Connect Precinct to an Aggregator

Welcome Forums Appliance and OS Connect Precinct to an Aggregator

  • This topic is empty.
Viewing 1 post (of 1 total)
  • Author
    Posts
  • #3263
    Mike RiforgiateMike Riforgiate
    Keymaster

    Go to Admin > Aggregators 

    Click +Add.  Enter the FQDN of the aggregator node you wish to connect to and check the box for each of the required types.

    Description of Types:
    • Incidents – Automatically Sync all
      • This will automatically send all incidents that Precinct creates to the connected Aggregator
    • Incidents – Manual Sync via Human submission
      • This will only send incident data to an Aggregator when Report to Aggregator button is clicked on the right panel
    • Report Synchronization
      • This will send Reports data to the Aggregator
    • Search and Response Job Authorization
      • This will allow the connected Aggregator to search artifacts and execute jobs that have been enabled
    • Threat Actor Subscription
      • This will automatically pull down all new data related to any Threat Actor bulletins that are published by the connected Aggregator
      • New Threat Actor data will trigger incident updates, both new and retroactive.
    • Asset Synchronization
      • Asset data is synchronized with the connected Aggregator
Viewing 1 post (of 1 total)
  • You must be logged in to reply to this topic.