Aller au contenu
1337skills 1337skills - Aide-mémoires

Vectra AI Commands

Comprehensive Vectra AI platform commands and workflows for network detection and response (NDR).

Platform API Authentication

CommandDescription
curl -H "Authorization: Token <token>" <endpoint>API authentication
vectra-cli auth loginLogin to Vectra platform
vectra-cli auth logoutLogout from platform
vectra-cli auth statusCheck authentication status
export VECTRA_TOKEN=<token>Set environment token
export VECTRA_URL=<url>Set platform URL

Detection Management

CommandDescription
GET /api/v3.3/detectionsList all detections
GET /api/v3.3/detections/{id}Get detection details
PATCH /api/v3.3/detections/{id}Update detection
DELETE /api/v3.3/detections/{id}Delete detection
GET /api/v3.3/detections?state=activeFilter active detections
GET /api/v3.3/detections?certainty=highFilter by certainty

Host Management

CommandDescription
GET /api/v3.3/hostsList all hosts
GET /api/v3.3/hosts/{id}Get host details
PATCH /api/v3.3/hosts/{id}Update host information
GET /api/v3.3/hosts?threat_score_gte=50Filter by threat score
GET /api/v3.3/hosts?certainty_score_gte=80Filter by certainty score

Account Management

CommandDescription
GET /api/v3.3/accountsList all accounts
GET /api/v3.3/accounts/{id}Get account details
PATCH /api/v3.3/accounts/{id}Update account
GET /api/v3.3/accounts?privilege_level=adminFilter by privilege level
GET /api/v3.3/accounts?threat_score_gte=50Filter by threat score

Campaign Management

CommandDescription
GET /api/v3.3/campaignsList all campaigns
GET /api/v3.3/campaigns/{id}Get campaign details
PATCH /api/v3.3/campaigns/{id}Update campaign
GET /api/v3.3/campaigns?state=activeFilter active campaigns

Assignment Management

CommandDescription
GET /api/v3.3/assignmentsList assignments
POST /api/v3.3/assignmentsCreate assignment
GET /api/v3.3/assignments/{id}Get assignment details
PATCH /api/v3.3/assignments/{id}Update assignment
DELETE /api/v3.3/assignments/{id}Delete assignment

Threat Intelligence

CommandDescription
GET /api/v3.3/threat_feedsList threat feeds
POST /api/v3.3/threat_feedsCreate threat feed
GET /api/v3.3/threat_feeds/{id}Get threat feed details
PATCH /api/v3.3/threat_feeds/{id}Update threat feed
DELETE /api/v3.3/threat_feeds/{id}Delete threat feed

Search and Filtering

CommandDescription
GET /api/v3.3/search/detectionsSearch detections
GET /api/v3.3/search/hostsSearch hosts
GET /api/v3.3/search/accountsSearch accounts
GET /api/v3.3/detections?ordering=-threat_scoreOrder by threat score
GET /api/v3.3/detections?page_size=100Set page size

MCP Server Integration

CommandDescription
vectra-mcp installInstall Vectra MCP server
vectra-mcp configureConfigure MCP server
vectra-mcp startStart MCP server
vectra-mcp stopStop MCP server
vectra-mcp statusCheck MCP server status

AI Assistant Commands

CommandDescription
vectra-mcp claude connectConnect to Claude Desktop
vectra-mcp cursor connectConnect to Cursor IDE
vectra-mcp chat enableEnable chat interface
vectra-mcp investigate <query>AI-assisted investigation
vectra-mcp visualize <data>Generate visualizations

Incident Investigation

CommandDescription
vectra-cli investigate --host <host-id>Investigate host
vectra-cli investigate --detection <detection-id>Investigate detection
vectra-cli timeline --host <host-id>Generate host timeline
vectra-cli timeline --account <account-id>Generate account timeline
vectra-cli correlate --detection <detection-id>Correlate detections

Response Actions

CommandDescription
vectra-cli response block --host <host-id>Block host
vectra-cli response isolate --host <host-id>Isolate host
vectra-cli response quarantine --account <account-id>Quarantine account
vectra-cli response whitelist --host <host-id>Whitelist host
vectra-cli response unblock --host <host-id>Unblock host

Reporting and Analytics

CommandDescription
GET /api/v3.3/reportsList available reports
POST /api/v3.3/reportsGenerate report
GET /api/v3.3/reports/{id}Get report details
GET /api/v3.3/analytics/summaryGet analytics summary
GET /api/v3.3/analytics/trendsGet trend analysis

Configuration Management

CommandDescription
GET /api/v3.3/settingsGet platform settings
PATCH /api/v3.3/settingsUpdate settings
GET /api/v3.3/sensorsList sensors
GET /api/v3.3/sensors/{id}Get sensor details
PATCH /api/v3.3/sensors/{id}Update sensor configuration

User and Role Management

CommandDescription
GET /api/v3.3/usersList users
POST /api/v3.3/usersCreate user
GET /api/v3.3/users/{id}Get user details
PATCH /api/v3.3/users/{id}Update user
DELETE /api/v3.3/users/{id}Delete user

Alert Management

CommandDescription
GET /api/v3.3/alertsList alerts
POST /api/v3.3/alertsCreate alert rule
GET /api/v3.3/alerts/{id}Get alert details
PATCH /api/v3.3/alerts/{id}Update alert rule
DELETE /api/v3.3/alerts/{id}Delete alert rule

Integration Management

CommandDescription
GET /api/v3.3/integrationsList integrations
POST /api/v3.3/integrationsCreate integration
GET /api/v3.3/integrations/{id}Get integration details
PATCH /api/v3.3/integrations/{id}Update integration
DELETE /api/v3.3/integrations/{id}Delete integration

Data Export

CommandDescription
vectra-cli export detections --format jsonExport detections
vectra-cli export hosts --format csvExport hosts
vectra-cli export accounts --format jsonExport accounts
vectra-cli export --start-date 2025-01-01Export with date filter
vectra-cli export --threat-score-min 50Export with score filter

Monitoring and Health

CommandDescription
GET /api/v3.3/healthCheck platform health
GET /api/v3.3/system/statusGet system status
GET /api/v3.3/sensors/healthCheck sensor health
GET /api/v3.3/system/metricsGet system metrics
GET /api/v3.3/system/logsGet system logs

Advanced Queries

CommandDescription
GET /api/v3.3/detections?detection_type=command_and_controlFilter by detection type
GET /api/v3.3/detections?src_ip=192.168.1.100Filter by source IP
GET /api/v3.3/detections?dst_port=443Filter by destination port
GET /api/v3.3/hosts?last_detection_timestamp_gte=2025-01-01Filter by timestamp

Bulk Operations

CommandDescription
vectra-cli bulk assign --detections <file>Bulk assign detections
vectra-cli bulk update --hosts <file>Bulk update hosts
vectra-cli bulk export --query <query>Bulk export with query
vectra-cli bulk remediate --actions <file>Bulk remediation actions

Automation and Scripting

CommandDescription
vectra-cli script run --file <script>Run automation script
vectra-cli script validate --file <script>Validate script
vectra-cli workflow create --name <name>Create workflow
vectra-cli workflow run --id <workflow-id>Run workflow

Performance Optimization

CommandDescription
vectra-cli optimize --cache-size 1GBSet cache size
vectra-cli optimize --parallel 10Set parallel processing
vectra-cli optimize --timeout 300Set timeout
vectra-cli cache clearClear cache
vectra-cli cache statusCheck cache status

Debugging and Troubleshooting

CommandDescription
vectra-cli debug --log-level debugEnable debug logging
vectra-cli debug connectivityTest connectivity
vectra-cli debug api --endpoint <endpoint>Test API endpoint
vectra-cli debug permissionsCheck permissions
vectra-cli logs --tail 100View recent logs

Environment Variables

VariableDescription
VECTRA_TOKENAPI authentication token
VECTRA_URLPlatform URL
VECTRA_TIMEOUTRequest timeout
VECTRA_LOG_LEVELLogging level
VECTRA_CACHE_DIRCache directory

Configuration Files

FileDescription
vectra.config.jsonMain configuration file
vectra-rules.ymlDetection rules
vectra-integrations.ymlIntegration settings
.vectra-credentialsStored credentials

Common Detection Types

TypeDescription
command_and_controlC2 communication
lateral_movementLateral movement activity
data_exfiltrationData exfiltration attempts
reconnaissanceNetwork reconnaissance
privilege_escalationPrivilege escalation