SOCRadarIncidentsMultiTenant

SOCRadar Multi-Tenant Incidents integration with advanced incident management, status reasons, and compliance tracking. Fetches security incidents from SOCRadar platform across all tenant companies with proper deduplication and date handling. Uses Multi-Tenant API for incident fetching and company-specific APIs for alarm management.

Category

Analytics & SIEM

Pack

SOCRadar

Configuration parameters

• apikey — API Key (required)
• multi_tenant_id — Multi-Tenant ID (required)
• isFetch — Fetch incidents
• first_fetch — First Fetch Time
• fetch_interval_minutes — Fetch Interval (Minutes)
• max_fetch — Max incidents per fetch
• show_content — Show Alarm Content
• status — Status Filter
• severities — Severity Levels
• alarm_type_ids — Alarm Type IDs (Include)
• excluded_alarm_type_ids — Alarm Type IDs (Exclude)
• alarm_main_types — Alarm Main Types
• excluded_alarm_main_types — Alarm Main Types (Exclude)
• alarm_sub_types — Alarm Sub Types
• excluded_alarm_sub_types — Alarm Sub Types (Exclude)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval

Commands (7)

• socradar-add-assignee — Add the assignee(s) of an alarm.
• socradar-add-comment — Add a comment to an alarm.
• socradar-add-tag — Add or remove a tag from an alarm.
• socradar-change-alarm-status — Change the status of one or more alarms.
• socradar-mark-false-positive — Mark an alarm as false positive.
• socradar-mark-resolved — Mark an alarm as resolved.
• socradar-test-fetch — Test incident fetching to verify alarms are available and date parsing works correctly.