LiteSOC × AmbactiBring LiteSOC into
the flow of work.
A little less busywork with LiteSOC.
Alert4 capabilities+
- Get an alert
Get a specific alert. Returns: id (UUID), alert_type, severity (critical/high/medium/low), status, title, description, source_ip, actor_id, trigger_event_id (UUID of triggering event), forensics (network/location data for Pro+ tiers, null for Free), created_at, updated_at, metadata. Severity is auto-assigned by LiteSOC.
- Get many alerts
Get many alerts. Each alert includes: id (UUID), trigger_event_id (UUID of triggering event), forensics object (network: is_vpn, is_tor, is_proxy, is_datacenter, asn, threat_score; location: city, country_code, region, latitude, longitude, timezone) for Pro+ tiers. Severity (critical/high/medium/low) is auto-assigned by LiteSOC.
- Resolve an alert
Mark an alert as resolved
- Mark alert as safe
Mark an alert as safe (false positive)
Event3 capabilities+
- Track a security event
Track a security event. Note: Severity is automatically assigned by LiteSOC based on the event type and cannot be set manually.
- Get a security event
Fetches details of a single event. Returns: id (UUID), event_name, severity (critical/warning/info), actor_id, ip_address, trigger_event_id, forensics object (network: is_vpn, is_tor, is_proxy, is_datacenter, asn, threat_score; location: city, country_code, region, latitude, longitude, timezone) for Pro+ tiers (null for Free tier), metadata, created_at. Severity is auto-assigned by LiteSOC. Note: Free tier users can only fetch events from the last 7 days.
- Get many security events
Get many security events. Each event includes: id (UUID), trigger_event_id, forensics object (network/location data for Pro+ tiers, null for Free tier), severity (critical/warning/info) auto-assigned by LiteSOC based on event type, enabling easy filtering in IF/Switch nodes.
Frequently asked
questions.
What could an Ambacti integration do with LiteSOC?
The documented operations include Alert: Get an alert; Alert: Get many alerts; Alert: Resolve an alert; Alert: Mark alert as safe.
Could I keep a workflow read-only?
For a read-only workflow, limit account permissions to reading data and exclude actions that create, update, or delete records.
Will every action run automatically?
Choose which steps could run on their own and which should pause for review. Changes should follow the permissions and approval rules you set.
Do I need to review actions in LiteSOC?
Decide which work could run on its own and which steps need your review.