JSON (Cloud Collector)

Replace the following placeholders:

<short_unique_input_id>: An identifier that should not exceed a length of 10-15 characters, i.e.: 123456abcdef
<environment_value>: Name of the environment from which the data is retrieved, i.e.: prod, stage, dev, etc.
<client_id_value>: Obtained from the vendor
<client_id_value>: Obtained from the vendor
<vectra_365_portal_url_value>: Obtained from the vendor
<start_time_value>: The starting timestamp in ISO8601 format since the collector is going to start retrieving messages

", "enabled": true, "credentials": { "client_id": "", "client_secret": "" }, "environment": "", "services": { "detections": { "vectra_365_portal_url": "", "start_time": "", "request_period_in_seconds": 60 } } } }, "behavior": { "custom": { "collector_globals": { }, "inputs": { "vectra_365": { "authenticator": { "type": "oauth", "client_id": "client_id", "client_secret": "client_secret", "token_url": "https://{vectra_365_portal_url}/vectra_365/oauth2/token" }, "services": { "detections": { "requester": { "url": "https://{vectra_365_portal_url}/vectra_365/api/v3/detections", "headers": { "Content-Type": "application/json" } }, "paginator": { "type": "next_url", "config": { "request_page_size_field": "page_size", "request_page_size": 10, "request_location": "params", "response_location": "body", "response_page_field": "next" } }, "retriever": { "type": "time_based", "config": { "time_window_interval_in_seconds": 3600, "timestamp_format": "%Y-%m-%dT%H:%M:%SZ", "result_path": "$.results.[*]", "response_max_data_size": 10000000, "response_timestamp_field": "last_timestamp", "response_unique_id_field": "id", "response_sort_order": "descending", "request_from_field": "last_timestamp_gte", "request_sort_field": "ordering", "request_sort_value": "last_timestamp" } }, "processor": { "type": "time_based", "config": { "tag": "ndr.vectra.platform.detection", "response_timestamp_field": "last_timestamp", "response_sort_order": "descending", "response_unique_id_field": "id" } } } } } } } } }]]>

YAML & DOCKER IMAGE (On-premise)

Replace the following placeholders:

<collector_unique_id>: Collector unique id, i.e: collector-abcdefg-12345
<collector_unique_name>: Collector name, i.e.: vectra-collector-1
<devo_domain_relay_endpoint>: Devo platform endpoint, i.e.: collector-eu.devo.io
<devo_domain_crt>: The name of the certificate file, i.e.: domain1.crt
<devo_domain_key>: The name of the key file, i.e.: domain1.key
<short_unique_input_id>: An identifier that should not exceed a length of 10-15 characters, i.e.: 123456abcdef
<environment_value>: Name of the environment from which the data is retrieved, i.e.: prod, stage, dev, etc.
<client_id_value>: Obtained from the vendor
<client_id_value>: Obtained from the vendor
<vectra_365_portal_url_value>: Obtained from the vendor
<start_time_value>: The starting timestamp in ISO8601 format since the collector is going to start retrieving messages

name: persistence: type: filesystem config: directory_name: state # type: redis # config: # host: host # port: port # password: password # db: db outputs: # devo_1: # type: devo_platform # config: # address: collector-us.devo.io # port: 443 # type: SSL # chain: chain.crt # cert: .crt # key: .key # devo_2: # type: devo_platform # config: # address: collector-eu.devo.io # port: 443 # type: SSL # chain: chain.crt # cert: .crt # key: .key # relay_1: # type: syslog # config: # address: 127.0.0.1 # port: 13000 # console_1: # type: console # config: # destination: standard console_2: type: console config: destination: null inputs: vectra_365: id: enabled: true credentials: client_id: client_secret: environment: services: detections: vectra_365_portal_url_value: start_time: # ISO 8601 format. i.e.: 2024-09-11T12:00:00Z request_period_in_seconds: 60 ########## DON'T MODIFY ANYTHING BELOW THIS LINE ########## behavior: custom: collector_globals: requests_limits: - period: "1d" number_of_requests: -1 - period: "1h" number_of_requests: -1 - period: "1m" number_of_requests: -1 - period: "1s" number_of_requests: -1 inputs: vectra_365: requests_limits: - period: "1d" number_of_requests: -1 - period: "1h" number_of_requests: -1 - period: "1m" number_of_requests: -1 - period: "1s" number_of_requests: -1 authenticator: type: "oauth" client_id: "client_id" client_secret: "client_secret" token_url: "https://{vectra_365_portal_url_value}/vectra_365/oauth2/token" services: detections: requests_limits: - period: "1d" number_of_requests: -1 - period: "1h" number_of_requests: -1 - period: "1m" number_of_requests: -1 - period: "1s" number_of_requests: -1 requester: url: "https://{vectra_365_portal_url_value}/vectra_365/api/v3/detections" headers: Content-Type: "application/json" paginator: type: "next_url" config: request_page_size_field: "page_size" request_page_size: 10 request_location: "params" response_location: "body" response_page_field: "next" retriever: type: "time_based" config: time_window_interval_in_seconds: 3600 timestamp_format: "%Y-%m-%dT%H:%M:%SZ" result_path: "$.results.[*]" response_max_data_size: 10000000 response_timestamp_field: "last_timestamp" response_unique_id_field: "id" response_sort_order: "descending" request_from_field: "last_timestamp_gte" request_sort_field: "ordering" request_sort_value: "last_timestamp" processor: type: "time_based" config: tag: "ndr.vectra.platform.detection" response_timestamp_field: "last_timestamp" response_sort_order: "descending" response_unique_id_field: "id" # tag_jsonpath: "$.tag_field" # deduplication: true # flattening: true # flatten_field: "results]]>

Collector Docker image	SHA-256 hash

Vectra 365 integration