Device Malicious IP Response
A 3-step recipe with Varonis. We can help you get access.
Recipe · 3 steps
Device Malicious IP Response
with Varonis · Threat Detection & Response Management
Respond to a device alert only when it involves a known malicious IP.
- Retrieve the newest alert for the named device, including the malicious-IP flag, to decide whether a response is warranted.
- Load the forensic events behind the malicious-IP alert to understand the operations performed from that address.
- Transition the malicious-IP alert into Under Investigation status with a response note.
What you'll need to have ready
- apiKey: Varonis DatAlert API key sent in the X-API-Key header.
- deviceName: Name of the device to check for malicious-IP alerts.
- lastDays: How many days back to search for alerts.
- note: Note recorded when the alert is moved into investigation.
For your developer
Arazzo workflow varonis:device-malicious-ip-response, 3 operations: getAlerts → getAlertedEvents → updateAlertStatus. Specs on APIs.io.