Details
| ID | Vectra |
|---|---|
| Provider | Vectra AI |
| Category | Network Security |
| From Version | 5.0.0 |
| Supported Modules | Agentix XSIAM |
README
Vectra is a detection product that alerts on suspicious network behavior. It can recognize certain known attacks and suspicious interactions on the network level (e.g. Reverse Shell, Port Scans, etc)
Cortex XSOAR supports fetching detections directly from Vectra. These are set to trigger incidents in Cortex XSOAR.
Commands start with !Vectra and can be viewed by clicking Show commands in the Settings/Integrations page.
For additional information check out also the solution brief at Integrating_Cognito_with_Demisto_English.pdf
To set up the integration on Cortex XSOAR:
- Go to ‘Settings > Integrations > Servers & Services’
- Locate the Vectra integration by searching for ‘Vectra’ using the search box on the top of the page.
- Click ‘Add instance’ to create and configure a new integration. You should configure the following Vectra and Cortex XSOAR-specific settings:
Name: A textual name for the integration instance.
Server URL: The hostname or IP address of the Vectra application. Make sure the URL is reachable with respect to IP address and port.
Credentials and Password: The username and password, or toggle to Credentials.
Fetch incidents: Select whether to automatically create Cortex XSOAR incidents from Vectra offenses.
If this option is checked, the first batch of offenses pulled as incidents will be the one raised in last 10 minutes of adding the instance.
Do not validate server certificate: Select to avoid server certification validation. You may want to do this in case Cortex XSOAR cannot validate the integration server certificate (due to missing CA certificate)
Incident type: Select to which incident type you want to map Vectra offenses.
Cortex XSOAR engine: If relevant, select the engine that acts as a proxy to the server.
Engines are used when you need to access a remote network segments and there are network devices such as proxies, firewalls, etc. that prevent the Cortex XSOAR server from accessing the remote networks.
For more information on Cortex XSOAR engines see:
Cortex XSOAR 6.13 - Engines
Cortex XSOAR 8 Cloud- Engines
Cortex XSOAR 8.7 On-prem - Engines
Require users to enter additional password: Select whether you’d like an additional step where users are required to authenticate themselves with a password.
- Press the ‘Test’ button to validate connection.
- After completing the test successfully, press the ‘Done’ button.
Commands:
vectra-detections - Detection objects contain all the information related to security events detected on the network.
vectra-health - The health configuration retrieves system health statistics such as subnet counts, traffic bandwidth, headend and sensor information.
vectra-hosts - Host information includes data that correlates the host data to detected security events.
vectra-sensors - The sensors branch retrieves a list of sensors that collect and feed data to the X-series.
vectra-settings - The settings information includes S-series sensor and X-series configurations input by the administrator.
vectra-triage - The rules branch can be used to retrieve a listing of configured Triage rules
Configuration parameters
server— Server URL (e.g. https://192.168.0.1) (required)credentials— Credentials (required)isFetch— Fetch incidentsinsecure— Trust any certificate (not secure)incidentType— Incident type
Commands (14)
-
vec-detectionsDeprecatedDetection objects contain all the information related to security events detected on the network
-
vec-get-detetctions-by-idDeprecatedGet detections by host id
-
vec-get-host-by-idDeprecatedGet host by id
-
vec-healthDeprecatedThe health configuration can be used to retrieve system health statistics such as subnet counts, traffic bandwidth, headend and sensor information
-
vec-hostsDeprecatedHost information includes data that correlates the host data to detected security events
-
vec-sensorsDeprecatedThe sensors branch can retrieve a listing of sensors that collect and feed data to the X-series
-
vec-settingsDeprecatedThe settings information includes S-series sensor and X-series configurations input by the administrator
-
vec-triageDeprecatedThe rules branch can be used to retrieve a listing of configured Triage rules
-
vectra-detectionsDeprecatedDetection objects contain all the information related to security events detected on the network
-
vectra-healthDeprecatedThe health configuration can be used to retrieve system health statistics such as subnet counts, traffic bandwidth, headend and sensor information
-
vectra-hostsDeprecatedHost information includes data that correlates the host data to detected security events
-
vectra-sensorsDeprecatedThe sensors branch can retrieve a listing of sensors that collect and feed data to the X-series
-
vectra-settingsDeprecatedhe settings information includes S-series sensor and X-series configurations input by the administrator
-
vectra-triageDeprecatedThe rules branch can be used to retrieve a listing of configured Triage rules
commonfields: id: Vectra version: -1 name: Vectra display: Vectra (Deprecated) category: Network Security provider: Vectra AI description: Deprecated. Use Vectra Detect instead. configuration: - display: Server URL (e.g. https://192.168.0.1) name: server defaultvalue: "" type: 0 required: true - display: Credentials name: credentials defaultvalue: "" type: 9 required: true - display: Fetch incidents name: isFetch type: 8 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Incident type name: incidentType type: 13 required: false script: script: '' type: javascript commands: - name: vec-detections deprecated: true arguments: - name: detection_id description: Filter by detection ID - name: fields description: Filters objects listed - name: page description: Page number. Possible values are a positive integer or last - name: page_size description: Page size. Possible values are a positive integer or all - name: ordering description: Orders records by last timestamp, threat score and certainty score. The default out sorts threat and certainty score in ascending order. Scores can sorted in descending order by prepending the query with “minus” symbol - name: min_id description: '>= the id provided' - name: max_id description: <= the id provided - name: state description: 'filter by state: active, inactive, ignored, ignored for all' - name: type_vname description: filter by the detection type (verbose name) - name: category description: filter by the detection category - name: src_ip description: filter by source (ip address) - name: t_score description: filter by threat score - name: t_score_gte description: filter by threat score >= the score provided - name: c_score description: filter by certainty score - name: c_score_gte description: filter by certainty score >= the score provided - name: last_timestamp description: filter by last timestamp - name: host_id description: filter by id of the host object a detection is attributed to - name: tags description: filter by a tag or a comma-separated list of tags - name: destination description: filter by destination in the detection detail set - name: proto description: filter by the protocol in the detection detail set - name: dst_port description: filter by the destination port in the detection detail set - name: inbound_ip description: filter by the inbound_ip in the relayed comm set - name: inbound_proto description: filter by the inbound_proto in the relayed comm set - name: inbound_port description: filter by the inbound_port in the relayed comm set - name: inbound_dns description: filter by the inbound_dns in the relayed comm set - name: outbound_ip description: filter by the outbound_ip in the relayed comm set - name: outbound_proto description: filter by the outbound_proto in the relayed comm set - name: outbound_port description: filter by the outbound_port in the relayed comm set - name: outbound_dns description: filter by the outbound_dns in the relayed_comm_set - name: dns_ip description: filter by the dns_ip in the dns_set - name: dns_request description: filter by the dns_request in the dns_set - name: resp_code description: filter by the resp_code in the dns_set - name: resp description: filter by the resp in the dns_set outputs: - contextPath: Vectra.Detections.DetectionId description: The learned hostname - contextPath: Vectra.Detections.TypeVName description: Vectra detection id - contextPath: Vectra.Detections.Category description: The detection category - contextPath: Vectra.Detections.SrcIP description: The detection source IP - contextPath: Vectra.Detections.State description: The detection state - contextPath: Vectra.Detections.TScore description: The detection tscore - contextPath: Vectra.Detections.CScore description: The detection cscore - contextPath: Vectra.Detections.TargetsKeyAsset description: Is detection targets key asset - contextPath: Vectra.Detections.Tags description: The detection tags - contextPath: Vectra.Detections.FirstTimestamp description: The detection first time stamp - contextPath: Vectra.Detections.LastTimestamp description: The detection last time stamp - contextPath: Vectra.Detections.HostID description: The detection host id description: Detection objects contain all the information related to security events detected on the network - name: vectra-detections arguments: - name: detection_id description: Filter by detection ID - name: fields description: Filters objects listed - name: page description: Page number. Possible values are a positive integer or last - name: page_size description: Page size. Possible values are a positive integer or all - name: ordering description: Orders records by last timestamp, threat score and certainty score. The default out sorts threat and certainty score in ascending order. Scores can sorted in descending order by prepending the query with “minus” symbol - name: min_id description: '>= the id provided' - name: max_id description: <= the id provided - name: state description: 'filter by state: active, inactive, ignored, ignored for all' - name: type_vname description: filter by the detection type (verbose name) - name: category description: filter by the detection category - name: src_ip description: filter by source (ip address) - name: t_score description: filter by threat score - name: t_score_gte description: filter by threat score >= the score provided - name: c_score description: filter by certainty score - name: c_score_gte description: filter by certainty score >= the score provided - name: last_timestamp description: filter by last timestamp - name: host_id description: filter by id of the host object a detection is attributed to - name: tags description: filter by a tag or a comma-separated list of tags - name: destination description: filter by destination in the detection detail set - name: proto description: filter by the protocol in the detection detail set - name: dst_port description: filter by the destination port in the detection detail set - name: inbound_ip description: filter by the inbound_ip in the relayed comm set - name: inbound_proto description: filter by the inbound_proto in the relayed comm set - name: inbound_port description: filter by the inbound_port in the relayed comm set - name: inbound_dns description: filter by the inbound_dns in the relayed comm set - name: outbound_ip description: filter by the outbound_ip in the relayed comm set - name: outbound_proto description: filter by the outbound_proto in the relayed comm set - name: outbound_port description: filter by the outbound_port in the relayed comm set - name: outbound_dns description: filter by the outbound_dns in the relayed_comm_set - name: dns_ip description: filter by the dns_ip in the dns_set - name: dns_request description: filter by the dns_request in the dns_set - name: resp_code description: filter by the resp_code in the dns_set - name: resp description: filter by the resp in the dns_set outputs: - contextPath: Vectra.Detections.DetectionId description: The learned hostname - contextPath: Vectra.Detections.TypeVName description: Vectra detection id - contextPath: Vectra.Detections.Category description: The detection category - contextPath: Vectra.Detections.SrcIP description: The detection source IP - contextPath: Vectra.Detections.State description: The detection state - contextPath: Vectra.Detections.TScore description: The detection tscore - contextPath: Vectra.Detections.CScore description: The detection cscore - contextPath: Vectra.Detections.TargetsKeyAsset description: Is detection targets key asset - contextPath: Vectra.Detections.Tags description: The detection tags - contextPath: Vectra.Detections.FirstTimestamp description: The detection first time stamp - contextPath: Vectra.Detections.LastTimestamp description: The detection last time stamp - contextPath: Vectra.Detections.HostID description: The detection host id description: Detection objects contain all the information related to security events detected on the network deprecated: true - name: vec-hosts deprecated: true arguments: - name: host_id description: Filter by host ID - name: fields description: Filters objects listed - name: page description: Page number. Possible values are a positive integer or last - name: page_size description: Page size. Possible values are a positive integer or all - name: ordering description: Orders records by last timestamp, threat score and certainty score. The default out sorts threat and certainty score in ascending order. Scores can sorted in descending order by prepending the query with “minus” symbol - name: name description: filter by name - name: state description: 'filter by state: active, inactive, suspended, ignored, ignored4all' - name: last_source description: filter by last_source (ip address) - name: t_score description: filter by threat score - name: t_score_gte description: filter by threat score >= the score provided - name: c_score description: filter by certainty score - name: c_score_gte description: filter by certainty score >= the score provided - name: last_detection_timestamp description: filter by last_detection_timestamp - name: tags description: filter by a tag or a comma-separated list of tags (returns hosts that contain any of the tags specified), e.g.tags=baz | tags=foo,bar" - name: key_assest description: 'filter by key asset: True, False' - name: mac_address description: filter by mac address outputs: - contextPath: Endpoint.Hostname description: The learned hostname - contextPath: Endpoint.VectraID description: Vectra object id - contextPath: Endpoint.State description: The state of this record - contextPath: Endpoint.IP description: Last source IP associated with this host - contextPath: Endpoint.LastDetection description: Last detection activity from this host - contextPath: Endpoint.Detection.ID description: List of Detections for Host - contextPath: Endpoint.TScore description: The current threat score correlated to this host - contextPath: Endpoint.CScore description: The current certainty score correlated to this host description: Host information includes data that correlates the host data to detected security events - name: vectra-hosts arguments: - name: host_id description: Filter by host ID - name: fields description: Filters objects listed - name: page description: Page number. Possible values are a positive integer or last - name: page_size description: Page size. Possible values are a positive integer or all - name: ordering description: Orders records by last timestamp, threat score and certainty score. The default out sorts threat and certainty score in ascending order. Scores can sorted in descending order by prepending the query with “minus” symbol - name: name description: filter by name - name: state description: 'filter by state: active, inactive, suspended, ignored, ignored4all' - name: last_source description: filter by last_source (ip address) - name: t_score description: filter by threat score - name: t_score_gte description: filter by threat score >= the score provided - name: c_score description: filter by certainty score - name: c_score_gte description: filter by certainty score >= the score provided - name: last_detection_timestamp description: filter by last_detection_timestamp - name: tags description: filter by a tag or a comma-separated list of tags (returns hosts that contain any of the tags specified), e.g.tags=baz | tags=foo,bar" - name: key_assest description: 'filter by key asset: True, False' - name: mac_address description: filter by mac address outputs: - contextPath: Endpoint.Hostname description: The learned hostname - contextPath: Endpoint.VectraID description: Vectra object id - contextPath: Endpoint.State description: The state of this record - contextPath: Endpoint.IP description: Last source IP associated with this host - contextPath: Endpoint.LastDetection description: Last detection activity from this host - contextPath: Endpoint.Detection.ID description: List of Detections for Host - contextPath: Endpoint.TScore description: The current threat score correlated to this host - contextPath: Endpoint.CScore description: The current certainty score correlated to this host description: Host information includes data that correlates the host data to detected security events deprecated: true - name: vec-settings deprecated: true arguments: [] description: The settings information includes S-series sensor and X-series configurations input by the administrator - name: vectra-settings arguments: [] description: he settings information includes S-series sensor and X-series configurations input by the administrator deprecated: true - name: vec-health deprecated: true arguments: - name: path description: the path to query description: The health configuration can be used to retrieve system health statistics such as subnet counts, traffic bandwidth, headend and sensor information - name: vectra-health arguments: - name: path description: the path to query description: The health configuration can be used to retrieve system health statistics such as subnet counts, traffic bandwidth, headend and sensor information deprecated: true - name: vec-triage deprecated: true arguments: [] outputs: - contextPath: Vectra.Rule.ID description: The record id - contextPath: Vectra.Rule.SmartCategory description: Custom Triage label used to recategorize specified detections - contextPath: Vectra.Rule.Description description: Name of Triage filter - contextPath: Vectra.Rule.Type description: Original detection type - contextPath: Vectra.Rule.Category description: Original detection category - contextPath: Vectra.Rule.Created description: The timestamp when this Triage filter was created - contextPath: Vectra.Rule.LastUpdate description: The timestamp when this Triage filter was triggered - contextPath: Vectra.Rule.Host.ID description: Host(s) that this Triage filter applies to - contextPath: Vectra.Rule.IP description: Host IP - contextPath: Vectra.Rule.Priority description: Used in ordering execution of Triage filters - contextPath: Vectra.Rule.Remote.IP description: Destination IP where this Triage filter will be applied to - contextPath: Vectra.Rule.Remote.Protocol description: Destination protocol where this Triage filter will be applied to - contextPath: Vectra.Rule.Remote.Port description: Destination port where this Triage filter will be applied to - contextPath: Vectra.Rule.Remote.DNS description: Destination FQDN where this Triage filter will apply to - contextPath: Vectra.Rule.Remote.Kerberos.Account description: Kerberos Account - contextPath: Vectra.Rule.Remote.Kerberos.Service description: Kerberos Service description: The rules branch can be used to retrieve a listing of configured Triage rules - name: vectra-triage arguments: [] outputs: - contextPath: Vectra.Rule.ID description: The record id - contextPath: Vectra.Rule.SmartCategory description: Custom Triage label used to recategorize specified detections - contextPath: Vectra.Rule.Description description: Name of Triage filter - contextPath: Vectra.Rule.Type description: Original detection type - contextPath: Vectra.Rule.Category description: Original detection category - contextPath: Vectra.Rule.Created description: The timestamp when this Triage filter was created - contextPath: Vectra.Rule.LastUpdate description: The timestamp when this Triage filter was triggered - contextPath: Vectra.Rule.Host.ID description: Host(s) that this Triage filter applies to - contextPath: Vectra.Rule.IP description: Host IP - contextPath: Vectra.Rule.Priority description: Used in ordering execution of Triage filters - contextPath: Vectra.Rule.Remote.IP description: Destination IP where this Triage filter will be applied to - contextPath: Vectra.Rule.Remote.Protocol description: Destination protocol where this Triage filter will be applied to - contextPath: Vectra.Rule.Remote.Port description: Destination port where this Triage filter will be applied to - contextPath: Vectra.Rule.Remote.DNS description: Destination FQDN where this Triage filter will apply to - contextPath: Vectra.Rule.Remote.Kerberos.Account description: Kerberos Account - contextPath: Vectra.Rule.Remote.Kerberos.Service description: Kerberos Service description: The rules branch can be used to retrieve a listing of configured Triage rules deprecated: true - name: vec-sensors deprecated: true arguments: [] outputs: - contextPath: Vectra.Sensor.ID description: Object ID - contextPath: Vectra.Sensor.Alias description: User configured alias assigned tothe sensor - contextPath: Vectra.Sensor.Location description: User configured location assigned to the sensor - contextPath: Vectra.Sensor.SerialNumber description: Serial number of the sensor - contextPath: Vectra.Sensor.LUID description: Local Unique Identifier assigned to the sensor - contextPath: Vectra.Sensor.Status description: Pairing status of the sensor - contextPath: Vectra.Sensor.CurrentVersion description: OS version currently running on the sensor - contextPath: Vectra.Sensor.OriginalVersion description: OS version originally installed on the sensor - contextPath: Vectra.Sensor.IP description: IP address of the sensor - contextPath: Vectra.Sensor.URI description: The URI of the brain the sensor is paired - contextPath: Vectra.Sensor.LastSeen description: Timestamp of the last connection by the sensor to the brain description: The sensors branch can retrieve a listing of sensors that collect and feed data to the X-series - name: vectra-sensors arguments: [] outputs: - contextPath: Vectra.Sensor.ID description: Object ID - contextPath: Vectra.Sensor.Alias description: User configured alias assigned tothe sensor - contextPath: Vectra.Sensor.Location description: User configured location assigned to the sensor - contextPath: Vectra.Sensor.SerialNumber description: Serial number of the sensor - contextPath: Vectra.Sensor.LUID description: Local Unique Identifier assigned to the sensor - contextPath: Vectra.Sensor.Status description: Pairing status of the sensor - contextPath: Vectra.Sensor.CurrentVersion description: OS version currently running on the sensor - contextPath: Vectra.Sensor.OriginalVersion description: OS version originally installed on the sensor - contextPath: Vectra.Sensor.IP description: IP address of the sensor - contextPath: Vectra.Sensor.URI description: The URI of the brain the sensor is paired - contextPath: VectraSensor.LastSeen description: Timestamp of the last connection by the sensor to the brain description: The sensors branch can retrieve a listing of sensors that collect and feed data to the X-series deprecated: true - name: vec-get-host-by-id deprecated: true arguments: - name: host_id required: true default: true description: The id of the required host outputs: - contextPath: Endpoint.Hostname description: The learned hostname - contextPath: Endpoint.VectraID description: Vectra object id - contextPath: Endpoint.State description: The state of this record - contextPath: Endpoint.IP description: Last source IP associated with this host - contextPath: Endpoint.Vectra.LastDetection description: Last detection activity from this host - contextPath: Endpoint.Vectra.DetectionID description: List of Detections for Host - contextPath: Endpoint.Vectra.TScore description: The current threat score correlated to this host - contextPath: Endpoint.Vectra.CScore description: The current certainty score correlated to this host description: Get host by id - name: vec-get-detetctions-by-id deprecated: true arguments: - name: detection_id description: The id of the required detection description: Get detections by host id isfetch: true tests: - No tests (deprecated) fromversion: 5.0.0 deprecated: true