Cosmos Bishop Fox Continuous Penetration Testing

Cosmos Continuous Penetration Testing is a comprehensive reconnaissance platform developed by Bishop Fox. It automates the collection and analysis of data on target networks, domains, and applications. By integrating with various tools, it streamlines information gathering, enhances vulnerability assessments, and supports effective threat intelligence. Its customizable features and reporting capabilities making it a valuable asset for security professionals.

Integration: API

Tables: Detection Finding, Vulnerabilities Finding

Events: Findings

DataBee uses Cosmos v1 APIs to get security and vulnerability findings. Authentication is performed using oauth2 protocols. This integration has been tested against Cosmos v1 of endpoint.

Cosmos Setup

Before starting the configuration of data source on Databee UI, the user will need to create the API Client and get the necessary information for API authentication such as Client ID and Client Secret.

Create API Client

• To access the Cosmos API, you will need an API key, API secret, and the organization's UID (sometimes called orgUid).
• From Cosmos Platform, Navigate to my Profile by clicking on your username on the top right corner > My Profile

• Navigate to API Keys tab and click the Generate New API Keys button to create it.

• Copy the API key, and API Secret
• Copy the token URL and API URL

Note: User will not be able to view API credentials again after completion of this step. Ensure that the user copies it to a secure location before closing.

• Organization’s UID (OrgUid) can be found from the API Keys tab.

Databee Configuration

To configure the Data Source, login into the Databee UI and click on Data and Add New Data Source. Search and click on the Cosmos Continuous Penetration Testing as mentioned below.

Click on the API Ingest option for the collection method. Give the name of the Data Source and other relevant information as mentioned below.

In the next configuration page,

• Enter the Organization ID ({orgUid}) into the API URL endpoint, which was obtained in the previous step
• Select OAuth2 as the authorization method.
• Paste the Client ID and Client Secret into the corresponding fields in the API Client section of Cosmos Continuous Penetration Testing.
• For API URL, enter https://api.bishopfox.com/v1/orgs/{orgUid}/findings. Replace {orgUid} with the organization id in the previous step
• For Token URL, enter https://bishopfox.auth0.com/oauth/token