Darktrace

Before you configure the Darktrace event source in SIEM (InsightIDR) using the cloud connection method, complete these steps in Darktrace to prepare your environment.

To complete this setup, you need:

• Access to the Darktrace Threat Visualizer
• A user account with permissions to create API tokens
• Access to system configuration settings (for global tokens)

Task 1: Retrieve the appliance URL

The appliance URL identifies your Darktrace instance and is required during event source configuration.

To retrieve the appliance URL:

1. Log in to the Darktrace Threat Visualizer.
2. Locate the URL in your browser address bar.
3. Copy the hostname only.
   • Do not include https://
   • Do not include trailing slashes or paths (for example, /login or /modelbreaches)

Examples:

Task 2: Generate API tokens

SIEM (InsightIDR) uses API tokens to authenticate and collect data from Darktrace.

You must generate a token pair that includes:

• Public token – Used as the DTAPI-Token header value
• Private token – Used to generate the DTAPI-Signature value

Token types

Darktrace supports two token types:

• Global token (recommended) – Provides full API access across the appliance
• Per-user token – Limited to the permissions of the associated user

Use a global token to ensure access to all required endpoints.

Generate a global token

To generate a global API token:

1. In Darktrace Threat Visualizer, go to Admin > System Config.
2. Select Settings.
3. Locate the API Token section.
4. Click New.
5. Copy the Public and Private tokens.
   • The Private token is shown only once.
   • Store both tokens securely for later use.

Generate a per-user token (optional)

Use this option only if you require scoped access.

To generate a per-user token:

1. In Darktrace Threat Visualizer, go to Admin > Permissions Admin.
2. Go to the Created Accounts tab.
3. Edit the target user.
4. Enable API Access in the Flags tab.
5. Save your changes.
6. Log in as the target user.
7. Open Account Settings.
8. Click New to generate the token pair.
9. Copy and securely store both tokens.

Configure required permissions (per-user only)

If you use a per-user token, ensure the account has:

• Access to unrestricted devices
• At least one of the following:
  • Visualizer
  • Darktrace IDENTITY Console
• Additional permissions for /modelbreaches if required

Global tokens do not require additional permission configuration.

Task 3: Verify required API endpoints

Ensure your Darktrace environment allows access to these endpoints:

• /modelbreaches
• /aianalyst/incidentevents

These endpoints are required for SIEM (InsightIDR) data collection.

Before SIEM (InsightIDR) can start ingesting data from Darktrace using the collector connection method, a Darktrace administrator with UI access must configure Darktrace to send syslog to the SIEM (InsightIDR) Collector.

Configure syslog forawrding in Darktrace

To configure syslog forwarding in Darktrace:

1. In Darktrace Threat Visualizer, go to Admin > System Config.
2. Select Modules and choose Syslog from the available Workflow Integrations.
3. In the configuration window, select Syslog JSON and click New to open the configuration settings.
4. Set the JSON Syslog Alerts field to true.
5. In the JSON Syslog Server field, specify the IP address of the SIEM (InsightIDR) Collector.
6. In the JSON Syslog Server Port field, specify a unique port over 1024 that you will use with the SIEM (InsightIDR) event source.
7. Set the JSON Syslog TCP Alerts field to true.

Darktrace will automatically save your changes.

1. In the Add Event Source panel, select Run On Cloud.
2. Name the event source. This will be the name of the log that contains the event data in Log Search.
3. Click Add a New Connection.
   1. In the Create a Cloud Connection screen, enter a name for the new connection.
   2. In the Appliance URL field, enter the Appliance URL that you retrieved in the previous section, Task 1: Retrieve the appliance URL.
   3. In the Public Token field, enter the Public Token that you retreived in the previous section, generate a global token.
   4. In the Private Token field, add a new credential:
      • Name your credential.
      • Describe your credential.
      • Select the credential type.
      • Enter the Private Token that you obtained in the previous section, generate a global token.
   5. Click Save & Test Connection.
4. Optionally, choose to send unparsed data.
5. Click Save.

1. In the Add Event Source panel, select Run On Collector.
2. Name the event source. This will be the name of the log that contains the event data in Log Search.
3. Select your collector.
4. Enter the port you chose in the Darktrace interface in the previous section,.
5. Select TCP as your protocol.
6. Optionally, choose to send unparsed data.
7. Click Save.