--- title: Vectra Cognito slug: connectors/vectra-cognito docTags: createdAt: 2026-06-09T16:30:09.678Z --- The Vectra Cognito connector enables automated threat detection and response by integrating Vectra's AI-driven security capabilities with Swimlane Turbine. Vectra Cognito is an AI-driven threat detection and response platform that provides real-time attack visibility and non-stop automated threat hunting. The Vectra Cognito connector for Swimlane Turbine enables users to automate the retrieval of detailed detection information, support packet capture downloads, and ingest the latest detection data for enhanced analysis and response. By integrating with Vectra Cognito, Swimlane Turbine users can streamline their security operations, reduce response times, and leverage AI to identify and mitigate threats more effectively. ## Prerequisites To utilize the Vectra Cognito connector within Swimlane Turbine, ensure you have the following: - OAuth 2.0 client credentials for authentication with these parameters: - URL: Endpoint URL for Vectra Cognito API access - Client ID: Unique identifier for OAuth 2.0 authentication - Client Secret: Confidential key for OAuth 2.0 authentication ## Capabilities The Vectra Cognito connector provides the following capabilities: - Get all Detections - Get Detection by ID - Get Detection to Support Downloads of PCAP # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Detection by ID Retrieve detailed information for a specific detection by providing its unique ID in Vectra Cognito. ### Endpoint - **URL:** `api/v3.2/detections/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Detection by ID action | ### Input Example `{"path_parameters":{"id":1}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | ------------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `summary` | object | Output field: summary | | `summary.user_type` | string | Type of the resource | | `summary.azure_ad_privilege` | object | Output field: summary.azure\_ad\_privilege | | `summary.azure_ad_privilege.privilege` | number | Output field: summary.azure\_ad\_privilege.privilege | | `summary.azure_ad_privilege.privilegeCategory` | string | Output field: summary.azure\_ad\_privilege.privilegeCategory | | `summary.num_events` | number | Output field: summary.num\_events | | `summary.operations` | array | Output field: summary.operations | | `summary.src_ips` | array | Output field: summary.src\_ips | | `summary.src_ips.file_name` | string | Name of the resource | | `summary.src_ips.file` | string | Output field: summary.src\_ips.file | | `summary.target_entities` | array | Output field: summary.target\_entities | | `summary.description` | string | Output field: summary.description | | `threat` | number | Output field: threat | | `note_modified_by` | object | Output field: note\_modified\_by | | `detection_category` | string | Output field: detection\_category | | `is_marked_custom` | boolean | Output field: is\_marked\_custom | | `detection_type` | string | Type of the resource | | `note_modified_timestamp` | object | Output field: note\_modified\_timestamp | | `assigned_to` | object | Output field: assigned\_to | | `detection` | string | Output field: detection | | `note` | object | Output field: note | | `groups` | array | Output field: groups | | `groups.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/x-www-form-urlencoded","Date":"Wed, 21 Jun 2023 20:37:23 GMT"},"reason":"OK","json_body":{"summary":{"user_type":"Regular","azure_ad_privilege":{},"num_events":2,"operations":[],"src_ips":[],"target_entities":[],"description":"This account was seen using an operation associated with ahigh privilege admin a..."},"threat":0,"note_modified_by":null,"detection_category":"LATERAL MOVEMENT","is_marked_custom":false,"detection_type":"Az...` ## Get Detection to Support Downloads of PCAP Retrieve packet capture data for a specific detection ID in Vectra Cognito. ### Endpoint - **URL:** `api/v3.3/detections/{{id}}/pcap` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Detection to Support Downloads of PCAP action | ### Input Example `{"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachments | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 5 Jun 2024 20:37:23 GMT"},"reason":"OK","file":[]}` ## Get Detections Retrieve and ingest the latest detection data from Vectra Cognito for analysis and response automation. ### Endpoint - **URL:** `api/v3.2/detections` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.fields` | array | Optional | Parameters for the Get Detections action | | `parameters.page` | number | Optional | Parameters for the Get Detections action | | `parameters.page_size` | number | Optional | Parameters for the Get Detections action | | `parameters.ordering` | array | Optional | Parameters for the Get Detections action | | `parameters.min_id` | number | Optional | Parameters for the Get Detections action | | `parameters.max_id` | number | Optional | Parameters for the Get Detections action | | `parameters.state` | string | Optional | Parameters for the Get Detections action | | `parameters.category` | string | Optional | Parameters for the Get Detections action | | `parameters.detection_type` | string | Optional | Parameters for the Get Detections action | | `parameters.detection_category` | string | Optional | Parameters for the Get Detections action | | `parameters.src_ip` | string | Optional | Parameters for the Get Detections action | | `parameters.t_score` | number | Optional | Parameters for the Get Detections action | | `parameters.t_score_gte` | number | Optional | Parameters for the Get Detections action | | `parameters.threat_score` | number | Optional | Parameters for the Get Detections action | | `parameters.threat_gte` | number | Optional | Parameters for the Get Detections action | | `parameters.c_score` | number | Optional | Parameters for the Get Detections action | | `parameters.c_score_gte` | number | Optional | Parameters for the Get Detections action | | `parameters.tags` | array | Optional | Parameters for the Get Detections action | | `parameters.destination` | string | Optional | Parameters for the Get Detections action | | `parameters.proto` | string | Optional | Parameters for the Get Detections action | | `parameters.is_targeting_key_asset` | boolean | Optional | Parameters for the Get Detections action | | `parameters.note_modified_timestamp_gte` | number | Optional | Parameters for the Get Detections action | | `parameters.src_account` | string | Optional | Parameters for the Get Detections action | | `parameters.id` | number | Optional | Parameters for the Get Detections action | ### Input Example `{"parameters":{"fields":["a","c"],"page":10,"page_size":23,"ordering":["minus"],"min_id":1,"max_id":1000,"state":"inactive","category":"LATERAL MOVEMENT","detection_type":"O365 Internal Spearphishing","detection_category":"LATERAL MOVEMENT","src_ip":"null","t_score":68,"t_score_gte":1000,"threat_score":280,"threat_gte":2000,"c_score":0,"c_score_gte":1000,"tags":["newticket","under_investigation"],"destination":"abc","proto":"abc","is_targeting_key_asset":true,"note_modified_timestamp_gte":34,"src_account":"O365:do-not-reply@vectra.ai","id":2}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | ------------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `summary` | object | Output field: summary | | `summary.user_type` | string | Type of the resource | | `summary.azure_ad_privilege` | object | Output field: summary.azure\_ad\_privilege | | `summary.azure_ad_privilege.privilege` | number | Output field: summary.azure\_ad\_privilege.privilege | | `summary.azure_ad_privilege.privilegeCategory` | string | Output field: summary.azure\_ad\_privilege.privilegeCategory | | `summary.num_events` | number | Output field: summary.num\_events | | `summary.operations` | array | Output field: summary.operations | | `summary.src_ips` | array | Output field: summary.src\_ips | | `summary.src_ips.file_name` | string | Name of the resource | | `summary.src_ips.file` | string | Output field: summary.src\_ips.file | | `summary.target_entities` | array | Output field: summary.target\_entities | | `summary.description` | string | Output field: summary.description | | `threat` | number | Output field: threat | | `note_modified_by` | object | Output field: note\_modified\_by | | `detection_category` | string | Output field: detection\_category | | `is_marked_custom` | boolean | Output field: is\_marked\_custom | | `detection_type` | string | Type of the resource | | `note_modified_timestamp` | object | Output field: note\_modified\_timestamp | | `assigned_to` | object | Output field: assigned\_to | | `detection` | string | Output field: detection | | `note` | object | Output field: note | | `groups` | array | Output field: groups | | `groups.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/x-www-form-urlencoded","Date":"Wed, 21 Jun 2023 20:37:23 GMT"},"reason":"OK","json_body":{"summary":{"user_type":"Regular","azure_ad_privilege":{},"num_events":2,"operations":[],"src_ips":[],"target_entities":[],"description":"This account was seen using an operation associated with ahigh privilege admin a..."},"threat":0,"note_modified_by":null,"detection_category":"LATERAL MOVEMENT","is_marked_custom":false,"detection_type":"Az...` # Response Headers | **Header** | **Description** | **Example** | | -------------- | ----------------------------------------------------- | --------------------------------- | | content-length | The length of the response body in bytes | 140 | | Content-Type | The media type of the resource | application/x-www-form-urlencoded | | Date | The date and time at which the message was originated | Thu, 2 May 2024 20:37:23 GMT |