SOCRadar Pack v2.2.0 - Add Multi-Tenant Integration

[Radargoger]

Description

New multi-tenant integration for MSPs and MSSPs to manage security incidents from multiple companies using SOCRadar's Multi-Tenant API.

Type of Change

• New integration
• Pack update

Changes

• Added SOCRadar Incidents v4 Multi-Tenant integration
• Centralized management: Monitor multiple companies from single integration
• Automatic company ID tracking and extraction in alarms
• Smart company ID handling: Actions auto-extract company ID from alarm data
• Configurable company information visibility in incidents
• Multi-status filtering (OPEN, CLOSED, ON_HOLD)
• Epoch time precision for zero duplicate incidents
• 9 management commands for full incident lifecycle
• All SOCRadar Incidents v4 features included
• Updated pack_metadata.json to version 2.2.0
• Added release notes for version 2.2.0

Key Features

• Multi-Tenant Support: Single integration monitors multiple companies
• Automatic Company Tracking: Each alarm includes company_id and company_name
• Smart Actions: Commands automatically extract company ID from alarm data
• Flexible Override: Manual company_id parameter available when needed
• Seamless Operation: No need to remember company IDs for each alarm

Multi-Tenant Workflow

1. Integration uses Multi-Tenant ID to fetch alarms from all companies
2. Each alarm includes company_id and company_name fields
3. When taking actions, company ID is automatically extracted from alarm
4. Manual override available via company_id parameter if needed

New Commands (with auto company ID extraction)

• socradar-change-alarm-status
• socradar-mark-false-positive
• socradar-mark-resolved
• socradar-add-comment
• socradar-change-assignee
• socradar-add-tag
• socradar-ask-analyst
• socradar-change-severity
• socradar-test-fetch

Dependencies

• Builds on SOCRadar pack structure
• Compatible with existing SOCRadar integrations

Testing

• Multi-tenant API tested
• Company ID auto-extraction verified
• All commands tested with company ID handling
• Fetch incidents verified across multiple companies
• Documentation complete

Checklist

• Code follows XSOAR style guidelines
• Integration icon added (120x50)
• README.md is complete
• Release notes added
• pack_metadata.json updated
• Documentation includes multi-tenant workflow

relates: https://jira-dc-proxy.xdr.pan.local/browse/CIAC-15482

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @merit-maita will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

[content-bot]

Hi @Radargoger, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.