SOCRadarIncidentsV4

SOCRadar Incidents v4 API integration with advanced incident management, status reasons, and compliance tracking. Fetches security incidents from SOCRadar platform with proper deduplication and date handling. Supports filtering by alarm type IDs for granular control.

Category

Analytics & SIEM

Pack

SOCRadar

Configuration parameters

• apikey — (required)
• company_id — Company ID (required)
• isFetch — Fetch incidents
• first_fetch — First Fetch Time
• fetch_interval_minutes — Fetch Interval (Minutes)
• max_fetch — Max incidents per fetch
• show_content — Show Alarm Content
• status — Status Filter
• severities — Severity Levels
• alarm_type_ids — Alarm Type IDs (Include)
• excluded_alarm_type_ids — Alarm Type IDs (Exclude)
• alarm_main_types — Alarm Main Types
• excluded_alarm_main_types — Alarm Main Types (Exclude)
• alarm_sub_types — Alarm Sub Types
• excluded_alarm_sub_types — Alarm Sub Types (Exclude)
• include_company_id — Include Company ID
• include_incident_link — Include Incident Link
• include_mitigation — Include Mitigation
• include_response — Include Response
• include_detection_and_analysis — Include Detection And Analysis
• include_post_incident_analysis — Include Post Incident Analysis
• include_related_assets — Include Related Assets
• include_related_entities — Include Related Entities
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval

Commands (8)

• socradar-add-assignee — add the assignee(s) of an alarm.
• socradar-add-comment — Add a comment to an alarm.
• socradar-add-tag — Add or remove a tag from an alarm.
• socradar-change-alarm-status — Change the status of one or more alarms.
• socradar-change-assignee — add the assignee(s) of an alarm.
• socradar-mark-false-positive — Mark an alarm as false positive.
• socradar-mark-resolved — Mark an alarm as resolved.
• socradar-test-fetch — Test incident fetching to verify alarms are available and date parsing works correctly.