Cisco XDR: Analytics

This atomic executes an OCSF query for an observable using one or more Cisco XDR integrations. This query can be executed synchronously or asynchronously and supports various filtering options.

Target: Platform APIs

Steps:
- Make sure an observable type or type ID was provided
- Build the query string and request payload
- Send the OCSF query request
- Check if the request was successful:
  - If not, end the workflow
- Check if the request was synchronous:
  - If it was, set the output variable with the request's results
  - If it wasn't, attempt to extract the request ID and set the output variable

XDR - Analytics - Execute OCSF Query

prod-nam

prod-eu

prod-apjc

Fetches events for a specific finding from Cisco XDR.

Target: Query APIs

Steps:
- Fetch the finding's events
- Check if the request was successful (if not, end the workflow)
- Extract the event list
- Set the output variables

More information about this API: https://queryservice.us.security.cisco.com/swagger-ui#/Findings/get-finding

XDR - Analytics - Get Events by Finding ID

Fetches findings for a specific detection from Cisco XDR.

Target: Query APIs

Steps:
- Fetch the detection's findings
- Check if the request was successful (if not, end the workflow)
- Extract the finding list
- Set the output variables

More information about this API: https://queryservice.us.security.cisco.com/swagger-ui#/Detections/get-findings-by-detection-id

XDR - Analytics - Get Findings by Detection ID

This atomic ingests authentication events from custom sources. Each authentication event will be sent to XDR’s data ingestion pipeline as a detection finding and then processed as other detection sources. The detection will be considered for correlation with other detections and genarating XDR incidents.

Target: Custom Security Events Ingest APIs

Steps:
- Build the workflow ID header
- Build the payload
- Check if the payload was generated successfully:
  - If no, end the workflow
- Ingest XDR analytics authentication event
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, output an error

XDR - Analytics - Ingest Authentication Event

This atomic ingests email security events from custom sources. Each email security event will be sent to XDR’s data ingestion pipeline as a detection finding and then processed as other detection sources. The detection will be considered for correlation with other detections and genarating XDR incidents.

Target: Custom Security Events Ingest APIs

Steps:
- Build the workflow ID header
- Build the payload
- Check if there were any errors:
  - If there were, end the workflow
- Ingest the email security event
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, output an error

XDR - Analytics - Ingest Email Security Event

This atomic ingests network security events from custom sources. Each network security event will be sent to XDR’s data ingestion pipeline as a detection finding and then processed as other detection sources. The detection will be considered for correlation with other detections and genarating XDR incidents.

Target: Custom Security Events Ingest APIs

Steps:
- Build the workflow ID header
- Build the payload
- Check if the payload was generated successfully:
  - If no, end the workflow
- Ingest XDR analytics network security event
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, output an error

XDR - Analytics - Ingest Network Security Event

Searches for detections in Cisco XDR.

Target: Query APIs

Steps:
- Search detections
- Check if the search was successful (if not, end the workflow)
- Extract the search results
- Check if there's a next page (if there is, update the output variable)
- Set the output variables

More information about this API: https://queryservice.us.security.cisco.com/swagger-ui#/Detections/get-detections-search

XDR - Analytics - Search Detections

Searches for findings in Cisco XDR. Returns a list of finding IDs.

Target: Query APIs

Steps:
- Search findings
- Check if the search was successful (if not, end the workflow)
- Extract the search results
- Check if there's a next page (if there is, update the output variable)
- Set the output variables

More information about this API: https://queryservice.us.security.cisco.com/swagger-ui#/Findings/get-findings-search