Vectra RUX (v1.0.3)
Vectra RUX pack empowers the SOC to create incidents based on events detection using Vectra AI's Attack Signal Intelligence.
- Author
- Vectra AI
- Support
- partner
- URL
- https://support.vectra.ai
- Categories
- Network Security
Incident fields (65)
- Vectra RUX AWS Region
- Vectra RUX Access Key ID
- Vectra RUX Account ID
- Vectra RUX Assumed Role
- Vectra RUX Certainty Score
- Vectra RUX Data Source Sensor ID
- Vectra RUX Data Source Sensor Name
- Vectra RUX Data Source Type
- Vectra RUX Destination Account Information
- Vectra RUX Destination Domain Information
- Vectra RUX Destination Host Information
- Vectra RUX Detection Category
- Vectra RUX Detection ID
- Vectra RUX Detection Notes
- Vectra RUX Detection Reason
- Vectra RUX Detection Type
- Vectra RUX Entity Assignment Assigned By
- Vectra RUX Entity Assignment Assigned Date
- Vectra RUX Entity Assignment Assigned to
- Vectra RUX Entity Assignment Details
- Vectra RUX Entity Assignment ID
- Vectra RUX Entity Assignment Outcome
- Vectra RUX Entity Assignment Resolved By
- Vectra RUX Entity Assignment Resolved Date
- Vectra RUX Entity External Reference ID
- Vectra RUX Entity ID
- Vectra RUX Entity IP
- Vectra RUX Entity Importance
- Vectra RUX Entity Name
- Vectra RUX Entity Priority Status
- Vectra RUX Entity Privilege Category
- Vectra RUX Entity Type
- Vectra RUX Entity UID
- Vectra RUX Entity URL
- Vectra RUX Entity Unresolved Priority Status
- Vectra RUX Entity Urgency Score
- Vectra RUX Event Accounts
- Vectra RUX Event Change Type
- Vectra RUX Event DNS
- Vectra RUX Event Domains
- Vectra RUX Event External Targets
- Vectra RUX Event Hosts
- Vectra RUX Event IPs
- Vectra RUX Event Name
- Vectra RUX Event Ports
- Vectra RUX Event Protocols
- Vectra RUX Event Severity
- Vectra RUX Event Timestamp
- Vectra RUX External Reference ID
- Vectra RUX Identity Type
- Vectra RUX Investigation Status
- Vectra RUX Is Event Triaged
- Vectra RUX Last Timestamp
- Vectra RUX Mitre IDs
- Vectra RUX Process Context Date Created
- Vectra RUX Process Context Error Message
- Vectra RUX Process Context Investigate Entity Link
- Vectra RUX Process Context Processes
- Vectra RUX Process Context Query Link
- Vectra RUX Process Context Query Status
- Vectra RUX Role Sequence
- Vectra RUX Source External Host IP
- Vectra RUX Source External Host Name
- Vectra RUX Threat Score
- Vectra RUX User Agent
Integrations (1)
- Vectra RUX - Network Detection & Response
Layouts (1)
- Vectra RUX Events Detection
Playbooks (2)
- Expire Inactive Detections - Vectra RUX
- Find Detection State and Expire Inactive Detections - Vectra RUX
Scripts (6)
- VectraRUXGetIncidents
- VectraRUXLinkEntityDetections
- VectraRUXLinkTicketDetections
- VectraRUXSyncDetectionNotes
- VectraRUXSyncDetectionSummary
- VectraRUXSyncEntityAssignment
README
Vectra RUX pack allows the security operations center to create incidents based on Events Detections, powered by Vectra AI’s Attack Signal Intelligence. This pack enables security teams to synchronize the Vectra RUX Detections with Cortex XSOAR incidents in real time, making it feasible to manage operations from a single place.
What does this pack do?
- Fetch detections from Vectra RUX.
- List and Describe Entities and Detections.
- List, Create, Update, and Resolve Entity Assignments.
- List, Create, Update, and Delete Entity notes.
- List, Create, Update, and Delete Detection notes.
- List, Update, and Remove Entity tags.
- List, Update, and Remove Detection tags.
- List, Assign, and Unassign members in Group.
- Download PCAP of detection.
- Update Investigation Status of the Detection.
- Reset unresolved-priority of an Entity.
- Update the External Reference ID of an Entity and Detection.
- Send Investigation Query and Get Results for an Investigation Query.
Support
If you have questions or concerns about the content you’re receiving, please reach out for support at https://support.vectra.ai or support@vectra.ai.
For more information, visit our Cortex XSOAR Developer Docs