Zscaler Deception
The Zscaler Deception connector enables automated interactions with the Zscaler Deception platform, facilitating the retrieval and management of security incidents and events.
Zscaler Deception is a cloud-based security service that specializes in the detection of advanced threats and targeted attacks. This connector enables Swimlane Turbine users to automate the retrieval and analysis of security events and incidents, as well as the management of incident-related comments directly within the Swimlane platform. By integrating with Zscaler Deception, users can enhance their security posture with real-time threat intelligence and streamline their incident response workflows, ensuring a proactive defense against deceptive attacks.
Limitations and Known Issues
None to date.
Supported Versions
This Zscaler Deception connector uses the Version 2API.
Additional Docs
Configuration
Prerequisites
To effectively utilize the Zscaler Deception connector with Swimlane Turbine, ensure you have the following:
- API Key Authentication with the required parameters:
- URL: The endpoint URL for the Zscaler Deception API.
- API Token (x-client-auth): A unique token used to authenticate API requests.
Authentication Methods
API Key Authentication:
- URL: The endpoint URL for the Zscaler Deception API (default: https://admin.zscalerbeta.net).
- Username: Your Zscaler Deception username with sufficient permissions.
- Password: The password associated with your Zscaler Deception account.
- API Token: The API token/key associated with your Zscaler Deception account.
- Verify SSL Certificates: Option to verify SSL certificate (default: true).
- HTTP(s) Proxy: Optional proxy to route requests through.
Capabilities
This Zscaler Deception connector provides the following capabilities:
- Get Events
- Get Incidents
- Get Incident Comments
Get Events
Returns a list of events from the Zscaler Deception platform. This action requires Read:Events permission and supports filtering, sorting, and pagination through query parameters.
Zscaler Deception's documentation for this action can be found here.
Get Incidents
Returns a list of incidents from the Zscaler Deception platform. This action requires Read:Incidents permission and allows filtering by incident ID, date range, and other criteria. You can use query parameters to limit your search by incident ID, status, or date range.
Zscaler Deception's documentation for this action can be found here.
Get Incident Comments
Returns all comments for a specific incident from the Zscaler Deception platform. This action requires Read:Incidents permission and allows you to retrieve the complete comment history for any incident by providing the incident ID.
Zscaler Deception's documentation for this action can be found here.
Configurations
Zscaler Deception API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
api_key | API Token for x-client-auth header | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Events
Retrieves a list of events from Zscaler Deception, with options to specify limit and offset. Requires Read:Events permission.
Endpoint
- URL: api/v2/events/
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.limit | integer | Required | The numbers of items to return in a single response |
parameters.offset | integer | Required | The number of items to skip before starting to collect the result |
parameters.sort | array | Optional | Sort order for events (e.g., "timestamp asc", "id desc") |
parameters.fields | array | Optional | Fields to include in the response |
parameters.from | string | Optional | Start date/time filter |
parameters.to | string | Optional | End date/time filter |
parameters.expfilter | array | Optional | Expression filter |
parameters.whitelisted | string | Optional | Whitelist filter |
parameters.test_events_only | string | Optional | Filter for test events only |
Input Example
{"parameters":{"limit":100,"offset":123,"sort":["string"],"fields":["string"],"from":"string","to":"string","expfilter":["string"],"whitelisted":"string","test_events_only":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data.file_name | string | Response data |
data.file | string | Response data |
meta | object | Output field: meta |
meta.paging | object | Output field: meta.paging |
meta.paging.total | number | Output field: meta.paging.total |
meta.paging.offset | number | Output field: meta.paging.offset |
meta.paging.limit | number | Output field: meta.paging.limit |
meta.paging.amount | number | Output field: meta.paging.amount |
Output Example
{"status_code":200,"reason":"OK","json_body":{"data":[],"meta":{"paging":{}}}}
Get List of all Comments
Retrieve all comments linked to a given incident in Zscaler Deception by providing the incidentId.
Endpoint
- URL: api/v2/incidents/id/{{incidentId}}/comments
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.incidentId | integer | Required | Incident Id |
Input Example
{"path_parameters":{"incidentId":123}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data.file_name | string | Response data |
data.file | string | Response data |
meta | object | Output field: meta |
meta.paging | object | Output field: meta.paging |
meta.paging.total | number | Output field: meta.paging.total |
meta.paging.offset | number | Output field: meta.paging.offset |
meta.paging.limit | number | Output field: meta.paging.limit |
meta.paging.amount | number | Output field: meta.paging.amount |
Output Example
{"status_code":200,"reason":"OK","json_body":{"data":[],"meta":{"paging":{}}}}
Get Incidents
Retrieves a list of incidents from Zscaler Deception, with the ability to specify limit and offset. Read:Incidents permission is required.
Endpoint
- URL: api/v2/incidents
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.incident_id | string | Optional | Incident Id |
parameters.from | string | Optional | from date |
parameters.to | string | Optional | to date |
parameters.spoll | boolean | Optional | Spoll |
parameters.limit | integer | Required | The numbers of items to return in a single response |
parameters.offset | integer | Required | The number of items to skip before starting to collect the result |
Input Example
{"parameters":{"incident_id":"string","from":"string","to":"string","spoll":true,"limit":100,"offset":123}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
title | string | Output field: title |
type | string | Type of the resource |
filter | string | Output field: filter |
window | string | Output field: window |
description | string | Output field: description |
mitigation | string | Output field: mitigation |
icon | string | Output field: icon |
columns | array | Output field: columns |
Output Example
{"status_code":200,"reason":"OK","json_body":{"id":0,"incident_id":0,"user_id":0,"comment":"string","created_timestamp":"string","edited_timestamp":"string","user_name":"string","user_login_id":"string"}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |