Sekoia XDR

Fetch alerts and events from SEKOIA.IO XDR.\nTo use this integration, please create an API Key with the appropriate permissions.

Category

Analytics & SIEM

Pack

SekoiaXDR

Configuration parameters

• credentials — API key (required)
• url — Server URL (i.e. https://api.sekoia.io) (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetch — Fetch incidents
• incidentType — Incident type
• first_fetch — First fetch timestamp (<sign + or -><number><time unit>, e.g., -7d, -1h) (required)
• max_fetch — Maximum incidents to fetch per interval. (required)
• incidentFetchInterval — Incidents Fetch Interval
• alerts_status — Alerts status.
• alerts_type — Alerts types.
• alerts_urgency — Alerts urgency levels ( "MINurgency,MAXurgency". i.e: 80,100 ).
• fetch_mode — Fetch mode (required)
• replace_dots_event — Replace "dots" in event field names with another character. (required)
• exclude_info_events — Events fields to exclude from the events search result.
• fetch_with_assets — Include assets information in the alerts when fetching.
• fetch_with_kill_chain — Include kill chain information in the alerts when fetching.
• mirror_direction — Incident Mirroring Direction.
• mirror_events — Include events in the mirroring of the alerts.
• mirror_kill_chain — Include kill chain information in the mirroring of the alerts.
• reopen_incident — Reopen Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
• close_incident — Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
• close_notes — Close notes. (required)
• timezone — Timezone ( TZ format ) (required)

Commands (23)

• get-mapping-fields — This command pulls the remote schema for the different incident types, and their associated incident fields, from the remote system.
• get-modified-remote-data — available from Cortex XSOAR version 6.1.0. This command queries for incidents that were modified since the last update.
• get-remote-data — This command gets new information about the incidents in the remote system and updates existing incidents in Cortex XSOAR.
• sekoia-xdr-add-attributes-asset — Command to add attributes to an asset in Sekoia XDR.
• sekoia-xdr-add-keys-asset — Command to add keys to an asset in Sekoia XDR.
• sekoia-xdr-events-execute-query — Command to create an event search job on Sekoia XDR, after this execute "sekoia-xdr-status-events-query" to see the status of the query job and "sekoia-xdr-results-events-query" to retrieve the results..
• sekoia-xdr-events-results-query — Command to retrieve the events from the search job "sekoia-xdr-execute-events-query" previously done on Sekoia XDR.
• sekoia-xdr-events-status-query — Command to query the status of the search job on Sekoia XDR.
• sekoia-xdr-get-alert — Command to retrieve a specific alert by uuid or short_id from Sekoia XDR.
• sekoia-xdr-get-asset — Get an asset by its UUID from Sekoia XDR.
• sekoia-xdr-get-cases-alert — Command to retrieve the cases related to an Alert from Sekoia XDR. If a case_id is given, returns the information about it, and if not it will give all cases in this alert.
• sekoia-xdr-get-comments — Command to get all the comments from an alert in Sekoia XDR.
• sekoia-xdr-get-kill-chain — Command to retrieve the definition of a Cyber Kill Chain Step.
• sekoia-xdr-get-user — Command to get information about a user in Sekoia XDR. Used also in the command !sekoia-xdr-get-comments to have the name of the persons who made the comments.
• sekoia-xdr-get-workflow-alert — Command to get the possible transitions of status on the alert.
• sekoia-xdr-http-request — Command that performs a HTTP request to Sekoia using the integration authentication configured.
• sekoia-xdr-list-alerts — Command to retrieve a list of Alerts from Sekoia XDR.
• sekoia-xdr-list-assets — Command to retrieve a list of Assets from Sekoia XDR.
• sekoia-xdr-post-comment-alert — Command to post comments to alerts in Sekoia XDR.
• sekoia-xdr-remove-attribute-asset — Command to remove an attribute from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the attribute_uuid to delete.
• sekoia-xdr-remove-key-asset — Command to remove a key from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the key_uuid to delete.
• sekoia-xdr-search-events — Command to search and retrieve the events from an alert. This is a combination of 3 commands: sekoia-xdr-events-execute-query, sekoia-xdr-events-status-query and sekoia-xdr-events-results-query.
• sekoia-xdr-update-status-alert — Command to update the status of a specific Alert by uuid or short_id.