Lumu

SecOps operations - Reflect and manage the Lumu Incidents either from XSOAR Cortex or viceversa using the mirroring integration flow, https://lumu.io/

Category

Utilities

Pack

Lumu

Configuration parameters

• max_fetch — Maximum number of incidents to fetch every time
• first_fetch — First fetch time interval
• url — Server URL (required)
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)
• api_key — API Key (required)
• fetch_offset — Incident Offset
• total_items_per_lumu_fetch — Total Incident per fetching using lumu endpoint
• max_time_fetching_lumu_incident — Max time in seconds per fetching using lumu endpoint
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• mirror_direction — Incident Mirroring Direction
• mirror_tags — Mirror tags

Commands (21)

• get-mapping-fields — mirror process.
• get-modified-remote-data — mirror process.
• get-remote-data — mirror process.
• lumu-clear-cache — Lumu clear cache, only trigger if it mandatory.
• lumu-close-incident — | `{incident-uuid}` | uuid of the specific incident | |---|---| >To associate a specific user to this transaction, include the header `Lumu-User-Id` with the user id as a value. [Read more](#user-identification-considerations).
• lumu-comment-a-specific-incident — Get a paginated list of open incidents for the company. The items are listed by the most recent.
• lumu-consult-incidents-updates-through-rest — Lumu provides an endpoint to consult real-time updates on incident operations through REST when Websocket is not available. Note: the date format in the updates received from the endpoint is in the UTC time zone and follows standards published in RFC 3339 and ISO 8601 | `{company-key}` | Your company's unique API key available at the [Lumu Portal](#access-and-authentication) | | --- | --- |.
• lumu-get-cache — Lumu get cache.
• lumu-mark-incident-as-read — This transaction does not require any additional body parameters. | `{incident-uuid}` | uuid of the specific incident | |---|---| >To associate a specific user to this transaction, include the header `Lumu-User-Id` with the user id as a value. [Read more](#user-identification-considerations).
• lumu-mute-incident — | `{incident-uuid}` | uuid of the specific incident | |---|---| >To associate a specific user to this transaction, include the header `Lumu-User-Id` with the user id as a value. [Read more](#user-identification-considerations).
• lumu-retrieve-a-specific-incident-context — Get details of a specific Incident. | `{incident-uuid}` | uuid of the specific incident | |---|---|.
• lumu-retrieve-a-specific-incident-details — Get details of a specific Incident. | `{incident-uuid}` | uuid of the specific incident | |---|---|.
• lumu-retrieve-a-specific-label — Get details such as id, name and business relevance from a specific label. | `{label-id}` | ID of the specific label | |---|---|.
• lumu-retrieve-closed-incidents — Get a paginated list of closed incidents for the company. The items are listed by the most recent.
• lumu-retrieve-endpoints-by-incident — Get a paginated summary of the endpoints affected by a specified incident. | `{incident-uuid}` | uuid of the specific incident | |---|---|.
• lumu-retrieve-incidents — Get a paginated list of incidents for the company. The items are listed by the most recent.
• lumu-retrieve-labels — Get a paginated list of all the labels created for the company and its details such as id, name and business relevance. The items are sorted by the label id in ascending order.
• lumu-retrieve-muted-incidents — Get a paginated list of muted incidents for the company. The items are listed by the most recent.
• lumu-retrieve-open-incidents — Get a paginated list of open incidents for the company. The items are listed by the most recent.
• lumu-unmute-incident — | `{incident-uuid}` | uuid of the specific incident | |---|---| >To associate a specific user to this transaction, include the header `Lumu-User-Id` with the user id as a value. [Read more](#user-identification-considerations).
• update-remote-system — mirror process.