SOCRadarIncidentsMultiTenant

SOCRadar Multi-Tenant Incidents integration with advanced incident management, status reasons, and compliance tracking. Fetches security incidents from SOCRadar platform across all tenant companies with proper deduplication and date handling. Uses Multi-Tenant API for incident fetching and company-specific APIs for alarm management.

Analytics & SIEM · SOCRadar

Configuration parameters

  • apikey — API Key (required)
  • multi_tenant_id — Multi-Tenant ID (required)
  • isFetch — Fetch incidents
  • first_fetch — First Fetch Time
  • fetch_interval_minutes — Fetch Interval (Minutes)
  • max_fetch — Max incidents per fetch
  • show_content — Show Alarm Content
  • status — Status Filter
  • severities — Severity Levels
  • alarm_type_ids — Alarm Type IDs (Include)
  • excluded_alarm_type_ids — Alarm Type IDs (Exclude)
  • alarm_main_types — Alarm Main Types
  • excluded_alarm_main_types — Alarm Main Types (Exclude)
  • alarm_sub_types — Alarm Sub Types
  • excluded_alarm_sub_types — Alarm Sub Types (Exclude)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type

Commands (7)

  • socradar-add-assignee

    Add the assignee(s) of an alarm.

  • socradar-add-comment

    Add a comment to an alarm.

  • socradar-add-tag

    Add or remove a tag from an alarm.

  • socradar-change-alarm-status

    Change the status of one or more alarms.

  • socradar-mark-false-positive

    Mark an alarm as false positive.

  • socradar-mark-resolved

    Mark an alarm as resolved.

  • socradar-test-fetch

    Test incident fetching to verify alarms are available and date parsing works correctly.