Secureworks integration
Pull security alerts, investigations, and endpoint data from Secureworks Taegis XDR to drive unified threat detection and response workflows.
What it connects
- View all endpoint assets across your infrastructure including OS versions, installed sensors, connection status, and custom tags to maintain an accurate inventory of monitored devices.
- Access active security alerts with severity ratings, confidence levels, and entity details to understand emerging threats and prioritize investigation efforts.
- Monitor ongoing security investigations with evidence summaries, current status, and assigned analysts to track investigation progress and reduce response time.
- Review audit logs of all user and API actions within Taegis to ensure compliance, track configuration changes, and maintain a complete security activity trail.
What it automates
- Update investigation status, reassign owners, and document findings to coordinate team response and keep investigations moving toward resolution.
- Attach alerts and events as evidence to investigations to correlate security data and build comprehensive threat narratives for faster analysis.
- Isolate compromised endpoints from the network or lift isolation when threats are remediated to contain incidents and restore access when safe.
- Bulk apply or remove tags on endpoints to organize assets by risk level, environment, or remediation status and orchestrate targeted security actions.
In practice
- When a critical security alert fires, automatically pull the alert details, attach related events to a new investigation, and assign it to an on-call analyst to accelerate incident triage.
- Tag all unpatched endpoints discovered during vulnerability scans, then isolate critical assets until patches are deployed and verified.
- Pull investigation records and audit logs on a schedule to generate compliance reports showing who investigated what, when, and with what outcome.
- Correlate endpoint inventory changes with investigation activity to identify which assets were involved in security incidents and apply remediation tags for follow-up.
