Arcanna AI
Arcanna AI is an AI-driven platform that automates the analysis and management of security events.
Arcanna AI is an advanced AI-driven platform designed to enhance security operations by providing insightful event analysis and feedback mechanisms. This connector allows Swimlane Turbine users to seamlessly integrate with Arcanna AI, enabling automated retrieval and management of events and jobs, as well as the ability to send events and feedback for improved threat detection and response. By leveraging Arcanna AI's capabilities, users can enhance their security workflows, reduce manual intervention, and improve the accuracy of threat analysis within the Swimlane Turbine ecosystem.
This is a connector for Arcanna.ai. Arcanna.ai is an AI-Assisted Cybersecurity by bringing all the required data into a single place where it can be processed and analyzed in order to automate decision and post-decision tasks across the growing IT infrastructure.
Prerequisites
Before you can use the Arcanna AI connector for Turbine, you'll need access to the Arcanna AI API. This requires the following:
- an API key authentication using the following parameters:
- URL: The endpoint URL for accessing Arcanna AI services.
- API Key: A unique key provided by Arcanna AI for authenticating API requests.
Capabilities
This connector provides the following capabilities:
- Get Event Export
- Get Event Status
- Get Jobs List
- Send Bulk Events
- Send Event
- Send Event Feedback
Additional Documentation
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
x-arcanna-api-key | API key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Event Export
Retrieve an event from Arcanna AI in its raw format using job_id and event_id as path parameters.
Endpoint
- URL: /api/v1/events/{{job_id}}/{{event_id}}/export
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.job_id | number | Required | Parameters for the Get Event Export action |
path_parameters.event_id | number | Required | Parameters for the Get Event Export action |
Input Example
{"path_parameters":{"job_id":123,"event_id":15427818711674}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
event_id | string | Unique identifier |
ingest_timestamp | string | Output field: ingest_timestamp |
status | string | Status value |
arcanna_event | object | Output field: arcanna_event |
arcanna_event.example_field | string | Output field: arcanna_event.example_field |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"event_id":"15427818711674","ingest_timestamp":"2024-02-15T11:50:13.781871Z","status":"OK","arcanna_event":{"example_field":"example_value"}}}
Get Event Status
Retrieve the status of an event in Arcanna AI using job_id and event_id as path parameters.
Endpoint
- URL: api/v1/events/{{job_id}}/{{event_id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.job_id | number | Required | Parameters for the Get Event Status action |
path_parameters.event_id | string | Required | Parameters for the Get Event Status action |
Input Example
{"path_parameters":{"job_id":1201,"event_id":"12011938471583"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
event_id | string | Unique identifier |
ingest_timestamp | string | Output field: ingest_timestamp |
status | string | Status value |
confidence_level | number | Unique identifier |
result | string | Result of the operation |
is_duplicated | boolean | Output field: is_duplicated |
error_message | string | Response message |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"event_id":"string","ingest_timestamp":"string","status":"string","confidence_level":0,"result":"string","is_duplicated":true,"error_message":"string"}}
Get Jobs List
Retrieve a list of jobs from Arcanna AI for monitoring and management purposes.
Endpoint
- URL: api/v1/jobs
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"job_id":0,"data_type":"string","title":"string","status":"string","labels":[],"features":[]}]}
Send Bulk Events
Send a bulk of events to Arcanna AI as a JSON string with XSOAR fields. Requires job_id as a path parameter and events in the JSON body.
Endpoint
- URL: api/v1/bulk/{{job_id}}
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.job_id | number | Required | Parameters for the Send Bulk Events action |
counts | number | Optional | Parameter for Send Bulk Events |
events | array | Optional | Parameter for Send Bulk Events |
events.job_id | number | Optional | Unique identifier |
events.severity | number | Optional | Parameter for Send Bulk Events |
events.name | string | Optional | Name of the resource |
events.destination | object | Optional | Parameter for Send Bulk Events |
events.destination.address | string | Optional | Parameter for Send Bulk Events |
events.destination.port | number | Optional | Parameter for Send Bulk Events |
events.destination.bytes | number | Optional | Parameter for Send Bulk Events |
events.destination.ip | string | Optional | Parameter for Send Bulk Events |
events.destination.packets | number | Optional | Parameter for Send Bulk Events |
events.rule | object | Optional | Parameter for Send Bulk Events |
events.rule.name | string | Optional | Name of the resource |
events.rule.id | string | Optional | Unique identifier |
events.rule.category | string | Optional | Parameter for Send Bulk Events |
events.source | object | Optional | Parameter for Send Bulk Events |
events.source.address | string | Optional | Parameter for Send Bulk Events |
events.source.port | number | Optional | Parameter for Send Bulk Events |
events.source.bytes | number | Optional | Parameter for Send Bulk Events |
events.source.ip | string | Optional | Parameter for Send Bulk Events |
events.source.packets | number | Optional | Parameter for Send Bulk Events |
events.event | object | Optional | Parameter for Send Bulk Events |
events.event.severity | number | Optional | Parameter for Send Bulk Events |
events.event.ingested | string | Optional | Parameter for Send Bulk Events |
Input Example
{"json_body":{"counts":10,"events":[{"job_id":1202,"severity":3,"name":"test_alert","destination":{"address":"10.128.0.6","port":53720,"bytes":836035,"ip":"10.128.0.6","packets":6459},"rule":{"name":"SURICATA HTTP unable to match response to request","id":"2221010","category":"Generic Protocol Command Decode"},"source":{"address":"8.8.8.8","port":9200,"bytes":4833843,"ip":"8.8.8.8","packets":9677},"event":{"severity":3,"ingested":"2021-06-15T07:56:50.654225827Z","created":"2021-06-15T07:56:49.649Z","kind":"alert","module":"suricata","start":"2021-06-14T14:02:06.280Z","category":["network","intrusion_detection"],"type":["allowed"],"dataset":"suricata.eve"},"fileset":{"name":"eve"},"message":"Generic Protocol Command Decode","url":{"path":"libhtp::request_uri_not_seen","original":"libhtp::request_uri_not_seen"},"@timestamp":"2021-06-15T07:56:49.647Z","suricata":{"eve":{"in_iface":"ens4","metadata":{"flowints":{"http.anomaly.count":2419}},"event_type":"alert","alert":{"signature_id":2221010,"rev":1,"gid":1,"signature":"SURICATA HTTP unable to match response to request","category":"Generic Protocol Command Decode"},"flow_id":576330410117303,"tx_id":3224,"flow":{}}},"closingReason":"Resolved","closing_notes":"some analyst note"}]},"path_parameters":{"job_id":1219}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | string | Status value |
error_message | string | Response message |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"string","error_message":"string"}}
Send Event
Send a raw event to Arcanna AI using job_id, raw_body, and title as inputs.
Endpoint
- URL: api/v1/events/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
job_id | number | Optional | Unique identifier |
raw_body | object | Optional | Request body data |
raw_body.destination | object | Optional | Request body data |
raw_body.destination.address | string | Optional | Request body data |
raw_body.destination.port | number | Optional | Request body data |
raw_body.destination.bytes | number | Optional | Request body data |
raw_body.destination.ip | string | Optional | Request body data |
raw_body.destination.packets | number | Optional | Request body data |
raw_body.rule | object | Optional | Request body data |
raw_body.rule.name | string | Optional | Request body data |
raw_body.rule.id | string | Optional | Request body data |
raw_body.rule.category | string | Optional | Request body data |
raw_body.source | object | Optional | Request body data |
raw_body.source.address | string | Optional | Request body data |
raw_body.source.port | number | Optional | Request body data |
raw_body.source.bytes | number | Optional | Request body data |
raw_body.source.ip | string | Optional | Request body data |
raw_body.source.packets | number | Optional | Request body data |
raw_body.event | object | Optional | Request body data |
raw_body.event.severity | number | Optional | Request body data |
raw_body.event.ingested | string | Optional | Request body data |
raw_body.event.created | string | Optional | Request body data |
raw_body.event.kind | string | Optional | Request body data |
raw_body.event.module | string | Optional | Request body data |
raw_body.event.start | string | Optional | Request body data |
Input Example
{"json_body":{"job_id":1219,"raw_body":{"destination":{"address":"10.128.0.6","port":53720,"bytes":836035,"ip":"10.128.0.6","packets":6459},"rule":{"name":"SURICATA HTTP unable to match response to request","id":"2221010","category":"Generic Protocol Command Decode"},"source":{"address":"8.8.8.8","port":9200,"bytes":4833843,"ip":"8.8.8.8","packets":9677},"event":{"severity":3,"ingested":"2021-06-15T07:56:50.654225827Z","created":"2021-06-15T07:56:49.649Z","kind":"alert","module":"suricata","start":"2021-06-14T14:02:06.280Z","category":["network","intrusion_detection"],"type":["allowed"],"dataset":"suricata.eve"},"fileset":{"name":"eve"},"message":"Generic Protocol Command Decode","url":{"path":"/libhtp::request_uri_not_seen","original":"/libhtp::request_uri_not_seen"},"@timestamp":"2021-06-15T07:56:49.647Z","suricata":{"eve":{"in_iface":"ens4","metadata":{"flowints":{"http.anomaly.count":2419}},"event_type":"alert","alert":{"signature_id":2221010,"rev":1,"gid":1,"signature":"SURICATA HTTP unable to match response to request","category":"Generic Protocol Command Decode"},"flow_id":576330410117303,"tx_id":3224,"flow":{}}}},"title":"sample_event","severity":3}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
event_id | string | Unique identifier |
job_id | number | Unique identifier |
ingest_timestamp | string | Output field: ingest_timestamp |
status | string | Status value |
error_message | string | Response message |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"event_id":"string","job_id":0,"ingest_timestamp":"string","status":"string","error_message":"string"}}
Send Event Feedback
Send feedback for a previously inferred event in Arcanna AI to improve future event analysis. Requires job_id and event_id as path parameters.
Endpoint
- URL: api/v1/events/{{job_id}}/{{event_id}}/feedback
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.job_id | string | Required | Parameters for the Send Event Feedback action |
path_parameters.event_id | string | Required | Parameters for the Send Event Feedback action |
cortex_user | string | Optional | Parameter for Send Event Feedback |
feedback | string | Optional | Parameter for Send Event Feedback |
closing_notes | string | Optional | Parameter for Send Event Feedback |
indicators | array | Optional | Parameter for Send Event Feedback |
indicators.type | string | Optional | Type of the resource |
indicators.value | string | Optional | Value for the parameter |
indicators.source | string | Optional | Parameter for Send Event Feedback |
Input Example
{"json_body":{"cortex_user":"string","feedback":"string","closing_notes":"string","indicators":[{"type":"string","value":"string","source":"string"}]},"path_parameters":{"job_id":"string","event_id":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | string | Status value |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"string"}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |