SOCRadarIncidents

Details

ID	`SOCRadarIncidents`
Provider	SOCRadar
Category	Analytics & SIEM
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Fetches SOCRadar incidents with desired parameters so that relevant actions over the incidents can be taken by using Cortex XSOAR.
This integration was integrated and tested with v21.11 of SOCRadar.

Configure SOCRadarIncidents on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for SOCRadarIncidents.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
API Key	The API Key to use for connection to SOCRadar.	True
Fetch incidents	Enable fetch incidents.	False
insecure	Trust any certificate (not secure)	False
Use system proxy settings	Whether to use XSOAR’s system proxy settings to connect to the API.	False
First Fetch Time	Date or relative timestamp to start fetching incidents from.	False
Company ID	Company ID in SOCRadar to fetch incidents.	True
Severity Level	Select severity level(s) of incidents to fetch. Leave blank to fetch all.	False
Maximum number of incidents to fetch	Maximum number of incidents to fetch in each integration execution interval.	False
Resolution Status	Fetch Incidents by resolution status (All, Resolved, Not Resolved)	False
FP Status	Fetch Incidents by false positive status (All, FP, Not FP)	False
Incident Main Type	Fetch incidents which belong to this particular main type.	False
Incident Sub Type	Fetch incidents which belong to this particular sub type.	False

Click Test to validate API key and connection to SOCRadar.

How to obtain SOCRadar Incident API key?

Every company has a unique API key in SOCRadar platform. This API key can be used to benefit from
various API endpoints that SOCRadar provides.

You can obtain your company’s API key from your company’s settings page by navigating to the
API Options tab. Besides, API key can be regenerated by using Actions button under the API
keys panel.

api_key

For further information about the SOCRadar API keys please see SOCRadar API documentation.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

socradar-mark-incident-fp

Marks incident as false positive in SOCRadar platform.

Base Command

socradar-mark-incident-fp

Input

Argument Name	Description	Required
socradar_incident_id	SOCRadar Incident ID to be marked as false positive.	Required
comments	Comments about false positive action over the incident.	Optional

Context Output

There is no context output for this command.

Command Example

!socradar-mark-incident-fp socradar_incident_id=29051453 comments="This incident is FP."

Human Readable Output

SOCRadar API Response: False positive action has been successfully taken. Affected incident IDs: 29051453

socradar-mark-incident-resolved

Marks incident as resolved in SOCRadar platform.

Base Command

socradar-mark-incident-resolved

Input

Argument Name	Description	Required
socradar_incident_id	SOCRadar Incident ID to be marked as resolved.	Required
comments	Comments about resolved action over the incident.	Optional

Context Output

There is no context output for this command.

Command Example

!socradar-mark-incident-resolved socradar_incident_id=29051453 comments="Incident has been resolved."

Human Readable Output

SOCRadar API Response: Incident has been successfully resolved. Affected incident IDs: 29051453

Configuration parameters

apikey — (required)
isFetch — Fetch incidents
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — First Fetch Time
socradar_company_id — Company ID (required)
severity — Severity Level
max_fetch — Maximum number of incidents to fetch
resolution_status — Resolution Status
fp_status — FP Status
incident_main_type — Incident Main Type
incident_sub_type — Incident Sub Type
include_company_id — Include Company ID
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (2)

socradar-mark-incident-fp
Marks incident as false positive in SOCRadar platform.
socradar-mark-incident-resolved
Marks incident as resolved in SOCRadar platform.

Source

SOCRadarIncidents.py SOCRadarIncidents_test.py SOCRadarIncidents.yml SOCRadarIncidents_description.md command_examples.txt

Download History Raw

## SOCRadar Incidents
Use the SOCRadar Incidents integration to fetch incidents from SOCRadar and take appropriate actions over those incidents.
***
### How to obtain an API key

To obtain your SOCRadar incident API key please navigate to **Company Settings** page in SOCRadar platform. Under the **API Options** tab retrieve your API key or regenerate a new one.

After obtaining the SOCRadar incident API key insert it into **API Key** field.

### How to configure
- ***Company ID***: Every incident in SOCRadar associates with a company. Insert the SOCRadar company ID of the company that you want to obtain incidents.
- ***Maximum number of incidents to fetch*** (Default is *20*): Insert the maximum number of incidents to fetch from SOCRadar in each fetching period. (Limited to max 50)
- ***Resolution Status*** (Default is *All*): Resolution status of incidents to fetch. (All, Resolved, Not Resolved)
- ***FP Status*** (Default is *All*): False positive status of incidents to fetch. (All, FP, Not FP)
- ***Incident Main Type***: Main type of incidents to fetch. All incident main types can be found under **Incident Summary & Options** tab in your company's settings page within SOCRadar platform. Leave it blank to fetch all main type of incidents.
- ***Incident Sub Type***: Sub type of incidents to fetch. All incident sub types can be found under **Incident Summary & Options** tab in your company's settings page within SOCRadar platform. Leave it blank to fetch all sub type of incidents.

### Rate Limits

To prevent abuse and ensure service stability, all API requests are rate limited. Rate limits specify the maximum number of API calls that can be made in a minute period. The exact number of calls that your application can make per minute varies based on company plan.

Please bear in mind that you should be careful about the your API key's rate limit especially when you plan to have multiple instances of SOCRadar incident integration with the same API key. If the instances will require more access to the SOCRadar incident API than your API key's rate limit then this integration will not work properly due to rate limit exceeding.

### Further Information

For further information about the usage and rate limitation of SOCRadar incident API please see [SOCRadar Incident API](https://platform.socradar.com/docs/api/incident_api/) documentation.