Connect Precinct to an Aggregator

[Mike Riforgiate]

Go to Admin > Aggregators 

Click +Add.  Enter the FQDN of the aggregator node you wish to connect to and check the box for each of the required types.

Description of Types:

• Incidents – Automatically Sync all
  • This will automatically send all incidents that Precinct creates to the connected Aggregator
• Incidents – Manual Sync via Human submission
  • This will only send incident data to an Aggregator when Report to Aggregator button is clicked on the right panel
• Report Synchronization
  • This will send Reports data to the Aggregator
• Search and Response Job Authorization
  • This will allow the connected Aggregator to search artifacts and execute jobs that have been enabled
• Threat Actor Subscription
  • This will automatically pull down all new data related to any Threat Actor bulletins that are published by the connected Aggregator
  • New Threat Actor data will trigger incident updates, both new and retroactive.
• Asset Synchronization
  • Asset data is synchronized with the connected Aggregator

[Author]

Posts