Darktrace /NETWORK

Adds one or more supported observables to the intelfeed in Darktrace. Supported observables include: external domains, IP addresses, and hostnames. Note that hostnames will be added as domains unless the "Hostnames" input is set to True. If using a user-based API token, the user must have the "Edit Domains" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Send the request to Darktrace
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-intelfeed-request

Darktrace /NETWORK - Add Observables to Intelfeed

prod-nam

prod-eu

prod-apjc

Adds a tag to a device in Darktrace. If using a user-based API token, the user must have the "Edit Tags" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Request the tag be added
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-tags-entities-request

Darktrace /NETWORK - Add Tag to Device

Clears a previously executed antigena action in Darktrace. If using a user-based API token, the user must have the "Darktrace RESPOND (formerly Antigena)" and "Visualizer" permissions. Data will be anonymized unless the user also has the "Unrestricted Devices" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Clear the action
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-antigena-request

Darktrace /NETWORK - Clear Antigena Action

Creates a new tag in Darktrace. If using a user-based API token, the user must have the "Edit Tags" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Send the request to Darktrace
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-tags-request

Darktrace /NETWORK - Create New Tag

Requests a PCAP file be generated from traffic observed by Darktrace. If using a user-based API token, the user must have the "Create PCAPs" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Check that the timeframe is 30 minutes or less
[] Build the request payload and authorization headers
[] Send the request to Darktrace
[] Check if the request was successful:
[]> If it was, attempt to extract the filename and set the output variables
[]> If it wasn't, return an error

More information about this API: https://portal.darktrace.com/product-guides/main

Darktrace /NETWORK - Create PCAP File

Executes an antigena action on a specific device in Darktrace. Actions include quarantining the device, blocking outgoing traffic, or blocking incoming traffic. If using a user-based API token, the user must have the "Darktrace RESPOND (formerly Antigena)" and "Visualizer" permissions. Data will be anonymized unless the user also has the "Unrestricted Devices" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Execute the action
[] Check if the request was successful:
[]> If it was, attempt to extract data and set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-antigena-manual-request

Darktrace /NETWORK - Execute Antigena Action

Gets a list of tags from Darktrace.

If using a user-based API token, the user must have one of the following permissions: Visualizer, SaaS Console, View Models, Edit Models, Device Admin.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the authorization headers
[] Send the request to Darktrace
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-tags-request

Darktrace /NETWORK - Get All Tags

Returns information about current and past Darktrace RESPOND/Network (formerly Antigena Network) actions. If using a user-based API token, the user must have the "Visualizer" permission. Data will be anonymized unless the user also has the "Unrestricted Devices" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Send the request to Darktrace
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-antigena-request

Darktrace /NETWORK - Get Antigena Information

Returns a time-sorted list of connections and events for a device or entity from Darktrace. The request requires either a device (did) or a model breach ID (pbid). If using a user-based API token, the user must have the "Visualizer" or "Platform Accounts Console" permission. Data will be anonymized unless the user also has the "Unrestricted Devices" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Make sure one of the required fields is provided
[] Build the request payload and authorization headers
[] Request connection details
[] Check if the request was successful:
[]> If it was: Set the atomic's output variables
[]> If it wasn't, return an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-details-request

Darktrace /NETWORK - Get Connections and Events

Returns the data used in the "Connections Data" view for a given device in Darktrace. The data returned covers a 4 week period. If using a user-based API token, the user must have the "Visualizer" permission. Data will be anonymized unless the user also has the "Unrestricted Devices" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Request the device information
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-deviceinfo-request

Darktrace /NETWORK - Get Device Information

Fetches a specific device from Darktrace using its ID.

If using a user-based API token, the user must have one of the following permissions: Visualizer, Platform Accounts Console, View Models, Edit Models, Device Admin. Data will be anonymized unless the user also has the "Unrestricted Devices" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Request the device
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-devices-request

Darktrace /NETWORK - Get Device by ID

Returns a list of devices similar to another device in Darktrace. If using a user-based API token, the user must have the "Visualizer" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Request the list of similar devices
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-similardevices-request

Darktrace /NETWORK - Get Similar Devices

Fetches a specific tag from Darktrace using its ID or name. If using a user-based API token, the user must have one of the following permissions: Visualizer, SaaS Console, View Models, Edit Models, Device Admin.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Request the tags
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-tags-request

Darktrace /NETWORK - Get Tag by ID or Name

Removes a single observable or all observables from the intelfeed in Darktrace. Remove a single observable by providing it as the "Observable to Remove." Remove all observables by setting "Remove All" to true. Supported observables include: external domains, IP addresses, and hostnames. If using a user-based API token, the user must have the "Edit Domains" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Send the request to Darktrace
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-intelfeed-request

Darktrace /NETWORK - Remove Observable from Intelfeed

Removes a tag from a device in Darktrace. If using a user-based API token, the user must have the "Edit Tags" permission.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Request the tag be removed
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-tags-entities-request

Darktrace /NETWORK - Remove Tag from Device

Searches Darktrace for devices that match the criteria provided. At least one search field should be specified. If using a user-based API token, the user must have the "Unrestricted Devices" and "Visualizer" permissions.

Target: Darktrace /NETWORK integration target or HTTP Endpoint for "your-tenant.cloud.darktrace.com" with no path

Account Key: None if using an integration-provided target, public and private tokens if using an HTTP Endpoint target

Steps:
[] Build the request payload and authorization headers
[] Search for devices
[] Check if the request was successful:
[]> If it was, attempt to extract data and set the output variables
[]> If it wasn't, output an error

More information about this API: https://portal.darktrace.com/product-guides/main/api-devicesearch-request