Skip to main content

August Content Digest

Discover new integrations, steps, and improvements.

We've added the following new integrations, steps, and improvements:

  • New templates:

    • Convert an array into selectable Slack Block Kit element

  • New integrations:

    • BreachRx

    • Method Security

    • Zscaler OneAPI ZIA

  • New steps and improvements:

    • incident.io

    • Shodan

    • Torq Cases

    • Vectra

New Templates

We've added the following template to the template library:

New integrations

BreachRx

A new BreachRx steps integration is now available on the Integrations page. The following steps are available:

  • Close Incident

  • Create Incident Action

  • Create Playbook

  • Create Procedure

  • Create Procedure Task

  • Get Chat Messages

  • Get Incident History

  • Get Playbook

  • Get Roles and Users

  • List Incident Actions

  • List Incidents

  • List Playbooks

  • List Procedures

  • Update Incident Action

  • Upload Document

Method Security

A new Method Security steps integration is now available on the Integrations page. The following steps are available:

  • Get External IP Addresses

  • Get Issue

  • Get Skill

  • Get Target V2

  • List Blueprints

  • Run Blueprint

  • Search Skills

  • Update Issue

Zscaler OneAPI ZIA

A new Zscaler OneAPI ZIA steps integration is now available on the Integrations page. The following steps are available:

  • Add Destination IP Group

  • Create Firewall Filtering Rule

  • Create Whitelist

  • Delete Custom Category

  • Delete Destination IP Group

  • Delete Firewall Filtering Rule

  • Delete Source IP Group

  • Delete URL Filtering Rule

  • Delete Web Application Rule

  • Edit Destination IP Group

  • Edit Source IP Group

  • Get Allowlist

  • Get Custom File Hash Quota

  • Get Location

  • Get Sandbox Report Quota Usage Details

  • Get URL Filtering Rule

  • Get Web Application Rule

  • List DNS Control Rules

  • List Policy Web Applications

  • List Source IP Groups

  • Manage Blacklist

  • Update ATP Malicious URLs

  • Update Custom File Hashes

New steps and improvements

incident.io

A new step was added to the incident.io integration:

  • List Users

Shodan

Several new steps were added to the Shodan integration:

  • Get Network Alert Details

  • List Network Alerts

Torq Cases

Several new steps were added to the Torq Cases integration:

  • Create a quick action for an observable

  • Delete a quick action from an observable

  • List an observable's quick actions

  • Query cases across workspaces

Vectra

A new step was added to the Vectra integration:

  • Get Detection

The List Detections step has several new optional parameters:

  • Access token

  • Canonicalize: Return the response in canonical JSON format. JSON makes no guarantees on order, and fields may be reordered in transit; if there are problems, a non-canonicalized response is returned.

  • Certainty: Filter on certainty score.

  • Certainty gte: Filter on certainty score greater than or equal to this value.

  • Created timestamp gte: Filter on detections created on or after this value.

  • Created timestamp lte: Filter on detections created on or before this value.

  • Custom certificates PEM: The contents of a .pem file containing a self-signed certificate or certificate chain. Useful when connecting to local servers.

  • Detection: Filter on detection name.

  • Detection category: Filter on detection category.

  • Detection type: Filter on detection name (same behavior as detection per the docs).

  • Entity ID: Filter on entity ID.

  • Host ID: Filter on host ID attributed to a detection.

  • HTTP proxy: Your HTTP proxy URL. If you need to use a SOCKS proxy, set the HTTP_PROXY environment variable to socks5://....

  • HTTPS proxy: Your HTTPS proxy URL. If you need to use a SOCKS proxy, set the HTTPS_PROXY environment variable to socks5://....

  • ID: Filter on ID values provided.

  • Include info category: Include INFO-category detections.

  • Include src dst groups: Include source and destination groups in the response.

  • Is targeting key asset: Filter on detections targeting a key asset.

  • Is triaged: Filter on detections with associated Triage Rules.

  • Last timestamp: Filter on the time when the event was last detected.

  • Last timestamp gte: Filter on detections last detected on or after the provided time.

  • Last timestamp lte: Filter on detections last detected on or before the provided time.

  • Max ID: Filter on IDs less than or equal to Max ID.

  • Max retries: The maximum number of times a step will be retried. By default (-1), the step will keep retrying for up to 50 seconds.

  • Min ID: Filter on IDs greater than or equal to Min ID.

  • Ordering: Which field to use when ordering the results. Prefix with - for descending.

  • Page: A page number within the paginated result set.

  • Page size: Number of results to return per page.

  • Retry delay: Initial delay before retry attempts in seconds, exponential backoff calculation will be applied over this value.

  • Retry on status: If set, the step will automatically retry the request on the specified status codes. The maximum retry duration is 50 seconds.

  • Skip SSL verification: If set, request will not verify SSL certificates. Where applicable, it might be better to provide a self-signed certificate using the Custom certificates PEM parameter.

  • Src account ID: Filter on detections associated with a certain account.

  • Src IP: Filter on detection source IP address.

  • State: Filter on detection state.

  • Tags: Filter on detection tags.

  • Threat: Filter on threat score.

  • Threat gte: Filter on threat score greater than or equal to this value.

  • Timeout: Timeout for request in seconds. By default, timeout is 30 seconds.

  • Type: Filter on detection-associated entity type.

Related Articles
Did this answer your question?