Taegis™ ManagedXDR Onboarding

☰

🌙☀

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Taegis Docs Home
About XDR
Getting Started
Integrate with XDR
- Integration Overview
- All Available Integration Guides
- Add Data Collectors
- Add Endpoint Agents
  - Taegis Endpoint Agent
  - Taegis NGAV
    - Taegis NGAV
    - Taegis NGAV FAQ
  - Red Cloak Endpoint Agent
  - CrowdStrike
  - Microsoft Defender for Endpoint
  - SentinelOne
  - VMware Carbon Black
  - VMware Carbon Black Cloud Endpoint Standard and Enterprise EDR
  - VMware Carbon Black Response Cloud
- Add Data Sources
  - Custom Integrations
    - Custom Transport Methods Overview
    - Transport via Event Hubs
    - Transport via File Upload API
    - Transport via HTTP Ingest
    - Transport via Secureworks-Managed S3
    - Transport via Syslog
    - Transport via Azure Storage Account
  - Integrate with AWS
    - AWS Overview
    - Amazon CloudWatch Logs
    - Amazon GuardDuty
    - Amazon AWS ALB
    - Amazon AWS CloudTrail
    - Amazon AWS VPC Flow Logs
    - Amazon AWS WAF Logs
    - Amazon S3 Event Archiving
  - AWS Supporting Documents
    - Amazon AWS Account ID
    - Amazon AWS Lambda Deployment Test
    - Amazon AWS Lambda Logs
    - Amazon AWS Lambda Migration
    - Amazon AWS Lambda Update
    - Amazon AWS Add Lambda Trigger
    - Amazon Multitenant CloudTrail Permissions
  - Integrate with Azure
    - Azure Overview
    - Microsoft Azure Active Directory Activity Reports
    - Microsoft Azure Activity Log
    - Microsoft Azure Application Gateway
    - Microsoft Azure Event Hubs
    - Microsoft Azure Firewall
    - Microsoft Azure Flow Logs
    - Microsoft Azure Front Door
    - Microsoft Azure Storage Account
  - Azure & Office 365 Supporting Documents
    - Microsoft Office 365 and Azure Data Availability
    - Microsoft Office 365 and Azure Permissions
  - Integrate with GCP
    - GCP Overview
    - Google Cloud Platform
  - Integrate with OCI
    - Oracle Cloud Infrastructure
  - Cloud API Integration Updates
    - Cloud API Integration Update Overview
    - Update Cloud API Integrations
  - Abnormal Inbound Email Security
  - Akamai App and API Protector
  - Akamai Enterprise Application Access
  - Akamai Guardicore Segmentation
  - AlienVault OTX
  - Anomali
  - Aruba ClearPass
  - Barracuda NGFW
  - Barracuda WAF
  - Cato Networks
  - Check Point
  - Cisco ASA
  - Cisco Duo
  - Cisco FTD Firewall
  - Cisco IOS and NX-OS
  - Cisco IronPort
  - Cisco ISE
  - Cisco Meraki
  - Cisco Umbrella
  - Citrix ADC
  - Claroty
  - Cloudflare
  - Corelight
  - CyberArk
  - Darktrace
  - Dragos
  - F5 ASM WAF
  - F5 LTM
  - Forcepoint Firewall
  - Forcepoint Web Security
  - Fortinet Fortigate
  - Fortinet FortiWeb
  - Google Workspace
  - HTTP Ingest
  - Imperva Cloud
  - Imperva WAF
  - Infoblox
  - Juniper Pulse Secure
  - Juniper SRX Firewall
  - Lastline
  - Linux Server
  - McAfee ePO
  - Microsoft DHCP
  - Microsoft DNS
  - Microsoft Entra Identity Protection
  - Microsoft Graph Security API Alerts
  - Microsoft IIS
  - Microsoft Office 365 Management API
  - Microsoft Windows Event Log
  - Mimecast
  - Netskope
  - Nozomi Guardian
  - Okta
  - OPNsense
  - Palo Alto Firewall
  - Palo Alto Prisma Access
  - Proofpoint
  - pfSense
  - S3 Ingest - Secureworks-Managed
  - SCADAfence
  - Skyhigh Secure Web Gateway
  - SonicWall Firewall
  - Sophos XG Firewall
  - Suricata
  - Symantec Endpoint Protection
  - Symantec (Blue Coat) ProxySG
  - Taegis NDR - Physical
  - Taegis NDR - Virtual
  - TAXII 2.1
  - Trend Micro Deep Security
  - VMWare vCenter
  - WatchGuard Firewall
  - Zscaler
- Create Custom Parsers
  - Overview
  - Syntax
  - Repeating Fields
  - Overriding and Extending Global Parsers
  - Supported Schemas
  - All Schemas
    - Antivirus
    - Auth
    - CloudAudit
    - DHCP
    - DNS
    - Email
    - Encrypt
    - FileMod
    - HTTP
    - Management Event
    - Netflow
    - NIDS
    - Process
    - Registry
    - Thirdparty
    - Types
Manage Integrations
Alerts, Events, and Investigations
- Alerts
- Events
- Investigations
- Explore an Entity Graph
- CyberChef
Dashboards
Search and Reports
- Search
- Reports
Automation
- Automation Overview
- Supported Playbooks
- Supported Connectors
- Actions
- Playbooks
- Connectors
- Automation Authoring
  - Building Connector Definitions
  - Building Playbook Templates
- Common Expression Language (CEL)
Threat Intelligence, Hunting, and Detection
- Threat Intelligence
- Threat Hunting
  - Hunting with Jupyter Notebooks
- Detectors
- Adversary Software Coverage
  - Adversary Software Coverage
  - Frequently Asked Questions
Vulnerabilities
- Vulnerability Management
Identity
XDR Admin
- Your Account
- Tenant Settings
APIs, SDK, and Magic
- Using XDR GraphQL APIs
- API Authentication
- XDR Python SDK
- Taegis Magic Jupyter Integration
  - Overview
- Alerts API
  - Using the Alerts API
  - Alerts GraphQL API
- Assets API
- Audits API
  - Using the Audits API
  - Audits GraphQL API
- Automations APIs
- Bring Your Own Threat Intelligence API
  - Using the BYOTI API
  - BYOTI GraphQL API
- Collector APIs
- Investigations API
- Threat Intelligence API
  - Using the Threat Intelligence API
  - Threat Intelligence GraphQL API
- Using the Users GraphQL API
- Using the Tenants GraphQL API
- Using the Countermeasures API
- Using the File Upload API
- Using the Notifications API
- Power BI for XDR
Secureworks Products, Services, and Policies
- Taegis NDR
  - Overview
  - Service Description
  - Transitioning from CTP
  - Legacy iSensor Service Descriptions
    - Managed iSensor
    - Managed iSensor Add-on
- ManagedXDR
- ManagedXDR Plus
- Elite Threat Hunting
  - Service Description
  - Onboarding Guide
- ManagedXDR for OT
- ManagedXDR Enhanced
  - Service Description
  - Onboarding Guide
- Secureworks Professional Services
- Legal

Welcome to the Secureworks® Taegis™ ManagedXDR Onboarding Overview ⫘

Congratulations and thank you for partnering with Secureworks® for your threat defense needs.

This tutorial is for ManagedXDR and Elite Threat Hunting users. Together with the guidance from your Onboarding Specialist/Customer Success Manager, this overview will help you through your onboarding process.

1 Getting Started

Access the Application & Manage Users

Your Secureworks Team

2 Integrate EDR Agent

Integrate an EDR Agent

Manage Endpoints

Achieve 40% Deployment Milestone

3 Integrate Data Sources

Set up Data Collectors

Add Data Sources

4 Using XDR

Searching & Reporting

Custom Rules & Automation

Proactive Response

CTU™ Countermeasures & Threat Intelligence

5 Steady State

Readiness Check

Steady State Achieved

Quarterly Updates

For more information around the ManagedXDR Service, Secureworks resources, suggested customer resources, and customer responsibilities, visit the ManagedXDR Service Description and ManagedXDR Onboarding Guide. ManagedXDR Elite customers should visit the ManagedXDR Elite Service Description and ManagedXDR Elite Onboarding Guide.

Need help? Contact us through XDR Chat Support.