ZeroTrustAnalyticsPlatform

Details

ID	`ZeroTrustAnalyticsPlatform`
Provider	Zscaler
Category	Endpoint
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Zero Trust Analytics Platform (ZTAP) is the underlying investigation platform and user interface for Critical Start’s MDR service.
This integration was integrated and tested with version 2021-06-25 of ZeroTrustAnalyticsPlatform

Configure ZeroTrustAnalyticsPlatform in Cortex

Parameter	Description	Required
ZTAP server URL		True
API Key	The API Key to use for connection	True
Reopen Group	Group to send to when reopening	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
Incident type		False
Incident Mirroring Direction		False
Comment entry tag	Adding this tag to a Note will sync as a comment in ZTAP	False
Escalate entry tag	Adding this tag to a Note will reassign the alert back to Critical Start SOC	False
ZTAP input tag		False
Fetch attachments for comments from ZTAP		False
Sync closing incidents with ZTAP	Cortex XSOAR only parameter.	False
Sync reopening incidents with ZTAP		False
First fetch timestamp		False
Maximum number of incidents to fetch		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

get-mapping-fields

Get mapping fields from remote incident.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

### get-remote-data

***
Get remote data from a remote incident. This command should only be called manually for debugging purposes.

#### Base Command

`get-remote-data`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | The remote incident id. | Required |
| lastUpdate | UTC timestamp in seconds. The incident is only updated if it was modified after the last update time. Default is 0. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

!get-remote-data id=1 lastUpdate=2000-01-1
```

Human Readable Output

ztap-get-alert-entries

Get the entries data from a remote incident.

Base Command

ztap-get-alert-entries

Input

Argument Name	Description	Required
id	The remote incident id.	Required

Context Output

There is no context output for this command.

Command Example

!ztap-get-alert-entries id=1

Human Readable Output

Example comment.
Sent by User (test@test) via ZTAP

Configuration parameters

url — ZTAP server URL (required)
apikey — API Key (required)
reopen_group — Reopen Group (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
mirror_direction — Incident Mirroring Direction
comment_tag — Comment entry tag
escalate_tag — Escalate entry tag
input_tag — ZTAP input tag
get_attachments — Fetch attachments for comments from ZTAP
close_incident — Sync closing incidents with ZTAP
reopen_incident — Sync reopening incidents with ZTAP
first_fetch — First fetch timestamp
max_fetch — Maximum number of incidents to fetch

Commands (3)

get-mapping-fields
Get mapping fields from remote incident.
get-remote-data
Get remote data from a remote incident. This command should only be called manually for debugging purposes.
ztap-get-alert-entries
Get the entries data from a remote incident.

Source

ZeroTrustAnalyticsPlatform.py ZeroTrustAnalyticsPlatform_test.py ZeroTrustAnalyticsPlatform.yml ZeroTrustAnalyticsPlatform_description.md command_examples.txt

Download History Raw

category: Endpoint
sectionorder:
- Connect
- Collect
provider: Zscaler
commonfields:
  id: ZeroTrustAnalyticsPlatform
  version: -1
configuration:
- defaultvalue: https://portalapi.threatanalytics.io/
  display: ZTAP server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  additionalinfo: The API Key to use for connection
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Reopen Group
  additionalinfo: Group to send to when reopening
  defaultvalue: Default
  name: reopen_group
  required: true
  type: 0
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Incident Mirroring Direction
  defaultvalue: Both
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Both
  type: 15
  hidden:
  - marketplacev2
  - platform
  required: false
  section: Collect
- display: Comment entry tag
  additionalinfo: Adding this tag to a Note will sync as a comment in ZTAP
  defaultvalue: comment
  name: comment_tag
  type: 0
  required: false
  section: Collect
- display: Escalate entry tag
  additionalinfo: Adding this tag to a Note will reassign the alert back to Critical Start SOC
  defaultvalue: escalate
  name: escalate_tag
  type: 0
  required: false
  section: Collect
- display: ZTAP input tag
  defaultvalue: ztap
  name: input_tag
  type: 0
  required: false
  section: Collect
- display: Fetch attachments for comments from ZTAP
  defaultvalue: 'false'
  name: get_attachments
  type: 8
  required: false
  section: Collect
- display: Sync closing incidents with ZTAP
  defaultvalue: 'false'
  name: close_incident
  type: 8
  required: false
  additionalinfo: Cortex XSOAR only parameter.
  hidden:
  - marketplacev2
  - platform
  section: Collect
- display: Sync reopening incidents with ZTAP
  defaultvalue: 'false'
  name: reopen_incident
  type: 8
  required: false
  section: Collect
- display: First fetch timestamp
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Maximum number of incidents to fetch
  defaultvalue: '100'
  name: max_fetch
  type: 0
  required: false
  section: Collect
description: Zero Trust Analytics Platform (ZTAP) is the underlying investigation platform and user interface for Critical Start's MDR service.
display: ZeroTrustAnalyticsPlatform
name: ZeroTrustAnalyticsPlatform
script:
  commands:
  - name: get-mapping-fields
    arguments: []
    description: Get mapping fields from remote incident.
  - name: get-remote-data
    arguments:
    - description: The remote incident id.
      name: id
      required: true
    - defaultValue: '0'
      description: UTC timestamp in seconds. The incident is only updated if it was modified after the last update time.
      name: lastUpdate
    description: Get remote data from a remote incident. This command should only be called manually for debugging purposes.
  - name: ztap-get-alert-entries
    arguments:
    - description: The remote incident id.
      name: id
      required: true
    description: Get the entries data from a remote incident.
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.0.0
defaultmapperin: ZeroTrustAnalyticsPlatform - Incoming Mapper
defaultmapperout: ZeroTrustAnalyticsPlatform - Outgoing Mapper
tests:
- No tests (auto formatted)