Vectra_Detect

This integration allows to create incidents based on Vectra Accounts/Hosts/Detections objects.

Network Security · Vectra AI

Configuration parameters

  • server_fqdn — Vectra Detect FQDN or IP (required)
  • authentication_type — Authentication Type
  • credentials — API Token
  • oauth_credentials — Client ID
  • insecure — Trust any certificate (not secure)
  • use_proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First fetch timestamp
  • mirror_direction — Mirroring Direction
  • refetch_closed_incidents — Re-Fetch closed incidents via mirroring
  • note_tag — Mirror tag for notes
  • fetch_entity_types — Entity types to fetch
  • tags — Tags
  • detection_category — Detection Category
  • detection_type — Detection Type
  • hosts_fetch_query — Hosts fetch query
  • accounts_fetch_query — Accounts fetch query
  • detections_fetch_query — Detections fetch query
  • max_fetch — Max created incidents per fetch
  • look_back — Advanced: Minutes to look back when fetching
  • fetch_escalated_accounts_and_hosts — Advanced: Fetch escalated Accounts and Hosts
  • create_multiple_incidents_by_timestamp — Re-Fetch Account/Host entity and Detection for new activity/event

Commands (47)

  • vectra-account-add-tags

    Add tags to an Account.

  • vectra-account-del-tags

    Delete tags from an Account.

  • vectra-account-describe

    Returns a single Account details.

  • vectra-account-markall-detections-asclosed

    Mark active detections as closed by providing the ID of the account in the argument.

  • vectra-account-markall-detections-asfixed

    Mark active detections as fixed by providing the ID of the account in the argument.

  • vectra-account-note-add

    Add a note to the account.

  • vectra-account-note-list

    List all notes of the specific account.

  • vectra-account-note-remove

    Remove a note from the account.

  • vectra-account-note-update

    Update a note in the account.

  • vectra-account-tag-list

    Returns a list of tags for a specified account.

  • vectra-assignment-assign

    Assigns an Account/Host entity to a Vectra User for investigation. If an assignment already exists on this entity, it will be reassigned.

  • vectra-assignment-describe

    Returns a single assignment details.

  • vectra-assignment-resolve

    Resolves an assignment by selecting resolution scheme. Could be 'resolving only' or 'resolving by filtering detections'.

  • vectra-detection-add-tags

    Add tags to a Detection.

  • vectra-detection-del-tags

    Delete tags from a Detection.

  • vectra-detection-describe

    Returns a single detection details.

  • vectra-detection-get-pcap

    Returns a Detection's PCAP file (if available).

  • vectra-detection-markasfixed

    Marks/Unmarks a Detection as fixed by providing the Detection ID.

  • vectra-detection-note-add

    Add a note to the detection.

  • vectra-detection-note-list

    List all notes of the specific detection.

  • vectra-detection-note-remove

    Remove a note from the detection.

  • vectra-detection-note-update

    Update a note in the detection.

  • vectra-detection-tag-list

    Returns a list of tags for a specified detection.

  • vectra-detections-mark-asclosed

    Mark detections as closed with provided detection IDs in the argument.

  • vectra-detections-mark-asopen

    Open detections with provided detection IDs in the argument.

  • vectra-group-assign

    Assign members to the specified group.

  • vectra-group-list

    Returns a list of all groups.

  • vectra-group-unassign

    Unassign members from the specified group.

  • vectra-host-add-tags

    Add tags to an Host.

  • vectra-host-del-tags

    Delete tags from an Host.

  • vectra-host-describe

    Returns a single Host details.

  • vectra-host-markall-detections-asclosed

    Mark active detections as closed by providing the ID of the host in the argument.

  • vectra-host-markall-detections-asfixed

    Mark active detections as fixed by providing ID of the host in the argument.

  • vectra-host-note-add

    Add a note to the host.

  • vectra-host-note-list

    List all notes of the specific host.

  • vectra-host-note-remove

    Remove a note from the host.

  • vectra-host-note-update

    Update a note in the host.

  • vectra-host-tag-list

    Returns a list of tags for a specified host.

  • vectra-outcome-create

    Creates a new assignment outcome.

  • vectra-outcome-describe

    Returns a single outcome details.

  • vectra-search-accounts

    Returns a list of Account objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.

  • vectra-search-assignments

    Return a list of assignments. By default already resolved assignment are not returned.

  • vectra-search-detections

    Returns a list of Detection objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.

  • vectra-search-hosts

    Returns a list of Host objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.

  • vectra-search-outcomes

    Returns a list of assignment outcomes.

  • vectra-search-users

    Returns a list of Vectra Users. All search attributes will be cumulative.

  • vectra-user-describe

    Returns a single Vectra User details.