Cyberint Argos Edge

Cyberint Argos Edge is an attack surface management solution providing findings into the external attack surface, phishing threats, brand impersonation, and more.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices, Aggregated Security Findings, SaaS Applications, Organizational Units, Users, Domains & URLs, File Systems, Incidents, Software

Parameters

1. Host Name or IP Address (required) - The hostname or IP address of the Argos Edge server, such as https://environment.cyberint.io/

2. Access Token (required) - An API Key associated with a user account that has permissions to fetch assets.

3. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

4. HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

5. HTTPS Proxy User Name (optional) - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

6. HTTPS Proxy Password (optional) - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

• Enable fetch from Alerts API (default: enabled) - Select this option to have the adapter fetch alerts from the Alerts API.
• Fetch Alerts Modified In Last X Days - Specify the number of days back to fetch modified alerts. By default the API sets a filter of one day.
• Fetch Alerts as Incidents instead of Devices (default: disabled) - Select this option to fetch alerts as Incidents instead of Devices.
• Enable fetch from Assets API (default: disabled) - Enable this option to have the adapter fetch Devices, Organizational Units, Users, Domains and URLs, and File Systems from the Assets API, according to the filter you configure. When you enable this, the following fields become available:
  • Customer ID (required) - Enter your customer ID.
  • Filter assets by type and Filter assets by monitoring status - Select the filters you want to apply to the fetch from each category's dropdown. For example, under Filter assets by type, you can choose to fetch only AWS accounts. By default, Filter assets by monitoring status is set to monitored_asm_and_ti and monitored_asm.
  • The following fields provide additional filtering options with numeric values. Enter the required number for the selected filter. For Example, if you want to Fetch only technologies with the specified top CVE score or higher, specify a CVE score.
    • Fetch assets created in last X days - Fetch only assets that were created in the specified number of last days.
    • Fetch only assets with the specified discovery precision or higher - Fetch only assets whose discovery precision is equal to or higher than the specified number.
    • Fetch only technologies with the specified top CVE score or higher - Fetch only technologies whose top CVE score is equal to or higher than the specified score.
    • Fetch technologies first seen in last X days - Fetch only technologies that were first seen in the specified number of last days.
    • Fetch technologies last seen until X days ago - Fetch only technologies that were last seen until the specified number of days ago.

APIs

Axonius uses the Cyberint Alerts (1.0) API and the Cyberint Assets API. The following endpoints are called:

• POST alert/api/v1/alerts - Used to test the connection and, when Enable fetch from Alerts API is selected, to fetch alerts.
• POST asset-configuration/external/api/v1/assets/ - Used to fetch assets when Enable fetch from Assets API is selected.
• POST asset-configuration/external/api/v1/assets/technologies - Used to fetch the technologies of the fetched assets when Enable fetch from Assets API is selected.

Supported From Version

Supported from Axonius version 4.5