SOCRadarIncidents

Details

ID	`SOCRadarIncidents`
Provider	SOCRadar
Category	Analytics & SIEM
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Fetches SOCRadar incidents with desired parameters so that relevant actions over the incidents can be taken by using Cortex XSOAR.
This integration was integrated and tested with v21.11 of SOCRadar.

Configure SOCRadarIncidents on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for SOCRadarIncidents.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
API Key	The API Key to use for connection to SOCRadar.	True
Fetch incidents	Enable fetch incidents.	False
insecure	Trust any certificate (not secure)	False
Use system proxy settings	Whether to use XSOAR’s system proxy settings to connect to the API.	False
First Fetch Time	Date or relative timestamp to start fetching incidents from.	False
Company ID	Company ID in SOCRadar to fetch incidents.	True
Severity Level	Select severity level(s) of incidents to fetch. Leave blank to fetch all.	False
Maximum number of incidents to fetch	Maximum number of incidents to fetch in each integration execution interval.	False
Resolution Status	Fetch Incidents by resolution status (All, Resolved, Not Resolved)	False
FP Status	Fetch Incidents by false positive status (All, FP, Not FP)	False
Incident Main Type	Fetch incidents which belong to this particular main type.	False
Incident Sub Type	Fetch incidents which belong to this particular sub type.	False

Click Test to validate API key and connection to SOCRadar.

How to obtain SOCRadar Incident API key?

Every company has a unique API key in SOCRadar platform. This API key can be used to benefit from
various API endpoints that SOCRadar provides.

You can obtain your company’s API key from your company’s settings page by navigating to the
API Options tab. Besides, API key can be regenerated by using Actions button under the API
keys panel.

api_key

For further information about the SOCRadar API keys please see SOCRadar API documentation.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

socradar-mark-incident-fp

Marks incident as false positive in SOCRadar platform.

Base Command

socradar-mark-incident-fp

Input

Argument Name	Description	Required
socradar_incident_id	SOCRadar Incident ID to be marked as false positive.	Required
comments	Comments about false positive action over the incident.	Optional

Context Output

There is no context output for this command.

Command Example

!socradar-mark-incident-fp socradar_incident_id=29051453 comments="This incident is FP."

Human Readable Output

SOCRadar API Response: False positive action has been successfully taken. Affected incident IDs: 29051453

socradar-mark-incident-resolved

Marks incident as resolved in SOCRadar platform.

Base Command

socradar-mark-incident-resolved

Input

Argument Name	Description	Required
socradar_incident_id	SOCRadar Incident ID to be marked as resolved.	Required
comments	Comments about resolved action over the incident.	Optional

Context Output

There is no context output for this command.

Command Example

!socradar-mark-incident-resolved socradar_incident_id=29051453 comments="Incident has been resolved."

Human Readable Output

SOCRadar API Response: Incident has been successfully resolved. Affected incident IDs: 29051453

Configuration parameters

apikey — (required)
isFetch — Fetch incidents
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — First Fetch Time
socradar_company_id — Company ID (required)
severity — Severity Level
max_fetch — Maximum number of incidents to fetch
resolution_status — Resolution Status
fp_status — FP Status
incident_main_type — Incident Main Type
incident_sub_type — Incident Sub Type
include_company_id — Include Company ID
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (2)

socradar-mark-incident-fp
Marks incident as false positive in SOCRadar platform.
socradar-mark-incident-resolved
Marks incident as resolved in SOCRadar platform.

Source

SOCRadarIncidents.py SOCRadarIncidents_test.py SOCRadarIncidents.yml SOCRadarIncidents_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: SOCRadar
commonfields:
  id: SOCRadarIncidents
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: The API Key to use for connection to SOCRadar
  displaypassword: API Key
  name: apikey
  required: true
  type: 9
  hiddenusername: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- defaultvalue: 3 days
  display: First Fetch Time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: Company ID in SOCRadar to fetch incidents.
  display: Company ID
  name: socradar_company_id
  required: true
  type: 0
  section: Connect
- additionalinfo: Select severity level(s) of incidents to fetch. Leave blank to fetch all.
  display: Severity Level
  name: severity
  options:
  - Info
  - Low
  - Medium
  - High
  - Critical
  type: 16
  section: Collect
  required: false
- additionalinfo: Maximum number of incidents to fetch in each integration execution interval.
  defaultvalue: '20'
  display: Maximum number of incidents to fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: Fetch Incidents by resolution status (All, Resolved, Not Resolved)
  defaultvalue: All
  display: Resolution Status
  name: resolution_status
  options:
  - All
  - Resolved
  - Not Resolved
  type: 15
  section: Collect
  required: false
- additionalinfo: Fetch Incidents by false positive status (All, FP, Not FP)
  defaultvalue: All
  display: FP Status
  name: fp_status
  options:
  - All
  - FP
  - Not FP
  type: 15
  section: Collect
  required: false
- additionalinfo: Fetch incidents which belong to this particular main type.
  display: Incident Main Type
  name: incident_main_type
  type: 0
  section: Collect
  required: false
- additionalinfo: Fetch incidents which belong to this particular sub type.
  display: Incident Sub Type
  name: incident_sub_type
  type: 0
  section: Collect
  required: false
- display: Include Company ID
  name: include_company_id
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: If enabled, the SOCRadar Company ID configured in this instance will be stored as a custom field on each fetched incident. Useful for multi-tenant environments to identify which company an incident belongs to.
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
defaultclassifier: SOCRadar Incident Classifier
defaultmapperin: SOCRadar Incident Mapper
defaultmapperout: 'null'
description: Fetches SOCRadar incidents with desired parameters so that relevant actions over the incidents can be taken by using Cortex XSOAR.
display: SOCRadar Incidents
name: SOCRadarIncidents
script:
  commands:
  - arguments:
    - description: SOCRadar Incident ID to be marked as false positive.
      name: socradar_incident_id
      required: true
    - description: Comments about false positive action over the incident.
      name: comments
    description: Marks incident as false positive in SOCRadar platform.
    name: socradar-mark-incident-fp
  - arguments:
    - description: SOCRadar Incident ID to be marked as resolved.
      name: socradar_incident_id
      required: true
    - description: Comments about resolved action over the incident.
      name: comments
    description: Marks incident as resolved in SOCRadar platform.
    name: socradar-mark-incident-resolved
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- SOCRadarIncidents-Test
fromversion: 6.0.0