Threat Model Hunt
A 3-step recipe with Varonis. We can help you get access.
Recipe · 3 steps
Threat Model Hunt
with Varonis · Threat Detection & Response Management
Pivot from a threat model name to its recent alerts and forensic events.
- Resolve the threat model definition by name to confirm it exists and to capture its category and severity before hunting on its alerts.
- Retrieve recent alerts generated by the resolved threat model name in descending time order.
- Load the forensic events behind the newest alert produced by the threat model to understand the detected activity.
What you'll need to have ready
- apiKey: Varonis DatAlert API key sent in the X-API-Key header.
- threatModelName: Threat model name to hunt on. Supports pipe-separated values and wildcard characters for pattern matching.
- lastDays: How many days back to search for alerts.
- maxResults: Maximum number of alerts to retrieve.
For your developer
Arazzo workflow varonis:threat-model-hunt, 3 operations: getThreatModels → getAlerts → getAlertedEvents. Specs on APIs.io.