Exterro/AccessData Pack.#This Integration is part of the
Supported Cortex XSOAR versions: 6.2.0 and later.
Use the Exterro package to integrate with the Exterro FTK platform enabling the automation of case/evidence management and endpoint collection.
Documentation for the integration was provided by FTK Connect.
Navigate to Settings > Integrations > Servers & Services.
Search for Exterro FTK.
Click Add instance to create and configure a new integration instance.
Parameter Description Example Name A meaningful name for the integration instance. FTKC Instance Web Protocol Protocol used in the FTKC server https (or) https Service URL The URL to the FTKC server, including the scheme. FQDN or IP address in X.X.X.X format with scheme specified. Service Listening Port The Port to the FTKC server. 4443 The API authentication key A piece of data that servers use to verify for authenticity eea810f5-a6f6 The path to the public certificate required to authenticate When selected, certificates are not checked. N/A
Click Test to validate the URLs, API Key, and connection.
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
Triggers the automation job and returns a string.
|automation_id||The Id of the automation workflow.||Required|
|case_name||The name of the case.||Optional|
|case_ids||Value of caseids.||Optional|
|evidence_path||The filepath of the evidence.||Optional|
|target_ips||Targetips for the collection.||Optional|
|search_tag_path||The filepath of the search and tag.||Optional|
|export_path||The path to export files.||Optional|
|ExterroFTK.Workflow.Status||string||The Status of the automation workflow trigger.|
If automation workflow Id 232 is designed for Agent Memory collection in FTK Connect, then below command can be used to trigger the automation job from cortex xsoar.
If automation workflow Id 233 is designed to create new case, add and process the evidence from provided path in FTK Connect, then below command can be used to trigger the automation job from cortex xsoar.