TaegisXDRv2

For integration with the Secureworks Taegis XDR platform.

Category

Data Enrichment & Threat Intelligence

Pack

SecureWorks

Configuration parameters

• environment — Taegis Environment (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• client_id — Client ID (required)
• client_secret — Client Secret (required)
• isFetch — Fetch incidents
• max_fetch — Maximum number of incidents per fetch
• incidentFetchInterval — Incidents Fetch Interval
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• incidentType — Incident type
• include_assets — Include Assets in Fetch
• fetch_type — Fetch Incident Type

Commands (21)

• taegis-add-evidence-to-investigation — Add alerts and events to an existing investigation.
• taegis-archive-investigation — Archive an investigation.
• taegis-create-comment — Create a comment on an investigation.
• taegis-create-investigation — Create an Investigation within Taegis.
• taegis-create-sharelink — Creates a ShareLink to a Taegis element, such as an alert or investigation.
• taegis-execute-playbook — Executes a Taegis playbook instance.
• taegis-fetch-alerts — List Taegis alerts by ID.
• taegis-fetch-assets — Fetch assets based on search criteria.
• taegis-fetch-comment — Fetch comment by comment ID.
• taegis-fetch-comments — Fetch comments by Investigation ID.
• taegis-fetch-endpoint — Fetch endpoint information.
• taegis-fetch-events — This is a beta command, which lets you implement and test pre-release software. Since the command is beta, it might contain bugs. Updates to the command during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the command to help us identify issues, fix them, and continually improve. Fetches Taegis events using a CQL query string or a list of event IDs. Supports pagination via the next cursor token returned in results. If no cql_query is provided, defaults to "FROM * EARLIEST=-1m | head 50".
• taegis-fetch-investigation — Fetch all investigations or a specific investigation.
• taegis-fetch-investigation-alerts — Fetch Alert IDs related to a specific investigation.
• taegis-fetch-playbook-execution — Fetch the results of a Taegis playbook instance execution.
• taegis-fetch-users — Fetch a user by ID or email address.
• taegis-isolate-asset — Isolate a specific asset.
• taegis-unarchive-investigation — Unarchive an investigation.
• taegis-update-alert-status — Update the status of an alert.
• taegis-update-comment — Update an existing comment.
• taegis-update-investigation — Update an existing investigation.