Outpost24

Integration version: 5.0

Configure Outpost24 integration in Google Security Operations

For detailed instructions on how to configure an integration inGoogle SecOps, seeConfigureintegrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display NameTypeDefault ValueIs MandatoryDescription
API RootStringhttps://your-appliance.outpost24.comYesAPI root of the Outpost24 instance.
UsernameStringN/AYesUsername of the Outpost24 account.
PasswordPasswordN/AYesPassword of the Outpost24 account.
Verify SSLCheckboxCheckedYesIf enabled, verifies that the SSL certificate for the connection to the Outpost24 server is valid.
Note: You can make changes at a later stage if needed. Once configured, theInstances can be used in Playbooks. For detailed information on configuring andsupporting multiple instances, seeSupporting multiple instances.

Use Cases

  1. Perform enrichment of entities
  2. Ingestion of alerts

Actions

Enrich Entities

Description

Enrich entities using information from Outpost24. Supported entities: IPAddress, Hostname.

Parameters

Parameter Display NameTypeDefault ValueIs MandatoryDescription
Create InsightCheckboxCheckedNoIf enabled, the action creates an insight containing all of the retrieved information about the entity.
Return Finding InformationCheckboxCheckedNoIf enabled, the action also retrieves information about findings that were found on the endpoint.
Finding TypeDDL

All

Possible values:

  • All
  • Vulnerability
  • Information
  • Port
NoSpecify the type of findings to return.
Finding Risk Level FilterCSVInitial, Recommendation, Low, Medium, High, CriticalNo

Specify a comma-separated list of risk level findings that are used during filtering.

Possible values: Initial, Recommendation, Low, Medium, High, Critical.

If nothing is provided, the action fetches findings with all risk levels.

Max Findings To ReturnInteger100No

Specify the number of findings to process per entity.

If nothing is provided, the action returns 100 findings.

Run On

The action is runs on the following entities:

  • IP Address
  • Hostname

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
JSON Result
{"id":24358,"ip":"10.205.0.35","hostname":"lix18.mirmine.net","businessCriticality":"MEDIUM","exposed":false,"created":"2021-09-09T12:58:47.085514Z","firstSeen":"2021-09-09T12:58:47.085514Z","source":["NETSEC"]"Findings":[listoffindings]}
Entity Enrichment
Enrichment Field NameLogic - When to apply
hostnameWhen available in JSON
ipWhen available in JSON
exposedWhen available in JSON
businessCriticalityWhen available in JSON
createdWhen available in JSON
firstSeenWhen available in JSON
sourceWhen available in JSON
count_initial_findingsWhen available in JSON
count_recommendation_findingsWhen available in JSON
count_low_findingsWhen available in JSON
count_medium_findingsWhen available in JSON
count_high_findingsWhen available in JSON
count_critical_findingsWhen available in JSON
Case Wall
Result typeValue / DescriptionType (Entity \ General)
Output message*

The action should not fail nor stop a playbook execution:

If data is available for one entity (is_success=true): "Successfully enriched the following entities using information from Outpost24 Mobile: {entity.identifier}".

If data is not available for one entity (is_success=true): "Action wasn't able to enrich the following entities using information from Outpost24: {entity.identifier}"

If data is not available for any entity (is_success=false): "None of the provided entities were enriched."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Enrich Entities". Reason: {0}''.format(error.Stacktrace): "Error executing action "Enrich Entities". Reason: invalid risk level filter values provided: {csv of invalid values}. Possible values: Initial, Recommendation, Low, Medium, High, Critical.'

General
Case Wall Table

Table Title: {entity.identifier}

Table Columns:

  • Key
  • Value
Entity
Case Wall Table

Table Title: {entity.identifier}

Table Columns:

  • CVE
  • Product Name
  • Service Name
  • Type
  • Solution
  • Reason
  • Description
  • Risk Level
Table

Ping

Description

Test connectivity to the Outpost24 with parameters provided at the integrationconfiguration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run On

This action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
JSON Result
N/A
Case Wall
Result typeValue/DescriptionType (Entity \ General
Output message*

The action should not fail nor stop a playbook execution:

If successful: "Successfully connected to the Outpost24 server with the provided connection parameters!"

The action should fail and stop a playbook execution:

If not successful: "Failed to connect to the Outpost24 server! Error is {0}".format(exception.stacktrace)

General

Connectors

Outpost24 - Outscan Findings Connector

Description

Pull information about outscan findings from Outpost24.

Note: The whitelist filter works with the "productName" parameter.

Configure Outpost24 - Outscan Findings Connector in Google SecOps

For detailed instructions on how to configure a connector inGoogle SecOps, seeConfiguring theconnector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display NameTypeDefault ValueIs MandatoryDescription
Product Field NameStringProduct NameYesEnter the source field name in order to retrieve the Product Field name.
Event Field NameStringtypeYesEnter the source field name in order to retrieve the Event Field name.
Environment Field NameString""No

Describes the name of the field where the environment name is stored.

If the environment field isn't found, the environment is the default environment.

Environment Regex PatternString.*No

A regex pattern to run on the value found in the "Environment Field Name" field.

Default is .* to catch all and return the value unchanged.

Used to allow the user to manipulate the environment field via regex logic.

If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.

Script Timeout (Seconds)Integer300YesTimeout limit for the python process running the current script.
API RootStringhttps://your-appliance.outpost24.comYesAPI root of the Outpost24 instance.
UsernameStringN/AYesUsername of the Outpost24 account.
PasswordPasswordN/AYesPassword of the Outpost24 account.
Type FilterCSVVulnerability, Information, PortYes

Comma-separated list of type filters for the finding.

Possible values: Vulnerability, Information, Port.

Lowest Risk To FetchStringN/ANo

The lowest risk that needs to be used to fetch alerts.

Possible values: Initial, Recommendation, Low, Medium, High, Critical.

If nothing is specified, the connector ingests alerts with all risk levels.

Max Days BackwardsInteger1NoThe number of hours for which findings should be fetched.
Max Findings To FetchInteger100NoThe number of findings to process per one connector iteration.
Use whitelist as a blacklistCheckboxUncheckedYesIf enabled, whitelist is used as a blacklist.
Verify SSLCheckboxCheckedYesIf enabled, verifies that the SSL certificate for the connection to the Outpost24 server is valid.
Proxy Server AddressStringN/ANoThe address of the proxy server to use.
Proxy UsernameStringN/ANoThe proxy username to authenticate with.
Proxy PasswordPasswordN/ANoThe proxy password to authenticate with.

Connector rules

Proxy support

The connector supports proxy.

Need more help?Get answers from Community members and Google SecOps professionals.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.