DruvaEventCollector

Druva Ransomware Response Integration provides ransomware protection for endpoints, SaaS applications and data center workloads for Druva Ransomware Recovery customers.

Analytics & SIEM · Druva

Details

ID	`DruvaEventCollector`
Provider	Druva
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This is the Druva event collector integration for Cortex XSIAM.

Configure Druva Event Collector in Cortex

Parameter	Required
Server URL	True
Client ID	True
Secret Key	True
Trust any certificate (not secure)
Use system proxy settings
The maximum number of events per fetch per type
Events to fetch

Additional Information

The maximum number of events per fetch: The default value is 10,000. The API only returns up to 500 events at a time without limiting capabilities, so it is best to enter this parameter in multiples of 500.
Resetting event fetching: Note that resetting the event fetching (clearing the integration context) will cause duplicate events to be fetched, as the integration will restart the fetch process from the beginning.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

druva-get-events

Gets events from Druva API in one batch (max 500). If tracker is given, only its successive events will be fetched.

Base Command

druva-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to true in order to create Cortex XSIAM events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Required
tracker	A string received in a previous run, marking the point in time from which we want to fetch. For InSync events, this is a tracker. For Cybersecurity events, this is a pageToken.	Optional
event_types	The types of events to fetch. Possible values are: InSync events, Cybersecurity events. Default is InSync events.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — Client ID (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
max_fetch — The maximum number of events per fetch per type.
event_types — Events to fetch

Commands (1)

druva-get-events
Gets events from Druva API in one batch (max 500). If tracker is given, only its successive events will be fetched.

Source

DruvaEventCollector.py DruvaEventCollector_test.py DruvaEventCollector.yml DruvaEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: Druva
sectionorder:
- Connect
- Collect
commonfields:
  id: DruvaEventCollector
  version: -1
configuration:
- defaultvalue: https://apis.druva.com
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Client ID
  name: credentials
  required: true
  type: 9
  displaypassword: Secret Key
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  section: Connect
  type: 8
- display: The maximum number of events per fetch per type.
  additionalinfo: The API only returns up to 500 events at a time without limiting capabilities, so it is best to enter this parameter in multiples of 500.
  name: max_fetch
  type: 0
  defaultvalue: "10000"
  section: Collect
- display: Events to fetch
  name: event_types
  type: 16
  additionalinfo: Select the types of events to fetch.
  defaultvalue: "InSync events"
  options:
  - InSync events
  - Cybersecurity events
  section: Collect
  required: false
description: Druva Ransomware Response Integration provides ransomware protection for endpoints, SaaS applications and data center workloads for Druva Ransomware Recovery customers.
display: Druva Event Collector
name: DruvaEventCollector
supportlevelheader: xsoar
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: When true, the integration creates Cortex XSIAM events. Otherwise, they will only be displayed.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: A string received in a previous run, marking the point in time from which we want to fetch. For InSync events, this is a tracker. For Cybersecurity events, this is a pageToken.
      name: tracker
      required: false
    - auto: PREDEFINED
      description: The type of events to fetch.
      name: event_types
      predefined:
      - InSync events
      - Cybersecurity events
      defaultValue: InSync events
      required: false
      isArray: true
    description: Gets events from Druva API in one batch (max 500). If tracker is given, only its successive events will be fetched.
    execution: false
    name: druva-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam