Secureworks integration
Pull security alerts, investigations, and endpoint data from Secureworks Taegis XDR to drive unified threat detection and response workflows.
What it connects
- View all endpoint assets across your infrastructure including OS versions, installed sensors, connection status, and custom tags to maintain an accurate inventory of monitored devices.
- Access active security alerts with severity ratings, confidence levels, and entity details to understand emerging threats and prioritize investigation efforts.
- Monitor ongoing security investigations with evidence summaries, current status, and assigned analysts to track investigation progress and reduce response time.
- Review audit logs of all user and API actions within Taegis to ensure compliance, track configuration changes, and maintain a complete security activity trail.
What it automates
- Update investigation status, reassign owners, and document findings to coordinate team response and keep investigations moving toward resolution.
- Attach alerts and events as evidence to investigations to correlate security data and build comprehensive threat narratives for faster analysis.
- Isolate compromised endpoints from the network or lift isolation when threats are remediated to contain incidents and restore access when safe.
- Bulk apply or remove tags on endpoints to organize assets by risk level, environment, or remediation status and orchestrate targeted security actions.
In practice
When a critical security alert fires, automatically pull the alert details, attach related events to a new investigation, and assign it to an on-call analyst to accelerate incident triage.
Tag all unpatched endpoints discovered during vulnerability scans, then isolate critical assets until patches are deployed and verified.
Pull investigation records and audit logs on a schedule to generate compliance reports showing who investigated what, when, and with what outcome.
Correlate endpoint inventory changes with investigation activity to identify which assets were involved in security incidents and apply remediation tags for follow-up.
