Dell Secureworks Taegis XDR

LAST UPDATED: NOVEMBER 24, 2025

Overview

Secureworks Taegis XDR (formerly Secureworks Red Cloak Threat Detection Response) is a threat-intelligence-based security analytics platform with built-in security context. Secureworks Taegis XDR allows organizations to detect, investigate, and respond to advanced threats across their endpoints, network, and cloud environments.

D3 SOAR is providing REST operations to function with Taegis XDR.

Dell Secureworks Taegis XDR is available for use in:

D3 SOAR	V14.0.27.0+
Category	SIEM XDR
Deployment Options	Option II, Option IV

Known Limitations

Taegis applies rate limits to API requests, and the limits vary across the platform. An HTTP 429 error indicates that the limit has been reached. Limits are tracked per request. If this error appears, retry after the limits reset.

Connection

Gather the following information to connect D3 SOAR to Taegis XDR.

Parameter	Description	Example
Server URL	The server URL of the Taegis XDR API.	https://api.ctpx.secureworks.com
Client ID	The client ID to authenticate the API connection.	c14U*****BUAv
Client Secret	The client secret to authenticate the API connection.	ZxFc*****ylPn

Permission Requirements

All commands are available to accounts with Tenant Auditor permissions.

As Taegis XDR is using role-based access control (RBAC), the Client ID and Secret are generated based on a specific user account and the application. Therefore, the command permissions are inherited from the user account’s role. Users need to configure their user profile from the Taegis XDR console for each command in this integration.

READER NOTE

Taegis XDR’s default user profiles (sorted from the least permissions to the most) are as follows:

Administrator (Tenant Admin)
Analyst (Tenant Analyst)
Responder (Tenant Responder)
Auditor (Tenant Auditor) - Read Only Access

Refer to User Roles and Profile Settings for details.

Configuring Taegis XDR to Work with D3 SOAR

READER NOTE

This section demonstrates the legacy method of creating client credentials and secrets using the CLI. Refer to Adding API Credentials for creating credentials with the UI.
Only users with the Tenant Analyst or Tenant Admin role can create client credentials. The credentials apply only to the tenant and region in which they are created. Separate credentials are required for each region.

IMPORTANT

By default, client credentials receive the Tenant Analyst role. To assign a lower-privileged role such as Tenant Auditor, refer to Create Privileged Client Credentials (Optional).

Log in to Taegis XDR with Google Chrome.
Open the Chrome Developer Tools by pressing F12 on a PC or Cmd+Opt+I on a Mac.
Navigate to the Console tab, enter the following code, and press Enter to copy the access_token to the clipboard.
JS
```
copy(localStorage.access_token)
```

READER NOTE *

The console does not display the access_token following the code execution. It is only copied to the clipboard. Users must save the access token in a text editor for later use.

Copy the following command lines to a text editor and replace the placeholder values.
BASH
```
set ACCESS_TOKEN="your_access_token"
set TENANT_ID="your_tenant_id"
curl -H "Authorization: Bearer %ACCESS_TOKEN%" -H "X-Tenant-Context: %TENANT_ID%" -H "Content-type: application/json" https://api.ctpx.secureworks.com/clients/v1/clients -d "{\"name\":\"your_unique_application_name\"}"
```
- your_access_token: Paste the access_token copied from the console.
- your_tenant_id: Retrieve the tenant ID from Taegis XDR UI at Tenant Settings > Subscriptions.
- your_unique_application_name: Enter a unique application name.
Open terminal, then execute the command lines to retrieve the client credentials needed to connect to D3.
Copy the returned client id and client secret and save them in a secure location.

READER NOTE *

The maximum number of client credentials that can be created per hour for a tenant is 10.

Configuring D3 SOAR to Work with Dell Secureworks Taegis XDR

Log in to D3 SOAR.
Find the Taegis XDR integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Taegis XDR in the search box to find the integration, then click it to select it.
4. Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Taegis XDR.
1. Connection Name: The desired name for the connection.
2. Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
4. Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): The description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: The checkbox that enables the connection to be used when selected.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input your domain level Server URL.
  2. Copy the Client ID from the Taegis XDR platform. Refer to step 6 of Configuring Taegis XDR to Work with D3 SOAR.
  3. Copy the Client Secret from the Taegis XDR platform. Refer to step 6 of Configuring Taegis XDR to Work with D3 SOAR.
10. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
11. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
Test the connection.
1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
2. Click OK to close the alert window.
3. Click + Add to create and add the configured connection.

Commands

Taegis XDR includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Taegis XDR API, refer to the Taegis XDR API reference.

READER NOTE

Certain permissions are required for each command. Refer to the Permission Requirements and Configuring Taegis XDR to Work with D3 SOAR for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:

Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose the desired date and time format, then click on the Save button.

The selected time format will now be visible when configuring Date/Time command input parameters.

Fetch Event

Returns all Taegis XDR alerts or investigations matching the specified criteria — including time range.

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Optional	The start of the time range (in UTC) for retrieving alerts or investigations based on the specified query time type. Alerts must have been created within the past 180 days. By default, the start time is 24 hours before the end time.	2023-04-27 00:00
End Time	Optional	The end of the time range (in UTC) for fetching alerts or investigations based on the specified query time type. By default, end time is the current time.	2023-04-28 00:00
Number of Event(s) Fetched	Optional	The number of the most recent events to retrieve. Valid values range from 1 to 10000. By default, the value is 10000.	10
Search Condition	Optional	The search condition expression used to filter the returned results. For query syntax, see Basic Syntax. For Alert event source, omit the "from alert where" clause — only include the expression beginning after the "where" keyword. For Investigation event source, refer to the supported CQL fields at Supported Fields for CQL.	severity >= 0.75 and status='OPEN'
Tolerance Scope	Optional	A time window (in minutes) that extends the time range for fetching events by subtracting from the specified start time. Tolerance scope helps prevent data loss by accounting for API response delays caused by temporary server-side data unavailability—arising from processing and synchronization—from the vendor. With the tolerance scope applied, events will be fetched within the range of (Start Time - Tolerance Scope) to End Time. By default, the tolerance scope is set to 0.	0
Query Time Type	Optional	The time field used to search for alerts or investigations. For the alert event source, available time fields are: First Activity Time Last Activity Time Created Time Inserted Time Updated Time. By default, the value is Created Time. For the investigation event source, available time fields are: Created Time Updated Time By default, the value is Updated Time.	First Activity Time
Event Source	Optional	The event source from which to ingest events. Available options are: Alert Investigation By default, the value is Alert.	Investigation

Output

To view the sample output data for all commands, refer to this article.

Fetch Event Field Mapping

See Field Mappings.

The Taegis XDR system integration includes pre-configured field mappings for the default event source.

The Default Event Source is the default system-provided set of field mappings applied when the fetch event command is executed. It includes a Main Event JSON Path, which is the JSONPath expression that points to the base array of event objects. The source field path continues from this array to locate the required data.

The Main Event JSON Path can be viewed by clicking on the Edit Event Source button.

Main Event JSON Path: $.data.alertsServiceSearch.alerts.list
The data.alertsServiceSearch.alerts.list array contains the event objects. Within each event object, the key id denotes the Unique Event Key field. As such, the full JSONPath expression to extract the Unique Event Key is $.data.alertsServiceSearch.alerts.list.id.
Event Source for Investigation Event
The D3 system configures the field mappings which are specific to the investigation-event-related events. If a source field in the field mapping is not found, the corresponding field mapping will be ignored. Because the __typename field in the raw data for incident events consistently has the value InvestigationV2, these events can be identified by the Search String: {$.__typename}=InvestigationV2. Click Edit Event Source to view the Search String.

The pre-configured field mappings are detailed below:

Field Name	Source Field
Default Event Source (Main Event JSON Path: $.data.alertsServiceSearch.alerts.list)
Unique Event Key	.id
Event Type	.__typename
Start Time	.metadata.created_at.seconds
Description	.metadata.description
Techniques	.attack_technique_ids
Severity	.metadata.severity
Status	.status
First Behavior Time	.metadata.began_at.seconds
Last Behavior Time	.metadata.ended_at.seconds
Message	.metadata.title
Entities	.entities.entities
Event Source for Investigation Event (Search String: {$.__typename}=InvestigationV2) The search string format is {jsonpath}=value. If the value of the $.__typename key is InvestigationV2 in the event object under raw data, then Investigation Event will use the field mapping below.
Event code	.shortId
Event Type	.__typename
Document ID	.id
Description	.title
Investigation Type	.type
Status	.status
Priority	.priority
Key Findings	.keyFindings
Start Time	.createdAt
Assignee ID	.assigneeId
Tenant ID	.tenantId
Updated Time	.updatedAt
Rule ID	.ruleId
Tag	.tags
Alert IDs	.alertsEvidence[*].alertId
Event IDs	.eventsEvidence[*].eventId
Asset IDs	.assetsEvidence[*].assettId

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Fetch Event failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid Query.

Error Sample Data

Fetch Event failed.

Status Code: 400.

Message: Invalid Query.

Get Threat Intelligence

Retrieves threat intelligence on the specified indicators.

Input

Input Parameter	Required/Optional	Description	Example
Indicators	Required	The indicators to retrieve corresponding threat intelligence.	JSON `[ "40.00.000.000" ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Threat Intelligence failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid Indicator.

Error Sample Data

Get Threat Intelligence failed.

Status Code: 400.

Message: Invalid Indicator.

Get Threat Watchlist

Retrieves a threat watchlist of the specified indicator type.

Input

Input Parameter

Required/Optional

Description

Example

Indicator Types

Required

The indicator type to retrieve the threat watchlist. Valid options are:

Domain
IP

Domain

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Threat Watchlist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Forbidden.

Error Sample Data

Get Threat Watchlist failed.

Status Code: 403.

Message: Forbidden.

List Countermeasure Rulesets

Returns Counter Threat Unit (CTU) countermeasure rulesets.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Countermeasure Rulesets failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Forbidden.

Error Sample Data

List Countermeasure Rulesets failed.

Status Code: 403.

Message: Forbidden.

List Countermeasure Threat Indicators

Retrieves the versions of Threat Indicator Lists released by the CTU. You have the option to retrieve all versions of the Threat Indicator Lists or only the most recent ones.

Input

Input Parameter	Required/Optional	Description	Example
Version	Required	The option to retrieve all or the most recent versions of Threat Indicator Lists.	All Versions

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Countermeasure Threat Indicators failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Forbidden.

Error Sample Data

List Countermeasure Threat Indicators failed.

Status Code: 403.

Message: Forbidden.

Resolve Alerts

Resolves alerts using alert IDs.

READER NOTE

Alert ID is a required parameter to run this command.

Run the Search Alerts command to obtain the Alert ID. Alert IDs can be found in the raw data at $.data.alertsServiceSearch.alerts.list[*].id.

Input

Input Parameter	Required/Optional	Description	Example
Alert IDs	Required	The IDs of the alerts to be resolved. Alert IDs can be obtained using the Fetch Event or Search Alerts commands.	JSON `[ "alert://priv:event-filter:***:***" ]`
Resolution Status	Required	The resolution status of the alerts. The options are: Open True Positive Benign True Positive Malicious False Positive Not Actionable Other Suppressed	False Positive
Reason	Optional	The resolution reason.	–

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Resolve Alerts failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid Queries.

Error Sample Data

Resolve Alerts failed.

Status Code: 400.

Message: Invalid Queries.

Search Alerts

Retrieves alerts matching the given criteria.

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Optional	The start time (in UTC format) of the time range for searching alerts. The start time corresponds to the specified query time type. If this parameter is not defined, the default start time is 24 hours before the end time.	2023-05-01 00:00
End Time	Optional	The end time (in UTC format) of the time range for searching alerts. The end time corresponds to the specified query time type. If this parameter is not defined, the default end time is the current time.	2023-05-02 00:00
Query Time Type	Required	The time field to search for alerts. The available time fields to search by are First Activity Time, Last Activity Time, Created Time and Inserted Time.	First Activity Time
Limit	Optional	The number of the most recent events to fetch. The valid value is an integer between 1 and 10000. If this parameter is not defined, the default value is 10000.	10
Query	Optional	The query expression to filter the returned results. For more information about the query syntax, refer to the documentation at Basic Syntax. Note: There is no need to include the "from alert where" clause in your query since it has already been hard coded by D3. You should only state the query language after the "where" keyword.	severity >= 0.75 and status='OPEN'

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Search Alerts failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid Queries.

Error Sample Data

Search Alerts failed.

Status Code: 400.

Message: Invalid Queries.

Search Assets

Retrieves endpoints matching the given criteria.

Input

Input Parameter	Required/Optional	Description	Example
Limit	Optional	The maximum number of assets to return. The valid input value is an integer between 1 and 100. If this parameter is not specified, all assets matching the specified endpoint state will be returned.	10
Endpoint State	Required	The state of the endpoints to return.	Active

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Search Assets failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Forbidden.

Error Sample Data

Search Assets failed.

Status Code: 403.

Message: Forbidden.

Search Investigations

Retrieves investigations matching the given criteria.

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Optional	The start time (in UTC format) of the time range for searching investigations. The start time corresponds to the specified query time type. If this parameter is not defined, the default start time is 24 hours before the end time.	2023-05-01 00:00
End Time	Optional	The end time (in UTC format) of the time range for searching investigations. The end time corresponds to the specified query time type. If this parameter is not defined, the default end time is the current time.	2023-05-02 00:00
Query Time Type	Required	The time field to search for investigations. The available time fields to search by are Created Time, Updated Time and Notified Time.	Updated Time
Limit	Optional	The maximum number of investigations to return. The valid value is an integer between 1 and 100. If this parameter is not defined, all investigations matching the search conditions will be returned.	10
Query	Optional	The query expression to filter the returned results. For more information about the query syntax, refer to the documentation at Basic Syntax.	type in ('Security Investigation') priority =2
Filter Text	Optional	The string for a free text search.	Test-A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Search Investigations failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid Query.

Error Sample Data

Search Investigations failed.

Status Code: 400.

Message: Invalid Query.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Output Type

Description

Return Data Type

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

More details about an error can be viewed in the Error tab.

String

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Taegis XDR portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Forbidden.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 403.

Message: Forbidden.