Sekoia XDR

Fetch alerts and events from SEKOIA.IO XDR.\nTo use this integration, please create an API Key with the appropriate permissions.

Analytics & SIEM · SekoiaXDR

Configuration parameters

  • credentials — API key (required)
  • url — Server URL (i.e. https://api.sekoia.io) (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First fetch timestamp (<sign + or -><number><time unit>, e.g., -7d, -1h) (required)
  • max_fetch — Maximum incidents to fetch per interval. (required)
  • incidentFetchInterval — Incidents Fetch Interval
  • alerts_status — Alerts status.
  • alerts_type — Alerts types.
  • alerts_urgency — Alerts urgency levels ( "MINurgency,MAXurgency". i.e: 80,100 ).
  • fetch_mode — Fetch mode (required)
  • replace_dots_event — Replace "dots" in event field names with another character. (required)
  • exclude_info_events — Events fields to exclude from the events search result.
  • fetch_with_assets — Include assets information in the alerts when fetching.
  • fetch_with_kill_chain — Include kill chain information in the alerts when fetching.
  • mirror_direction — Incident Mirroring Direction.
  • mirror_events — Include events in the mirroring of the alerts.
  • mirror_kill_chain — Include kill chain information in the mirroring of the alerts.
  • reopen_incident — Reopen Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
  • close_incident — Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
  • close_notes — Close notes. (required)
  • timezone — Timezone ( TZ format ) (required)

Commands (23)

  • get-mapping-fields

    This command pulls the remote schema for the different incident types, and their associated incident fields, from the remote system.

  • get-modified-remote-data

    available from Cortex XSOAR version 6.1.0. This command queries for incidents that were modified since the last update.

  • get-remote-data

    This command gets new information about the incidents in the remote system and updates existing incidents in Cortex XSOAR.

  • sekoia-xdr-add-attributes-asset

    Command to add attributes to an asset in Sekoia XDR.

  • sekoia-xdr-add-keys-asset

    Command to add keys to an asset in Sekoia XDR.

  • sekoia-xdr-events-execute-query

    Command to create an event search job on Sekoia XDR, after this execute "sekoia-xdr-status-events-query" to see the status of the query job and "sekoia-xdr-results-events-query" to retrieve the results..

  • sekoia-xdr-events-results-query

    Command to retrieve the events from the search job "sekoia-xdr-execute-events-query" previously done on Sekoia XDR.

  • sekoia-xdr-events-status-query

    Command to query the status of the search job on Sekoia XDR.

  • sekoia-xdr-get-alert

    Command to retrieve a specific alert by uuid or short_id from Sekoia XDR.

  • sekoia-xdr-get-asset

    Get an asset by its UUID from Sekoia XDR.

  • sekoia-xdr-get-cases-alert

    Command to retrieve the cases related to an Alert from Sekoia XDR. If a case_id is given, returns the information about it, and if not it will give all cases in this alert.

  • sekoia-xdr-get-comments

    Command to get all the comments from an alert in Sekoia XDR.

  • sekoia-xdr-get-kill-chain

    Command to retrieve the definition of a Cyber Kill Chain Step.

  • sekoia-xdr-get-user

    Command to get information about a user in Sekoia XDR. Used also in the command !sekoia-xdr-get-comments to have the name of the persons who made the comments.

  • sekoia-xdr-get-workflow-alert

    Command to get the possible transitions of status on the alert.

  • sekoia-xdr-http-request

    Command that performs a HTTP request to Sekoia using the integration authentication configured.

  • sekoia-xdr-list-alerts

    Command to retrieve a list of Alerts from Sekoia XDR.

  • sekoia-xdr-list-assets

    Command to retrieve a list of Assets from Sekoia XDR.

  • sekoia-xdr-post-comment-alert

    Command to post comments to alerts in Sekoia XDR.

  • sekoia-xdr-remove-attribute-asset

    Command to remove an attribute from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the attribute_uuid to delete.

  • sekoia-xdr-remove-key-asset

    Command to remove a key from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the key_uuid to delete.

  • sekoia-xdr-search-events

    Command to search and retrieve the events from an alert. This is a combination of 3 commands: sekoia-xdr-events-execute-query, sekoia-xdr-events-status-query and sekoia-xdr-events-results-query.

  • sekoia-xdr-update-status-alert

    Command to update the status of a specific Alert by uuid or short_id.