Alert Logic
Alert Logic MDR provides single pane-of-glass visibility across public cloud, hybrid, and on-premises environments, providing vital insights on your security posture, and detecting and responding to threats to your business.
Prerequisites
To authenticate this connector, you need one of the following:
- Username and Password
- Access Key ID and Secret Key
Capabilities
This connector provides the following capabilities:
- Add Incident Feedback
- Close Incident
- Get Incident History
- Get Incident ID by Friendly ID
- Get Incident
- Get Incident by Time
- Get Logs/Events for Incident
- Reopen Incident
Notes
Additional Documentation
Configurations
Alert Logic Authentication
Authenticates using username/access_key_id and password/secret_key.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | Username or Access Key ID | string | Required |
password | Password or Secret Key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Add Incident Feedback
Update incident feedback for an incident.
Endpoint
- URL: /iris/v3/{{accountId}}/{{incidentId}}/feedback
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.accountId | string | Optional | Parameters for the Add Incident Feedback action |
path_parameters.incidentId | string | Required | Parameters for the Add Incident Feedback action |
customer_feedback | string | Optional | Parameter for Add Incident Feedback |
customer_feedback_reason | string | Optional | Reason for feedback. Allowed values: further_action, acceptable_risk, compensating_control, threat_not_valid, not_concluded, other |
Input Example
{"json_body":{"customer_feedback":"My feedback","customer_feedback_reason":"further_action"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
feedback | string | Output field: feedback |
feedback_datetime | string | Time value |
feedback_reason | string | Response reason phrase |
feedback_uid | string | Unique identifier |
feedback_user | string | Output field: feedback_user |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"feedback":"My feedback","feedback_datetime":"2020-05-25T19:21:04.854130+00:00","feedback_reason":"further_action","feedback_uid":"FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF","feedback_user":"User Name <[email protected]>"}}
Close Incident
Close an incident.
Endpoint
- URL: /iris/v3/{{accountId}}/{{incidentId}}/complete
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.accountId | string | Optional | Parameters for the Close Incident action |
path_parameters.incidentId | string | Required | Parameters for the Close Incident action |
notes | string | Optional | Parameter for Close Incident |
reason_code | string | Optional | Reason for completion. Allowed values: further_action, acceptable_risk, compensating_control, threat_not_valid, not_concluded, other |
Input Example
{"path_parameters":{"accountId":"string","incidentId":"string"},"notes":"string","reason_code":"string"}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
new | object | Output field: new |
new.notes | string | Output field: new.notes |
new.reason_code | string | Response reason phrase |
new.status | string | Status value |
new.status_change_time | string | Status value |
old | object | Output field: old |
old.status | string | Status value |
old.status_change_time | string | Status value |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"new":{"notes":"This incident is closed because of y","reason_code":"further_action","status":"completed","status_change_time":"2020-05-22T11:09:56.855569+00:00"},"old":{"status":"open","status_change_time":"2020-05-22T07:54:33.555371+00:00"}}}
Get Incident
Fetch a specific incident by its incident ID.
Endpoint
- URL: /iris/v3/{{accountId}}/{{incidentId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.accountId | string | Optional | Parameters for the Get Incident action |
path_parameters.incidentId | string | Required | Parameters for the Get Incident action |
parameters.return_value | string | Optional | Comma delimited list of "dot-notation" string names of desired properties in the result set. Use if you only want a subset of attributes from the incident. |
Input Example
{"path_parameters":{"accountId":"string","incidentId":"string"},"parameters":{"return_value":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}
Get Incident History
Fetch history for an specific incident by its incident ID.
Endpoint
- URL: /iris/v3/{{accountId}}/{{incidentId}}/history
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.accountId | string | Optional | Parameters for the Get Incident History action |
path_parameters.incidentId | string | Required | Parameters for the Get Incident History action |
Input Example
{"path_parameters":{"accountId":"string","incidentId":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":[{"details":{},"historyType":2012,"message":"Incident Created","time":1527253566.384131,"time_str":"2018-05-25T13:06:06.384131+00:00","who":"System"}]}
Get Incident ID by Friendly ID
Fetch a specific incident by its friendly ID.
Endpoint
- URL: /iris/v3/{{accountId}}/friendly/{{friendlyId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.accountId | string | Optional | Parameters for the Get Incident ID by Friendly ID action |
path_parameters.friendlyId | string | Required | Parameters for the Get Incident ID by Friendly ID action |
Input Example
{"path_parameters":{"accountId":"string","friendlyId":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":[{"incidentId":"610DE0F9-0001-0020-0002-B58A00000000","humanFriendlyId":"aecbf","accountId":1234}]}
Get Incidents by Time
Fetch incidents last updated within a time span for the specified account.
Endpoint
- URL: /iris/v3/{{accountId}}/incidents_by_time
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.accountId | string | Optional | Parameters for the Get Incidents by Time action |
parameters.return_value | string | Optional | Parameters for the Get Incidents by Time action |
parameters.start_time | string | Optional | Parameters for the Get Incidents by Time action |
parameters.end_time | string | Optional | Parameters for the Get Incidents by Time action |
parameters.pagination | boolean | Optional | Parameters for the Get Incidents by Time action |
parameters.limit | number | Optional | Parameters for the Get Incidents by Time action |
parameters.offset | number | Optional | Parameters for the Get Incidents by Time action |
Input Example
{"parameters":{"return_value":"string","start_time":"string","end_time":"string","pagination":false,"limit":10,"offset":5},"path_parameters":{"accountId":"1234"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}
Get Logs/Events for Incident
Get associated logs/events for a incident.
Endpoint
- URL: /iris/v3/{{accountId}}/{{incidentId}}/elaborations/associated
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.accountId | string | Optional | Parameters for the Get Logs/Events for Incident action |
path_parameters.incidentId | string | Required | Parameters for the Get Logs/Events for Incident action |
parameters.returnSource | string | Optional | Parameters for the Get Logs/Events for Incident action |
parameters.return_value | string | Optional | Comma delimited list of "dot-notation" string names of desired properties in the result set. Use if you only want a subset of attributes from the incident. |
parameters.limit | number | Optional | Maximum number of items in the result set. |
parameters.offset | number | Optional | The (zero-based) offset of the first item in the result set to return. |
Input Example
{"path_parameters":{"accountId":"string","incidentId":"string"},"parameters":{"returnSource":"string","return_value":"string","limit":123,"offset":123}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}
Reopen Incident
Reopen an incident.
Endpoint
- URL: /iris/v3/{{accountId}}/{{incidentId}}/reopen
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.accountId | string | Optional | Parameters for the Reopen Incident action |
path_parameters.incidentId | string | Required | Parameters for the Reopen Incident action |
notes | string | Optional | Parameter for Reopen Incident |
Input Example
{"path_parameters":{"accountId":"string","incidentId":"string"},"notes":"string"}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
new | object | Output field: new |
new.notes | string | Output field: new.notes |
new.reason_code | string | Response reason phrase |
new.status | string | Status value |
new.status_change_time | string | Status value |
old | object | Output field: old |
old.status | string | Status value |
old.status_change_time | string | Status value |
old.reason_code | string | Response reason phrase |
old.notes | string | Output field: old.notes |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"new":{"notes":"Reopened because of y","reason_code":"other","status":"open","status_change_time":"2020-05-22T11:09:56.855569+00:00"},"old":{"status":"completed","status_change_time":"2020-05-22T07:54:33.555371+00:00","reason_code":"further_action","notes":"closed because of x"}}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |