Details

ID	`SOCRadarIncidentsMultiTenant`
Provider	SOCRadar
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

SOCRadar Incidents v4.0 Multi-Tenant

Fetch and manage security incidents from multiple companies using SOCRadar’s Multi-Tenant Incident API. Designed for MSPs, MSSPs, and organizations managing multiple subsidiaries.

Overview

SOCRadar is a digital risk protection platform that provides extended threat intelligence and brand protection capabilities. This Multi-Tenant integration enables XSOAR to ingest security incidents from multiple companies through a single integration instance, including:

Brand Protection: Impersonating domains, phishing attacks, brand abuse
Cyber Threat Intelligence: Stolen credentials, data leaks, malware infections
Attack Surface Management: External exposure findings, misconfigurations
Dark Web Intelligence: Compromised credentials, leaked data from dark web sources
Supply Chain Security: Third-party risks and vendor security issues

Multi-Tenant Features

Centralized Multi-Company Management

Single Integration: Monitor incidents from all your companies through one integration instance
Company Tracking: Each alarm automatically includes company ID and company name
Smart Filtering: Filter and manage incidents across companies or focus on specific ones

Automatic Company ID Handling

Auto-Extraction: When taking actions, company ID is automatically extracted from alarm data
No Manual Input: You don’t need to remember or specify company IDs for most operations
Override Capability: Manually specify company ID when needed (advanced use cases)

Company Visibility Control

Configurable Display: Choose whether to show company information in incident details
Custom Fields: Company ID and company name available in custom fields
Incident Naming: Company information included in incident names for quick identification

What’s New in Multi-Tenant v4.0

Multi-Tenant Specific

Multi-Tenant API Endpoint: Uses /multi_tenant/{multi-tenant-id}/incidents for fetching
Company Information: Each alarm includes both company_id and company_name
Smart Action Handling: Automatically determines which company to act upon
Default Company Visibility: Company info shown by default (can be disabled)

Core Features (from v4.0)

Multi-Status Filtering: Select multiple statuses (OPEN, CLOSED, ON_HOLD) simultaneously
Epoch Time Precision: Second-level accuracy for incident fetching - zero duplicates
Reverse Pagination: Fetches newest incidents first for better performance
Dynamic Content Extraction: Automatically extracts alarm-specific fields regardless of type
Enhanced Deduplication: Two-layer protection prevents duplicate incidents

Technical Improvements

Interval-based fetching with overlap protection
Configurable content and entity inclusion
Comprehensive debug logging
Better error handling and recovery
Intelligent company ID extraction from incident context

Key Differences: Standard vs Multi-Tenant

Feature	Standard v4.0	Multi-Tenant v4.0
Configuration	Company ID + API Key	Multi-Tenant ID + API Key
Fetch Endpoint	`/company/{id}/incidents/v4`	`/multi_tenant/{id}/incidents`
Company Data	Single company (implicit)	Multiple companies (explicit)
Company ID in Actions	Uses configured company ID	Auto-extracted from alarm
Company Visibility	Optional (default: hidden)	Optional (default: visible)
Use Case	Single organization	MSPs, MSSPs, multi-subsidiary

Prerequisites

Required

SOCRadar account with Multi-Tenant Incident API access
Multi-Tenant ID from SOCRadar platform
API Key from SOCRadar platform
XSOAR 6.x or later

API Access

To obtain your API credentials:

Log in to SOCRadar Platform
Reach out support team to get MSSP API Key

Configuration

Integration Settings

Parameter	Required	Default	Description
Server URL	Yes	`https://platform.socradar.com/api`	SOCRadar API base URL
API Key	Yes	-	Your Multi-Tenant API Key from SOCRadar
Multi-Tenant ID	Yes	-	Your Multi-Tenant ID (integer)
Fetch incidents	No	False	Enable automatic incident fetching
Incident type	No	-	XSOAR incident type to create
Max incidents per fetch	No	10000	Maximum incidents per fetch cycle
First fetch time	No	3 days	Initial time range for first fetch
Fetch Interval (Minutes)	No	1	Time window for subsequent fetches

Filtering Options

Parameter	Type	Description
Status Filter	Multi-select	Select one or more: OPEN, CLOSED, ON_HOLD
Severity	Multi-select	Filter by: LOW, MEDIUM, HIGH, CRITICAL
Alarm Type IDs	Text	Comma-separated list of type IDs to include
Excluded Alarm Type IDs	Text	Comma-separated list of type IDs to exclude
Main Alarm Types	Text	Comma-separated main types (e.g., “Brand Protection”)
Alarm Sub Types	Text	Comma-separated sub types

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

socradar-change-alarm-status

Change the status of one or more alarms.

Base Command

socradar-change-alarm-status

Input

Argument Name	Description	Required
alarm_ids	Comma-separated list of alarm IDs to update.	Required
status_reason	New status reason for the alarms. Possible values are: OPEN, INVESTIGATING, RESOLVED, PENDING_INFO, LEGAL_REVIEW, VENDOR_ASSESSMENT, FALSE_POSITIVE, DUPLICATE, PROCESSED_INTERNALLY, MITIGATED, NOT_APPLICABLE.	Required
comments	Optional comments explaining the status change.	Optional
company_id	Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.	Optional

Context Output

Path	Type	Description
SOCRadar.Alarm.ID	String	Alarm ID.
SOCRadar.Alarm.Status	String	New alarm status.

socradar-mark-false-positive

Mark an alarm as false positive.

Base Command

socradar-mark-false-positive

Input

Argument Name	Description	Required
alarm_id	Alarm ID to mark as false positive.	Required
comments	Optional comments explaining why this is a false positive. Default is False positive.	Optional
company_id	Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.	Optional

Context Output

Path	Type	Description
SOCRadar.Alarm.ID	String	Alarm ID.
SOCRadar.Alarm.Status	String	New alarm status.

socradar-mark-resolved

Mark an alarm as resolved.

Base Command

socradar-mark-resolved

Input

Argument Name	Description	Required
alarm_id	Alarm ID to mark as resolved.	Required
comments	Optional comments explaining the resolution. Default is Resolved.	Optional
company_id	Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.	Optional

Context Output

Path	Type	Description
SOCRadar.Alarm.ID	String	Alarm ID.
SOCRadar.Alarm.Status	String	New alarm status.

socradar-add-comment

Add a comment to an alarm.

Base Command

socradar-add-comment

Input

Argument Name	Description	Required
alarm_id	Alarm ID to add comment to.	Required
user_email	Email address of the user adding the comment.	Required
comment	Comment text to add.	Required
company_id	Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.	Optional

Context Output

Path	Type	Description
SOCRadar.Alarm.ID	String	Alarm ID.

socradar-add-assignee

Add the assignee(s) of an alarm.

Base Command

socradar-add-assignee

Input

Argument Name	Description	Required
alarm_id	Alarm ID to add assignee for.	Required
user_emails	Comma-separated list of user email addresses to assign.	Required
company_id	Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.	Optional

Context Output

Path	Type	Description
SOCRadar.Alarm.ID	String	Alarm ID.
SOCRadar.Alarm.Assignees	String	New assignees.

socradar-add-tag

Add or remove a tag from an alarm.

Base Command

socradar-add-tag

Input

Argument Name	Description	Required
alarm_id	Alarm ID to add/remove tag for.	Required
tag	Tag name to add or remove.	Required
company_id	Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.	Optional

Context Output

Path	Type	Description
SOCRadar.Alarm.ID	String	Alarm ID.
SOCRadar.Alarm.Tags	String	Alarm tags.

socradar-test-fetch

Test incident fetching to verify alarms are available and date parsing works correctly.

Base Command

socradar-test-fetch

Input

Argument Name	Description	Required
limit	Number of incidents to test fetch (default 5). Default is 5.	Optional
first_fetch	Test date range (e.g., “3 days”, “7 days”). Default is 3 days.	Optional

Context Output

Path	Type	Description
SOCRadar.TestFetch.TotalCount	Number	Total number of incidents found.
SOCRadar.TestFetch.SampleIncidents	Unknown	Sample incidents for testing.
SOCRadar.TestFetch.StartDate	String	Parsed start date used for the test.
SOCRadar.TestFetch.TotalRecords	Number	Total number of incidents from service.
SOCRadar.TestFetch.TotalPages	Number	Total number of pages of incidents from service.

License

This integration is provided as part of the Cortex XSOAR content pack.

Configuration parameters

apikey — API Key (required)
multi_tenant_id — Multi-Tenant ID (required)
isFetch — Fetch incidents
first_fetch — First Fetch Time
fetch_interval_minutes — Fetch Interval (Minutes)
max_fetch — Max incidents per fetch
show_content — Show Alarm Content
status — Status Filter
severities — Severity Levels
alarm_type_ids — Alarm Type IDs (Include)
excluded_alarm_type_ids — Alarm Type IDs (Exclude)
alarm_main_types — Alarm Main Types
excluded_alarm_main_types — Alarm Main Types (Exclude)
alarm_sub_types — Alarm Sub Types
excluded_alarm_sub_types — Alarm Sub Types (Exclude)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (7)

socradar-add-assignee
Add the assignee(s) of an alarm.
socradar-add-comment
Add a comment to an alarm.
socradar-add-tag
Add or remove a tag from an alarm.
socradar-change-alarm-status
Change the status of one or more alarms.
socradar-mark-false-positive
Mark an alarm as false positive.
socradar-mark-resolved
Mark an alarm as resolved.
socradar-test-fetch
Test incident fetching to verify alarms are available and date parsing works correctly.

Source

SOCRadarIncidentsV4MultiTenant.py SOCRadarIncidentsV4MultiTenant_test.py SOCRadarIncidentsV4MultiTenant.yml SOCRadarIncidentsV4MultiTenant_description.md

Download History Raw

category: Analytics & SIEM
provider: SOCRadar
commonfields:
  id: SOCRadarIncidentsMultiTenant
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
  additionalinfo: Your SOCRadar API key from platform.socradar.com
- display: Multi-Tenant ID
  name: multi_tenant_id
  required: true
  type: 0
  section: Connect
  additionalinfo: Your Multi-Tenant ID from SOCRadar platform for fetching incidents across all companies
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: First Fetch Time
  name: first_fetch
  type: 0
  defaultvalue: 3 days
  section: Collect
  additionalinfo: 'Time range for FIRST fetch only. Examples: "3 days", "7 days", "30 days". After first fetch, integration will use Fetch Interval for subsequent fetches.'
- display: Fetch Interval (Minutes)
  name: fetch_interval_minutes
  type: 0
  defaultvalue: "1"
  section: Collect
  additionalinfo: "Time window for subsequent fetches in minutes. Default: 1 minute. Integration will fetch alarms from last N minutes. Example: If set to 1, it fetches alarms from last 1 minute each cycle."
- display: Max incidents per fetch
  name: max_fetch
  type: 0
  defaultvalue: "200"
  section: Collect
  additionalinfo: "Maximum number of incidents to create per cycle. Recommended: 200 for stability. The actual number fetched depends on the time window and available alarms."
- display: Show Alarm Content
  name: show_content
  type: 8
  required: false
  defaultvalue: "true"
  section: Collect
  additionalinfo: If enabled, alarm content will be appended to incident details field (may increase incident size).
- display: Status Filter
  name: status
  type: 16
  required: false
  section: Collect
  options:
  - OPEN
  - CLOSED
  - ON_HOLD
  additionalinfo: Filter incidents by status (leave empty for all statuses)
- display: Severity Levels
  name: severities
  type: 16
  required: false
  section: Collect
  options:
  - LOW
  - INFO
  - MEDIUM
  - HIGH
  - CRITICAL
  additionalinfo: Filter incidents by severity levels (leave empty for all severities)
- display: Alarm Type IDs (Include)
  name: alarm_type_ids
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm type IDs to include (e.g., "1,2,3"). Leave empty to include all alarm types.
- display: Alarm Type IDs (Exclude)
  name: excluded_alarm_type_ids
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm type IDs to exclude (e.g., "4,5,6"). Takes precedence if same ID appears in both include and exclude.
- display: Alarm Main Types
  name: alarm_main_types
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm main types to filter (e.g., "Brand Protection,Attack Surface Management")
- display: Alarm Main Types (Exclude)
  name: excluded_alarm_main_types
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm main types to exclude (e.g., "Brand Protection,Attack Surface Management")
- display: Alarm Sub Types
  name: alarm_sub_types
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm sub types to filter (e.g., "Impersonating Domain,Stolen Credential")
- display: Alarm Sub Types (Exclude)
  name: excluded_alarm_sub_types
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm sub types to exclude (e.g., "Impersonating Domain,Stolen Credential")
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
description: SOCRadar Multi-Tenant Incidents integration with advanced incident management, status reasons, and compliance tracking. Fetches security incidents from SOCRadar platform across all tenant companies with proper deduplication and date handling. Uses Multi-Tenant API for incident fetching and company-specific APIs for alarm management.
display: SOCRadar Incidents Multi-Tenant
name: SOCRadarIncidentsMultiTenant
script:
  commands:
  - name: socradar-change-alarm-status
    description: Change the status of one or more alarms.
    arguments:
    - name: alarm_ids
      description: Comma-separated list of alarm IDs to update.
      required: true
    - name: status_reason
      description: New status reason for the alarms.
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - INVESTIGATING
      - RESOLVED
      - PENDING_INFO
      - LEGAL_REVIEW
      - VENDOR_ASSESSMENT
      - FALSE_POSITIVE
      - DUPLICATE
      - PROCESSED_INTERNALLY
      - MITIGATED
      - NOT_APPLICABLE
    - name: comments
      description: Optional comments explaining the status change.
      required: false
    - name: company_id
      description: Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.
      required: false
    - name: update_related_finding_status
      description: Decide whether to update related finding status.
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
      required: false
    - name: email
      description: Email of action owner (required if update_related_finding_status is True).
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Status
      description: New alarm status.
      type: String

  - name: socradar-mark-false-positive
    description: Mark an alarm as false positive.
    arguments:
    - name: alarm_id
      description: Alarm ID to mark as false positive.
      required: true
    - name: comments
      description: Optional comments explaining why this is a false positive.
      required: false
      defaultValue: "False positive"
    - name: company_id
      description: Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Status
      description: New alarm status.
      type: String

  - name: socradar-mark-resolved
    description: Mark an alarm as resolved.
    arguments:
    - name: alarm_id
      description: Alarm ID to mark as resolved.
      required: true
    - name: comments
      description: Optional comments explaining the resolution.
      required: false
      defaultValue: "Resolved"
    - name: company_id
      description: Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Status
      description: New alarm status.
      type: String

  - name: socradar-add-comment
    description: Add a comment to an alarm.
    arguments:
    - name: alarm_id
      description: Alarm ID to add comment to.
      required: true
    - name: user_email
      description: Email address of the user adding the comment.
      required: true
    - name: comment
      description: Comment text to add.
      required: true
    - name: company_id
      description: Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String

  - name: socradar-add-assignee
    description: Add the assignee(s) of an alarm.
    arguments:
    - name: alarm_id
      description: Alarm ID to add assignee for.
      required: true
    - name: user_emails
      description: Comma-separated list of user email addresses to assign.
      required: true
    - name: company_id
      description: Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Assignees
      description: New assignees.
      type: String

  - name: socradar-add-tag
    description: Add or remove a tag from an alarm.
    arguments:
    - name: alarm_id
      description: Alarm ID to add/remove tag for.
      required: true
    - name: tag
      description: Tag name to add or remove.
      required: true
    - name: company_id
      description: Company ID for the alarm. If not provided, will be auto-fetched from alarm data. Can also use ${incident.socradarcompanyid} from incident fields.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Tags
      description: Alarm tags.
      type: String

  - name: socradar-test-fetch
    description: Test incident fetching to verify alarms are available and date parsing works correctly.
    arguments:
    - name: limit
      description: Number of incidents to test fetch (default 5).
      required: false
      defaultValue: "5"
    - name: first_fetch
      description: 'Test date range (e.g., "3 days", "7 days").'
      required: false
      defaultValue: "3 days"
    outputs:
    - contextPath: SOCRadar.TestFetch.TotalCount
      description: Total number of incidents found.
      type: Number
    - contextPath: SOCRadar.TestFetch.SampleIncidents
      description: Sample incidents for testing.
      type: Unknown
    - contextPath: SOCRadar.TestFetch.StartDate
      description: Parsed start date used for the test.
      type: String
    - contextPath: SOCRadar.TestFetch.TotalRecords
      description: Total number of incidents from service.
      type: Number
    - contextPath: SOCRadar.TestFetch.TotalPages
      description: Total number of pages of incidents from service.
      type: Number

  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: "-"
  subtype: python3
  type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)