Connectors
Nozomi Connector
5 min
use this connector to interact with nozomi through swimlane created nozomi guardian get alerts component, allowing us to pull alerts based on the query=”alerts” input parameters the component has integrated with soc solutions bundle’s component named “execute process bulk alerts“, which automates the process of ti enrichment and case record creation the creation of the component was referencing elasticsecurity get signals component note the component is created from tc24 2 12, with nozomi connector version 1 1 3 instructions to deploy the component download this component and upload to the turbine instance component nozomi networks get alerts ssp import ssp via turbine console > applications and applets > + sign at the top right corner > upload the file in \[1] upon import, you shall see the list of asset / component / connector, choose the following and import \ ‘nozomi networks get alerts’ component create/update asset details accordingly, url, username and password create playbook named “at bulk ingest alerts, (nozomi)“, \ configure action prepare query, with block named ‘query’, fill in the nozomi query syntax here , example “alerts” (note refer to nozomi api for more query filter details) reference query setting // "alerts | where days ago(time) < 1" // "alerts | where hours ago(time) < 1" "alerts | where minutes ago(time) < 1" add component named “nozomi networks get alerts“ imported in step \[3] configure input ‘query’ reference to prepare query’s result \ add component named “execute process bulk alerts“ from soc solutions bundle configure input ‘alerts’ reference to “nozomi networks get alerts“ published alerts reference screenshots playbook test result 1 entry playbook ‘at bulk ingest alerts (nozomi)’, and component’s result of ‘nozomi networks get alerts’ nozomi query(get alerts) action setting result of execute process bulk alerts case record creation using nozomi guardian alerts capabilities the nozomi integration provides the following capabilities get all alerts get assets get node count get pcap by alert id run cli command run query run query information notes run query information information on queries is detailed extensively in the nozomi user manual run cli command information information on cli commands is detailed extensively in the nozomi user manual