DarktraceMBs

Rapid detection of malicious behaviour can make all the difference in the response to a security event. This pack includes configurations to combine the world-class threat detection of Darktrace with the synchrony and automation abilities of XSOAR, allowing security teams to investigate model breaches and all model breach related actions (such as commenting, acknowledging and model logic info).

Network Security · Darktrace

Details

IDDarktraceMBs
ProviderDarktrace
CategoryNetwork Security
From Version6.6.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Darktrace is a Cyber AI platform for threat detection and response across cloud, email, industrial, and the network.
This integration was integrated and tested with version 6.0.0 of Darktrace

Configure Darktrace in Cortex

Parameter Description Required
url Server URL (e.g. https://example.net) True
isFetch Fetch incidents False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
public_api_token Public API Token True
private_api_token Private API Token True
min_score Minimum Score True
max_alerts Maximum Model Breaches per Fetch False
first_fetch First fetch time False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

darktrace-get-model-breach

darktrace-get-model-breach returns a model breach based on its model breach id (pbid)

Base Command

darktrace-get-model-breach

Input

Argument Name Description Required
pbid Model breach ID Required

Context Output

Path Type Description
Darktrace.ModelBreach.pbid Number Model breach ID
Darktrace.ModelBreach.time Date Model breach generated time.
Darktrace.ModelBreach.commentCount Number Number of comments on the model breach
Darktrace.ModelBreach.score Number Score of Darktrace model breach (0 to 1)
Darktrace.ModelBreach.device.did Number Darktrace device ID of Device that breached the model
Darktrace.ModelBreach.device.macaddress String MAC address of the device involved in the model breach (if applicable)
Darktrace.ModelBreach.device.vendor String Vendor of the device involved in the model breach (if applicable)
Darktrace.ModelBreach.device.ip String IP of the device involved in the model breach (if applicable)
Darktrace.ModelBreach.device.hostname String Hostname of the device involved in the model breach (if applicable)
Darktrace.ModelBreach.device.devicelabel String Device label of the device involved in the model breach (if applicable)
Darktrace.ModelBreach.model.name String Darktrace model that was breached
Darktrace.ModelBreach.model.pid Number Model ID of the model that was breached
Darktrace.ModelBreach.model.uuid String Model UUID of the model that was breached
Darktrace.ModelBreach.model.tags Unknown List of model tags for the model that was breached
Darktrace.ModelBreach.model.priority Number Priority of the model that was breached (0 to 5)
Darktrace.ModelBreach.model.description String Darktrace model description

Command Example

!darktrace-get-model-breach pbid=95

Context Example

{
    "Darktrace": {
        "ModelBreach": {
            "commentCount": 0,
            "device": {
                "devicelabel": "Kelly's Laptop",
                "did": 823,
                "hostname": "sf-l-kjohnson",
                "ip": "172.31.32.146",
                "macaddress": "06:42:04:c2:b0:48",
                "vendor": "HP"
            },
            "model": {
                "description": "A device is connecting to watched domains or IP addresses. The watch list can be edited from the main GUI menu, Intel sub-menu, under the icon Watched Domains.\\n\\nAction: Review the domain and IP being connected to.",
                "name": "Compromise::Watched Domain",
                "pid": 762,
                "priority": 5,
                "tags": ["AP: C2 Comms"],
                "uuid": "3338210a-8979-4a1b-8039-63ca8addf166"
            },
            "pbid": 95,
            "score": 1,
            "time": "2020-10-08T21:11:21.000Z"
        }
    }
}

Human Readable Output

Darktrace Model Breach 95

commentCount device model pbid score time
0 did: 823
macaddress: 0a:df:4b:52:64:7a
vendor: HP
ip: 172.31.32.146
hostname: ip-172-31-32-146
devicelabel: Kelly’s Laptop		 name: Compromise::Watched Domain
pid: 762
uuid: 3338210a-8979-4a1b-8039-63ca8addf166
tags: [AP: C2 Comms]
priority: 5
description: A device is connecting to watched domains or IP addresses. The watch list can be edited from the main GUI menu, Intel sub-menu, under the icon Watched Domains.		 95 1 2020-10-08T21:11:21.000Z

darktrace-get-model-breach-comments

Returns the comments on a model breach based on its model breach id (pbid)

Base Command

darktrace-get-model-breach-comments

Input

Argument Name Description Required
pbid Model Breach ID Required

Context Output

Path Type Description
Darktrace.ModelBreach.Comment.message Unknown comments on Model Breach
Darktrace.ModelBreach.pbid Unknown Model breach identifier
Darktrace.ModelBreach.Comment.username Unknown Commented by user
Darktrace.ModelBreach.Comment.time Unknown Comment timestamp

Command Example

!darktrace-get-model-breach-comments pbid=46

Context Example

{
    "Darktrace": {
        "ModelBreach": {
            "comments": [
                {
                    "message": "Flag for follow-up",
                    "pbid": 46,
                    "pid": 210,
                    "time": "2020-10-08T21:11:21.000Z",
                    "username": "user.one"
                },
                {
                    "message": "Activity has been remediated",
                    "pbid": 46,
                    "pid": 210,
                    "time": "2020-10-08T23:11:21.000Z",
                    "username": "user.two"
                }
            ]
        }
    }
}

Human Readable Output

Darktrace Model Breach 46 Comments

message pbid pid time username
Flag for follow-up 46 210 2020-10-08T21:11:21.000Z user.one
Activity has been remediated 46 210 2020-10-08T23:11:21.000Z user.two

darktrace-acknowledge-model-breach

Acknowledge a model breach as specified by Model Breach ID

Base Command

darktrace-acknowledge-model-breach

Input

Argument Name Description Required
pbid Model Breach ID Required

Context Output

Path Type Description
Darktrace.ModelBreach.acknowledged String Whether the model breach is acknowledged in Darktrace
Darktrace.ModelBreach.pbid Number Model breach ID
Darktrace.ModelBreach.acknowledged.response Number Message response from acknowledge action

Command Example

!darktrace-acknowledge-model-breach pbid=111

Context Example

{
    "Darktrace": {
        "ModelBreach": {
            "acknowledged": true,
            "pbid": 111
        }
    }
}

Human Readable Output

Model Breach 111 Acknowledged

response
Successfully acknowledged.

darktrace-unacknowledge-model-breach

Unacknowledges a model breach as specified by Model Breach ID

Base Command

darktrace-unacknowledge-model-breach

Input

Argument Name Description Required
pbid Darktrace model breach ID Required

Context Output

Path Type Description
Darktrace.ModelBreach.acknowledged String Whether the model breach is acknowledged
Darktrace.ModelBreach.pbid Number Model breach ID
Darktrace.ModelBreach.acknowledged.response String Message response from acknowledge action

Command Example

!darktrace-unacknowledge-model-breach pbid=111

Context Example

{
    "Darktrace": {
        "ModelBreach": {
            "acknowledged": false,
            "pbid": 111
        }
    }
}

Human Readable Output

Model Breach 111 Unacknowledged

response
Successfully unacknowledged.

darktrace-get-model-breach-connections

Returns connections encountered by the device during a model breach.

Base Command

darktrace-get-model-breach-connections

Input

Argument Name Description Required
pbid Darktrace model breach ID Required
endtime Endtime of data retrieved Not Required
count The amount of lines returned Not Required
offset The offset of data pulled Not Required

Context Output

Path Type Description
Darktrace.ModelBreach Dictionary Details of the model breach

darktrace-get-model

Returns a model given a UUID

Base Command

darktrace-get-model

Input

Argument Name Description Required
uuid Darktrace model ID Required

Context Output

Path Type Description
Darktrace.Model Dictionary Details of the model

darktrace-get-model-component

Returns the details of a component given a CID

Base Command

darktrace-get-model-component

Input

Argument Name Description Required
cid Darktrace components ID Required

Context Output

Path Type Description
Darktrace.Model.Component Dictionary Details of the component

darktrace-post-comment-to-model-breach

Posts a specified comment to a model breach.

Base Command

darktrace-post-comment-to-model-breach

Input

Argument Name Description Required
pbid Darktrace model breach unique identifier Required
message Comment message Required

Context Output

Path Type Description
Darktrace.ModelBreach.commented String Whether the model breach is commented in Darktrace
Darktrace.ModelBreach.pbid Number Model breach ID
Darktrace.ModelBreach.message String Comment content
Darktrace.ModelBreach.response String Message response from comment action

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • isFetch — Fetch incidents
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • publicApiKey — Public API Token (required)
  • privateApiKey — Private API Token (required)
  • min_score — Minimum Score (required)
  • max_fetch — Maximum Model Breaches per Fetch
  • first_fetch — First fetch time

Commands (8)

  • darktrace-acknowledge-model-breach

    Acknowledge a model breach as specified by Model Breach ID.

  • darktrace-get-model

    Fetch the configuration details behind a specified model.

  • darktrace-get-model-breach

    Fetch details about a specific Model Breach.

  • darktrace-get-model-breach-comments

    Fetch all comments for a given model brach.

  • darktrace-get-model-breach-connections

    Retrieve connections relevant to a specified model breach.

  • darktrace-get-model-component

    Get details of a component.

  • darktrace-post-comment-to-model-breach

    Post a comment to a model breach.

  • darktrace-unacknowledge-model-breach

    Unacknowledge a given model breach.

Source

DarktraceMBs.py DarktraceMBs_test.py DarktraceMBs.yml DarktraceMBs_description.md command_examples.txt
Download History Raw 
category: Network Security
provider: Darktrace
sectionorder:
- Connect
- Collect
commonfields:
  id: DarktraceMBs
  version: -1
configuration:
- defaultvalue: https://example.net
  display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- additionalinfo: Public token obtained by creating an API token pair on the /config configuration page
  display: Public API Token
  name: publicApiKey
  required: true
  type: 4
  section: Connect
- additionalinfo: Private token obtained by creating an API token pair on the /config configuration page
  display: Private API Token
  name: privateApiKey
  required: true
  type: 4
  section: Connect
- additionalinfo: Minimum Darktrace score for fetched incidents (0-100)
  defaultvalue: '0'
  display: Minimum Score
  name: min_score
  required: true
  type: 0
  section: Collect
- additionalinfo: Maximum number of Darktrace model breaches to fetch at a time
  defaultvalue: '50'
  display: Maximum Model Breaches per Fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: Time to start fetching the first incidents. Default is to begin fetching 1 day ago. Max number of model breaches that will be populated upon first fetch is 20.
  defaultvalue: 1 day ago
  display: First fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
description: Rapid detection of malicious behaviour can make all the difference in the response to a security event. This pack includes configurations to combine the world-class threat detection of Darktrace with the synchrony and automation abilities of XSOAR, allowing security teams to investigate model breaches and all model breach related actions (such as commenting, acknowledging and model logic info).
display: Darktrace Model Breaches
name: DarktraceMBs
script:
  commands:
  - name: darktrace-get-model-breach
    arguments:
    - description: Darktrace model breach unique identifier.
      name: pbid
      required: true
    description: Fetch details about a specific Model Breach.
    outputs:
    - contextPath: Darktrace.ModelBreach.pbid
      description: Model breach ID.
      type: Number
    - contextPath: Darktrace.ModelBreach.time
      description: Model breach generated time.
      type: Date
    - contextPath: Darktrace.ModelBreach.commentCount
      description: Number of comments on the model breach.
      type: Number
    - contextPath: Darktrace.ModelBreach.score
      description: Score of Darktrace model breach (0 to 1).
      type: Number
    - contextPath: Darktrace.ModelBreach.device.did
      description: Darktrace device ID of Device that breached the model.
      type: String
    - contextPath: Darktrace.ModelBreach.device.macaddress
      description: MAC address of the device involved in the model breach (if applicable).
      type: String
    - contextPath: Darktrace.ModelBreach.device.vendor
      description: Vendor of the device involved in the model breach (if applicable).
      type: String
    - contextPath: Darktrace.ModelBreach.device.ip
      description: IP of the device involved in the model breach (if applicable).
      type: String
    - contextPath: Darktrace.ModelBreach.device.hostname
      description: Hostname of the device involved in the model breach (if applicable).
      type: String
    - contextPath: Darktrace.ModelBreach.device.devicelabel
      description: Device label of the device involved in the model breach (if applicable).
      type: String
    - contextPath: Darktrace.ModelBreach.model.name
      description: Darktrace model that was breached.
      type: String
    - contextPath: Darktrace.ModelBreach.model.pid
      description: Model ID of the model that was breached.
      type: Number
    - contextPath: Darktrace.ModelBreach.model.uuid
      description: Model UUID of the model that was breached.
      type: String
    - contextPath: Darktrace.ModelBreach.model.tags
      description: List of model tags for the model that was breached.
      type: Unknown
    - contextPath: Darktrace.ModelBreach.model.priority
      description: Priority of the model that was breached (0 to 5).
      type: Number
    - contextPath: Darktrace.ModelBreach.model.description
      description: Darktrace model description.
      type: String
  - name: darktrace-get-model-breach-comments
    arguments:
    - description: Darktrace model breach unique identifier.
      name: pbid
      required: true
    description: Fetch all comments for a given model brach.
    outputs:
    - contextPath: Darktrace.ModelBreach.Comment.message
      description: comments on Model Breach.
      type: Unknown
    - contextPath: Darktrace.ModelBreach.pbid
      description: Model breach identifier.
      type: Unknown
    - contextPath: Darktrace.ModelBreach.Comment.username
      description: Commenting user.
      type: Unknown
    - contextPath: Darktrace.ModelBreach.Comment.time
      description: Comment timestamp.
      type: Unknown
  - name: darktrace-acknowledge-model-breach
    arguments:
    - description: Acknowledge a given model breach.
      name: pbid
      required: true
    description: Acknowledge a model breach as specified by Model Breach ID.
    outputs:
    - contextPath: Darktrace.ModelBreach.acknowledged
      description: Whether the model breach is acknowledged in Darktrace.
      type: String
    - contextPath: Darktrace.ModelBreach.pbid
      description: Model breach ID.
      type: Number
    - contextPath: Darktrace.ModelBreach.acknowledged.response
      description: Message response from acknowledge action.
      type: String
  - name: darktrace-post-comment-to-model-breach
    arguments:
    - description: Darktrace model breach unique identifier.
      name: pbid
      required: true
    - description: Comment message.
      name: message
      required: true
    description: Post a comment to a model breach.
    outputs:
    - contextPath: Darktrace.ModelBreach.commented
      description: Whether the model breach is commented in Darktrace.
      type: String
    - contextPath: Darktrace.ModelBreach.pbid
      description: Model breach ID.
      type: Number
    - contextPath: Darktrace.ModelBreach.message
      description: Comment content.
      type: String
    - contextPath: Darktrace.ModelBreach.response
      description: Message response from comment action.
      type: String
  - name: darktrace-unacknowledge-model-breach
    arguments:
    - description: Darktrace model breach unique identifier.
      name: pbid
      required: true
    description: Unacknowledge a given model breach.
    outputs:
    - contextPath: Darktrace.ModelBreach.acknowledged
      description: Whether the model breach is acknowledged in Darktrace.
      type: String
    - contextPath: Darktrace.ModelBreach.pbid
      description: Model breach ID.
      type: Number
    - contextPath: Darktrace.ModelBreach.acknowledged.response
      description: Message response from acknowledge action.
      type: Number
  - name: darktrace-get-model-breach-connections
    arguments:
    - name: pbid
      required: true
      description: Darktrace model breach unique identifier.
    - name: endtime
      description: End time of data to return in millisecond format, relative to midnight January 1st 1970 UTC.
    - name: count
      defaultValue: "100"
      description: Specifies the maximum number of items to return. Default 100.
    - name: offset
      defaultValue: "0"
      description: Offset of starting point for fetching details of the modelbreach.
    description: Retrieve connections relevant to a specified model breach.
    outputs:
    - contextPath: Darktrace.ModelBreach
      description: List of events from the modelbreach and their details. Each event might have different keys. It is recommended to run the command once to check the relevant outputs in context.
      type: Unknown
  - name: darktrace-get-model
    arguments:
    - name: uuid
      required: true
      description: Unique model identifier.
    description: Fetch the configuration details behind a specified model.
    outputs:
    - contextPath: Darktrace.Model
      description: A dictionary of the details of the model. Each model might have different keys. It is recommended to run the command once to check the relevant outputs in context.
      type: Unknown
  - name: darktrace-get-model-component
    arguments:
    - name: cid
      required: true
      description: Unique component identifier.
    description: Get details of a component.
    outputs:
    - contextPath: Darktrace.Model.Component
      description: A dictionary of the details of the model. Each model might have different keys. It is recommended to run the command once to check the relevant outputs in context.
      type: Unknown
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.6.0
tests:
- No tests (auto formatted)