Taegis XDR v1.0.0

About the connector

SecureWorks Taegis™ XDR offers superior detection, unmatched response and an open platform built from the ground up to integrate market-leading technologies and deliver the highest ROI.

This document provides information about the Taegis XDR Connector, which facilitates automated interactions, with a Taegis XDR server using FortiSOAR™ playbooks. Add the Taegis XDR Connector as a step in FortiSOAR™ playbooks and perform automated operations with Taegis XDR.

Version information

Connector Version: 1.0.0

Authored By: Fortinet

Certified: No

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-taegis-xdr

Prerequisites to configuring the connector

• You must have the credentials of Taegis XDR server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Taegis XDR server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Taegis XDR connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Get Alerts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "Alerts": [
            {
                "id": "",
                "metadata": {
                    "title": "",
                    "description": "",
                    "severity": ""
                },
                "url": ""
            }
        ]
    }
}

operation: Get Assets

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "Assets": [
            {
                "id": "",
                "ingestTime": "",
                "createdAt": "",
                "updatedAt": "",
                "deletedAt": "",
                "biosSerial": "",
                "firstDiskSerial": "",
                "systemVolumeSerial": "",
                "sensorVersion": "",
                "endpointPlatform": "",
                "hostnames": "",
                "architecture": "",
                "osFamily": "",
                "osVersion": "",
                "osDistributor": "",
                "osRelease": "",
                "systemType": "",
                "osCodename": "",
                "kernelRelease": "",
                "kernelVersion": "",
                "tags": [
                    {
                        "key": "",
                        "tag": ""
                    }
                ],
                "endpointType": "",
                "hostId": "",
                "sensorId": ""
            }
        ]
    }
}

operation: Get Endpoint

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "assetEndpointInfo": {
            "hostId": "",
            "hostName": "",
            "actualIsolationStatus": "",
            "allowedDomain": "",
            "desiredIsolationStatus": "",
            "firstConnectTime": "",
            "moduleHealth": {
                "enabled": "",
                "lastRunningTime": "",
                "moduleDisplayName": ""
            },
            "lastConnectAddress": "",
            "lastConnectTime": "",
            "sensorVersion": ""
        }
    }
}

operation: Get Investigations

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "Investigations": [
            {
                "archived_at": "",
                "created_at": "",
                "description": "",
                "id": "",
                "key_findings": "",
                "priority": "",
                "service_desk_id": "",
                "service_desk_type": "",
                "status": "",
                "alerts2": [],
                "url": ""
            }
        ]
    }
}

operation: Get Investigations Alerts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "InvestigationAlerts": [
            {
                "id": "",
                "description": "",
                "message": "",
                "severity": ""
            }
        ]
    }
}

operation: Get Playbook Execution

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "PlaybookExecution": {
            "createdAt": "",
            "executionTime": "",
            "id": "",
            "inputs": {
                "alert": {
                    "message": ""
                }
            },
            "instance": {
                "name": "",
                "playbook": {
                    "name": ""
                }
            },
            "outputs": "",
            "state": "",
            "updatedAt": ""
        }
    }
}

operation: Get User by ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "Users": [
            {
                "email": "",
                "family_name": "",
                "given_name": "",
                "status": "",
                "user_id": ""
            }
        ]
    }
}

operation: Isolate Assets

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "AssetIsolation": {
            "id": ""
        }
    }
}

operation: Update Alert Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "AlertStatusUpdate": {
            "reason": "",
            "resolution_status": ""
        }
    }
}

operation: Update Investigation

Input parameters

Output

The output contains the following populated JSON schema:

{
    "TaegisXDR": {
        "InvestigationUpdate": {
            "id": ""
        }
    }
}

Included playbooks

The Sample - Taegis XDR - 1.0.0 playbook collection comes bundled with the Taegis XDR connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Taegis XDR connector.

• Get Alerts
• Get Assets
• Get Endpoint
• Get Investigations
• Get Investigations Alerts
• Get Playbook Execution
• Get User by ID
• Isolate Assets
• Update Alert Status
• Update Investigation

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.