Swimlane
自動配備
コミュニティの提供による
Detection & Response Enablement
概要
Imports records from a Swimlane SOAR application into OpenCTI as STIX Case-Incidents, enabling SOC cases to be correlated with threat intelligence.
Swimlane is a security orchestration, automation and response (SOAR) platform for managing SOC cases and security workflows. This connector periodically queries the Swimlane REST API and imports application records into OpenCTI as STIX 2.1 Case-Incidents. Field mapping is generic to accommodate Swimlane's custom application schemas — the record tracking ID is used as the case name and the record ID as an external reference. Once imported, Swimlane cases can be correlated and enriched with the threat intelligence curated in OpenCTI.