☰

🌙☀

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Taegis Docs Home
About XDR
Getting Started
Integrate with XDR
- Integration Overview
- All Available Integration Guides
- Add Data Collectors
- Add Endpoint Agents
  - Taegis Endpoint Agent
  - Taegis NGAV
    - Taegis NGAV
    - Taegis NGAV FAQ
  - Red Cloak Endpoint Agent
  - CrowdStrike
  - Microsoft Defender for Endpoint
  - SentinelOne
  - VMware Carbon Black
  - VMware Carbon Black Cloud Endpoint Standard and Enterprise EDR
  - VMware Carbon Black Response Cloud
- Add Data Sources
  - Custom Integrations
    - Custom Transport Methods Overview
    - Transport via Event Hubs
    - Transport via File Upload API
    - Transport via HTTP Ingest
    - Transport via Secureworks-Managed S3
    - Transport via Syslog
    - Transport via Azure Storage Account
  - Integrate with AWS
    - AWS Overview
    - Amazon CloudWatch Logs
    - Amazon GuardDuty
    - Amazon AWS ALB
    - Amazon AWS CloudTrail
    - Amazon AWS VPC Flow Logs
    - Amazon AWS WAF Logs
    - Amazon S3 Event Archiving
  - AWS Supporting Documents
    - Amazon AWS Account ID
    - Amazon AWS Lambda Deployment Test
    - Amazon AWS Lambda Logs
    - Amazon AWS Lambda Migration
    - Amazon AWS Lambda Update
    - Amazon AWS Add Lambda Trigger
    - Amazon Multitenant CloudTrail Permissions
  - Integrate with Azure
    - Azure Overview
    - Microsoft Azure Active Directory Activity Reports
    - Microsoft Azure Activity Log
    - Microsoft Azure Application Gateway
    - Microsoft Azure Event Hubs
    - Microsoft Azure Firewall
    - Microsoft Azure Flow Logs
    - Microsoft Azure Front Door
    - Microsoft Azure Storage Account
  - Azure & Office 365 Supporting Documents
    - Microsoft Office 365 and Azure Data Availability
    - Microsoft Office 365 and Azure Permissions
  - Integrate with GCP
    - GCP Overview
    - Google Cloud Platform
  - Integrate with OCI
    - Oracle Cloud Infrastructure
  - Cloud API Integration Updates
    - Cloud API Integration Update Overview
    - Update Cloud API Integrations
  - Abnormal Inbound Email Security
  - Akamai App and API Protector
  - Akamai Enterprise Application Access
  - Akamai Guardicore Segmentation
  - AlienVault OTX
  - Anomali
  - Aruba ClearPass
  - Barracuda NGFW
  - Barracuda WAF
  - Cato Networks
  - Check Point
  - Cisco ASA
  - Cisco Duo
  - Cisco FTD Firewall
  - Cisco IOS and NX-OS
  - Cisco IronPort
  - Cisco ISE
  - Cisco Meraki
  - Cisco Umbrella
  - Citrix ADC
  - Claroty
  - Cloudflare
  - Corelight
  - CyberArk
  - Darktrace
  - Dragos
  - F5 ASM WAF
  - F5 LTM
  - Forcepoint Firewall
  - Forcepoint Web Security
  - Fortinet Fortigate
  - Fortinet FortiWeb
  - Google Workspace
  - HTTP Ingest
  - Imperva Cloud
  - Imperva WAF
  - Infoblox
  - Juniper Pulse Secure
  - Juniper SRX Firewall
  - Lastline
  - Linux Server
  - McAfee ePO
  - Microsoft DHCP
  - Microsoft DNS
  - Microsoft Entra Identity Protection
  - Microsoft Graph Security API Alerts
  - Microsoft IIS
  - Microsoft Office 365 Management API
  - Microsoft Windows Event Log
  - Mimecast
  - Netskope
  - Nozomi Guardian
  - Okta
  - OPNsense
  - Palo Alto Firewall
  - Palo Alto Prisma Access
  - Proofpoint
  - pfSense
  - S3 Ingest - Secureworks-Managed
  - SCADAfence
  - Skyhigh Secure Web Gateway
  - Snowflake
  - SonicWall Firewall
  - Sophos XG Firewall
  - Suricata
  - Symantec Endpoint Protection
  - Symantec (Blue Coat) ProxySG
  - Taegis NDR - Physical
  - Taegis NDR - Virtual
  - TAXII 2.1
  - Trend Micro Deep Security
  - VMWare vCenter
  - WatchGuard Firewall
  - Zscaler
- Create Custom Parsers
  - Overview
  - Syntax
  - Repeating Fields
  - Overriding and Extending Global Parsers
  - Supported Schemas
  - All Schemas
    - Antivirus
    - Auth
    - CloudAudit
    - DHCP
    - DNS
    - Email
    - Encrypt
    - FileMod
    - HTTP
    - Management Event
    - Netflow
    - NIDS
    - Process
    - Registry
    - Thirdparty
    - Types
Manage Integrations
Alerts, Events, and Investigations
- Alerts
- Events
- Investigations
- Explore an Entity Graph
- CyberChef
Dashboards
Search and Reports
- Search
- Reports
Automation
- Automation Overview
- Supported Playbooks
- Supported Connectors
- Actions
- Playbooks
- Connectors
- Automation Authoring
  - Building Connector Definitions
  - Building Playbook Templates
- Common Expression Language (CEL)
Threat Intelligence, Hunting, and Detection
- Threat Intelligence
- Threat Hunting
  - Hunting with Jupyter Notebooks
- Detectors
- Adversary Software Coverage
  - Adversary Software Coverage
  - Frequently Asked Questions
Vulnerabilities
- Vulnerability Management
Identity
XDR Admin
- Your Account
- Tenant Settings
APIs, SDK, and Magic
- Using XDR GraphQL APIs
- API Authentication
- XDR Python SDK
- Taegis Magic Jupyter Integration
  - Overview
- Alerts API
  - Using the Alerts API
  - Alerts GraphQL API
- Assets API
- Audits API
  - Using the Audits API
  - Audits GraphQL API
- Automations APIs
- Bring Your Own Threat Intelligence API
  - Using the BYOTI API
  - BYOTI GraphQL API
- Collector APIs
- Investigations API
- Threat Intelligence API
  - Using the Threat Intelligence API
  - Threat Intelligence GraphQL API
- Using the Users GraphQL API
- Using the Tenants GraphQL API
- Using the Countermeasures API
- Using the File Upload API
- Using the Notifications API
- Power BI for XDR
Secureworks Products, Services, and Policies
- Taegis NDR
  - Overview
  - Service Description
  - Transitioning from CTP
  - Legacy iSensor Service Descriptions
    - Managed iSensor
    - Managed iSensor Add-on
- ManagedXDR
- ManagedXDR Plus
- Elite Threat Hunting
  - Service Description
  - Onboarding Guide
- ManagedXDR for OT
- ManagedXDR Enhanced
  - Service Description
  - Onboarding Guide
- Secureworks Professional Services
- Legal

Custom Parsers Schemas

The following are supported schemas that can be used with Custom Parsers in Secureworks® Taegis™ XDR.