Demisto Install

Updated 2 months ago by Elvis Hovor

This document explains how to install and configure the TruSTAR integration with Demisto.

The TruSTAR App for Demisto automatically sends triggered playbook tasks to TruSTAR for enrichment, and then sends back deeplink information to Demisto. You can search IOCs directly from Demisto to get relevant data throughout every step of your workflow.

Time to Install: 15-30 minutes for installation from the Demisto marketplace.

Features

  • Submit open cases in Demisto to your TruSTAR enclave. The deeplink to the TruSTAR report is automatically added to the Demisto case.
  • Enrich intelligence in open Demisto cases by querying TruSTAR enclaves.
  • Create playbooks to automate intelligence gathering, using TruSTAR API calls. You can also use those API calls in Demisto's War Room.

Requirements

The following requirements and components need to be installed and activated for TruSTAR integration to work with Demisto

  • Demisto Server v3.6 to 4.0 (more info here)
  • Demisto Agent (D2) (more info here)
  • Demisto Engine (more info here)
While the TruSTAR integration requires no special port allocations or firewall exceptions, you do need to follow firewall and port guidelines for installing Demisto. Check here for details. For certain functions, the TruSTAR App will need access to station.trustar.co over port 443.

Installing and Configuring the TruSTAR App

The TruSTAR integration is available on Demisto's integration page for download.

  1. Login to your Demisto installation.
  2. Select Settings -> Integrations -> and type TruSTAR in the search integration text box.
  3. Select Add Instance to install the TruSTAR App. You now see a Configuration dialog box.
  4. Enter the parameters explained in the table below.

Configuration Parameter

Required

Description

Name

Yes

Name you assign to the instance. It must be unique for each instance you set up.

Server URL

Yes

TruSTAR Station URL. Enter https://station.trustar.co 

TruSTAR API Key

Yes

Authentication Key to connect to TruSTAR station. This is used for making API calls. Available under Settings-> API in your TruSTAR Station account. How to find your API Key

TruSTAR API Secret

Yes

Secret Key to connect to TruSTAR station. This is used for making API calls. Available under Settings-> API on TruSTAR Station. How to find your API Secret

  1. When you have finished entering the configuration parameters, click Test to check connectivity with TruSTAR.

How Did We Do?