Cybereason Connector

How to Get Domain, Username, and Password

• Domain: Provided by Cybereason and used in the API base URL (e.g., https://your-domain.cybereason.net/)
• Username/Password: Issued upon subscription or user provisioning.

Create a New API Connector

Basic Details

1. Provide the Connector's Name and Description.
2. Select the you want to import or export - currently, we support Asset.
3. Select the Asset Type - currently we support Host Asset.
   The following screenshot displays the Basic Details fields.
   

4. Next, provide the API authentication details of the CyberReason environment as provided in the Prerequisites section.

Data Model

The CyberReason API Connector offers an out-of-box data model mapping for you to map with Qualys ETM schema. You can view the schema to understand the attributes in the data model.

Transform Maps

Map the fields from the CSV file to the corresponding fields in your target system. Transform Maps ensure the data is transformed correctly during the import or export process.

The CyberReason Connector offers an out-of-box transform map for you to proceed without further configuration. View the map to understand the data transformation or clone the map to edit its configurations.

Click Create New for a new Transform Map.

Perform the following steps to configure a Transform Model:

1. Transform Map Name: Enter a unique name for the Transform Map. This name helps identify the specific transformation configuration within this connector.
2. Source Data Model: Select the data model that serves as the input for the transformation. This is the model from which data will be extracted.
3. Target Data Model: Choose the data model that receives the transformed data. This model defines how the data will be structured after the transformation.

Fields Mapping

The Fields Mapping section maps fields from the Source Data Model to the Target Data Model.

1. Source Field: Specify the field in the Source Data Model containing the transformed data.
2. Data Type: Indicate the data type of the Source Field (e.g., string, integer, date).
3. Target Field: Designate the corresponding field where the transformed data will be placed in the Target Data Model.

Click Add to create and display the mapping for the Source Field, Data Type, and Target Field below the section. This visual helps ensure that all necessary fields are mapped correctly and allows easy verification and adjustments.

Profile

Create a profile for your connector. A profile decides the connector status, execution schedule and transform map to choose. The connector follows the configurations of this profile for all future executions.

Click the "+" to create a new profile.

In the Add Profile screen, provide the necessary inputs for your new profile.

Provide a Name and Description.

The Filter field allows for advanced data scoping by defining conditions to selectively retrieve assets based on attributes.

Sample filter (as shown in above image):

{
  "fieldName": "osType",
  "operator": "Equals",
  "values": ["WINDOWS", "OSX"]
}

This filter restricts ingestion to assets running Windows or macOS operating systems.

Select the required Transform Map for the data mapping.

The Resource Types determine which resources to select for the profile. The Resource Type determine the required resource whose findings should be ingested by Qualys ETM.

The Status field determines whether the connector should be in Active or Inactive state after creation. 

Lastly, the Schedule section lets you either create a Single Occurrence schedule or a Recurring schedule. Provide the exact date and time for the Single Occurence execution and provide the Start and End date/time for the Recurring schedule.

Select Identification Rules

The Identification Rules are a set of out-of-the-box precedence rules set by Qualys CSAM. The connector discovers findings based on the order set by the selected Identification Rules.

You can proceed to the next step without making any changes to this screen.

If you don't want to choose a specific rule, turn off the toggle next to it. But, ensure that at least one rule is selected.

To learn more about the different rules and options present in this screen, refer to the CSAM Online Help.

How Does a Connection Work?

The CyberReason connector functions through configured profiles, determining what data gets synchronised and when.

A Connection usually involves creating a profile that defines which vulnerabilities to import based on detection data types and asset types. The connector then automatically executes according to the schedule (or on-demand), pulling asset data from CyberReason into Qualys ETM where it can be viewed alongside other security findings.

With the CyberReason API Connector successfully configured, you are almost ready to view all the assets and findings from CyberReason.

In the Connector screen, you can find your newly configured connector listed and marked in the Processed state.

Connector States

A successfully configured connector goes through 4 states.

1. Registered - The connector is successfully created and registered to fetch data from the vendor.
2. Scheduled - The connector is scheduled to execute a connection with the vendor.
3. Processing - A connection is executed and the connector is fetching the asset and findings data.
4. Processed - The connector has successfully fetched the assets, it may still be under process of fetching the findings. Wait for some more time for the connector to fetch the findings completely.

The Processed state indicates that the Connector is successfully configured but it is under the process of importing all your assets and findings. This process (specifically for findings) may take some time.

This entire process may take up to 2 hours for completion. Once, it is done. You can find the imported data in Enterprise TruRisk Management (ETM).