VectraRUXEventsDetections

This integration allows the security operations center to create and manage incidents based on Vectra Events Detections.

Network Security · Vectra RUX

Configuration parameters

  • server_url — Server URL (required)
  • credentials — Client ID (required)
  • isFetch — Fetch incidents
  • max_fetch — Max Fetch
  • first_fetch — First Fetch Time
  • entity_types — Entity Types
  • only_prioritized_detections — Create Incidents for Prioritized Detections
  • only_escalated_detections — Create Incidents for Escalated Detections
  • mirror_direction — Mirroring Direction
  • note_tag — Mirror tag for notes
  • open_detection_on_incident_reopen — Open Detection on Incident Reopen
  • detection_status_for_reopen — Detection Status for Incident Reopen
  • close_detection_on_incident_closure — Close Detection on Incident Closure
  • close_reason_of_detection — Detection Close Reason for Incident Closure
  • incidentType — Incident type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (36)

  • vectra-assignment-list

    Returns a list of all assignments.

  • vectra-detection-describe

    Returns a list of detections for the specified detection ID(s).

  • vectra-detection-external-id-update

    Update the external reference ID for the provided detection ID(s).

  • vectra-detection-investigation-status-update

    Update the investigation status of the detection by detection ID(s).

  • vectra-detection-list

    Returns a list of detections based on the specified filters.

  • vectra-detection-note-add

    Add a note to the detection.

  • vectra-detection-note-list

    Returns a list of notes for a specified detection.

  • vectra-detection-note-remove

    Remove a note from the detection.

  • vectra-detection-note-update

    Update a note in the detection.

  • vectra-detection-pcap-download

    Download pcap of the detection.

  • vectra-detection-tag-add

    Add tags to a detection.

  • vectra-detection-tag-list

    Returns a list of tags for a specified detection.

  • vectra-detection-tag-remove

    Remove tags from the detection.

  • vectra-detections-mark-asclosed

    Mark detections as closed with provided detection IDs in the argument.

  • vectra-detections-mark-asopen

    Open detections with provided detection IDs in the argument.

  • vectra-entity-assignment-add

    Add an assignment for the entity.

  • vectra-entity-assignment-update

    Update an assignment in the entity.

  • vectra-entity-describe

    Describes an entity by ID.

  • vectra-entity-detection-list

    Returns a list of detections for a specified entity.

  • vectra-entity-detections-mark-asclosed

    Mark the detections of the entity as closed with the provided entity ID in the argument.

  • vectra-entity-external-id-update

    Update the external reference ID for the provided entity.

  • vectra-entity-list

    Returns a list of entities.

  • vectra-entity-note-add

    Add a note to the entity.

  • vectra-entity-note-list

    Returns a list of notes for a specified entity.

  • vectra-entity-note-remove

    Remove a note from the entity.

  • vectra-entity-note-update

    Update a note in the entity.

  • vectra-entity-tag-add

    Add tags in the entity.

  • vectra-entity-tag-list

    Returns a list of tags for a specified entity.

  • vectra-entity-tag-remove

    Remove tags from the entity.

  • vectra-entity-unresolved-priority-reset

    Update the unresolved priority of an entity to false.

  • vectra-group-assign

    Assign members to the specified group.

  • vectra-group-list

    Returns a list of all groups.

  • vectra-group-unassign

    Unassign members from the specified group.

  • vectra-investigation-query-send

    Submit an investigation query and receive a request ID for retrieving results.

  • vectra-investigation-result-get

    Retrieve the results of a previously submitted investigation query using the request ID.

  • vectra-user-list

    Returns a list of users.