DarktraceAdmin

This pack includes configurations to combine the world-class threat detection of Darktrace with the synchrony and automation abilities of XSOAR, allowing security teams to manage device actions including device statuses and tags. Your understanding of potential threats can also be levelled-up with Advanced Search logs from DPI.

Network Security · Darktrace

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • publicApiKey — Public API Token (required)
  • privateApiKey — Private API Token (required)

Commands (8)

  • darktrace-get-device-connection-info

    Returns the graphable data for a device (max of 4 weeks of connections retained).

  • darktrace-get-external-endpoint-details

    Returns details collected by Darktrace about external IP addresses or hostnames.

  • darktrace-get-similar-devices

    Returns a list of similar devices with respect to a specified device.

  • darktrace-get-tagged-devices

    Get all devices that hold a common tag.

  • darktrace-get-tags-for-device

    Get all tags for the given device.

  • darktrace-post-tag-to-device

    Post a tag to a device.

  • darktrace-post-to-watched-list

    Post to the list of Darkace Watched Domains to generate alerts when visited.

  • darktrace-run-advanced-search-analysis

    Run an Advanced Search Query and perform an analysis operation on any metric.