Vectra Respond UX - Entity Scoring

Overview

Vectra Respond UX delivers an intuitive, AI-driven interface for seamless threat investigation and response. It provides real-time visibility, guided workflows and automated remediation actions to accelerate incident resolution.

• Vendor: Vectra
• Supported environment: SaaS
• Supported application or feature: Entities scoring

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

Configure

This setup guide will show you how to forward logs produced by your Vectra Appliance server to Sekoia.io by means of an rsyslog transport channel.

How to create credentials

1. Log in to the Vectra Respond UX
2. Go to Manage > API Clients
3. Click Add API Client
4. Type a name, select a Role and type a description
5. Click Generate Credentials
6. Copy the Client ID and Secret Key

Create the intake

1. Go to the intake page and create a new intake from the format Vectra Response UX Entity Scoring.
2. Set up the intake configuration with the base URL of the API, your client id and your client secret.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

test_account_scoringtest_host_scoring

{
    "id": 1111,
    "entity_id": 333,
    "name": "O365:john.doe@example.org",
    "breadth_contrib": 0,
    "importance": 1,
    "type": "account",
    "is_prioritized": false,
    "severity": "Low",
    "urgency_score": 30,
    "velocity_contrib": 0,
    "attack_rating": 1,
    "active_detection_types": [
        "M365 Unusual eDiscovery Search"
    ],
    "category": "ACCOUNT SCORING",
    "url": "https://test.uw2.portal.vectra.ai/accounts/333",
    "event_timestamp": "2024-08-13T20:43:59Z",
    "last_detection": {
        "id": 444,
        "type": "M365 Unusual eDiscovery Search",
        "url": "https://test.uw2.portal.vectra.ai/detections/444"
    }
}

{
    "id": 1111,
    "entity_id": 2222,
    "name": "hostname",
    "breadth_contrib": 0,
    "importance": 1,
    "type": "host",
    "is_prioritized": false,
    "severity": "Low",
    "urgency_score": 30,
    "velocity_contrib": 0,
    "attack_rating": 1,
    "active_detection_types": [],
    "category": "HOST_SCORING",
    "url": "https://test.uw2.portal.vectra.ai/hosts/2222",
    "event_timestamp": "2024-11-17T13:04:46Z",
    "last_detection": {
        "id": null,
        "type": null,
        "url": null
    }
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

No related built-in rules was found. This message is automatically generated.

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
Application logs	None

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	``
Category	configuration
Type	change

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

test_account_scoring.jsontest_host_scoring.json

{
    "message": "{\"id\": 1111, \"entity_id\": 333, \"name\": \"O365:john.doe@example.org\", \"breadth_contrib\": 0, \"importance\": 1, \"type\": \"account\", \"is_prioritized\": false, \"severity\": \"Low\", \"urgency_score\": 30, \"velocity_contrib\": 0, \"attack_rating\": 1, \"active_detection_types\": [\"M365 Unusual eDiscovery Search\"], \"category\": \"ACCOUNT SCORING\", \"url\": \"https://test.uw2.portal.vectra.ai/accounts/333\", \"event_timestamp\": \"2024-08-13T20:43:59Z\", \"last_detection\": {\"id\": 444, \"type\": \"M365 Unusual eDiscovery Search\", \"url\": \"https://test.uw2.portal.vectra.ai/detections/444\"}}",
    "event": {
        "category": [
            "configuration"
        ],
        "dataset": "entity_scoring",
        "reference": "https://test.uw2.portal.vectra.ai/accounts/333",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2024-08-13T20:43:59Z",
    "observer": {
        "product": "Vectra Respond UX",
        "vendor": "Vectra"
    },
    "related": {
        "user": [
            "john.doe@example.org"
        ]
    },
    "user": {
        "name": "john.doe@example.org",
        "risk": {
            "static_level": "Low",
            "static_score": 30
        }
    },
    "vectra": {
        "entity_scoring": {
            "account": {
                "provider": "O365"
            },
            "attack_rating": 1,
            "category": "ACCOUNT SCORING",
            "importance": 1,
            "is_prioritized": false,
            "last_detection": {
                "id": 444,
                "type": "M365 Unusual eDiscovery Search",
                "url": "https://test.uw2.portal.vectra.ai/detections/444"
            },
            "type": "account"
        }
    }
}

{
    "message": "{\"id\": 1111, \"entity_id\": 2222, \"name\": \"hostname\", \"breadth_contrib\": 0, \"importance\": 1, \"type\": \"host\", \"is_prioritized\": false, \"severity\": \"Low\", \"urgency_score\": 30, \"velocity_contrib\": 0, \"attack_rating\": 1, \"active_detection_types\": [], \"category\": \"HOST_SCORING\", \"url\": \"https://test.uw2.portal.vectra.ai/hosts/2222\", \"event_timestamp\": \"2024-11-17T13:04:46Z\", \"last_detection\": {\"id\": null, \"type\": null, \"url\": null}}",
    "event": {
        "category": [
            "configuration"
        ],
        "dataset": "entity_scoring",
        "reference": "https://test.uw2.portal.vectra.ai/hosts/2222",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2024-11-17T13:04:46Z",
    "host": {
        "name": "hostname",
        "risk": {
            "static_level": "Low",
            "static_score": 30
        }
    },
    "observer": {
        "product": "Vectra Respond UX",
        "vendor": "Vectra"
    },
    "vectra": {
        "entity_scoring": {
            "attack_rating": 1,
            "category": "HOST_SCORING",
            "importance": 1,
            "is_prioritized": false,
            "type": "host"
        }
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
@timestamp	date	Date/time when the event originated.
event.category	keyword	Event category. The second categorization field in the hierarchy.
event.dataset	keyword	Name of the dataset.
event.reference	keyword	Event reference URL
event.type	keyword	Event type. The third categorization field in the hierarchy.
host.name	keyword	Name of the host.
observer.product	keyword	The product name of the observer.
observer.vendor	keyword	Vendor name of the observer.
user.name	keyword	Short name or login of the user.
vectra.entity_scoring.account.provider	keyword
vectra.entity_scoring.attack_rating	integer
vectra.entity_scoring.category	keyword
vectra.entity_scoring.importance	integer
vectra.entity_scoring.is_prioritized	boolean
vectra.entity_scoring.last_detection.id	integer
vectra.entity_scoring.last_detection.type	keyword
vectra.entity_scoring.last_detection.url	keyword
vectra.entity_scoring.type	keyword

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.

Further Readings

• Vectra Platform API Quick Start Tutorial