In order for 40 analyzer to interact with other devices and execute playbooks,
using those other
devices, it's going to use a set of connectors. And as I mentioned in the
overview, depending on
what connectors we have set up is going to control what 40 analyzer is able to
interact with. So to
get a better idea of connectors that are in place and or available on the 40
analyzer, let's make
a road trip over to our 40 analyzer. All right, and here we go. Let me go ahead
and log in. I'll
supply the password, click log in. And because we are using administrative WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
supply the password, click log in. And because we are using administrative
domains, it's going to
ask us about which ADAM we want to go into. We're going to go into the root AD
AM where I have four
devices. And again, this is the firmware version 763F as in, hope it works
because the feature version
is not one you should use in production. You should make sure you use the
mature versions,
but for the demos and for the set of videos, I have chosen the feature version.
Because going
forward, what's going to happen is the interface here is going to be adopted as
versions become
more mature. So as far as the connectors go and automation in general on the 40 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
more mature. So as far as the connectors go and automation in general on the 40
analyzer,
we're going to go down to incidents and events. And under incidents and events,
we have an option right here called automation. And those were going to see all
the details
regarding playbooks and automation with playbooks. So we'll click here on
automation. And we are
on the summary tab. I was doing some play earlier today with various testing of
some playbooks.
But what I want to do right now in this video is take a look at active
connectors. So currently,
I have some connections to some 48 firewalls. And this is just updating the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I have some connections to some 48 firewalls. And this is just updating the
health stuff there.
So this says three devices connected, three devices disconnected. I do have
four firewalls
in HA pairs. So we click here, it's going to show us. So I've got the branch
firewall one and it's
HA pair. And I've got the 48 fabric, the headquarters site with firewalls one,
two, and three firewall,
one is the route. And then over here, I've got 48 fabric again. And there's no
automation
rules configured on this device. We'll take a look in another video about local
configured
automation rules. But for now, I just want to confirm that we have access with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
automation rules. But for now, I just want to confirm that we have access with
this 40
OS connector from the 40 analyzer over to our 48 firewalls. Let me go ahead and
close that.
Here's the local connector. Effectively, that's the connector of the 40 analy
zer to itself. And
then we have the 40 guard connector. And then all these others, I don't have
those components in
place. So they're showing up as grayed out. Now, if we wanted to add another
connector, what we
could do is click on create new and here are 20 security fabric connectors that
we could add.
And we also have some IT service management connectors with service now, slack, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we also have some IT service management connectors with service now, slack,
MS teams,
and a generic connector as well. And if we could cancel here and scroll down a
little bit on the
active connections page here, there's also a third party connector for virus
total right here.
Now, currently it is not enabled. Also, it is not yet configured. So if we
double click on virus
total, what we could do is go ahead and put in the API key that would authorize
us effectively
to go ahead and make queries up to virus total. So I made a free account up at
virus total. That's
right now on this page. And if you go to Keith Barker there and go to API key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right now on this page. And if you go to Keith Barker there and go to API key.
So here's the API
key that we can insert there. We can click on here to copy, put on a seat,
click on the eyeball.
And there's also quotas with my free account. So if you want to upgrade and
have more ability and
more quantity for API calls, you can go ahead and do an upgrade. But for the
free version,
you get four lookups per minute and 500 lookups per day. And the monthly quota
is 15 and a half
thousand lookups per month. It's also saying that for this free version, you're
not supposed to use
it in business workflows, commercial products, or services. So effectively, if
you're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you're going to
use this for your production business, you'd want to upgrade and not use the
free account.
So I'm going to go ahead and click here, copy to copy my API key. And then with
that now my clipboard,
I'll go over here to the configuration for the virus total connector. And for
the API key, I'll
delete that and I'll do a control V and I'll paste in that key. And then here
on the action tab,
it's supposed to find what we're able to do with virus total. So we can query
based on IP or domain
or URL to get more information on a specific IP domain or URL. So go back to
configuration we go, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
configuration we go,
we'll click on OK. And now that it's configured, I also want to go ahead and
enable it. So if we
click right here on enable, here's a little green check, which is great. API
connection is
successful, which is a good indicator. And as another example, we scroll up
here for four guard
connector, let me go ahead and refresh that real quick. And now we have a green
check there,
which is great. So we're curious about whether or not we have our connectors in
place. Here's
where we go under instant events, automation, and active connectors. And then
also confirm that we
have the connections in place that we want to use. And as an example of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have the connections in place that we want to use. And as an example of
creating a new one,
let's go to create new. And let's see when I can demo here, how about there's
Cisco ice,
vSphere, I can do that. I've got some vSphere servers in my environment. So I
go ahead and
let me select vSphere by double clicking on it. And in my lab environment, it's
at 192.168.111.
That's the vCenter server component. And the username, let me look for that up
real quick,
it'd be administrator at ogit. prod. It's getting here my lab environment. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it'd be administrator at ogit. prod. It's getting here my lab environment. And
the password, I'll put
that in. And then we click on action, you'll can ingest or receive vSphere
server event logs.
And for data ingestion, I'm going to go ahead and enable it. And for the
schedule, let me go
ahead and have it do it today at 105 PM. And then I'll have it end today as
well at 5 PM. And the
interval value of the schedule, let me go ahead and say every about 10 minutes.
Also include the
vSphere server event logs, scroll down, and that looks good. So we'll click on
okay. And if that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
okay. And if that
went well, this should change to a little green checkmark here. As soon as it
makes the connection,
and we have that connector working between 40 analyzer and my vSphere
environment. So I'm going
to go ahead and bounce off that tab for a moment, go back to active connectors,
scroll down,
and survey says it is a green. That's fantastic. So now we have that connector
in place as well
that we can use. So based on the types of connectors that are active and
available,
that's going to control what actions we can do based on which devices we're
operating with. So
here we can interact with virus total. We have some logs we can take from v WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here we can interact with virus total. We have some logs we can take from v
Sphere. We have the
local connector for the 40 analyzer itself. We have the ForteGuard connector
for ForteGuard
services up in the cloud. And we have three devices connected with the 40 us
connector,
effectively meaning the 40 analyzer can interact with the automation and the
stitches over on the
40 gates. And as an example of some of the options we could have based on the
connector we're using,
let's just for a moment go to playbook tab here. I'm going to create a new
playbook just for the
purpose of showing you based on the connector that we're using the options that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
purpose of showing you based on the connector that we're using the options that
are available. So I
can click right here new playbook created from scratch. And then we can choose
our trigger. We'll
cover triggers in more detail in next video. So I'll say on demand and click on
save, which basically
means this playbook can be launched manually by an administrator. And then
based on this playbook
being triggered, we can specify the follow up action. So we can take cancel
that for a moment,
we can just grab any dots here and create a subsequent action out of them. And
it doesn't
matter which one you use, you can use the top one, the bottom one, the right
one doesn't really matter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one doesn't really matter.
So we'll drag it over here and now because I do have connectors in place with
the local host,
the 40 analyzer itself with 40 us, which is the 40 gate firewalls and Forte
Guard up in the cloud.
And we also have connectors over with virus total. I could leverage any of
those including vSphere.
And again, depending on the connector we're using is going to depend on the
actions we could take.
So for example, if we said local host, which is the 40 analyzer itself, so I'll
put demo here
for the name and then for the connectors, the local connector. And then for the
action, check
it out. These are all the actions that the 40 analyzer can do on itself WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it out. These are all the actions that the 40 analyzer can do on itself
effectively as it
interacts with its own 40 analyzer brain. So update and asset and identity, get
events,
etc, etc, etc. And the list goes on. So if we change this, for example, do
cancel
and let's create a different action and let's go ahead and use 40 us as the
connector. So I'll
type in demo there. Now that 40 us is the connector, we can specify the device
to use
and then the automation. And an incoming web hook call is the interaction
between the 40 analyzer
and what the 40 gate or the security fabric of 40 gates have configured in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and what the 40 gate or the security fabric of 40 gates have configured in
their automation as
far as stitches go. So for device ID, I'll go ahead and select HQ firewall one,
and then we'll click
on okay. As another example, based on the connector we're working with, if we
remove the tasks that
we just put in there and then we grabbed an edge there and brought it over, let
's go ahead and
let's do how about virus total. So it's like virus total. I'll type in demo for
this. It's
going to use the virus total connector. So here for the actions, virus total, I
have query IP,
query domain and so forth. So if we click then cancel there and we used a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
query domain and so forth. So if we click then cancel there and we used a
different connector,
so we'll scroll down and click on vSphere. I'll just label this demo for the
moment. Again,
we're just focusing on the various connectors and what we can do with them. And
then for the action,
here we have the action of ingest event log to 40 analyzer from a vSphere
server and click on
okay. And then I click on cancel. I don't want to save this new playbook. And
we took a look at
another example. Let's go ahead and let's look at this one right here, a
playbook called incident
dash run report. So it's an on demand trigger. It would regenerate a report. In
fact, we can't
edit this because it's a built in one. But what we can do is we could right
click and click on clone WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
click and click on clone
and it'll give us the chance to edit and take a look at the details. So here,
if we take a look
at this run report task, we edit it and she's in the local connector, the
action is run report,
we still saw the report we want to run. So we'll cancel that. We looked at the
attached data to
incident. Effectively, it would run the report and then attach that report to
the incident. And
this playbook, when we execute this, we do that for us. So generate the report
and then attach
that report to an incident. So as an example, if we took this playbook, still
we're reading this
run report now to incident, we'll click on OK. And then if we're working with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
run report now to incident, we'll click on OK. And then if we're working with
our incidents,
for example, under incidents and events, good incidents, let's just grab how
about this right
here, right click and say, we want to go into analysis mode. And then from here
, we get execute
playbook and simply run that playbook. So if we click on close for a moment, if
we scroll down on
the right hand side here, currently, it's not showing any playbooks executed in
association with
this incident, but we could go and click right here on execute playbook. And I
'm going to go to the
modified time column and sort by that. And let me look for the one we just made
. I think it's this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
. I think it's this
one run report and add to incidents, we can select that, run it and then click
on OK. And
effectively, what's going to do are the instructions in that playbook. So here
it's showing us the
details of what's happening. There's the name of the playbook, the trigger was
a manual trigger. So
we launched it manually. And it failed as shown right here. And I think the
reason it failed is
because I didn't specify the actual report to run. So let me go ahead and edit
that playbook by
going back to automation. And right here, we'll go back to run report and add
to instant. And
let me edit this and specify which report to run. It'll be helpful. So I'll go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let me edit this and specify which report to run. It'll be helpful. So I'll go
ahead and listen to
our IPS report. Now the reason some reports are showing here and others aren't
is that it has to
have caching enabled on that report to be included as part of a playbook. So I
'm just going to
choose one of these that's already cached and click on OK and click on OK again
. And let's try
that again. So go back to our incidents. Just go and grab a random one. How is
this right there? We'll
analyze it and scroll down. So currently no executed playbooks. We'll click
here on execute playbook.
We'll go and launch run report and add to instant. Click on OK. And it'll give WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll go and launch run report and add to instant. Click on OK. And it'll give
us the status playbook
as it runs. And here's those details right here. And it failed. So here's
showing in the details
error and parsing schedule parameters. Time period. I'll get it included. Let
me go back to
cancel and close. We'll go back to automation and we'll edit run report and add
to instant. And
let's edit the details here. So time period. Yep. I should go ahead and specify
time period. I'll
say this week and click on OK and OK. And let's try that one more time. We'll
go back to an incident. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go back to an incident.
Just grab one, double click on it to go into analysis mode. We'll scroll down
to make sure we
don't have any playbooks that already get run. Also, it would show us here if
we had several
playbooks that were launched against an associate with this incident. It would
show up here. So we'll
do an execute playbook. And here it is right here. Run report and add to
instant. So we'll go ahead
and click on run and OK. All right. So it's kicked off and it should be
generating the incident
report. And then it should be associating that with the incident. All right. So
the report was
generated. That's great news. And it attached it. Fantastic. So we should see WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
generated. That's great news. And it attached it. Fantastic. So we should see
this test here in
just a moment, say success, which it does. So if we close that and close that
and here in our
playbooks, if we just click on refresh, it's going to show us that that
playbook was run. And also
that report is now associated with that incident. Anybody want to take a look
at the reports individually,
we get on reports, generate reports, and there's our report right there. So the
key takeaway from
this video is regarding automation on the 40 analyzer. It depends a lot on what
active connectors we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
active connectors we
have in place that are usable. So if we don't have connectors, for example, 40
mail or 40 web
or other components, we won't be able to interact or have the 40 analyzer
interact with those devices.
[BLANK_AUDIO]