Provides view of raised alerts within ZTAP.
The backbone of highly effective managed detection and response (MDR) is the Zero Trust Analytics Platform (ZTAP) utilized by elite security analysts to resolve every alert.
What does this pack do?
This pack enables you to:
- Sync and update escalated ZTAP alerts.
- Respond to Critical Start analysts directly from the XSOAR platform.
This pack includes the integration, the ZTAP Alert incident type, and an incident layout that displays information.
Custom Classifier
If using a custom classifier the following fields are required for bidirectional sync
| Input Field |
Output Field |
| xsoar_mirror_id |
dbotMirrorId |
| xsoar_mirror_direction |
dbotMirrorDirection |
| xsoar_mirror_instance |
dbotMirrorInstance |
| xsoar_mirror_last_sync |
dbotMirrorLastSync |
| xsoar_mirror_tags |
dbotMirrorTags |
Custom Playbook
If using a custom playbook comments from before the alert was escalated will not be fetched.
In order to fetch them call ztap-get-alert-entries during initial processing.
Note that the escalation comment will be fetched during this step.
The backbone of highly effective managed detection and response (MDR) is the Zero Trust Analytics Platform (ZTAP) utilized by elite security analysts to resolve every alert.
What does this pack do?
This pack enables you to:
- Sync and update escalated ZTAP alerts.
- Respond to Critical Start analysts directly from the XSOAR platform.
This pack includes the integration, the ZTAP Alert incident type, and an incident layout that displays information.
Custom Classifier
If using a custom classifier the following fields are required for bidirectional sync
| Input Field |
Output Field |
| xsoar_mirror_id |
dbotMirrorId |
| xsoar_mirror_direction |
dbotMirrorDirection |
| xsoar_mirror_instance |
dbotMirrorInstance |
| xsoar_mirror_last_sync |
dbotMirrorLastSync |
| xsoar_mirror_tags |
dbotMirrorTags |
Custom Playbook
If using a custom playbook comments from before the alert was escalated will not be fetched.
In order to fetch them call ztap-get-alert-entries during initial processing.
Note that the escalation comment will be fetched during this step.
