{"type":"doc","content":[{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-tabs-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"a9fa78bd-5d48-423a-98b5-a8140fcf50ea"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab-container.png"}}],"title":"Refined Tab Container"}},"localId":"329b2a15-c0ce-40d0-ad6b-d34adbf68664"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"JSON (Cloud Collector)"}},"macroMetadata":{"macroId":{"value":"10c9ec001fec90d8e807cf0699fd903dd8357948e030ede54b925c4037849799"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"bb9cf900-7fa3-4d41-a299-28bd57853479"}},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Replace the following placeholders:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": An identifier that should not exceed a length of 10-15 characters, i.e.: ","type":"text"},{"text":"123456abcdef","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Name of the environment from which the data is retrieved, i.e.: ","type":"text"},{"text":"prod","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"stage","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"dev","type":"text","marks":[{"type":"code"}]},{"text":", etc.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Obtained from the vendor","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Obtained from the vendor","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Obtained from the vendor","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": The starting timestamp in ISO8601 format since the collector is going to start retrieving messages","type":"text"}]}]}]}]},{"type":"codeBlock","content":[{"text":"{\n \"global_overrides\": {\n \"debug\": false\n },\n \"inputs\": {\n \"vectra_365\": {\n \"id\": \"\",\n \"enabled\": true,\n \"credentials\": {\n \"client_id\": \"\",\n \"client_secret\": \"\"\n },\n \"environment\": \"\",\n \"services\": {\n \"detections\": {\n \"vectra_365_portal_url\": \"\",\n \"start_time\": \"\",\n \"request_period_in_seconds\": 60\n }\n }\n }\n },\n \"behavior\": {\n \"custom\": {\n \"collector_globals\": {\n },\n \"inputs\": {\n \"vectra_365\": {\n \"authenticator\": {\n \"type\": \"oauth\",\n \"client_id\": \"client_id\",\n \"client_secret\": \"client_secret\",\n \"token_url\": \"https://{vectra_365_portal_url}/vectra_365/oauth2/token\"\n },\n \"services\": {\n \"detections\": {\n \"requester\": {\n \"url\": \"https://{vectra_365_portal_url}/vectra_365/api/v3/detections\",\n \"headers\": {\n \"Content-Type\": \"application/json\"\n }\n },\n \"paginator\": {\n \"type\": \"next_url\",\n \"config\": {\n \"request_page_size_field\": \"page_size\",\n \"request_page_size\": 10,\n \"request_location\": \"params\",\n \"response_location\": \"body\",\n \"response_page_field\": \"next\"\n }\n },\n \"retriever\": {\n \"type\": \"time_based\",\n \"config\": {\n \"time_window_interval_in_seconds\": 3600,\n \"timestamp_format\": \"%Y-%m-%dT%H:%M:%SZ\",\n \"result_path\": \"$.results.[*]\",\n \"response_max_data_size\": 10000000,\n \"response_timestamp_field\": \"last_timestamp\",\n \"response_unique_id_field\": \"id\",\n \"response_sort_order\": \"descending\",\n \"request_from_field\": \"last_timestamp_gte\",\n \"request_sort_field\": \"ordering\",\n \"request_sort_value\": \"last_timestamp\"\n }\n },\n \"processor\": {\n \"type\": \"time_based\",\n \"config\": {\n \"tag\": \"ndr.vectra.platform.detection\",\n \"response_timestamp_field\": \"last_timestamp\",\n \"response_sort_order\": \"descending\",\n \"response_unique_id_field\": \"id\"\n }\n }\n }\n }\n }\n }\n }\n }\n}","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"YAML & DOCKER IMAGE (On-premise)"}},"macroMetadata":{"macroId":{"value":"4a913b33c12a8775d611742f017e21dd0a97490c63ed959ea2882ec75dd3954e"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"21554b71-d17a-4a68-a399-13a1679c073c"}},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Replace the following placeholders:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Collector unique id, i.e: ","type":"text"},{"text":"collector-abcdefg-12345","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Collector name, i.e.: ","type":"text"},{"text":"vectra-collector-1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Devo platform endpoint, i.e.: ","type":"text"},{"text":"collector-eu.devo.io","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": The name of the certificate file, i.e.: ","type":"text"},{"text":"domain1.crt","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": The name of the key file, i.e.: ","type":"text"},{"text":"domain1.key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": An identifier that should not exceed a length of 10-15 characters, i.e.: ","type":"text"},{"text":"123456abcdef","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Name of the environment from which the data is retrieved, i.e.: ","type":"text"},{"text":"prod","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"stage","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"dev","type":"text","marks":[{"type":"code"}]},{"text":", etc.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Obtained from the vendor","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Obtained from the vendor","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": Obtained from the vendor","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": The starting timestamp in ISO8601 format since the collector is going to start retrieving messages","type":"text"}]}]}]}]},{"type":"codeBlock","content":[{"text":"globals:\n debug: false\n id: \n name: \n persistence:\n type: filesystem\n config:\n directory_name: state\n# type: redis\n# config:\n# host: host\n# port: port\n# password: password\n# db: db\n\noutputs:\n# devo_1:\n# type: devo_platform\n# config:\n# address: collector-us.devo.io\n# port: 443\n# type: SSL\n# chain: chain.crt\n# cert: .crt\n# key: .key\n# devo_2:\n# type: devo_platform\n# config:\n# address: collector-eu.devo.io\n# port: 443\n# type: SSL\n# chain: chain.crt\n# cert: .crt\n# key: .key\n# relay_1:\n# type: syslog\n# config:\n# address: 127.0.0.1\n# port: 13000\n# console_1:\n# type: console\n# config:\n# destination: standard\n console_2:\n type: console\n config:\n destination: null\n\ninputs:\n vectra_365:\n id: \n enabled: true\n credentials:\n client_id: \n client_secret: \n environment: \n services:\n detections:\n vectra_365_portal_url_value: \n start_time: # ISO 8601 format. i.e.: 2024-09-11T12:00:00Z\n request_period_in_seconds: 60\n\n########## DON'T MODIFY ANYTHING BELOW THIS LINE ##########\nbehavior:\n custom:\n collector_globals:\n requests_limits:\n - period: \"1d\"\n number_of_requests: -1\n - period: \"1h\"\n number_of_requests: -1\n - period: \"1m\"\n number_of_requests: -1\n - period: \"1s\"\n number_of_requests: -1\n\n inputs:\n vectra_365:\n requests_limits:\n - period: \"1d\"\n number_of_requests: -1\n - period: \"1h\"\n number_of_requests: -1\n - period: \"1m\"\n number_of_requests: -1\n - period: \"1s\"\n number_of_requests: -1\n authenticator:\n type: \"oauth\"\n client_id: \"client_id\"\n client_secret: \"client_secret\"\n token_url: \"https://{vectra_365_portal_url_value}/vectra_365/oauth2/token\"\n services:\n detections:\n requests_limits:\n - period: \"1d\"\n number_of_requests: -1\n - period: \"1h\"\n number_of_requests: -1\n - period: \"1m\"\n number_of_requests: -1\n - period: \"1s\"\n number_of_requests: -1\n requester:\n url: \"https://{vectra_365_portal_url_value}/vectra_365/api/v3/detections\"\n headers:\n Content-Type: \"application/json\"\n paginator:\n type: \"next_url\"\n config:\n request_page_size_field: \"page_size\"\n request_page_size: 10\n request_location: \"params\"\n response_location: \"body\"\n response_page_field: \"next\"\n retriever:\n type: \"time_based\"\n config:\n time_window_interval_in_seconds: 3600\n timestamp_format: \"%Y-%m-%dT%H:%M:%SZ\"\n result_path: \"$.results.[*]\"\n response_max_data_size: 10000000\n response_timestamp_field: \"last_timestamp\"\n response_unique_id_field: \"id\"\n response_sort_order: \"descending\"\n request_from_field: \"last_timestamp_gte\"\n request_sort_field: \"ordering\"\n request_sort_value: \"last_timestamp\"\n processor:\n type: \"time_based\"\n config:\n tag: \"ndr.vectra.platform.detection\"\n response_timestamp_field: \"last_timestamp\"\n response_sort_order: \"descending\"\n response_unique_id_field: \"id\"\n # tag_jsonpath: \"$.tag_field\"\n # deduplication: true\n # flattening: true\n # flatten_field: \"results","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"bfddc32e-90b3-45e6-9e4d-7e4a43412544"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Collector Docker image","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1},"content":[{"type":"paragraph","content":[{"text":"SHA-256 hash","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported