phcode42v2/readme.html at main · phantomcyber/phcode42v2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
<html>
  <head></head>
  <body>
    <h2>py42</h2>
      <p>This app is built using <a href="https://github.com/code42/py42">py42</a>, the official Code42 python SDK.</p>

    <h2>Objective</h2>
      <p>This app implements various investigative actions on the Code42 Incydr platform. Additionally, this app
      ingests alerts from Code42 to facilitate a timely response.</p>

    <h2>How to Configure the App</h2>
      <p>
        Access the Asset Settings tab on the Asset Configuration page. Input the cloud instance, username, and password
        to use to connect to Code42.
      </p>
    <p>
      If using the polling feature, you may set the Start Date and End Date for the initial ingest. Otherwise,
      it ingests up to 30 days back. Ongoing queries will only get new alerts. Configure the polling interval in the
      Ingest Settings tab. Additionally, you can configure which alert severities to poll for, such as HIGH, MEDIUM,
      or LOW.
    </p>

    <h2>On Poll</h2>
      <p>
        The 'on poll' functionality first ingests the past 30 days of Code42 alerts (or uses the configured start and
        end dates). Note that if you use the "poll now" feature, you are limited to the number of containers and
        artifacts listed in the parameter fields. Adjust the polling interval in the ingest settings to determine how
        frequent polling occurs. The app ingests individual alerts only once unless deleted and re-polled.
      </p>

  </body>
</html>