Skip to main content

Vectra RUX - Network Detection & Response

This Integration is part of the Vectra RUX Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.10.0 and later.

This integration allows the security operations center to create and manage incidents based on Vectra Events Detections. This integration was integrated and tested with Vectra API v3.5.

Configure Vectra RUX - Network Detection & Response in Cortex#

ParameterDescriptionRequired
Server URLURL of the Vectra AI platform.True
Client IDIdentifies a client or application for authentication and authorization in the Vectra AI platform.True
Client Secret KeySecret key used for secure communication with the Vectra AI platform.True
Fetch incidentsFalse
Max FetchThe maximum number of events detections to fetch each time. If the value is greater than 200, it will be considered as 200. The maximum is 200.False
First Fetch TimeThe date or relative timestamp from which to begin fetching events detections.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Oct 2025, 01 Mar 2021 04:45:33, 2025-12-17T14:05:44Z.		False
Entity TypesFilter by entity type. If not selected, it will fetch all events detections.False
Create Incidents for Prioritized DetectionsEnabling this checkbox generates incidents for prioritized events detections. If not selected, incidents are created for all events detections.False
Create Incidents for Escalated DetectionsEnabling this checkbox generates incidents for escalated events detections. If not selected, incidents are created for all events detections.False
Mirroring DirectionThe mirroring direction in which to mirror the detections. You can mirror 'Incoming' (from Vectra to XSOAR), 'Outgoing' (from XSOAR to Vectra), or in both directions.False
Mirror tag for notesThe tag value should be used to mirror the detection note by adding the same tag in the notes.False
Open Detection on Incident ReopenEnabling this checkbox opens the detection in Vectra when the incident is reopened in XSOAR.

Note: This parameter is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.		False
Detection Status for Incident ReopenDetection status to set in Vectra when incident is reopened in XSOAR. Default value is 'Escalated'.

Note: This parameter is only used when open detection on incident reopen is 'checked' and the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.		False
Close Detection on Incident ClosureEnabling this checkbox closes the detection in Vectra when the incident is closed in XSOAR.

Note: This parameter is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.		False
Detection Close Reason for Incident ClosureDetection close reason to set in Vectra when closing incidents in XSOAR. Default value is 'Remediated'.

Note: This parameter is only used when close detection on incident closer is 'checked' and the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.		False
Incident typeFalse
Trust any certificate (not secure)When checked, no SSL certificates check will be done when interacting with the Vectra RUX API. It's insecure. (Default - unchecked)False
Use system proxy settingsUse the system proxy settings to reach with the Vectra RUX API.False

Configuration for fetching Vectra RUX Events Detections as an XSOAR Incident#

To fetch Vectra RUX Events Detections follow the next steps:

  1. Select Fetches incidents.
  2. Under Classifier, select "N/A".
  3. Under Incident type, select "Vectra RUX Events Detection".
  4. Under Mapper (incoming), select "Vectra RUX - Incoming Mapper" for default mapping.
  5. Enter connection parameters. (Server URL, Client ID & Client Secret Key)
  6. Update "Max Fetch" & "First Fetch Time" based on your requirements.
  7. Filter the Detections by the "Entity Type"(Account and Host).
  8. Filter the Detections by "Create Incidents for Prioritized Detections", "Create Incidents for Escalated Detections":
    1. Default Behavior: By default, the integration retrieves all event detections across all entity types (Account and Host) and all detection statuses (Open, Acknowledged, Escalated, Paused). This includes both prioritized and non-prioritized detections.
    2. Fetch Only Prioritized Detections: Enable "Create Incidents for Prioritized Detections" to filter out non-prioritized detections. Incidents will be created only for prioritized event detections.
    3. Fetch Only Escalated Detections: Enable "Create Incidents for Escalated Detections" to retrieve all escalated detections, regardless of their priority level.
    4. Fetch Prioritized and Escalated Detections: Enable both "Create Incidents for Prioritized Detections" and "Create Incidents for Escalated Detections". This configuration retrieves detections that are either prioritized or escalated.
  9. Select the Incident Mirroring Direction:
    1. Incoming - Mirrors changes from the Vectra RUX Detection into the Cortex XSOAR incident.
    2. Outgoing - Mirrors changes from the Cortex XSOAR incident to the Vectra RUX Detection.
    3. Incoming And Outgoing - Mirrors changes both Incoming and Outgoing directions on incidents.
  10. Enter the relevant tag name for mirror notes. Note: This value is mapped to the dbotMirrorTags incident field in Cortex XSOAR, which defines how Cortex XSOAR handles notes when you tag them in the War Room. This is required for mirroring notes from Cortex XSOAR to Vectra RUX.
  11. Uncheck the "Open Detection on Incident Reopen" option if you don't want to open the detection in Vectra when the incident is reopened in XSOAR. This option is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.
  12. Select the "Detection Status for Incident Reopen" option if you want to set the detection status in Vectra when the incident is reopened in XSOAR. Default value is 'Escalated'. This option is only used when the "Open Detection on Incident Reopen" option is checked and the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.
  13. Uncheck the "Close Detection on Incident Closure" option if you don't want to close the detection in Vectra when the incident is closed in XSOAR. This option is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.
  14. Select the "Detection Close Reason for Incident Closure" option if you want to set the detection close reason in Vectra when the incident is closed in XSOAR. Default value is 'Benign'. This option is only used when the "Close Detection on Incident Closure" option is checked and the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.
  15. Select SSL certificate validation and Proxy if required.

Notes for mirroring:

  • This feature is compliant with XSOAR version 6.0 and above.
  • When mirroring incidents, you can make changes in Vectra that will be reflected in Cortex XSOAR, or vice versa.
  • Any tags removed from the Vectra entity will not be removed in the XSOAR incident, as XSOAR doesn't allow the removal of the tags field via the backend. However, tags removed from the XSOAR incident UI will be removed from the Vectra entity.
  • New notes from the XSOAR incident will be created as notes in the Vectra Detection. Updates to existing notes in the XSOAR incident will not be reflected in the Vectra Detection.
  • New notes from the Vectra Detection will be created as notes in the XSOAR incident. Updates to existing notes in the Vectra Detection will create new notes in the XSOAR incident.
  • If the Detection Status is updated in the Vectra Detection, it will be reflected in the XSOAR incident, or vice versa.
  • If you want to reopen a detection in Vectra when the incident is reopened in XSOAR, check the "Open Detection on Incident Reopen" option. This option is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.
  • Set the "Detection Status for Incident Reopen" option to set the detection status in Vectra when the incident is reopened in XSOAR. Default value is 'Escalated'. This option is only used when the "Open Detection on Incident Reopen" option is checked and the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.
  • If you want to close a detection in Vectra when the incident is closed in XSOAR, check the "Close Detection on Incident Closure" option. This option is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.
  • Set the "Detection Close Reason for Incident Closure" option to set the detection close reason in Vectra when the incident is closed in XSOAR. Default value is 'Benign'. This option is only used when the "Close Detection on Incident Closure" option is checked and the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'.
  • The mirroring settings apply only for incidents that are fetched after applying the settings.
  • The mirroring is strictly tied to Incident type "Vectra RUX Events Detection" & Incoming mapper "Vectra RUX - Incoming Mapper" If you want to change or use your custom incident type/mapper then make sure changes related to these are present.
  • If you want to use the mirror mechanism and you're using custom mappers, then the incoming mapper must contain the following fields: dbotMirrorDirection, dbotMirrorId, dbotMirrorInstance, and dbotMirrorTags.
  • To use a custom mapper, you must first duplicate the mapper and update the fields in the copy of the mapper. (Refer to the "Create a custom mapper consisting of the default Vectra RUX mapper" section for more information.)
  • Following new fields are introduced in the response of the incident to enable the mirroring:
    • mirror_direction: This field determines the mirroring direction for the incident. It is a required field for XSOAR to enable mirroring support.
    • mirror_tags: This field determines what would be the tag needed to mirror the XSOAR entry out to Vectra RUX. It is a required field for XSOAR to enable mirroring support.
    • mirror_instance: This field determines from which instance the XSOAR incident was created. It is a required field for XSOAR to enable mirroring support.

Expire Inactive Detections#

  • Use the Expire Inactive Detections - Vectra RUX playbook to expire inactive detections that are fetched in XSOAR.
  • You can also schedule a job with the Expire Inactive Detections - Vectra RUX playbook in Cortex XSOAR to expire inactive detections periodically. Refer to Cortex XSOAR documentation for more information. To create a job with a 24-hour recurring schedule, follow these steps:
    1. In Cortex XSOAR, navigate to Jobs (via the top menu or sidebar).
    2. Click New Job.
    3. Select Time triggered and enable Recurring.
    4. Set the schedule to Every 24 hours (or configure a specific daily time using a cron expression such as 0 0 * * *).
    5. Set the Name for the job (e.g., Expire Inactive Detections - Daily).
    6. Under Playbook, select Expire Inactive Detections - Vectra RUX.
    7. Click Create new job to activate the job.

Commands#

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

vectra-detections-mark-asclosed#

Mark detections as closed with provided detection IDs in the argument.

Base Command#

vectra-detections-mark-asclosed

Input#

Argument NameDescriptionRequired
detection_idsProvide a list of detection IDs separated by commas or a single detection ID.Required
close_reasonProvide the close reason. Possible values are: benign, remediated.Required

Context Output#

There is no context output for this command.

Command example#

!vectra-detections-mark-asclosed detection_ids=123,345 close_reason=remediated

Human Readable Output#

The provided detection IDs have been successfully closed as remediated#

vectra-user-list#

Returns a list of users.

Base Command#

vectra-user-list

Input#

Argument NameDescriptionRequired
emailFilter by email.Optional
roleFilter users with the specified role. Use the role standardized name. Possible values are: Admin, Auditor, Global Analyst, Read-Only, Restricted Admin, Security Analyst, Setting Admin, Super Admin.Optional
last_login_timestampReturn only the users which have a last login timestamp equal to or after the given timestamp.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2023, 01 Mar 2021 04:45:33, 2022-04-17T14:05:44Z.		Optional

Context Output#

PathTypeDescription
Vectra.User.idNumberThe ID of the User.
Vectra.User.user_idNumberThe ID of the User.
Vectra.User.nameStringUsername of the user.
Vectra.User.emailStringThe email associated with the user.
Vectra.User.roleStringThe role associated with the user.
Vectra.User.last_login_timestampStringLast login timestamp in UTC format of the user.
Vectra.User.last_loginStringLast login timestamp of the user.

Command example#

!vectra-user-list

Context Example#

{
"Vectra": {
"User": [
{
"id": 59,
"user_id": 59,
"username": "user.name1",
"email": "",
"role": "Security Analyst",
"last_login_timestamp": "2023-08-22T09:24:44Z",
"last_login": "2023-08-22T09:24:44Z"
},
{
"id": 32,
"user_id": 32,
"username": "user.name2",
"email": "",
"role": "Super Admin",
"last_login_timestamp": "2023-07-02T18:41:19Z",
"last_login": "2023-07-02T18:41:19Z"
},
{
"id": 23,
"user_id": 23,
"username": "vectra_mdr",
"email": "",
"role": "Vectra MDR"
}
]
}
}

Human Readable Output#

Users Table#

User IDUser NameRoleLast Login Timestamp
59user.name1Security Analyst2023-08-22T09:24:44Z
32user.name2Super Admin2023-07-02T18:41:19Z
23vectra_mdrVectra MDR

vectra-entity-list#

Returns a list of entities.

Base Command#

vectra-entity-list

Input#

Argument NameDescriptionRequired
prioritizedFetch only entities whose priority score is above the configured priority threshold will be included in the response. Possible values are: true, false.Optional
entity_typeSpecify the type of the entity. Possible values are: account, host.Optional
nameFilter by matching entity name.Optional
tagsFilter by a tag or a comma-separated list of tags.Optional
stateFilter on entity activation state. Possible values are: active, inactive.Optional
orderingOrders records by last timestamp or urgency score. Default sorting is by urgency score in descending order. Use the minus symbol (-) to sort scores in descending order. Multiple ordering fields can be specified with a comma-separated list (e.g., ordering=urgency_score,-name).Optional
last_detection_timestampReturn only the entities which have a last detection timestamp equal to or after the given timestamp.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2023, 01 Mar 2021 04:45:33, 2022-04-17T14:05:44Z.		Optional
pageEnables the caller to specify a particular page of results. Default is 1.Optional
page_sizeSpecify the desired page size for the request. Maximum is 5000. Default is 50.Optional
last_modified_timestampReturn only the entities which have a last modified timestamp equal to or after the given timestamp.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2023, 01 Mar 2021 04:45:33, 2022-04-17T14:05:44Z.		Optional

Context Output#

PathTypeDescription
Vectra.Entity.idNumberID of the entity.
Vectra.Entity.nameStringName of the entity.
Vectra.Entity.breadth_contribNumberBreadth contribution of the entity.
Vectra.Entity.importanceNumberEntity importance.
Vectra.Entity.typeStringType of the entity.
Vectra.Entity.is_prioritizedBooleanEntity is prioritized or not.
Vectra.Entity.severityStringSeverity of the entity.
Vectra.Entity.urgency_scoreNumberUrgency score of the entity.
Vectra.Entity.velocity_contribNumberVelocity contribution of the entity.
Vectra.Entity.detection_setStringSet of detections related to entity.
Vectra.Entity.last_detection_timestampDateTime of the last detection activity related to entity.
Vectra.Entity.notes.idStringNotes of the entity.
Vectra.Entity.notes.dateCreatedStringCreated date of the Note.
Vectra.Entity.notes.dateModifiedStringModified date of the Note.
Vectra.Entity.notes.createdByStringCreated user of the Note.
Vectra.Entity.notes.ModifiedByStringModified user of the Note.
Vectra.Entity.notes.noteStringNote of the entity.
Vectra.Entity.attack_ratingNumberAttack Ratting of the entity.
Vectra.Entity.privilege_levelStringPrivilege Level of the entity.
Vectra.Entity.privilege_categoryStringPrivilege Category of the entity.
Vectra.Entity.attack_profileStringAttack Profile of the entity.
Vectra.Entity.sensorsUnknownSensors of the entity.
Vectra.Entity.stateStringState of the entity.
Vectra.Entity.tagsUnknownTags of the entity.
Vectra.Entity.urlStringUrl link of the entity.
Vectra.Entity.host_typeUnknownHost type of the entity.
Vectra.Entity.account_typeStringAccount type of the entity.

Command example#

!vectra-entity-list entity_type=account page=1 page_size=4 tags=test,test1 prioritized=true state=active

Context Example#

{
[
{
"id": 334,
"name": "account_name",
"breadth_contrib": 2,
"entity_importance": 1,
"importance": 2,
"entity_type": "account",
"type": "account",
"is_prioritized": true,
"severity": "Critical",
"urgency_score": 100,
"velocity_contrib": 2,
"detection_set": [
"http://server_url.com/api/v3.3/detections/1933",
"http://server_url.com/api/v3.3/detections/1934"
],
"last_detection_timestamp": "2023-05-15T09:39:24Z",
"last_modified_timestamp": "2023-07-27T08:56:09Z",
"notes": [],
"attack_rating": 10,
"attack_profile": "AWS Threat Actor",
"sensors": [
"test"
],
"state": "active",
"tags": [
"test"
],
"url": "http://server_url.com/api/v3.3/accounts/334",
"account_type": [
"o365"
]
},
{
"id": 335,
"name": "account_name_1",
"breadth_contrib": 2,
"entity_importance": 1,
"importance": 2,
"entity_type": "account",
"type": "account",
"is_prioritized": true,
"severity": "Critical",
"urgency_score": 80,
"velocity_contrib": 2,
"detection_set": [
"http://server_url.com/api/v3.3/detections/1935",
"http://server_url.com/api/v3.3/detections/1937"
],
"last_detection_timestamp": "2023-05-15T09:41:24Z",
"last_modified_timestamp": "2023-07-27T08:56:09Z",
"notes": [],
"attack_rating": 6,
"attack_profile": "attack1",
"sensors": [],
"state": "active",
"tags": [
"test",
"test1"
],
"url": "http://server_url.com/api/v3.3/accounts/335",
"account_type": [
"o365"
]
},
{
"id": 337,
"name": "account_name_2",
"breadth_contrib": 2,
"entity_importance": 1,
"importance": 1,
"entity_type": "account",
"type": "account",
"is_prioritized": true,
"severity": "Critical",
"urgency_score": 40,
"velocity_contrib": 2,
"detection_set": [
"http://server_url.com/api/v3.3/detections/1835",
"http://server_url.com/api/v3.3/detections/1837"
],
"last_detection_timestamp": "2023-05-15T09:40:24Z",
"last_modified_timestamp": "2023-07-27T08:56:09Z",
"notes": [],
"attack_rating": 9,
"attack_profile": "attack2",
"sensors": [],
"state": "active",
"tags": [
"test1"
],
"url": "http://server_url.com/api/v3.3/accounts/337",
"account_type": [
"aws"
]
},
{
"id": 339,
"name": "account_name_3",
"breadth_contrib": 2,
"entity_importance": 1,
"importance": 2,
"entity_type": "account",
"type": "account",
"is_prioritized": true,
"severity": "Critical",
"urgency_score": 21,
"velocity_contrib": 2,
"detection_set": [
"http://server_url.com/api/v3.3/detections/1735",
"http://server_url.com/api/v3.3/detections/1737"
],
"last_detection_timestamp": "2023-05-15T09:44:24Z",
"last_modified_timestamp": "2023-07-27T08:56:09Z",
"notes": [],
"attack_rating": 5,
"attack_profile": "attack3",
"sensors": [],
"state": "active",
"tags": [
"test"
],
"url": "http://server_url.com/api/v3.3/accounts/339",
"account_type": [
"o365"
]
}
]
}

Human Readable Output#

Entities Table (Showing Page 1 out of 1)#

IDNameEntity TypeUrgency ScoreEntity ImportanceLast Detection TimestampLast Modified TimestampDetections IDsPrioritizeStateTags
334account_nameaccount100High2023-05-15T09:39:24Z2023-07-18T09:44:24Z1933, 1934trueactivetest
335account_name_1account80High2023-05-15T09:41:24Z2023-07-17T09:44:24Z1935, 1937trueactivetest, test1
337account_name_2account40Medium2023-05-15T09:40:24Z2023-07-16T09:44:24Z1835, 1837trueactivetest1
339account_name_3account21High2023-05-15T09:44:24Z2023-07-15T09:44:24Z1735, 1737trueactivetest

vectra-entity-describe#

Describes an entity by ID.

Base Command#

vectra-entity-describe

Input#

Argument NameDescriptionRequired
entity_idSpecify the id of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: host, account.Required

Context Output#

PathTypeDescription
Vectra.Entity.idNumberID of the entity.
Vectra.Entity.nameStringName of the entity.
Vectra.Entity.breadth_contribNumberBreadth contribution of the entity.
Vectra.Entity.importanceNumberEntity importance.
Vectra.Entity.typeStringType of the entity.
Vectra.Entity.is_prioritizedBooleanEntity is prioritized or not.
Vectra.Entity.severityStringSeverity of the entity.
Vectra.Entity.urgency_scoreNumberUrgency score of the entity.
Vectra.Entity.velocity_contribNumberVelocity contribution of the entity.
Vectra.Entity.detection_setStringSet of detections related to the entity.
Vectra.Entity.last_detection_timestampDateTime of the last detection activity related to the entity.
Vectra.Entity.last_modified_timestampDateTime of the last modification activity related to the entity.
Vectra.Entity.notes.idStringNotes of the entity.
Vectra.Entity.notes.dateCreatedStringCreated date of the Note.
Vectra.Entity.notes.dateModifiedStringModified date of the Note.
Vectra.Entity.notes.createdByStringCreated user of the Note.
Vectra.Entity.notes.ModifiedByStringModified user of the Note.
Vectra.Entity.notes.noteStringNote of the entity.
Vectra.Entity.attack_ratingNumberAttack Ratting of the entity.
Vectra.Entity.privilege_levelStringPrivilege Level of the entity.
Vectra.Entity.privilege_categoryStringPrivilege Category of the entity.
Vectra.Entity.attack_profileStringAttack Profile of the entity.
Vectra.Entity.sensorsUnknownSensors of the entity.
Vectra.Entity.stateStringState of the entity.
Vectra.Entity.tagsUnknownTags of the entity.
Vectra.Entity.urlStringUrl link of the entity.
Vectra.Entity.host_typeUnknownHost type of the entity.
Vectra.Entity.account_typeUnknownAccount type of the entity.

Command example#

!vectra-entity-describe entity_type=account entity_id=334

Context Example#

{
"id": 334,
"name": "account_name",
"breadth_contrib": 2,
"entity_importance": 1,
"importance": 2,
"entity_type": "account",
"type": "account",
"is_prioritized": true,
"severity": "Critical",
"urgency_score": 100,
"velocity_contrib": 2,
"detection_set": [
"http://server_url.com/api/v3.3/detections/1933",
"http://server_url.com/api/v3.3/detections/1934"
],
"last_detection_timestamp": "2023-05-15T09:39:24Z",
"last_modified_timestamp": "2023-07-28T05:25:47Z",
"notes": [],
"attack_rating": 10,
"attack_profile": "test_attack",
"sensors": [
"test"
],
"state": "active",
"tags": [
"test"
],
"url": "http://server_url.com/api/v3.3/accounts/334",
"account_type": [
"o365"
]
}
}

Human Readable Output#

Entity detail#

Entity ID: 334#

NameEntity TypeUrgency ScoreEntity ImportanceLast Detection TimestampLast Modified TimestampDetections IDsPrioritizeStateTags
account_nameaccount100High2023-05-15T09:39:24Z2023-07-28T05:25:47Z1933, 1934trueactivetest

vectra-entity-detection-list#

Returns a list of detections for a specified entity.

Base Command#

vectra-entity-detection-list

Input#

Argument NameDescriptionRequired
entity_idSpecify the id of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
pageEnables the caller to specify a particular page of results. Default is 1.Optional
page_sizeSpecify the desired page size for the request. Maximum is 5000. Default is 50.Optional
detection_categoryThe category of the detection. Possible values are: Command & Control, Botnet, Reconnaissance, Lateral Movement, Exfiltration, Info.Optional
detection_typeFilter by detection type.Optional
last_timestampReturn only the detections which have a last timestamp equal to or after the given timestamp.
Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours.
Example: 2023-04-25T00:00:00Z, 2023-04-25, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2023 04:45:33, 15 Jun.		Optional
detection_nameFilter by detection name.Optional
stateFilter by state. Default is active.Optional
tagsFilter by a tag or a comma-separated list of tags.Optional

Context Output#

PathTypeDescription
Vectra.Entity.Detections.idNumberEntity detection ID.
Vectra.Entity.Detections.assigned_dateUnknownDate assigned to the detection.
Vectra.Entity.Detections.assigned_toUnknownUser or entity assigned to the detection.
Vectra.Entity.Detections.categoryStringCategory of the detection.
Vectra.Entity.Detections.certaintyNumberCertainty level of the detection.
Vectra.Entity.Detections.c_scoreNumberConfidence score of the detection.
Vectra.Entity.Detections.descriptionStringDescription of the detection.
Vectra.Entity.Detections.detectionStringDetection information.
Vectra.Entity.Detections.detection_categoryStringCategory of the detection.
Vectra.Entity.Detections.detection_typeStringType of the detection.
Vectra.Entity.Detections.grouped_details.external_target.ipStringIP address of the external target in the detection group.
Vectra.Entity.Detections.grouped_details.external_target.nameStringName of the external target in the detection group.
Vectra.Entity.Detections.grouped_details.num_sessionsNumberNumber of sessions in the detection group.
Vectra.Entity.Detections.grouped_details.bytes_receivedNumberTotal bytes received in the detection group.
Vectra.Entity.Detections.grouped_details.bytes_sentNumberTotal bytes sent in the detection group.
Vectra.Entity.Detections.grouped_details.ja3_hashesStringJA3 hashes in the detection group.
Vectra.Entity.Detections.grouped_details.ja3s_hashesStringJA3S hashes in the detection group.
Vectra.Entity.Detections.grouped_details.sessions.tunnel_typeStringTunnel type used in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.protocolStringProtocol used in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.app_protocolStringApplication protocol used in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_portNumberDestination port in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_ipStringDestination IP address in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.bytes_receivedNumberTotal bytes received in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.bytes_sentNumberTotal bytes sent in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.first_timestampDateFirst timestamp of the sessions in the detection group.
Vectra.Entity.Detections.grouped_details.sessions.last_timestampDateLast timestamp of the sessions in the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_geoUnknownGeolocation of the destination IP in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_geo_latUnknownLatitude of the destination IP in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_geo_lonUnknownLongitude of the destination IP in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.first_timestampDateFirst timestamp of the detection group.
Vectra.Entity.Detections.grouped_details.last_timestampDateLast timestamp of the detection group.
Vectra.Entity.Detections.grouped_details.dst_ipsStringDestination IP addresses in the detection group.
Vectra.Entity.Detections.grouped_details.dst_portsNumberDestination ports in the detection group.
Vectra.Entity.Detections.grouped_details.target_domainsStringTarget domains in the detection group.
Vectra.Entity.Detections.is_targeting_key_assetBooleanIndicates if the detection is targeting a key asset.
Vectra.Entity.Detections.last_timestampDateLast timestamp of the detection.
Vectra.Entity.Detections.noteUnknownNote associated with the detection.
Vectra.Entity.Detections.note_modified_byUnknownUser or entity who last modified the note.
Vectra.Entity.Detections.note_modified_timestampUnknownTimestamp when the note was last modified.
Vectra.Entity.Detections.notesUnknownAdditional notes related to the detection.
Vectra.Entity.Detections.sensor_nameStringName of the sensor associated with the detection.
Vectra.Entity.Detections.src_account.idNumberID of the source account associated with the detection.
Vectra.Entity.Detections.src_account.nameStringName of the source account associated with the detection.
Vectra.Entity.Detections.src_account.urlStringURL of the source account associated with the detection.
Vectra.Entity.Detections.src_account.threatNumberThreat level of the source account associated with the detection.
Vectra.Entity.Detections.src_account.certaintyNumberCertainty level of the source account associated with the detection.
Vectra.Entity.Detections.src_account.privilege_levelNumberPrivilege level of the source account associated with the detection.
Vectra.Entity.Detections.src_account.privilege_categoryStringPrivilege category of the source account associated with the detection.
Vectra.Entity.Detections.src_host.idNumberID of the source host in the detection.
Vectra.Entity.Detections.src_host.ipStringIP address of the source host in the detection.
Vectra.Entity.Detections.src_host.nameStringName of the source host in the detection.
Vectra.Entity.Detections.src_host.urlStringURL associated with the source host in the detection.
Vectra.Entity.Detections.src_host.is_key_assetBooleanIndicates if the source host is a key asset.
Vectra.Entity.Detections.src_host.groupsUnknownGroups associated with the source host in the detection.
Vectra.Entity.Detections.src_host.threatNumberThreat level associated with the source host in the detection.
Vectra.Entity.Detections.src_host.certaintyNumberCertainty level associated with the source host in the detection.
Vectra.Entity.Detections.src_ipStringSource IP address in the detection.
Vectra.Entity.Detections.stateStringState of the detection.
Vectra.Entity.Detections.summary.bytes_receivedNumberTotal bytes received in the detection summary.
Vectra.Entity.Detections.summary.bytes_sentNumberTotal bytes sent in the detection summary.
Vectra.Entity.Detections.summary.cnc_serverStringCNC server associated with the detection summary.
Vectra.Entity.Detections.summary.num_eventsNumberTotal number of events related to the detection.
Vectra.Entity.Detections.summary.probable_ownerUnknownProbable owner of the detection summary.
Vectra.Entity.Detections.summary.sessionsNumberTotal sessions in the detection summary.
Vectra.Entity.Detections.tagsUnknownTags associated with the detection.
Vectra.Entity.Detections.threatNumberThreat level of the detection.
Vectra.Entity.Detections.t_scoreNumberT-score of the detection.
Vectra.Entity.Detections.typeStringType of the detection.
Vectra.Entity.Detections.urlStringURL associated with the detection.

Command example#

!vectra-entity-detection-list entity_id=1

Context Example#

{
[
{
"id": 132,
"category": "exfiltration",
"certainty": 70,
"c_score": 70,
"description": "",
"detection": "Data Smuggler",
"detection_category": "exfiltration",
"detection_type": "smuggler",
"grouped_details": [
{
"event_id": "ec2162c7-e526-4446-a549-71558743a1d7",
"event_name": "UpdateAssumeRolePolicy",
"aws_account_id": "aws_account_id",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-east-1",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"roleName\": \"stratus-red-team-backdoor-r-role\", \"policyDocument\": \"{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": {\\\"Effect\\\": \\\"Allow\\\", \\\"Principal\\\": {\\\"AWS\\\": \\\"arn:aws:iam::123456789012:root\\\"}, \\\"Action\\\": \\\"sts:AssumeRole\\\"}}\"}"
],
"response_elements": [],
"role_sequence": [
"account_id",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"stratus-red-team_06e15b96-ee6b-482c-aff4-4f2f4a46a67c"
],
"last_timestamp": "2023-06-06T17:01:04Z"
},
{
"event_id": "89a098eb-1198-4e2a-9fa4-ef568ae39403",
"event_name": "UpdateAssumeRolePolicy",
"aws_account_id": "884414556547",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-east-1",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"policyDocument\": \"{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": {\\\"Effect\\\": \\\"Allow\\\", \\\"Principal\\\": {\\\"AWS\\\": \\\"arn:aws:iam::123456789012:root\\\"}, \\\"Action\\\": \\\"sts:AssumeRole\\\"}}\", \"roleName\": \"stratus-red-team-backdoor-r-role\"}"
],
"response_elements": [],
"role_sequence": [
"account_name",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"stratus-red-team_a24eac3a-4fee-46ce-bc37-b4e675343fc9"
],
"last_timestamp": "2023-06-06T15:40:43Z"
}
],
"is_targeting_key_asset": false,
"last_timestamp": "2023-06-06T17:01:04Z",
"notes": [],
"sensor_name": "mafosb50",
"src_account": {
"id": 21,
"name": "account_name",
"url": "http://server_url.com/api/v3.3/accounts/21",
"threat": 76,
"certainty": 35
},
"src_ip": "0.0.0.0",
"state": "active",
"tags": [],
"threat": 80,
"t_score": 80,
"type": "account",
"url": "http://server_url.com/api/v3.3/detections/132"
},
{
"id": 135,
"category": "lateral_movement",
"certainty": 50,
"c_score": 50,
"description": "",
"detection": "AWS Suspect Admin Privilege Granting",
"detection_category": "lateral_movement",
"detection_type": "aws_admin_privilege_granted",
"grouped_details": [
{
"event_id": "85d88db5-cf2d-4b6e-9411-d3119d9920e0",
"event_name": "AttachRolePolicy",
"aws_account_id": "884414556547",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-east-1",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"roleName\":\"stratus-red-team-backdoor-r-role\",\"policyArn\":\"arn:aws:iam::aws:policy/AdministratorAccess\"}"
],
"response_elements": [],
"role_sequence": [
"account_name",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_5077134d-32ea-4403-996b-de30d7f278d7 HashiCorp-terraform-exec/0.17.3"
],
"last_timestamp": "2023-06-06T17:00:46Z"
},
{
"event_id": "ca157e7c-9a53-4012-9288-e6ac1c488fbc",
"event_name": "AttachRolePolicy",
"aws_account_id": "884414556547",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-east-1",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"roleName\":\"stratus-red-team-backdoor-r-role\",\"policyArn\":\"arn:aws:iam::aws:policy/AdministratorAccess\"}"
],
"response_elements": [],
"role_sequence": [
"account_name",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_01be8427-d1b5-4c18-8edb-0301c8e66c8e HashiCorp-terraform-exec/0.17.3"
],
"last_timestamp": "2023-06-06T15:40:07Z"
}
],
"is_targeting_key_asset": false,
"last_timestamp": "2023-06-06T17:00:46Z",
"notes": [],
"sensor_name": "mafosb50",
"src_account": {
"id": 21,
"name": "account_name",
"url": "http://server_url.com/api/v3.3/accounts/21",
"threat": 76,
"certainty": 35
},
"src_ip": "0.0.0.0",
"state": "fixed",
"summary": {
},
"tags": [],
"threat": 60,
"t_score": 60,
"type": "account",
"url": "http://server_url.com/api/v3.3/detections/135"
},
{
"id": 140,
"category": "reconnaissance",
"certainty": 40,
"c_score": 40,
"description": "",
"detection": "RPC Targeted Recon",
"detection_category": "reconnaissance",
"detection_type": "rpc_recon_1to1",
"grouped_details": [
{
"event_id": "cf9f469b-0a8e-47c6-85eb-5a0486292e58",
"event_name": "ModifySnapshotAttribute",
"aws_account_id": "884414556547",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-west-2",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"snapshotId\":\"snap-0f7d022a2f4f67e08\",\"createVolumePermission\":{\"add\":{\"items\":[{\"userId\":\"012345678912\"}]}},\"attributeType\":\"CREATE_VOLUME_PERMISSION\"}"
],
"response_elements": [
"{\"requestId\":\"350c1eb8-b696-4d94-88d4-a764a0eed08b\",\"_return\":true}"
],
"role_sequence": [
"account_name",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"stratus-red-team_a4dd596b-7a8d-4e77-a74d-13f19adf4403"
],
"last_timestamp": "2023-06-06T15:46:28Z"
}
],
"is_targeting_key_asset": false,
"last_timestamp": "2023-06-06T15:46:28Z",
"notes": [],
"sensor_name": "mafosb50",
"src_account": {
"id": 21,
"name": "account_name",
"url": "http://server_url.com/api/v3.3/accounts/21",
"threat": 76,
"certainty": 35
},
"src_ip": "0.0.0.0",
"state": "fixed",
"summary": {
},
"tags": [],
"threat": 60,
"t_score": 60,
"type": "account",
"url": "http://server_url.com/api/v3.3/detections/140"
}
]
}

Human Readable Output#

Detections Table (Showing Page 1 out of 1)#

IDDetection NameDetection TypeCategoryAccount NameSrc IPThreat ScoreCertainty ScoreNumber Of EventsStateLast Timestamp
132Data Smugglersmugglerexfiltrationaccount_name0.0.0.080700active2023-06-06T17:01:04Z
135AWS Suspect Admin Privilege Grantingaws_admin_privilege_grantedlateral_movementaccount_name0.0.0.060500fixed2023-06-06T17:00:46Z
140RPC Targeted Reconrpc_recon_1to1reconnaissanceaccount_name0.0.0.060400fixed2023-06-06T15:46:28Z

vectra-detection-describe#

Returns a list of detections for the specified detection ID(s).

Base Command#

vectra-detection-describe

Input#

Argument NameDescriptionRequired
detection_idsSpecify the ID(s) of the detections.Required
pageEnables the caller to specify a particular page of results. Default is 1.Optional
page_sizeSpecify the desired page size for the request. Maximum is 5000. Default is 50.Optional

Context Output#

PathTypeDescription
Vectra.Entity.Detections.idNumberEntity detection ID.
Vectra.Entity.Detections.assigned_dateUnknownDate assigned to the detection.
Vectra.Entity.Detections.assigned_toUnknownUser or entity assigned to the detection.
Vectra.Entity.Detections.categoryStringCategory of the detection.
Vectra.Entity.Detections.certaintyNumberCertainty level of the detection.
Vectra.Entity.Detections.c_scoreNumberConfidence score of the detection.
Vectra.Entity.Detections.descriptionStringDescription of the detection.
Vectra.Entity.Detections.detectionStringDetection information.
Vectra.Entity.Detections.detection_categoryStringCategory of the detection.
Vectra.Entity.Detections.detection_typeStringType of the detection.
Vectra.Entity.Detections.grouped_details.external_target.ipStringIP address of the external target in the detection group.
Vectra.Entity.Detections.grouped_details.external_target.nameStringName of the external target in the detection group.
Vectra.Entity.Detections.grouped_details.num_sessionsNumberNumber of sessions in the detection group.
Vectra.Entity.Detections.grouped_details.bytes_receivedNumberTotal bytes received in the detection group.
Vectra.Entity.Detections.grouped_details.bytes_sentNumberTotal bytes sent in the detection group.
Vectra.Entity.Detections.grouped_details.ja3_hashesStringJA3 hashes in the detection group.
Vectra.Entity.Detections.grouped_details.ja3s_hashesStringJA3S hashes in the detection group.
Vectra.Entity.Detections.grouped_details.sessions.tunnel_typeStringTunnel type used in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.protocolStringProtocol used in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.app_protocolStringApplication protocol used in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_portNumberDestination port in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_ipStringDestination IP address in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.bytes_receivedNumberTotal bytes received in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.bytes_sentNumberTotal bytes sent in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.first_timestampDateFirst timestamp of the sessions in the detection group.
Vectra.Entity.Detections.grouped_details.sessions.last_timestampDateLast timestamp of the sessions in the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_geoUnknownGeolocation of the destination IP in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_geo_latUnknownLatitude of the destination IP in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.sessions.dst_geo_lonUnknownLongitude of the destination IP in the sessions of the detection group.
Vectra.Entity.Detections.grouped_details.first_timestampDateFirst timestamp of the detection group.
Vectra.Entity.Detections.grouped_details.last_timestampDateLast timestamp of the detection group.
Vectra.Entity.Detections.grouped_details.dst_ipsStringDestination IP addresses in the detection group.
Vectra.Entity.Detections.grouped_details.dst_portsNumberDestination ports in the detection group.
Vectra.Entity.Detections.grouped_details.target_domainsStringTarget domains in the detection group.
Vectra.Entity.Detections.is_targeting_key_assetBooleanIndicates if the detection is targeting a key asset.
Vectra.Entity.Detections.last_timestampDateLast timestamp of the detection.
Vectra.Entity.Detections.noteUnknownNote associated with the detection.
Vectra.Entity.Detections.note_modified_byUnknownUser or entity who last modified the note.
Vectra.Entity.Detections.note_modified_timestampUnknownTimestamp when the note was last modified.
Vectra.Entity.Detections.notesUnknownAdditional notes related to the detection.
Vectra.Entity.Detections.sensor_nameStringName of the sensor associated with the detection.
Vectra.Entity.Detections.src_account.idNumberID of the source account associated with the detection.
Vectra.Entity.Detections.src_account.nameStringName of the source account associated with the detection.
Vectra.Entity.Detections.src_account.urlStringURL of the source account associated with the detection.
Vectra.Entity.Detections.src_account.threatNumberThreat level of the source account associated with the detection.
Vectra.Entity.Detections.src_account.certaintyNumberCertainty level of the source account associated with the detection.
Vectra.Entity.Detections.src_account.privilege_levelNumberPrivilege level of the source account associated with the detection.
Vectra.Entity.Detections.src_account.privilege_categoryStringPrivilege category of the source account associated with the detection.
Vectra.Entity.Detections.src_host.idNumberID of the source host in the detection.
Vectra.Entity.Detections.src_host.ipStringIP address of the source host in the detection.
Vectra.Entity.Detections.src_host.nameStringName of the source host in the detection.
Vectra.Entity.Detections.src_host.urlStringURL associated with the source host in the detection.
Vectra.Entity.Detections.src_host.is_key_assetBooleanIndicates if the source host is a key asset.
Vectra.Entity.Detections.src_host.groupsUnknownGroups associated with the source host in the detection.
Vectra.Entity.Detections.src_host.threatNumberThreat level associated with the source host in the detection.
Vectra.Entity.Detections.src_host.certaintyNumberCertainty level associated with the source host in the detection.
Vectra.Entity.Detections.src_ipStringSource IP address in the detection.
Vectra.Entity.Detections.stateStringState of the detection.
Vectra.Entity.Detections.summary.bytes_receivedNumberTotal bytes received in the detection summary.
Vectra.Entity.Detections.summary.bytes_sentNumberTotal bytes sent in the detection summary.
Vectra.Entity.Detections.summary.cnc_serverStringCNC server associated with the detection summary.
Vectra.Entity.Detections.summary.num_eventsNumberTotal number of events related to the detection.
Vectra.Entity.Detections.summary.probable_ownerUnknownProbable owner of the detection summary.
Vectra.Entity.Detections.summary.sessionsNumberTotal sessions in the detection summary.
Vectra.Entity.Detections.tagsUnknownTags associated with the detection.
Vectra.Entity.Detections.threatNumberThreat level of the detection.
Vectra.Entity.Detections.t_scoreNumberT-score of the detection.
Vectra.Entity.Detections.typeStringType of the detection.
Vectra.Entity.Detections.urlStringURL associated with the detection.

Command example#

!vectra-detection-describe detection_ids=132,135,140

Context Example#

{
[
{
"id": 132,
"category": "exfiltration",
"certainty": 70,
"c_score": 70,
"description": "",
"detection": "Data Smuggler",
"detection_category": "exfiltration",
"detection_type": "smuggler",
"grouped_details": [
{
"event_id": "ec2162c7-e526-4446-a549-71558743a1d7",
"event_name": "UpdateAssumeRolePolicy",
"aws_account_id": "aws_account_id",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-east-1",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"roleName\": \"stratus-red-team-backdoor-r-role\", \"policyDocument\": \"{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": {\\\"Effect\\\": \\\"Allow\\\", \\\"Principal\\\": {\\\"AWS\\\": \\\"arn:aws:iam::123456789012:root\\\"}, \\\"Action\\\": \\\"sts:AssumeRole\\\"}}\"}"
],
"response_elements": [],
"role_sequence": [
"account_id",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"stratus-red-team_06e15b96-ee6b-482c-aff4-4f2f4a46a67c"
],
"last_timestamp": "2023-06-06T17:01:04Z"
},
{
"event_id": "89a098eb-1198-4e2a-9fa4-ef568ae39403",
"event_name": "UpdateAssumeRolePolicy",
"aws_account_id": "884414556547",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-east-1",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"policyDocument\": \"{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": {\\\"Effect\\\": \\\"Allow\\\", \\\"Principal\\\": {\\\"AWS\\\": \\\"arn:aws:iam::123456789012:root\\\"}, \\\"Action\\\": \\\"sts:AssumeRole\\\"}}\", \"roleName\": \"stratus-red-team-backdoor-r-role\"}"
],
"response_elements": [],
"role_sequence": [
"account_name",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"stratus-red-team_a24eac3a-4fee-46ce-bc37-b4e675343fc9"
],
"last_timestamp": "2023-06-06T15:40:43Z"
}
],
"is_targeting_key_asset": false,
"last_timestamp": "2023-06-06T17:01:04Z",
"notes": [],
"sensor_name": "mafosb50",
"src_account": {
"id": 21,
"name": "account_name",
"url": "http://server_url.com/api/v3.3/accounts/21",
"threat": 76,
"certainty": 35
},
"src_ip": "0.0.0.0",
"state": "active",
"summary": {
},
"tags": [],
"threat": 80,
"t_score": 80,
"type": "account",
"url": "http://server_url.com/api/v3.3/detections/132"
},
{
"id": 135,
"category": "lateral_movement",
"certainty": 50,
"c_score": 50,
"description": "",
"detection": "AWS Suspect Admin Privilege Granting",
"detection_category": "lateral_movement",
"detection_type": "aws_admin_privilege_granted",
"grouped_details": [
{
"event_id": "85d88db5-cf2d-4b6e-9411-d3119d9920e0",
"event_name": "AttachRolePolicy",
"aws_account_id": "884414556547",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-east-1",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"roleName\":\"stratus-red-team-backdoor-r-role\",\"policyArn\":\"arn:aws:iam::aws:policy/AdministratorAccess\"}"
],
"response_elements": [],
"role_sequence": [
"account_name",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_5077134d-32ea-4403-996b-de30d7f278d7 HashiCorp-terraform-exec/0.17.3"
],
"last_timestamp": "2023-06-06T17:00:46Z"
},
{
"event_id": "ca157e7c-9a53-4012-9288-e6ac1c488fbc",
"event_name": "AttachRolePolicy",
"aws_account_id": "884414556547",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-east-1",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"roleName\":\"stratus-red-team-backdoor-r-role\",\"policyArn\":\"arn:aws:iam::aws:policy/AdministratorAccess\"}"
],
"response_elements": [],
"role_sequence": [
"account_name",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_01be8427-d1b5-4c18-8edb-0301c8e66c8e HashiCorp-terraform-exec/0.17.3"
],
"last_timestamp": "2023-06-06T15:40:07Z"
}
],
"is_targeting_key_asset": false,
"last_timestamp": "2023-06-06T17:00:46Z",
"notes": [],
"sensor_name": "mafosb50",
"src_account": {
"id": 21,
"name": "account_name",
"url": "http://server_url.com/api/v3.3/accounts/21",
"threat": 76,
"certainty": 35
},
"src_ip": "0.0.0.0",
"state": "fixed",
"summary": {
},
"tags": [],
"threat": 60,
"t_score": 60,
"type": "account",
"url": "http://server_url.com/api/v3.3/detections/135"
},
{
"id": 140,
"category": "reconnaissance",
"certainty": 40,
"c_score": 40,
"description": "",
"detection": "RPC Targeted Recon",
"detection_category": "reconnaissance",
"detection_type": "rpc_recon_1to1",
"grouped_details": [
{
"event_id": "cf9f469b-0a8e-47c6-85eb-5a0486292e58",
"event_name": "ModifySnapshotAttribute",
"aws_account_id": "884414556547",
"src_external_host": {
"ip": "0.0.0.0"
},
"aws_region": "us-west-2",
"access_key_id": [
"123456"
],
"identity_type": "Federated Account",
"assumed_role": "AWSReservedSSO_AdministratorAccess_a670eb90f07e2960",
"request_parameters": [
"{\"snapshotId\":\"snap-0f7d022a2f4f67e08\",\"createVolumePermission\":{\"add\":{\"items\":[{\"userId\":\"012345678912\"}]}},\"attributeType\":\"CREATE_VOLUME_PERMISSION\"}"
],
"response_elements": [
"{\"requestId\":\"350c1eb8-b696-4d94-88d4-a764a0eed08b\",\"_return\":true}"
],
"role_sequence": [
"account_name",
"AWSReservedSSO_AdministratorAccess_a670eb90f07e2960"
],
"user_agent": [
"stratus-red-team_a4dd596b-7a8d-4e77-a74d-13f19adf4403"
],
"last_timestamp": "2023-06-06T15:46:28Z"
}
],
"is_targeting_key_asset": false,
"last_timestamp": "2023-06-06T15:46:28Z",
"notes": [],
"sensor_name": "mafosb50",
"src_account": {
"id": 21,
"name": "account_name",
"url": "http://server_url.com/api/v3.3/accounts/21",
"threat": 76,
"certainty": 35
},
"src_ip": "0.0.0.0",
"state": "fixed",
"summary": {
},
"tags": [],
"threat": 60,
"t_score": 60,
"type": "account",
"url": "http://server_url.com/api/v3.3/detections/140"
}
]
}

Human Readable Output#

Detections Table (Showing Page 1 out of 1)#

IDDetection NameDetection TypeCategoryAccount NameSrc IPThreat ScoreCertainty ScoreNumber Of EventsStateLast Timestamp
132Data Smugglersmugglerexfiltrationaccount_name0.0.0.080700active2023-06-06T17:01:04Z
135AWS Suspect Admin Privilege Grantingaws_admin_privilege_grantedlateral_movementaccount_name0.0.0.060500fixed2023-06-06T17:00:46Z
140RPC Targeted Reconrpc_recon_1to1reconnaissanceaccount_name0.0.0.060400fixed2023-06-06T15:46:28Z

vectra-entity-note-add#

Add a note to the entity.

Base Command#

vectra-entity-note-add

Input#

Argument NameDescriptionRequired
entity_idSpecify the id of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
noteNote to be added in the specified entity_id.Required

Context Output#

PathTypeDescription
Vectra.Entity.Notes.entity_idStringID of the entity associated with the note.
Vectra.Entity.Notes.note_idNumberID of the note.
Vectra.Entity.Notes.date_createdDateDate when the note was created.
Vectra.Entity.Notes.date_modifiedUnknownDate when the note was last modified.
Vectra.Entity.Notes.created_byStringUser who created the note.
Vectra.Entity.Notes.modified_byUnknownUser who last modified the note.
Vectra.Entity.Notes.noteStringContent of the note.

Context Output#

PathTypeDescription
Vectra.Entity.Notes.entity_idStringThe ID of the entity associated with the note.
Vectra.Entity.Notes.note_idNumberThe ID of the note.
Vectra.Entity.Notes.date_createdDateThe date when the note was created.
Vectra.Entity.Notes.date_modifiedUnknownThe date when the note was last modified.
Vectra.Entity.Notes.created_byStringThe user who created the note.
Vectra.Entity.Notes.modified_byUnknownThe user who last modified the note.
Vectra.Entity.Notes.noteStringThe content of the note.

Command example#

!vectra-entity-note-add entity_id=1 entity_type=account note="test note"

Context Example#

{
{
"date_created": "2023-06-21T06:19:15.224449Z",
"created_by": "test_user",
"note": "test_note",
"note_id": 19,
"entity_id": 1
}
}

Human Readable Output#

The note has been successfully added to the entity#

Returned Note ID: 19

vectra-entity-note-update#

Update a note in the entity.

Base Command#

vectra-entity-note-update

Input#

Argument NameDescriptionRequired
entity_idSpecify the id of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
note_idSpecify the ID of the note.Required
noteNote to be updated for the specified note_id.Required

Context Output#

PathTypeDescription
Vectra.Entity.Notes.entity_idStringID of the entity associated with the note.
Vectra.Entity.Notes.note_idNumberID of the note.
Vectra.Entity.Notes.date_createdDateDate when the note was created.
Vectra.Entity.Notes.date_modifiedUnknownDate when the note was last modified.
Vectra.Entity.Notes.created_byStringUser who created the note.
Vectra.Entity.Notes.modified_byUnknownUser who last modified the note.
Vectra.Entity.Notes.noteStringContent of the note.

Command example#

!vectra-entity-note-update entity_id=1 entity_type=account note_id=1 note="note modified"

Context Example#

{
{
"date_created": "2023-06-16T04:55:58Z",
"date_modified": "2023-06-22T04:57:09Z",
"created_by": "test_user",
"modified_by": "test_user",
"note": "note modified",
"note_id": 8,
"entity_id": 1
}
}

Human Readable Output#

The note has been successfully updated in the entity#

vectra-entity-note-remove#

Remove a note from the entity.

Base Command#

vectra-entity-note-remove

Input#

Argument NameDescriptionRequired
entity_idSpecify the ID of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
note_idSpecify the ID of the note.Required

Context Output#

There is no context output for this command.

Command Example#

!vectra-entity-note-remove entity_id=1 entity_type=account note_id=1"

Context Example#

{}

Human Readable Output#

The note has been successfully removed from the entity#

vectra-entity-tag-add#

Add tags in the entity.

Base Command#

vectra-entity-tag-add

Input#

Argument NameDescriptionRequired
entity_idSpecify the id of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
tagsComma-separated values of tags to be included in the entity.Required

Context Output#

PathTypeDescription
Vectra.Entity.Tags.tag_idStringID of the tag.
Vectra.Entity.Tags.entity_idStringID of the entity associated with the tag.
Vectra.Entity.Tags.entity_typeStringType of the entity.
Vectra.Entity.Tags.tagsUnknownA list of tags linked to an entity.

Command example#

!vectra-entity-tag-add entity_id=1 entity_type=host tags="tag1, tag2"

Context Example#

{
{
"tag_id": "1",
"tags": [
"tag1",
"tag2"
],
"entity_type": "host",
"entity_id": 1
}
}

Human Readable Output#

Tags have been successfully added to the entity#

Updated list of tags: tag1, tag2

vectra-entity-tag-remove#

Remove tags from the entity.

Base Command#

vectra-entity-tag-remove

Input#

Argument NameDescriptionRequired
entity_idSpecify the id of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
tagsComma-separated values of tags to be removed from the entity.Required

Context Output#

PathTypeDescription
Vectra.Entity.Tags.tag_idStringID of the tag.
Vectra.Entity.Tags.entity_idStringID of the entity associated with the tag.
Vectra.Entity.Tags.entity_typeStringType of the entity.
Vectra.Entity.Tags.tagsUnknownA list of tags linked to an entity.

Command example#

!vectra-entity-tag-remove entity_id=1 entity_type=host tags="tag2"

Context Example#

{
{
"tag_id": "1",
"tags": ["tag1"],
"entity_type": "host",
"entity_id": 1
}
}

Human Readable Output#

Specified tags have been successfully removed for the entity#

Updated list of tags: tag1

vectra-entity-tag-list#

Returns a list of tags for a specified entity.

Base Command#

vectra-entity-tag-list

Input#

Argument NameDescriptionRequired
entity_idSpecify the id of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required

Context Output#

PathTypeDescription
Vectra.Entity.Tags.tag_idStringID of the tag.
Vectra.Entity.Tags.entity_idStringID of the entity associated with the tag.
Vectra.Entity.Tags.entity_typeStringType of the entity.
Vectra.Entity.Tags.tagsUnknownA list of tags linked to an entity.

Command example#

!vectra-entity-tag-list entity_id=1 entity_type=host

Context Example#

{
"Vectra": {
"Entity": {
"Tags": {
"tag_id": "1",
"tags": [
"tag1",
"tag2"
],
"entity_type": "host",
"entity_id": 1
}
}
}
}

Human Readable Output#

List of tags: tag1, tag2#

vectra-entity-assignment-add#

Add an assignment for the entity.

Base Command#

vectra-entity-assignment-add

Input#

Argument NameDescriptionRequired
entity_idSpecify the ID of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
user_idSpecify the ID of the user.Required

Context Output#

PathTypeDescription
Vectra.Entity.Assignments.idNumberID of the assignment.
Vectra.Entity.Assignments.assignment_idNumberID of the assignment.
Vectra.Entity.Assignments.assigned_by.idNumberID of the user who assigned the entity.
Vectra.Entity.Assignments.assigned_by.usernameStringUsername of the user who assigned the entity.
Vectra.Entity.Assignments.date_assignedDateDate when the entity was assigned.
Vectra.Entity.Assignments.date_resolvedDateDate when the entity was resolved.
Vectra.Entity.Assignments.events.assignment_idNumberID of the assignment event.
Vectra.Entity.Assignments.events.actorNumberID of the actor who performed the assignment event.
Vectra.Entity.Assignments.events.event_typeStringType of assignment event.
Vectra.Entity.Assignments.events.datetimeDateDate of the assignment event.
Vectra.Entity.Assignments.events.context.toNumberID of the entity that was assigned to.
Vectra.Entity.Assignments.events.context.entity_t_scoreNumberThreat score of the entity that was assigned to.
Vectra.Entity.Assignments.events.context.entity_c_scoreNumberCertainty score of the entity that was assigned to.
Vectra.Entity.Assignments.outcome.idStringID of the assignment outcome.
Vectra.Entity.Assignments.outcome.builtinStringWhether the assignment outcome is builtin or not.
Vectra.Entity.Assignments.outcome.user_selectableStringWhether the assignment outcome is user selectable or not.
Vectra.Entity.Assignments.outcome.titleStringTitle of the assignment outcome.
Vectra.Entity.Assignments.outcome.categoryStringCategory of the assignment outcome.
Vectra.Entity.Assignments.resolved_by.idNumberID of the user who resolved the entity.
Vectra.Entity.Assignments.resolved_by.usernameStringUsername of the user who resolved the entity.
Vectra.Entity.Assignments.triaged_detectionsUnknownNumber of detections that have been triaged for the entity.
Vectra.Entity.Assignments.host_idNumberID of the host that the entity is associated with.
Vectra.Entity.Assignments.account_idUnknownID of the account that the entity is associated with.
Vectra.Entity.Assignments.assigned_to.idNumberID of the user who is currently assigned to the entity.
Vectra.Entity.Assignments.assigned_to.usernameStringUsername of the user who is currently assigned to the entity.

Command Example#

!vectra-entity-assignment-add entity_id=1 entity_type=account user_id=1

Context Example#

{
{
"assigned_by": {
"id": 2,
"username": "test_user_2"
},
"date_assigned": "2023-07-24T08:52:59.367115Z",
"events": [
{
"assignment_id": 74,
"actor": 65,
"event_type": "created",
"datetime": "2023-07-24T08:52:59Z",
"context": {
"to": 60,
"entity_t_score": 0,
"entity_c_score": 0
}
}
],
"host_id": 10,
"assigned_to": {
"id": 1,
"username": "test.user@example.com"
},
"assignment_id": 1,
"id":1
}
}

Human Readable Output#

The assignment has been successfully created#

Assignment detail#

Assignment IDAssigned ByAssigned DateAssigned ToEvent Type
1test_user_22023-07-24T08:52:59.367115Ztest.user@example.comcreated

vectra-entity-assignment-update#

Update an assignment in the entity.

Base Command#

vectra-entity-assignment-update

Input#

Argument NameDescriptionRequired
assignment_idSpecify the ID of the assignment.Required
user_idSpecify the ID of the user.Required

Context Output#

PathTypeDescription
Vectra.Entity.Assignments.idNumberID of the assignment.
Vectra.Entity.Assignments.assignment_idNumberID of the assignment.
Vectra.Entity.Assignments.assigned_by.idNumberID of the user who assigned the entity.
Vectra.Entity.Assignments.assigned_by.usernameStringUsername of the user who assigned the entity.
Vectra.Entity.Assignments.date_assignedDateDate when the entity was assigned.
Vectra.Entity.Assignments.date_resolvedDateDate when the entity was resolved.
Vectra.Entity.Assignments.events.assignment_idNumberID of the assignment event.
Vectra.Entity.Assignments.events.actorNumberID of the actor who performed the assignment event.
Vectra.Entity.Assignments.events.event_typeStringType of assignment event.
Vectra.Entity.Assignments.events.datetimeDateDate of the assignment event.
Vectra.Entity.Assignments.events.context.toNumberID of the entity that was assigned to.
Vectra.Entity.Assignments.events.context.fromNumberID of the entity that was assigned.
Vectra.Entity.Assignments.events.context.entity_t_scoreNumberThreat score of the entity that was assigned to.
Vectra.Entity.Assignments.events.context.entity_c_scoreNumberCertainty score of the entity that was assigned to.
Vectra.Entity.Assignments.outcome.idStringID of the assignment outcome.
Vectra.Entity.Assignments.outcome.builtinStringWhether the assignment outcome is builtin or not.
Vectra.Entity.Assignments.outcome.user_selectableStringWhether the assignment outcome is user selectable or not.
Vectra.Entity.Assignments.outcome.titleStringTitle of the assignment outcome.
Vectra.Entity.Assignments.outcome.categoryStringCategory of the assignment outcome.
Vectra.Entity.Assignments.resolved_by.idNumberID of the user who resolved the entity.
Vectra.Entity.Assignments.resolved_by.usernameStringUsername of the user who resolved the entity.
Vectra.Entity.Assignments.triaged_detectionsUnknownNumber of detections that have been triaged for the entity.
Vectra.Entity.Assignments.host_idNumberID of the host that the entity is associated with.
Vectra.Entity.Assignments.account_idUnknownID of the account that the entity is associated with.
Vectra.Entity.Assignments.assigned_to.idNumberID of the user who is currently assigned to the entity.
Vectra.Entity.Assignments.assigned_to.usernameStringUsername of the user who is currently assigned to the entity.

Command Example#

!vectra-entity-assignment-update assignment_id=1 user_id=2

Context Example#

{
{
"assigned_by": {
"id": 65,
"username": "api_client"
},
"date_assigned": "2023-07-21T12:44:10Z",
"events": [
{
"assignment_id": 1,
"actor": 65,
"event_type": "reassigned",
"datetime": "2023-07-25T06:26:10Z",
"context": {
"from": 1,
"to": 2,
"entity_t_score": 68,
"entity_c_score": 90
}
},
{
"assignment_id": 1,
"actor": 65,
"event_type": "created",
"datetime": "2023-07-21T12:44:10Z",
"context": {
"to": 1,
"entity_t_score": 68,
"entity_c_score": 90
}
}
],
"host_id": 97,
"assigned_to": {
"id": 2,
"username": "test_user_2"
},
"assignment_id": 1,
"id": 1
}
}

Human Readable Output#

The assignment has been successfully updated#

Assignment detail#

Assignment IDAssigned ByAssigned DateAssigned ToEvent Type
1api_client2023-07-21T12:44:10Ztest_user_2reassigned

vectra-detection-pcap-download#

Download pcap of the detection.

Base Command#

vectra-detection-pcap-download

Input#

Argument NameDescriptionRequired
detection_idSpecify the ID of the detection.Required

Context Output#

PathTypeDescription
File.SizeNumberThe size of the file.
File.SHA1StringThe SHA1 hash of the file.
File.SHA256StringThe SHA256 hash of the file.
File.SHA512StringThe SHA512 hash of the file.
File.NameStringThe name of the file.
File.SSDeepStringThe SSDeep hash of the file.
File.EntryIDStringThe entry ID of the file.
File.InfoStringFile information.
File.TypeStringThe file type.
File.MD5StringThe MD5 hash of the file.
File.ExtensionStringThe file extension.

Command Example#

!vectra-detection-pcap-download detection_id="116"

Context Example#

{
"File": {
"EntryID": "1703@7e0f6637-f0a4-46b3-8c61-2f94b3432428",
"Extension": "pcap",
"Info": "pcap-ng capture file - version 1.0",
"MD5": "709db6e1f8f5054ca57caf43ba248ed6",
"Name": "IP-192.168.55.10_hidden_dns_tunnel_1382.pcap",
"SHA1": "49fe55c6aef85549261b46dd2e54f8d485306ee5",
"SHA256": "8615bde9332584b4fd4fe4dc2cc6fc4c75504f6d44667814456c089fd413aa4d",
"SHA512": "3fa29be0e20884c850b62d2a99aa09b24488289ba0bc9aff37ebe982c21d3a78fb26d9c9ac7fbf2a0839ba649dc0a845f30e7f13de3a0c6284c3c2ac54102143",
"SSDeep": "384:dN+Pm11R0XPmts64kZog9ZaikYngk+SnRxFyeyCEyuAOasucOcakca0/rHfcjOUI:dI+t25caEPjRSnmuNasxRana4DgOUDcX",
"Size": 23988,
"Type": "application/vnd.tcpdump.pcap"
}
}

Human Readable Output#

Uploaded file: IP-192.168.55.10_hidden_dns_tunnel_1382.pcap

PropertyTypeSizeInfoMD5SHA1SHA256SHA512SSDeep
Valueapplication/vnd.tcpdump.pcap23,988 bytespcap-ng capture file - version 1.0709db6e1f8f5054ca57caf43ba248ed649fe55c6aef85549261b46dd2e54f8d485306ee58615bde9332584b4fd4fe4dc2cc6fc4c75504f6d44667814456c089fd413aa4d3fa29be0e20884c850b62d2a99aa09b24488289ba0bc9aff37ebe982c21d3a78fb26d9c9ac7fbf2a0839ba649dc0a845f30e7f13de3a0c6284c3c2ac54102143384:dN+Pm11R0XPmts64kZog9ZaikYngk+SnRxFyeyCEyuAOasucOcakca0/rHfcjOUI:dI+t25caEPjRSnmuNasxRana4DgOUDcX

vectra-assignment-list#

Returns a list of all assignments.

Base Command#

vectra-assignment-list

Input#

Argument NameDescriptionRequired
entity_idsSpecify the IDs of the entities. Comma-separated values supported.Optional
entity_typeSpecify the type of the entity. Possible values are: account, host.Optional
resolvedFilter by resolved status. Possible values are: True, False.Optional
assigneesFilter by user ids of the assignment. Comma-separated values supported.Optional
resolutionFilter by outcome ids of the resolution. Comma-separated values supported.Optional
created_afterFilter by created after the timestamp.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2023, 01 Mar 2021 04:45:33, 2022-04-17T14:05:44Z.		Optional
pageEnables the caller to specify a particular page of results. Default is 1.Optional
page_sizeSpecify the desired page size for the request. Default is 50.Optional

Context Output#

PathTypeDescription
Vectra.Entity.Assignments.idNumberID of the assignment.
Vectra.Entity.Assignments.assignment_idNumberID of the assignment.
Vectra.Entity.Assignments.assigned_by.idNumberID of the user who assigned the entity.
Vectra.Entity.Assignments.assigned_by.usernameStringUsername of the user who assigned the entity.
Vectra.Entity.Assignments.date_assignedDateDate when the entity was assigned.
Vectra.Entity.Assignments.date_resolvedDateDate when the entity was resolved.
Vectra.Entity.Assignments.events.assignment_idNumberID of the assignment event.
Vectra.Entity.Assignments.events.actorNumberID of the actor who performed the assignment event.
Vectra.Entity.Assignments.events.event_typeStringType of the assignment event.
Vectra.Entity.Assignments.events.datetimeDateDate of the assignment event.
Vectra.Entity.Assignments.events.context.toNumberID of the entity that was assigned to.
Vectra.Entity.Assignments.events.context.entity_t_scoreNumberThreat score of the entity that was assigned to.
Vectra.Entity.Assignments.events.context.entity_c_scoreNumberCertainty score of the entity that was assigned to.
Vectra.Entity.Assignments.events.context.triage_asStringTriage status of the entity.
Vectra.Entity.Assignments.events.context.triaged_detection_idsArrayIDs of the detections that have been triaged for the entity.
Vectra.Entity.Assignments.events.context.fixed_detection_idsArrayIDs of the detections that have been fixed.
Vectra.Entity.Assignments.events.context.created_rule_idsArrayIDs of the rules that have been created for the entity.
Vectra.Entity.Assignments.outcome.idNumberID of the assignment outcome.
Vectra.Entity.Assignments.outcome.builtinBooleanWhether the assignment outcome is builtin or not.
Vectra.Entity.Assignments.outcome.user_selectableBooleanWhether the assignment outcome is user selectable or not.
Vectra.Entity.Assignments.outcome.titleStringTitle of the assignment outcome.
Vectra.Entity.Assignments.outcome.categoryStringCategory of the assignment outcome.
Vectra.Entity.Assignments.resolved_by.idNumberID of the user who resolved the entity.
Vectra.Entity.Assignments.resolved_by.usernameStringUsername of the user who resolved the entity.
Vectra.Entity.Assignments.triaged_detectionsArrayNumber of detections that have been triaged for the entity.
Vectra.Entity.Assignments.host_idNumberID of the host that the entity is associated with.
Vectra.Entity.Assignments.account_idNumberID of the account that the entity is associated with.
Vectra.Entity.Assignments.assigned_to.idNumberID of the user who is currently assigned to the entity.
Vectra.Entity.Assignments.assigned_to.usernameStringUsername of the user who is currently assigned to the entity.

Command Example#

!vectra-assignment-list

Context Example#

{
"Vectra": {
"Entity": {
"Assignments": [
{
"id": 214,
"assigned_by": {
"id": 64,
"username": "test.user4@example.com"
},
"date_assigned": "2023-08-18T10:55:29Z",
"events": [
{
"assignment_id": 214,
"actor": 64,
"event_type": "reassigned",
"datetime": "2023-08-18T10:56:11Z",
"context": {
"from": 39,
"to": 59,
"entity_t_score": 0,
"entity_c_score": 0
}
},
{
"assignment_id": 214,
"actor": 64,
"event_type": "created",
"datetime": "2023-08-18T10:55:29Z",
"context": {
"to": 39,
"entity_t_score": 0,
"entity_c_score": 0
}
}
],
"host_id": 220,
"assigned_to": {
"id": 59,
"username": "test.user2@example.com"
},
"assignment_id": 214
},
{
"id": 212,
"assigned_by": {
"id": 65,
"username": "test.user4@example.com"
},
"date_assigned": "2023-08-18T06:29:56Z",
"date_resolved": "2023-08-18T06:32:09Z",
"events": [
{
"assignment_id": 212,
"actor": 65,
"event_type": "resolved",
"datetime": "2023-08-18T06:32:09Z",
"context": {
"entity_t_score": 77,
"entity_c_score": 53
}
},
{
"assignment_id": 212,
"actor": 65,
"event_type": "reassigned",
"datetime": "2023-08-18T06:31:02Z",
"context": {
"from": 59,
"to": 60,
"entity_t_score": 77,
"entity_c_score": 53
}
},
{
"assignment_id": 212,
"actor": 65,
"event_type": "created",
"datetime": "2023-08-18T06:29:56Z",
"context": {
"to": 59,
"entity_t_score": 77,
"entity_c_score": 53
}
}
],
"outcome": {
"id": 1,
"builtin": true,
"user_selectable": true,
"title": "Benign True Positive",
"category": "benign_true_positive"
},
"resolved_by": {
"id": 65,
"username": "test.user4@example.com"
},
"account_id": 108,
"assigned_to": {
"id": 60,
"username": "test.user1@example.com"
},
"assignment_id": 212
}
]
}
}
}

Human Readable Output#

Assignments Table (Showing Page 1 out of 1)#

Account IDHost IDAssignment IDAssigned ByAssigned ToDate AssignedResolved ByDate ResolvedOutcome IDOutcome
220214test.user4@example.comtest.user2@example.com2023-08-18T10:55:29Z
108212test.user4@example.comtest.user1@example.com2023-08-18T06:29:56Ztest.user4@example.com2023-08-18T06:32:09Z1Benign True Positive

vectra-entity-note-list#

Returns a list of notes for a specified entity.

Base Command#

vectra-entity-note-list

Input#

Argument NameDescriptionRequired
entity_idSpecify the ID of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: host, account.Required

Context Output#

PathTypeDescription
Vectra.Entity.Notes.note_idNumberID of the note.
Vectra.Entity.Notes.idNumberID of the note.
Vectra.Entity.Notes.date_createdDateDate when the note was created.
Vectra.Entity.Notes.date_modifiedUnknownDate when the note was last modified.
Vectra.Entity.Notes.created_byStringUser who created the note.
Vectra.Entity.Notes.modified_byUnknownUser who last modified the note.
Vectra.Entity.Notes.noteStringContent of the note.
Vectra.Entity.Notes.entity_idStringID of the entity associated with the note.
Vectra.Entity.Notes.entity_typeStringType of the entity associated with the note.

Command Example#

!vectra-entity-note-list entity_id="107" entity_type="account"

Context Example#

{
"Vectra": {
"Entity": {
"Notes": [
{
"created_by": "test_user@example.com",
"date_created": "2023-08-25T07:09:08Z",
"entity_id": 107,
"entity_type": "account",
"id": 1070,
"modified_by": "test_user@example.com",
"note": "From XSOAR",
"note_id": 1070
},
{
"created_by": "test_user@example.com",
"date_created": "2023-08-25T07:08:58Z",
"entity_id": 107,
"entity_type": "account",
"id": 1069,
"modified_by": "test_user@example.com",
"note": "Test note",
"note_id": 1069
},
{
"created_by": "api_client",
"date_created": "2023-08-16T05:23:33Z",
"entity_id": 107,
"entity_type": "account",
"id": 922,
"note": "[Mirrored From XSOAR] XSOAR Incident ID: 14228\n\nNote: **bold**\n\n_Italic_\n\n+Underline+\n\n~~strikethrough~~\n\nAdded By: admin",
"note_id": 922
}
]
}
}
}

Human Readable Output#

Entity Notes Table#

Note IDNoteCreated ByCreated DateModified ByModified Date
1070From XSOARtest_user@example.com2023-08-25T07:09:08Ztest_user@example.com2023-08-25T08:10:08Z
1069Test notetest_user@example.com2023-08-25T07:08:58Ztest_user@example.com2023-08-25T08:10:08Z
922[Mirrored From XSOAR] XSOAR Incident ID: 14228
Note:XSOAR note
Added By: admin		api_client2023-08-16T05:23:33Z

vectra-group-list#

Returns a list of all groups.

Base Command#

vectra-group-list

Input#

Argument NameDescriptionRequired
group_typeFilter by group type. Possible values are: account, host, ip, domain.Optional
account_namesFilter by Account Names. Supports comma-separated values.

Note: Only valid when the group_type parameter is set to "account".		Optional
domainsFilter by Domains. Supports comma-separated values.

Note: Only valid when the group_type parameter is set to "domain".		Optional
host_idsFilter by Host IDs. Supports comma-separated values.

Note: Only valid when the group_type parameter is set to "host".		Optional
host_namesFilter by Host Names. Supports comma-separated values.

Note: Only valid when the group_type parameter is set to "host".		Optional
importanceFilter by group importance. Possible values are: high, medium, low, never_prioritize.Optional
ipsFilter by IPs. Supports comma-separated values.

Note: Only valid when the group_type parameter is set to "ip".		Optional
descriptionFilter by group description.Optional
last_modified_timestampReturn only the groups which have a last modification timestamp equal to or after the given timestamp.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z.		Optional
last_modified_byFilters by the user id who made the most recent modification to the group.Optional
group_nameFilters by group name.Optional

Context Output#

PathTypeDescription
Vectra.Group.group_idNumberID of the group.
Vectra.Group.idNumberID of the group.
Vectra.Group.nameStringName of the group.
Vectra.Group.descriptionStringDescription of the group.
Vectra.Group.last_modifiedDateDate when the group was last modified.
Vectra.Group.last_modified_byStringName of the user who last modified the group.
Vectra.Group.typeStringType of the group.
Vectra.Group.membersUnknownMembers of the group.
Vectra.Group.members.idNumberEntity ID of member.
Vectra.Group.members.nameStringEntity name of member.
Vectra.Group.members.is_key_assetBooleanIndicates key asset.
Vectra.Group.members.urlStringEntity URL of member.
Vectra.Group.members.uidStringEntity UID of member.
Vectra.Group.rules.triage_categoryStringTriage category of rule.
Vectra.Group.rules.idNumberId of the rule.
Vectra.Group.rules.descriptionStringDescription of the rule.
Vectra.Group.importanceStringImportance level of the group.
Vectra.Group.cognito_managedBooleanWhether the group is managed by Cognito or not.

Command Example#

!vectra-group-list

Context Example#

{
"Vectra": {
"Group": [
{
"id": 1,
"group_id": 1,
"name": "Cognito - Box",
"description": "Domains used by the Box service",
"last_modified": "2023-05-31T13:57:53Z",
"last_modified_by": "cognito",
"type": "domain",
"members": [
"*.abc.com",
"*.xyz.net"
],
"rules": [
{
"triage_category": "Box",
"id": 175,
"description": "data storage to Box service"
}
],
"importance": "medium",
"cognito_managed": true
},
{
"id": 8,
"group_id": 8,
"name": "Cognito - IPAM",
"description": "IPAM, created by Cognito",
"last_modified": "2023-08-18T09:16:54Z",
"last_modified_by": "cognito",
"type": "host",
"members": [
{
"is_key_asset": false,
"id": 97,
"name": "IP-0.0.0.0",
"url": "https://server_url.com/api/v3.3/hosts/97"
},
{
"is_key_asset": false,
"id": 212,
"name": "IP-0.0.0.1",
"url": "https://server_url.com/api/v3.3/hosts/212"
}
],
"rules": [
{
"triage_category": "Expected IPAM Behavior",
"id": 189,
"description": "Expected behavior from these devices"
},
{
"triage_category": "Expected IPAM Behavior",
"id": 193,
"description": "Expected behavior from these devices"
}
],
"importance": "medium"
},
{
"id": 16,
"group_id": 16,
"name": "Cognito - Guest Wifi",
"description": "IP space used by Guest Wifi",
"last_modified": "2023-08-18T08:55:54Z",
"last_modified_by": "cognito",
"type": "ip",
"members": [
"0.0.0.0",
"0.0.0.1"
],
"importance": "medium",
"cognito_managed": false
},
{
"id": 22,
"group_id": 22,
"name": "Dev-Group-Account-High",
"description": "",
"last_modified": "2023-08-25T10:17:37Z",
"last_modified_by": "cognito",
"type": "account",
"members": [
{
"uid": "O300:service-principal_00000000-0000-0000-0000-000000000001"
},
{
"uid": "administrator@fictotech.com"
}
],
"importance": "high"
}
]
}
}

Human Readable Output#

Groups Table#

Group IDNameGroup TypeDescriptionImportanceMembersLast Modified Timestamp
1Cognito - BoxdomainDomains used by the Box servicemedium*.abc.com, *.xyz.net2023-05-31T13:57:53Z
8Cognito - IPAMhostIPAM, created by Cognitomedium97, 2122023-08-18T09:16:54Z
16Cognito - Guest WifiipIP space used by Guest Wifimedium0.0.0.0, 0.0.0.12023-08-18T08:55:54Z
22Dev-Group-Account-HighaccounthighO300:service-principal_00000000-0000-0000-0000-000000000001, administrator@fictotech.com2023-08-25T10:17:37Z

vectra-group-unassign#

Unassign members from the specified group.

Base Command#

vectra-group-unassign

Input#

Argument NameDescriptionRequired
group_idSpecify Group ID to unassign members.Required
membersMember values based on the group type. Supports comma-separated values.

Note:
If the group type is host, then the "Host IDs".
If the group type is account, then "Account Names".
If the group type is ip, then the list of "IPs".
If the group type is domain, then the list of "Domains" .		Required

Context Output#

PathTypeDescription
Vectra.Group.group_idNumberID of the group.
Vectra.Group.idNumberID of the group.
Vectra.Group.nameStringName of the group.
Vectra.Group.descriptionStringDescription of the group.
Vectra.Group.last_modifiedDateDate when the group was last modified.
Vectra.Group.last_modified_byStringName of the user who last modified the group.
Vectra.Group.typeStringType of the group.
Vectra.Group.membersUnknownMembers of the group.
Vectra.Group.members.idNumberEntity ID of member.
Vectra.Group.members.nameStringEntity name of member.
Vectra.Group.members.is_key_assetBooleanIndicates key asset.
Vectra.Group.members.urlStringEntity URL of member.
Vectra.Group.members.uidStringEntity UID of member.
Vectra.Group.rules.triage_categoryStringTriage category of rule.
Vectra.Group.rules.idNumberId of the rule.
Vectra.Group.rules.descriptionStringDescription of the rule.

Command Example#

!vectra-group-unassign group_id=23 members="*.domain4.com,*.domain5.com"

Context Example#

{
"Vectra": {
"Group": {
"cognito_managed": false,
"description": "xsoar-group-account-test",
"group_id": 23,
"id": 23,
"last_modified": "2023-09-04T12:03:02Z",
"last_modified_by": "API Client a7f5be37",
"members": ["*.domain1.net", "*.domain2.com", "*.domain3.com"],
"name": "xsoar-group-account-test",
"type": "domain"
}
}
}

Human Readable Output#

Member(s) *.domain4.com, *.domain5.com have been unassigned from the group#

Updated group details#

Group IDNameGroup TypeDescriptionMembersLast Modified Timestamp
1xsoar-group-account-testdomainxsoar-group-account-test*.domain1.net, *.domain2.com, *.domain3.com2023-09-04T07:30:01Z

vectra-group-assign#

Assign members to the specified group.

Base Command#

vectra-group-assign

Input#

Argument NameDescriptionRequired
group_idSpecify Group ID to assign members.Required
membersMember values based on the group type. Supports comma-separated values.

Note:
If the group type is host, then the "Host IDs".
If the group type is account, then "Account Names".
If the group type is ip, then the list of "IPs".
If the group type is domain, then the list of "Domains" .		Required

Context Output#

PathTypeDescription
Vectra.Group.group_idNumberID of the group.
Vectra.Group.idNumberID of the group.
Vectra.Group.nameStringName of the group.
Vectra.Group.descriptionStringDescription of the group.
Vectra.Group.last_modifiedDateDate when the group was last modified.
Vectra.Group.last_modified_byStringName of the user who last modified the group.
Vectra.Group.typeStringType of the group.
Vectra.Group.membersUnknownMembers of the group.
Vectra.Group.members.idNumberEntity ID of member.
Vectra.Group.members.nameStringEntity name of member.
Vectra.Group.members.is_key_assetBooleanIndicates key asset.
Vectra.Group.members.urlStringEntity URL of member.
Vectra.Group.members.uidStringEntity UID of member.
Vectra.Group.rules.triage_categoryStringTriage category of rule.
Vectra.Group.rules.idNumberId of the rule.
Vectra.Group.rules.descriptionStringDescription of the rule.

Command Example#

!vectra-group-assign group_id=23 members="*.domain4.com,*.domain5.com"

Context Example#

{
"Vectra": {
"Group": {
"cognito_managed": false,
"description": "xsoar-group-account-test",
"group_id": 23,
"id": 23,
"last_modified": "2023-09-04T11:59:15Z",
"last_modified_by": "API Client a7f5be37",
"members": [
"*.domain1.net",
"*.domain2.com",
"*.domain3.com",
"*.domain4.com",
"*.domain5.com"
],
"name": "xsoar-group-account-test",
"type": "domain"
}
}
}

Human Readable Output#

Member(s) *.domain4.com, *.domain5.com have been assigned to the group#

Updated group details#

Group IDNameGroup TypeDescriptionMembersLast Modified Timestamp
1xsoar-group-account-testdomainxsoar-group-account-test*.domain1.net, *.domain2.com, *.domain3.com, *.domain4.com, *.domain5.com2023-09-04T06:30:01Z

vectra-entity-detections-mark-asclosed#

Mark the detections of the entity as closed with the provided entity ID in the argument.

Base Command#

vectra-entity-detections-mark-asclosed

Input#

Argument NameDescriptionRequired
entity_idSpecify the ID of the entity.Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
close_reasonSpecify the close reason. Possible values are: benign, remediated.Required

Context Output#

There is no context output for this command.

Command example#

!vectra-entity-detections-mark-asclosed entity_id=1 entity_type=account close_reason=benign

Human Readable Output#

The detections (34122, 35097) of the provided entity ID have been successfully closed as benign#

vectra-detections-mark-asopen#

Open detections with provided detection IDs in the argument.

Base Command#

vectra-detections-mark-asopen

Input#

Argument NameDescriptionRequired
detection_idsProvide a list of detection IDs separated by commas or a single detection ID.Required

Context Output#

There is no context output for this command.

Command example#

!vectra-detections-mark-asopen detection_ids=1,2,3

Human Readable Output#

The provided detection IDs have been successfully re-opened#

vectra-detection-tag-list#

Returns a list of tags for a specified detection.

Base Command#

vectra-detection-tag-list

Input#

Argument NameDescriptionRequired
detection_idSpecify the ID of the detection.Required

Context Output#

PathTypeDescription
Vectra.Detection.Tags.tag_idStringThe ID of the tag.
Vectra.Detection.Tags.detection_idStringThe ID of the Detection associated with the tag.
Vectra.Detection.Tags.tagsUnknownA list of tags linked to a detection.

Command example#

!vectra-detection-tag-list detection_id=123

Context Example#

{
"Vectra": {
"Detection": {
"Tags": {
"detection_id": 123,
"tag_id": "123",
"tags": [
"tag1",
"tag2"
]
}
}
}
}

Human Readable Output#

List of tags: tag1, tag2#

vectra-detection-tag-add#

Add tags to a detection.

Base Command#

vectra-detection-tag-add

Input#

Argument NameDescriptionRequired
detection_idSpecify the ID of the detection.Required
tagsComma-separated values of tags to be added to the detection.Required

Context Output#

PathTypeDescription
Vectra.Detection.Tags.tag_idStringThe ID of the tag.
Vectra.Detection.Tags.detection_idStringThe ID of the detection associated with the tag.
Vectra.Detection.Tags.tagsUnknownA list of tags linked to a detection.

Command example#

!vectra-detection-tag-add detection_id=1 tags="tag1,tag2"

Context Example#

{
"Vectra": {
"Detection": {
"Tags": {
"detection_id": 1,
"tag_id": 1,
"tags": [
"tag",
"tag1",
"tag2"
]
}
}
}
}

Human Readable Output#

Tags have been successfully added to the detection#

Updated list of tags: tag, tag1, tag2

vectra-detection-tag-remove#

Remove tags from the detection.

Base Command#

vectra-detection-tag-remove

Input#

Argument NameDescriptionRequired
detection_idSpecify the ID of the detection.Required
tagsComma-separated values of tags to be removed from the detection.Required

Context Output#

PathTypeDescription
Vectra.Detection.Tags.tag_idStringThe ID of the tag.
Vectra.Detection.Tags.detection_idStringThe ID of the detection associated with the tag.
Vectra.Detection.Tags.tagsUnknownA list of tags linked to a detection.

Command example#

!vectra-detection-tag-remove detection_id="2" tags="tag3,tag4"

Context Example#

{
"Vectra": {
"Detection": {
"Tags": {
"detection_id": 2,
"tag_id": "2",
"tags": [
"tag",
"tag1",
"tag2"
]
}
}
}
}

Human Readable Output#

Specified tags have been successfully removed for the detection#

Updated list of tags: tag, tag1, tag2

vectra-detection-note-list#

Returns a list of notes for a specified detection.

Base Command#

vectra-detection-note-list

Input#

Argument NameDescriptionRequired
detection_idSpecify the ID of the detection.Required

Context Output#

PathTypeDescription
Vectra.Detection.Notes.note_idNumberID of the note.
Vectra.Detection.Notes.idNumberID of the note.
Vectra.Detection.Notes.date_createdDateDate when the note was created (ISO8601).
Vectra.Detection.Notes.date_modifiedDateDate when the note was last modified (ISO8601).
Vectra.Detection.Notes.created_byStringUser who created the note.
Vectra.Detection.Notes.modified_byStringUser who last modified the note.
Vectra.Detection.Notes.noteStringContent of the note.
Vectra.Detection.Notes.detection_idStringID of the detection associated with the note.

Command example#

!vectra-detection-note-list detection_id=1

Context Example#

{
"Vectra": {
"Detection": {
"Notes": [
{
"created_by": "test_user@example.com",
"date_created": "2023-08-25T07:09:08Z",
"detection_id": 1,
"id": 1070,
"modified_by": "test_user@example.com",
"note": "From XSOAR",
"note_id": 1070
},
{
"created_by": "test_user@example.com",
"date_created": "2023-08-25T07:08:58Z",
"detection_id": 1,
"id": 1069,
"modified_by": "test_user@example.com",
"note": "Test note",
"note_id": 1069
},
{
"created_by": "api_client",
"date_created": "2023-08-16T05:23:33Z",
"detection_id": 1,
"id": 922,
"note": "[Mirrored From XSOAR] XSOAR Incident ID: 14228\n\nNote: **bold**\n\n_Italic_\n\n+Underline+\n\n~~strikethrough~~\n\nAdded By: admin",
"note_id": 922
}
]
}
}
}

Human Readable Output#

Detection Notes Table#

Note IDNoteCreated ByCreated DateModified ByModified Date
1070From XSOARtest_user@example.com2023-08-25T07:08:58Ztest_user@example.com2023-08-25T07:08:58Z
1069Test notetest_user@example.com2023-08-25T07:08:58Ztest_user@example.com2023-08-25T07:08:58Z
922[Mirrored From XSOAR] XSOAR Incident ID: 14228\n\nNote: bold\n\nItalic\n\n+Underline+\n\nstrikethrough\n\nAdded By: adminapi_client2023-08-16T05:23:33Z

vectra-detection-note-add#

Add a note to the detection.

Base Command#

vectra-detection-note-add

Input#

Argument NameDescriptionRequired
detection_idSpecify the ID of the detection.Required
noteNote to be added in the specified detection_id.Required

Context Output#

PathTypeDescription
Vectra.Detection.Notes.detection_idStringID of the detection associated with the note.
Vectra.Detection.Notes.note_idNumberID of the note.
Vectra.Detection.Notes.idNumberID of the note.
Vectra.Detection.Notes.date_createdDateDate when the note was created (ISO8601).
Vectra.Detection.Notes.created_byStringUser who created the note.
Vectra.Detection.Notes.noteStringContent of the note.

Command example#

!vectra-detection-note-add detection_id=1 note="test note"

Context Example#

{
{
"date_created": "2023-06-21T06:19:15.224449Z",
"created_by": "test_user",
"note": "test note",
"note_id": 19,
"id": 19,
"detection_id": 1
}
}

Human Readable Output#

The note has been successfully added to the detection#

Returned Note ID: 19

vectra-detection-note-update#

Update a note in the detection.

Base Command#

vectra-detection-note-update

Input#

Argument NameDescriptionRequired
detection_idSpecify the ID of the detection.Required
note_idSpecify the ID of the note.Required
noteNote to be updated for the specified note_id.Required

Context Output#

PathTypeDescription
Vectra.Detection.Notes.detection_idStringID of the detection associated with the note.
Vectra.Detection.Notes.note_idNumberID of the note.
Vectra.Detection.Notes.idNumberID of the note.
Vectra.Detection.Notes.date_createdDateDate when the note was created (ISO8601).
Vectra.Detection.Notes.date_modifiedDateDate when the note was last modified (ISO8601).
Vectra.Detection.Notes.created_byStringUser who created the note.
Vectra.Detection.Notes.modified_byStringUser who last modified the note.
Vectra.Detection.Notes.noteStringContent of the note.

Command example#

!vectra-detection-note-update detection_id=1 note_id=1 note="note modified"

Context Example#

{
{
"date_created": "2023-06-16T04:55:58Z",
"date_modified": "2023-06-22T04:57:09Z",
"created_by": "test_user",
"modified_by": "test_user",
"note": "note modified",
"note_id": 8,
"id": 8,
"detection_id": 1
}
}

Human Readable Output#

The note has been successfully updated in the detection#

vectra-detection-note-remove#

Remove a note from the detection.

Base Command#

vectra-detection-note-remove

Input#

Argument NameDescriptionRequired
detection_idSpecify the ID of the detection.Required
note_idSpecify the ID of the note.Required

Context Output#

There is no context output for this command.

Command Example#

!vectra-detection-note-remove detection_id=1 note_id=1

Context Example#

{}

Human Readable Output#

The note has been successfully removed from the detection#

vectra-entity-unresolved-priority-reset#

Update the unresolved priority of an entity to false.

Base Command#

vectra-entity-unresolved-priority-reset

Input#

Argument NameDescriptionRequired
entity_idSpecify the ID of the entity.

Note: Users can get the entity ID by executing the "vectra-entity-list" command.		Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required

Context Output#

PathTypeDescription
Vectra.Entity.idStringAn ID of the entity.
Vectra.Entity.typeStringThe type of the entity.
Vectra.Entity.unresolved_priorityBooleanAn entity unresolved priority status.

Command Example#

!vectra-entity-unresolved-priority-reset entity_id=1 entity_type=account

Context Example#

{
"Vectra": {
"Entity": [
{
"id": "1",
"type": "account",
"unresolved_priority": false
}
]
}
}

Human Readable Output#

The unresolved priority of the provided entity has been successfully changed as 'false'#

vectra-detection-investigation-status-update#

Update the investigation status of the detection by detection ID(s).

Base Command#

vectra-detection-investigation-status-update

Input#

Argument NameDescriptionRequired
detection_idsProvide a list of detection IDs separated by comma or a single detection ID.

Note: Users can get the detection ID by executing the "vectra-detection-list" command.		Required
investigation_statusSpecify the investigation status. Possible values are: open, acknowledged, escalated, paused, closed, expired.Required

Context Output#

PathTypeDescription
Vectra.Detection.idStringThe detection ID.
Vectra.Detection.investigation_statusStringThe detection investigation status.

Command Example#

!vectra-detection-investigation-status-update detection_ids=1 investigation_status=escalated

Context Example#

{
"Vectra": {
"Detection": [
{
"id": "1",
"investigation_status": "escalated"
}
]
}
}

Human Readable Output#

The investigation Status for provided Detection ID(s) ['1'] have been updated as escalated#

vectra-detection-external-id-update#

Update the external reference ID for the provided detection ID(s).

Base Command#

vectra-detection-external-id-update

Input#

Argument NameDescriptionRequired
detection_idsProvide a list of detection IDs separated by comma or a single detection ID.

Note: Users can get the detection ID by executing the "vectra-detection-list" command.		Required
external_reference_idProvide the external reference ID.Required

Context Output#

PathTypeDescription
Vectra.Detection.idStringThe detection ID.
Vectra.Detection.external_reference_idStringThe external reference ID of the detection.

Command Example#

!vectra-detection-external-id-update detection_ids=1 external_reference_id=12345

Context Example#

{
"Vectra": {
"Detection": [
{
"id": "1",
"external_reference_id": "12345"
}
]
}
}

Human Readable Output#

The external reference ID for provided Detection ID(s) ['1'] have been updated as 12345#

vectra-entity-external-id-update#

Update the external reference ID for the provided entity.

Base Command#

vectra-entity-external-id-update

Input#

Argument NameDescriptionRequired
entity_idSpecify the ID of the entity.

Note: Users can get the entity ID by executing the "vectra-entity-list" command.		Required
entity_typeSpecify the type of the entity. Possible values are: account, host.Required
external_reference_idProvide the external reference ID.Required

Context Output#

PathTypeDescription
Vectra.Entity.idStringAn ID of the entity.
Vectra.Entity.typeStringThe type of the entity.
Vectra.Entity.external_reference_idStringThe external reference ID of the entity.

Command Example#

!vectra-entity-external-id-update entity_id=1 entity_type=account external_reference_id=12345

Context Example#

{
"Vectra": {
"Entity": [
{
"id": "1",
"type": "account",
"external_reference_id": "12345"
}
]
}
}

Human Readable Output#

The external reference ID for provided Entity have been updated as 12345#

vectra-detection-list#

Returns a list of detections based on the specified filters.

Base Command#

vectra-detection-list

Input#

Argument NameDescriptionRequired
created_afterFilter the detections by created on or after the specified time.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 March 2026, 01 Mar 2026 04:45:33, 2026-04-17T14:05:44Z.		Optional
created_beforeFilter the detections by created on or before the specified time.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 March 2026, 01 Mar 2026 04:45:33, 2026-04-17T14:05:44Z.		Optional
last_detected_afterFilter the detections by last detected on or after the specified time.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 March 2026, 01 Mar 2026 04:45:33, 2026-04-17T14:05:44Z.		Optional
last_detected_beforeFilter the detections by last detected on or before the specified time.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 March 2026, 01 Mar 2026 04:45:33, 2026-04-17T14:05:44Z.		Optional
descriptionFilter by description containing specified value.Optional
detection_nameFilter by detection name.Optional
detection_typeFilter by detection type.Optional
detection_categoryFilter by detections category. Possible values are: Command & Control, Botnet, Reconnaissance, Lateral Movement, Exfiltration, Info.Optional
include_info_category_detectionsInclude the info category detections which are excluded by default. Possible values are: true, false. Default is true.Optional
close_reasonFilter by close reason of the detection. Possible values are: benign, remediated.Optional
detection_stateFilter by detection state. Possible values are: active, inactive, fixed.Optional
entity_typeFilter by Entity type. Possible values are: account, host.Optional
tagsFilter by detection tags. Comma-separated values supported.Optional
is_triagedFilter by detection triage status. Possible values are: true, false. Default is false.Optional
pageProvide page number to retrieve. Default is 1.Optional
page_sizeProvide a number of results per page. Default is 50.Optional

Context Output#

PathTypeDescription
Vectra.Detection.idNumberA unique identifier for the detection.
Vectra.Detection.assigned_dateDateThe date when the detection was assigned.
Vectra.Detection.assigned_toStringThe email or user to whom the detection is assigned.
Vectra.Detection.certaintyNumberThe certainty level associated with the detection.
Vectra.Detection.created_timestampDateThe timestamp when the detection was created.
Vectra.Detection.custom_detectionUnknownThe custom detection configuration or settings.
Vectra.Detection.data_source.typeStringThe type of data source for the detection.
Vectra.Detection.data_source.connection_nameStringThe name of the connection used for data ingestion.
Vectra.Detection.data_source.connection_idStringA unique identifier for the data source connection.
Vectra.Detection.descriptionStringThe description of the detection.
Vectra.Detection.detectionStringThe name of the detection.
Vectra.Detection.detection_categoryStringThe category of the detection.
Vectra.Detection.detection_typeStringThe type of the detection.
Vectra.Detection.detection_urlStringThe URL to access the detection details.
Vectra.Detection.filtered_by_aiBooleanIndicates if the detection was filtered by AI.
Vectra.Detection.filtered_by_ruleBooleanIndicates if the detection was filtered by a rule.
Vectra.Detection.filtered_by_userBooleanIndicates if the detection was filtered by a user.
Vectra.Detection.first_timestampDateThe first timestamp when the detection was observed.
Vectra.Detection.grouped_details.roleStringThe role associated with the detection group.
Vectra.Detection.grouped_details.last_timestampDateThe last timestamp of the detection group.
Vectra.Detection.groups.idNumberA unique identifier for the group.
Vectra.Detection.groups.nameStringThe name of the group.
Vectra.Detection.groups.descriptionStringThe description of the group.
Vectra.Detection.groups.typeStringThe type of the group.
Vectra.Detection.groups.last_modifiedDateThe timestamp when the group was last modified.
Vectra.Detection.groups.last_modified_byStringThe email or user who last modified the group.
Vectra.Detection.is_custom_modelBooleanIndicates if the detection uses a custom model.
Vectra.Detection.is_marked_customBooleanIndicates if the detection is marked as custom.
Vectra.Detection.is_triagedBooleanIndicates if the detection has been triaged.
Vectra.Detection.last_timestampDateThe last timestamp when the detection was observed.
Vectra.Detection.noteStringA note associated with the detection.
Vectra.Detection.note_modified_byStringThe email or user who modified the note.
Vectra.Detection.note_modified_timestampDateThe timestamp when the note was last modified.
Vectra.Detection.notes.created_byStringThe email or user who created the note.
Vectra.Detection.notes.date_createdDateThe date when the note was created.
Vectra.Detection.notes.date_modifiedDateThe date when the note was modified.
Vectra.Detection.notes.idNumberA unique identifier for the note.
Vectra.Detection.notes.modified_byStringThe email or user who modified the note.
Vectra.Detection.notes.noteStringThe content of the note.
Vectra.Detection.reasonStringThe reason for the detection state or triage action.
Vectra.Detection.sensorStringThe sensor identifier that detected the activity.
Vectra.Detection.sensor_nameStringThe name of the sensor that detected the activity.
Vectra.Detection.src_account.idNumberA unique identifier for the source account.
Vectra.Detection.src_account.nameStringThe name of the source account.
Vectra.Detection.src_account.urlStringThe URL to access the source account details.
Vectra.Detection.src_account.threatNumberThe threat level associated with the source account.
Vectra.Detection.src_account.certaintyNumberThe certainty level associated with the source account.
Vectra.Detection.src_account.privilege_levelNumberThe privilege level associated with the source account.
Vectra.Detection.src_account.privilege_categoryStringThe privilege category associated with the source account.
Vectra.Detection.src_host.idNumberA unique identifier for the source host.
Vectra.Detection.src_host.nameStringThe name of the source host.
Vectra.Detection.src_host.ipStringThe IP address of the source host.
Vectra.Detection.src_host.urlStringThe URL to access the source host details.
Vectra.Detection.src_host.is_key_assetBooleanIndicates if the source host is a key asset.
Vectra.Detection.src_host.group.idNumberA unique identifier for the source host group.
Vectra.Detection.src_host.group.nameStringThe name of the source host group.
Vectra.Detection.src_host.group.descriptionStringThe description of the source host group.
Vectra.Detection.src_host.group.typeStringThe type of the source host group.
Vectra.Detection.src_host.group.last_modifiedDateThe timestamp when the source host group was last modified.
Vectra.Detection.src_host.group.last_modified_byStringThe email or user who last modified the source host group.
Vectra.Detection.src_host.threatNumberThe threat level associated with the source host.
Vectra.Detection.src_host.certaintyNumberThe certainty level associated with the source host.
Vectra.Detection.src_ipStringThe source IP address in the detection.
Vectra.Detection.src_groups.idNumberA unique identifier for the source group.
Vectra.Detection.src_groups.nameStringThe name of the source group.
Vectra.Detection.src_groups.descriptionStringThe description of the source group.
Vectra.Detection.src_groups.typeStringThe type of the source group.
Vectra.Detection.src_groups.last_modifiedDateThe timestamp when the source group was last modified.
Vectra.Detection.src_groups.last_modified_byStringThe email or user who last modified the source group.
Vectra.Detection.dst_groups.idNumberA unique identifier for the destination group.
Vectra.Detection.dst_groups.nameStringThe name of the destination group.
Vectra.Detection.dst_groups.descriptionStringThe description of the destination group.
Vectra.Detection.dst_groups.typeStringThe type of the destination group.
Vectra.Detection.dst_groups.last_modifiedDateThe timestamp when the destination group was last modified.
Vectra.Detection.dst_groups.last_modified_byStringThe email or user who last modified the destination group.
Vectra.Detection.stateStringThe current state of the detection.
Vectra.Detection.summary.artifactArrayThe artifacts associated with the detection summary.
Vectra.Detection.summary.last_timestampDateThe last timestamp in the detection summary.
Vectra.Detection.summary.descriptionStringThe description in the detection summary.
Vectra.Detection.summary.rolesArrayThe roles associated with the detection summary.
Vectra.Detection.tagsArrayThe tags associated with the detection.
Vectra.Detection.is_targeting_key_assetBooleanIndicates if the detection is targeting a key asset.
Vectra.Detection.threatNumberThe threat level of the detection.
Vectra.Detection.triage_rule_idUnknownA unique identifier for the triage rule applied to the detection.
Vectra.Detection.typeStringThe type of the detection.
Vectra.Detection.urlStringThe URL to access the detection details.

Command Example#

!vectra-detection-list page=1 page_size=2

Context Example#

{
"Vectra": {
"Detection": [
{
"summary": {
"app_name": "Exchange",
"operations": [
"Add-MailboxPermission"
],
"src_ips": [
"10.0.0.1"
],
"description": "This account performed Exchange operations that were unusual for the account."
},
"src_account": {
"id": 1001,
"name": "user@example.com",
"url": "https://example.vectra.ai/api/v3.5/accounts/1001",
"threat": 45,
"certainty": 60
},
"state": "active",
"created_timestamp": "2026-01-15T10:30:00Z",
"filtered_by_user": false,
"type": "account",
"detection_type": "M365 Risky Exchange Operation",
"data_source": {
"type": "o365",
"connection_name": "M365-Production",
"connection_id": "abc123"
},
"filtered_by_rule": false,
"detection": "M365 Risky Exchange Operation",
"url": "https://example.vectra.ai/api/v3.5/detections/5001",
"sensor": "abc123",
"threat": 50,
"is_custom_model": false,
"is_triaged": false,
"detection_category": "lateral_movement",
"filtered_by_ai": false,
"detection_url": "https://example.vectra.ai/api/v3.5/detections/5001",
"last_timestamp": "2026-01-15T12:00:00Z",
"first_timestamp": "2026-01-15T10:00:00Z",
"certainty": 50,
"is_marked_custom": false,
"id": 5001,
"sensor_name": "Vectra NDR",
"is_targeting_key_asset": false,
"grouped_details": [
{
"parameters": [
{
"data": [
{
"name": "Identity",
"value": "mailbox@example.com"
}
],
"timestamp": "2026-01-15T11:30:00Z"
}
],
"operation": "Add-MailboxPermission",
"behavior": "Mailbox management",
"user_type": "Admin",
"last_timestamp": "2026-01-15T12:00:00Z",
"src_ip": "10.0.0.1",
"app_name": "Exchange"
}
]
},
{
"state": "active",
"created_timestamp": "2026-01-15T09:00:00Z",
"filtered_by_user": false,
"type": "host",
"detection_type": "Suspicious Domain",
"groups": [
{
"id": 10,
"name": "Production Servers",
"description": "Production server subnet",
"type": "ip",
"last_modified": "2026-01-10T08:00:00Z",
"last_modified_by": "admin@example.com"
}
],
"data_source": {
"type": "sensor",
"connection_name": "Network Sensor 1",
"connection_id": "xyz789"
},
"filtered_by_rule": false,
"detection": "Suspicious Domain",
"url": "https://example.vectra.ai/api/v3.5/detections/5002",
"sensor": "xyz789",
"threat": 30,
"is_custom_model": false,
"is_triaged": false,
"detection_category": "command_and_control",
"filtered_by_ai": false,
"detection_url": "https://example.vectra.ai/api/v3.5/detections/5002",
"src_ip": "10.0.1.50",
"last_timestamp": "2026-01-15T09:45:00Z",
"first_timestamp": "2026-01-15T09:00:00Z",
"src_host": {
"id": 2001,
"ip": "10.0.1.50",
"name": "workstation-01",
"url": "https://example.vectra.ai/api/v3.5/hosts/2001",
"is_key_asset": false,
"groups": [
{
"id": 10,
"name": "Production Servers",
"description": "Production server subnet",
"last_modified": "2026-01-10T08:00:00Z",
"last_modified_by": "admin@example.com",
"type": "ip"
}
],
"threat": 35,
"certainty": 40
},
"certainty": 25,
"is_marked_custom": false,
"id": 5002,
"sensor_name": "Network Sensor 1",
"is_targeting_key_asset": false,
"grouped_details": [
{
"protocol": "dns",
"last_timestamp": "2026-01-15T09:45:00Z",
"grouping_field": "last_timestamp",
"response_code": "NXDomain",
"target_domains": [
"suspicious-domain.example"
],
"dst_ips": [
"8.8.8.8"
]
}
],
"summary": {
"num_failures": 5,
"num_successes": 0,
"num_sessions": 10
}
}
]
}
}

Human Readable Output#

Detections Table (Showing Page 1 out of 100)#

IDDetection NameDetection TypeAccount NameHost NameSrc IPThreat ScoreCertainty ScoreNumber Of EventsStateLast Timestamp
5001M365 Risky Exchange OperationM365 Risky Exchange Operationuser@example.com50500active2026-01-15T12:00:00Z
5002Suspicious DomainSuspicious Domainworkstation-0110.0.1.5030250active2026-01-15T09:45:00Z

vectra-investigation-query-send#

Submit an investigation query and receive a request ID for retrieving results.

Base Command#

vectra-investigation-query-send

Input#

Argument NameDescriptionRequired
queryProvide an investigation query in the supported query language.Required
versionSpecify the version of the query language.Optional

Context Output#

PathTypeDescription
Vectra.Investigation.request_idStringThe unique identifier for the query request. Use this to retrieve results.
Vectra.Investigation.searchable_range.searchable_days_allowedNumberA Maximum number of days of data that can be searched.

Command Example#

!vectra-investigation-query-send query="SELECT * FROM detections" version=v1

Context Example#

{
"Vectra": {
"Investigation": {
"request_id": "b57d7a27-28ad-4c0c-b28a-0e7b3",
"searchable_range": {
"searchable_days_allowed": 14
}
}
}
}

Human Readable Output#

The Vectra investigation has started. You can view the results by executing the below command#

!vectra-investigation-result-get id=b57d7a27-28ad-4c0c-b28a-0e7b3

vectra-investigation-result-get#

Retrieve the results of a previously submitted investigation query using the request ID.

Base Command#

vectra-investigation-result-get

Input#

Argument NameDescriptionRequired
idProvide the unique request ID of investigation.Required
pageProvide page number to retrieve. Default is 1.Optional
page_sizeProvide a number of results per page to retrieve. Default is 50.Optional

Context Output#

PathTypeDescription
Vectra.Investigation.request_idStringThe unique identifier for the query request.
Vectra.Investigation.dataUnknownAn array of query results.
Vectra.Investigation.meta.query_statusStringThe status of the query.
Vectra.Investigation.meta.num_rows_availableNumberTotal rows returned by the query.
Vectra.Investigation.meta.pageNumberThe current page number.
Vectra.Investigation.meta.page_sizeNumberThe rows returned on this page.
Vectra.Investigation.meta.estimated_file_size_bytesNumberThe estimated size of the full result set in bytes.
Vectra.Investigation.meta.columnsUnknownAn array of tuples describing the result schema.

Command Example#

!vectra-investigation-result-get id=b57d7a27-28ad-4c0c-b28a-0e7b3

Context Example#

{
"Vectra": {
"Investigation": {
"request_id": "b57d7a27-28ad-4c0c-b28a-0e7b3",
"meta": {
"page": 1,
"page_size": 50,
"estimated_file_size_bytes": 0,
"num_rows_available": 0,
"query_status": "SUCCESS",
"columns": [
[
"timestamp",
[
{
"type": "timestamp"
},
""
]
],
[
"orig_h",
[
{
"type": "string"
},
""
]
],
[
"resp_h",
[
{
"type": "string"
},
""
]
],
[
"resp_p",
[
{
"type": "number"
},
""
]
]
]
}
}
}
}

Human Readable Output#

Investigation Result for Request ID: b57d7a27-28ad-4c0c-b28a-0e7b3#

Query StatusPage NumberPage sizeTotal RowsFile Size (bytes)Columns
SUCCESS15000- values: timestamp, [{'type': 'timestamp'}, '']
- values: orig_h, [{'type': 'string'}, '']
- values: resp_h, [{'type': 'string'}, '']
- values: resp_p, [{'type': 'number'}, '']

Investigation Results Data#

No entries.

Edit this page
Report an Issue