Skip to main content

Secureworks Taegis

Visualize assets, users, and evaluations in Taegis while monitoring changes through advanced queries and automated alerts.

Installation​

To authenticate with Secureworks Taegis XDR, you'll need to configure certain credentials such as TENANT_ID, BASE_URL, CLIENT_ID, and CLIENT_SECRET. Here's how you can obtain these values and set them in your environment variables for secure and effective authentication:

TENANT_ID: A unique identifier for your Taegis XDR tenant, required for API requests. To find it, log in to the XDR Console, go to Tenant Settings → Subscriptions.

CLIENT_ID & CLIENT_SECRET: Follow this document to create the necessary credentials for this integration: Create Client Credentials.

BASE_URL: You can find the appropriate BASE_URL in your Taegis console under Web URL. Select the correct URL based on your deployment region:

US1: https://api.ctpx.secureworks.com US2: https://api.delta.taegis.secureworks.com US3: https://api.foxtrot.taegis.secureworks.com EU: https://api.echo.taegis.secureworks.com

Configuration in JupiterOne​

To install the SecureWorks Taegis integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select SecureWorks Taegis Click New Instance to begin configuring your integration.

Creating a configuration requires the following:

  • The Account Name used to identify the SecureWorks Taegis account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your SecureWorks Taegis Tenant ID ,Client ID, Client Secret, BaseUrl.

  • Designate the desired Included Vulnerability Severities and Included Vulnerability States.

Click Create once all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.