Digital Guardian ARC Watchlist Integration
This pack integrates with Digital Guardian's Data Loss Prevention (DLP) platform Analytics & Reporting Cloud (ARC) solution to identify, remediate, and protect sensitive data from insider and outsider threats.
Automates event fetching from user-configured export profiles.
Allows for the execution of response actions to mitigate data loss risks without manual intervention.
This pack integrates with Digital Guardian's Data Loss Prevention (DLP) platform Analytics & Reporting Cloud (ARC) solution to identify, remediate, and protect sensitive data from insider and outsider threats.
Automates event fetching from user-configured export profiles.
Allows for the execution of response actions to mitigate data loss risks without manual intervention.
Customers can decide which events and alerts are integrated into Cortex XSIAM by selecting a Digital Guardian export profile when configuring the Digital Guardian ARC Event Collector, ensuring visibility to your individual SOC’s needs.
Events and logs fetched by the event collector can be accessed and queried by navigating to Incident response > Investigation > Query Builder.
| Name | Description |
|---|---|
Digital Guardian Destination DNS Domain | Digital Guardian Destination DNS Domain |
Digital Guardian Sensitivity | Digital Guardian Sensitivity |
Digital Guardian Computer Name | Digital Guardian Computer Name |
Digital Guardian Policy | Digital Guardian Policy |
Digital Guardian Filename | Digital Guardian Filename |
Digital Guardian Classification | Digital Guardian Classification |
Digital Guardian Email Subject | Digital Guardian Email Subject |
Digital Guardian ARC UID | Digital Guardian ARC UID |
Digital Guardian Source Address | Digital Guardian Source Address |
Digital Guardian Alarm Name | Digital Guardian Alarm Name |
Digital Guardian Username | Digital Guardian Username |
Digital Guardian Command line | Digital Guardian Command line |
Digital Guardian Remote Port | Digital Guardian Remote Port |
Digital Guardian Email Recipient | Digital Guardian Email Recipient |
Digital Guardian Source IP | Digital Guardian Source IP |
Digital Guardian Parent Process Name | Digital Guardian Parent Process Name |
Digital Guardian Process Name | Digital Guardian Process Name |
Digital Guardian Destination Address | Digital Guardian Destination Address |
Digital Guardian Threat Type | Digital Guardian Threat Type |
Digital Guardian Activity | Digital Guardian Activity |
Digital Guardian Attachment Filename | Digital Guardian Attachment Filename |
Digital Guardian Email Sender | Digital Guardian Email Sender |
| Name | Description |
|---|---|
Digital Guardian Security Event |
| Name | Description |
|---|---|
| Digital Guardian (Partner Contribution) | Use Digital Guardian Integration to fetch incidents and to programmatically add or remove entries from watchlists and component lists. |
| Name | Description |
|---|---|
Digital Guardian Security Event |
| Name | Description |
|---|---|
| Digital Guardian Demo Playbook | This playbook will show how to handle an exfiltration event through Digital Guardian by emailing a user's manager and adding the user to a DG Watchlist. |
| Name | Description |
|---|---|
Digital Guardian Sensitivity | Digital Guardian Sensitivity |
Digital Guardian Policy | Digital Guardian Policy |
Digital Guardian Classification | Digital Guardian Classification |
Digital Guardian Alarm Name | Digital Guardian Alarm Name |
Digital Guardian ARC UID | Digital Guardian ARC UID |
Digital Guardian Activity | Digital Guardian Activity |
Digital Guardian Threat Type | Digital Guardian Threat Type |
Digital Guardian Email Subject | Digital Guardian Email Subject |
| Name | Description |
|---|---|
Digital Guardian Security Event |
| Name | Description |
|---|---|
| Digital Guardian ARC Event Collector | Digital Guardian ARC event collector. |
| Digital Guardian (Partner Contribution) | Use Digital Guardian Integration to fetch incidents and to programmatically add or remove entries from watchlists and component lists. |
| Name | Description |
|---|---|
Digital Guardian ARC Modeling Rule |
| Name | Description |
|---|---|
| Digital Guardian Demo Playbook | This playbook will show how to handle an exfiltration event through Digital Guardian by emailing a user's manager and adding the user to a DG Watchlist. |
| Pack Name | Pack By |
|---|---|
| Active Directory Query | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Common Playbooks | By: Cortex XSOAR |
| Pack Name | Pack By |
|---|
| Pack Name | Pack By |
|---|---|
| Cortex REST API | By: Cortex XSOAR |
| Rasterize | By: Cortex XSOAR |
| Active Directory Query | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
| Common Playbooks | By: Cortex XSOAR |
| Certification | Certified | Read more |
| Supported By | Partner | |
| Created | November 25, 2020 | |
| Last Release | January 14, 2025 |
