Darktrace Respond collector
- Juan Tomás Alonso Nieto (Deactivated)
- MD Tausif
[ Overview ] [ Devo collector features ] [ Data sources ] [ Flattening preprocessing ] [ Vendor setup ] [ Minimum configuration required for basic pulling ] [ Accepted authentication methods ] [ Run the collector ] [ Collector services detail ] [ Collector operations ] [ Change log ]
Overview
Darktrace RESPOND works autonomously to disarm attacks whenever they occur. Reacts to threats in seconds, working 24/7 as it frees up security teams and resources.
Darktrace Self-Learning AI delivers precise information about what’s not normal to your organization. Darktrace RESPOND takes precise action to neutralize threats against any and every asset, no matter where data resides.
Devo collector features
Feature | Details |
|---|---|
Allow parallel downloading ( |
|
Running environments |
|
Populated Devo events |
|
Flattening preprocessing |
|
Allowed source events obfuscation |
|
Data sources
Data source | Description | API endpoint | Collector service name | Devo table | Available from release |
|---|---|---|---|---|---|
Antigena Actions | Gives information about current and past Darktrace RESPOND/Network (formerly Antigena Network) actions. |
|
|
|
|
AiAnalyst Incident Events | Provides access to AI Analyst events - a group of anomalies or network activity investigated by Cyber AI Analyst. |
|
|
|
|
Summary Statistics | Returns simple statistics on device counts, processed bandwidth and the number of active Darktrace RESPOND actions. |
|
|
|
|
Status | Detailed system health information from the Status page . |
|
|
|
|
Modelbreaches | Returns a time-sorted list of model breaches, filtered by the specified parameters. |
|
|
|
|
For more information on how the events are parsed, visit our page.
Flattening preprocessing
Data source | Collector service | Optional | Flattening details |
|---|---|---|---|
Status | status | Yes | Original : "time":"2023-05-31 09:37",
"installed":"2022-06-15",
"mobileAppConfigured":false,
"version":"6.0.32 (a1c388)",
"ipAddress":"172.27.24.26",
"modelsUpdated":"2023-05-30 18:46:46",
"modelPackageVersion":"6.0.23-1019~20230530170515~g6d5204",
"bundleVersion":"60076",
"instances":{
"1":{
"id":1,
"downCount":1,
"upCount":1,
"downTimeMs":1685514150000000,
"downTime":"2023-05-31 06:22:30",
"version":"6.0.32 (a1c388)",
"ipAddress":"172.27.24.26",
}
"2":{
"id":2,
"downCount":8,
"upCount":8,
"downTimeMs":1685516996000000,
"downTime":"2023-05-31 07:09:56",
"version":"6.0.32 (a1c388)",
"ipAddress":"10.32.1.99",
}
}Result: "time":"2023-05-31 09:37",
"installed":"2022-06-15",
"mobileAppConfigured":false,
"version":"6.0.32 (a1c388)",
"ipAddress":"172.27.24.26",
"modelsUpdated":"2023-05-30 18:46:46",
"modelPackageVersion":"6.0.23-1019~20230530170515~g6d5204",
"bundleVersion":"60076",
'instance_info': {'id': 2, 'downCount': 8, 'upCount': 8, 'downTimeMs': 1685516996000000, 'downTime': '2023-05-31 07:09:56', 'version': '6.0.32 (a1c388)', 'ipAddress': '10.32.1.99'} |
Vendor setup
A Darktrace user with Unrestricted Devices and Visualizer role.
Action | Steps |
Obtain an API-Token Pair |
Both tokens are required to generate the DT-API-Signature value, which must be passed with every API request made to the appliance, so make sure you record them securely. |
Minimum configuration required for basic pulling
Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.
This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.
Setting | Details |
|---|---|
| The Darktrace Respond API base URL (for example, https://euw1-1234-01.cloud.darktrace.com ). |
| The token obtained from Daktrace Respond for authentication. |
| The token obtained from Daktrace Respond for authentication. |
Accepted authentication methods
Authentication method | Public token | Private token | Base URL |
API-token pair | Required | Required | Required |
Run the collector
Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).
Collector services detail
This section is intended to explain how to proceed with specific actions for services.
Events service
Collector operations
This section is intended to explain how to proceed with specific operations of this collector.
Change log
Release | Released on | Release type | Details | Recommendations |
|---|---|---|---|---|
| Nov 19, 2024 | Improvement | Improvements
|
|
| May 11, 2023 | FIRST RELEASE | Released the first version of the Darktrace Respond collector. |
|