IronDefense
The IronDefense Integration for Cortex XSOAR allows users to interact with IronDefense alerts within Cortex XSOAR. The Integration provides the ability to rate alerts, update alert statuses, add comments to alerts, to report observed bad activity, get alerts, get events, and get IronDome information.
- Category
- Network Security
- Pack
- IronDefense
Configuration parameters
- ironAPIHost — IronAPI Host/IP (required)
- ironAPIPort — IronAPI Port (required)
- credentials — Username (required)
- requestTimeout — Request Timeout (Sec)
- isFetch — Fetch incidents
- incidentType — Incident type
- incidentFetchInterval — Incidents Fetch Interval
- enableAlertNotifications — Enable Alert Notification Ingestion (Refresh Not Supported)
- alertLimit — Alert Notification Limit Per Request. (Max 500)
- alertCategories — Alert Notification Categories to Exclude
- alertSubCategories — Alert Notification SubCategories to Exclude, See https://ironnet.atlassian.net/wiki/x/hADvGg for values (Enter in comma separated list format)
- alertSeverityLower — Lower Bound of Severity for Alert Notification (0-1000)
- alertSeverityUpper — Upper Bound of Severity for Alert Notification (0-1000)
- alertActions — Alert Notification Actions to Include (Alert Created enabled by default)
- enableEventNotifications — Enable Event Notification Ingestion (Refresh Not Supported)
- eventLimit — Event Notification Limit Per Request. (Max 500)
- eventCategories — Event Notification Categories to Exclude
- eventSubCategories — Event Notification SubCategories to Exclude, See https://ironnet.atlassian.net/wiki/x/hADvGg for values (Enter in comma separated list format)
- eventSeverityLower — Lower Bound of Severity for Event Notification (0-1000)
- eventSeverityUpper — Upper Bound of Severity for Event Notification (0-1000)
- eventActions — Event Notification Actions to Include (Event Created enabled by default)
- enableDomeNotifications — Enable Dome Notification Ingestion (Refresh Not Supported)
- domeLimit — Dome Notification Limit Per Request. (Max 500)
- domeCategories — Dome Notification Types to Exclude
Commands (8)
- irondefense-comment-alert — Adds a comment to an IronDefense alert.
- irondefense-get-alert-irondome-information — Retrieves IronDome information for an IronDefense alert.
- irondefense-get-alerts — Pulls Alerts from IronDefense.
- irondefense-get-event — Retrieves an IronDefense event.
- irondefense-get-events-from-alert — Retrieves IronDefense Events for a given Alert ID.
- irondefense-rate-alert — Rates an IronDefense alert.
- irondefense-report-observed-bad-activity — Submits an observed bad endpoint to IronDefense to create Threat. Intelligence Rules (TIR).
- irondefense-set-alert-status — Sets the status of an IronDefense alert.