Vectra Cognito
The Vectra Cognito connector enables automated threat detection and response by integrating Vectra's AI-driven security capabilities with Swimlane Turbine.
Vectra Cognito is an AI-driven threat detection and response platform that provides real-time attack visibility and non-stop automated threat hunting. The Vectra Cognito connector for Swimlane Turbine enables users to automate the retrieval of detailed detection information, support packet capture downloads, and ingest the latest detection data for enhanced analysis and response. By integrating with Vectra Cognito, Swimlane Turbine users can streamline their security operations, reduce response times, and leverage AI to identify and mitigate threats more effectively.
Prerequisites
To utilize the Vectra Cognito connector within Swimlane Turbine, ensure you have the following:
- OAuth 2.0 client credentials for authentication with these parameters:
- URL: Endpoint URL for Vectra Cognito API access
- Client ID: Unique identifier for OAuth 2.0 authentication
- Client Secret: Confidential key for OAuth 2.0 authentication
Capabilities
The Vectra Cognito connector provides the following capabilities:
- Get all Detections
- Get Detection by ID
- Get Detection to Support Downloads of PCAP
Configurations
Oauth 2.0 Client Credentials
Authenticates using oauth 2.0 client credentials.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
client_id | The client ID | string | Required |
client_secret | The client secret. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Detection by ID
Retrieve detailed information for a specific detection by providing its unique ID in Vectra Cognito.
Endpoint
- URL: api/v3.2/detections/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Detection by ID action |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
summary | object | Output field: summary |
summary.user_type | string | Type of the resource |
summary.azure_ad_privilege | object | Output field: summary.azure_ad_privilege |
summary.azure_ad_privilege.privilege | number | Output field: summary.azure_ad_privilege.privilege |
summary.azure_ad_privilege.privilegeCategory | string | Output field: summary.azure_ad_privilege.privilegeCategory |
summary.num_events | number | Output field: summary.num_events |
summary.operations | array | Output field: summary.operations |
summary.src_ips | array | Output field: summary.src_ips |
summary.src_ips.file_name | string | Name of the resource |
summary.src_ips.file | string | Output field: summary.src_ips.file |
summary.target_entities | array | Output field: summary.target_entities |
summary.description | string | Output field: summary.description |
threat | number | Output field: threat |
note_modified_by | object | Output field: note_modified_by |
detection_category | string | Output field: detection_category |
is_marked_custom | boolean | Output field: is_marked_custom |
detection_type | string | Type of the resource |
note_modified_timestamp | object | Output field: note_modified_timestamp |
assigned_to | object | Output field: assigned_to |
detection | string | Output field: detection |
note | object | Output field: note |
groups | array | Output field: groups |
groups.file_name | string | Name of the resource |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/x-www-form-urlencoded","Date":"Wed, 21 Jun 2023 20:37:23 GMT"},"reason":"OK","json_body":{"summary":{"user_type":"Regular","azure_ad_privilege":{},"num_events":2,"operations":[],"src_ips":[],"target_entities":[],"description":"This account was seen using an operation associated with ahigh privilege admin a..."},"threat":0,"note_modified_by":null,"detection_category":"LATERAL MOVEMENT","is_marked_custom":false,"detection_type":"Az...
Get Detection to Support Downloads of PCAP
Retrieve packet capture data for a specific detection ID in Vectra Cognito.
Endpoint
- URL: api/v3.3/detections/{{id}}/pcap
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Detection to Support Downloads of PCAP action |
Input Example
{"path_parameters":{"id":"1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | Attachments |
file.file | string | Output field: file.file |
file.file_name | string | Name of the resource |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 5 Jun 2024 20:37:23 GMT"},"reason":"OK","file":[]}
Get Detections
Retrieve and ingest the latest detection data from Vectra Cognito for analysis and response automation.
Endpoint
- URL: api/v3.2/detections
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.fields | array | Optional | Parameters for the Get Detections action |
parameters.page | number | Optional | Parameters for the Get Detections action |
parameters.page_size | number | Optional | Parameters for the Get Detections action |
parameters.ordering | array | Optional | Parameters for the Get Detections action |
parameters.min_id | number | Optional | Parameters for the Get Detections action |
parameters.max_id | number | Optional | Parameters for the Get Detections action |
parameters.state | string | Optional | Parameters for the Get Detections action |
parameters.category | string | Optional | Parameters for the Get Detections action |
parameters.detection_type | string | Optional | Parameters for the Get Detections action |
parameters.detection_category | string | Optional | Parameters for the Get Detections action |
parameters.src_ip | string | Optional | Parameters for the Get Detections action |
parameters.t_score | number | Optional | Parameters for the Get Detections action |
parameters.t_score_gte | number | Optional | Parameters for the Get Detections action |
parameters.threat_score | number | Optional | Parameters for the Get Detections action |
parameters.threat_gte | number | Optional | Parameters for the Get Detections action |
parameters.c_score | number | Optional | Parameters for the Get Detections action |
parameters.c_score_gte | number | Optional | Parameters for the Get Detections action |
parameters.tags | array | Optional | Parameters for the Get Detections action |
parameters.destination | string | Optional | Parameters for the Get Detections action |
parameters.proto | string | Optional | Parameters for the Get Detections action |
parameters.is_targeting_key_asset | boolean | Optional | Parameters for the Get Detections action |
parameters.note_modified_timestamp_gte | number | Optional | Parameters for the Get Detections action |
parameters.src_account | string | Optional | Parameters for the Get Detections action |
parameters.id | number | Optional | Parameters for the Get Detections action |
Input Example
{"parameters":{"fields":["a","c"],"page":10,"page_size":23,"ordering":["minus"],"min_id":1,"max_id":1000,"state":"inactive","category":"LATERAL MOVEMENT","detection_type":"O365 Internal Spearphishing","detection_category":"LATERAL MOVEMENT","src_ip":"null","t_score":68,"t_score_gte":1000,"threat_score":280,"threat_gte":2000,"c_score":0,"c_score_gte":1000,"tags":["newticket","under_investigation"],"destination":"abc","proto":"abc","is_targeting_key_asset":true,"note_modified_timestamp_gte":34,"src_account":"O365:[email protected]","id":2}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
summary | object | Output field: summary |
summary.user_type | string | Type of the resource |
summary.azure_ad_privilege | object | Output field: summary.azure_ad_privilege |
summary.azure_ad_privilege.privilege | number | Output field: summary.azure_ad_privilege.privilege |
summary.azure_ad_privilege.privilegeCategory | string | Output field: summary.azure_ad_privilege.privilegeCategory |
summary.num_events | number | Output field: summary.num_events |
summary.operations | array | Output field: summary.operations |
summary.src_ips | array | Output field: summary.src_ips |
summary.src_ips.file_name | string | Name of the resource |
summary.src_ips.file | string | Output field: summary.src_ips.file |
summary.target_entities | array | Output field: summary.target_entities |
summary.description | string | Output field: summary.description |
threat | number | Output field: threat |
note_modified_by | object | Output field: note_modified_by |
detection_category | string | Output field: detection_category |
is_marked_custom | boolean | Output field: is_marked_custom |
detection_type | string | Type of the resource |
note_modified_timestamp | object | Output field: note_modified_timestamp |
assigned_to | object | Output field: assigned_to |
detection | string | Output field: detection |
note | object | Output field: note |
groups | array | Output field: groups |
groups.file_name | string | Name of the resource |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/x-www-form-urlencoded","Date":"Wed, 21 Jun 2023 20:37:23 GMT"},"reason":"OK","json_body":{"summary":{"user_type":"Regular","azure_ad_privilege":{},"num_events":2,"operations":[],"src_ips":[],"target_entities":[],"description":"This account was seen using an operation associated with ahigh privilege admin a..."},"threat":0,"note_modified_by":null,"detection_category":"LATERAL MOVEMENT","is_marked_custom":false,"detection_type":"Az...
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 140 |
Content-Type | The media type of the resource | application/x-www-form-urlencoded |
Date | The date and time at which the message was originated | Thu, 2 May 2024 20:37:23 GMT |