ArgusManagedDefence

Rapidly detect, analyse and respond to security threats with mnemonic’s leading Managed Detection and Response (MDR) service.

Data Enrichment & Threat Intelligence · mnemonic MDR

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • api_url — API URL (required)
  • api_key — API Key (required)
  • min_severity — Minimum severity of alerts to fetch (required)
  • first_fetch — First fetch time
  • max_fetch — Maximum number of incidents per fetch
  • exclude_tag — Fetch incidents exclude tag
  • mirror_direction — Incident Mirroring Direction
  • mirror_tag — Mirroring tag
  • close_argus_case — Close Argus Case
  • close_incident — Close XSOAR Incident
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (35)

  • argus-add-attachment

    Add attachment to case (Max 50 MB, should be an archive).

  • argus-add-case-tag

    Adds a key, value tag to an Argus case.

  • argus-add-comment

    Add comment to an Argus case.

  • argus-advanced-case-search

    Returns cases matching the defined case search criteria.

  • argus-close-case

    Close an Argus case.

  • argus-create-case

    Create Argus case.

  • argus-delete-case

    Mark existing case as deleted.

  • argus-delete-comment

    Mark existing comment as deleted.

  • argus-download-attachment

    Download specific attachment contents.

  • argus-download-attachment-by-filename

    Downloads case attachment by best-effort search of filename.

  • argus-download-case-attachments

    Download all attachments related to Argus Case.

  • argus-edit-comment

    Edit existing comment.

  • argus-fetch-observations-for-domain

    Look up reputation observations for the given domain.

  • argus-fetch-observations-for-ip

    Look up reputation observations for the given IP.

  • argus-find-aggregated-events

    Search for aggregated events (OSB! advanced method: look in API doc).

  • argus-find-nids-events

    Search for NIDS events.

  • argus-get-attachment

    Fetch specific attachment metadata.

  • argus-get-case-metadata-by-id

    Returns the basic case descriptor for the case identified by ID.

  • argus-get-event

    Fetch specified event.

  • argus-get-events-for-case

    Fetch events associated with specified case.

  • argus-get-payload

    Fetch specified event payload.

  • argus-get-pcap

    Fetch specified event payload as PCAP.

  • argus-list-aggregated-events

    List aggregated events.

  • argus-list-case-attachments

    List attachments for an existing case.

  • argus-list-case-comments

    List the comments of an Argus case.

  • argus-list-case-tags

    List tags attached to an Argus case.

  • argus-list-nids-events

    Simple search for NIDS events.

  • argus-pdns-search-records

    Search against PassiveDNS with criteria and return matching records.

  • argus-print-case-comments

    Print case comments as notes.

  • argus-print-case-metadata-by-id

    Print case metadata as HTML. Does not add to context.

  • argus-remove-case-tag-by-id

    Remove existing tag by tag ID.

  • argus-remove-case-tag-by-key-value

    Remove existing tag with key, value matching.

  • argus-update-case

    Request changes to basic fields of an existing case.

  • get-remote-data

    Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

  • update-remote-system

    Updates the remote system with incident changes.