Digital Guardian ARC Watchlist Integration
This pack integrates with Digital Guardian's Data Loss Prevention (DLP) platform Analytics & Reporting Cloud (ARC) solution to identify, remediate, and protect sensitive data from insider and outsider threats.
Automates event fetching from user-configured export profiles.
Allows for the execution of response actions to mitigate data loss risks without manual intervention.
This pack integrates with Digital Guardian's Data Loss Prevention (DLP) platform Analytics & Reporting Cloud (ARC) solution to identify, remediate, and protect sensitive data from insider and outsider threats.
Automates event fetching from user-configured export profiles.
Allows for the execution of response actions to mitigate data loss risks without manual intervention.
Customers can decide which events and alerts are integrated into Cortex XSIAM by selecting a Digital Guardian export profile when configuring the Digital Guardian ARC Event Collector, ensuring visibility to your individual SOC’s needs.
Events and logs fetched by the event collector can be accessed and queried by navigating to Incident response > Investigation > Query Builder.
| Name | Description |
|---|---|
Digital Guardian Alarm Name | Digital Guardian Alarm Name |
Digital Guardian Activity | Digital Guardian Activity |
Digital Guardian Username | Digital Guardian Username |
Digital Guardian ARC UID | Digital Guardian ARC UID |
Digital Guardian Email Subject | Digital Guardian Email Subject |
Digital Guardian Parent Process Name | Digital Guardian Parent Process Name |
Digital Guardian Destination DNS Domain | Digital Guardian Destination DNS Domain |
Digital Guardian Email Recipient | Digital Guardian Email Recipient |
Digital Guardian Sensitivity | Digital Guardian Sensitivity |
Digital Guardian Source Address | Digital Guardian Source Address |
Digital Guardian Command line | Digital Guardian Command line |
Digital Guardian Threat Type | Digital Guardian Threat Type |
Digital Guardian Process Name | Digital Guardian Process Name |
Digital Guardian Computer Name | Digital Guardian Computer Name |
Digital Guardian Remote Port | Digital Guardian Remote Port |
Digital Guardian Destination Address | Digital Guardian Destination Address |
Digital Guardian Email Sender | Digital Guardian Email Sender |
Digital Guardian Filename | Digital Guardian Filename |
Digital Guardian Source IP | Digital Guardian Source IP |
Digital Guardian Classification | Digital Guardian Classification |
Digital Guardian Policy | Digital Guardian Policy |
Digital Guardian Attachment Filename | Digital Guardian Attachment Filename |
| Name | Description |
|---|---|
Digital Guardian Security Event |
| Name | Description |
|---|---|
| Digital Guardian (Partner Contribution) | Use Digital Guardian Integration to fetch incidents and to programmatically add or remove entries from watchlists and component lists. |
| Name | Description |
|---|---|
Digital Guardian Security Event |
| Name | Description |
|---|---|
| Digital Guardian Demo Playbook | This playbook will show how to handle an exfiltration event through Digital Guardian by emailing a user's manager and adding the user to a DG Watchlist. |
| Name | Description |
|---|---|
Digital Guardian Policy | Digital Guardian Policy |
Digital Guardian Email Subject | Digital Guardian Email Subject |
Digital Guardian Classification | Digital Guardian Classification |
Digital Guardian Alarm Name | Digital Guardian Alarm Name |
Digital Guardian Threat Type | Digital Guardian Threat Type |
Digital Guardian Activity | Digital Guardian Activity |
Digital Guardian ARC UID | Digital Guardian ARC UID |
Digital Guardian Sensitivity | Digital Guardian Sensitivity |
| Name | Description |
|---|---|
Digital Guardian Security Event |
| Name | Description |
|---|---|
| Digital Guardian ARC Event Collector | Digital Guardian ARC event collector. |
| Digital Guardian (Partner Contribution) | Use Digital Guardian Integration to fetch incidents and to programmatically add or remove entries from watchlists and component lists. |
| Name | Description |
|---|---|
Digital Guardian ARC Modeling Rule |
| Name | Description |
|---|---|
| Digital Guardian Demo Playbook | This playbook will show how to handle an exfiltration event through Digital Guardian by emailing a user's manager and adding the user to a DG Watchlist. |
| Pack Name | Pack By |
|---|---|
| Active Directory Query | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Common Playbooks | By: Cortex XSOAR |
| Pack Name | Pack By |
|---|
| Pack Name | Pack By |
|---|---|
| Filters And Transformers | By: Cortex XSOAR |
| Rasterize | By: Cortex XSOAR |
| Active Directory Query | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Aggregated Scripts | By: Cortex XSOAR |
| Cortex REST API | By: Cortex XSOAR |
| Common Playbooks | By: Cortex XSOAR |
demisto option to the Export Profiles multi-select dropdown in the configuration parameters.
| Certification | Certified | Read more |
| Supported By | Partner | |
| Created | November 25, 2020 | |
| Last Release | April 27, 2026 |
