Digital Guardian v2.0.9
Digital Guardian ARC Watchlist Integration
- Author:
- Digital Guardian
- Support:
- partner
- Default data source:
- DigitalGuardianARCEventCollector
Incident fields (22)
- Digital Guardian ARC UID
- Digital Guardian Activity
- Digital Guardian Alarm Name
- Digital Guardian Attachment Filename
- Digital Guardian Classification
- Digital Guardian Command line
- Digital Guardian Computer Name
- Digital Guardian Destination Address
- Digital Guardian Destination DNS Domain
- Digital Guardian Email Recipient
- Digital Guardian Email Sender
- Digital Guardian Email Subject
- Digital Guardian Filename
- Digital Guardian Parent Process Name
- Digital Guardian Policy
- Digital Guardian Process Name
- Digital Guardian Remote Port
- Digital Guardian Sensitivity
- Digital Guardian Source Address
- Digital Guardian Source IP
- Digital Guardian Threat Type
- Digital Guardian Username
Incident types (1)
Integrations (2)
Layouts (1)
Modeling rules (1)
Playbooks (1)
README
Digital Guardian
This pack integrates with Digital Guardian’s Data Loss Prevention (DLP) platform Analytics & Reporting Cloud (ARC) solution to identify, remediate, and protect sensitive data from insider and outsider threats.
What does this pack do?
-
Automates event fetching from user-configured export profiles.
-
Allows for the execution of response actions to mitigate data loss risks without manual intervention.
<~XSIAM>
Customers can decide which events and alerts are integrated into Cortex XSIAM by selecting a Digital Guardian export profile when configuring the Digital Guardian ARC Event Collector, ensuring visibility to your individual SOC’s needs.
Events and logs fetched by the event collector can be accessed and queried by navigating to Incident response > Investigation > Query Builder.
</~XSIAM>