Vectra_Detect

This integration allows to create incidents based on Vectra Accounts/Hosts/Detections objects.
This integration was integrated and tested with version 7.1 of Vectra Detect

Use cases

1. Fetch accounts, hosts and detections from Vectra Detect.
2. Bi-Directional mirroring for accounts and hosts.
3. List and describe accounts, hosts, detections, and users.
4. List, describe, create, and resolve assignments for accounts and hosts.
5. List, describe, and create assignment outcomes.
6. List, create, update, and delete notes for accounts, hosts, and detections.
7. List, create, and remove tags for accounts, hosts, and detections.
8. List, assign, and unassign members in group.
9. Mark and unmark detection as fixed.
10. Mark all detections as fixed for accounts and hosts.
11. Get detection’s PCAP file.
12. Clean up all incidents in Cortex XSOAR by closing duplicate incidents from Vectra Detect.

Configure Vectra Detect on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for Vectra Detect.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Vectra Detect FQDN or IP	Enter the FQDN or IP to reach the Vectra Detect API. (e.g. “my-vectra-box.local” or “192.168.1.1”)	True
   Authentication Type	Select the authentication type (Default - API Token).	False
   API Token	Enter the API token that can be retrieved from the Vectra UI > My Profile > General (tab) > API Token. You can also use the XSOAR credentials wallet to store it. In that case, the token should be the password.	False
   Client ID and Client Secret Key	Enter the Client ID and Client Secret Key that can be retrieved from the Vectra UI > Manage > API Clients. You can also use the XSOAR credentials wallet to store it.	False
   Trust any certificate (not secure)	When checked, no SSL certificates check will be done when interacting with the Vectra Detect API. It’s insecure. (Default - unchecked)	False
   Use system proxy settings	Use the system proxy settings to reach with the Vectra Detect API.	False
   Fetch incidents		False
   Incident type		False
   First fetch timestamp	The date or relative timestamp from which to begin fetching entities. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2024, 01 Aug 2024 04:45:33, 2024-07-17T14:05:44Z. (default - 7 days)	False
   Mirroring Direction	The mirroring direction in which to mirror the account and host. You can mirror “Incoming” (from Vectra to Cortex XSOAR), “Outgoing” (from Cortex XSOAR to Vectra), or in both directions.	False
   Re-Fetch closed incidents via mirroring	If selected, new incidents will be created (via Outgoing Mirroring). If not selected, it reopens previously closed incidents (via Incoming Mirroring). Note: This flow is triggered only when the relevant account or host is still active and the previously fetched incident is closed.	False
   Mirror tag for notes	The tag value should be used to mirror the account and host note by adding the same tag in the notes.	False
   Entity types to fetch	Choose what to fetch - Accounts and/or Hosts and/or Detections. (Default - Accounts,Hosts)	False
   Tags	Only Accounts or Hosts that contain any of the tags specified will be fetched. Note: For the partial match of the tag, use ‘*’ at the start and end of word (Only a single word is allowed). Ex. *MDR*.	False
   Detection Category	Filter the detections belonging to a specified category displayed as part of layout. Note: This filter applies on the ‘Vectra Account’ and ‘Vectra Host’ incident type.	False
   Detection Type	Filter the detections belonging to a specified type displayed as part of layout. Note: This filter applies on the ‘Vectra Account’ and ‘Vectra Host’ incident type.
   Hosts fetch query	Only “active” Hosts matching this fetch query will be fetched. Will be used only if “Hosts” is selected in the “Entity types to fetch”. (default - host.threat:>=50)	False
   Accounts fetch query	Only “active” Accounts matching this fetch query will be fetched. Will be used only if “Accounts” is selected in the “Entity types to fetch”. (default - account.threat:>=50)	False
   Detections fetch query	Only “active” Detections matching this fetch query will be fetched. Will be used only if “Detections” is selected in the “Entity types to fetch”. (default - detection.threat:>=50 AND detection.certainty:>=50)	False
   Max created incidents per fetch	The maximum number of new incidents to create per fetch. This value would be split between selected “Entity types to fetch”. If the value is greater than 200, it will be considered as 200. The maximum is 200. (Default - 50)	False
   Advanced: Minutes to look back when fetching	Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created.	False
   Advanced: Fetch escalated Accounts and Hosts	Use this parameter to fetch escalated Accounts and Hosts. Note: If this parameter is set to True, it will fetch Accounts and Hosts that have been updated based on the provided filter parameters, even if their detection timestamps are older than the first fetch time.	False
   Re-Fetch Account/Host entity and Detection for new activity/event	Whether to create multiple incidents for the same entity (Account or Host) or Detection if new detection activity occurs for the entity (Account or Host) or a new event is detected for the detection.	False

4. Click Test to validate the URLs, token, and connection.

Configuration for fetching Vectra Account or Vectra Host as a Cortex XSOAR incident

To fetch Vectra Account or Vectra Host as a Cortex XSOAR incident:

1. Select Fetches incidents.
2. Under Classifier, select “Vectra Detect”.
3. Under Incident type, select “N/A”.
4. Under Mapper (incoming), select “Vectra Detect - Incoming Mapper” for default mapping.
5. Select the “Authentication Type” (Default - API Token).
6. Enter connection parameters. (Vectra Detect FQDN or IP, API Token or Client ID and Client Secret Key)
7. Select SSL certificate validation and Proxy if required.
8. Update “Max created incidents per fetch” & “First fetch timestamp” based on your requirements.
9. Select the Incident Mirroring Direction:
   1. Incoming - Mirrors changes from the Vectra into the Cortex XSOAR incident.
   2. Outgoing - Mirrors changes from the Cortex XSOAR incident to the Vectra.
   3. Incoming And Outgoing - Mirrors changes both Incoming and Outgoing directions on incidents.
10. Check the “Re-Fetch closed incidents via mirroring” option if you want to prevent reopening of closed incidents and refetch them via mirroring on modification of the Vectra Account or Vectra Host.
11. Enter the relevant tag name for mirror notes.
    Note: This value is mapped to the dbotMirrorTags incident field in Cortex XSOAR, which defines how Cortex XSOAR handles notes when you tag them in the War Room. This is required for mirroring notes from Cortex XSOAR to Vectra.
12. Provide the filter parameter “Tags”, to filter entities by specific tag/s for fetch type account and host.
13. Provide the filter parameter “Detection Category” and “Detection Type”, to filter detections by the specified category and type for fetch type account and host.
14. Provide the “Minutes to look back when fetching” parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created.
15. Check the “Fetch escalated Accounts and Hosts” option to fetch escalated Accounts and Hosts that have been updated based on the provided filter parameters, even if their detection timestamps are older than the first fetch time.
16. Check the “Re-Fetch Account/Host entity and Detection for new activity/event” option if you want multiple Cortex XSOAR incidents to be created for the same Entity (Account or Host) or Detection whenever new detection activity is recorded. Disable this option if you want only one incident per Entity (Account or Host) or Detection regardless of ongoing activity.

Notes for mirroring:

• The mirroring is strictly tied to incident types “Vectra Account” and “Vectra Host”, as well as the incoming mapper “Vectra Detect - Incoming Mapper”. If you want to change or use a custom incident type/mapper, ensure that related changes are also present.
• The mirroring settings apply only for incidents that are fetched after applying the settings.
• Any tags removed from the Vectra Account or Vectra Host will not be removed in the Cortex XSOAR incident, as Cortex XSOAR doesn’t allow the removal of the tags field via the backend. However, tags removed from the Cortex XSOAR incident UI will be removed from the Vectra Account or Vectra Host.
• New notes from the Cortex XSOAR incident will be created as notes in the Vectra Account or Vectra Host. Updates to existing notes in the Cortex XSOAR incident will not be reflected in the Vectra Account or Vectra Host.
• New notes from the Vectra Account or Vectra Host will be created as notes in the Cortex XSOAR incident. Updates to existing notes in the Vectra Account or Vectra Host will create new notes in the Cortex XSOAR incident.
• If a closed Cortex XSOAR incident is tied to a specific Vectra Account or Vectra Host and new detections for that Vectra Account or Vectra Host arise or existing detections become active again:
  • If “Re-Fetch closed Incidents while Mirroring” checkbox is not selected and “Incoming Mirroring” is enabled, the incident will be automatically reopened.
  • If “Re-Fetch closed Incidents while Mirroring” checkbox is selected and “Outgoing Mirroring” is enabled, a new incident will be created for the Vectra Account or Vectra Host.
• When a Cortex XSOAR incident is closed but there are still active detections on the Vectra side, and the Vectra Account or Vectra Host is subsequently updated:
  • If “Re-Fetch closed Incidents while Mirroring” checkbox is not selected and “Incoming Mirroring” is enabled, the corresponding XSOAR incident for that Vectra Account or Vectra Host will be reopened.
  • If “Re-Fetch closed Incidents while Mirroring” checkbox is selected and “Outgoing Mirroring” is enabled, a new incident will be created for the Vectra Account or Vectra Host.
• If a Cortex XSOAR incident is reopened and the corresponding entity has an assignment in Vectra, the assignment will be removed from Vectra.
• If you want to use the mirror mechanism and you’re using custom mappers, then the incoming mapper must contain the following fields: dbotMirrorDirection, dbotMirrorId, dbotMirrorInstance, and dbotMirrorTags.
• To use a custom mapper, you must first duplicate the mapper and update the fields in the copy of the mapper. (Refer to the “Create a custom mapper consisting of the default Vectra Detect - Incoming Mapper” section for more information.)
• Following new fields are introduced in the response of the incident to enable the mirroring:
  • mirror_direction: This field determines the mirroring direction for the incident. It is a required field for Cortex XSOAR to enable mirroring support.
  • mirror_tags: This field determines what would be the tag needed to mirror the Cortex XSOAR entry out to Vectra. It is a required field for XSOAR to enable mirroring support.
  • mirror_instance: This field determines from which instance the Cortex XSOAR incident was created. It is a required field for Cortex XSOAR to enable mirroring support.

Cleanup Duplicate Incidents

• Use the Close All Duplicate XSOAR Incidents - Vectra Detect playbook to clean up duplicate incidents. You can use VectraDetectCloseDuplicateIncidents script individually to clean up duplicate incidents.
• You can also schedule a job with Close All Duplicate XSOAR Incidents - Vectra Detect playbook in Cortex XSOAR to clean up incidents periodically. Refer to this Cortex XSOAR documentation for more information.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

vectra-search-accounts

Returns a list of Account objects. All search attributes will be cumulative unless you’re using the search_query_only one, in that case, only this one will be taken into account.

Base Command

vectra-search-accounts

Input

Context Output

vectra-search-hosts

Returns a list of Host objects. All search attributes will be cumulative unless you’re using the search_query_only one, in that case, only this one will be taken into account.

Base Command

vectra-search-hosts

Input

Context Output

vectra-search-detections

Returns a list of Detection objects. All search attributes will be cumulative unless you’re using the search_query_only one, in that case, only this one will be taken into account.

Base Command

vectra-search-detections

Input

Context Output

vectra-search-assignments

Return a list of assignments. By default already resolved assignment are not returned.

Base Command

vectra-search-assignments

Input

Context Output

vectra-search-users

Returns a list of Vectra Users. All search attributes will be cumulative.

Base Command

vectra-search-users

Input

Context Output

vectra-search-outcomes

Returns a list of assignment outcomes.

Base Command

vectra-search-outcomes

Input

There are no input arguments for this command.

Context Output

vectra-account-describe

Returns a single Account details

Base Command

vectra-account-describe

Input

Context Output

vectra-account-add-tags

Add tags to an Account

Base Command

vectra-account-add-tags

Input

Context Output

There is no context output for this command.

vectra-account-del-tags

Delete tags from an Account

Base Command

vectra-account-del-tags

Input

Context Output

There is no context output for this command.

vectra-account-tag-list

Returns a list of tags for a specified account.

Base Command

vectra-account-tag-list

Input

Context Output

Command example

!vectra-account-tag-list id="2"

Context Example

{
    "Vectra.Account": {
        "ID": 2,
        "Tags": [
            "note",
            "tag_from_xsoar",
            "tag_from_vectra"
        ]
    }
}

Human Readable Output

List of tags: note, tag_from_xsoar, tag_from_vectra

vectra-account-note-add

Add a note to the account.

Base Command

vectra-account-note-add

Input

Context Output

Command example

!vectra-account-note-add account_id="2" note="test note"

Context Example

{
    "Vectra.Account.Notes": {
        "date_created": "2024-07-10T07:30:58.574942Z",
        "created_by": "xsoar",
        "note": "test note",
        "note_id": 1959,
        "account_id": 2
    }
}

Human Readable Output

The note has been successfully added to the account

Returned Note ID: 1959

vectra-account-note-update

Update a note in the account.

Base Command

vectra-account-note-update

Input

Context Output

Command example

!vectra-account-note-update account_id="2" note_id="1959" note="updated test note"

Context Example

{
    "Vectra.Account.Notes": {
        "date_created": "2024-07-10T07:30:58.574942Z",
        "date_modified": "2024-07-12T06:42:29.546835Z",
        "created_by": "xsoar",
        "modified_by": "xsoar",
        "note": "updated test note",
        "note_id": 1959,
        "account_id": 2
    }
}

Human Readable Output

The note has been successfully updated in the account

vectra-account-note-remove

Remove a note from the account.

Base Command

vectra-account-note-remove

Input

Context Output

There is no context output for this command.

Command example

!vectra-account-note-remove account_id="2" note_id="1959"

Human Readable Output

The note has been successfully removed from the account

vectra-account-note-list

List all notes of the specific account.

Base Command

vectra-account-note-list

Input

Context Output

Command example

!vectra-account-note-list account_id="2"

Context Example

{
    "Vectra.Account.Notes": [
        {
            "date_created": "2024-07-10T05:40:31Z",
            "date_modified": "2024-07-16T12:56:30Z",
            "created_by": "xsoar",
            "modified_by": "xsoar",
            "note": "updated_note",
            "note_id": 1959,
            "account_id": 2
        },
        {
            "date_created": "2024-07-08T07:11:49Z",
            "created_by": "xsoar",
            "note": "Here comes your note TEST",
            "note_id": 1906,
            "account_id": 2
        }
    ]
}

Human Readable Output

Notes Table

Note ID	Note	Created By	Created Date	Modified By	Modified Date
1959	updated_note	xsoar	2024-07-10T05:40:31Z	xsoar	2024-07-16T12:56:30Z
1906	Here comes your note TEST	xsoar	2024-07-08T07:11:49Z

vectra-account-markall-detections-asfixed

Mark active detections as fixed by providing the ID of the account in the argument.

Base Command

vectra-account-markall-detections-asfixed

Input

Context Output

There is no context output for this command.

Command example

!vectra-account-markall-detections-asfixed account_id=109

Human Readable Output

The active detections of the provided account have been successfully marked as fixed.

vectra-account-markall-detections-asclosed

Mark active detections as closed by providing the ID of the account in the argument.

Base Command

vectra-account-markall-detections-asclosed

Input

Context Output

There is no context output for this command.

Command example

!vectra-account-markall-detections-asclosed account_id=108 close_reason=benign

Human Readable Output

The active detections of the provided account have been successfully closed as benign

vectra-host-describe

Returns a single Host details

Base Command

vectra-host-describe

Input

Context Output

vectra-host-add-tags

Add tags to an Host

Base Command

vectra-host-add-tags

Input

Context Output

There is no context output for this command.

vectra-host-del-tags

Delete tags from an Host

Base Command

vectra-host-del-tags

Input

Context Output

There is no context output for this command.

vectra-host-tag-list

Returns a list of tags for a specified host.

Base Command

vectra-host-tag-list

Input

Context Output

Command example

!vectra-host-tag-list id="2"

Context Example

{
    "Vectra.Host": {
        "ID": 2,
        "Tags": [
            "note",
            "tag_from_xsoar",
            "tag_from_vectra"
        ]
    }
}

Human Readable Output

List of tags: note, tag_from_xsoar, tag_from_vectra

vectra-host-note-add

Add a note to the host.

Base Command

vectra-host-note-add

Input

Context Output

Command example

!vectra-host-note-add host_id="5" note="test note"

Context Example

{
    "Vectra.Host.Notes": {
        "date_created": "2024-07-10T07:31:58.574942Z",
        "created_by": "xsoar",
        "note": "test note",
        "note_id": 1960,
        "host_id": 5
    }
}

Human Readable Output

The note has been successfully added to the host

Returned Note ID: 1960

vectra-host-note-update

Update a note in the host.

Base Command

vectra-host-note-update

Input

Context Output

Command example

!vectra-account-note-update host_id="7" note_id="1960" note="updated test note"

Context Example

{
    "Vectra.Host.Notes": {
        "date_created": "2024-07-10T07:31:58.574942Z",
        "date_modified": "2024-07-12T06:44:29.546835Z",
        "created_by": "xsoar",
        "modified_by": "xsoar",
        "note": "updated test note",
        "note_id": 1960,
        "host_id": 7
    }
}

Human Readable Output

The note has been successfully updated in the host

vectra-host-note-remove

Remove a note from the host.

Base Command

vectra-host-note-remove

Input

Context Output

There is no context output for this command.

Command example

!vectra-host-note-remove host_id="7" note_id="1960"

Human Readable Output

The note has been successfully removed from the host

vectra-host-note-list

List all notes of the specific host.

Base Command

vectra-host-note-list

Input

Context Output

Command example

!vectra-host-note-list host_id="7"

Context Example

{
    "Vectra.Host.Notes": [
        {
            "date_created": "2024-07-11T07:32:31Z",
            "created_by": "xsoar",
            "note": "test note",
            "note_id": 1960,
            "host_id": 7
        },
        {
            "date_created": "2024-07-11T06:23:07Z",
            "created_by": "cds_xsoar",
            "note": "test note",
            "note_id": 1982,
            "host_id": 7
        }
    ]
}

Human Readable Output

Notes Table

Note ID	Note	Created By	Created Date
1960	test note	xsoar	2024-07-11T07:32:31Z
1982	test note	cds_xsoar	2024-07-11T06:23:07Z

vectra-host-markall-detections-asfixed

Mark active detections as fixed by providing ID of the host in the argument.

Base Command

vectra-host-markall-detections-asfixed

Input

Context Output

There is no context output for this command.

Command example

!vectra-host-markall-detections-asfixed host_id=23176

Human Readable Output

The active detections of the provided host have been successfully marked as fixed.

vectra-host-markall-detections-asclosed

Mark active detections as closed by providing the ID of the host in the argument.

Base Command

vectra-host-markall-detections-asclosed

Input

Context Output

There is no context output for this command.

Command example

!vectra-host-markall-detections-asclosed host_id=23176 close_reason=remediated

Human Readable Output

The active detections of the provided host have been successfully closed as remediated

vectra-detection-describe

Returns a single detection details

Base Command

vectra-detection-describe

Input

Context Output

vectra-detection-get-pcap

Returns a Detection’s PCAP file (if available)

Base Command

vectra-detection-get-pcap

Input

Context Output

There is no context output for this command.

vectra-detection-markasfixed

Marks/Unmarks a Detection as fixed by providing the Detection ID

Base Command

vectra-detection-markasfixed

Input

Context Output

There is no context output for this command.

vectra-detection-add-tags

Add tags to a Detection

Base Command

vectra-detection-add-tags

Input

Context Output

There is no context output for this command.

vectra-detection-del-tags

Delete tags from a Detection

Base Command

vectra-detection-del-tags

Input

Context Output

There is no context output for this command.

vectra-detection-tag-list

Returns a list of tags for a specified detection.

Base Command

vectra-detection-tag-list

Input

Context Output

Command example

!vectra-detection-tag-list id="2"

Context Example

{
    "Vectra.Detection": {
        "ID": 2,
        "Tags": [
            "note",
            "tag_from_xsoar",
            "tag_from_vectra"
        ]
    }
}

Human Readable Output

List of tags: note, tag_from_xsoar, tag_from_vectra

vectra-detection-note-add

Add a note to the detection.

Base Command

vectra-detection-note-add

Input

Context Output

Command example

!vectra-detection-note-add detection_id="7" note="test note"

Context Example

{
    "Vectra.Detection.Notes": {
        "date_created": "2024-07-10T07:32:58.574942Z",
        "created_by": "xsoar",
        "note": "test note",
        "note_id": 1961,
        "detection_id": 7
    }
}

Human Readable Output

The note has been successfully added to the detection

Returned Note ID: 1961

vectra-detection-note-update

Update a note in the detection.

Base Command

vectra-detection-note-update

Input

Context Output

Command example

!vectra-detection-note-update detection_id="9" note_id="1961" note="updated test note"

Context Example

{
    "Vectra.Detection.Notes": {
        "date_created": "2024-07-10T07:32:58.574942Z",
        "date_modified": "2024-07-12T06:43:29.546835Z",
        "created_by": "xsoar",
        "modified_by": "xsoar",
        "note": "updated test note",
        "note_id": 1961,
        "detection_id": 9
    }
}

Human Readable Output

The note has been successfully updated in the detection

vectra-detection-note-remove

Remove a note from the detection.

Base Command

vectra-detection-note-remove

Input

Context Output

There is no context output for this command.

Command example

!vectra-detection-note-remove detection_id=97" note_id="1961"

Human Readable Output

The note has been successfully removed from the detection

vectra-detection-note-list

List all notes of the specific detection.

Base Command

vectra-detection-note-list

Input

Context Output

Command example

!vectra-detection-note-list detection_id="9"

Context Example

{
    "Vectra.Detection.Notes": [
        {
            "date_created": "2024-07-12T04:52:20Z",
            "date_modified": "2024-07-12T10:21:03Z",
            "created_by": "xsoar",
            "modified_by": "xsoar",
            "note": "updated note 2nd",
            "note_id": 1961,
            "detection_id": 9
        },
        {
            "date_created": "2024-07-11T07:32:20Z",
            "created_by": "xsoar",
            "note": "your first test note",
            "note_id": 1937,
            "detection_id": 9
        }
    ]
}

Human Readable Output

Notes Table

Note ID	Note	Created By	Created Date	Modified By	Modified Date
1961	updated note 2nd	xsoar	2024-07-12T04:52:20Z	xsoar	2024-07-12T10:21:03Z
1937	your first test note	xsoar	2024-07-11T07:32:20Z

vectra-detections-mark-asclosed

Mark detections as closed with provided detection IDs in the argument.

Base Command

vectra-detections-mark-asclosed

Input

Context Output

There is no context output for this command.

Command example

!vectra-detections-mark-asclosed detection_ids=123,345 close_reason=remediated

Human Readable Output

The provided detection IDs have been successfully closed as remediated

vectra-detections-mark-asopen

Open detections with provided detection IDs in the argument.

Base Command

vectra-detections-mark-asopen

Input

Context Output

There is no context output for this command.

Command example

!vectra-detections-mark-asopen detection_ids=123,345

Human Readable Output

The provided detection IDs have been successfully re-opened

vectra-outcome-describe

Returns a single outcome details

Base Command

vectra-outcome-describe

Input

Context Output

vectra-outcome-create

Creates a new assignment outcome

Base Command

vectra-outcome-create

Input

Context Output

vectra-assignment-describe

Returns a single assignment details

Base Command

vectra-assignment-describe

Input

Context Output

vectra-assignment-assign

Assigns an Account/Host entity to a Vectra User for investigation. If an assignment already exists on this entity, it will be reassigned

Base Command

vectra-assignment-assign

Input

Context Output

vectra-assignment-resolve

Resolves an assignment by selecting resolution scheme. Could be ‘resolving only’ or ‘resolving by filtering detections’

Base Command

vectra-assignment-resolve

Input

Context Output

vectra-user-describe

Returns a single Vectra User details

Base Command

vectra-user-describe

Input

Context Output

vectra-group-list

Returns a list of all groups.

Base Command

vectra-group-list

Input

Context Output

Command example

!vectra-group-list group_type=account importance=high

Context Example

{
    "Vectra": {
        "Group": [
            {
                "description": "",
                "group_id": 1,
                "id": 1,
                "last_modified": "2024-07-22T06:44:44Z",
                "last_modified_by": "cds_xsoar",
                "members": [
                    {
                        "uid": "user@lab.test.local"
                    },
                    {
                        "uid": "O365:serviceprincipal_00000000-0000-0000-0000-000000000001"
                    }
                ],
                "name": "AccountNoBlock",
                "type": "account"
            },
            {
                "description": "",
                "group_id": 2,
                "id": 2,
                "last_modified": "2024-07-22T06:44:40Z",
                "last_modified_by": "cds_xsoar",
                "members": [
                    {
                        "uid": "O365:serviceprincipal_00000000-0000-0000-0000-000000000001"
                    }
                ],
                "name": "AccountBlock",
                "type": "account"
            }
        ]
    }
}

Human Readable Output

Groups Table

Group ID	Name	Group Type	Members	Last Modified Timestamp
1	AccountNoBlock	account	user@lab.test.local, O365:serviceprincipal_00000000-0000-0000-0000-000000000001	2024-07-22T06:44:44Z
2	AccountBlock	account	O365:serviceprincipal_00000000-0000-0000-0000-000000000001	2024-07-22T06:44:40Z

vectra-group-assign

Assign members to the specified group.

Base Command

vectra-group-assign

Input

Context Output

Command example

!vectra-group-assign group_id=3557 members="account_4"

Context Example

{
    "Vectra": {
        "Group": {
        "id": 3,
        "name": "xsoar-account-group-2",
        "last_modified": "2023-09-04T09:22:46Z",
        "last_modified_by": "TEST Client",
        "members": [
            {
                "uid": "account_1"
            },
            {
                "uid": "account_2"
            },
            {
                "uid": "account_3"
            },
            {
                "uid": "account_4"
            }
        ],
        "type": "account",
        "group_id": 3
        }
    }
}

Human Readable Output

Member(s) account_4 have been assigned to the group

Updated group details

Group ID	Name	Group Type	Members	Last Modified Timestamp
3	xsoar-account-group-2	account	account_1, account_2, account_3, account_4	2023-09-04T09:22:46Z

vectra-group-unassign

Unassign members from the specified group.

Base Command

vectra-group-unassign

Input

Context Output

Command example

!vectra-group-unassign group_id=5 members="2126"

Context Example

{
    "Vectra": {
        "Group": {
            "id": 2,
            "group_id": 2,
            "type": "host",
            "name": "TEST RENAME",
            "description": "TEST RENAME",
            "last_modified": "2023-09-04T06:27:57Z",
            "last_modified_by": "TEST Client"
        }
    }
}

Human Readable Output

Member(s) 2126 have been unassigned from the group

Updated group details

Group ID	Name	Group Type	Description	Last Modified Timestamp
2	TEST RENAME	host	TEST RENAME	2023-09-04T06:27:57Z

Troubleshooting

Receive Notification on an Incident Fetch Error

The administrator and Cortex XSOAR users on the recipient’s list receive a notification when an integration experiences an incident fetch error. Cortex XSOAR users can select their notification method, such as email, from their user preferences. Refer to Cortex XSOAR 6.13 documentation or Cortex XSOAR 8 Cloud documentation or Cortex XSOAR 8.7 On-prem documentation for more information.

The following are tips for handling issues with mirroring incidents between Vectra and Cortex XSOAR

Docker timeout issue for Fetch Incidents

• If you encounter a timeout error while fetching incidents, you can try adjusting the value of the max_fetch parameter in the instance configuration. Setting it to a lower value, such as 50 can help prevent the timeout issue.

• Another way to address this issue is to increase the timeout of the Docker container. By default, Docker containers have a timeout of 5 minutes. You can increase this timeout to a higher value, such as 10 minutes, to allow more time for the fetch command to complete. Refer to this XSOAR documentation for more information.

Handling HTTP 429 and 5xx Errors

The commands and fetch incidents mechanism will do up to 3 internal retries with a gap of 15, 30, and 60 seconds (exponentially) between the retries.