SOCRadarIncidents

Details

ID	`SOCRadarIncidents`
Provider	SOCRadar
Category	Analytics & SIEM
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Fetches SOCRadar incidents with desired parameters so that relevant actions over the incidents can be taken by using Cortex XSOAR.
This integration was integrated and tested with v21.11 of SOCRadar.

Configure SOCRadarIncidents on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for SOCRadarIncidents.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
API Key	The API Key to use for connection to SOCRadar.	True
Fetch incidents	Enable fetch incidents.	False
insecure	Trust any certificate (not secure)	False
Use system proxy settings	Whether to use XSOAR’s system proxy settings to connect to the API.	False
First Fetch Time	Date or relative timestamp to start fetching incidents from.	False
Company ID	Company ID in SOCRadar to fetch incidents.	True
Severity Level	Select severity level(s) of incidents to fetch. Leave blank to fetch all.	False
Maximum number of incidents to fetch	Maximum number of incidents to fetch in each integration execution interval.	False
Resolution Status	Fetch Incidents by resolution status (All, Resolved, Not Resolved)	False
FP Status	Fetch Incidents by false positive status (All, FP, Not FP)	False
Incident Main Type	Fetch incidents which belong to this particular main type.	False
Incident Sub Type	Fetch incidents which belong to this particular sub type.	False

Click Test to validate API key and connection to SOCRadar.

How to obtain SOCRadar Incident API key?

Every company has a unique API key in SOCRadar platform. This API key can be used to benefit from
various API endpoints that SOCRadar provides.

You can obtain your company’s API key from your company’s settings page by navigating to the
API Options tab. Besides, API key can be regenerated by using Actions button under the API
keys panel.

api_key

For further information about the SOCRadar API keys please see SOCRadar API documentation.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

socradar-mark-incident-fp

Marks incident as false positive in SOCRadar platform.

Base Command

socradar-mark-incident-fp

Input

Argument Name	Description	Required
socradar_incident_id	SOCRadar Incident ID to be marked as false positive.	Required
comments	Comments about false positive action over the incident.	Optional

Context Output

There is no context output for this command.

Command Example

!socradar-mark-incident-fp socradar_incident_id=29051453 comments="This incident is FP."

Human Readable Output

SOCRadar API Response: False positive action has been successfully taken. Affected incident IDs: 29051453

socradar-mark-incident-resolved

Marks incident as resolved in SOCRadar platform.

Base Command

socradar-mark-incident-resolved

Input

Argument Name	Description	Required
socradar_incident_id	SOCRadar Incident ID to be marked as resolved.	Required
comments	Comments about resolved action over the incident.	Optional

Context Output

There is no context output for this command.

Command Example

!socradar-mark-incident-resolved socradar_incident_id=29051453 comments="Incident has been resolved."

Human Readable Output

SOCRadar API Response: Incident has been successfully resolved. Affected incident IDs: 29051453

Configuration parameters

apikey — (required)
isFetch — Fetch incidents
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — First Fetch Time
socradar_company_id — Company ID (required)
severity — Severity Level
max_fetch — Maximum number of incidents to fetch
resolution_status — Resolution Status
fp_status — FP Status
incident_main_type — Incident Main Type
incident_sub_type — Incident Sub Type
include_company_id — Include Company ID
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (2)

socradar-mark-incident-fp
Marks incident as false positive in SOCRadar platform.
socradar-mark-incident-resolved
Marks incident as resolved in SOCRadar platform.

Source

SOCRadarIncidents.py SOCRadarIncidents_test.py SOCRadarIncidents.yml SOCRadarIncidents_description.md command_examples.txt

Download History Raw

!socradar-mark-incident-fp socradar_incident_id=29051453 comments="This incident is FP."
!socradar-mark-incident-resolved socradar_incident_id=29051453 comments="Incident has been resolved."