Zero Trust Analytics Platform (v1.1.21)
Provides view of raised alerts within ZTAP.
- Author
- Critical Start
- Support
- partner
- URL
- https://support.criticalstart.com/
- Categories
- Forensics & Malware Analysis
Incident fields (10)
- ZTAP Alert ID
- ZTAP Alert Link
- ZTAP Assigned Organization
- ZTAP Input Tag
- ZTAP Priority
- ZTAP Product Status
- ZTAP Source Organization
- ZTAP Status
- ZTAP Trigger Count
- ZTAP Triggers
Integrations (1)
- ZeroTrustAnalyticsPlatform
Layouts (1)
- ZTAP Alert
Playbooks (1)
- ZTAP Alert
Scripts (5)
- ZTAPBuildTimeline
- ZTAPExtractFields
- ZTAPParseFields
- ZTAPParseLinks
- ZTAPViewTimeline
README
The backbone of highly effective managed detection and response (MDR) is the Zero Trust Analytics Platform (ZTAP) utilized by elite security analysts to resolve every alert.
What does this pack do?
This pack enables you to:
- Sync and update escalated ZTAP alerts.
- Respond to Critical Start analysts directly from the XSOAR platform.
This pack includes the integration, the ZTAP Alert incident type, and an incident layout that displays information.
Custom Classifier
If using a custom classifier the following fields are required for bidirectional sync
| Input Field | Output Field |
|---|---|
| xsoar_mirror_id | dbotMirrorId |
| xsoar_mirror_direction | dbotMirrorDirection |
| xsoar_mirror_instance | dbotMirrorInstance |
| xsoar_mirror_last_sync | dbotMirrorLastSync |
| xsoar_mirror_tags | dbotMirrorTags |
Custom Playbook
If using a custom playbook comments from before the alert was escalated will not be fetched.
In order to fetch them call ztap-get-alert-entries during initial processing.
Note that the escalation comment will be fetched during this step.