DarktraceEmail

Details

ID	`DarktraceEmail`
Provider	Thoma Bravo
Category	Network Security
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This pack includes configurations to combine the world-class threat detection of Darktrace with the synchrony and automation abilities of XSOAR, allowing security teams to investigate critical incidents along with accompanying summaries and timelines.
This integration was integrated and tested with version 6.2 of DarktraceEmail.

Configure DarktraceEmail in Cortex

Parameter	Description	Required
Server URL (e.g. https://example.net)		True
Fetch incidents		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Incident type		False
Public API Token	Public token obtained by creating an API token pair on the /config configuration page.	True
Private API Token	Private token obtained by creating an API token pair on the /config configuration page.	True
Minimum Score	Minimum Darktrace score for fetched incidents (0-100).	True
Maximum Emails per Fetch	Maximum number of Darktrace Emails to fetch at a time.	False
First fetch time	Time to start fetching the first incidents. Default is to begin fetching 1 day ago. Max number of model breaches that will be populated upon first fetch is 20.	False
Incidents Fetch Interval		False
Darktrace Tag Severity	Fetches Emails with any tags of the desired severity level, filtering is inclusive. By default fetches all severity levels.	False
Only Actioned Emails	Only fetch Emails that have been actioned. Disabled by default.	False
Direction	Fetch emails based on direction; either inbound, outbound or internal. By default fetches all directions.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

darktrace-email-get-email

Fetch details about a specific Email.

Base Command

darktrace-email-get-email

Input

Argument Name	Description	Required
uuid	Darktrace UUID of the Email.	Required

Context Output

Path	Type	Description
Darktrace.Email.uuid	string	UUID of email.
Darktrace.Email.direction	string	Direction of email.
Darktrace.Email.dtime	string	Timestamp of email.
Darktrace.Email.header_from_email	string	Email address of sender.
Darktrace.Email.header_subject	string	Subject of email.
Darktrace.Email.model_score	number	Anomaly score of email.
Darktrace.Email.receipt_status	string	Receipt status of email.

darktrace-email-hold-email

Apply “hold” action to a specified Email.

Base Command

darktrace-email-hold-email

Input

Argument Name	Description	Required
uuid	Unique ID of Email.	Required

Context Output

Path	Type	Description
Darktrace.Action.resp	string	Status of the hold action.

darktrace-email-release-email

Apply “release” action to a specified Email.

Base Command

darktrace-email-release-email

Input

Argument Name	Description	Required
uuid	Unique ID of Email.	Required
recipient	Recipient of Email. Not required but speeds up the command.	Optional

Context Output

Path	Type	Description
Darktrace.Action.resp	string	Status of the release action.

Configuration parameters

url — Server URL (e.g. https://example.net) (required)
isFetch — Fetch incidents
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
publicApiKey — Public API Token (required)
privateApiKey — Private API Token (required)
min_score — Minimum Score (required)
max_fetch — Maximum Emails per Fetch
first_fetch — First fetch time
incidentFetchInterval — Incidents Fetch Interval
tag_severity — Darktrace Tag Severity
actioned — Only Actioned Emails
direction — Direction

Commands (3)

darktrace-email-get-email
Fetch details about a specific Email.
darktrace-email-hold-email
Apply "hold" action to a specified Email.
darktrace-email-release-email
Apply "release" action to a specified Email.

Source

DarktraceEmail.py DarktraceEmail_test.py DarktraceEmail.yml DarktraceEmail_description.md

Download History Raw

## Darktrace
To configure the connection to your Darktrace instance, you will provide:
- Server URL of Darktrace and any necessary proxy information.
- Public and Private API Tokens from Darktrace. Follow the Per-User Token [instructions here](https://customerportal.darktrace.com/product-guides/main/api-tokens). Note that you will need the following permissions for your API tokens: Email logs and Manual Action. 

Best Practices: 
- Ingest both actioned and un-actioned emails. Ingesting the un-actioned emails will give you the ability to manually hold them.
- If you want to reduce the volume of emails ingested then we recommend starting with only inbound emails. Consider adding internal and outbound later on.
- Ingest emails with all Darktrace Tag Severity levels.