Natrix

Natrix is a security platform that enhances threat detection and response through advanced alert management and analytics.

Natrix is a comprehensive security platform designed to manage and analyze alerts effectively. This connector allows Swimlane Turbine users to seamlessly assign alerts to analysts and update alert statuses within Natrix. By integrating Natrix with Swimlane Turbine, security teams can automate alert management processes, ensuring timely responses and efficient workflow management. This integration enhances the capabilities of security operations by providing streamlined alert handling and status updates, reducing manual intervention and improving response times.

Prerequisites

Before you can use the Natrix connector for Turbine, you'll need access to the Natrix API. This requires the following:

OAuth 2.0 Resource Owner Password Credentials authentication using the following parameters:

URL: The endpoint for accessing the Natrix API.

Client ID: The identifier for your application registered with Keycloak.

Username: The username for authenticating against the Natrix API.

Password: The password associated with the username for authentication.

Client Secret: A secret key used in conjunction with the client ID for secure authentication.

Capabilities

This Connector provides the following capabilities:

Capabilities

Here

e.g. Manage Firewall Policies instead of listing each individual tasks

Limitations

Include information about known limitations here, including supported or minimum versions, especially known unsupported versions.

Asset Setup

The content here should discuss asset setup in a conversational manner. Be sure to include any known login and test connection errors.

Tasks Setup

Special task setup as needed depending on plugin, exclude if empty.

Known available allowed input options from enum type selection

Notes

Any other notes not fitting other sections go here.

Any reference URLs to external docs or other resources

Configurations

Natrix Password Credentials

Authenticates using OAuth 2.0 Resource Owner Password Credentials grant against Keycloak.

Configuration Parameters

Parameter	Description	Type	Required
url	Base URL of the Natrix server (e.g., https://soc-master01.soc.lan).	string	Required
client_id	OAuth2 client ID registered in Keycloak (e.g., master).	string	Required
client_secret	OAuth2 client secret registered in Keycloak.	string	Required
username	Natrix user email address.	string	Required
password	Natrix user password.	string	Required
verify_ssl	Verify SSL certificate.	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Assign Alert

Assign a Natrix alert or group of alerts to an analyst using event ID, sensor index, assigned user, and action scope.

Endpoint

URL: soctopus/api/alert/assign

Method: POST

Input

Argument Name	Type	Required	Description
event_id	string	Optional	Elasticsearch document ID of the alert.
sensor_index	string	Optional	Sensor and index in format "<sensor_name>:<index_name>" (e.g., sen01_heavynode:elastalert-2026.04.21).
assigned_user	string	Optional	Analyst email address registered in Natrix.
action_scope	string	Optional	Scope of the assignment.

Input Example

{"event_id":"string","sensor_index":"string","assigned_user":"string","action_scope":"event_id"}

Set Alert Status

Update the status of one or more Natrix alerts using event_id, sensor_index, event_status, and action_scope.

Endpoint

URL: soctopus/api/alert/setstatus

Method: POST

Input

Argument Name	Type	Required	Description
event_id	string	Optional	Elasticsearch document ID of the alert.
sensor_index	string	Optional	Sensor and index in format "<sensor_name>:<index_name>" (e.g., sen01_heavynode:elastalert-2026.04.21).
event_status	string	Optional	New status for the alert.
action_scope	string	Optional	Scope of the status change.
comment	string	Optional	Optional free-text comment stored with the status change.

Input Example

{"event_id":"string","sensor_index":"string","event_status":"active","action_scope":"event_id","comment":"string"}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT