Vega

Vega integration for fetching alerts and incidents from the Vega platform.

Category

Analytics & SIEM

Pack

Vega

Configuration parameters

• url — Base URL (required)
• access_key_id — Access Key ID (required)
• access_key — Access Key (required)
• isFetch — Fetch incidents
• incidentFetchInterval — Incidents Fetch Interval (required)
• max_fetch — Maximum incidents per fetch (required)
• lookback_minutes — Fetch Lookback (minutes) (required)
• vega_entities — Vega Entities to fetch (required)
• backfill_days — Backfill Days (required)
• autoclosure — Enable Cortex XSOAR to Vega mirroring
• outgoing_mirror_fields — Outgoing fields to mirror
• alert_severities — Alert Severities to fetch
• alert_statuses — Alert Statuses to fetch
• alert_verdicts — Alert Verdicts to fetch
• alert_has_related_incidents — Has related incidents (required)
• incident_severities — Incident Severities to fetch
• incident_statuses — Incident Statuses to fetch
• incident_verdicts — Incident Verdicts to fetch
• incidentType — Incident type
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (9)

• get-mapping-fields — Returns the outgoing mirroring fields for Vega Alert and Vega Incident investigations.
• get-modified-remote-data — Gets Vega alert and incident IDs modified since the last update time. Used for debugging incoming mirroring.
• get-remote-data — Gets remote data from a remote Vega alert or incident. Used for debugging incoming mirroring.
• update-remote-system — Pushes Cortex XSOAR investigation changes to Vega when outgoing mirroring is enabled.
• vega-get-alert-events — Fetch all aggregated alert events for a Vega alert using internal API pagination, then return the requested display page as a markdown table and CustomFields for the Alert Events layout section.
• vega-set-detections-state — Set the state for one or more Vega detections.
• vega-update-alert — Immediately update Vega alert status, severity, verdict, verdict reasoning, assignees, and/or comment on the Vega platform and sync the open Cortex XSOAR investigation when run from a Vega Alert investigation.
• vega-update-detections — Update severity, status, state, and/or tags for one or more Vega detections using the updateDetections GraphQL mutation.
• vega-update-incident — Immediately update Vega incident status, verdict, verdict reasoning, severity, assignee emails, and/or comment on the Vega platform and sync the open Cortex XSOAR investigation when run from a Vega Incident investigation.