Google SecOps SOAR integration (RUX)

This integration implements the investigative and generic actions, connector and job for the Vectra RUX app on the Chronicle SOAR Platform. It will allow end-users to implement any use cases on the Vectra Cloud Platform that are possible using a combination of the below-mentioned actions.

Actions:

• Test Connectivity(ping): Tests the connectivity of the Chronicle SOAR server to the Vectra platform.

• List Entities: List Entities based on different parameters.

• List Detections: List all the detections for the given entity ID.

• Mark Entity Fixed: Mark all detections as fixed for provided ID.

• Mark Detection Fixed: Mark all detections for the entity as fixed.

• Unmark Detection Fixed: Unmark the given detections as fixed.

• Describe Entity: Show all the details of an entity for the given ID.

• Describe Detection: Show all the details of a detection for the far given ID.

• Add tags: Add tags to the given entity IDs.

• Remove tags: Remove members from the given group ID.

• Add Note: Add a note to the given entity ID.

• Remove Note: Remove a note from the given entity ID.

• List Entity Detections: List all the detections for the given entity ID.

• Assign Entity: Assign an entity to the given user ID.

• Update Assignment: Updates the assigned user in the assignment for the given entity.

• Remove Assignment: Remove the assignment for the given entity ID..

• Download PCAP: Download the PCAP file for the given detection ID.

• List Assignments: List all the assignments based on the query parameters.

• Describe Assignment: Show all the details of an assignment for the given ID.

• Resolve Assignment: Resolve assignment based on the given assignment ID and outcome ID.

• List Outcomes: List all the assignment outcomes.

• List Users: List users based on the query parameters.

• List Groups: List groups based on the query parameters.

• Assign Group: Add members to the given group ID.

Connector

• Vectra RUX - Entities Connector: Pull entities and their detections from the Vectra RUX platform and create a case in Chronicle SOAR.

Job

• Vectra RUX - Clear Empty Cases Job: Close the Chronicle case if the detection is attached to a different entity.

Playbooks

• Vectra RUX – Process Case Playbook: Assigns a Vectra user to the entity in Vectra and adds a note to link to the Google SecOps Case.

• Vectra RUX – Resolve Case Playbook: Resolves the entity in Vectra with reasoning and closes the case in Google SecOps.

Attachments

1MB

Vectra_RUX_Integration_Guide_Google_SecOps_SOAR.pdf

PDF

Open