Digital Guardian | Marketplace

Details
Content
Dependencies
Version History

Digital Guardian ARC Watchlist Integration

Incident Fields

Name	Description
Digital Guardian Username	Digital Guardian Username
Digital Guardian Parent Process Name	Digital Guardian Parent Process Name
Digital Guardian Activity	Digital Guardian Activity
Digital Guardian Destination Address	Digital Guardian Destination Address
Digital Guardian Attachment Filename	Digital Guardian Attachment Filename
Digital Guardian Sensitivity	Digital Guardian Sensitivity
Digital Guardian Process Name	Digital Guardian Process Name
Digital Guardian Alarm Name	Digital Guardian Alarm Name
Digital Guardian Remote Port	Digital Guardian Remote Port
Digital Guardian Email Subject	Digital Guardian Email Subject
Digital Guardian Computer Name	Digital Guardian Computer Name
Digital Guardian Filename	Digital Guardian Filename
Digital Guardian Email Sender	Digital Guardian Email Sender
Digital Guardian Email Recipient	Digital Guardian Email Recipient
Digital Guardian Threat Type	Digital Guardian Threat Type
Digital Guardian Command line	Digital Guardian Command line
Digital Guardian Source IP	Digital Guardian Source IP
Digital Guardian Policy	Digital Guardian Policy
Digital Guardian Source Address	Digital Guardian Source Address
Digital Guardian ARC UID	Digital Guardian ARC UID
Digital Guardian Destination DNS Domain	Digital Guardian Destination DNS Domain
Digital Guardian Classification	Digital Guardian Classification

Incident Types

Name	Description
Digital Guardian Security Event

Integrations

Name	Description
Digital Guardian (Partner Contribution)	Use Digital Guardian Integration to fetch incidents and to programmatically add or remove entries from watchlists and component lists.

Layouts

Name	Description
Digital Guardian Security Event

Playbooks

Name	Description
Digital Guardian Demo Playbook	This playbook will show how to handle an exfiltration event through Digital Guardian by emailing a user's manager and adding the user to a DG Watchlist.

Incident Fields

Name	Description
Digital Guardian Classification	Digital Guardian Classification
Digital Guardian Activity	Digital Guardian Activity
Digital Guardian Sensitivity	Digital Guardian Sensitivity
Digital Guardian Alarm Name	Digital Guardian Alarm Name
Digital Guardian ARC UID	Digital Guardian ARC UID
Digital Guardian Threat Type	Digital Guardian Threat Type
Digital Guardian Policy	Digital Guardian Policy
Digital Guardian Email Subject	Digital Guardian Email Subject

Incident Types

Name	Description
Digital Guardian Security Event

Integrations

Name	Description
Digital Guardian ARC Event Collector	Digital Guardian ARC event collector.
Digital Guardian (Partner Contribution)	Use Digital Guardian Integration to fetch incidents and to programmatically add or remove entries from watchlists and component lists.

Modeling Rules

Name	Description
Digital Guardian ARC Modeling Rule

Playbooks

Name	Description
Digital Guardian Demo Playbook	This playbook will show how to handle an exfiltration event through Digital Guardian by emailing a user's manager and adding the user to a DG Watchlist.

Required Content Packs (3)

Pack Name	Pack By
Active Directory Query	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (6)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	November 25, 2020
Last Release	June 19, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.