Attack Surface Management: Step 4 - Outbound Integrations

[nathanael_s]

Table of Contents

Below you'll find a table of contents for the Outbound Integrations journey.

• Table of Contents
• Prerequisites
• Actions
• Ticketing
• SIEM
• SOAR
• Journey Complete

Once and Entity or Issue has been discovered, customers often find it useful to export that information to a Ticketing System, SIEM, SOAR, or a combination of these options.

Prerequisites

• Project Owner level access.
• Admin access to Integration Solution account.

Actions

Ticketing

In this section we will walk you through setting up ServiceNow as an Outbound Integration. The ServiceNow integration is a bi-directional one, that supports updates from ServiceNow into Attack Surface Management, on top of pushing Entities and Issues to ServiceNow.

Show More

Prerequisites

See the Relevant Links section for more documentation regarding the prerequisites.

• Existing Project(s)
• Existing Collection(s)
• Project Admin rights for Project(s)
• Admin access in ServiceNow

Steps

1. Create an API Key in Mandiant ASM by navigating to the linked page for this step. | Docs

2. Get and Install the Mandiant ASM Integration from the ServiceNow Store.

3. In the ServiceNow console, navigate to Security Operations > Integrations > Integration Configurations, then click Configure next to Mandiant ASM.

4. Enter your Mandiant ASM Access Key and Secret Access Key from step 1. Click Submit.

5. Navigate to Mandiant ASM > Projects and Collections and select the Collections to be imported.

6. Navigate to the CMDB CI Class Models application, search for

   sys_choice.list

   , then add three new choices as mentioned in step 6 in the linked documentation.

7. Navigate to Mandiant ASM > Vulnerable Item Import and define the schedule you would like to use. Click Update.

Relevant Links

• All Steps: https://docs.mandiant.com/home/asm-servicenow-integration
• 1: https://asm.advantage.mandiant.com/account/settings/api-keys
• 2-7: https://docs.mandiant.com/home/asm-servicenow-integration#integration-configuration

SIEM

In this section we will walk you through setting up Chronicle SIEM as an Outbound Integration for Attack Surface Management.

Show More

Prerequisites

See the Relevant Links section for more documentation regarding the prerequisites.

• Existing Project(s)
• Existing Collection(s)
• Project Admin rights for Project(s)
• Google Developer Service Account Credential JSON file

Steps

1. Request a Google Developer Service Account Credential JSON file from your Chronicle account manager.

2. From the Attack Surface Management console, click Projects & Settings, choose a Project, click Account Settings.

3. Click the Integrations tab.

4. Under Outbound Integrations, click Add New for Chronicle SIEM.

5. Update your API Ingestion Endpoint if necessary.

6. Enter your Chronicle Customer ID.

7. Upload the Google Developer Service Account Credential JSON file you received from your Chronicle Account Manager.

8. Select the Ingest Period.

9. Select the Minimum Issue Severity.

10. Click Add Integration.

11. Click Collections, then click Collections Settings next to the Collection you'd like to connect the integration to.

12. Select the Integrations tab, select Connect Integration, then link the Google Cloud integration.

13. Close the window, then click Scan Collection to begin scanning utilizing the Google Cloud integration.

Relevant Links

• All Steps: https://docs.mandiant.com/home/asm-chronicle-siem-integration

 SOAR

In this section we will walk you through setting up Chronicle SOAR as an Outbound Integration for Attack Surface Management.

Show More

Prerequisites

See the Relevant Links section for more documentation regarding the prerequisites.

• Existing Project(s)
• Existing Collection(s)
• Project Admin rights for Project(s)
• Admin rights inside of Google Cloud

Steps

1. Create an API Key in Mandiant ASM by navigating to the linked page. | Docs

2. In the Chronicle UI, click on the Marketplace icon in the top right, then click on Integrations.

3. Search through the Integrations and click the down arrow icon to install the integration for Attack Surface Management.

4. Once the integration is installed, navigate to Response > Integrations Setup.

5. Provide the API Access Key and Secret Access Key, following the directions in the linked page. | Docs

Relevant Links

• All Steps: https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/mandiant-asm
• 1: https://asm.advantage.mandiant.com/account/settings/api-keys
• 5: https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/mandiant-asm
  
  

Journey Complete

Congratulations! You've completed the Product Journey for Attack Surface Management!