DarktraceAIA

Details

ID	`DarktraceAIA`
Provider	Thoma Bravo
Category	Network Security
From Version	6.6.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Darktrace is a Cyber AI platform for threat detection and response across cloud, email, industrial, and the network.
This integration was integrated and tested with version 6.0.0 of Darktrace

Configure Darktrace in Cortex

Parameter	Description	Required
url	Server URL (e.g. https://example.net)	True
isFetch	Fetch incidents	False
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False
public_api_token	Public API Token	True
private_api_token	Private API Token	True
min_score	Minimum Score	True
max_alerts	Maximum Model Breaches per Fetch	False
first_fetch	First fetch time	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

darktrace-get-ai-analyst-incident-event

Returns all AI Analyst incident events

Base Command

darktrace-get-ai-analyst-incident-event

Input

Argument Name	Description	Required
eventId	Unique identified of an AI Analyst incident event	Required

Context Output

Path	Type	Description
Darktrace.AIAnalyst.eventId	Unknown	AIAnalyst unique identifier
Darktrace.AIAnalyst.title	String	AIAnalyst event title
Darktrace.AIAnalyst.mitreTactics	Unknown	AIAnalyst mitre tactics seen on event
Darktrace.AIAnalyst.score	Unknown	group score for ai analyst incident
Darktrace.AIAnalyst.category	String	group category for ai analyst incident
Darktrace.AIAnalyst.summary	String	AIAnalyst event summary
Darktrace.AIAnalyst.groupId	Unknown	unique identifier for event Id
Darktrace.AIAnalyst.devices	Unknown	Associated devices with incident event
Darktrace.AIAnalyst.modelBreaches	Unknown	Associated model breaches with event Id

darktrace-get-comments-for-ai-analyst-incident-event

Returns all Darktrace Comments for a given Incident Event

Base Command

darktrace-get-comments-for-ai-analyst-incident-event

Input

Argument Name	Description	Required
eventId	Unique identified of an AI Analyst incident event	Required

Context Output

Path	Type	Description
Darktrace.AIAnalyst.incidet_id	Number	Incident event unique identifier
Darktrace.AIAnalyst.message	String	Posted message
Darktrace.AIAnalyst.eventId	String	Unique event identifier
Darktrace.AIAnalyst.time	String	Message post timestamp
Darktrace.AIAnalyst.username	String	Darktrace username of posting user

darktrace-post-comment-to-ai-analyst-incident-event

Post comment to an AI Analyst Incident Event.

Base Command

darktrace-post-comment-to-ai-analyst-incident-event

Input

Argument Name	Description	Required
eventId	Unique identified of an AI Analyst incident event	Required
comment	Enter a message to comment	Required

Context Output

Path	Type	Description
Darktrace.AIAnalyst.commented	String	Whether the incident is commented in Darktrace
Darktrace.AIAnalyst.response	String	Post command response
Darktrace.AIAnalyst.eventId	String	Unique event identifier
Darktrace.AIAnalyst.message	String	Message to be commented

darktrace-acknowledge-ai-analyst-incident-event

Acknowledges an AI Analyst Incident Event

Base Command

darktrace-acknowledge-ai-analyst-incident-event

Input

Argument Name	Description	Required
eventId	Unique identified of an AI Analyst incident event	Required

Context Output

Path	Type	Description
Darktrace.AIAnalyst.acknowledged	String	Whether the incident is acknowledge in Darktrace
Darktrace.AIAnalyst.response	String	Post response comment
Darktrace.AIAnalyst.eventId	String	incident event unique identifier

darktrace-unacknowledge-ai-analyst-incident-event

Unacknowledges an AI Analyst Incident Event

Base Command

darktrace-unacknowledge-ai-analyst-incident-event

Input

Argument Name	Description	Required
eventId	Unique identified of an AI Analyst incident event	Required

Context Output

Path	Type	Description
Darktrace.AIAnalyst.unacknowledged	String	Whether the incident is acknowledge in Darktrace
Darktrace.AIAnalyst.response	String	Post response comment
Darktrace.AIAnalyst.eventId	String	incident event unique identifier

darktrace-get-ai-analyst-incident-group-from-eventId

Pulls all linked events for a given event. Over time, events can become merged with one another. This happens when two sets of disparate activity are suddenly linked by shared factors.

Base Command

darktrace-get-ai-analyst-incident-group-from-eventId

Input

Argument Name	Description	Required
eventId	Unique identified of an AI Analyst incident event	Required

Context Output

Path	Type	Description
Darktrace.AIAnalyst.groupId	String	Investigation Group Unique Identifier
Darktrace.AIAnalyst.incidentEvents	Unknown	Associated events
Darktrace.AIAnalyst.mitreTactics	Unknown	Associated Mitre Tactics seen on incident
Darktrace.AIAnalyst.groupScore	Number	Group score
Darktrace.AIAnalyst.groupCategory	String	Group category

Configuration parameters

url — Server URL (e.g. https://example.net) (required)
isFetch — Fetch incidents
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
publicApiKey — Public API Token (required)
privateApiKey — Private API Token (required)
min_score — Minimum Score (required)
max_fetch — Maximum Model Breaches per Fetch
first_fetch — First fetch time

Commands (6)

darktrace-acknowledge-ai-analyst-incident-event
Acknowledge an AI Analyst Incident Event.
darktrace-get-ai-analyst-incident-event
Fetch the details of an AI Analyst event.
darktrace-get-ai-analyst-incident-group-from-eventId
Pulls all linked events for a given event. Over time, events can become merged with one another. This happens when two sets of disparate activity are suddenly linked by shared factors.
darktrace-get-comments-for-ai-analyst-incident-event
Fetch all comments from an AI Analyst incident Event.
darktrace-post-comment-to-ai-analyst-incident-event
Post a comment to an AI Analyst incident Event.
darktrace-unacknowledge-ai-analyst-incident-event
Unacknowledge an AI Analyst Incident Event.

Source

DarktraceAIA.py DarktraceAIA_test.py DarktraceAIA.yml DarktraceAIA_description.md command_examples.txt

Download History Raw

category: Network Security
provider: Thoma Bravo
fromversion: 6.6.0
sectionorder:
- Connect
- Collect
commonfields:
  id: DarktraceAIA
  version: -1
configuration:
- defaultvalue: https://example.net
  display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- additionalinfo: Public token obtained by creating an API token pair on the /config configuration page
  display: Public API Token
  name: publicApiKey
  required: true
  type: 4
  section: Connect
- additionalinfo: Private token obtained by creating an API token pair on the /config configuration page
  display: Private API Token
  name: privateApiKey
  required: true
  type: 4
  section: Connect
- additionalinfo: Minimum Darktrace score for fetched incidents (0-100)
  defaultvalue: '0'
  display: Minimum Score
  name: min_score
  required: true
  type: 0
  section: Collect
- additionalinfo: Maximum number of Darktrace AI Analyst Incidents to fetch at a time
  defaultvalue: '50'
  display: Maximum Model Breaches per Fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: Time to start fetching the first incidents. Default is to begin fetching 1 day ago. Max number of model breaches that will be populated upon first fetch is 20.
  defaultvalue: 1 day ago
  display: First fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
description: Rapid detection of malicious behaviour can make all the difference in the response to a security event. This pack includes configurations to combine the world-class threat detection of Darktrace with the synchrony and automation abilities of XSOAR, allowing security teams to investigate critical incidents along with accompanying summaries and timelines. AI actions can also be applied.
display: Darktrace AI Analyst
name: DarktraceAIA
script:
  commands:
  - name: darktrace-get-ai-analyst-incident-event
    description: Fetch the details of an AI Analyst event.
    arguments:
    - description: Unique identified of an AI Analyst incident event.
      name: eventId
      required: true
    outputs:
    - contextPath: Darktrace.AIAnalyst.eventId
      description: AIAnalyst unique identifier.
      type: Unknown
    - contextPath: Darktrace.AIAnalyst.title
      description: AIAnalyst event title.
      type: String
    - contextPath: Darktrace.AIAnalyst.mitreTactics
      description: AIAnalyst mitre tactics seen on event.
      type: Unknown
    - contextPath: Darktrace.AIAnalyst.score
      description: group score for ai analyst incident.
      type: Unknown
    - contextPath: Darktrace.AIAnalyst.category
      description: group category for ai analyst incident.
      type: String
    - contextPath: Darktrace.AIAnalyst.summary
      description: AIAnalyst event summary.
      type: String
    - contextPath: Darktrace.AIAnalyst.groupId
      description: unique identifier for event Id.
      type: Unknown
    - contextPath: Darktrace.AIAnalyst.devices
      description: Associated devices with incident event.
      type: Unknown
    - contextPath: Darktrace.AIAnalyst.modelBreaches
      description: Associated model breaches with event Id.
      type: Unknown
  - name: darktrace-get-comments-for-ai-analyst-incident-event
    description: Fetch all comments from an AI Analyst incident Event.
    arguments:
    - description: Unique identified of an AI Analyst incident event.
      name: eventId
      required: true
    outputs:
    - contextPath: Darktrace.AIAnalyst.incidet_id
      description: Incident event unique identifier.
      type: String
    - contextPath: Darktrace.AIAnalyst.message
      description: Posted message.
      type: String
    - contextPath: Darktrace.AIAnalyst.eventId
      description: Unique event identifier.
      type: String
    - contextPath: Darktrace.AIAnalyst.time
      description: Message post timestamp.
      type: String
    - contextPath: Darktrace.AIAnalyst.username
      description: Darktrace username of posting user.
      type: String
  - name: darktrace-post-comment-to-ai-analyst-incident-event
    description: Post a comment to an AI Analyst incident Event.
    arguments:
    - description: Unique identified of an AI Analyst incident event.
      name: eventId
      required: true
    - description: Enter a message to comment.
      name: comment
      required: true
    outputs:
    - contextPath: Darktrace.AIAnalyst.commented
      description: Whether the incident is commented in Darktrace.
      type: String
    - contextPath: Darktrace.AIAnalyst.response
      description: Post command response.
      type: String
    - contextPath: Darktrace.AIAnalyst.eventId
      description: Unique event identifier.
      type: String
    - contextPath: Darktrace.AIAnalyst.message
      description: Message to be commented.
      type: String
  - name: darktrace-acknowledge-ai-analyst-incident-event
    description: Acknowledge an AI Analyst Incident Event.
    arguments:
    - description: Unique identified of an AI Analyst incident event.
      name: eventId
      required: true
    outputs:
    - contextPath: Darktrace.AIAnalyst.acknowledged
      description: Whether the incident is acknowledge in Darktrace.
      type: String
    - contextPath: Darktrace.AIAnalyst.response
      description: Post response comment.
      type: String
    - contextPath: Darktrace.AIAnalyst.eventId
      description: incident event unique identifier.
      type: String
  - name: darktrace-unacknowledge-ai-analyst-incident-event
    description: Unacknowledge an AI Analyst Incident Event.
    arguments:
    - description: Unique identified of an AI Analyst incident event.
      name: eventId
      required: true
    outputs:
    - contextPath: Darktrace.AIAnalyst.unacknowledged
      description: Whether the incident is unacknowledge in Darktrace.
      type: String
    - contextPath: Darktrace.AIAnalyst.response
      description: Post response comment.
      type: String
    - contextPath: Darktrace.AIAnalyst.eventId
      description: incident event unique identifier.
      type: String
  - name: darktrace-get-ai-analyst-incident-group-from-eventId
    description: Pulls all linked events for a given event. Over time, events can become merged with one another. This happens when two sets of disparate activity are suddenly linked by shared factors.
    arguments:
    - description: Unique identified of an AI Analyst incident event.
      name: eventId
      required: true
    outputs:
    - contextPath: Darktrace.AIAnalyst.groupId
      description: Investigation Group Unique Identifier.
      type: String
    - contextPath: Darktrace.AIAnalyst.incidentEvents
      description: Associated events.
      type: Unknown
    - contextPath: Darktrace.AIAnalyst.mitreTactics
      description: Associated Mitre Tactics seen on incident.
      type: Unknown
    - contextPath: Darktrace.AIAnalyst.groupScore
      description: Group score.
      type: Number
    - contextPath: Darktrace.AIAnalyst.groupCategory
      description: Group category.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)