Devo_v2

Use the Devo v2 integration to query Devo for alerts, lookup tables, with support of pagination, and to write to lookup tables.

Configuration parameters

reader_endpoint — Query Server Endpoint (e.g. https://apiv2-us.devo.com/search/query) (required)
port — Port (e.g. 443)
reader_oauth_token — OAuth Token (Preferred method) (required)
writer_relay — Writer relay to connect to (e.g. us.elb.relay.logtrust.net)
writer_credentials — Writer JSON credentials
linq_link_base — Devo base domain
isFetch — Fetch incidents
incidentType — Incident type
table_name — Custom Alert Table name(if not provided, 'siem.logtrust.alert.info' will be used)
prefix — Custom Alert Table prefix (provide prefix if custom table name provided)
fetch_incidents_filters — Fetch incidents alert filter (Same filters for get-alerts)
fetch_incidents_deduplication — Deduplication parameters JSON if required
fetch_incidents_limit — Fetch Incident Limit(must be between 10 and 100; advisable 50 for better performance.)
incidentFetchInterval — Incidents Fetch Interval
timeout — Global query default timeout in seconds
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
fetch_incidents_lookback_seconds — Fetch Incidents Lookback Time (in seconds). Must be between 3600 (1 hour; default) to 86400 (24 hours).
fetch_incidents_window — Fetch Incident Time Frame (in seconds)

devo-get-alerts — Queries alerts in the specified timeframe.
devo-multi-table-query — Queries multiple tables for a given token and returns relevant results.
devo-run-query — Queries Devo based on the specified LINQ query.
devo-write-to-lookup-table — Writes lookup table entry records to a specified Devo table.
devo-write-to-table — Writes records to a specified Devo table.