Skip to main content

Darktrace

Darktrace is an enterprise cybersecurity and artificial intelligence platform that provides autonomous threat detection, investigation, and response capabilities across cloud, network, email, endpoint, and industrial environments. The platform uses self-learning AI and machine learning algorithms to understand normal patterns of behavior within an organization's digital infrastructure and identify anomalous activities that may indicate cyber threats, security incidents, insider threats, or data breaches.

CategoryNDR
DirectionQuery source
Sign-inAPI Token Pair
Query languagesSTIX
Websitedarktrace.com

Before you start​

Huntbase signs in to Darktrace with API Token Pair. Create the credential in Darktrace first, then keep it to hand for the Connect step.

  1. In the Darktrace Threat Visualizer, go to Admin › System Config.
  2. Select Settings, find the API Token section, and click New.
  3. Copy both the Public and the Private token. The Private token is shown only once.
Watch out for
  • Both tokens must come from the same pair. Requests are signed with the Private token and identified by the Public token.

For the vendor's own instructions, see Darktrace API token setup (Rapid7 guide; Darktrace's own API guide requires a customer portal login).

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Darktrace​

  1. Go to Connections and click New connection, or click New connection on the Darktrace product page.
  2. On Product, pick Darktrace and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Darktrace lives:

FieldRequiredNotes
Server AddressYesThe hostname or IP address of your Darktrace appliance (the Threat Visualizer), without https://.

Advanced settings​

These settings are under Advanced. You can usually leave them alone.

FieldRequiredNotes
Max ResultsNoMaximum number of results to return per query (upstream max 10000).

Credentials​

The only Method is API Token Pair. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
Public TokenYesThe Public token from the token pair. Secret — not shown again after you save it.
Private TokenYesThe Private token from the same pair. Secret — not shown again after you save it.

Query it​

Once connected, Darktrace can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.

Next steps​