AWS CloudTrail SOAR Integration

This document details the tools provided by the AWS CloudTrail SOAR integration.

Tools

aws_cloud_trail_ping

Test connectivity to AWS Cloud Trail with parameters provided at the integration configuration page on Marketplace tab.

Parameters:

• case_id (str, required): The ID of the case.

• alert_group_identifiers (List[str], required): Identifiers for the alert groups.

• target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.

• scope (str, optional, default=“All entities”): Defines the scope for the action.