Vectra_Detect

This integration allows to create incidents based on Vectra Accounts/Hosts/Detections objects.

Network Security · Vectra AI

Details

ID	`Vectra_Detect`
Provider	Vectra AI
Category	Network Security
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This integration allows to create incidents based on Vectra Accounts/Hosts/Detections objects.
This integration was integrated and tested with version 7.1 of Vectra Detect

Use cases

Fetch accounts, hosts and detections from Vectra Detect.
Bi-Directional mirroring for accounts and hosts.
List and describe accounts, hosts, detections, and users.
List, describe, create, and resolve assignments for accounts and hosts.
List, describe, and create assignment outcomes.
List, create, update, and delete notes for accounts, hosts, and detections.
List, create, and remove tags for accounts, hosts, and detections.
List, assign, and unassign members in group.
Mark and unmark detection as fixed.
Mark all detections as fixed for accounts and hosts.
Get detection’s PCAP file.
Clean up all incidents in Cortex XSOAR by closing duplicate incidents from Vectra Detect.

Configure Vectra Detect on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Vectra Detect.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Vectra Detect FQDN or IP	Enter the FQDN or IP to reach the Vectra Detect API. (e.g. “my-vectra-box.local” or “192.168.1.1”)	True
Authentication Type	Select the authentication type (Default - API Token).	False
API Token	Enter the API token that can be retrieved from the Vectra UI > My Profile > General (tab) > API Token. You can also use the XSOAR credentials wallet to store it. In that case, the token should be the password.	False
Client ID and Client Secret Key	Enter the Client ID and Client Secret Key that can be retrieved from the Vectra UI > Manage > API Clients. You can also use the XSOAR credentials wallet to store it.	False
Trust any certificate (not secure)	When checked, no SSL certificates check will be done when interacting with the Vectra Detect API. It’s insecure. (Default - unchecked)	False
Use system proxy settings	Use the system proxy settings to reach with the Vectra Detect API.	False
Fetch incidents		False
Incident type		False
First fetch timestamp	The date or relative timestamp from which to begin fetching entities. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2024, 01 Aug 2024 04:45:33, 2024-07-17T14:05:44Z. (default - 7 days)	False
Mirroring Direction	The mirroring direction in which to mirror the account and host. You can mirror “Incoming” (from Vectra to Cortex XSOAR), “Outgoing” (from Cortex XSOAR to Vectra), or in both directions.	False
Re-Fetch closed incidents via mirroring	If selected, new incidents will be created (via Outgoing Mirroring). If not selected, it reopens previously closed incidents (via Incoming Mirroring). Note: This flow is triggered only when the relevant account or host is still active and the previously fetched incident is closed.	False
Mirror tag for notes	The tag value should be used to mirror the account and host note by adding the same tag in the notes.	False
Entity types to fetch	Choose what to fetch - Accounts and/or Hosts and/or Detections. (Default - Accounts,Hosts)	False
Tags	Only Accounts or Hosts that contain any of the tags specified will be fetched. Note: For the partial match of the tag, use ‘’ at the start and end of word (Only a single word is allowed). Ex. MDR*.	False
Detection Category	Filter the detections belonging to a specified category displayed as part of layout. Note: This filter applies on the ‘Vectra Account’ and ‘Vectra Host’ incident type.	False
Detection Type	Filter the detections belonging to a specified type displayed as part of layout. Note: This filter applies on the ‘Vectra Account’ and ‘Vectra Host’ incident type.
Hosts fetch query	Only “active” Hosts matching this fetch query will be fetched. Will be used only if “Hosts” is selected in the “Entity types to fetch”. (default - host.threat:>=50)	False
Accounts fetch query	Only “active” Accounts matching this fetch query will be fetched. Will be used only if “Accounts” is selected in the “Entity types to fetch”. (default - account.threat:>=50)	False
Detections fetch query	Only “active” Detections matching this fetch query will be fetched. Will be used only if “Detections” is selected in the “Entity types to fetch”. (default - detection.threat:>=50 AND detection.certainty:>=50)	False
Max created incidents per fetch	The maximum number of new incidents to create per fetch. This value would be split between selected “Entity types to fetch”. If the value is greater than 200, it will be considered as 200. The maximum is 200. (Default - 50)	False
Advanced: Minutes to look back when fetching	Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created.	False
Advanced: Fetch escalated Accounts and Hosts	Use this parameter to fetch escalated Accounts and Hosts. Note: If this parameter is set to True, it will fetch Accounts and Hosts that have been updated based on the provided filter parameters, even if their detection timestamps are older than the first fetch time.	False
Re-Fetch Account/Host entity and Detection for new activity/event	Whether to create multiple incidents for the same entity (Account or Host) or Detection if new detection activity occurs for the entity (Account or Host) or a new event is detected for the detection.	False

Click Test to validate the URLs, token, and connection.

Configuration for fetching Vectra Account or Vectra Host as a Cortex XSOAR incident

To fetch Vectra Account or Vectra Host as a Cortex XSOAR incident:

Select Fetches incidents.
Under Classifier, select “Vectra Detect”.
Under Incident type, select “N/A”.
Under Mapper (incoming), select “Vectra Detect - Incoming Mapper” for default mapping.
Select the “Authentication Type” (Default - API Token).
Enter connection parameters. (Vectra Detect FQDN or IP, API Token or Client ID and Client Secret Key)
Select SSL certificate validation and Proxy if required.
Update “Max created incidents per fetch” & “First fetch timestamp” based on your requirements.
Select the Incident Mirroring Direction:
1. Incoming - Mirrors changes from the Vectra into the Cortex XSOAR incident.
2. Outgoing - Mirrors changes from the Cortex XSOAR incident to the Vectra.
3. Incoming And Outgoing - Mirrors changes both Incoming and Outgoing directions on incidents.
Check the “Re-Fetch closed incidents via mirroring” option if you want to prevent reopening of closed incidents and refetch them via mirroring on modification of the Vectra Account or Vectra Host.
Enter the relevant tag name for mirror notes.
Note: This value is mapped to the dbotMirrorTags incident field in Cortex XSOAR, which defines how Cortex XSOAR handles notes when you tag them in the War Room. This is required for mirroring notes from Cortex XSOAR to Vectra.
Provide the filter parameter “Tags”, to filter entities by specific tag/s for fetch type account and host.
Provide the filter parameter “Detection Category” and “Detection Type”, to filter detections by the specified category and type for fetch type account and host.
Provide the “Minutes to look back when fetching” parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created.
Check the “Fetch escalated Accounts and Hosts” option to fetch escalated Accounts and Hosts that have been updated based on the provided filter parameters, even if their detection timestamps are older than the first fetch time.
Check the “Re-Fetch Account/Host entity and Detection for new activity/event” option if you want multiple Cortex XSOAR incidents to be created for the same Entity (Account or Host) or Detection whenever new detection activity is recorded. Disable this option if you want only one incident per Entity (Account or Host) or Detection regardless of ongoing activity.

Notes for mirroring:

The mirroring is strictly tied to incident types “Vectra Account” and “Vectra Host”, as well as the incoming mapper “Vectra Detect - Incoming Mapper”. If you want to change or use a custom incident type/mapper, ensure that related changes are also present.
The mirroring settings apply only for incidents that are fetched after applying the settings.
Any tags removed from the Vectra Account or Vectra Host will not be removed in the Cortex XSOAR incident, as Cortex XSOAR doesn’t allow the removal of the tags field via the backend. However, tags removed from the Cortex XSOAR incident UI will be removed from the Vectra Account or Vectra Host.
New notes from the Cortex XSOAR incident will be created as notes in the Vectra Account or Vectra Host. Updates to existing notes in the Cortex XSOAR incident will not be reflected in the Vectra Account or Vectra Host.
New notes from the Vectra Account or Vectra Host will be created as notes in the Cortex XSOAR incident. Updates to existing notes in the Vectra Account or Vectra Host will create new notes in the Cortex XSOAR incident.
If a closed Cortex XSOAR incident is tied to a specific Vectra Account or Vectra Host and new detections for that Vectra Account or Vectra Host arise or existing detections become active again:
- If “Re-Fetch closed Incidents while Mirroring” checkbox is not selected and “Incoming Mirroring” is enabled, the incident will be automatically reopened.
- If “Re-Fetch closed Incidents while Mirroring” checkbox is selected and “Outgoing Mirroring” is enabled, a new incident will be created for the Vectra Account or Vectra Host.
When a Cortex XSOAR incident is closed but there are still active detections on the Vectra side, and the Vectra Account or Vectra Host is subsequently updated:
- If “Re-Fetch closed Incidents while Mirroring” checkbox is not selected and “Incoming Mirroring” is enabled, the corresponding XSOAR incident for that Vectra Account or Vectra Host will be reopened.
- If “Re-Fetch closed Incidents while Mirroring” checkbox is selected and “Outgoing Mirroring” is enabled, a new incident will be created for the Vectra Account or Vectra Host.
If a Cortex XSOAR incident is reopened and the corresponding entity has an assignment in Vectra, the assignment will be removed from Vectra.
If you want to use the mirror mechanism and you’re using custom mappers, then the incoming mapper must contain the following fields: dbotMirrorDirection, dbotMirrorId, dbotMirrorInstance, and dbotMirrorTags.
To use a custom mapper, you must first duplicate the mapper and update the fields in the copy of the mapper. (Refer to the “Create a custom mapper consisting of the default Vectra Detect - Incoming Mapper” section for more information.)
Following new fields are introduced in the response of the incident to enable the mirroring:
- mirror_direction: This field determines the mirroring direction for the incident. It is a required field for Cortex XSOAR to enable mirroring support.
- mirror_tags: This field determines what would be the tag needed to mirror the Cortex XSOAR entry out to Vectra. It is a required field for XSOAR to enable mirroring support.
- mirror_instance: This field determines from which instance the Cortex XSOAR incident was created. It is a required field for Cortex XSOAR to enable mirroring support.

Cleanup Duplicate Incidents

Use the Close All Duplicate XSOAR Incidents - Vectra Detect playbook to clean up duplicate incidents. You can use VectraDetectCloseDuplicateIncidents script individually to clean up duplicate incidents.
You can also schedule a job with Close All Duplicate XSOAR Incidents - Vectra Detect playbook in Cortex XSOAR to clean up incidents periodically. Refer to this Cortex XSOAR documentation for more information.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

vectra-search-accounts

Returns a list of Account objects. All search attributes will be cumulative unless you’re using the search_query_only one, in that case, only this one will be taken into account.

Base Command

vectra-search-accounts

Input

Argument Name	Description	Required
min_id	Returns Accounts with an ID greater than or equal to the specified ID.	Optional
max_id	Returns Accounts with an ID less than or equal to the specified ID.	Optional
min_threat	Returns Accounts with a threat score greater than or equal to the specified score.	Optional
max_threat	Returns Accounts with a threat score less than or equal to the specified score.	Optional
min_certainty	Returns Accounts with a certainty score greater than or equal to the specified score.	Optional
max_certainty	Returns Accounts with a certainty score less than or equal to the specified score.	Optional
state	Filters by state (‘active’, ‘inactive’). Possible values are: active, inactive.	Optional
search_query	Search query in Lucene query syntax.	Optional
search_query_only	Use specifically this search query. Compared to “search_query” where default arguments are appended.	Optional
min_privilege_level	Returns entries with a privilege level greater than or equal to the specified score.	Optional
max_privilege_level	Returns entries with a privilege level greater than or equal to the specified score.	Optional
privilege_category	Filters by the privilege category (“low”, “medium”, “high”) provided.	Optional
tags	Filters by a tag or a comma-separated list tags.	Optional

Context Output

Path	Type	Description
Vectra.Account.Assignee	String	Vectra user account this Account is assigned to
Vectra.Account.AssignedDate	String	Assignment date
Vectra.Account.CertaintyScore	Number	Account certainty score
Vectra.Account.ID	Number	Account ID (unique)
Vectra.Account.LastDetectionTimestamp	String	Last time a detection linked to this account has been seen
Vectra.Account.PrivilegeLevel	Number	Account privilege level (from 1 to 10)
Vectra.Account.PrivilegeCategory	String	Account privilege category (Either ‘Low’, ‘Medium’ or ‘High’ - Privilege levels of 1-2 > ‘Low’, 3-7 > ‘Medium’, 8-10 > ‘High’)
Vectra.Account.Severity	String	Account severity according to scores (‘Low’, ‘Medium’, ‘High’, ‘Critical’)
Vectra.Account.State	String	Account state (‘active’, ‘inactive’)
Vectra.Account.Tags	String	Account tags
Vectra.Account.ThreatScore	Number	Account threat score
Vectra.Account.Type	String	Account type (‘kerberos’ or ‘o365’)
Vectra.Account.URL	String	Account URL to pivot to Vectra UI
Vectra.Account.Name	String	The username of the account

vectra-search-hosts

Returns a list of Host objects. All search attributes will be cumulative unless you’re using the search_query_only one, in that case, only this one will be taken into account.

Base Command

vectra-search-hosts

Input

Argument Name	Description	Required
min_id	Returns Hosts with an ID greater than or equal to the specified ID.	Optional
max_id	Returns Hosts with an ID less than or equal to the specified ID.	Optional
min_threat	Returns Hosts with a threat score greater than or equal to the specified score.	Optional
max_threat	Returns Hosts with a threat score less than or equal to the specified score.	Optional
min_certainty	Returns Hosts with a certainty score greater than or equal to the specified score.	Optional
max_certainty	Returns Hosts with a certainty score less than or equal to the specified score.	Optional
state	Filters by state (‘active’, ‘inactive’). Possible values are: active, inactive.	Optional
search_query	Search query in Lucene query syntax.	Optional
search_query_only	Use specifically this search query. Compared to “search_query” where default arguments are appended.	Optional

Context Output

Path	Type	Description
Vectra.Host.Assignee	String	Vectra user account this Host is assigned to
Vectra.Host.AssignedDate	String	Assignment date
Vectra.Host.CertaintyScore	Number	Host certainty score
Vectra.Host.HasActiveTraffic	Boolean	Whether this Host has active traffic
Vectra.Host.Hostname	String	Host name
Vectra.Host.ID	Number	Host ID (Unique)
Vectra.Host.IP	String	Host IP address
Vectra.Host.IsKeyAsset	Boolean	Whether this Host is seen as a key asset
Vectra.Host.IsTargetingKeyAsset	Boolean	Whether this Host is targeting a key asset
Vectra.Host.PrivilegeLevel	Number	Host privilege level (from 1 to 10)
Vectra.Host.PrivilegeCategory	String	Host privilege category. (Either ‘Low’, ‘Medium’ or ‘High’ - Privilege levels of 1-2 > ‘Low’, 3-7 > ‘Medium’, 8-10 > ‘High’)
Vectra.Host.ProbableOwner	String	Host probable owner
Vectra.Host.SensorLUID	String	Sensor LUID that saw this Host
Vectra.Host.SensorName	String	Sensor Name that saw this Host
Vectra.Host.Sensor	String	Sensor details that have seen this Host
Vectra.Host.Severity	String	Host severity according to scores (‘Low’, ‘Medium’, ‘High’, ‘Critical’)
Vectra.Host.State	String	Host state (‘active’, ‘inactive’)
Vectra.Host.Tags	String	Host tags
Vectra.Host.ThreatScore	Number	Host threat score
Vectra.Host.URL	String	Host URL to pivot to Vectra UI

vectra-search-detections

Returns a list of Detection objects. All search attributes will be cumulative unless you’re using the search_query_only one, in that case, only this one will be taken into account.

Base Command

vectra-search-detections

Input

Argument Name	Description	Required
min_id	Returns Detections with an ID greater than or equal to the specified ID.	Optional
max_id	Returns Detections with an ID less than or equal to the specified ID.	Optional
min_threat	Returns Detections with a threat score greater than or equal to the specified score.	Optional
max_threat	Returns Detections with a threat score less than or equal to the specified score.	Optional
min_certainty	Returns Detections with a certainty score greater than or equal to the specified score.	Optional
max_certainty	Returns Detections with a certainty score less than or equal to the specified score.	Optional
state	Filters by state (‘active’, ‘inactive’). Possible values are: active, inactive.	Optional
search_query	Search query in Lucene query syntax.	Optional
search_query_only	Use specifically this search query. Compared to “search_query” where default arguments are appended.	Optional

Context Output

Path	Type	Description
Vectra.Detection.Assignee	String	Vectra user account this detection is assigned to
Vectra.Detection.AssignedDate	String	Assignment date
Vectra.Detection.Category	String	Detection category (Lateral, Exfil, …)
Vectra.Detection.CertaintyScore	Number	Detection certainty score
Vectra.Detection.Description	String	Detection description
Vectra.Detection.DestinationIPs	String	Detection destination IPs
Vectra.Detection.DestinationPorts	String	Detection destination ports
Vectra.Detection.FirstTimestamp	String	First time this detection has been seen
Vectra.Detection.ID	Number	Detection ID (unique)
Vectra.Detection.IsTargetingKeyAsset	Boolean	Whether this detection is targeting a key asset
Vectra.Detection.LastTimestamp	String	Last time this detection has been seen
Vectra.Detection.Name	String	The name of the detection. Would be a user defined name if this detection is triaged or the default type name instead
Vectra.Detection.Severity	String	Detection severity according to scores (‘Low’, ‘Medium’, ‘High’, ‘Critical’)
Vectra.Detection.SensorLUID	String	Sensor LUID that saw this detection
Vectra.Detection.SensorName	String	Sensor name that saw this detection.
Vectra.Detection.SourceAccountID	String	Account ID relating to this detection
Vectra.Detection.SourceHostID	String	Host ID relating to this detection
Vectra.Detection.SourceIP	String	Source IP relating to this detection
Vectra.Detection.State	String	Detection state (‘active’, ‘inactive’)
Vectra.Detection.Tags	String	Detection tags
Vectra.Detection.ThreatScore	Number	Detection threat score
Vectra.Detection.TriageRuleID	String	Triage rule ID related to this detection
Vectra.Detection.Type	String	Detection type (Brute Force, Port Sweep, …)
Vectra.Detection.URL	String	Detection URL to pivot to Vectra UI

vectra-search-assignments

Return a list of assignments. By default already resolved assignment are not returned.

Base Command

vectra-search-assignments

Input

Argument Name	Description	Required
account_ids	Filters by accounts IDs.	Optional
assignee_ids	Filters by assignees IDs.	Optional
host_ids	Filters by hosts IDs.	Optional
outcome_ids	Filters by outcomes IDs.	Optional
resolved	Filters by resolution state.	Optional

Context Output

Path	Type	Description
Vectra.Assignment.AccountID	Number	Account ID this assignment is linked to
Vectra.Assignment.AssignedBy	String	Who lastly assigned this assignment
Vectra.Assignment.AssignedDate	String	When this assignment was lastly assigned
Vectra.Assignment.AssignedTo	String	To who this assignment is assigned
Vectra.Assignment.HostID	String	Host ID this assignment is linked to
Vectra.Assignment.ID	Number	Assignment ID (unique)
Vectra.Assignment.IsResolved	Boolean	Is this assignment resolved
Vectra.Assignment.OutcomeCategory	String	Assignment Outcome category
Vectra.Assignment.OutcomeTitle	String	Assignment Outcome title
Vectra.Assignment.TriagedDetections	String	List of Detection that have been triaged with the resolution
Vectra.Assignment.TriagedAs	String	Name of the triage rule if any
Vectra.Assignment.ResolvedBy	String	Who resolved this assignment
Vectra.Assignment.ResolvedDate	string	When this assignment was resolved

vectra-search-users

Returns a list of Vectra Users. All search attributes will be cumulative.

Base Command

vectra-search-users

Input

Argument Name	Description	Required
username	Filters by user name.	Optional
role	Filters by user role.	Optional
type	Filters by type (‘Local’, ‘SAML’, …). Possible values are: local, SAML.	Optional
last_login_datetime	Filters for Users that logged in since the given datetime.	Optional

Context Output

Path	Type	Description
Vectra.User.Email	String	User’s email address
Vectra.User.ID	Number	User ID (unique)
Vectra.User.Role	String	User’s role
Vectra.User.Type	String	User type (‘Local’, ‘SAML’, …)
Vectra.User.Username	String	Username
Vectra.User.LastLoginDate	String	User’s last login datetime

vectra-search-outcomes

Returns a list of assignment outcomes.

Base Command

vectra-search-outcomes

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
Vectra.Outcome.IsBuiltIn	String	Is this Outcome a builtin Outcome
Vectra.Outcome.Category	String	Outcome’s category (‘False Positive’, ‘Benign True Positive’, ‘Malicious True Positive’)
Vectra.Outcome.ID	Number	Outcome ID (unique)
Vectra.Outcome.Title	String	Outcome title

vectra-account-describe

Returns a single Account details

Base Command

vectra-account-describe

Input

Argument Name	Description	Required
id	Account ID you want to get details on.	Optional

Context Output

Path	Type	Description
Vectra.Account.Assignee	String	Vectra user account this Account is assigned to
Vectra.Account.AssignedDate	String	Assignment date
Vectra.Account.CertaintyScore	Number	Account certainty score
Vectra.Account.ID	Number	Account ID (unique)
Vectra.Account.LastDetectionTimestamp	String	Last time a detection linked to this account has been seen
Vectra.Account.PrivilegeLevel	Number	Account privilege level (from 1 to 10)
Vectra.Account.PrivilegeCategory	String	Account privilege category (Either ‘Low’, ‘Medium’ or ‘High’ - Privilege levels of 1-2 > ‘Low’, 3-7 > ‘Medium’, 8-10 > ‘High’)
Vectra.Account.Severity	String	Account severity according to scores (‘Low’, ‘Medium’, ‘High’, ‘Critical’)
Vectra.Account.State	String	Account state (‘active’, ‘inactive’)
Vectra.Account.Tags	String	Account tags
Vectra.Account.ThreatScore	Number	Account threat score
Vectra.Account.Type	String	Account type (‘kerberos’ or ‘o365’)
Vectra.Account.URL	String	Account URL to pivot to Vectra UI
Vectra.Account.Name	String	The username of the account

vectra-account-add-tags

Add tags to an Account

Base Command

vectra-account-add-tags

Input

Argument Name	Description	Required
id	Account ID you want to add tags on.	Optional
tags	The tags list (comma separated).	Optional

Context Output

There is no context output for this command.

vectra-account-del-tags

Delete tags from an Account

Base Command

vectra-account-del-tags

Input

Argument Name	Description	Required
id	Account ID you want to del tags from.	Optional
tags	The tags list (comma separated).	Optional

Context Output

There is no context output for this command.

vectra-account-tag-list

Returns a list of tags for a specified account.

Base Command

vectra-account-tag-list

Input

Argument Name	Description	Required
id	Specify the ID of the account.	Required

Context Output

Path	Type	Description
Vectra.Account.ID	Number	ID of the account associated with the tags.
Vectra.Account.Tags	String	Tags associated to the account.

Command example

!vectra-account-tag-list id="2"

Context Example

{
    "Vectra.Account": {
        "ID": 2,
        "Tags": [
            "note",
            "tag_from_xsoar",
            "tag_from_vectra"
        ]
    }
}

Human Readable Output

List of tags: note, tag_from_xsoar, tag_from_vectra

vectra-account-note-add

Add a note to the account.

Base Command

vectra-account-note-add

Input

Argument Name	Description	Required
account_id	Specify the ID of the account.	Required
note	Note to be added in the specified account_id.	Required

Context Output

Path	Type	Description
Vectra.Account.Notes.account_id	Number	ID of the account associated with the note.
Vectra.Account.Notes.note_id	Number	ID of the note.
Vectra.Account.Notes.date_created	Date	Date when the note was created.
Vectra.Account.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Account.Notes.created_by	String	User who created the note.
Vectra.Account.Notes.modified_by	String	User who last modified the note.
Vectra.Account.Notes.note	String	Content of the note.

Command example

!vectra-account-note-add account_id="2" note="test note"

Context Example

{
    "Vectra.Account.Notes": {
        "date_created": "2024-07-10T07:30:58.574942Z",
        "created_by": "xsoar",
        "note": "test note",
        "note_id": 1959,
        "account_id": 2
    }
}

Human Readable Output

The note has been successfully added to the account

Returned Note ID: 1959

vectra-account-note-update

Update a note in the account.

Base Command

vectra-account-note-update

Input

Argument Name	Description	Required
account_id	Specify the ID of the account.	Required
note_id	Specify the ID of the note. Note: Use the vectra-account-note-list command to get note_id.	Required
note	Note to be updated for the specified note_id.	Required

Context Output

Path	Type	Description
Vectra.Account.Notes.account_id	Number	ID of the account associated with the note.
Vectra.Account.Notes.note_id	Number	ID of the note.
Vectra.Account.Notes.date_created	Date	Date when the note was created.
Vectra.Account.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Account.Notes.created_by	String	User who created the note.
Vectra.Account.Notes.modified_by	String	User who last modified the note.
Vectra.Account.Notes.note	String	Content of the note.

Command example

!vectra-account-note-update account_id="2" note_id="1959" note="updated test note"

Context Example

{
    "Vectra.Account.Notes": {
        "date_created": "2024-07-10T07:30:58.574942Z",
        "date_modified": "2024-07-12T06:42:29.546835Z",
        "created_by": "xsoar",
        "modified_by": "xsoar",
        "note": "updated test note",
        "note_id": 1959,
        "account_id": 2
    }
}

Human Readable Output

The note has been successfully updated in the account

vectra-account-note-remove

Remove a note from the account.

Base Command

vectra-account-note-remove

Input

Argument Name	Description	Required
account_id	Specify the ID of the account.	Required
note_id	Specify the ID of the note. Note: Use the vectra-account-note-list command to get note_id.	Required

Context Output

There is no context output for this command.

Command example

!vectra-account-note-remove account_id="2" note_id="1959"

Human Readable Output

The note has been successfully removed from the account

vectra-account-note-list

List all notes of the specific account.

Base Command

vectra-account-note-list

Input

Argument Name	Description	Required
account_id	Specify the ID of the account.	Required

Context Output

Path	Type	Description
Vectra.Account.Notes.account_id	Number	ID of the account associated with the note.
Vectra.Account.Notes.note_id	Number	ID of the note.
Vectra.Account.Notes.date_created	Date	Date when the note was created.
Vectra.Account.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Account.Notes.created_by	String	User who created the note.
Vectra.Account.Notes.modified_by	String	User who last modified the note.
Vectra.Account.Notes.note	String	Content of the note.

Command example

!vectra-account-note-list account_id="2"

Context Example

{
    "Vectra.Account.Notes": [
        {
            "date_created": "2024-07-10T05:40:31Z",
            "date_modified": "2024-07-16T12:56:30Z",
            "created_by": "xsoar",
            "modified_by": "xsoar",
            "note": "updated_note",
            "note_id": 1959,
            "account_id": 2
        },
        {
            "date_created": "2024-07-08T07:11:49Z",
            "created_by": "xsoar",
            "note": "Here comes your note TEST",
            "note_id": 1906,
            "account_id": 2
        }
    ]
}

Human Readable Output

Notes Table

Note ID Note Created By Created Date Modified By Modified Date

1959 updated_note xsoar 2024-07-10T05:40:31Z xsoar 2024-07-16T12:56:30Z

1906 Here comes your note TEST xsoar 2024-07-08T07:11:49Z

Note ID	Note	Created By	Created Date	Modified By	Modified Date
1959	updated_note	xsoar	2024-07-10T05:40:31Z	xsoar	2024-07-16T12:56:30Z
1906	Here comes your note TEST	xsoar	2024-07-08T07:11:49Z

vectra-account-markall-detections-asfixed

Mark active detections as fixed by providing the ID of the account in the argument.

Base Command

vectra-account-markall-detections-asfixed

Input

Argument Name	Description	Required
account_id	Provide an account ID.	Required

Context Output

There is no context output for this command.

Command example

!vectra-account-markall-detections-asfixed account_id=109

Human Readable Output

The active detections of the provided account have been successfully marked as fixed.

vectra-account-markall-detections-asclosed

Mark active detections as closed by providing the ID of the account in the argument.

Base Command

vectra-account-markall-detections-asclosed

Input

Argument Name	Description	Required
account_id	Provide an account ID.	Required
close_reason	Provide the close reason. Possible values are: benign, remediated.	Required

Context Output

There is no context output for this command.

Command example

!vectra-account-markall-detections-asclosed account_id=108 close_reason=benign

Human Readable Output

The active detections of the provided account have been successfully closed as benign

vectra-host-describe

Returns a single Host details

Base Command

vectra-host-describe

Input

Argument Name	Description	Required
id	Host ID you want to get details on.	Optional

Context Output

Path	Type	Description
Vectra.Host.Assignee	String	Vectra user account this Host is assigned to
Vectra.Host.AssignedDate	String	Assignment date
Vectra.Host.CertaintyScore	Number	Host certainty score
Vectra.Host.HasActiveTraffic	Boolean	Whether this Host has active traffic
Vectra.Host.Hostname	String	Host name
Vectra.Host.ID	Number	Host ID (Unique)
Vectra.Host.IP	String	Host IP address
Vectra.Host.IsKeyAsset	Boolean	Whether this Host is seen as a key asset
Vectra.Host.IsTargetingKeyAsset	Boolean	Whether this Host is targeting a key asset
Vectra.Host.PrivilegeLevel	Number	Host privilege level (from 1 to 10)
Vectra.Host.PrivilegeCategory	String	Host privilege category. (Either ‘Low’, ‘Medium’ or ‘High’ - Privilege levels of 1-2 > ‘Low’, 3-7 > ‘Medium’, 8-10 > ‘High’)
Vectra.Host.ProbableOwner	String	Host probable owner
Vectra.Host.SensorLUID	String	Sensor LUID that saw this Host
Vectra.Host.SensorName	String	Sensor Name that saw this Host
Vectra.Host.Sensor	String	Sensor details that have seen this Host
Vectra.Host.Severity	String	Host severity according to scores (‘Low’, ‘Medium’, ‘High’, ‘Critical’)
Vectra.Host.State	String	Host state (‘active’, ‘inactive’)
Vectra.Host.Tags	String	Host tags
Vectra.Host.ThreatScore	Number	Host threat score
Vectra.Host.URL	String	Host URL to pivot to Vectra UI

vectra-host-add-tags

Add tags to an Host

Base Command

vectra-host-add-tags

Input

Argument Name	Description	Required
id	Host ID you want to add tags on.	Optional
tags	The tags list (comma separated).	Optional

Context Output

There is no context output for this command.

vectra-host-del-tags

Delete tags from an Host

Base Command

vectra-host-del-tags

Input

Argument Name	Description	Required
id	Host ID you want to del tags from.	Optional
tags	The tags list (comma separated).	Optional

Context Output

There is no context output for this command.

vectra-host-tag-list

Returns a list of tags for a specified host.

Base Command

vectra-host-tag-list

Input

Argument Name	Description	Required
id	Specify the ID of the host.	Required

Context Output

Path	Type	Description
Vectra.Host.ID	Number	ID of the host associated with the tags.
Vectra.Host.Tags	String	Tags associated to the host.

Command example

!vectra-host-tag-list id="2"

Context Example

{
    "Vectra.Host": {
        "ID": 2,
        "Tags": [
            "note",
            "tag_from_xsoar",
            "tag_from_vectra"
        ]
    }
}

Human Readable Output

List of tags: note, tag_from_xsoar, tag_from_vectra

vectra-host-note-add

Add a note to the host.

Base Command

vectra-host-note-add

Input

Argument Name	Description	Required
host_id	Specify the ID of the host.	Required
note	Note to be added in the specified host_id.	Required

Context Output

Path	Type	Description
Vectra.Host.Notes.host_id	Number	ID of the host associated with the note.
Vectra.Host.Notes.note_id	Number	ID of the note.
Vectra.Host.Notes.date_created	Date	Date when the note was created.
Vectra.Host.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Host.Notes.created_by	String	User who created the note.
Vectra.Host.Notes.modified_by	String	User who last modified the note.
Vectra.Host.Notes.note	String	Content of the note.

Command example

!vectra-host-note-add host_id="5" note="test note"

Context Example

{
    "Vectra.Host.Notes": {
        "date_created": "2024-07-10T07:31:58.574942Z",
        "created_by": "xsoar",
        "note": "test note",
        "note_id": 1960,
        "host_id": 5
    }
}

Human Readable Output

The note has been successfully added to the host

Returned Note ID: 1960

vectra-host-note-update

Update a note in the host.

Base Command

vectra-host-note-update

Input

Argument Name	Description	Required
host_id	Specify the ID of the host.	Required
note_id	Specify the ID of the note. Note: Use the vectra-host-note-list command to get note_id.	Required
note	Note to be updated for the specified note_id.	Required

Context Output

Path	Type	Description
Vectra.Host.Notes.host_id	Number	ID of the host associated with the note.
Vectra.Host.Notes.note_id	Number	ID of the note.
Vectra.Host.Notes.date_created	Date	Date when the note was created.
Vectra.Host.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Host.Notes.created_by	String	User who created the note.
Vectra.Host.Notes.modified_by	String	User who last modified the note.
Vectra.Host.Notes.note	String	Content of the note.

Command example

!vectra-account-note-update host_id="7" note_id="1960" note="updated test note"

Context Example

{
    "Vectra.Host.Notes": {
        "date_created": "2024-07-10T07:31:58.574942Z",
        "date_modified": "2024-07-12T06:44:29.546835Z",
        "created_by": "xsoar",
        "modified_by": "xsoar",
        "note": "updated test note",
        "note_id": 1960,
        "host_id": 7
    }
}

Human Readable Output

The note has been successfully updated in the host

vectra-host-note-remove

Remove a note from the host.

Base Command

vectra-host-note-remove

Input

Argument Name	Description	Required
host_id	Specify the ID of the host.	Required
note_id	Specify the ID of the note. Note: Use the vectra-host-note-list command to get note_id.	Required

Context Output

There is no context output for this command.

Command example

!vectra-host-note-remove host_id="7" note_id="1960"

Human Readable Output

The note has been successfully removed from the host

vectra-host-note-list

List all notes of the specific host.

Base Command

vectra-host-note-list

Input

Argument Name	Description	Required
host_id	Specify the ID of the host.	Required

Context Output

Path	Type	Description
Vectra.Host.Notes.host_id	Number	ID of the host associated with the note.
Vectra.Host.Notes.note_id	Number	ID of the note.
Vectra.Host.Notes.date_created	Date	Date when the note was created.
Vectra.Host.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Host.Notes.created_by	String	User who created the note.
Vectra.Host.Notes.modified_by	String	User who last modified the note.
Vectra.Host.Notes.note	String	Content of the note.

Command example

!vectra-host-note-list host_id="7"

Context Example

{
    "Vectra.Host.Notes": [
        {
            "date_created": "2024-07-11T07:32:31Z",
            "created_by": "xsoar",
            "note": "test note",
            "note_id": 1960,
            "host_id": 7
        },
        {
            "date_created": "2024-07-11T06:23:07Z",
            "created_by": "cds_xsoar",
            "note": "test note",
            "note_id": 1982,
            "host_id": 7
        }
    ]
}

Human Readable Output

Notes Table

Note ID Note Created By Created Date

1960 test note xsoar 2024-07-11T07:32:31Z

1982 test note cds_xsoar 2024-07-11T06:23:07Z

Note ID	Note	Created By	Created Date
1960	test note	xsoar	2024-07-11T07:32:31Z
1982	test note	cds_xsoar	2024-07-11T06:23:07Z

vectra-host-markall-detections-asfixed

Mark active detections as fixed by providing ID of the host in the argument.

Base Command

vectra-host-markall-detections-asfixed

Input

Argument Name	Description	Required
host_id	Provide a host ID.	Required

Context Output

There is no context output for this command.

Command example

!vectra-host-markall-detections-asfixed host_id=23176

Human Readable Output

The active detections of the provided host have been successfully marked as fixed.

vectra-host-markall-detections-asclosed

Mark active detections as closed by providing the ID of the host in the argument.

Base Command

vectra-host-markall-detections-asclosed

Input

Argument Name	Description	Required
host_id	Provide a host ID.	Required
close_reason	Provide the close reason. Possible values are: benign, remediated.	Required

Context Output

There is no context output for this command.

Command example

!vectra-host-markall-detections-asclosed host_id=23176 close_reason=remediated

Human Readable Output

The active detections of the provided host have been successfully closed as remediated

vectra-detection-describe

Returns a single detection details

Base Command

vectra-detection-describe

Input

Argument Name	Description	Required
id	Detection ID you want to get details on.	Optional

Context Output

Path	Type	Description
Vectra.Detection.Assignee	String	Vectra user account this detection is assigned to
Vectra.Detection.AssignedDate	String	Assignment date
Vectra.Detection.Category	String	Detection category (Lateral, Exfil, …)
Vectra.Detection.CertaintyScore	Number	Detection certainty score
Vectra.Detection.Description	String	Detection description
Vectra.Detection.DestinationIPs	String	Detection destination IPs
Vectra.Detection.DestinationPorts	String	Detection destination ports
Vectra.Detection.FirstTimestamp	String	First time this detection has been seen
Vectra.Detection.ID	Number	Detection ID (unique)
Vectra.Detection.IsTargetingKeyAsset	Boolean	Whether this detection is targeting a key asset
Vectra.Detection.LastTimestamp	String	Last time this detection has been seen
Vectra.Detection.Name	String	The name of the detection. Would be a user defined name if this detection is triaged or the default type name instead
Vectra.Detection.Severity	String	Detection severity according to scores (‘Low’, ‘Medium’, ‘High’, ‘Critical’)
Vectra.Detection.SensorLUID	String	Sensor LUID that saw this detection
Vectra.Detection.SensorName	String	Sensor name that saw this detection.
Vectra.Detection.SourceAccountID	String	Account ID relating to this detection
Vectra.Detection.SourceHostID	String	Host ID relating to this detection
Vectra.Detection.SourceIP	String	Source IP relating to this detection
Vectra.Detection.State	String	Detection state (‘active’, ‘inactive’)
Vectra.Detection.Tags	String	Detection tags
Vectra.Detection.ThreatScore	Number	Detection threat score
Vectra.Detection.TriageRuleID	String	Triage rule ID related to this detection
Vectra.Detection.Type	String	Detection type (Brute Force, Port Sweep, …)
Vectra.Detection.URL	String	Detection URL to pivot to Vectra UI

vectra-detection-get-pcap

Returns a Detection’s PCAP file (if available)

Base Command

vectra-detection-get-pcap

Input

Argument Name	Description	Required
id	The Detection ID you want to get the PCAP file from.	Optional

Input

Argument Name	Description	Required
id	Specify the ID of the detection.	Required

Context Output

Path	Type	Description
Vectra.Detection.ID	Number	ID of the detection associated with the tags.
Vectra.Detection.Tags	String	Tags associated to the detection.

Command example

!vectra-detection-tag-list id="2"

Context Example

{
    "Vectra.Detection": {
        "ID": 2,
        "Tags": [
            "note",
            "tag_from_xsoar",
            "tag_from_vectra"
        ]
    }
}

Human Readable Output

List of tags: note, tag_from_xsoar, tag_from_vectra

vectra-detection-note-add

Add a note to the detection.

Base Command

vectra-detection-note-add

Input

Argument Name	Description	Required
detection_id	Specify the ID of the detection.	Required
note	Note to be added in the specified detection_id.	Required

Context Output

Path	Type	Description
Vectra.Detection.Notes.detection_id	Number	ID of the detection associated with the note.
Vectra.Detection.Notes.note_id	Number	ID of the note.
Vectra.Detection.Notes.date_created	Date	Date when the note was created.
Vectra.Detection.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Detection.Notes.created_by	String	User who created the note.
Vectra.Detection.Notes.modified_by	String	User who last modified the note.
Vectra.Detection.Notes.note	String	Content of the note.

Command example

!vectra-detection-note-add detection_id="7" note="test note"

Context Example

{
    "Vectra.Detection.Notes": {
        "date_created": "2024-07-10T07:32:58.574942Z",
        "created_by": "xsoar",
        "note": "test note",
        "note_id": 1961,
        "detection_id": 7
    }
}

Human Readable Output

The note has been successfully added to the detection

Returned Note ID: 1961

vectra-detection-note-update

Update a note in the detection.

Base Command

vectra-detection-note-update

Input

Argument Name	Description	Required
detection_id	Specify the ID of the detection.	Required
note_id	Specify the ID of the note. Note: Use the vectra-detection-note-list command to get note_id.	Required
note	Note to be updated for the specified note_id.	Required

Context Output

Path	Type	Description
Vectra.Detection.Notes.detection_id	Number	ID of the detection associated with the note.
Vectra.Detection.Notes.note_id	Number	ID of the note.
Vectra.Detection.Notes.date_created	Date	Date when the note was created.
Vectra.Detection.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Detection.Notes.created_by	String	User who created the note.
Vectra.Detection.Notes.modified_by	String	User who last modified the note.
Vectra.Detection.Notes.note	String	Content of the note.

Command example

!vectra-detection-note-update detection_id="9" note_id="1961" note="updated test note"

Context Example

{
    "Vectra.Detection.Notes": {
        "date_created": "2024-07-10T07:32:58.574942Z",
        "date_modified": "2024-07-12T06:43:29.546835Z",
        "created_by": "xsoar",
        "modified_by": "xsoar",
        "note": "updated test note",
        "note_id": 1961,
        "detection_id": 9
    }
}

Human Readable Output

The note has been successfully updated in the detection

vectra-detection-note-remove

Remove a note from the detection.

Base Command

vectra-detection-note-remove

Input

Argument Name	Description	Required
detection_id	Specify the ID of the detection.	Required
note_id	Specify the ID of the note. Note: Use the vectra-detection-note-list command to get note_id.	Required

Context Output

There is no context output for this command.

Command example

!vectra-detection-note-remove detection_id=97" note_id="1961"

Human Readable Output

The note has been successfully removed from the detection

vectra-detection-note-list

List all notes of the specific detection.

Base Command

vectra-detection-note-list

Input

Argument Name	Description	Required
detection_id	Specify the ID of the detection.	Required

Context Output

Path	Type	Description
Vectra.Detection.Notes.detection_id	Number	ID of the detection associated with the note.
Vectra.Detection.Notes.note_id	Number	ID of the note.
Vectra.Detection.Notes.date_created	Date	Date when the note was created.
Vectra.Detection.Notes.date_modified	Date	Date when the note was last modified.
Vectra.Detection.Notes.created_by	String	User who created the note.
Vectra.Detection.Notes.modified_by	String	User who last modified the note.
Vectra.Detection.Notes.note	String	Content of the note.

Command example

!vectra-detection-note-list detection_id="9"

Context Example

{
    "Vectra.Detection.Notes": [
        {
            "date_created": "2024-07-12T04:52:20Z",
            "date_modified": "2024-07-12T10:21:03Z",
            "created_by": "xsoar",
            "modified_by": "xsoar",
            "note": "updated note 2nd",
            "note_id": 1961,
            "detection_id": 9
        },
        {
            "date_created": "2024-07-11T07:32:20Z",
            "created_by": "xsoar",
            "note": "your first test note",
            "note_id": 1937,
            "detection_id": 9
        }
    ]
}

Human Readable Output

Notes Table

Note ID Note Created By Created Date Modified By Modified Date

1961 updated note 2nd xsoar 2024-07-12T04:52:20Z xsoar 2024-07-12T10:21:03Z

1937 your first test note xsoar 2024-07-11T07:32:20Z

vectra-detections-mark-asclosed

Mark detections as closed with provided detection IDs in the argument.

Base Command

vectra-detections-mark-asclosed

Input

Argument Name	Description	Required
detection_ids	Provide a list of detection IDs separated by commas or a single detection ID.	Required
close_reason	Provide the close reason. Possible values are: benign, remediated.	Required

Context Output

There is no context output for this command.

Command example

!vectra-detections-mark-asclosed detection_ids=123,345 close_reason=remediated

Human Readable Output

The provided detection IDs have been successfully closed as remediated

vectra-detections-mark-asopen

Open detections with provided detection IDs in the argument.

Base Command

vectra-detections-mark-asopen

Input

Argument Name	Description	Required
detection_ids	Provide a list of detection IDs separated by commas or a single detection ID.	Required

Context Output

There is no context output for this command.

Command example

!vectra-detections-mark-asopen detection_ids=123,345

Human Readable Output

The provided detection IDs have been successfully re-opened

vectra-outcome-describe

Returns a single outcome details

Base Command

vectra-outcome-describe

Input

Argument Name	Description	Required
id	Outcome ID you want to get details on.	Optional

Context Output

Path	Type	Description
Vectra.Outcome.IsBuiltIn	String	Is this Outcome a builtin Outcome
Vectra.Outcome.Category	String	Outcome’s category (‘False Positive’, ‘Benign True Positive’, ‘Malicious True Positive’)
Vectra.Outcome.ID	Number	Outcome ID (unique)
Vectra.Outcome.Title	String	Outcome title

vectra-outcome-create

Creates a new assignment outcome

Base Command

vectra-outcome-create

Input

Argument Name	Description	Required
title	Outcome title (will be visible in the UI).	Optional
category	Outcome category (one of the 3). Possible values are: Benign True Positive, Malicious True Positive, False Positive.	Optional

Context Output

Path	Type	Description
Vectra.Outcome.IsBuiltIn	String	Is this Outcome a builtin Outcome
Vectra.Outcome.Category	String	Outcome’s category (‘False Positive’, ‘Benign True Positive’, ‘Malicious True Positive’)
Vectra.Outcome.ID	Number	Outcome ID (unique)
Vectra.Outcome.Title	String	Outcome title

vectra-assignment-describe

Returns a single assignment details

Base Command

vectra-assignment-describe

Input

Argument Name	Description	Required
id	Assignment ID you want to get details on.	Optional

Context Output

Path	Type	Description
Vectra.Assignment.AccountID	Number	Account ID this assignment is linked to
Vectra.Assignment.AssignedBy	String	Who lastly assigned this assignment
Vectra.Assignment.AssignedDate	String	When this assignment was lastly assigned
Vectra.Assignment.AssignedTo	String	To who this assignment is assigned
Vectra.Assignment.HostID	String	Host ID this assignment is linked to
Vectra.Assignment.ID	Number	Assignment ID (unique)
Vectra.Assignment.IsResolved	Boolean	Is this assignment resolved
Vectra.Assignment.OutcomeCategory	String	Assignment Outcome category
Vectra.Assignment.OutcomeTitle	String	Assignment Outcome title
Vectra.Assignment.TriagedDetections	String	List of Detection that have been triaged with the resolution
Vectra.Assignment.TriagedAs	String	Name of the triage rule if any
Vectra.Assignment.ResolvedBy	String	Who resolved this assignment
Vectra.Assignment.ResolvedDate	string	When this assignment was resolved

vectra-assignment-assign

Assigns an Account/Host entity to a Vectra User for investigation. If an assignment already exists on this entity, it will be reassigned

Base Command

vectra-assignment-assign

Input

Argument Name	Description	Required
assignee_id	Assignee’s ID (Vectra User ID).	Optional
assignment_id	Assignment ID if an assignment already exists for the given entity.	Optional
account_id	Account ID.	Optional
host_id	Host ID.	Optional

Context Output

Path	Type	Description
Vectra.Assignment.AccountID	Number	Account ID this assignment is linked to
Vectra.Assignment.AssignedBy	String	Who lastly assigned this assignment
Vectra.Assignment.AssignedDate	String	When this assignment was lastly assigned
Vectra.Assignment.AssignedTo	String	To who this assignment is assigned
Vectra.Assignment.HostID	String	Host ID this assignment is linked to
Vectra.Assignment.ID	Number	Assignment ID (unique)
Vectra.Assignment.IsResolved	Boolean	Is this assignment resolved
Vectra.Assignment.OutcomeCategory	String	Assignment Outcome category
Vectra.Assignment.OutcomeTitle	String	Assignment Outcome title
Vectra.Assignment.TriagedDetections	String	List of Detection that have been triaged with the resolution
Vectra.Assignment.TriagedAs	String	Name of the triage rule if any
Vectra.Assignment.ResolvedBy	String	Who resolved this assignment
Vectra.Assignment.ResolvedDate	string	When this assignment was resolved

vectra-assignment-resolve

Resolves an assignment by selecting resolution scheme. Could be ‘resolving only’ or ‘resolving by filtering detections’

Base Command

vectra-assignment-resolve

Input

Argument Name	Description	Required
assignment_id	Assignment’s ID.	Optional
outcome_id	Assignment Outcome’s ID.	Optional
note	A note to add to this resolution.	Optional
detections_filter	Do you want to filter detections when resolving this assignment ? [Default is None]. Possible values are: None, Filter Rule.	Optional
filter_rule_name	Filter rule’s name (when using filter_detections=”Filter Rule”).	Optional
detections_list	Detection IDs list you want to filter.	Optional

Context Output

Path	Type	Description
Vectra.Assignment.AccountID	Number	Account ID this assignment is linked to
Vectra.Assignment.AssignedBy	String	Who lastly assigned this assignment
Vectra.Assignment.AssignedDate	String	When this assignment was lastly assigned
Vectra.Assignment.AssignedTo	String	To who this assignment is assigned
Vectra.Assignment.HostID	String	Host ID this assignment is linked to
Vectra.Assignment.ID	Number	Assignment ID (unique)
Vectra.Assignment.IsResolved	Boolean	Is this assignment resolved
Vectra.Assignment.OutcomeCategory	String	Assignment Outcome category
Vectra.Assignment.OutcomeTitle	String	Assignment Outcome title
Vectra.Assignment.TriagedDetections	String	List of Detection that have been triaged with the resolution
Vectra.Assignment.TriagedAs	String	Name of the triage rule if any
Vectra.Assignment.ResolvedBy	String	Who resolved this assignment
Vectra.Assignment.ResolvedDate	string	When this assignment was resolved

vectra-user-describe

Returns a single Vectra User details

Base Command

vectra-user-describe

Input

Argument Name	Description	Required
id	User ID you want to get details on.	Optional

Context Output

Path	Type	Description
Vectra.User.Email	String	User’s email address
Vectra.User.ID	Number	User ID (unique)
Vectra.User.Role	String	User’s role
Vectra.User.Type	String	User type (‘Local’, ‘SAML’, …)
Vectra.User.Username	String	Username
Vectra.User.LastLoginDate	String	User’s last login datetime

vectra-group-list

Returns a list of all groups.

Base Command

vectra-group-list

Input

Argument Name	Description	Required
group_type	Filter by group type. Possible values are: account, host, ip, domain.	Optional
account_names	Filter by Account Names. Supports comma-separated values. Note: Only valid when the group_type parameter is set to “account”.	Optional
domains	Filter by Domains. Supports comma-separated values. Note: Only valid when the group_type parameter is set to “domain”.	Optional
host_ids	Filter by Host IDs. Supports comma-separated values. Note: Only valid when the group_type parameter is set to “host”.	Optional
host_names	Filter by Host Names. Supports comma-separated values. Note: Only valid when the group_type parameter is set to “host”.	Optional
importance	Filter by group importance. Possible values are: high, medium, low, never_prioritize.	Optional
ips	Filter by IPs. Supports comma-separated values. Note: Only valid when the group_type parameter is set to “ip”.	Optional
description	Filter by group description.	Optional
last_modified_timestamp	Return only the groups which have a last modification timestamp equal to or after the given timestamp. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z.	Optional
last_modified_by	Filters by the user id who made the most recent modification to the group.	Optional
group_name	Filters by group name.	Optional

Context Output

Path	Type	Description
Vectra.Group.group_id	Number	ID of the group.
Vectra.Group.name	String	Name of the group.
Vectra.Group.description	String	Description of the group.
Vectra.Group.last_modified	Date	Date when the group was last modified.
Vectra.Group.last_modified_by	String	Name of the user who last modified the group.
Vectra.Group.type	String	Type of the group.
Vectra.Group.members.id	Number	Entity ID of member.
Vectra.Group.members.name	String	Entity name of member.
Vectra.Group.members.is_key_asset	Boolean	Indicates key asset.
Vectra.Group.members.url	String	Entity URL of member.
Vectra.Group.members.uid	String	Entity UID of member.
Vectra.Group.rules.triage_category	String	Triage category of rule.
Vectra.Group.rules.id	Number	ID of the rule.
Vectra.Group.rules.description	String	Description of the rule.
Vectra.Group.importance	String	Importance level of the group.
Vectra.Group.cognito_managed	Boolean	Whether the group is managed by Cognito or not.

Command example

!vectra-group-list group_type=account importance=high

Context Example

{
    "Vectra": {
        "Group": [
            {
                "description": "",
                "group_id": 1,
                "id": 1,
                "last_modified": "2024-07-22T06:44:44Z",
                "last_modified_by": "cds_xsoar",
                "members": [
                    {
                        "uid": "user@lab.test.local"
                    },
                    {
                        "uid": "O365:serviceprincipal_00000000-0000-0000-0000-000000000001"
                    }
                ],
                "name": "AccountNoBlock",
                "type": "account"
            },
            {
                "description": "",
                "group_id": 2,
                "id": 2,
                "last_modified": "2024-07-22T06:44:40Z",
                "last_modified_by": "cds_xsoar",
                "members": [
                    {
                        "uid": "O365:serviceprincipal_00000000-0000-0000-0000-000000000001"
                    }
                ],
                "name": "AccountBlock",
                "type": "account"
            }
        ]
    }
}

Human Readable Output

Groups Table

Group ID Name Group Type Members Last Modified Timestamp

1 AccountNoBlock account user@lab.test.local, O365:serviceprincipal_00000000-0000-0000-0000-000000000001 2024-07-22T06:44:44Z

2 AccountBlock account O365:serviceprincipal_00000000-0000-0000-0000-000000000001 2024-07-22T06:44:40Z

vectra-group-assign

Assign members to the specified group.

Base Command

vectra-group-assign

Input

Argument Name	Description	Required
group_id	Specify Group ID to assign members. Note: You can get the group_id by executing the "vectra-group-list" command.	Required
members	A comma-separated list of member values based on the group type. Note: You can get the members by executing the "vectra-group-list" command. If the group type is host, then the “Host IDs”. If the group type is account, then “Account Names”. If the group type is ip, then the list of “IPs”. If the group type is domain, then the list of “Domains”.	Required

Context Output

Path	Type	Description
Vectra.Group.group_id	Number	ID of the group.
Vectra.Group.name	String	Name of the group.
Vectra.Group.description	String	Description of the group.
Vectra.Group.last_modified	Date	Date when the group was last modified.
Vectra.Group.last_modified_by	String	Name of the user who last modified the group.
Vectra.Group.type	String	Type of the group.
Vectra.Group.members.id	Number	Entity ID of member.
Vectra.Group.members.name	String	Entity name of member.
Vectra.Group.members.is_key_asset	Boolean	Indicates key asset.
Vectra.Group.members.url	String	Entity URL of member.
Vectra.Group.members.uid	String	Entity UID of member.
Vectra.Group.rules.triage_category	String	Triage category of rule.
Vectra.Group.rules.id	Number	ID of the rule.
Vectra.Group.rules.description	String	Description of the rule.

Command example

!vectra-group-assign group_id=3557 members="account_4"

Context Example

{
    "Vectra": {
        "Group": {
        "id": 3,
        "name": "xsoar-account-group-2",
        "last_modified": "2023-09-04T09:22:46Z",
        "last_modified_by": "TEST Client",
        "members": [
            {
                "uid": "account_1"
            },
            {
                "uid": "account_2"
            },
            {
                "uid": "account_3"
            },
            {
                "uid": "account_4"
            }
        ],
        "type": "account",
        "group_id": 3
        }
    }
}

Human Readable Output

Member(s) account_4 have been assigned to the group

Updated group details

Group ID Name Group Type Members Last Modified Timestamp

3 xsoar-account-group-2 account account_1, account_2, account_3, account_4 2023-09-04T09:22:46Z

vectra-group-unassign

Unassign members from the specified group.

Base Command

vectra-group-unassign

Input

Argument Name	Description	Required
group_id	Specify Group ID to unassign members. Note: You can get the group_id by executing the "vectra-group-list" command.	Required
members	A comma-separated list of member values based on the group type. Note: You can get the members by executing the "vectra-group-list" command. If the group type is host, then the “Host IDs”. If the group type is account, then “Account Names”. If the group type is ip, then the list of “IPs”. If the group type is domain, then the list of “Domains”.	Required

Context Output

Path	Type	Description
Vectra.Group.group_id	Number	ID of the group.
Vectra.Group.name	String	Name of the group.
Vectra.Group.description	String	Description of the group.
Vectra.Group.last_modified	Date	Date when the group was last modified.
Vectra.Group.last_modified_by	String	Name of the user who last modified the group.
Vectra.Group.type	String	Type of the group.
Vectra.Group.members.id	Number	Entity ID of member.
Vectra.Group.members.name	String	Entity name of member.
Vectra.Group.members.is_key_asset	Boolean	Indicates key asset.
Vectra.Group.members.url	String	Entity URL of member.
Vectra.Group.members.uid	String	Entity UID of member.
Vectra.Group.rules.triage_category	String	Triage category of rule.
Vectra.Group.rules.id	Number	ID of the rule.
Vectra.Group.rules.description	String	Description of the rule.

Command example

!vectra-group-unassign group_id=5 members="2126"

Context Example

{
    "Vectra": {
        "Group": {
            "id": 2,
            "group_id": 2,
            "type": "host",
            "name": "TEST RENAME",
            "description": "TEST RENAME",
            "last_modified": "2023-09-04T06:27:57Z",
            "last_modified_by": "TEST Client"
        }
    }
}

Human Readable Output

Member(s) 2126 have been unassigned from the group

Updated group details

Group ID Name Group Type Description Last Modified Timestamp

2 TEST RENAME host TEST RENAME 2023-09-04T06:27:57Z

Troubleshooting

Receive Notification on an Incident Fetch Error

The administrator and Cortex XSOAR users on the recipient’s list receive a notification when an integration experiences an incident fetch error. Cortex XSOAR users can select their notification method, such as email, from their user preferences. Refer to Cortex XSOAR 6.13 documentation or Cortex XSOAR 8 Cloud documentation or Cortex XSOAR 8.7 On-prem documentation for more information.

The following are tips for handling issues with mirroring incidents between Vectra and Cortex XSOAR

Issue	Recommendation
Mirroring is not working.	Open Context Data and search for dbot. Confirm the dbot fields are configured correctly either through the mapper for that specific incident type or using setIncident. Specifically, make sure the integration instance is configured correctly for the mirroring direction (incoming, outgoing, both) - dbotMirrorId, dbotMirrorDirection, dbotMirrorInstance, dbotMirrorTags.
Required fields are not getting sent or not visible in UI.	This may be a mapping issue, specifically if you have used a custom mapper make sure you’ve covered all the out of box mapper fields.
Notes from Cortex XSOAR have not been mirrored in Vectra	Tag is required for mirroring notes from Cortex XSOAR to Vectra. There might be a reason the note is not tagged as the tag needs to be added manually in Cortex XSOAR. Click Actions > Tags and add the “note” tag (OR the specific tag name which was set up in the Instance Configuration).

Docker timeout issue for Fetch Incidents

If you encounter a timeout error while fetching incidents, you can try adjusting the value of the max_fetch parameter in the instance configuration. Setting it to a lower value, such as 50 can help prevent the timeout issue.
Another way to address this issue is to increase the timeout of the Docker container. By default, Docker containers have a timeout of 5 minutes. You can increase this timeout to a higher value, such as 10 minutes, to allow more time for the fetch command to complete. Refer to this XSOAR documentation for more information.

Handling HTTP 429 and 5xx Errors

The commands and fetch incidents mechanism will do up to 3 internal retries with a gap of 15, 30, and 60 seconds (exponentially) between the retries.

Configuration parameters

server_fqdn — Vectra Detect FQDN or IP (required)
authentication_type — Authentication Type
credentials — API Token
oauth_credentials — Client ID
insecure — Trust any certificate (not secure)
use_proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
first_fetch — First fetch timestamp
mirror_direction — Mirroring Direction
refetch_closed_incidents — Re-Fetch closed incidents via mirroring
note_tag — Mirror tag for notes
fetch_entity_types — Entity types to fetch
tags — Tags
detection_category — Detection Category
detection_type — Detection Type
hosts_fetch_query — Hosts fetch query
accounts_fetch_query — Accounts fetch query
detections_fetch_query — Detections fetch query
max_fetch — Max created incidents per fetch
look_back — Advanced: Minutes to look back when fetching
fetch_escalated_accounts_and_hosts — Advanced: Fetch escalated Accounts and Hosts
create_multiple_incidents_by_timestamp — Re-Fetch Account/Host entity and Detection for new activity/event

Commands (47)

vectra-account-add-tags
Add tags to an Account.
vectra-account-del-tags
Delete tags from an Account.
vectra-account-describe
Returns a single Account details.
vectra-account-markall-detections-asclosed
Mark active detections as closed by providing the ID of the account in the argument.
vectra-account-markall-detections-asfixed
Mark active detections as fixed by providing the ID of the account in the argument.
vectra-account-note-add
Add a note to the account.
vectra-account-note-list
List all notes of the specific account.
vectra-account-note-remove
Remove a note from the account.
vectra-account-note-update
Update a note in the account.
vectra-account-tag-list
Returns a list of tags for a specified account.
vectra-assignment-assign
Assigns an Account/Host entity to a Vectra User for investigation. If an assignment already exists on this entity, it will be reassigned.
vectra-assignment-describe
Returns a single assignment details.
vectra-assignment-resolve
Resolves an assignment by selecting resolution scheme. Could be 'resolving only' or 'resolving by filtering detections'.
vectra-detection-add-tags
Add tags to a Detection.
vectra-detection-del-tags
Delete tags from a Detection.
vectra-detection-describe
Returns a single detection details.
vectra-detection-get-pcap
Returns a Detection's PCAP file (if available).
vectra-detection-markasfixed
Marks/Unmarks a Detection as fixed by providing the Detection ID.
vectra-detection-note-add
Add a note to the detection.
vectra-detection-note-list
List all notes of the specific detection.
vectra-detection-note-remove
Remove a note from the detection.
vectra-detection-note-update
Update a note in the detection.
vectra-detection-tag-list
Returns a list of tags for a specified detection.
vectra-detections-mark-asclosed
Mark detections as closed with provided detection IDs in the argument.
vectra-detections-mark-asopen
Open detections with provided detection IDs in the argument.
vectra-group-assign
Assign members to the specified group.
vectra-group-list
Returns a list of all groups.
vectra-group-unassign
Unassign members from the specified group.
vectra-host-add-tags
Add tags to an Host.
vectra-host-del-tags
Delete tags from an Host.
vectra-host-describe
Returns a single Host details.
vectra-host-markall-detections-asclosed
Mark active detections as closed by providing the ID of the host in the argument.
vectra-host-markall-detections-asfixed
Mark active detections as fixed by providing ID of the host in the argument.
vectra-host-note-add
Add a note to the host.
vectra-host-note-list
List all notes of the specific host.
vectra-host-note-remove
Remove a note from the host.
vectra-host-note-update
Update a note in the host.
vectra-host-tag-list
Returns a list of tags for a specified host.
vectra-outcome-create
Creates a new assignment outcome.
vectra-outcome-describe
Returns a single outcome details.
vectra-search-accounts
Returns a list of Account objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
vectra-search-assignments
Return a list of assignments. By default already resolved assignment are not returned.
vectra-search-detections
Returns a list of Detection objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
vectra-search-hosts
Returns a list of Host objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
vectra-search-outcomes
Returns a list of assignment outcomes.
vectra-search-users
Returns a list of Vectra Users. All search attributes will be cumulative.
vectra-user-describe
Returns a single Vectra User details.

Source

VectraDetect.py VectraDetect_test.py VectraDetect.yml VectraDetect_description.md

Download History Raw

commonfields:
  id: Vectra_Detect
  version: -1
sectionorder:
- Connect
- Collect
name: Vectra_Detect
display: Vectra Detect
description: This integration allows to create incidents based on Vectra Accounts/Hosts/Detections objects.
category: Network Security
provider: Vectra AI
defaultclassifier: Vectra Detect
defaultmapperin: Vectra Detect - Incoming Mapper
fromversion: 6.5.0

configuration:
- display: Vectra Detect FQDN or IP
  name: server_fqdn
  type: 0    # Short Text
  additionalinfo: Enter the FQDN or IP to reach the Vectra Detect API. (e.g. "my-vectra-box.local" or "192.168.1.1")
  required: true
  defaultvalue: ''
  section: Connect
- display: Authentication Type
  name: authentication_type
  type: 15
  additionalinfo: Select the authentication type (Default - API Token).
  required: false
  defaultvalue: "API Token"
  options:
  - API Token
  - OAuth 2.0
  section: Connect
- display: API Token
  name: credentials
  type: 9    # Authentication text - allows switching to credentials
  additionalinfo: Enter the API token that can be retrieved from the Vectra UI > My Profile > General (tab) > API Token. You can also use the XSOAR credentials wallet to store it. In that case, the token should be the password.
  required: false
  hiddenusername: true
  displaypassword: API Token
  section: Connect
- display: Client ID
  displaypassword: Client Secret Key
  name: oauth_credentials
  additionalinfo: Enter the Client ID and Client Secret Key that can be retrieved from the Vectra UI > Manage > API Clients. You can also use the XSOAR credentials wallet to store it.
  type: 9
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure    # Do not change
  type: 8    # Boolean checkbox
  additionalinfo: When checked, no SSL certificates check will be done when interacting with the Vectra Detect API. It's insecure. (Default - unchecked)
  required: false
  section: Connect
- display: Use system proxy settings
  name: use_proxy    # Do not change
  type: 8    # Boolean checkbox
  additionalinfo: Use the system proxy settings to reach with the Vectra Detect API.
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch    # Do not change
  type: 8    # Boolean checkbox
  required: false
  section: Collect
- display: Incident type
  name: incidentType    # Do not change
  type: 13    # special use - automatically added - Incident type single select dropdown
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: First fetch timestamp
  name: first_fetch    # Do not change
  type: 0    # Short Text
  additionalinfo: "The date or relative timestamp from which to begin fetching entities.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2024, 01 Aug 2024 04:45:33, 2024-07-17T14:05:44Z. (default - 7 days)"
  defaultvalue: 7 days
  required: false
  section: Collect
- additionalinfo: The mirroring direction in which to mirror the account and host. You can mirror "Incoming" (from Vectra to Cortex XSOAR), "Outgoing" (from Cortex XSOAR to Vectra), or in both directions.
  display: Mirroring Direction
  hidden: false
  name: mirror_direction
  options:
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  required: false
  type: 15
  section: Collect
- additionalinfo: "If selected, new incidents will be created (via Outgoing Mirroring). If not selected, it reopens previously closed incidents (via Incoming Mirroring).\n\nNote: This flow is triggered only when the relevant account or host is still active and the previously fetched incident is closed."
  defaultvalue: "false"
  display: Re-Fetch closed incidents via mirroring
  name: refetch_closed_incidents
  required: false
  type: 8
  section: Collect
- additionalinfo: The tag value should be used to mirror the account and host note by adding the same tag in the notes.
  defaultvalue: note
  display: Mirror tag for notes
  hidden: false
  name: note_tag
  required: false
  type: 0
  section: Collect
- display: Entity types to fetch
  name: fetch_entity_types
  type: 16    # Multiple select dropdown
  additionalinfo: Choose what to fetch - Accounts and/or Hosts and/or Detections. (Default - Accounts,Hosts)
  options:
  - Accounts
  - Hosts
  - Detections
  defaultvalue: Accounts,Hosts
  required: false
  section: Collect
- additionalinfo: "Only Accounts or Hosts that contain any of the tags specified will be fetched.\n\nNote: For the partial match of the tag, use '*' at the start and end of word (Only a single word is allowed). Ex. *MDR*."
  display: Tags
  name: tags
  type: 16
  section: Collect
- additionalinfo: "Filter the detections belonging to a specified category displayed as part of layout.\n\nNote: This filter applies on the 'Vectra Account' and 'Vectra Host' incident type."
  display: Detection Category
  name: detection_category
  options:
  - Command & Control
  - Botnet
  - Reconnaissance
  - Lateral Movement
  - Exfiltration
  - Info
  type: 15
  section: Collect
- additionalinfo: "Filter the detections belonging to a specified type displayed as part of layout.\n\nNote: This filter applies on the 'Vectra Account' and 'Vectra Host' incident type."
  display: Detection Type
  name: detection_type
  type: 0
  section: Collect
- display: Hosts fetch query
  name: hosts_fetch_query
  type: 0    # Short text
  additionalinfo: Only "active" Hosts matching this fetch query will be fetched. Will be used only if "Hosts" is selected in the "Entity types to fetch". (default - host.threat:>=50)
  defaultvalue: host.threat:>=50
  required: false
  section: Collect
- display: Accounts fetch query
  name: accounts_fetch_query
  type: 0    # Short text
  additionalinfo: Only "active" Accounts matching this fetch query will be fetched. Will be used only if "Accounts" is selected in the "Entity types to fetch". (default - account.threat:>=50)
  defaultvalue: account.threat:>=50
  required: false
  section: Collect
- display: Detections fetch query
  name: detections_fetch_query
  type: 0    # Short text
  additionalinfo: Only "active" Detections matching this fetch query will be fetched. Will be used only if "Detections" is selected in the "Entity types to fetch". (default - detection.threat:>=50 AND detection.certainty:>=50)
  defaultvalue: detection.threat:>=50 AND detection.certainty:>=50
  required: false
  section: Collect
- display: Max created incidents per fetch
  name: max_fetch
  type: 0    # Short Text
  additionalinfo: The maximum number of new incidents to create per fetch. This value would be split between selected "Entity types to fetch". If the value is greater than 200, it will be considered as 200. The maximum is 200. (Default - 50)
  defaultvalue: 50
  required: false
  section: Collect
- defaultvalue: 60
  display: 'Advanced: Minutes to look back when fetching'
  additionalinfo: "Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created."
  name: look_back
  type: 0
  required: false
  section: Collect
- defaultvalue: 'false'
  display: 'Advanced: Fetch escalated Accounts and Hosts'
  additionalinfo: "Use this parameter to fetch escalated Accounts and Hosts.\n\nNote: If this parameter is set to True, it will fetch Accounts and Hosts that have been updated based on the provided filter parameters, even if their detection timestamps are older than the first fetch time."
  name: fetch_escalated_accounts_and_hosts
  type: 8
  required: false
  section: Collect
- defaultvalue: 'false'
  display: 'Re-Fetch Account/Host entity and Detection for new activity/event'
  additionalinfo: "Whether to create multiple incidents for the same entity (Account or Host) or Detection if new detection activity occurs for the entity (Account or Host) or a new event is detected for the detection."
  name: create_multiple_incidents_by_timestamp
  type: 8
  required: false
  section: Collect
script:
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  commands:
    # Search Accounts / Hosts / Detections / Users / Outcomes (Assignment outcomes) / Assignments
    # Describe single account / host / detection / outcome / assignment by ID
    # Get detection PCAP
    # Add tags to an account / host / detection
    # Remove tags to an account / host / detection
    # Create an assignment outcome

  - name: vectra-search-accounts
    description: Returns a list of Account objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
    arguments:
    - name: min_id
      description: Returns Accounts with an ID greater than or equal to the specified ID.
    - name: max_id
      description: Returns Accounts with an ID less than or equal to the specified ID.
    - name: min_threat
      description: Returns Accounts with a threat score greater than or equal to the specified score.
    - name: max_threat
      description: Returns Accounts with a threat score less than or equal to the specified score.
    - name: min_certainty
      description: Returns Accounts with a certainty score greater than or equal to the specified score.
    - name: max_certainty
      description: Returns Accounts with a certainty score less than or equal to the specified score.
    - name: state
      description: Filters by state ('active', 'inactive').
      auto: PREDEFINED
      predefined:
      - active
      - inactive
    - name: search_query
      description: Search query in Lucene query syntax.
    - name: search_query_only
      description: Use specifically this search query. Compared to "search_query" where default arguments are appended.
    - name: min_privilege_level
      description: Returns entries with a  privilege level greater than or equal to the specified score.
    - name: max_privilege_level
      description: Returns entries with a  privilege level greater than or equal to the specified score.
    - name: privilege_category
      description: Filters by the privilege category ("low", "medium", "high") provided.
    - name: tags
      description: Filters by a tag or a comma-separated list tags.

    outputs: &accountOutput
    - contextPath: Vectra.Account.Assignee
      type: String
      description: Vectra user account this Account is assigned to.
    - contextPath: Vectra.Account.AssignedDate
      type: String
      description: Assignment date.
    - contextPath: Vectra.Account.CertaintyScore
      type: Number
      description: Account certainty score.
    - contextPath: Vectra.Account.ID
      type: Number
      description: Account ID (unique).
    - contextPath: Vectra.Account.LastDetectionTimestamp
      type: String
      description: Last time a detection linked to this account has been seen.
    - contextPath: Vectra.Account.PrivilegeLevel
      type: Number
      description: Account privilege level (from 1 to 10).
    - contextPath: Vectra.Account.PrivilegeCategory
      type: String
      description: Account privilege category (Either 'Low', 'Medium' or 'High' - Privilege levels of 1-2 > 'Low', 3-7 > 'Medium', 8-10 > 'High').
    - contextPath: Vectra.Account.Severity
      type: String
      description: Account severity according to scores ('Low', 'Medium', 'High', 'Critical').
    - contextPath: Vectra.Account.State
      type: String
      description: Account state ('active', 'inactive').
    - contextPath: Vectra.Account.Tags
      type: String
      description: Account tags.
    - contextPath: Vectra.Account.ThreatScore
      type: Number
      description: Account threat score.
    - contextPath: Vectra.Account.Type
      type: String
      description: Account type ('kerberos' or 'o365').
    - contextPath: Vectra.Account.URL
      type: String
      description: Account URL to pivot to Vectra UI.
    - contextPath: Vectra.Account.Name
      type: String
      description: The username of the account.

  - name: vectra-search-hosts
    description: Returns a list of Host objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
    arguments:
    - name: min_id
      description: Returns Hosts with an ID greater than or equal to the specified ID.
    - name: max_id
      description: Returns Hosts with an ID less than or equal to the specified ID.
    - name: min_threat
      description: Returns Hosts with a threat score greater than or equal to the specified score.
    - name: max_threat
      description: Returns Hosts with a threat score less than or equal to the specified score.
    - name: min_certainty
      description: Returns Hosts with a certainty score greater than or equal to the specified score.
    - name: max_certainty
      description: Returns Hosts with a certainty score less than or equal to the specified score.
    - name: state
      description: Filters by state ('active', 'inactive').
      auto: PREDEFINED
      predefined:
      - active
      - inactive
    - name: search_query
      description: Search query in Lucene query syntax.
    - name: search_query_only
      description: Use specifically this search query. Compared to "search_query" where default arguments are appended.
    outputs: &hostOutput
    - contextPath: Vectra.Host.Assignee
      type: String
      description: Vectra user account this Host is assigned to.
    - contextPath: Vectra.Host.AssignedDate
      type: String
      description: Assignment date.
    - contextPath: Vectra.Host.CertaintyScore
      type: Number
      description: Host certainty score.
    - contextPath: Vectra.Host.HasActiveTraffic
      type: Boolean
      description: Whether this Host has active traffic.
    - contextPath: Vectra.Host.Hostname
      type: String
      description: Host name.
    - contextPath: Vectra.Host.ID
      type: Number
      description: Host ID (Unique).
    - contextPath: Vectra.Host.IP
      type: String
      description: Host IP address.
    - contextPath: Vectra.Host.IsKeyAsset
      type: Boolean
      description: Whether this Host is seen as a key asset.
    - contextPath: Vectra.Host.IsTargetingKeyAsset
      type: Boolean
      description: Whether this Host is targeting a key asset.
    - contextPath: Vectra.Host.PrivilegeLevel
      type: Number
      description: Host privilege level (from 1 to 10).
    - contextPath: Vectra.Host.PrivilegeCategory
      type: String
      description: Host privilege category. (Either 'Low', 'Medium' or 'High' - Privilege levels of 1-2 > 'Low', 3-7 > 'Medium', 8-10 > 'High').
    - contextPath: Vectra.Host.ProbableOwner
      type: String
      description: Host probable owner.
    - contextPath: Vectra.Host.SensorLUID
      type: String
      description: Sensor LUID that saw this Host.
    - contextPath: Vectra.Host.SensorName
      type: String
      description: Sensor Name that saw this Host.
    - contextPath: Vectra.Host.Sensor
      type: String
      description: Sensor details that have seen this Host.
    - contextPath: Vectra.Host.Severity
      type: String
      description: Host severity according to scores ('Low', 'Medium', 'High', 'Critical').
    - contextPath: Vectra.Host.State
      type: String
      description: Host state ('active', 'inactive').
    - contextPath: Vectra.Host.Tags
      type: String
      description: Host tags.
    - contextPath: Vectra.Host.ThreatScore
      type: Number
      description: Host threat score.
    - contextPath: Vectra.Host.URL
      type: String
      description: Host URL to pivot to Vectra UI.

  - name: vectra-search-detections
    description: Returns a list of Detection objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
    arguments:
    - name: min_id
      description: Returns Detections with an ID greater than or equal to the specified ID.
    - name: max_id
      description: Returns Detections with an ID less than or equal to the specified ID.
    - name: min_threat
      description: Returns Detections with a threat score greater than or equal to the specified score.
    - name: max_threat
      description: Returns Detections with a threat score less than or equal to the specified score.
    - name: min_certainty
      description: Returns Detections with a certainty score greater than or equal to the specified score.
    - name: max_certainty
      description: Returns Detections with a certainty score less than or equal to the specified score.
    - name: state
      description: Filters by state ('active', 'inactive').
      auto: PREDEFINED
      predefined:
      - active
      - inactive
    - name: search_query
      description: Search query in Lucene query syntax.
    - name: search_query_only
      description: Use specifically this search query. Compared to "search_query" where default arguments are appended.
    outputs: &detectionOutput
    - contextPath: Vectra.Detection.Assignee
      type: String
      description: Vectra user account this detection is assigned to.
    - contextPath: Vectra.Detection.AssignedDate
      type: String
      description: Assignment date.
    - contextPath: Vectra.Detection.Category
      type: String
      description: Detection category (Lateral, Exfil, ...)
    - contextPath: Vectra.Detection.CertaintyScore
      type: Number
      description: Detection certainty score.
    - contextPath: Vectra.Detection.Description
      type: String
      description: Detection description.
    - contextPath: Vectra.Detection.DestinationIPs
      type: String
      description: Detection destination IPs.
    - contextPath: Vectra.Detection.DestinationPorts
      type: String
      description: Detection destination ports.
    - contextPath: Vectra.Detection.FirstTimestamp
      type: String
      description: First time this detection has been seen.
    - contextPath: Vectra.Detection.ID
      type: Number
      description: Detection ID (unique).
    - contextPath: Vectra.Detection.IsTargetingKeyAsset
      type: Boolean
      description: Whether this detection is targeting a key asset.
    - contextPath: Vectra.Detection.LastTimestamp
      type: String
      description: Last time this detection has been seen.
    - contextPath: Vectra.Detection.Name
      type: String
      description: The name of the detection. Would be a user defined name if this detection is triaged or the default type name instead.
    - contextPath: Vectra.Detection.Severity
      type: String
      description: Detection severity according to scores ('Low', 'Medium', 'High', 'Critical').
    - contextPath: Vectra.Detection.SensorLUID
      type: String
      description: Sensor LUID that saw this detection.
    - contextPath: Vectra.Detection.SensorName
      type: String
      description: Sensor name that saw this detection.
    - contextPath: Vectra.Detection.SourceAccountID
      type: String
      description: Account ID relating to this detection.
    - contextPath: Vectra.Detection.SourceHostID
      type: String
      description: Host ID relating to this detection.
    - contextPath: Vectra.Detection.SourceIP
      type: String
      description: Source IP relating to this detection.
    - contextPath: Vectra.Detection.State
      type: String
      description: Detection state ('active', 'inactive').
    - contextPath: Vectra.Detection.Tags
      type: String
      description: Detection tags.
    - contextPath: Vectra.Detection.ThreatScore
      type: Number
      description: Detection threat score.
    - contextPath: Vectra.Detection.TriageRuleID
      type: String
      description: Triage rule ID related to this detection.
    - contextPath: Vectra.Detection.Type
      type: String
      description: Detection type (Brute Force, Port Sweep, ...)
    - contextPath: Vectra.Detection.URL
      type: String
      description: Detection URL to pivot to Vectra UI.

  - name: vectra-search-assignments
    description: Return a list of assignments. By default already resolved assignment are not returned.
    arguments:
    - name: account_ids
      description: Filters by accounts IDs.
      isArray: true
    - name: assignee_ids
      description: Filters by assignees IDs.
      isArray: true
    - name: host_ids
      description: Filters by hosts IDs.
      isArray: true
    - name: outcome_ids
      description: Filters by outcomes IDs.
      isArray: true
    - name: resolved
      description: Filters by resolution state.
    outputs: &assignmentOutput
    - contextPath: Vectra.Assignment.AccountID
      type: Number
      description: Account ID this assignment is linked to.
    - contextPath: Vectra.Assignment.AssignedBy
      type: String
      description: Who lastly assigned this assignment.
    - contextPath: Vectra.Assignment.AssignedDate
      type: String
      description: When this assignment was lastly assigned.
    - contextPath: Vectra.Assignment.AssignedTo
      type: String
      description: To who this assignment is assigned.
    - contextPath: Vectra.Assignment.HostID
      type: String
      description: Host ID this assignment is linked to.
    - contextPath: Vectra.Assignment.ID
      type: Number
      description: Assignment ID (unique).
    - contextPath: Vectra.Assignment.IsResolved
      type: Boolean
      description: Is this assignment resolved.
    - contextPath: Vectra.Assignment.OutcomeCategory
      type: String
      description: Assignment Outcome category.
    - contextPath: Vectra.Assignment.OutcomeTitle
      type: String
      description: Assignment Outcome title.
    - contextPath: Vectra.Assignment.TriagedDetections
      type: String
      description: List of Detection that have been triaged with the resolution.
    - contextPath: Vectra.Assignment.TriagedAs
      type: String
      description: Name of the triage rule if any.
    - contextPath: Vectra.Assignment.ResolvedBy
      type: String
      description: Who resolved this assignment.
    - contextPath: Vectra.Assignment.ResolvedDate
      type: string
      description: When this assignment was resolved.

  - name: vectra-search-users
    description: Returns a list of Vectra Users. All search attributes will be cumulative.
    arguments:
    - name: username
      description: Filters by user name.
      default: true
    - name: role
      description: Filters by user role.
    - name: type
      description: Filters by type ('Local', 'SAML', ...)
      auto: PREDEFINED
      predefined:
      - local
      - SAML
    - name: last_login_datetime
      description: Filters for Users that logged in since the given datetime.
    outputs: &userOutput
    - contextPath: Vectra.User.Email
      type: String
      description: User's email address.
    - contextPath: Vectra.User.ID
      type: Number
      description: User ID (unique).
    - contextPath: Vectra.User.Role
      type: String
      description: User's role.
    - contextPath: Vectra.User.Type
      type: String
      description: User type ('Local', 'SAML', ...)
    - contextPath: Vectra.User.Username
      type: String
      description: Username.
    - contextPath: Vectra.User.LastLoginDate
      type: String
      description: User's last login datetime.

  - name: vectra-search-outcomes
    description: Returns a list of assignment outcomes.
    outputs: &outcomeOutput
    - contextPath: Vectra.Outcome.IsBuiltIn
      type: String
      description: Is this Outcome a builtin Outcome.
    - contextPath: Vectra.Outcome.Category
      type: String
      description: Outcome's category ('False Positive', 'Benign True Positive', 'Malicious True Positive').
    - contextPath: Vectra.Outcome.ID
      type: Number
      description: Outcome ID (unique).
    - contextPath: Vectra.Outcome.Title
      type: String
      description: Outcome title.

  ######
  ### Accounts
  #
  - name: vectra-account-describe
    description: Returns a single Account details.
    arguments:
    - name: id
      default: true
      description: Account ID you want to get details on.
    outputs: *accountOutput

  - name: vectra-account-add-tags
    description: Add tags to an Account.
    execution: true    # This command modifies the Vectra system
    arguments:
    - name: id
      default: true
      description: Account ID you want to add tags on.
    - name: tags
      description: The tags list (comma separated).
      isArray: true
    outputs: []

  - name: vectra-account-del-tags
    description: Delete tags from an Account.
    execution: true   # This command affects the Vectra system
    arguments:
    - name: id
      default: true
      description: Account ID you want to del tags from.
    - name: tags
      description: The tags list (comma separated).
      isArray: true
    outputs: []

  - name: vectra-account-tag-list
    description: Returns a list of tags for a specified account.
    arguments:
    - name: id
      required: true
      description: Specify the ID of the account.
    outputs:
    - contextPath: Vectra.Account.ID
      description: ID of the account associated with the tags.
      type: Number
    - contextPath: Vectra.Account.Tags
      description: Tags associated to the account.
      type: String

  - name: vectra-account-note-add
    description: Add a note to the account.
    arguments:
    - description: Specify the ID of the account.
      name: account_id
      required: true
    - description: Note to be added in the specified account_id.
      name: note
      required: true
    outputs:
    - contextPath: Vectra.Account.Notes.account_id
      description: ID of the account associated with the note.
      type: Number
    - contextPath: Vectra.Account.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Account.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Account.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Account.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Account.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Account.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-account-note-update
    arguments:
    - description: Specify the ID of the account.
      name: account_id
      required: true
    - description: "Specify the ID of the note.\n\nNote: Use the vectra-account-note-list command to get note_id."
      name: note_id
      required: true
    - description: Note to be updated for the specified note_id.
      name: note
      required: true
    description: Update a note in the account.
    outputs:
    - contextPath: Vectra.Account.Notes.account_id
      description: ID of the account associated with the note.
      type: Number
    - contextPath: Vectra.Account.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Account.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Account.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Account.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Account.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Account.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-account-note-remove
    arguments:
    - description: Specify the ID of the account.
      name: account_id
      required: true
    - description: "Specify the ID of the note.\n\nNote: Use the vectra-account-note-list command to get note_id."
      name: note_id
      required: true
    description: Remove a note from the account.

  - name: vectra-account-note-list
    arguments:
    - description: Specify the ID of the account.
      name: account_id
      required: true
    description: List all notes of the specific account.
    outputs:
    - contextPath: Vectra.Account.Notes.account_id
      description: ID of the account associated with the note.
      type: Number
    - contextPath: Vectra.Account.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Account.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Account.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Account.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Account.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Account.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-account-markall-detections-asfixed
    description: Mark active detections as fixed by providing the ID of the account in the argument.
    execution: true   # This command affects the Vectra system
    arguments:
    - name: account_id
      required: true
      description: Provide an account ID.
    outputs: []

  - name: vectra-account-markall-detections-asclosed
    description: Mark active detections as closed by providing the ID of the account in the argument.
    execution: true   # This command affects the Vectra system
    arguments:
    - name: account_id
      required: true
      description: Provide an account ID.
    - name: close_reason
      required: true
      description: Provide the close reason.
      auto: PREDEFINED
      predefined:
      - benign
      - remediated

  ######
  ### Hosts
  #
  - name: vectra-host-describe
    description: Returns a single Host details.
    arguments:
    - name: id
      default: true
      description: Host ID you want to get details on.
    # - name: name
    #   description: Returns Hosts having this name
    # - name: ip
    #   description: Returns Hosts having this IP address
    outputs: *hostOutput

  - name: vectra-host-add-tags
    description: Add tags to an Host.
    execution: true    # This command modifies the Vectra system
    arguments:
    - name: id
      default: true
      description: Host ID you want to add tags on.
    - name: tags
      description: The tags list (comma separated).
      isArray: true
    outputs: []

  - name: vectra-host-del-tags
    description: Delete tags from an Host.
    execution: true   # This command affects the Vectra system
    arguments:
    - name: id
      default: true
      description: Host ID you want to del tags from.
    - name: tags
      description: The tags list (comma separated).
      isArray: true
    outputs: []

  - name: vectra-host-tag-list
    description: Returns a list of tags for a specified host.
    arguments:
    - name: id
      required: true
      description: Specify the ID of the host.
    outputs:
    - contextPath: Vectra.Host.ID
      description: ID of the host associated with the tags.
      type: Number
    - contextPath: Vectra.Host.Tags
      description: Tags associated to the host.
      type: String

  - name: vectra-host-note-add
    description: Add a note to the host.
    arguments:
    - description: Specify the ID of the host.
      name: host_id
      required: true
    - description: Note to be added in the specified host_id.
      name: note
      required: true
    outputs:
    - contextPath: Vectra.Host.Notes.host_id
      description: ID of the host associated with the note.
      type: Number
    - contextPath: Vectra.Host.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Host.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Host.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Host.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Host.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Host.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-host-note-update
    arguments:
    - description: Specify the ID of the host.
      name: host_id
      required: true
    - description: "Specify the ID of the note.\n\nNote: Use the vectra-host-note-list command to get note_id."
      name: note_id
      required: true
    - description: Note to be updated for the specified note_id.
      name: note
      required: true
    description: Update a note in the host.
    outputs:
    - contextPath: Vectra.Host.Notes.host_id
      description: ID of the host associated with the note.
      type: Number
    - contextPath: Vectra.Host.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Host.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Host.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Host.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Host.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Host.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-host-note-remove
    arguments:
    - description: Specify the ID of the host.
      name: host_id
      required: true
    - description: "Specify the ID of the note.\n\nNote: Use the vectra-host-note-list command to get note_id."
      name: note_id
      required: true
    description: Remove a note from the host.

  - name: vectra-host-note-list
    arguments:
    - description: Specify the ID of the host.
      name: host_id
      required: true
    description: List all notes of the specific host.
    outputs:
    - contextPath: Vectra.Host.Notes.host_id
      description: ID of the host associated with the note.
      type: Number
    - contextPath: Vectra.Host.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Host.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Host.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Host.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Host.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Host.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-host-markall-detections-asfixed
    description: Mark active detections as fixed by providing ID of the host in the argument.
    execution: true   # This command affects the Vectra system
    arguments:
    - name: host_id
      required: true
      description: Provide a host ID.
    outputs: []

  - name: vectra-host-markall-detections-asclosed
    description: Mark active detections as closed by providing the ID of the host in the argument.
    execution: true   # This command affects the Vectra system
    arguments:
    - name: host_id
      required: true
      description: Provide a host ID.
    - name: close_reason
      required: true
      description: Provide the close reason.
      auto: PREDEFINED
      predefined:
      - benign
      - remediated

  ######
  ### Detections
  #
  - name: vectra-detection-describe
    description: Returns a single detection details.
    arguments:
    - name: id
      default: true
      description: Detection ID you want to get details on.
    outputs: *detectionOutput

  - name: vectra-detection-get-pcap
    description: Returns a Detection's PCAP file (if available).
    arguments:
    - name: id
      default: true
      description: The Detection ID you want to get the PCAP file from.
    outputs: []

  - name: vectra-detection-markasfixed
    description: Marks/Unmarks a Detection as fixed by providing the Detection ID.
    execution: true    # This command modifies the Vectra system
    arguments:
    - name: id
      default: true
      description: Detection ID you want to mark/unmark as fixed.
    - name: fixed
      description: The wanted detection status ("true", "false"). No default value.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs: []

  - name: vectra-detection-add-tags
    description: Add tags to a Detection.
    execution: true    # This command modifies the Vectra system
    arguments:
    - name: id
      default: true
      description: Detection ID you want to add tags on.
    - name: tags
      description: The tags list (comma separated).
      isArray: true
    outputs: []

  - name: vectra-detection-del-tags
    description: Delete tags from a Detection.
    execution: true   # This command affects the Vectra system
    arguments:
    - name: id
      default: true
      description: Detection ID you want to del tags from.
    - name: tags
      description: The tags list (comma separated).
      isArray: true
    outputs: []

  - name: vectra-detection-tag-list
    description: Returns a list of tags for a specified detection.
    arguments:
    - name: id
      required: true
      description: Specify the ID of the detection.
    outputs:
    - contextPath: Vectra.Detection.ID
      description: ID of the detection associated with the tags.
      type: Number
    - contextPath: Vectra.Detection.Tags
      description: Tags associated to the detection.
      type: String

  - name: vectra-detection-note-add
    description: Add a note to the detection.
    arguments:
    - description: Specify the ID of the detection.
      name: detection_id
      required: true
    - description: Note to be added in the specified detection_id.
      name: note
      required: true
    outputs:
    - contextPath: Vectra.Detection.Notes.detection_id
      description: ID of the detection associated with the note.
      type: Number
    - contextPath: Vectra.Detection.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Detection.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Detection.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Detection.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Detection.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Detection.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-detection-note-update
    arguments:
    - description: Specify the ID of the detection.
      name: detection_id
      required: true
    - description: "Specify the ID of the note.\n\nNote: Use the vectra-detection-note-list command to get note_id."
      name: note_id
      required: true
    - description: Note to be updated for the specified note_id.
      name: note
      required: true
    description: Update a note in the detection.
    outputs:
    - contextPath: Vectra.Detection.Notes.detection_id
      description: ID of the detection associated with the note.
      type: Number
    - contextPath: Vectra.Detection.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Detection.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Detection.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Detection.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Detection.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Detection.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-detection-note-remove
    arguments:
    - description: Specify the ID of the detection.
      name: detection_id
      required: true
    - description: "Specify the ID of the note.\n\nNote: Use the vectra-detection-note-list command to get note_id."
      name: note_id
      required: true
    description: Remove a note from the detection.

  - name: vectra-detection-note-list
    arguments:
    - description: Specify the ID of the detection.
      name: detection_id
      required: true
    description: List all notes of the specific detection.
    outputs:
    - contextPath: Vectra.Detection.Notes.detection_id
      description: ID of the detection associated with the note.
      type: Number
    - contextPath: Vectra.Detection.Notes.note_id
      description: ID of the note.
      type: Number
    - contextPath: Vectra.Detection.Notes.date_created
      description: Date when the note was created.
      type: Date
    - contextPath: Vectra.Detection.Notes.date_modified
      description: Date when the note was last modified.
      type: Date
    - contextPath: Vectra.Detection.Notes.created_by
      description: User who created the note.
      type: String
    - contextPath: Vectra.Detection.Notes.modified_by
      description: User who last modified the note.
      type: String
    - contextPath: Vectra.Detection.Notes.note
      description: Content of the note.
      type: String

  - name: vectra-detections-mark-asclosed
    description: Mark detections as closed with provided detection IDs in the argument.
    execution: true    # This command modifies the Vectra system
    arguments:
    - name: detection_ids
      required: true
      description: Provide a list of detection IDs separated by commas or a single detection ID.
      isArray: true
    - name: close_reason
      required: true
      description: Provide the close reason.
      auto: PREDEFINED
      predefined:
      - benign
      - remediated

  - name: vectra-detections-mark-asopen
    description: Open detections with provided detection IDs in the argument.
    execution: true    # This command modifies the Vectra system
    arguments:
    - name: detection_ids
      required: true
      description: Provide a list of detection IDs separated by commas or a single detection ID.
      isArray: true

  ######
  ### Assignment Outcomes
  #
  - name: vectra-outcome-describe
    description: Returns a single outcome details.
    arguments:
    - name: id
      default: true
      description: Outcome ID you want to get details on.
    outputs: *outcomeOutput

  - name: vectra-outcome-create
    description: Creates a new assignment outcome.
    execution: true    # This command is harmful
    arguments:
    - name: title
      description: Outcome title (will be visible in the UI).
    - name: category
      description: Outcome category (one of the 3).
      auto: PREDEFINED
      predefined:
      - Benign True Positive
      - Malicious True Positive
      - False Positive
    outputs: *outcomeOutput

  ######
  ### Assignment
  #
  - name: vectra-assignment-describe
    description: Returns a single assignment details.
    arguments:
    - name: id
      default: true
      description: Assignment ID you want to get details on.
    outputs: *assignmentOutput

  - name: vectra-assignment-assign
    description: Assigns an Account/Host entity to a Vectra User for investigation. If an assignment already exists on this entity, it will be reassigned.
    execution: true     # This command is harmful
    arguments:
    - name: assignee_id
      description: Assignee's ID (Vectra User ID).
    - name: assignment_id
      description: Assignment ID if an assignment already exists for the given entity.
    - name: account_id
      description: Account ID.
    - name: host_id
      description: Host ID.
    outputs: *assignmentOutput

  - name: vectra-assignment-resolve
    description: Resolves an assignment by selecting resolution scheme. Could be 'resolving only' or 'resolving by filtering detections'.
    execution: true     # This command is harmful
    arguments:
    - name: assignment_id
      description: Assignment's ID.
    - name: outcome_id
      description: Assignment Outcome's ID.
    - name: note
      description: A note to add to this resolution.
    - name: detections_filter
      description: Do you want to filter detections when resolving this assignment ? [Default is None].
      auto: PREDEFINED
      predefined:
      - None
      - Filter Rule
    - name: filter_rule_name
      description: Filter rule's name (when using filter_detections="Filter Rule").
    - name: detections_list
      description: Detection IDs list you want to filter.
      isArray: true
    outputs: *assignmentOutput

  ######
  ### Vectra Users
  #
  - name: vectra-user-describe
    description: Returns a single Vectra User details.
    arguments:
    - name: id
      default: true
      description: User ID you want to get details on.
    outputs: *userOutput

  ######
  ### Vectra Groups
  #
  - arguments:
    - auto: PREDEFINED
      description: Filter by group type.
      name: group_type
      predefined:
      - account
      - host
      - ip
      - domain
    - description: |-
        Filter by Account Names. Supports comma-separated values.

        Note: Only valid when the group_type parameter is set to "account".
      isArray: true
      name: account_names
    - description: |-
        Filter by Domains. Supports comma-separated values.

        Note: Only valid when the group_type parameter is set to "domain".
      isArray: true
      name: domains
    - description: |-
        Filter by Host IDs. Supports comma-separated values.

        Note: Only valid when the group_type parameter is set to "host".
      isArray: true
      name: host_ids
    - description: |-
        Filter by Host Names. Supports comma-separated values.

        Note: Only valid when the group_type parameter is set to "host".
      isArray: true
      name: host_names
    - auto: PREDEFINED
      description: Filter by group importance.
      name: importance
      predefined:
      - high
      - medium
      - low
      - never_prioritize
    - description: |-
        Filter by IPs. Supports comma-separated values.

        Note: Only valid when the group_type parameter is set to "ip".
      isArray: true
      name: ips
    - description: Filter by group description.
      name: description
    - description: |-
        Return only the groups which have a last modification timestamp equal to or after the given timestamp.

        Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

        For example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z.
      name: last_modified_timestamp
    - description: Filters by the user id who made the most recent modification to the group.
      name: last_modified_by
    - description: Filters by group name.
      name: group_name
    description: Returns a list of all groups.
    name: vectra-group-list
    outputs:
    - contextPath: Vectra.Group.group_id
      description: ID of the group.
      type: Number
    - contextPath: Vectra.Group.name
      description: Name of the group.
      type: String
    - contextPath: Vectra.Group.description
      description: Description of the group.
      type: String
    - contextPath: Vectra.Group.last_modified
      description: Date when the group was last modified.
      type: Date
    - contextPath: Vectra.Group.last_modified_by
      description: Name of the user who last modified the group.
      type: String
    - contextPath: Vectra.Group.type
      description: Type of the group.
      type: String
    - contextPath: Vectra.Group.members.id
      description: Entity ID of member.
      type: Number
    - contextPath: Vectra.Group.members.name
      description: Entity name of member.
      type: String
    - contextPath: Vectra.Group.members.is_key_asset
      description: Indicates key asset.
      type: Boolean
    - contextPath: Vectra.Group.members.url
      description: Entity URL of member.
      type: String
    - contextPath: Vectra.Group.members.uid
      description: Entity UID of member.
      type: String
    - contextPath: Vectra.Group.rules.triage_category
      description: Triage category of rule.
      type: String
    - contextPath: Vectra.Group.rules.id
      description: ID of the rule.
      type: Number
    - contextPath: Vectra.Group.rules.description
      description: Description of the rule.
      type: String
    - contextPath: Vectra.Group.importance
      description: Importance level of the group.
      type: String
    - contextPath: Vectra.Group.cognito_managed
      description: Whether the group is managed by Cognito or not.
      type: Boolean
  - arguments:
    - description: "Specify Group ID to assign members.\n\nNote: You can get the group_id by executing the \"vectra-group-list\" command."
      name: group_id
      required: true
    - description: "A comma-separated list of member values based on the group type.\n\nNote:\nYou can get the members by executing the \"vectra-group-list\" command.\nIf the group type is host, then the \"Host IDs\".\nIf the group type is account, then \"Account Names\".\nIf the group type is ip, then the list of \"IPs\".\nIf the group type is domain, then the list of \"Domains\"."
      isArray: true
      name: members
      required: true
    description: Assign members to the specified group.
    name: vectra-group-assign
    outputs:
    - contextPath: Vectra.Group.group_id
      description: ID of the group.
      type: Number
    - contextPath: Vectra.Group.name
      description: Name of the group.
      type: String
    - contextPath: Vectra.Group.description
      description: Description of the group.
      type: String
    - contextPath: Vectra.Group.last_modified
      description: Date when the group was last modified.
      type: Date
    - contextPath: Vectra.Group.last_modified_by
      description: Name of the user who last modified the group.
      type: String
    - contextPath: Vectra.Group.type
      description: Type of the group.
      type: String
    - contextPath: Vectra.Group.members.id
      description: Entity ID of member.
      type: Number
    - contextPath: Vectra.Group.members.name
      description: Entity name of member.
      type: String
    - contextPath: Vectra.Group.members.is_key_asset
      description: Indicates key asset.
      type: Boolean
    - contextPath: Vectra.Group.members.url
      description: Entity URL of member.
      type: String
    - contextPath: Vectra.Group.members.uid
      description: Entity UID of member.
      type: String
    - contextPath: Vectra.Group.rules.triage_category
      description: Triage category of rule.
      type: String
    - contextPath: Vectra.Group.rules.id
      description: ID of the rule.
      type: Number
    - contextPath: Vectra.Group.rules.description
      description: Description of the rule.
      type: String
  - arguments:
    - description: "Specify Group ID to unassign members.\n\nNote: You can get the group_id by executing the \"vectra-group-list\" command."
      name: group_id
      required: true
    - description: "A comma-separated list of member values based on the group type.\n\nNote:\nYou can get the members by executing the \"vectra-group-list\" command.\nIf the group type is host, then the \"Host IDs\".\nIf the group type is account, then \"Account Names\".\nIf the group type is ip, then the list of \"IPs\".\nIf the group type is domain, then the list of \"Domains\"."
      isArray: true
      name: members
      required: true
    description: Unassign members from the specified group.
    name: vectra-group-unassign
    outputs:
    - contextPath: Vectra.Group.group_id
      description: ID of the group.
      type: Number
    - contextPath: Vectra.Group.name
      description: Name of the group.
      type: String
    - contextPath: Vectra.Group.description
      description: Description of the group.
      type: String
    - contextPath: Vectra.Group.last_modified
      description: Date when the group was last modified.
      type: Date
    - contextPath: Vectra.Group.last_modified_by
      description: Name of the user who last modified the group.
      type: String
    - contextPath: Vectra.Group.type
      description: Type of the group.
      type: String
    - contextPath: Vectra.Group.members.id
      description: Entity ID of member.
      type: Number
    - contextPath: Vectra.Group.members.name
      description: Entity name of member.
      type: String
    - contextPath: Vectra.Group.members.is_key_asset
      description: Indicates key asset.
      type: Boolean
    - contextPath: Vectra.Group.members.url
      description: Entity URL of member.
      type: String
    - contextPath: Vectra.Group.members.uid
      description: Entity UID of member.
      type: String
    - contextPath: Vectra.Group.rules.triage_category
      description: Triage category of rule.
      type: String
    - contextPath: Vectra.Group.rules.id
      description: ID of the rule.
      type: Number
    - contextPath: Vectra.Group.rules.description
      description: Description of the rule.
      type: String

tests:
- No tests - Not dev yet

Note ID	Note	Created By	Created Date	Modified By	Modified Date
1961	updated note 2nd	xsoar	2024-07-12T04:52:20Z	xsoar	2024-07-12T10:21:03Z
1937	your first test note	xsoar	2024-07-11T07:32:20Z

Group ID	Name	Group Type	Members	Last Modified Timestamp
1	AccountNoBlock	account	user@lab.test.local, O365:serviceprincipal_00000000-0000-0000-0000-000000000001	2024-07-22T06:44:44Z
2	AccountBlock	account	O365:serviceprincipal_00000000-0000-0000-0000-000000000001	2024-07-22T06:44:40Z

Vectra_Detect

Details

README

Use cases

Configure Vectra Detect on Cortex XSOAR

Configuration for fetching Vectra Account or Vectra Host as a Cortex XSOAR incident

Cleanup Duplicate Incidents

Commands

vectra-search-accounts

Base Command

Input

Context Output

vectra-search-hosts

Base Command

Input

Context Output

vectra-search-detections

Base Command

Input

Context Output

vectra-search-assignments

Base Command

Input

Context Output

vectra-search-users

Base Command

Input

Context Output

vectra-search-outcomes

Base Command

Input

Context Output

vectra-account-describe

Base Command

Input

Context Output

vectra-account-add-tags

Base Command

Input

Context Output

vectra-account-del-tags

Base Command

Input

Context Output

vectra-account-tag-list

Base Command

Input

Context Output

Command example

Context Example

Human Readable Output

List of tags: note, tag_from_xsoar, tag_from_vectra

vectra-account-note-add

Base Command

Input

Context Output

Command example

Context Example

Human Readable Output

The note has been successfully added to the account

vectra-account-note-update

Base Command

Input

Context Output

Command example

Context Example

Human Readable Output

The note has been successfully updated in the account

vectra-account-note-remove

Base Command

Input

Context Output

Command example

Human Readable Output

The note has been successfully removed from the account

vectra-account-note-list

Base Command

Input

Context Output

Command example