Google SecOps SOAR integration (QUX)

This integration implements the investigative and generic actions, connector and job for the Vectra QUX app on the Chronicle SOAR Platform. It will allow end-users to implement any use cases on the Vectra Cloud Platform that are possible using a combination of the below-mentioned actions.

Actions:

• Test Connectivity(ping): Tests the connectivity of the Chronicle SOAR server to Vectra.

• Search Hosts: List hosts based on query parameters.

• Search Accounts: List accounts based on query parameters.

• Search Detections: List detections based on query parameters.

• Mark Entity Fixed: Mark the given detections as fixed.

• Mark Detection Fixed: Mark detections as fixed for provided IDs

• Unmark Detection Fixed: Unmark the given detections as fixed.

• Describe Entity: Show all the details of an entity for the given ID.

• Describe Detection: Show all the details of a detection for the given ID.

• Add Tags: Add tags to the given entity IDs

• Remove Tags: Remove tags from the given entity ID.

• Add Note: Add a note to the given entity ID

• Remove Note: Remove a note from the given entity ID.

• List Entity Detections: List all the detections for the given entity ID

• Assign Entity: Assign an entity to the given user ID.

• Update Assignment: Updates the assigned user in the assignment for the given entity.

• Remove Assignment: Remove the assignment for the given entity ID.

• Download PCAP: Download the PCAP file for the given detection ID.

• List Assignments: List all the assignments based on the query see parameters.

• Describe Assignment: Show all the details of an assignment for the given ID.

• Resolve Assignment: Resolve assignment based on the given assignment ID and outcome ID.

• List Outcomes : List all the assignment outcomes.

• Add Outcome : Add outcome with title and category.

• List Users: List users based on the query parameters.

• List Groups: List groups based on the query parameters.

• Assign Group: Add members to the given group ID.

• Remove Group: Remove members from the given group ID.

Connector

• Vectra QUX - Entities Connector: Pull entities and their detections from the Vectra QUX platform and create a case in Chronicle SOAR.

Job

• Vectra QUX - Clear Empty Cases Job: Close the Chronicle case if the detection is attached to a different entity or no detections remain.

Playbooks

• Vectra QUX – Process Case Playbook: Assigns a Vectra user to the entity in Vectra and adds a note to link to the Google SecOps Case.

• Vectra QUX – Resolve Case Playbook: Resolves the entity in Vectra with reasoning and closes the case in Google SecOps.

Attachments

1MB

Vectra_QUX_Integration_Guide_Google_SecOps_SOAR.pdf

PDF

Open