Cisco XDR: Analytics

This atomic executes an OCSF query for an observable using one or more Cisco XDR integrations. This query can be executed synchronously or asynchronously and supports various filtering options.

Target: Platform APIs

Steps:
- Make sure an observable type or type ID was provided
- Build the query string and request payload
- Send the OCSF query request
- Check if the request was successful:
  - If not, end the workflow
- Check if the request was synchronous:
  - If it was, set the output variable with the request's results
  - If it wasn't, attempt to extract the request ID and set the output variable

XDR - Analytics - Execute OCSF Query

prod-nam

prod-eu

prod-apjc

This atomic ingests email security events from custom sources. Each email security event will be sent to XDR’s data ingestion pipeline as a detection finding and then processed as other detection sources. The detection will be considered for correlation with other detections and genarating XDR incidents.

Target: Custom Security Events Ingest APIs

Steps:
- Build the workflow ID header
- Build the payload
- Check if there were any errors:
  - If there were, end the workflow
- Ingest the email security event
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, output an error

XDR - Analytics - Ingest Email Security Event

This atomic ingests network security events from custom sources. Each network security event will be sent to XDR’s data ingestion pipeline as a detection finding and then processed as other detection sources. The detection will be considered for correlation with other detections and genarating XDR incidents.

Target: Custom Security Events Ingest APIs

Steps:
- Build the workflow ID header
- Build the payload
- Check if the payload was generated successfully:
  - If no, end the workflow
- Ingest XDR analytics network security event
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, output an error