DruvaEventCollector

Druva Ransomware Response Integration provides ransomware protection for endpoints, SaaS applications and data center workloads for Druva Ransomware Recovery customers.

Analytics & SIEM · Druva

Details

ID	`DruvaEventCollector`
Provider	Druva
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This is the Druva event collector integration for Cortex XSIAM.

Configure Druva Event Collector in Cortex

Parameter	Required
Server URL	True
Client ID	True
Secret Key	True
Trust any certificate (not secure)
Use system proxy settings
The maximum number of events per fetch per type
Events to fetch

Additional Information

The maximum number of events per fetch: The default value is 10,000. The API only returns up to 500 events at a time without limiting capabilities, so it is best to enter this parameter in multiples of 500.
Resetting event fetching: Note that resetting the event fetching (clearing the integration context) will cause duplicate events to be fetched, as the integration will restart the fetch process from the beginning.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

druva-get-events

Gets events from Druva API in one batch (max 500). If tracker is given, only its successive events will be fetched.

Base Command

druva-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to true in order to create Cortex XSIAM events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Required
tracker	A string received in a previous run, marking the point in time from which we want to fetch. For InSync events, this is a tracker. For Cybersecurity events, this is a pageToken.	Optional
event_types	The types of events to fetch. Possible values are: InSync events, Cybersecurity events. Default is InSync events.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — Client ID (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
max_fetch — The maximum number of events per fetch per type.
event_types — Events to fetch

Commands (1)

druva-get-events
Gets events from Druva API in one batch (max 500). If tracker is given, only its successive events will be fetched.

Source

DruvaEventCollector.py DruvaEventCollector_test.py DruvaEventCollector.yml DruvaEventCollector_description.md

Download History Raw

**Important:** Contrary to the Druva integration, DruvaEventCollector is supported by Palo Alto Networks.

## Druva Event Collector

The integration is applicable to customers using Realize Ransomware Recovery module with inSync and Phoenix on Druva Public Cloud.

The API Credentials, which is a combination of the Client ID and Secret Key, are equivalent to user name and password. You can access all the Druva APIs and in turn, access the data stored within Druva products. It is strongly recommended not to share the Client ID and Secret Key with unauthorized sources.