Integrating IBM Resilient
=========================

Overview
--------

This guide outlines how to interwork IBM Resilient SOAR and Genian ZTNA using an IBM App leveraging REST API. 

For more info on the REST API function in Genain ZTNA, refer to: :doc:`/api` 

Resilient Circuit Overview
--------------------------

   **Genian ZTNA + IBM Resilient Interoperation**

   - The events that trigger the app, and enforcement actions taken by Genian
     ZTNA are user configurable, and are not limited to those shown in this
     example.

   - Multiple instances of this integration may be configured to provide a flexible
     response to different threats.

     .. image:: /images/int_IBM_resilient_app_process.png
        :width: 800px

   - The Genian ZTNA APP is installed on IBM Resilient and configured to call
     Genian ZTNA's API in the following sequence.
  
    After an event occurs in IBM Resilient (identify the threat IP), it is delivered to the App.

   **[App starts]** 

     1) Genian ZTNA checks if the threat node IP is known.   

       - If the IP is known: Proceed to the next step    
       - If the IP is not known: App is ended after outputting the message'The node is not subject to management'
   
     2) Check the Genians Node ID associated with the IP address.  

     3) Check if the Resilient enforcement Tag exists int Genian ZTNA Tag list.

       - If the tag exists: Proceed to the next step    
       - If the tag does not exist: Create the tag and proceed to the next step 
   
     4) Assign the tag to the threat node 

   **[App operation end]**

   After the tag has been applied to the threat node, Genian ZTNA will perform the Enforcement Action that is configured as associated with the tag.

For Video Demonstration, see: `Genian ZTNA Video Series <https://www.genians.com/videos/>`_ 

Installing The Genian ZTNA Extension on IBM Resilient
-------------------------------------------------------

The Genian ZTNA app for IBM Resilient along with more detailed documentation can be found on the `IBM App Exchange <https://exchange.xforce.ibmcloud.com/hub/extension/ad48a7105785bfa167c3c49b4d288685>`_ .