Darktrace (v4.0.8)
Populates Darktrace Model Breaches and AI Analyst Events in Cortex XSOAR, allowing for cross-platform automated investigation and response.
- Author
- Darktrace
- Support
- partner
- URL
- https://customerportal.darktrace.com
- Default data source
- Darktrace Event Collector
- Categories
- Network Security
Incident fields (53)
- Darktrace AI Analyst Associated Devices
- Darktrace AI Analyst Category
- Darktrace AI Analyst Event Id
- Darktrace AI Analyst Group Id
- Darktrace AI Analyst Mitre Tactics
- Darktrace AI Analyst Related Model Breaches
- Darktrace AI Analyst Score
- Darktrace AI Analyst Summary
- Darktrace AI Analyst Title
- Darktrace Comment Count
- Darktrace Device Hostname
- Darktrace Device ID
- Darktrace Device IP
- Darktrace Device Label
- Darktrace Device MAC
- Darktrace Device Vendor
- Darktrace Email Action Status
- Darktrace Email Actions
- Darktrace Email Actions Taken
- Darktrace Email Anomaly Score
- Darktrace Email Attachments
- Darktrace Email Critical Tags
- Darktrace Email Direction
- Darktrace Email Group Status
- Darktrace Email Informational Tags
- Darktrace Email Links
- Darktrace Email Read Status
- Darktrace Email Receipt Status
- Darktrace Email Recipient
- Darktrace Email Release Requested
- Darktrace Email Sender
- Darktrace Email Subject
- Darktrace Email Summary
- Darktrace Email Tags
- Darktrace Email Time
- Darktrace Email UI Link
- Darktrace Email UUID
- Darktrace Email Warning Tags
- Darktrace Model Breach Category
- Darktrace Model Breach Comment Count
- Darktrace Model Breach Description
- Darktrace Model Breach ID
- Darktrace Model Breach Name
- Darktrace Model Breach Policy Id
- Darktrace Model Breach Priority
- Darktrace Model Breach Score
- Darktrace Model Breach Tags
- Darktrace Model Breach Unique Identifier
- Darktrace Model ID
- Darktrace Model Name
- Darktrace Model Priority
- Darktrace Model Tags
- Darktrace Model UUID
Integrations (6)
- Darktrace (Deprecated)
- Darktrace Event Collector
- Darktrace AI Analyst
- Darktrace Admin
- DarktraceEmail
- Darktrace Model Breaches
Layouts (4)
- Darktrace AI Analyst Incident Layout
- Darktrace Email Layout
- Darktrace MBs Layout
- Darktrace Model Breach Layout
Modeling rules (1)
- Darktrace Modeling Rule
Playbooks (5)
- Darktrace Basic AI Analyst Event Handler
- Darktrace Basic Model Breach Handler
- Darktrace Email Basic Email Handler
- Darktrace Email Update Incident Fields
- Handle Darktrace Model Breach
README
As organizations continue to mature their security stack and adopt defence-in-depth practices, it is increasingly important for security operation teams to have their data available in one place, rather than spread across multiple tools.
This integration pack enriches your Cortex XSOAR playbooks with information from Darktrace’s self-learning AI in our DETECT product family. This ensures your endpoint data is accompanied by tailored Darktrace alerts on anomalous activities within your network, SaaS, cloud and industrial environments.
Together with XSOAR, this pack can speed up your triage workflow, boost SOC efficiency and ensure all your security coverage can be found in one place.
What does this pack do?
This pack provides three optional sub-integrations by pulling a variety of Darktrace metrics:
- Model Breaches and all model breach related actions (such as commenting, acknowledging and model logic info).
- AI Analyst investigations indicative of critical incidents along with accompanying summaries and timelines. AI actions can also be applied.
- Device administration data including device statuses and tags. Your understanding of potential threats can also be levelled-up with Advanced Search logs from DPI.
Customers can decide which of these alerts are integrated, ensuring visibility is bespoke to your individual SOC’s needs. Alerts from the connector will populate in the XSOAR ‘Incidents’ tab.