Darktrace Event Collector

Details

ID	`Darktrace Event Collector`
Provider	Thoma Bravo
Category	Analytics & SIEM
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Use this integration to fetch a list of model breaches, filtered by the specified parameters. This is important for organizations that wish to integrate Darktrace programmatically into their SOC environment.
The integration was integrated and tested with version v5.2 API of Darktrace.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Darktrace Event Collector in Cortex

Parameter	Description	Required
Server URL (e.g. https://example.cloud.darktrace.com)	REST API Endpoint of Darktrace server.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Public API Token	Public token obtained by creating an API token pair on the /config configuration page.	True
Private API Token	Private token obtained by creating an API token pair on the /config configuration page.	True
Max events per fetch	Maximum number of Darktrace model breaches to fetch at a time.	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	Time to start fetching the first incidents. Limited to 1 Year.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

darktrace-get-events

Gets events from Darktrace Event Collector.

Base Command

darktrace-get-events

Input

Argument Name	Description	Required
limit	The number of events to return. Default is 10.	Optional
start_time	The start time by which to filter events. Date format will be the same as in the first_fetch parameter.	Optional
end_time	The end time by which to filter events.	Optional
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Required

Context Output

There is no context output for this command.

Configuration parameters

base_url — Server URL (e.g., https://example.cloud.darktrace.com) (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
public_creds — (required)
private_creds — (required)
max_fetch — Max events per fetch
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)

Commands (1)

darktrace-get-events
Gets events from Darktrace.

Source

DarktraceEventCollector.py DarktraceEventCollector_test.py DarktraceEventCollector.yml DarktraceEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Thoma Bravo
sectionorder:
- Connect
- Collect
commonfields:
  id: Darktrace Event Collector
  version: -1
configuration:
- name: base_url
  display: Server URL (e.g., https://example.cloud.darktrace.com)
  required: true
  defaultvalue:
  type: 0
  additionalinfo: 'REST API Endpoint of Darktrace server.'
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- additionalinfo: Public token obtained by creating an API token pair on the /config configuration page.
  displaypassword: Public API Token
  hiddenusername: true
  name: public_creds
  required: true
  type: 9
  section: Connect
- additionalinfo: Private token obtained by creating an API token pair on the /config configuration page.
  displaypassword: Private API Token
  hiddenusername: true
  name: private_creds
  required: true
  type: 9
  section: Connect
- additionalinfo: Maximum number of Darktrace model breaches to fetch at a time.
  defaultvalue: '1000'
  display: Max events per fetch
  name: max_fetch
  required: false
  type: 0
  section: Collect
- additionalinfo: Time to start fetching the first incidents.
  defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  required: false
  type: 0
  section: Collect
description: Use this integration to fetch model breaches from Darktrace as events in XSIAM.
display: Darktrace Event Collector
name: Darktrace Event Collector
supportlevelheader: xsoar
script:
  commands:
  - arguments:
    - description: The number of events to return.
      name: limit
      defaultValue: 10
    - description: The start time by which to filter events. Date format will be the same as in the first_fetch parameter.
      name: start_time
    - description: The end time by which to filter events.
      name: end_time
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    description: Gets events from Darktrace.
    name: darktrace-get-events
  runonce: false
  script: "-"
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
fromversion: 6.9.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam