category: Network Security provider: Darktrace sectionorder: - Connect - Collect commonfields: id: DarktraceMBs version: -1 configuration: - defaultvalue: https://example.net display: Server URL (e.g. https://example.net) name: url required: true type: 0 section: Connect - display: Fetch incidents name: isFetch type: 8 section: Collect required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - display: Incident type name: incidentType type: 13 section: Connect required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - additionalinfo: Public token obtained by creating an API token pair on the /config configuration page display: Public API Token name: publicApiKey required: true type: 4 section: Connect - additionalinfo: Private token obtained by creating an API token pair on the /config configuration page display: Private API Token name: privateApiKey required: true type: 4 section: Connect - additionalinfo: Minimum Darktrace score for fetched incidents (0-100) defaultvalue: '0' display: Minimum Score name: min_score required: true type: 0 section: Collect - additionalinfo: Maximum number of Darktrace model breaches to fetch at a time defaultvalue: '50' display: Maximum Model Breaches per Fetch name: max_fetch type: 0 section: Collect required: false - additionalinfo: Time to start fetching the first incidents. Default is to begin fetching 1 day ago. Max number of model breaches that will be populated upon first fetch is 20. defaultvalue: 1 day ago display: First fetch time name: first_fetch type: 0 section: Collect required: false description: Rapid detection of malicious behaviour can make all the difference in the response to a security event. This pack includes configurations to combine the world-class threat detection of Darktrace with the synchrony and automation abilities of XSOAR, allowing security teams to investigate model breaches and all model breach related actions (such as commenting, acknowledging and model logic info). display: Darktrace Model Breaches name: DarktraceMBs script: commands: - name: darktrace-get-model-breach arguments: - description: Darktrace model breach unique identifier. name: pbid required: true description: Fetch details about a specific Model Breach. outputs: - contextPath: Darktrace.ModelBreach.pbid description: Model breach ID. type: Number - contextPath: Darktrace.ModelBreach.time description: Model breach generated time. type: Date - contextPath: Darktrace.ModelBreach.commentCount description: Number of comments on the model breach. type: Number - contextPath: Darktrace.ModelBreach.score description: Score of Darktrace model breach (0 to 1). type: Number - contextPath: Darktrace.ModelBreach.device.did description: Darktrace device ID of Device that breached the model. type: String - contextPath: Darktrace.ModelBreach.device.macaddress description: MAC address of the device involved in the model breach (if applicable). type: String - contextPath: Darktrace.ModelBreach.device.vendor description: Vendor of the device involved in the model breach (if applicable). type: String - contextPath: Darktrace.ModelBreach.device.ip description: IP of the device involved in the model breach (if applicable). type: String - contextPath: Darktrace.ModelBreach.device.hostname description: Hostname of the device involved in the model breach (if applicable). type: String - contextPath: Darktrace.ModelBreach.device.devicelabel description: Device label of the device involved in the model breach (if applicable). type: String - contextPath: Darktrace.ModelBreach.model.name description: Darktrace model that was breached. type: String - contextPath: Darktrace.ModelBreach.model.pid description: Model ID of the model that was breached. type: Number - contextPath: Darktrace.ModelBreach.model.uuid description: Model UUID of the model that was breached. type: String - contextPath: Darktrace.ModelBreach.model.tags description: List of model tags for the model that was breached. type: Unknown - contextPath: Darktrace.ModelBreach.model.priority description: Priority of the model that was breached (0 to 5). type: Number - contextPath: Darktrace.ModelBreach.model.description description: Darktrace model description. type: String - name: darktrace-get-model-breach-comments arguments: - description: Darktrace model breach unique identifier. name: pbid required: true description: Fetch all comments for a given model brach. outputs: - contextPath: Darktrace.ModelBreach.Comment.message description: comments on Model Breach. type: Unknown - contextPath: Darktrace.ModelBreach.pbid description: Model breach identifier. type: Unknown - contextPath: Darktrace.ModelBreach.Comment.username description: Commenting user. type: Unknown - contextPath: Darktrace.ModelBreach.Comment.time description: Comment timestamp. type: Unknown - name: darktrace-acknowledge-model-breach arguments: - description: Acknowledge a given model breach. name: pbid required: true description: Acknowledge a model breach as specified by Model Breach ID. outputs: - contextPath: Darktrace.ModelBreach.acknowledged description: Whether the model breach is acknowledged in Darktrace. type: String - contextPath: Darktrace.ModelBreach.pbid description: Model breach ID. type: Number - contextPath: Darktrace.ModelBreach.acknowledged.response description: Message response from acknowledge action. type: String - name: darktrace-post-comment-to-model-breach arguments: - description: Darktrace model breach unique identifier. name: pbid required: true - description: Comment message. name: message required: true description: Post a comment to a model breach. outputs: - contextPath: Darktrace.ModelBreach.commented description: Whether the model breach is commented in Darktrace. type: String - contextPath: Darktrace.ModelBreach.pbid description: Model breach ID. type: Number - contextPath: Darktrace.ModelBreach.message description: Comment content. type: String - contextPath: Darktrace.ModelBreach.response description: Message response from comment action. type: String - name: darktrace-unacknowledge-model-breach arguments: - description: Darktrace model breach unique identifier. name: pbid required: true description: Unacknowledge a given model breach. outputs: - contextPath: Darktrace.ModelBreach.acknowledged description: Whether the model breach is acknowledged in Darktrace. type: String - contextPath: Darktrace.ModelBreach.pbid description: Model breach ID. type: Number - contextPath: Darktrace.ModelBreach.acknowledged.response description: Message response from acknowledge action. type: Number - name: darktrace-get-model-breach-connections arguments: - name: pbid required: true description: Darktrace model breach unique identifier. - name: endtime description: End time of data to return in millisecond format, relative to midnight January 1st 1970 UTC. - name: count defaultValue: "100" description: Specifies the maximum number of items to return. Default 100. - name: offset defaultValue: "0" description: Offset of starting point for fetching details of the modelbreach. description: Retrieve connections relevant to a specified model breach. outputs: - contextPath: Darktrace.ModelBreach description: List of events from the modelbreach and their details. Each event might have different keys. It is recommended to run the command once to check the relevant outputs in context. type: Unknown - name: darktrace-get-model arguments: - name: uuid required: true description: Unique model identifier. description: Fetch the configuration details behind a specified model. outputs: - contextPath: Darktrace.Model description: A dictionary of the details of the model. Each model might have different keys. It is recommended to run the command once to check the relevant outputs in context. type: Unknown - name: darktrace-get-model-component arguments: - name: cid required: true description: Unique component identifier. description: Get details of a component. outputs: - contextPath: Darktrace.Model.Component description: A dictionary of the details of the model. Each model might have different keys. It is recommended to run the command once to check the relevant outputs in context. type: Unknown dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '-' subtype: python3 type: python fromversion: 6.6.0 tests: - No tests (auto formatted)