| 1 | # Darktrace Integration |
| 2 | |
| 3 | The Darktrace integration allows you to monitor Alert Logs. Darktrace is a network solution for detecting and investigating emerging cyber-threats that evade traditional security tools. It is powered by Enterprise Immune System technology, which uses machine learning and mathematics to monitor behaviors and detect anomalies in your organization’s network. |
| 4 | |
| 5 | For example, you could use the data from this integration to know which model is breached and analyse model breaches, and also know about system health, changes in monitored traffic, and any errors experienced by Darktrace Security Modules or probe instances. |
| 6 | |
| 7 | # Data Streams |
| 8 | |
| 9 | The Darktrace integration collects logs for three types of events: |
| 10 | |
| 11 | ## AI Analyst Alert |
| 12 | |
| 13 | Generated by AI that investigates, analyzes, and reports threats within the Darktrace environment. It reviews all Model Breaches and creates events for behaviors of interest to cyber analysts. |
| 14 | |
| 15 | ## Model Breach Alert |
| 16 | |
| 17 | Triggered when a model breach occurs. Models define conditions that alert the system to anomalous behavior, malicious activity, or compliance issues. |
| 18 | |
| 19 | ## System Status Alert |
| 20 | |
| 21 | Informs operators of system health, traffic changes, and errors. Includes host details, event severity, and useful investigation links. Notifications are sent for active and resolved events. |
| 22 | |
| 23 | ## Acquiring the API Token Pair |
| 24 | |
| 25 | An API token pair is required for each Master instance. |
| 26 | |
| 27 | ### Per-user Token |
| 28 | |
| 29 | API tokens can only be created by local users with granted API access permissions. |
| 30 | |
| 31 | 1. Navigate to the Permissions Admin page (Main Menu - Admin) on the Threat Visualizer. |
| 32 | 2. Locate the user and enable "API Access". |
| 33 | 3. Log in as the user intended for API access, navigate to Account Settings, and generate new API tokens. |
| 34 | 4. Record the Public and Private tokens securely. |
| 35 | |
| 36 | ### Global Token |
| 37 | |
| 38 | Requires access to the System Config page and appropriate permissions. |
| 39 | |
| 40 | 1. Navigate to the System Config page on the Threat Visualizer. |
| 41 | 2. Select "Settings" and generate new API tokens. |
| 42 | 3. Record the Public and Private tokens securely. |
| 43 | |
| 44 | ## Token Usage |
| 45 | |
| 46 | Both tokens are required to generate the DT-API Signature, which must be included with every API request. |
| 47 | |
| 48 | For more details, refer to the Darktrace Threat Visualizer API Guide. |