TaegisXDRv2

For integration with the Secureworks Taegis XDR platform.

Data Enrichment & Threat Intelligence · Secureworks

Configuration parameters

  • environment — Taegis Environment (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • client_id — Client ID (required)
  • client_secret — Client Secret (required)
  • isFetch — Fetch incidents
  • max_fetch — Maximum number of incidents per fetch
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • incidentType — Incident type
  • include_assets — Include Assets in Fetch
  • fetch_type — Fetch Incident Type

Commands (21)

  • taegis-add-evidence-to-investigation

    Add alerts and events to an existing investigation.

  • taegis-archive-investigation

    Archive an investigation.

  • taegis-create-comment

    Create a comment on an investigation.

  • taegis-create-investigation

    Create an Investigation within Taegis.

  • taegis-create-sharelink

    Creates a ShareLink to a Taegis element, such as an alert or investigation.

  • taegis-execute-playbook

    Executes a Taegis playbook instance.

  • taegis-fetch-alerts

    List Taegis alerts by ID.

  • taegis-fetch-assets

    Fetch assets based on search criteria.

  • taegis-fetch-comment

    Fetch comment by comment ID.

  • taegis-fetch-comments

    Fetch comments by Investigation ID.

  • taegis-fetch-endpoint

    Fetch endpoint information.

  • taegis-fetch-events

    This is a beta command, which lets you implement and test pre-release software. Since the command is beta, it might contain bugs. Updates to the command during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the command to help us identify issues, fix them, and continually improve. Fetches Taegis events using a CQL query string or a list of event IDs. Supports pagination via the next cursor token returned in results. If no cql_query is provided, defaults to "FROM * EARLIEST=-1m | head 50".

  • taegis-fetch-investigation

    Fetch all investigations or a specific investigation.

  • taegis-fetch-investigation-alerts

    Fetch Alert IDs related to a specific investigation.

  • taegis-fetch-playbook-execution

    Fetch the results of a Taegis playbook instance execution.

  • taegis-fetch-users

    Fetch a user by ID or email address.

  • taegis-isolate-asset

    Isolate a specific asset.

  • taegis-unarchive-investigation

    Unarchive an investigation.

  • taegis-update-alert-status

    Update the status of an alert.

  • taegis-update-comment

    Update an existing comment.

  • taegis-update-investigation

    Update an existing investigation.