Secureworks® Taegis™ XDR currently supports the following playbooks:
☰
🌙☀
Subscribe to the Taegis™ XDR Documentation RSS Feed at .
Learn more about RSS readers or RSS browser extensions.
- Taegis Docs Home
- About XDR
- Getting Started
-
Integrate with XDR
- Integration Overview
- Data Source Integration Definitions
- All Available Integrations
- Add Data Collectors
-
Add Endpoint Agents
-
Taegis Endpoint Agent
- Introduction
- Beta Release Channel
- Groups
- Isolation Exceptions
- Agent Settings
- Downloads
- Supported OS and System Recommendations
- Agent Technical Details
- Installation Info and Prerequisites
- Windows Agent Installation
- macOS Agent Installation
- Linux Agent Installation
- Windows Agent Troubleshooting
- macOS Agent Troubleshooting
- Linux Agent Troubleshooting
- Agent Uninstall
- Agent FAQ
- Agent Known Issues
- Agent Changelog
- Taegis NGAV
- Red Cloak Endpoint Agent
- CrowdStrike
- Microsoft Defender for Endpoint
- SentinelOne
- VMware Carbon Black
- VMware Carbon Black Cloud Endpoint Standard and Enterprise EDR
- VMware Carbon Black Response Cloud
-
Taegis Endpoint Agent
-
Forward Data to XDR
- Akamai App and API Protector
- Akamai Enterprise Application Access
- Akamai Guardicore Segmentation
- AlienVault OTX
- Amazon GuardDuty
- Amazon CloudWatch Logs
- Amazon AWS ALB
- Amazon AWS CloudTrail
- Amazon AWS WAF Logs
- Amazon AWS VPC Flow Logs
- Amazon AWS Account ID
- Amazon AWS Lambda Deployment Test
- Amazon AWS Lambda Logs
- Amazon AWS Lambda Migration
- Amazon AWS Lambda Update
- Amazon AWS Add Lambda Trigger
- Amazon Multitenant CloudTrail Permissions
- Amazon S3 Event Archiving
- Anomali
- Aruba ClearPass
- Barracuda NGFW
- Barracuda WAF
- Cato Networks
- Check Point
- Cisco ASA
- Cisco Duo
- Cisco FTD Firewall
- Cisco IOS and NX-OS
- Cisco IronPort
- Cisco ISE
- Cisco Meraki
- Cisco Umbrella
- Citrix ADC
- Claroty
- Cloudflare
- Corelight
- CyberArk
- Darktrace
- Dragos
- F5 ASM WAF
- F5 LTM
- Forcepoint Firewall
- Forcepoint Web Security
- Fortinet Fortigate
- Fortinet FortiWeb
- Google Cloud Platform
- Google Workspace
- Imperva Cloud
- Imperva WAF
- Infoblox
- Juniper Pulse Secure
- Juniper SRX Firewall
- Lastline
- Linux Server
- McAfee ePO
- Microsoft Azure Active Directory Activity Reports
- Microsoft Azure Activity Log
- Microsoft Azure Firewall
- Microsoft Azure Front Door
- Microsoft Azure Application Gateway
- Microsoft Azure Event Hubs
- Microsoft DHCP
- Microsoft DNS
- Microsoft Entra Identity Protection
- Microsoft Graph Security API Alerts
- Microsoft IIS
- Microsoft Windows Event Log
- Microsoft Office 365 and Azure
- Microsoft Office 365 and Azure Data Availability
- Microsoft Office 365 and Azure Permissions
- Microsoft Office 365 Management API
- Mimecast
- Netskope
- Nozomi Guardian
- Okta
- OPNsense
- Palo Alto Firewall
- Proofpoint
- pfSense
- SCADAfence
- Skyhigh Secure Web Gateway
- SonicWall Firewall
- Sophos XG Firewall
- Suricata
- Symantec (Blue Coat) ProxySG
- Taegis NDR - Physical
- Taegis NDR - Virtual
- TAXII 2.1
- Trend Micro Deep Security
- VMWare vCenter
- WatchGuard Firewall
- Zscaler
- Create Custom Parsers
- Manage Integrations
-
Alerts, Events, and Investigations
- Alerts
- Events
- Investigations
- CyberChef
- Dashboards
-
Search and Reports
- Search
- Reports
-
Automation
- Automation Overview
- Supported Playbooks
- Supported Connectors
- Playbooks
- Connectors
-
Automation Authoring
- Building Connector Definitions
- Building Playbook Templates
- Common Expression Language (CEL)
-
Threat Intelligence, Hunting, and Detection
- Threat Intelligence
- Threat Hunting
-
Detectors
- Detector Overview
- Detector Test Alerts
- Account Compromise
- Bring Your Own Threat Intel
- Brute Force
- Business Email Compromise
- Cloud Recon to Change
- Cloud Watchlist
- Domain Watchlist
- Domain Generation Algorithms
- Email Watchlist
- Endpoint Watchlists
- File Analysis
- Hands-On-Keyboard
- Impossible Travel
- IP Watchlist
- Kerberoasting
- Network IDS
- Password Spray
- Penetration Test
- Portscanning and Broadscanning
- Punycode
- Quick Mail Consent (MS o365)
- Rare Program to Rare IP
- SharpHound
- Snapshot Exfiltration
- Stolen User Credentials
- Suspicious DNS Activity
- Tactic Graph
- Taegis NDR
- Taegis Watchlist
- Adversary Software Coverage
- Vulnerabilities
- XDR Admin
-
APIs, SDK, and Magic
- Using XDR GraphQL APIs
- API Authentication
- XDR Python SDK
- Taegis Magic Jupyter Integration
- Alerts API
- Assets API
- Audits API
- Automations APIs
- Bring Your Own Threat Intelligence API
- Collector APIs
- Investigations API
- Threat Intelligence API
- Using the Users GraphQL API
- Using the Tenants GraphQL API
- Using the Countermeasures API
- Using the File Upload API
- Power BI for XDR
-
Secureworks Products, Services, and Policies
-
Taegis NDR
- Overview
- Service Description
- Transitioning from CTP
- Legacy iSensor Service Descriptions
-
ManagedXDR
- Service Description
- Onboarding Guide
- Proactive Response
- Addendum - Secureworks Services for ManagedXDR
- FAQ
- ManagedXDR Plus
- ManagedXDR Elite
- ManagedXDR for OT
- ManagedXDR Enhanced
- Secureworks Professional Services
- Legal
-
Taegis NDR