Tehtris Xdr
The TEHTRIS XDR connector enables automated interactions with the TEHTRIS XDR platform, facilitating threat detection and response activities.
TEHTRIS XDR provides a comprehensive cybersecurity solution that monitors and protects against advanced threats across various vectors. By integrating with Swimlane Turbine, users can automate the retrieval of detailed XDR events, manage alert statuses, and control endpoint security measures such as isolation and disk scan statuses. This connector empowers security teams to efficiently respond to incidents, manage quarantined files, and maintain an up-to-date software list on endpoints, all within the Swimlane Turbine platform. The TEHTRIS XDR connector streamlines security operations, enabling faster threat detection and response while reducing manual workload.
The TEHTRIS XDR connector integrates with Swimlane Turbine. TEHTRIS XDR Platform is used to control and improve the IT security of private and public companies against advanced cyber threats such as cyber espionage or cyber sabotage activities.
Prerequisites
To utilize the TEHTRIS XDR connector within Swimlane Turbine, ensure you have the following prerequisites:
- HTTP Basic Authentication with the following parameters:
- URL: The endpoint URL for the TEHTRIS XDR API.
- Username: Your TEHTRIS XDR account username.
- Password: Your TEHTRIS XDR account password.
Asset Setup
To Generate an API key:
- From TEHTRIS XDR Platform, navigate to Parameters > API Keys.
- To create a new key to use with some API, click Add.
- A popup is displayed, in which you may easily find API, first enter a label that describes the purpose for the API key.
- Choose all required API filtered by name, by product or by method. Several API may be selected to share same API key.
- When selection is done, click Create.
- When the key is generated, a warning appears: ?Provided only once, store it somewhere safe?. Full 60 chars of API key string will never be displayed in key management tab, only the prefix appears, so key shall be copied now.
- Use the copy to clipboard button function, and click Close.
Capabilities
This connector provides the following capabilities:
- Fetch Events
- Get Alert Status
- Get EDR Disk Scan Status
- Get EDR Isolation Status
- Get Software List
- List all Quarantine Files
- List Running Process
- Restore a File from a Quarantine
- Send Isolation Action
- Update Alert Status
Notes
- Once logged in to the XDR platform using your username and password, select the TEHTRIS XDR option, where you will find the Swagger documentation.
Configurations
Tehtris XDR HTTP Basic Authentication
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | api as username. | string | Required |
password | Generated API key as password. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Fetch Events
Retrieve detailed events from TEHTRIS XDR starting from a specified date by using the 'fromDate' parameter.
Endpoint
- URL: /xdr/v1/event
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.fromDate | number | Required | Seconds since EPOCH in UTC timezone of the starting date from when fetch the events. If countOnly is false, it can not be earlier than 43 days in the past. |
parameters.toDate | number | Optional | Seconds since EPOCH in UTC timezone of the ending date to fetch the events. Leave blank to fetch events until now. |
parameters.eventId | number | Optional | If used, response contains only events with 'id' greater than this parameter. |
parameters.countOnly | boolean | Optional | If True, then Count Alert instead of retrieving list of alerts. |
parameters.byTag | boolean | Optional | If True and countOnly is True, then Count Alert by Tag. |
parameters.limit | number | Optional | If countOnly is false, number of events to return in one query. Can not be greater than 1000. |
parameters.offset | number | Optional | If countOnly is false, the number of events to skip before starting to collect the result set. |
parameters.filterID | string | Optional | The Filter ID used to retrieve events, if no filter ID is specified in query the first filter ID store with API Key is used. |
parameters.createdOrModified | string | Optional | CREATED query all alerts created between "fromDate" and "toDate". "MODIFIED" query all alerts created since last 43 days and whose status has been modified between "fromDate" and "toDate". |
Input Example
{"parameters":{"fromDate":1707974685,"toDate":1707974690,"eventId":1,"countOnly":false,"byTag":false,"limit":100,"offset":0,"filterID":"1","createdOrModified":"CREATED"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}
Get Alert Status
Retrieve detailed alert statuses from TEHTRIS XDR using a specified watchPointId.
Endpoint
- URL: /xdr/v2/event/watch-point/{{watchPointId}}/alerts
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.watchPointId | string | Required | Identifier of watch point. |
parameters.limit | number | Optional | Limit on the number of returned alerts. You can set it to 0 to simulate a count only. |
parameters.offset | number | Optional | Offset. |
Input Example
{"parameters":{"limit":1000,"offset":0},"path_parameters":{"watchPointId":"2bc15a58-2fa9-527d-8553-4b5dfc7b0456-G2"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
alerts | array | Output field: alerts |
alerts.sha256 | string | Output field: alerts.sha256 |
alerts.rflId | number | Unique identifier |
alerts.ipSrc | string | Output field: alerts.ipSrc |
alerts.description | string | Output field: alerts.description |
alerts.pid | number | Unique identifier |
alerts.pCreateDatetime | string | Time value |
alerts.uid | string | Unique identifier |
alerts.path | string | Output field: alerts.path |
alerts.cmdline | string | Output field: alerts.cmdline |
alerts.uuid__ | string | Unique identifier |
alerts.appType | string | Type of the resource |
alerts.os_release__ | string | Output field: alerts.os_release__ |
alerts.eventName | string | Name of the resource |
alerts.tag | string | Output field: alerts.tag |
alerts.id | number | Unique identifier |
alerts.egKBId | number | Unique identifier |
alerts.mitreTechs | string | Output field: alerts.mitreTechs |
alerts.egKBName | string | Name of the resource |
alerts.os_architecture__ | string | Output field: alerts.os_architecture__ |
alerts.os_server__ | boolean | Output field: alerts.os_server__ |
alerts.lvl | number | Output field: alerts.lvl |
alerts.tehtris | object | Output field: alerts.tehtris |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{"alerts":[{}]}}
Get EDR Disk Scan Status
Retrieve the current disk scan status in TEHTRIS XDR using the appliance ID and EDR UUID.
Endpoint
- URL: /edr/v2/live/{{applianceId}}/{{edrUuid}}/scan-disk
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.applianceId | number | Required | The appliance number where the endpoint is connected. Minimum value is 1 and maximum value is 254. |
path_parameters.edrUuid | string | Required | The UUID of the endpoint you want to use this API on. |
parameters.scanId | string | Optional | ID of the scan. If no ID is specified, will retrieve the status of the scheduled scan. |
Input Example
{"parameters":{"scanId":""},"path_parameters":{"applianceId":1,"edrUuid":""}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | object | Status value |
status.status | string | Status value |
status.data | object | Response data |
status.data.scanned_folders | array | Response data |
status.data.start_time | string | Response data |
status.data.end_time | string | Response data |
status.data.files_scanned | number | Response data |
status.data.binaries_scanned | number | Response data |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{"status":{"status":"string","data":{}}}}
Get EDR Isolation Status
Retrieve the current isolation status of an endpoint in TEHTRIS XDR using specific identifiers.
Endpoint
- URL: /edr/v2/live/{{applianceId}}/{{edrUuid}}/isolation
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.edrUuid | string | Required | The UUID of the endpoint you want to use this API on. |
path_parameters.applianceId | number | Required | The appliance number where the endpoint is connected. Minimum value is 1 and maximum value is 254. |
Input Example
{"path_parameters":{"edrUuid":"","applianceId":2}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | boolean | Status value |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{"status":true}}
Get Software List
Retrieve a list of software installed on an endpoint identified by edrUuid and applianceId in TEHTRIS XDR.
Endpoint
- URL: /edr/v2/live/{{applianceId}}/{{edrUuid}}/software
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.edrUuid | string | Required | The UUID of the endpoint you want to use this API on. |
path_parameters.applianceId | number | Required | The appliance number where the endpoint is connected. Minimum value is 1 and maximum value is 254. |
Input Example
{"path_parameters":{"edrUuid":"","applianceId":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
columns | array | Output field: columns |
columns.type | string | Type of the resource |
columns.name | string | Name of the resource |
columns.default | string | Output field: columns.default |
data | array | Response data |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{"columns":[{}],"data":["string"]}}
List all Quarantine Files
Retrieve all files quarantined by TEHTRIS XDR for a specific endpoint, requiring edrUuid and applianceId.
Endpoint
- URL: /edr/v2/live/{{applianceId}}/{{edrUuid}}/remediation/quarantine
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.edrUuid | string | Required | The UUID of the endpoint you want to use this API on. |
path_parameters.applianceId | number | Required | The appliance number where the endpoint is connected. Minimum value is 1 and maximum value is 254. |
Input Example
{"path_parameters":{"edrUuid":"","applianceId":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
quarantinePaths | array | Output field: quarantinePaths |
Output Example
{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{"quarantinePaths":["string"]}}
List Running Process
Retrieve currently running UEBA modules in TEHTRIS XDR using the 'rid' path parameter for identification.
Endpoint
- URL: /siem/{{rid}}/uba/v4/ueba/observe-running-modules
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.rid | number | Required | The appliance ID. |
Input Example
{"path_parameters":{"rid":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
list | array | Output field: list |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{"list":["string"]}}
Restore a File from a Quarantine
Restores a quarantined file within TEHTRIS XDR using the EDR UUID, appliance ID, and the specified file path.
Endpoint
- URL: /edr/v2/live/{{applianceId}}/{{edrUuid}}/remediation/quarantine
- Method: PATCH
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.edrUuid | string | Required | The UUID of the endpoint you want to use this API on. |
path_parameters.applianceId | number | Required | The appliance number where the endpoint is connected. Minimum value is 1 and maximum value is 254. |
parameters.path | string | Required | Path of the file to restore. |
Input Example
{"parameters":{"path":""},"path_parameters":{"edrUuid":"","applianceId":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
restoredPath | string | Output field: restoredPath |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{"restoredPath":"string"}}
Send Isolation Action
Initiates an endpoint isolation in TEHTRIS XDR using the provided edrUuid, applianceId, and a specified isolation action.
Endpoint
- URL: /edr/v2/live/{{applianceId}}/{{edrUuid}}/isolation
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.edrUuid | string | Required | The UUID of the endpoint you want to use this API on. |
path_parameters.applianceId | number | Required | The appliance number where the endpoint is connected. Minimum value is 1 and maximum value is 254. |
parameters.isolationAction | string | Required | Enable/disable the network isolation. enable- all incoming and outgoing connections on the selected endpoint are blocked except their connections to the TEHTRIS appliances and DNS requests. disable- Disables the isolation. whitelist- While isolation is enabled, whitelist the ruleset input. |
parameters.power | string | Optional | Soft power = Isolation policy; Hard power = Enforce isolation without config. |
toWhitelist | object | Optional | Parameter for Send Isolation Action |
Input Example
{"parameters":{"isolationAction":"enable","power":"soft"},"json_body":{"toWhitelist":{}},"path_parameters":{"edrUuid":"","applianceId":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}
Update Alert Status
Modify the name, description, and status of a TEHTRIS XDR watch point; set status to close to freeze it.
Endpoint
- URL: /xdr/v2/event/watch-point/{{watchPointId}}
- Method: PATCH
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.watchPointId | string | Required | Identifier of watch point. |
name | string | Optional | Name of the resource |
description | string | Optional | Parameter for Update Alert Status |
status | string | Optional | Status value |
Input Example
{"json_body":{"name":"Potential Ransomware activity","description":"Some alerts match the detection of 'Potential Ransomware activity' with 'AD-FR-SERVER-248' value on 'hostname__' keys ","status":"checked"},"path_parameters":{"watchPointId":"2bc15a58-2fa9-527d-8553-4b5dfc7b0456-G2"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
name | string | Name of the resource |
description | string | Output field: description |
type | string | Type of the resource |
severity | number | Output field: severity |
creation | object | Output field: creation |
creation.date | string | Date value |
edition | object | Output field: edition |
edition.date | string | Date value |
composedOf | object | Output field: composedOf |
composedOf.scenarios | array | Output field: composedOf.scenarios |
composedOf.pivots | array | Output field: composedOf.pivots |
composedOf.pivots.key | string | Output field: composedOf.pivots.key |
composedOf.pivots.value | string | Value for the parameter |
childOf | object | Output field: childOf |
childOf.metaIds | object | Unique identifier |
id | string | Unique identifier |
freezeDateTime | string | Time value |
isFreeze | boolean | Output field: isFreeze |
mayContainTooOldAlerts | boolean | Output field: mayContainTooOldAlerts |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 15 Feb 2024 20:37:23 GMT"},"reason":"OK","json_body":{"name":"Potential Ransomware activity, AD-FR-SERVER-248","description":"Some alerts match the detection of 'Potential Ransomware activity' with 'AD-FR-S...","type":"AUTO_SCN_PVT","severity":9,"creation":{"date":"2023-05-01T10:47:35+00:00"},"edition":{"date":"2023-05-01T10:47:35+00:00"},"composedOf":{"scenarios":[],"pivots":[]},"childOf...
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 140 |
content-type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 15 Feb 2024 20:37:23 GMT |