Cyberhaven (v1.0.0)
Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.
- Author
- Cyberhaven, Inc
- Support
- partner
- URL
- https://support.cyberhaven.io
- Categories
- Data Enrichment & Threat Intelligence
Incident fields (46)
- Cyberhaven AI Severity
- Cyberhaven AI Summary
- Cyberhaven Assigned To
- Cyberhaven Blocked
- Cyberhaven Close Note
- Cyberhaven Close Reason
- Cyberhaven Created By
- Cyberhaven Dataset Custom Data
- Cyberhaven Dataset ID
- Cyberhaven Dataset Name
- Cyberhaven Dataset Sensitivity
- Cyberhaven End Action Hostname
- Cyberhaven End Action Kind
- Cyberhaven End Content Filename
- Cyberhaven End Event JSON
- Cyberhaven End Sensor Kind
- Cyberhaven Event Lineage Graph Link
- Cyberhaven Event Time
- Cyberhaven Incident Custom Data
- Cyberhaven Incident ID
- Cyberhaven Last Modified
- Cyberhaven Lineage End ID
- Cyberhaven Lineage Start ID
- Cyberhaven Policy Custom Data
- Cyberhaven Policy ID
- Cyberhaven Policy Name
- Cyberhaven Policy Severity
- Cyberhaven Reaction Time
- Cyberhaven Resolution Time
- Cyberhaven Risk Score
- Cyberhaven Screenshot GUID
- Cyberhaven Start Action Hostname
- Cyberhaven Start Action Kind
- Cyberhaven Start Content Filename
- Cyberhaven Start Event JSON
- Cyberhaven Start Sensor Kind
- Cyberhaven Status
- Cyberhaven Trigger Time
- Cyberhaven User Custom Data
- Cyberhaven User ID
- Cyberhaven User Local ID
- Cyberhaven User Reaction Message
- Cyberhaven User Reactions
- Cyberhaven User Risk Groups
- Cyberhaven Username
- Cyberhaven Warning Status
Integrations (1)
- Cyberhaven
Layouts (1)
- Cyberhaven Incident
Playbooks (1)
- Synchronize Incident Closure - Cyberhaven
Scripts (1)
- CyberhavenIncidentRefresh
README
The Cyberhaven pack enables security operations teams to fetch and investigate DLP (Data Loss Prevention) incidents from the Cyberhaven data security platform directly within Cortex XSOAR. By synchronizing Cyberhaven incidents with XSOAR in real time, analysts can manage DLP investigations, review event and data lineage details, and update incident status.
What does this pack do?
- Fetch DLP incidents from Cyberhaven and create corresponding XSOAR incidents.
- List and filter Cyberhaven DLP incidents by severity, status, assignee, user, and time range.
- Update incident status, close reason, close note, and assignee.
- Retrieve full event details for one or more Cyberhaven events by ID.
- Retrieve data lineage chains between two Cyberhaven event IDs.
- Mirror incident updates from XSOAR back to Cyberhaven (status, owner, close reason, close notes).
- Automatically close XSOAR incidents when the corresponding Cyberhaven incident is closed (via the included playbook).