ZeroTrustAnalyticsPlatform

Details

ID	`ZeroTrustAnalyticsPlatform`
Provider	Zscaler
Category	Endpoint
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Zero Trust Analytics Platform (ZTAP) is the underlying investigation platform and user interface for Critical Start’s MDR service.
This integration was integrated and tested with version 2021-06-25 of ZeroTrustAnalyticsPlatform

Configure ZeroTrustAnalyticsPlatform in Cortex

Parameter	Description	Required
ZTAP server URL		True
API Key	The API Key to use for connection	True
Reopen Group	Group to send to when reopening	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
Incident type		False
Incident Mirroring Direction		False
Comment entry tag	Adding this tag to a Note will sync as a comment in ZTAP	False
Escalate entry tag	Adding this tag to a Note will reassign the alert back to Critical Start SOC	False
ZTAP input tag		False
Fetch attachments for comments from ZTAP		False
Sync closing incidents with ZTAP	Cortex XSOAR only parameter.	False
Sync reopening incidents with ZTAP		False
First fetch timestamp		False
Maximum number of incidents to fetch		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

get-mapping-fields

Get mapping fields from remote incident.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

### get-remote-data

***
Get remote data from a remote incident. This command should only be called manually for debugging purposes.

#### Base Command

`get-remote-data`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | The remote incident id. | Required |
| lastUpdate | UTC timestamp in seconds. The incident is only updated if it was modified after the last update time. Default is 0. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

!get-remote-data id=1 lastUpdate=2000-01-1
```

Human Readable Output

ztap-get-alert-entries

Get the entries data from a remote incident.

Base Command

ztap-get-alert-entries

Input

Argument Name	Description	Required
id	The remote incident id.	Required

Context Output

There is no context output for this command.

Command Example

!ztap-get-alert-entries id=1

Human Readable Output

Example comment.
Sent by User (test@test) via ZTAP

Configuration parameters

url — ZTAP server URL (required)
apikey — API Key (required)
reopen_group — Reopen Group (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
mirror_direction — Incident Mirroring Direction
comment_tag — Comment entry tag
escalate_tag — Escalate entry tag
input_tag — ZTAP input tag
get_attachments — Fetch attachments for comments from ZTAP
close_incident — Sync closing incidents with ZTAP
reopen_incident — Sync reopening incidents with ZTAP
first_fetch — First fetch timestamp
max_fetch — Maximum number of incidents to fetch

Commands (3)

get-mapping-fields
Get mapping fields from remote incident.
get-remote-data
Get remote data from a remote incident. This command should only be called manually for debugging purposes.
ztap-get-alert-entries
Get the entries data from a remote incident.

Source

ZeroTrustAnalyticsPlatform.py ZeroTrustAnalyticsPlatform_test.py ZeroTrustAnalyticsPlatform.yml ZeroTrustAnalyticsPlatform_description.md command_examples.txt

Download History Raw

!ztap-get-alert-entries