https://github.com/wallix/cisco_cybervision_integration
CISCO Cybervision connector for WALLIX Bastion
https://github.com/wallix/cisco_cybervision_integration
Last synced: 8 days ago
JSON representation
CISCO Cybervision connector for WALLIX Bastion
- Host: GitHub
- URL: https://github.com/wallix/cisco_cybervision_integration
- Owner: wallix
- Created: 2023-10-20T15:14:46.000Z (over 2 years ago)
- Default Branch: master
- Last Pushed: 2023-10-20T15:43:21.000Z (over 2 years ago)
- Last Synced: 2025-11-12T10:04:32.681Z (8 months ago)
- Language: Python
- Size: 789 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# CISCO Cybervision integration for WALLIX Bastion
Enhance your IT & OT infrastructure management with the CISCO Cybervision connector for WALLIX Bastion.
This connector enables:
- automatic onboarding of devices discovered by Cybervision on a Bastion appliance
- one-time and periodic synchronization of devices metadata between Cybervision and Bastion
## Installation
Upload the archive to your Cybervision appliance, then unzip it using `tar -xf `.
You will find three shell scripts inside, which must be run as root:
- `install.sh`: perform a guided installation of the connector as a cron task
- `run.sh`: force a manual execution of the connector (after a successfull installation)
The install will ask for the frequency to set on the cron task, an existing user to execute the program and a path to store the files.
As Cybervision system files are read-only, you cannot create a new user. You can choose to run it as root or cv-admin. cv-admin is recommended.
Likewise, the files can only be stored under the `/data` directory, e.G in /data/home/cv-bastion or /data/tmp/cv-bastion.
You may also choose to install the integration on a separate machine. In this case it is recommended to create a dedicated user without login ability, i.e configuring /bin/false as login shell.
Mind that to run crob jobs, the user needs a home directory.
To update the connector, simply run the `install.sh` script from the new version with the same inputs to override the previous installation.
The logs of the connector when run using cron will be found within syslog. (on Cyber Vision they are located at /data/log/syslog)
You can update the `config.yaml` file at anytime. Make sure the file ownership remains to the user that runs the connector.
## What it does
Each run of the connector executes the following operations:
1. Find all devices on the Bastion
2. For each device on Cybervision: check if it has a property `bastion.id` or an IP address which matches one in the Bastion devices.
If a match is found, the following custom properties are added or updated on the Cybervision device:
- bastion.id (if unset)
- all Bastion services, in the form `bastion.service.: `, ex: `bastion.service.ssh: 22`
- bastion.lastSync
3. Find all devices in the selected Cybervision preset
4. For each device in the preset: if it does not exist on the Bastion and bastion.auto_onboard is true, add the device on the Bastion
The connector identifies all tagged services which are relevant for the Bastion (SSH, RDP and TELNET) and the associated port.
If none of these services is found and no public IP is mentioned on the device, it is skipped.
The device is created with the following properties:
- name: Cybervision label
- services: the services mentioned above if detected by Cybervision
- IP: the first public IP found for one of these services
- Tags:
- all tags found on Cybervision, written in the form `cybervision..: 1`. Tags from the "Network analysis" category are ignored.
- the following device properties: "serial-number", "model-ref", "vendor-name", "fw-version", written in the form `cybervision.serial_number: xxxx`
The connector also add the tags `cybervision.id` and `cybervision.lastSync`.
Likewise, a user property names `bastion.id`and `bastion.lastSync` is added to the Cybervision device.
5. If the device already exists, its tags are updated (using the Cybervision tags and properties mentioned above)
## Ignore a specific device
A Cybervision device belonging to the selected preset can be skipped from onboarding and tags synchronization by applying the property "bastion.ignore" with value "yes" or "true".
## Uninstall
To uninstall the integration, simply delete the installation directory and run `crontab -r -u "user"` with the username used to run the integration to delete the user crontab. If the user crontab may contain other cron tasks, use `crontab -e -u "user" instead to edit it and remove the corresponding line.