IronDefense

The IronDefense Integration for Cortex XSOAR allows users to interact with IronDefense alerts within Cortex XSOAR. The Integration provides the ability to rate alerts, update alert statuses, add comments to alerts, to report observed bad activity, get alerts, get events, and get IronDome information.

Network Security · IronNet

Configuration parameters

  • ironAPIHost — IronAPI Host/IP (required)
  • ironAPIPort — IronAPI Port (required)
  • credentials — Username (required)
  • requestTimeout — Request Timeout (Sec)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • enableAlertNotifications — Enable Alert Notification Ingestion (Refresh Not Supported)
  • alertLimit — Alert Notification Limit Per Request. (Max 500)
  • alertCategories — Alert Notification Categories to Exclude
  • alertSubCategories — Alert Notification SubCategories to Exclude, See https://ironnet.atlassian.net/wiki/x/hADvGg for values (Enter in comma separated list format)
  • alertSeverityLower — Lower Bound of Severity for Alert Notification (0-1000)
  • alertSeverityUpper — Upper Bound of Severity for Alert Notification (0-1000)
  • alertActions — Alert Notification Actions to Include (Alert Created enabled by default)
  • enableEventNotifications — Enable Event Notification Ingestion (Refresh Not Supported)
  • eventLimit — Event Notification Limit Per Request. (Max 500)
  • eventCategories — Event Notification Categories to Exclude
  • eventSubCategories — Event Notification SubCategories to Exclude, See https://ironnet.atlassian.net/wiki/x/hADvGg for values (Enter in comma separated list format)
  • eventSeverityLower — Lower Bound of Severity for Event Notification (0-1000)
  • eventSeverityUpper — Upper Bound of Severity for Event Notification (0-1000)
  • eventActions — Event Notification Actions to Include (Event Created enabled by default)
  • enableDomeNotifications — Enable Dome Notification Ingestion (Refresh Not Supported)
  • domeLimit — Dome Notification Limit Per Request. (Max 500)
  • domeCategories — Dome Notification Types to Exclude

Commands (8)

  • irondefense-comment-alert

    Adds a comment to an IronDefense alert.

  • irondefense-get-alert-irondome-information

    Retrieves IronDome information for an IronDefense alert.

  • irondefense-get-alerts

    Pulls Alerts from IronDefense.

  • irondefense-get-event

    Retrieves an IronDefense event.

  • irondefense-get-events-from-alert

    Retrieves IronDefense Events for a given Alert ID.

  • irondefense-rate-alert

    Rates an IronDefense alert.

  • irondefense-report-observed-bad-activity

    Submits an observed bad endpoint to IronDefense to create Threat. Intelligence Rules (TIR).

  • irondefense-set-alert-status

    Sets the status of an IronDefense alert.