Hunters

Actions for Hunters

• Send Data. Sends a custom set of Lucidum data to Hunters.

Use Cases

Below are the possible use cases for the Send Data action:

• If you want to run Lucidum “headless”, you can send relevant data to Hunters on a regular schedule.

• You can send data to Hunters for storage, analysis, and threat response.

Prerequisites

A Jira account that has permissions to create tickets.

Workflows

• Creating a new Configuration and a new Action

• Creating a new Action from the Location Results page

• Editing a Configuration

• Editing an Action

• Viewing Information about an Action

Hunters Configuration

• Configuration Name. Identifier for the Configuration. This name will appear in the Lucidum Action Center.

• URL. The URL for the hunters API. For example, https://api.us.hunters.ai

• Client ID. A unique ID that allows API access from Lucidum to Hunters. For details, see https://docs.hunters.ai/apidocs/manage-api-tokens

• Secret Key. A unique key that allows API access from Lucidum to Hunters. For details, see https://docs.hunters.ai/apidocs/manage-api-tokens

• Max # of Records per Payload. The maximum number of records to send to Hunters in each action. The default value is “100”.

Create or Edit an Action

To create an action for Jira Cloud:

1. In the Create a New Action page, in the General step, enter:

   

   • Action Type. Select Send Data from the pulldown options..

   • Configuration Name. Select an action configuration from the pulldown options.

   • Action Name. Identifier for the action. This name will appear in the Lucidum Action Center.

   • Description. Description of the action.

2. Click the Next (>) icon.

3. In the Filters page, click Configure Filters.

4. In the Configure Filters for Action page, you define the query for the assets or users that the action will act upon.

   

   • For existing actions, these fields are populated with values from the query for this action.

   • For details on creating and editing queries in Lucidum, see the section on Building Queries.

5. Click the Apply (page and pencil) icon.

   

6. Click the Next (>) icon.

7. In the Schedule step, enter:

   

    

   • Schedule Type. Define the schedule for the action. Choices are:

     • Recurrence. Specify a frequency for the recurring schedule.

     • After Data Ingestion. The action is executed after data ingestion, which happens at least once every 24 hours and can also be triggered manually.

   • Do not trigger the action unless. Specify the number of results from Filters as a prerequisite for executing the action.

8. Click the Next (>) icon.

9. In the Details step, enter the following:

   

    

   • Output Fields. For the records selected with the Filters field, specify the columns to display. When creating or editing the query, you can select these fields in the Query Results page > Edit Column button.

   • Hunters Tag Name. Define an asset tag for the asset data. The default value is LucidumAsset. For details, see https://docs.hunters.ai/apidocs/create-a-new-asset-tag.

   • Hunters Tag Sensitivity. Sensitivity level that will be assigned to each asset with this tag. Possible values are "critical", "high", "neutral", "low". The default value is “high”. For details, see https://docs.hunters.ai/apidocs/create-a-new-asset-tag .

   • CIDR Segment for IP Range Tagging. All assets in the specified CIDR IP range will be assigned the asset tag in Hunters Tag Name. For details, see https://docs.hunters.ai/apidocs/create-a-new-asset-tag .

   • Hunters Attribute Name for Exact Match Tagging. For exact match identifiers, specifies the type of data for matching. Possible types are "person_job_title", "person_name", "os_username", "username", "agent_id", "ip", "windows_user_sid", "hostname", "email". The default value is “hostname”. For details, see https://docs.hunters.ai/apidocs/create-a-new-asset-tag .

   • De-dupe Previous Jobs. In this field, you specify whether you want duplicates of asset IDs (if your query is for assets) or user IDs (if your query is for users). You can specify integers between 0 and the number specified in Settings > System Settings > General > Data Settings > Action Result Retention in Days. This setting specifies the number of days that Lucidum stores action results.

     • If you specify “0” (zero), Lucidum includes all the records from the query in each delivery to Hunters.

     • If you specify “1” (one), Lucidum examines the previous webhook payload and excludes records for asset IDs or user IDs that were sent in the delivery to Hunters.

     • If you specify “2” (two), Lucidum examines the last two webhook payloads and excludes records for asset IDs or user IDs that were sent in the previous two deliveries to Hunters.