria.severity	array	Optional	Parameter for Create Vulnerability Exceptions
params.vulnerabilityCriteria.fixable	array	Optional	Parameter for Create Vulnerability Exceptions
params.expiryTime	string	Optional	Time value
params.state	number	Optional	Parameter for Create Vulnerability Exceptions
params.props	object	Optional	Parameter for Create Vulnerability Exceptions
params.props.description	string	Optional	Parameter for Create Vulnerability Exceptions
params.props.createdBy	string	Optional	Parameter for Create Vulnerability Exceptions
params.props.updatedBy	string	Optional	Parameter for Create Vulnerability Exceptions
params.exceptionType	string	Optional	Type of the resource

Input Example

Output

Parameter	Type	Description
data	object	Response data
data.createdTime	string	Response data
data.exceptionGuid	string	Response data
data.exceptionName	string	Response data
data.exceptionReason	string	Response data
data.exceptionType	string	Response data
data.expiryTime	string	Response data
data.props	object	Response data
data.props.description	string	Response data
data.props.createdBy	string	Response data
data.props.updatedBy	string	Response data
data.resourceScope	object	Response data
data.resourceScope.registry	array	Response data
data.state	number	Response data
data.updatedTime	string	Response data
data.vulnerabilityCriteria	object	Response data
data.vulnerabilityCriteria.severity	array	Response data

Output Example

Get Alert Metadata

Lacework Get Alert Metadata

Endpoint

URL: /api/v2/Alerts/

Method: GET

Input

Argument Name	Type	Required	Description
alert_id	string	Required	Alert ID to fetch scope from
scope	string	Required	Which scope to fetch

Input Example

{"alert_id":"string","scope":"string"}

Output

Parameter	Type	Description
alertId	string	Unique identifier
startTime	string	Time value
alertType	string	Type of the resource
severity	string	Output field: severity
internetExposure	string	Output field: internetExposure
reachability	string	Output field: reachability
derivedFields	string	Output field: derivedFields
endTime	string	Time value
lastUserUpdatedTime	string	Time value
status	string	Status value
alertName	string	Name of the resource
alertInfo	string	Output field: alertInfo
policyId	string	Unique identifier
evolvingAlert	string	Output field: evolvingAlert
entityMap	object	Output field: entityMap
entityMap.RecId	string	Unique identifier
entityMap.Resource	array	Output field: entityMap.Resource
entityMap.Resource.KEY	string	Output field: entityMap.Resource.KEY
entityMap.ViolationReason	string	Response reason phrase

Output Example

{"alertId":"string","startTime":"string","alertType":"string","severity":"string","internetExposure":"string","reachability":"string","derivedFields":{"category":"string","sub_category":"string","source":"string"},"endTime":"string","lastUserUpdatedTime":"string","status":"string","alertName":"string","alertInfo":{"subject":"string","description":"string"},"policyId":"string","evolvingAlert":"string","entityMap":{"RecId":"string","Resource":[{}],"ViolationReason":"string"}}

Get Alerts

Lacework Get Alerts API

Endpoint

URL: api/v2/Alerts

Method: GET

Input

Argument Name	Type	Required	Description
start_time	string	Required	Start time to search for Alerts
end_time	string	Required	End time to search for Alerts
alert_filter	string	Required	Add any alert types that should be fetched

Input Example

{"start_time":"string","end_time":"string","alert_filter":"string"}

Get Alerts and Metadata

Get Alerts from Lacework

Endpoint

URL: api/v2/Alerts

Method: GET

Input

Argument Name	Type	Required	Description
start_time	string	Required	Start time to search for Alerts
end_time	string	Required	End time to search for Alerts
alert_filter	string	Required	Add any alert types that should be fetched

Input Example

{"start_time":"string","end_time":"string","alert_filter":"string"}

Get Cloud Accounts

Lacework Get Cloud Accounts

Endpoint

URL: api/v2/CloudAccounts

Method: GET

Get Host Vulnerabilities

Run a query against lacework

Endpoint

URL: Vulnerabilities/Containers/search

Method: GET

Input

Argument Name	Type	Required	Description
primary_query_endpoint	string	Optional	Parameter for Get Host Vulnerabilities
primary_query_filter	array	Optional	Parameter for Get Host Vulnerabilities
primary_query_filter.field	string	Optional	Parameter for Get Host Vulnerabilities
primary_query_filter.expression	string	Optional	Parameter for Get Host Vulnerabilities
primary_query_filter.values	array	Optional	Value for the parameter
primary_query_filter.value	string	Optional	Value for the parameter
primary_query_return_fields	array	Optional	Parameter for Get Host Vulnerabilities
secondary_query_endpoint	string	Optional	Parameter for Get Host Vulnerabilities
secondary_query_filter	array	Optional	Parameter for Get Host Vulnerabilities
secondary_query_filter.field	string	Optional	Parameter for Get Host Vulnerabilities
secondary_query_filter.expression	string	Optional	Parameter for Get Host Vulnerabilities
secondary_query_filter.values	array	Optional	Value for the parameter
secondary_query_filter.value	number	Optional	Value for the parameter
master_key	string	Optional	Parameter for Get Host Vulnerabilities
field_mappings	object	Optional	Parameter for Get Host Vulnerabilities
field_mappings.agent_id	object	Optional	Unique identifier
field_mappings.agent_id.ReferenceLookup	object	Optional	Unique identifier
field_mappings.agent_id.ReferenceLookup.key	string	Optional	Unique identifier
field_mappings.agent_id.ReferenceLookup.field	string	Optional	Unique identifier
field_mappings.agent_id.ReferenceLookup.data	string	Optional	Response data
field_mappings.agent_id.ReferenceLookup.multi_value	boolean	Optional	Unique identifier
field_mappings.cloud_instance_id	object	Optional	Unique identifier
field_mappings.cloud_instance_id.ReferenceLookup	object	Optional	Unique identifier
field_mappings.cloud_instance_id.ReferenceLookup.key	string	Optional	Unique identifier
field_mappings.cloud_instance_id.ReferenceLookup.field	string	Optional	Unique identifier

Input Example

{"primary_query_endpoint":"Entities/Machines/search","primary_query_filter":[{"field":"severity","expression":"in","values":["Critical","High","Medium"]},{"field":"status","expression":"in","values":["New","Active"]},{"field":"fixInfo.fix_available","expression":"eq","value":1}],"primary_query_return_fields":["mid","machineTags"],"secondary_query_endpoint":"Vulnerabilities/Hosts/search","secondary_query_filter":[{"field":"severity","expression":"in","values":["Critical","High","Medium"]},{"field":"status","expression":"in","values":["New","Active"]},{"field":"fixInfo.fix_available","expression":"eq","value":1}],"master_key":"vulnerability_id","field_mappings":{"agent_id":{"ReferenceLookup":{"key":"mid","field":"mid","data":"primary_query","multi_value":false}},"cloud_instance_id":{"ReferenceLookup":{"key":"mid","field":"machineTags_InstanceId","data":"primary_query","multi_value":false}},"cloud_account_id":{"ReferenceLookup":{"key":"mid","field":"machineTags_Account","data":"primary_query","multi_value":false}},"ami_id":{"ReferenceLookup":{"key":"mid","field":"machineTags_AmiId","data":"primary_query","multi_value":false}},"vulnerability_id":"vulnId","vulnerability_meta_name":"featureKey.name","vulnerability_meta_namespace":"featureKey.namespace","vulnerability_description_text":"cveProps.description","vulnerability_reference":"cveProps.link","vulnerability_meta_version_current":"featureKey.version_installed","vulnerability_meta_version_fixed":"fixInfo.fixed_version","vulnerability_severity":"severity","vulnerability_category":"status"}}

Get Host Vulnerabilities Bad

Run a query against lacework

Endpoint

URL: Vulnerabilities/Containers/search

Method: GET

Input

Argument Name	Type	Required	Description
start_time	string	Optional	Time value
end_time	string	Optional	Time value
filter	array	Optional	Parameter for Get Host Vulnerabilities Bad
filter.field	string	Optional	Parameter for Get Host Vulnerabilities Bad
filter.expression	string	Optional	Parameter for Get Host Vulnerabilities Bad
filter.values	array	Optional	Value for the parameter
filter.value	string	Optional	Value for the parameter
returns	array	Optional	Parameter for Get Host Vulnerabilities Bad

Input Example

{"start_time":"-7 days","end_time":"now","filter":[{"field":"severity","expression":"in","values":["Critical","High","Medium"]},{"field":"status","expression":"in","values":["New","Active"]},{"field":"fixInfo.fix_available","expression":"eq","value":"1"}],"returns":["mid","severity","vulnId","evalCtx","fixInfo","featureKey"]}

Output Example

{"evalCtx":{"exception_props":[],"hostname":"ip-10-160-5-194.ec2.internal","mc_eval_guid":"6398c97cd2e9172783de42186df1a694"},"featureKey":{"name":"p11-kit-trust","namespace":"amzn:2","package_active":0,"package_path":"","version_installed":"0:0.23.22-1.amzn2.0.1"},"fixInfo":{},"mid":6420720632738334000}

Get Machines

Run a query against lacework

Endpoint

URL: Vulnerabilities/Containers/search

Method: GET

Get Report

Run a query against lacework to hunt for IPs

Endpoint

URL: Reports

Method: GET

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Get Report
params.primaryQueryId	string	Optional	Unique identifier
params.secondaryQueryId	string	Optional	Unique identifier
params.format	string	Optional	Parameter for Get Report
params.reportType	string	Optional	Type of the resource

Input Example

{"params":{"primaryQueryId":"627166550282","secondaryQueryId":"","format":"json","reportType":"AWS_SOC_Rev2"}}

Output

Parameter	Type	Description
data	array	Response data
data.reportType	string	Response data
data.reportTitle	string	Response data
data.custGuid	string	Response data
data.envGuid	string	Response data
data.recommendations	array	Response data
data.recommendations.ACCOUNT_ID	string	Response data
data.recommendations.ACCOUNT_ALIAS	string	Response data
data.recommendations.START_TIME	number	Response data
data.recommendations.SUPPRESSIONS	array	Response data
data.recommendations.SUPPRESSIONS.file_name	string	Response data
data.recommendations.SUPPRESSIONS.file	string	Response data
data.recommendations.INFO_LINK	string	Response data
data.recommendations.ASSESSED_RESOURCE_COUNT	number	Response data
data.recommendations.STATUS	string	Response data
data.recommendations.REC_ID	string	Response data
data.recommendations.CATEGORY	string	Response data
data.recommendations.SERVICE	string	Response data
data.recommendations.TITLE	string	Response data
data.recommendations.VIOLATIONS	array	Response data
data.recommendations.VIOLATIONS.reasons	array	Response data
data.recommendations.VIOLATIONS.resource	string	Response data
data.recommendations.RESOURCE_COUNT	number	Response data
data.recommendations.SEVERITY	number	Response data
data.summary	array	Response data

Output Example

{"data":[],"ok":true,"message":"string"}

Post Comments

Endpoint

URL: /api/v2/Alerts/{alertId}/comment

Method: GET

Input

Argument Name	Type	Required	Description
alert_id	string	Required	Unique identifier
comment	string	Required	Parameter for Post Comments

Input Example

{"alert_id":"12345","comment":"Closing as false positive."}

Output

Parameter	Type	Description
data	object	Response data
data.id	number	Response data
data.alertId	number	Response data
data.createdTime	string	Response data
data.entryType	string	Response data
data.entryAuthorType	string	Response data
data.message	object	Response data
data.message.value	string	Response data
data.externalTime	string	Response data
data.user	object	Response data
data.user.userGuid	string	Response data
data.user.username	string	Response data
data.updateContext	object	Response data

Output Example

{"data":{"id":211250,"alertId":871115,"createdTime":"2022-07-18T18:28:30.739Z","entryType":"Comment","entryAuthorType":"UserUpdate","message":{"value":"test comment"},"externalTime":"","user":{"userGuid":"LW123_6FA99157890E373006F7EE3FA926B02C38D547BD6C79F1D","username":"[email protected]"},"updateContext":{}}}

Query IP Indicators

Run a query against lacework to hunt for IPs

Endpoint

URL: Queries/execute

Method: GET

Input

Argument Name	Type	Required	Description
start_time	string	Optional	Time value
end_time	string	Optional	Time value
ips	array	Optional	Parameter for Query IP Indicators

Input Example

{"start_time":"-1 days","end_time":"now","ips":["8.8.8.8","9.9.9.9"]}

Query Lacework

Run a query against lacework

Endpoint

URL: Vulnerabilities/Containers/search

Method: GET

Input

Argument Name	Type	Required	Description
start_time	string	Required	Start time to search for Alerts
end_time	string	Required	Start time to search for Alerts
query_endpoint	string	Required	Endpoint to query data from
filter	array	Required	Parameter for Query Lacework
filter.expression	string	Optional	Parameter for Query Lacework
filter.field	string	Optional	Parameter for Query Lacework
filter.value	string	Optional	Value for the parameter
filter.values	array	Optional	Value for the parameter
returns	array	Optional	Which items to return from API call

Input Example

{"start_time":"string","end_time":"string","query_endpoint":"string","filter":[{"expression":"string","field":"string","value":"string","values":["string"]}],"returns":["string"]}

Search Active Containers

Search Active Containers API

Endpoint

URL: api/v2/Entities/Containers/search

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Optional	Data Body
headers	object	Optional	Request Headers

Input Example

{"path_parameters":{},"parameters":{},"data_body":{},"headers":{}}

Search Agent Information

Search Agent Information API

Endpoint

URL: /api/v2/AgentInfo/search

Method: POST

Input

Argument Name	Type	Required	Description
start_time	string	Optional	Time value
end_time	string	Optional	Time value
filters	array	Optional	Parameter for Search Agent Information
filters.field	string	Optional	Parameter for Search Agent Information
filters.expression	string	Optional	Parameter for Search Agent Information
filters.value	string	Optional	Value for the parameter
returns	array	Optional	Parameter for Search Agent Information

Input Example

{"start_time":"-1 days","end_time":"now","filters":[{"field":"status","expression":"eq","value":"ACTIVE"}],"returns":["hostname","ipAddr","os","agentVersion","status"]}

Search Audit Logs

Search Audit Logs API

Endpoint

URL: api/v2/AuditLogs/search

Method: POST

Input

Argument Name	Type	Required	Description
start_time	string	Optional	Time value
end_time	string	Optional	Time value
filter	array	Optional	Parameter for Search Audit Logs
filter.field	string	Optional	Parameter for Search Audit Logs
filter.expression	string	Optional	Parameter for Search Audit Logs
filter.value	string	Optional	Value for the parameter
filter.values	array	Optional	Value for the parameter
returns	array	Optional	Parameter for Search Audit Logs

Input Example

{"start_time":"-1 days","end_time":"now","returns":["accountName","createdTime","eventDescription","eventName","userAction","userName"]}

Search Compliance Evaluations

Search Compliance Evaluations API

Endpoint

URL: api/v2/Configs/ComplianceEvaluations/search

Method: POST

Input

Argument Name	Type	Required	Description
start_time	string	Optional	Time value
end_time	string	Optional	Time value
filter	array	Optional	Parameter for Search Compliance Evaluations
filter.field	string	Optional	Parameter for Search Compliance Evaluations
filter.expression	string	Optional	Parameter for Search Compliance Evaluations
filter.value	string	Optional	Value for the parameter
returns	array	Optional	Parameter for Search Compliance Evaluations
dataset	string	Optional	Response data

Input Example

{"start_time":"-1 days","end_time":"now","filter":[{"field":"status","expression":"eq","value":"NonCompliant"},{"field":"account.AccountId","expression":"eq","value":"812212113623"}],"returns":["account","id","recommendation","severity","status"],"dataset":"AwsCompliance"}

Search Container Vulnerabilities

Search Active Containers API

Endpoint

URL: api/v2/Entities/Containers/search

Method: POST

Input

Argument Name	Type	Required	Description
start_time	string	Optional	Time value
end_time	string	Optional	Time value
filter	array	Optional	Parameter for Search Container Vulnerabilities
filter.field	string	Optional	Parameter for Search Container Vulnerabilities
filter.expression	string	Optional	Parameter for Search Container Vulnerabilities
filter.value	string	Optional	Value for the parameter
returns	array	Optional	Parameter for Search Container Vulnerabilities

Input Example

{"start_time":"-1 days","end_time":"now","filter":[{"field":"severity","expression":"eq","value":"Medium"},{"field":"fixInfo.fix_available","expression":"eq","value":1},{"field":"evalCtx.image_info.digest","expression":"eq","value":"sha256:07aea1edd530054adb739335edd8d9c7fc9c0cbbd982c7250b24442fefa0d0b8"}],"returns":["imageId","severity","status","vulnId","evalCtx","fixInfo","featureKey"]}

Search Inventory

Lacework Search Inventory API

Endpoint

URL: api/v2/Inventory/search

Method: GET

Input

Argument Name	Type	Required	Description
start_time	string	Optional	Time value
end_time	string	Optional	Time value
filter	array	Optional	Parameter for Search Inventory
filter.field	string	Optional	Parameter for Search Inventory
filter.expression	string	Optional	Parameter for Search Inventory
filter.value	string	Optional	Value for the parameter
filter.values	array	Optional	Value for the parameter
returns	array	Optional	Parameter for Search Inventory
csp	string	Optional	Parameter for Search Inventory

Input Example

{"start_time":"-1 weeks","end_time":"now","filter":[{"field":"resourceRegion","expression":"eq","value":"ap-southeast-2"},{"field":"cloudDetails.accountID","expression":"eq","value":"16459126737"},{"field":"resourceType","expression":"in","values":["acm:certificate","ec2:customer-gateway","ec2:instance","ec2:internet-gateway","ec2:natgateway","ec2:security-group","ec2:subnet","ec2:vpc","ec2:vpc-endpoint","ec2:vpc-flow-log","ec2:vpn-connection","ec2:vpn-gateway","eks:cluster","elbv2:listener","elbv2:listener-rule","elbv2:loadbalancer","elbv2:target-group","s3:bucket"]}],"returns":["urn","cloudDetails","resourceConfig","resourceId","resourceType"],"csp":"AWS"}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT