ZeroTrustAnalyticsPlatform

Zero Trust Analytics Platform (ZTAP) is the underlying investigation platform and user interface for Critical Start's MDR service.

Endpoint · Zero Trust Analytics Platform

Configuration parameters

  • url — ZTAP server URL (required)
  • apikey — API Key (required)
  • reopen_group — Reopen Group (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • mirror_direction — Incident Mirroring Direction
  • comment_tag — Comment entry tag
  • escalate_tag — Escalate entry tag
  • input_tag — ZTAP input tag
  • get_attachments — Fetch attachments for comments from ZTAP
  • close_incident — Sync closing incidents with ZTAP
  • reopen_incident — Sync reopening incidents with ZTAP
  • first_fetch — First fetch timestamp
  • max_fetch — Maximum number of incidents to fetch

Commands (3)

  • get-mapping-fields

    Get mapping fields from remote incident.

  • get-remote-data

    Get remote data from a remote incident. This command should only be called manually for debugging purposes.

  • ztap-get-alert-entries

    Get the entries data from a remote incident.