SNYPR is a security analytics platform that transforms Big Data into actionable security intelligence. It delivers the proven power of Securonix analytics with the speed, scale, and affordable, long-term storage of Hadoop in a single, out-of-the box solution.

Connect Securonix SNYPR with Devo SOAR

1. Navigate to Automations > Integrations.

2. Search for Securonix SNYPR.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the Devo SOAR Remote Agent.

8. URL: URL to your SNYPR instance. Example: 'https://www.example.com/Snypr'.

9. Tenant (Optional): SNYPR Tenant. Default "Securonix".

10. Username: Username for the SNYPR account.

11. Password: Password for the SNYPR account.

12. After you've entered all the details, click Connect.

Actions for Securonix SNYPR

Get Activity Data

Get Activity Data (also known as "event data") for a specific Datasource by running a Spotter query on Activity selection. For activity data, querying is allowed only for a 24-hour time range window. You can add additional conditions to the query for custom results.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

If split rows are selected, events in separate rows are displayed in json format:

• has_error: True/False

• error: message/null

• other fields of an Event data

else a single row containing an array of events is displayed:

• has_error: True/False

• error: message/null

• events: array of Activity Events json data

List Resources

Displays a list of all users, peer groups, resource groups, or policies.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• resource json of either of Policies/Resource Groups/Users/Peer Groups

Search Users

Search users in your organization.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

If split rows are selected, users in separate rows are displayed in json format:

• has_error: True/False

• error: message/null

• other fields of User data

else a single row containing an array of users is displayed:

• has_error: True/False

• error: message/null

• events: array of User json data

Search Watchlist

Search watchlists in your organization.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

If split rows are selected, watchlists in separate rows are displayed in json format:

• has_error: True/False

• error: message/null

• other fields of Watchlist data

else a single row containing an array of users is displayed:

• has_error: True/False

• error: message/null

• events: array of Watchlist json data

Get Violations

Get violations in violation collection.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output of Action:
If split rows are selected, violations data in separate rows are displayed in json format:

• has_error: True/False

• error: message/null

• other fields of a Violation data

else a single row containing an array of violations is displayed:

• has_error: True/False

• error: message/null

• events: array of Violation json data

Risk Scorecard/History

List the user's risk scorecard or history data.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

If split rows are selected, risk data in separate rows are displayed in json format:

• has_error: True/False

• error: message/null

• other fields of an Risk data

else a single row containing an array of risk is displayed:

• has_error: True/False

• error: message/null

• events: array of Risk json data

Run Spotter Query

Run generic Spotter Query on your SNYPR Instance.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

if Split Rows is selected, results in separate rows are displayed in json format:

• has_error: True/False

• error: message/null

• other fields of result data

else a single row containing an array of users is displayed:

• has_error: True/False

• error: message/null

• events: array of json results

Add Comment to Violation

Adds a comment to a SNYPR Violation.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• other fields of result data

Release Notes

• v2.0.0 - Updated architecture to support IO via filesystem