Digital Guardian (v2.0.12)
Digital Guardian ARC Watchlist Integration
- Author
- Digital Guardian
- Support
- partner
- URL
- https://digitalguardian.com
- Default data source
- DigitalGuardianARCEventCollector
- Categories
- Data Enrichment & Threat Intelligence
Incident fields (22)
- Digital Guardian ARC UID
- Digital Guardian Activity
- Digital Guardian Alarm Name
- Digital Guardian Attachment Filename
- Digital Guardian Classification
- Digital Guardian Command line
- Digital Guardian Computer Name
- Digital Guardian Destination Address
- Digital Guardian Destination DNS Domain
- Digital Guardian Email Recipient
- Digital Guardian Email Sender
- Digital Guardian Email Subject
- Digital Guardian Filename
- Digital Guardian Parent Process Name
- Digital Guardian Policy
- Digital Guardian Process Name
- Digital Guardian Remote Port
- Digital Guardian Sensitivity
- Digital Guardian Source Address
- Digital Guardian Source IP
- Digital Guardian Threat Type
- Digital Guardian Username
Integrations (2)
- Digital Guardian
- Digital Guardian ARC Event Collector
Layouts (1)
- Digital Guardian Security Event
Modeling rules (1)
- Digital Guardian ARC Modeling Rule
Playbooks (1)
- Digital Guardian Demo Playbook
README
Digital Guardian
This pack integrates with Digital Guardian’s Data Loss Prevention (DLP) platform Analytics & Reporting Cloud (ARC) solution to identify, remediate, and protect sensitive data from insider and outsider threats.
What does this pack do?
-
Automates event fetching from user-configured export profiles.
-
Allows for the execution of response actions to mitigate data loss risks without manual intervention.
<~XSIAM>
Customers can decide which events and alerts are integrated into Cortex XSIAM by selecting a Digital Guardian export profile when configuring the Digital Guardian ARC Event Collector, ensuring visibility to your individual SOC’s needs.
Events and logs fetched by the event collector can be accessed and queried by navigating to Incident response > Investigation > Query Builder.
</~XSIAM>