Vectra_Detect

This integration allows to create incidents based on Vectra Accounts/Hosts/Detections objects.

Category

Network Security

Pack

Vectra_AI

Configuration parameters

• server_fqdn — Vectra Detect FQDN or IP (required)
• authentication_type — Authentication Type
• credentials — API Token
• oauth_credentials — Client ID
• insecure — Trust any certificate (not secure)
• use_proxy — Use system proxy settings
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• first_fetch — First fetch timestamp
• mirror_direction — Mirroring Direction
• refetch_closed_incidents — Re-Fetch closed incidents via mirroring
• note_tag — Mirror tag for notes
• fetch_entity_types — Entity types to fetch
• tags — Tags
• detection_category — Detection Category
• detection_type — Detection Type
• hosts_fetch_query — Hosts fetch query
• accounts_fetch_query — Accounts fetch query
• detections_fetch_query — Detections fetch query
• max_fetch — Max created incidents per fetch
• look_back — Advanced: Minutes to look back when fetching
• fetch_escalated_accounts_and_hosts — Advanced: Fetch escalated Accounts and Hosts
• create_multiple_incidents_by_timestamp — Re-Fetch Account/Host entity and Detection for new activity/event

Commands (47)

• vectra-account-add-tags — Add tags to an Account.
• vectra-account-del-tags — Delete tags from an Account.
• vectra-account-describe — Returns a single Account details.
• vectra-account-markall-detections-asclosed — Mark active detections as closed by providing the ID of the account in the argument.
• vectra-account-markall-detections-asfixed — Mark active detections as fixed by providing the ID of the account in the argument.
• vectra-account-note-add — Add a note to the account.
• vectra-account-note-list — List all notes of the specific account.
• vectra-account-note-remove — Remove a note from the account.
• vectra-account-note-update — Update a note in the account.
• vectra-account-tag-list — Returns a list of tags for a specified account.
• vectra-assignment-assign — Assigns an Account/Host entity to a Vectra User for investigation. If an assignment already exists on this entity, it will be reassigned.
• vectra-assignment-describe — Returns a single assignment details.
• vectra-assignment-resolve — Resolves an assignment by selecting resolution scheme. Could be 'resolving only' or 'resolving by filtering detections'.
• vectra-detection-add-tags — Add tags to a Detection.
• vectra-detection-del-tags — Delete tags from a Detection.
• vectra-detection-describe — Returns a single detection details.
• vectra-detection-get-pcap — Returns a Detection's PCAP file (if available).
• vectra-detection-markasfixed — Marks/Unmarks a Detection as fixed by providing the Detection ID.
• vectra-detection-note-add — Add a note to the detection.
• vectra-detection-note-list — List all notes of the specific detection.
• vectra-detection-note-remove — Remove a note from the detection.
• vectra-detection-note-update — Update a note in the detection.
• vectra-detection-tag-list — Returns a list of tags for a specified detection.
• vectra-detections-mark-asclosed — Mark detections as closed with provided detection IDs in the argument.
• vectra-detections-mark-asopen — Open detections with provided detection IDs in the argument.
• vectra-group-assign — Assign members to the specified group.
• vectra-group-list — Returns a list of all groups.
• vectra-group-unassign — Unassign members from the specified group.
• vectra-host-add-tags — Add tags to an Host.
• vectra-host-del-tags — Delete tags from an Host.
• vectra-host-describe — Returns a single Host details.
• vectra-host-markall-detections-asclosed — Mark active detections as closed by providing the ID of the host in the argument.
• vectra-host-markall-detections-asfixed — Mark active detections as fixed by providing ID of the host in the argument.
• vectra-host-note-add — Add a note to the host.
• vectra-host-note-list — List all notes of the specific host.
• vectra-host-note-remove — Remove a note from the host.
• vectra-host-note-update — Update a note in the host.
• vectra-host-tag-list — Returns a list of tags for a specified host.
• vectra-outcome-create — Creates a new assignment outcome.
• vectra-outcome-describe — Returns a single outcome details.
• vectra-search-accounts — Returns a list of Account objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
• vectra-search-assignments — Return a list of assignments. By default already resolved assignment are not returned.
• vectra-search-detections — Returns a list of Detection objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
• vectra-search-hosts — Returns a list of Host objects. All search attributes will be cumulative unless you're using the search_query_only one, in that case, only this one will be taken into account.
• vectra-search-outcomes — Returns a list of assignment outcomes.
• vectra-search-users — Returns a list of Vectra Users. All search attributes will be cumulative.
• vectra-user-describe — Returns a single Vectra User details.