VectraXDR

This integration allows to create incidents based on Vectra XDR Entities.

Category

Network Security

Pack

VectraXDR

Configuration parameters

• server_url — Server URL (required)
• credentials — Client ID (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetch — Fetch incidents
• max_fetch — Max Fetch
• first_fetch — First Fetch Time
• mirror_direction — Mirroring Direction
• refetch_closed_incidents — Re-Fetch closed incidents via mirroring
• note_tag — Mirror tag for notes
• entity_type — Entity Type
• is_prioritized — Prioritized
• tags — Tags
• detection_category — Detection Category
• detection_type — Detection Type
• urgency_score_low_threshold — Specify the numeric value of "Urgency Score" for mapping the Low Incident Severity.
• urgency_score_medium_threshold — Specify the numeric value of "Urgency Score" for mapping the Medium Incident Severity.
• urgency_score_high_threshold — Specify the numeric value of "Urgency Score" for mapping the High Incident Severity.
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval

Commands (35)

• vectra-assignment-list — Returns a list of all assignments.
• vectra-assignment-outcome-list — Returns a list of all entity assignment outcomes.
• vectra-detection-describe — Returns a list of detections for the specified detection ID(s).
• vectra-detection-note-add — Add a note to the detection.
• vectra-detection-note-list — Returns a list of notes for a specified detection.
• vectra-detection-note-remove — Remove a note from the detection.
• vectra-detection-note-update — Update a note in the detection.
• vectra-detection-pcap-download — Download pcap of the detection.
• vectra-detection-tag-add — Add tags to a detection.
• vectra-detection-tag-list — Returns a list of tags for a specified detection.
• vectra-detection-tag-remove — Remove tags from the detection.
• vectra-detections-mark-asclosed — Mark detections as close with provided detection IDs in the argument.
• vectra-detections-mark-asopen — Open detections with provided detection IDs in the argument.
• vectra-detections-mark-fixed — Mark detection as fixed with provided detection IDs in argument.
• vectra-detections-unmark-fixed — Unmark detection as fixed with provided detection IDs in argument.
• vectra-entity-assignment-add — Add an assignment for the entity.
• vectra-entity-assignment-resolve — Resolve an assignment in the entity.
• vectra-entity-assignment-update — Update an assignment in the entity.
• vectra-entity-describe — Describes an entity by ID.
• vectra-entity-detection-list — Returns a list of detections for a specified entity.
• vectra-entity-detections-mark-asclosed — Mark the detections of the entity as closed with the provided entity ID in the argument.
• vectra-entity-detections-mark-fixed — Mark the detections of the entity as fixed with the provided entity ID in the argument.
• vectra-entity-list — Returns a list of entities.
• vectra-entity-note-add — Add a note to the entity.
• vectra-entity-note-list — Returns a list of notes for a specified entity.
• vectra-entity-note-remove — Remove a note from the entity.
• vectra-entity-note-update — Update a note in the entity.
• vectra-entity-reset-fetch — Resets the given entity to refetch incidents.
• vectra-entity-tag-add — Add tags in the entity.
• vectra-entity-tag-list — Returns a list of tags for a specified entity.
• vectra-entity-tag-remove — Remove tags from the entity.
• vectra-group-assign — Assign members to the specified group.
• vectra-group-list — Returns a list of all groups.
• vectra-group-unassign — Unassign members from the specified group.
• vectra-user-list — Returns a list of users.