Devo_v2

Use the Devo v2 integration to query Devo for alerts, lookup tables, with support of pagination, and to write to lookup tables.

Analytics & SIEM · Devo

Configuration parameters

  • reader_endpoint — Query Server Endpoint (e.g. https://apiv2-us.devo.com/search/query) (required)
  • port — Port (e.g. 443)
  • reader_oauth_token — OAuth Token (Preferred method) (required)
  • writer_relay — Writer relay to connect to (e.g. us.elb.relay.logtrust.net)
  • writer_credentials — Writer JSON credentials
  • linq_link_base — Devo base domain
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • table_name — Custom Alert Table name(if not provided, 'siem.logtrust.alert.info' will be used)
  • prefix — Custom Alert Table prefix (provide prefix if custom table name provided)
  • fetch_incidents_filters — Fetch incidents alert filter (Same filters for get-alerts)
  • fetch_incidents_deduplication — Deduplication parameters JSON if required
  • fetch_incidents_limit — Fetch Incident Limit(must be between 10 and 100; advisable 50 for better performance.)
  • incidentFetchInterval — Incidents Fetch Interval
  • timeout — Global query default timeout in seconds
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_incidents_lookback_seconds — Fetch Incidents Lookback Time (in seconds). Must be between 3600 (1 hour; default) to 86400 (24 hours).
  • fetch_incidents_window — Fetch Incident Time Frame (in seconds)

Commands (5)

  • devo-get-alerts

    Queries alerts in the specified timeframe.

  • devo-multi-table-query

    Queries multiple tables for a given token and returns relevant results.

  • devo-run-query

    Queries Devo based on the specified LINQ query.

  • devo-write-to-lookup-table

    Writes lookup table entry records to a specified Devo table.

  • devo-write-to-table

    Writes records to a specified Devo table.