Darktrace Email

• Darktrace URL
• Public Token
• Private Token
• Anomaly Score Threshold

Prerequisites

• Admin access to Darktrace

Create a local user

1

Open the Permissions Admin

On the Threat Visualizer of the instance from which you want to request data, click Menu, then click Admin > Permissions Admin.

2

Start a new user

Click the Created Accounts tab, then on the left side click Create new user.

3

Enter user details

Give the user a recognizable Username (e.g., radiant_connector) and a Password, then click User Templates.

4

Apply the Administrator template

For Select a user template, select Administrator, then click Threat Tray Behavior Categories to continue.

5

Continue past the default behavior categories

Keep all default settings for Threat Tray Behavior Categories unchanged, then click Flags.

6

Enable API access

Toggle the API Access selector to Yes.

If this selector cannot be changed, keep proceeding with the user creation and refer to Troubleshoot users with no API access after you finish.

7

Add the user to the Admins group

Add this user to the Darktrace Admins Group, then click Add Threat Visualizer permissions.

8

Save the user

Leave the remaining setup steps unchanged by clicking the proceeding buttons. On the Summary page, click Update user to save changes.

Troubleshoot users with no API access

Generate the API token

1

Sign in as the new user

Sign in to the Darktrace Threat Visualizer with the user created in the previous section.

2

Open Account Settings

Click Account Settings from the main menu.

3

Open API Access

Click the API Access button.

4

Generate the tokens

In the pop-up, click New. A Public Token and Private Token appear.

Copy both token values now. The Private Token cannot be retrieved later. You will provide these values to Radiant Security in the next section.

Add the credentials in Radiant Security

1. Sign in to Radiant Security.
2. From the navigation menu, select Settings > Credentials and click + Add Credential.
3. Search for and select Darktrace API from the list, then click Configure Credential.
4. Enter an identifiable name for the credential (e.g., Darktrace API Tokens) and complete the required fields:

   • Tenant URL: your Darktrace Console URL, in the format https://xxxxxx.cloud.darktrace.com.
   • Public Token: the 40-digit Public Token copied in the previous section.
   • Private Token: the 40-digit Private Token copied in the previous section.
   • Anomaly Score Threshold: a value from 0 to 100 representing the Antigena Email Score Darktrace assigns to each analyzed email. A threshold of 0 sends every email for triage; a threshold of 100 sends only emails Darktrace deems highly likely to be malicious. A starting value of 80 avoids triaging every email while ensuring those with lower Darktrace confidence scores still undergo further analysis.

Add the data connector in Radiant Security

1. From the navigation menu, select Settings > Data Connectors and click + Add Connector.
2. Search for and select Darktrace API, then click Data Feeds.
3. Select Darktrace Email Alerts, then click Credentials.
4. Select the credential created in the previous section, then click Add Connector.

Verify ingestion

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"darktrace_email".
3. Confirm recent alerts appear.