Repository navigation
[Pack] DECTRAX: Autonomous Cyber Deception & Line-Rate Firewall Interdiction (v1.0.0) - #46370
Conversation
|
Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed. |
|
Hi @Sadman-TheDentian, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link. |
🤖 AI-Powered Code Review AvailableHi @kamalq97, you can leverage AI-powered code review to assist with this PR! Available Commands:
|
|
|
Summary
This pull request contributes the official DECTRAX integration pack to Palo Alto Networks Cortex XSOAR (
Packs/DECTRAX/).DECTRAX is an autonomous deception and active interdiction platform that exposes lightweight synthetic lures across corporate subnets (Active Directory LDAP, Windows RDP, SMB, Modbus, SSH) with 0.00% false-positive accuracy and publishes line-rate External Dynamic Lists (EDL) for automated perimeter blocking in under 1.5 seconds.
Commands Implemented
!dectrax-get-blocked-ips: Retrieves active attacker IPs interdicted across the network.!dectrax-check-ip: Instant lookup whether an IP observable has interacted with internal decoys.!dectrax-block-ip: Playbook action to push suspicious IPs directly to the live firewall drop feed.Pack Layout
Verification & Testing
pytest apps/cortex-xsoar/Packs/DECTRAX/Integrations/DECTRAX/DECTRAX_test.pyResult: 3 passed, 0 failures, 0 warnings.
relates: link to the issue