{ "openapi": "3.0.1", "x-hideTryItPanel": true, "info": { "title": "Cortex XSOAR 8 API", "description": "This is the public REST API to integrate with the Cortex XSOAR 8 server.\nHTTP request can be sent using any HTTP-client.\n\nFor an example dedicated client take a look at the [Demisto Client for Python](https://github.com/demisto/demisto-py).", "contact": { "name": "Cortex Documentation Team", "url": "", "email": "docs-cortex@paloaltonetworks.com" }, "version": "XSOAR 8 Cloud", "license": { "name": "", "url": "" } }, "servers": [ { "url": "https://api-yourfqdn", "description": "" } ], "tags": [ { "name": "API Keys", "description": "APIs for managing API keys" }, { "name": "Audit Log", "description": "APIs for audit logs" }, { "name": "Authentication settings", "description": "APIs for authentication settings, such as IdP and SSO" }, { "name": "Content Packs", "description": "APIs for content packs" }, { "name": "Dashboards", "description": "APIs for managing dashboards" }, { "name": "Engines", "description": "APIs for managing engines" }, { "name": "Entry", "description": "APIs for managing entries to the War Room" }, { "name": "Evidence", "description": "APIs for managing evidence entities" }, { "name": "Incident Fields", "description": "APIs for managing incident fields" }, { "name": "Incidents", "description": "APIs for managing incidents" }, { "name": "Indicators", "description": "APIs for managing indicators" }, { "name": "Integrations", "description": "APIs for managing indicators" }, { "name": "Investigations", "description": "APIs for managing playground investigations" }, { "name": "Item Dependencies", "description": "APIs for managing content item dependencies" }, { "name": "Jobs", "description": "APIs for managing jobs" }, { "name": "Lists", "description": "APIs for managing lists" }, { "name": "Multi-tenant", "description": "APIs for multi-tenant deployments" }, { "name": "Playbooks", "description": "APIs for managing playbooks" }, { "name": "Relationships", "description": "APIs for managing relationships between indicators" }, { "name": "Remote repository", "description": "APIs for remote repository management" }, { "name": "Reports", "description": "APIs for managing reports" }, { "name": "Scripts", "description": "APIs for managing scripts" }, { "name": "Syslog servers", "description": "APIs for managing syslog servers" }, { "name": "System Management", "description": "APIs for system management" }, { "name": "Unit 42", "description": "APIs relating to Unit 4" }, { "name": "Widgets", "description": "APIs for managing widgets" } ], "paths": { "/xsoar/public/v1/incident": { "post": { "tags": [ "Incidents" ], "summary": "Create or update an incident", "description": "Manually create a new Cortex XSOAR incident or update an existing one.\n\nTo update an existing incident, you must update the `version` parameter. For more information on updating the `version` parameter, see [Optimistic locking and versioning](./docs/Optimistic-Locking-and-Versioning.md).\n\nTo update incident custom fields, they must be in lowercase and without spaces. For example, \"Scan IP\" should be \"scanip\".\nTo get the actual key name, you can go to Cortex XSOAR CLI and run `/incident_add` and look for the key that you would like to update.\n\nUse `createInvestigation: true` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. ", "operationId": "createIncident", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateIncidentRequest" }, "examples": { "Example 1": { "value": { "details": "My test incident", "name": "My test incident", "severity": 2, "type": "Unclassified" } } } } }, "required": false }, "responses": { "200": { "description": "Request processed successfully, but no incident was created. This can occur when conditions (for example, a pre-processing rule) prevent incident creation without generating an error.", "content": {} }, "201": { "description": "Incident created successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IncidentWrapper" }, "examples": { "Example 1": { "value": { "id": "178791", "version": 0, "cacheVersn": 0, "modified": "1970-01-01T00:00:00Z", "sizeInBytes": 0, "CustomFields": { "bmcassignee": [ {} ], "bmccustomer": [ {} ], "bmcrequester": [ {} ], "containmentsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "crowdstrikefalconbehaviourpatterndispositiondetails": [ {}, {}, {} ], "datadogcloudsiem": [ {}, {}, {} ], "dataminrpulserelatedterms": [ {}, {}, {} ], "decyfirdatadetails": [ {}, {}, {} ], "detectionsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 20, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "domaintoolsirisdetect": [ {}, {}, {} ], "endpoint": [ {} ], "externalid": "178791", "extrahoprevealxdetectiondevices": [ {}, {}, {} ], "extrahoprevealxmitretechniques": [ {}, {}, {} ], "filerelationships": [ {}, {}, {} ], "fortisiemattacktactics": [ {}, {} ], "fortisiemevents": [ {} ], "incidentduration": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 0, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "incidentrdpachehuntingstringssimilarity": [ {}, {}, {} ], "incidentrdpcachehuntingstringsifter": [ {}, {}, {} ], "inventasource": [ {} ], "microsoftsentinelowner": [], "qintelqwatchexposures": [ {}, {}, {} ], "remediationsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 7200, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "rsametasevents": [], "rsarawlogslist": [], "securitypolicymatch": [ {} ], "similarincidentsdbot": [ {} ], "spycloudcompassdevicedata": [ {}, {}, {} ], "suspiciousexecutions": [ {}, {}, {} ], "timetoassignment": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 0, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "triagesla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "urlsslverification": [], "xdralertsearchresults": [ {}, {}, {} ], "xdrinvestigationresults": [ {}, {}, {}, { "columnheader1": "" }, {}, { "columnheader1": "" }, {}, {} ], "xpanseserviceclassifications": [ {}, {}, {} ], "xpanseservicevalidation": [ { "columnheader1": "" }, {}, {} ] }, "account": "", "autime": 1713700028107000000, "type": "Unclassified", "rawType": "Unclassified", "name": "My test incident", "rawName": "My test incident", "status": 0, "custom_status": "", "resolution_status": "", "reason": "", "created": "2024-04-21T11:47:08.107Z", "occurred": "2024-04-21T11:47:08.107982676Z", "closed": "0001-01-01T00:00:00Z", "sla": 0, "severity": 2, "investigationId": "", "labels": [ { "value": "", "type": "Instance" }, { "value": "Manual", "type": "Brand" } ], "attachment": null, "details": "My test incident", "openDuration": 0, "lastOpen": "0001-01-01T00:00:00Z", "closingUserId": "", "owner": "", "activated": "0001-01-01T00:00:00Z", "closeReason": "", "rawCloseReason": "", "closeNotes": "", "playbookId": "playbook0", "dueDate": "2024-05-01T11:47:08.107988742Z", "reminder": "0001-01-01T00:00:00Z", "runStatus": "", "notifyTime": "0001-01-01T00:00:00Z", "phase": "", "rawPhase": "", "isPlayground": false, "rawJSON": "", "parent": "", "parentXDRIncident": "", "retained": false, "category": "", "rawCategory": "", "linkedIncidents": null, "linkedCount": 0, "droppedCount": 0, "sourceInstance": "", "sourceBrand": "Manual", "canvases": null, "lastJobRunTime": "0001-01-01T00:00:00Z", "feedBased": false, "dbotMirrorId": "", "dbotMirrorInstance": "", "dbotMirrorDirection": "", "dbotDirtyFields": null, "dbotCurrentDirtyFields": null, "dbotMirrorTags": null, "dbotMirrorLastSync": "0001-01-01T00:00:00Z", "isDebug": false } } } } } }, "400": { "description": "Bad Request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" }, "examples": { "example-1": { "summary": "Incident creation failure", "value": { "id": "incCreateErr", "status": 400, "title": "Failed creating incident", "error": "", "encrypted": false, "multires": null } } } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" }, "examples": { "example-1": { "summary": "Internal server error.", "value": { "id": "incCreateErr", "status": 500, "title": "Internal server error.", "error": "", "encrypted": false, "multires": null } } } } } } }, "x-codegen-request-body-name": "CreateIncidentRequest", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ] } }, "/xsoar/public/v1/incident/json": { "post": { "tags": [ "Incidents" ], "summary": "Create an incident from JSON", "description": "Create a single incident from raw JSON.", "operationId": "createIncidentJson", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "all": { "type": "boolean" }, "CustomFields": { "type": "object", "properties": { "key": { "type": "string" } } }, "overrideInvestigation": { "type": "boolean" }, "closeNotes": { "type": "string" }, "data": { "type": "object", "properties": { "key": { "type": "string" } } }, "columns": { "type": "array", "items": { "type": "string" } }, "line": { "type": "string" }, "ids": { "type": "array", "items": { "type": "string" } }, "force": { "type": "boolean" }, "originalIncidentId": { "type": "string" }, "closeReason": { "type": "string" } }, "x-examples": { "Example 1": { "all": true, "filter": { "parent": [ "parent", "parent" ], "reason": [ "reason", "reason" ], "notInvestigation": [ "notInvestigation", "notInvestigation" ], "totalOnly": true, "type": [ "type", "type" ], "fromActivatedDate": "2000-01-23T04:56:07.000+00:00", "notCategory": [ "notCategory", "notCategory" ], "fromDateLicense": "2000-01-23T04:56:07.000+00:00", "andOp": true, "searchAfterElastic": [ "searchAfterElastic", "searchAfterElastic" ], "searchBefore": [ "searchBefore", "searchBefore" ], "details": "details", "id": [ "id", "id" ], "toActivatedDate": "2000-01-23T04:56:07.000+00:00", "period": { "fromValue": "fromValue", "toValue": "toValue", "byFrom": "byFrom", "field": "field", "by": "by", "byTo": "byTo" }, "searchAfterMapOrder": { "key": 6 }, "level": [ null, null ], "query": "query", "notStatus": [ null, null ], "sort": [ { "asc": true, "field": "field", "fieldType": "fieldType" }, { "asc": true, "field": "field", "fieldType": "fieldType" } ], "users": [ "users", "users" ], "fromDate": "2000-01-23T04:56:07.000+00:00", "size": 1, "fromReminder": "2000-01-23T04:56:07.000+00:00", "name": [ "name", "name" ], "files": [ "files", "files" ], "searchAfter": [ "searchAfter", "searchAfter" ], "fromClosedDate": "2000-01-23T04:56:07.000+00:00", "page": 0, "fields": [ "fields", "fields" ], "Cache": { "key": [ "Cache", "Cache" ] }, "status": [ null, null ], "ignoreWorkers": true, "filterobjectquery": "filterobjectquery", "urls": [ "urls", "urls" ], "systems": [ "systems", "systems" ], "includeTmp": true, "toClosedDate": "2000-01-23T04:56:07.000+00:00", "searchAfterMap": { "key": [ "searchAfterMap", "searchAfterMap" ] }, "toDueDate": "2000-01-23T04:56:07.000+00:00", "fromDueDate": "2000-01-23T04:56:07.000+00:00", "searchBeforeElastic": [ "searchBeforeElastic", "searchBeforeElastic" ], "toDate": "2000-01-23T04:56:07.000+00:00", "trim_events": 5, "toReminder": "2000-01-23T04:56:07.000+00:00", "timeFrame": 5, "investigation": [ "investigation", "investigation" ], "accounts": { "key": "{}" }, "category": [ "category", "category" ] }, "CustomFields": { "key": "{}" }, "overrideInvestigation": true, "closeNotes": "closeNotes", "data": { "key": "{}" }, "columns": [ "columns", "columns" ], "line": "line", "ids": [ "ids", "ids" ], "force": true, "originalIncidentId": "originalIncidentId", "closeReason": "closeReason" } } } } }, "required": false }, "responses": { "200": { "description": "IncidentWrapper", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IncidentWrapper" } } } } }, "x-codegen-request-body-name": "body" } }, "/xsoar/public/v1/incidents/search": { "post": { "tags": [ "Incidents" ], "summary": "Search incidents by filter", "description": "Search incidents across all indices. You can filter by multiple options.\n\nThe maximum response size is 250 MB. If the response is larger than this, you will get an error response.\n\n**Note:** This endpoint is not supported in multi-tenant environments.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "searchIncidents", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SearchIncidentsData" } } }, "required": true }, "responses": { "200": { "description": "incidentSearchResponse", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Incident" } }, "total": { "type": "integer" } } } } } } }, "x-codegen-request-body-name": "filter" } }, "/xsoar/public/v1/incidenttype": { "post": { "tags": [ "Incidents" ], "summary": "Create a new incident type", "description": "Create a new incident type.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "createOrUpdateIncidentType", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IncidentTypeRequest" } } }, "required": false }, "responses": { "200": { "description": "IncidentType", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IncidentType" } } } } }, "x-codegen-request-body-name": "IncidentType" } }, "/xsoar/public/v1/indicators/search": { "post": { "tags": [ "Indicators" ], "summary": "Search indicators", "description": "Search indicators by filter.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "indicatorsSearch", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IndicatorFilter" } } }, "required": false }, "responses": { "200": { "description": "indicatorResult", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IndicatorResult" } } } } }, "x-codegen-request-body-name": "IndicatorFilter" } }, "/xsoar/public/v2/statistics/widgets/query": { "post": { "tags": [ "Widgets" ], "summary": "Get widget statistics", "description": "Get the statistics for the specified widget.\n\n**Note:** This endpoint has many return types depending on the widget type and data. Each 200X represents a 200 OK request of specific widget type and data.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "GetStatsForWidget", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "dataType": { "type": "string" }, "widgetType": { "type": "string" }, "query": { "type": "string" }, "dateRange": { "type": "object", "properties": { "fromDate": { "type": "string" }, "toDate": { "type": "string" } } }, "params": { "type": "object", "properties": { "groupBy": { "type": "array", "items": { "type": "string" } } } }, "category": { "type": "string" } }, "x-examples": { "Example 1": { "id": "", "version": 0, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "", "prevName": "", "dataType": "incidents", "widgetType": "pie", "query": "", "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "", "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "groupBy": [ "dbotStatus" ] }, "category": "" } } }, "examples": { "Example 1": { "value": { "script": { "name": "hello_world_2", "dockerImage": "demisto/python3:3.10.14.92207", "propagationLabels": [ "all" ] }, "savePassword": false } } } } }, "required": false }, "responses": { "200": { "description": "Response depends on the widget type:\n - Incident data type of a \"table\" or \"list\" widget returns incidentSearchResponse\n total:\n type: integer\n data:\n type: array\n items:\n \"$ref\": \"#/components/schemas/Incident\"\n - Indicators data type of a \"table\" or \"list\" widget returns IoCsResponse\n total:\n type: integer\n data:\n type: array\n items:\n \"$ref\": \"#/components/schemas/IocObject\"\n - Number widget returns a simple number\n type: integer\n - Trend widget returns a trend object\n \"$ref\": \"#/components/schemas/StatsTrendsResponse\"\n - Text widget returns a text object, describing the final text and the placeholders values.\n \"$ref\": \"#/components/schemas/StatsTextResponse\"\n - Line chart widget or Column chart widget returns StatsResponseWithReferenceLine\n \"$ref\": \"#/components/schemas/StatsResponseWithReferenceLine\"\n - A chart data array by groups. When requesting a date, the key is the date string, according to the specified time frame. Empty groups (dates) are also returned.\n type: array\n items:\n \"$ref\": \"#/components/schemas/Group\"", "content": { "application/json": { "schema": { "oneOf": [ { "type": "object", "properties": { "total": { "type": "integer" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Incident" } } } }, { "type": "object", "properties": { "total": { "type": "integer" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/IocObject" } } } }, { "type": "object", "properties": { "number": { "type": "integer" } } }, { "$ref": "#/components/schemas/StatsTrendsResponse" }, { "$ref": "#/components/schemas/StatsTextResponse" }, { "$ref": "#/components/schemas/StatsResponseWithReferenceLine" }, { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Group" } } } } ] }, "examples": { "Example 1": { "value": { "ErrorsPrivateDoNotUse": null, "total": 1, "data": [ { "id": "178794", "version": 1, "cacheVersn": 0, "modified": "2024-04-30T13:02:17.93Z", "sizeInBytes": 0, "sortValues": [ "1" ], "dbotCreatedBy": "user@company.com", "CustomFields": { "bmcassignee": [ {} ], "bmccustomer": [ {} ], "bmcrequester": [ {} ], "containmentsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "crowdstrikefalconbehaviourpatterndispositiondetails": [ {}, {}, {} ], "datadogcloudsiem": [ {}, {}, {} ], "dataminrpulserelatedterms": [ {}, {}, {} ], "decyfirdatadetails": [ {}, {}, {} ], "detectionsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 20, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "domaintoolsirisdetect": [ {}, {}, {} ], "endpoint": [ {} ], "externalid": "178794", "extrahoprevealxdetectiondevices": [ {}, {}, {} ], "extrahoprevealxmitretechniques": [ {}, {}, {} ], "filerelationships": [ {}, {}, {} ], "fortisiemattacktactics": [ {}, {} ], "fortisiemevents": [ {} ], "incidentduration": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 0, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "incidentrdpachehuntingstringssimilarity": [ {}, {}, {} ], "incidentrdpcachehuntingstringsifter": [ {}, {}, {} ], "inventasource": [ {} ], "microsoftsentinelowner": [], "qintelqwatchexposures": [ {}, {}, {} ], "remediationsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 7200, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "3degpevt": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "3rxb5har": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "42q8ri0w": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "7prumt0z": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "a28fg0oj": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "bmhsqopn": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "bxvy7aci": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "bzxrevrq": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "cfzmni5r": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "h5eoo5d7": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "irh1zn5e": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "iuoszzbg": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "jbpbuedw": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "kethuvyk": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "lyefflpk": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "o4zg2bva": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "oq4ib3rq": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "oupkddj1": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "psjrp4kv": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "pufesh2i": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "qub0kxf8": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "sbwfoqdv": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "tzpheljw": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "v86tnqon": [ {} ], "wl53df56": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "xtmm8ix9": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "ym2kvwjh": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 1, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "rsametasevents": [], "rsarawlogslist": [], "securitypolicymatch": [ {} ], "similarincidentsdbot": [ {} ], "spycloudcompassdevicedata": [ {}, {}, {} ], "suspiciousexecutions": [ {}, {}, {} ], "timetoassignment": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 0, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "triagesla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "urlsslverification": [], "xdralertsearchresults": [ {}, {}, {} ], "xdrinvestigationresults": [ {}, {}, {}, { "columnheader1": "" }, {}, { "columnheader1": "" }, {}, {} ], "xpanseserviceclassifications": [ {}, {}, {} ], "xpanseservicevalidation": [ { "columnheader1": "" }, {}, {} ] }, "account": "", "autime": 1714482136614000000, "type": "default_type", "rawType": "default_type", "name": "ITmoiUOu", "rawName": "ITmoiUOu", "status": 1, "custom_status": "", "resolution_status": "", "reason": "", "created": "2024-04-30T13:02:16.614Z", "occurred": "2024-04-30T13:02:16.929227958Z", "closed": "0001-01-01T00:00:00Z", "sla": 0, "severity": 1, "investigationId": "178794", "labels": [ { "value": "user@company.com", "type": "Instance" }, { "value": "Manual", "type": "Brand" } ], "attachment": null, "details": "", "openDuration": 0, "lastOpen": "0001-01-01T00:00:00Z", "closingUserId": "", "owner": "", "activated": "0001-01-01T00:00:00Z", "closeReason": "", "rawCloseReason": "", "closeNotes": "", "playbookId": "", "dueDate": "0001-01-01T00:00:00Z", "reminder": "0001-01-01T00:00:00Z", "runStatus": "", "notifyTime": "0001-01-01T00:00:00Z", "phase": "", "rawPhase": "", "isPlayground": false, "rawJSON": "", "parent": "", "parentXDRIncident": "", "retained": false, "category": "", "rawCategory": "", "linkedIncidents": [], "linkedCount": 0, "droppedCount": 0, "sourceInstance": "user@company.com", "sourceBrand": "Manual", "canvases": null, "lastJobRunTime": "0001-01-01T00:00:00Z", "feedBased": false, "dbotMirrorId": "", "dbotMirrorInstance": "", "dbotMirrorDirection": "", "dbotDirtyFields": null, "dbotCurrentDirtyFields": null, "dbotMirrorTags": null, "dbotMirrorLastSync": "0001-01-01T00:00:00Z", "isDebug": false } ] } } } } } } }, "x-codegen-request-body-name": "body", "x-internal": false }, "parameters": [] }, "/public_api/v1/audits/management_logs": { "post": { "operationId": "postManagementLogs", "tags": [ "Audit Log" ], "summary": "Get audit management log", "description": "Get audit management logs.\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 100.\n- Offset is the zero-based number of incidents from the start of the result set.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "search_from": 0, "search_to": 19, "sort": { "field": "email", "keyword": "ASC" }, "filters": [ { "field": "type", "operator": "in", "value": [ "AUTH" ] }, { "field": "sub_type", "operator": "in", "value": [ "login" ] }, { "field": "result", "operator": "in", "value": [ "SUCCESS" ] }, { "field": "timestamp", "operator": "lte", "value": 1565074114053 } ] } } }, "properties": { "request_data": { "type": "object", "description": "A dictionary containing the API request fields.\nAn empty dictionary returns all results.", "properties": { "filters": { "type": "array", "description": "Array of filter fields.", "items": { "type": "object", "properties": { "field": { "type": "string", "description": "Filter is based on the following keywords:\n- `email`: User's email address.\n- `type`: Type of audit log.\n- `sub_type`: Subtype of audit log.\n- `result`: Result type.\n- `timestamp`: Log timestamp.", "enum": [ "email", "type", "sub_type", "result", "timestamp" ] }, "operator": { "type": "string", "description": "Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `email`, `type`, `sub_type`, `result`: List of strings\n`gte` / `lte`\n- `timestamp`: Integer in timestamp epoch milliseconds\n", "enum": [ "in", "gte", "lte" ] }, "value": { "type": [ "string", "array", "integer" ], "description": "Value that this filter must match.\n- `timestamp`: Integer representing the number of milliseconds after the Unix epoch, UTC timezone.\n- All other fields require a string value. In the case of `in` operator, the value is an array.", "items": { "type": "string" } } }, "required": [ "field", "operator", "value" ] } }, "search_from": { "type": "integer", "description": "An integer representing the starting offset within the query result set from which you want management logs returned.\nManagement logs are returned as a zero-based list. Any log indexed less than this value is not returned in the final result set and defaults to zero." }, "search_to": { "type": "integer", "description": "An integer representing the end offset within the result set after which you do not want management logs returned.\nLogs in the management log list that are indexed higher than this value are not returned in the final results set. Defaults to 100, which returns all logs to the end of the list.", "default": 100 }, "sort": { "type": "object", "description": "Identifies the sort order for the result set. By default the sort is defined as creation-time and desc.", "properties": { "field": { "type": "string", "enum": [ "type", "sub-type", "result" ], "description": "The field you want to sort by." }, "keyword": { "type": "string", "enum": [ "asc", "desc" ], "default": "desc", "description": "Whether to sort in ascending or descending order." } }, "required": [ "field", "keyword" ] } } } } }, "examples": { "Request all management logs from older to newer": { "value": { "request_data": { "search_from": 0, "search_to": 100, "sort": { "field": "timestamp", "keyword": "asc" } } } }, "Request all results": { "value": { "request_data": {} } }, "Request all successful login events after 06-Aug-19, sorted by timestamp oldest to newest": { "value": { "request_data": { "search_from": 0, "search_to": 100, "sort": { "field": "timestamp", "keyword": "asc" }, "filters": [ { "field": "type", "operator": "in", "value": [ "AUTH" ] }, { "field": "sub_type", "operator": "in", "value": [ "login" ] }, { "field": "result", "operator": "in", "value": [ "SUCCESS" ] }, { "field": "timestamp", "operator": "gte", "value": 1565074114053 } ] } } } } } }, "description": "To retrieve all of the results, you need to iterate over the `total_count` in increments of 100 using `search_from` and `search_to` fields in the request." }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "reply": { "total_count": 1, "result_count": 1, "data": [ { "AUDIT_ID": 1, "AUDIT_OWNER_NAME": "User Name", "AUDIT_OWNER_EMAIL": "username@paloaltonetworks.com", "AUDIT_ASSET_JSON": "{}", "AUDIT_ASSET_NAMES": "", "AUDIT_HOSTNAME": null, "AUDIT_RESULT": "SUCCESS", "AUDIT_REASON": null, "AUDIT_DESCRIPTION": null, "AUDIT_ENTITY": "AUTH", "AUDIT_ENTITY_SUBTYPE": "Login", "AUDIT_SESSION_ID": null, "AUDIT_CASE_ID": null, "AUDIT_INSERT_TIME": 1565074114053 } ] } } }, "properties": { "reply": { "type": "object", "description": "JSON object containing the query result.", "properties": { "total_count": { "type": "integer", "description": "Number of total results of this filter without paging." }, "result_count": { "type": "integer", "description": "Number of returned items." }, "data": { "type": "array", "description": "List of audit items.", "items": { "type": "object", "properties": { "AUDIT_ID": { "type": "integer" }, "AUDIT_OWNER_NAME": { "type": "string" }, "AUDIT_OWNER_EMAIL": { "type": "string" }, "AUDIT_ASSET_JSON": { "type": "string" }, "AUDIT_ASSET_NAMES": { "type": "string" }, "AUDIT_HOSTNAME": { "type": "string" }, "AUDIT_RESULT": { "type": "string" }, "AUDIT_REASON": { "type": "string" }, "AUDIT_DESCRIPTION": { "type": "string" }, "AUDIT_ENTITY": { "type": "string", "enum": [ "LIVE_TERMINAL", "RULES", "RULES_EXCEPTIONS", "AUTH", "RESPONSE", "INCIDENT_MANAGEMENT", "ALERT_MANAGEMENT", "INCIDENT_TIMELINE_EVENT", "ENDPOINT_MANAGEMENT", "ENDPOINT_GROUPS", "ALERT_WHITELIST", "PUBLIC_API", "DISTRIBUTIONS", "STARRED_INCIDENTS", "POLICY_PROFILES", "DEVICE_CONTROL_PROFILES", "DEVICE_CONTROL_POLICY", "PROTECTION_PROFILES", "DEVICE_CONTROL_PROFILE", "HOST_FIREWALL_PROFILE", "HOST_DISK_ENCRYPTION_PROFILE", "POLICY_RULES", "PROTECTION_POLICY", "DEVICE_CONTROL_TEMP_EXCEPTIONS", "DEVICE_CONTROL_GLOBAL_EXCEPTIONS", "DEVICE_CONTROL_CUSTOM_DEVICE", "GLOBAL_EXCEPTIONS", "MSSP", "REPORTING", "DASHBOARD", "BROKER_API", "BROKER_VM", "MTH", "MDR", "ALERT_NOTIFICATIONS", "INTEGRATIONS", "QUERY", "SCRIPT_EXECUTION", "ALERT_RULES", "COLLECTION", "API_KEY", "EDL", "VA_RESCAN_ENDPOINT", "HI_RESCAN_ENDPOINT", "REMEDIATION", "INGEST_DATA", "LICENSING", "AGENT_CONFIGURATION", "PERMISSIONS", "SCORING_RULES", "LAYOUT_RULES", "PLAYBOOK_TRIGGERS", "FEATURED_ALERT_FIELDS", "SYSTEM", "TENANT_TAKEOVER", "SCOUTER_POLICY", "SCOUTER_PROFILE", "SCOUTER_GROUPS", "ALLOWED_DOMAINS", "QUERY_LIBRARY", "TENANT_CONFIGURATION", "SCOUTER_CONFIGURATION", "HOST_FIREWALL", "XIF", "XDM", "ACTION_CENTER", "XCLOUD_INTEGRATION", "DATASETS", "XSOAR", "SECURITY_SETTINGS", "ALERT_EXCLUSION", "INDICATOR_RULES", "EVENT_FORWARDING", "ASSET_INVENTORY", "SERVER_SETTINGS", "ASSET_ROLES", "CUSTOM_FIELDS", "AUTOMATION_RULES", "AGENT_EXCEPTION_RULES", "REMEDIATION_PATH_RULES" ] }, "AUDIT_ENTITY_SUBTYPE": { "type": "string" }, "AUDIT_SESSION_ID": { "type": "integer" }, "AUDIT_CASE_ID": { "type": "integer" }, "AUDIT_INSERT_TIME": { "type": "integer" }, "AUDIT_SEVERITY": { "type": "string" }, "AUDIT_LINK": { "type": "string" }, "AUDIT_SOURCE_IP": { "type": "string" }, "AUDIT_USER_AGENT": { "type": "string" }, "AUDIT_USER_ROLES": { "type": "array", "items": { "type": "string" } }, "AUDIT_ADDITIONAL_INFORMATION": { "type": "object", "properties": { "endpoint_names": { "type": "array", "items": { "type": "string" } }, "endpoint_count": { "type": "integer" } } }, "AUDIT_OBJECT_ID": { "type": "string" } } } } } } } }, "examples": { "example-1": { "value": { "reply": { "total_count": 1, "result_count": 1, "data": [ { "AUDIT_ID": 1, "AUDIT_OWNER_NAME": "User Name", "AUDIT_OWNER_EMAIL": "username@paloaltonetworks.com", "AUDIT_ASSET_JSON": "{}", "AUDIT_ASSET_NAMES": "", "AUDIT_HOSTNAME": "", "AUDIT_RESULT": "SUCCESS", "AUDIT_REASON": "", "AUDIT_DESCRIPTION": "", "AUDIT_ENTITY": "AUTH", "AUDIT_ENTITY_SUBTYPE": "Login", "AUDIT_SESSION_ID": 382303947890, "AUDIT_CASE_ID": 473829372, "AUDIT_INSERT_TIME": 1565074114053, "AUDIT_SEVERITY": "SEV_020_LOW", "AUDIT_LINK": null, "AUDIT_SOURCE_IP": "31.174.156.148", "AUDIT_USER_AGENT": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36", "AUDIT_USER_ROLES": [ "Account Admin" ], "AUDIT_ADDITIONAL_INFORMATION": { "endpoint_names": [ "WIN-fgo6762G" ], "endpoint_count": 1 }, "AUDIT_OBJECT_ID": null } ] } } } } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } } } }, "/public_api/v1/rbac/get_roles": { "post": { "tags": [ "System Management" ], "summary": "Get roles", "description": "Retrieve information about one or more roles created in your environment.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "post-public_api-v1-rbac-get_roles", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "role_names": { "type": "array", "description": "List of one or more role names in your environment for which you want detailed information.", "items": { "type": "string" } } }, "description": "A dictionary containing the API request fields." } }, "x-examples": { "Example 1": { "request_data": { "role_names": [ "Role1", "Role2" ] } } } } } }, "required": false }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "array", "description": "JSON object containing the query result.", "items": { "type": "object", "properties": { "pretty_name": { "type": "string", "description": "Name of the role as it appears in the Management Console." }, "permissions": { "type": "array", "description": "List of permissions associated with this role.", "items": { "type": "string" } }, "insert_time": { "type": "integer", "description": "Timestamp of when the Role was created." }, "update_time": { "type": "integer", "description": "Timestamp of when the Role was last updated.Email of the user who created the Role.", "nullable": true }, "created_by": { "type": "string", "description": "Email of the user who created the Role." }, "description": { "type": "string", "description": "Description of the Role, if available." }, "groups": { "type": "array", "description": "Group names associated with the Role.", "items": { "type": "string" } }, "users": { "type": "array", "description": "Email addresses of users associated with the Role.", "items": { "type": "string" } } } } } }, "x-examples": { "Example 1": { "reply": [ [ { "pretty_name": "Role1", "permissions": [ "Reports", "Playbooks", "Datasets Access Control", "Dashboards", "Scripts" ], "insert_time": 1658315576844, "created_by": "user1@acme.com", "description": "", "groups": [ "group1", "group2" ], "users": [] } ], [ { "pretty_name": "Role2", "permissions": [ "Dashboards", "Datasets Access Control" ], "insert_time": 1661435660656, "created_by": "user1@acme.com", "description": "", "groups": [], "users": [] } ] ] } } } }, "Example 1": { "example": { "reply": [ [ { "pretty_name": "Role1", "permissions": [ "Reports", "Playbooks", "Datasets Access Control", "Dashboards", "Scripts" ], "insert_time": 1658315576844, "update_time": null, "created_by": "user1@acme.com", "description": "", "groups": [ "group1", "group2" ], "users": [] } ], [ { "pretty_name": "Role2", "permissions": [ "Dashboards", "Datasets Access Control" ], "insert_time": 1661435660656, "update_time": null, "created_by": "user1@acme.com", "description": "", "groups": [], "users": [] } ] ] } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "x-codegen-request-body-name": "body" } }, "/public_api/v1/rbac/get_user_group": { "post": { "tags": [ "System Management" ], "summary": "Get user groups", "description": "Retrieve a list of the current user emails associated with one or more user groups in your environment.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "post-public_api-v1-rbac-get_user_group", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "group_names": { "type": "array", "description": "List of one or more user group names for which you want the associated users.", "items": { "type": "string" } } }, "description": "A dictionary containing the API request fields." } }, "x-examples": { "Example 1": { "request_data": { "group_names": [ "Group1", "Group2" ] } } } } } }, "required": false }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "array", "description": "JSON object containing the query result.", "items": { "type": "object", "properties": { "group_name": { "type": "string", "description": "Name of the User Group." }, "description": { "type": "string", "description": "Description of the User Group, if available." }, "pretty_name": { "type": "string", "description": "Name of the User Group as it appears in the Management Console." }, "insert_time": { "type": "integer", "description": "Timestamp of when the User Group was created." }, "update_time": { "type": "integer", "description": "Timestamp of when the User Group was last updated." }, "user_email": { "type": "array", "description": "List of email addresses belonging to the users associated with the User Group.", "items": { "type": "string" } }, "source": { "type": "string", "description": "Type of User Group." } } } } }, "x-examples": { "Example 1": { "reply": [ { "group_name": "Group1", "pretty_name": "Investigator", "insert_time": 1661170832341, "update_time": 1661171650679, "user_email": [ "user1@acme.com", "user2@pacme.com", "user3@acme.com", "user4@acme.com", "user5@acme.com" ], "source": "Custom" }, { "group_name": "Group2", "pretty_name": "Instance Administrator", "insert_time": 1660830450590, "update_time": 1661171631589, "user_email": [ "user1@acme.com", "user2@acme.com", "user3@acme.com", "user4@acme.com" ], "source": "Custom" } ] } } } }, "Example 1": { "example": { "reply": [ { "group_name": "Group1", "description": null, "pretty_name": "Investigator", "insert_time": 1661170832341, "update_time": 1661171650679, "user_email": [ "user1@acme.com", "user2@pacme.com", "user3@acme.com", "user4@acme.com", "user5@acme.com" ], "source": "Custom" }, { "group_name": "Group2", "description": null, "pretty_name": "Instance Administrator", "insert_time": 1660830450590, "update_time": 1661171631589, "user_email": [ "user1@acme.com", "user2@acme.com", "user3@acme.com", "user4@acme.com" ], "source": "Custom" } ] } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "x-codegen-request-body-name": "body" } }, "/public_api/v1/rbac/get_users": { "post": { "tags": [ "System Management" ], "summary": "Get users", "description": "Retrieve a list of the current users in your environment.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "post-public_api-v1-rbac-get_users", "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": false }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "array", "description": "JSON object containing the query result.", "items": { "type": "object", "properties": { "user_email": { "type": "string", "description": "Email address of the user." }, "user_first_name": { "type": "string", "description": "First name of the user." }, "user_last_name": { "type": "string", "description": "Last name of the user." }, "role_name": { "type": "string", "description": "Role name associated with the user." }, "last_logged_in": { "type": "integer", "description": "Timestamp of when the user last logged in." }, "user_type": { "type": "string", "description": "Type of user." }, "groups": { "type": "array", "description": "Name of user groups associated with the user, if applicable.", "items": { "type": "string" } }, "scope": { "type": "array", "description": "Name of scope associated with the user, if applicable.", "items": { "type": "string" } } } } } }, "x-examples": { "Example 1": { "reply": [ { "user_email": "user1@acme.com", "user_first_name": "", "user_last_name": "", "role_name": "Account Admin", "last_logged_in": 1640024700241, "user_type": "CSP", "groups": [], "scope": [] }, { "user_email": "user2@acme.com", "user_first_name": "", "user_last_name": "", "role_name": "Account Admin", "user_type": "CSP", "groups": [], "scope": [] }, { "user_email": "user3@acme.com", "user_first_name": "", "user_last_name": "", "role_name": "Investigator", "user_type": "CSP", "groups": [], "scope": [] } ] } } } }, "Example 1": { "example": { "reply": [ { "user_email": "user1@acme.com", "user_first_name": "", "user_last_name": "", "role_name": "Account Admin", "last_logged_in": 1640024700241, "user_type": "CSP", "groups": [], "scope": [] }, { "user_email": "user2@acme.com", "user_first_name": "", "user_last_name": "", "role_name": "Account Admin", "last_logged_in": null, "user_type": "CSP", "groups": [], "scope": [] }, { "user_email": "user3@acme.com", "user_first_name": "", "user_last_name": "", "role_name": "Investigator", "last_logged_in": null, "user_type": "CSP", "groups": [], "scope": [] } ] } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "type": "object" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "x-codegen-request-body-name": "body" } }, "/public_api/v1/rbac/set_user_role": { "post": { "tags": [ "System Management" ], "summary": "Set a user role", "description": "Add or remove one or more users from a role.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "post-public_api-v1-rbac-set_user_role", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "user_emails": { "type": "array", "description": "List of one or more user emails of users you want to add to or remove from a role.", "items": { "type": "string" } }, "role_name": { "type": "string", "description": "Name of the role you want to add a user to. Send an empty field to remove the user." } }, "description": "A dictionary containing the API request fields." } }, "x-examples": { "Example 1": { "request_data": { "user_emails": [ "user1@acme.com", "user2@acme.com" ], "role_name": "Role1" } } } } } }, "required": false }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "update_count": { "type": "string", "description": "Number of updated users." } }, "description": "JSON object containing the query result." } }, "x-examples": { "Example 1": { "reply": { "update_count": "2" } } } } }, "Example 1": { "example": { "reply": { "update_count": "2" } } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "x-codegen-request-body-name": "body" } }, "/public_api/v1/system_diagnostics/data/papi/": { "post": { "tags": [ "System Management" ], "summary": "Get System Health Metrics", "description": "Retrieves system health metrics snapshots for the tenant. Each snapshot\ncontains node metrics, component statuses, storage usage, queue depths,\nand external connectivity information.\n\nBy default, returns data from the last 24 hours. Snapshots are ordered\nby timestamp descending (most recent first). \r\n\r\n**Note:** This endpoint is supported in XSOAR 8.13 On-prem and later. \n", "parameters": [ { "schema": { "type": "string", "example": "{your_api_key}" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "operationId": "getSystemHealthMetrics", "responses": { "200": { "description": "Successful response containing system diagnostics snapshots.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SystemDiagnosticsResponse" }, "example": { "reply": { "results": [ { "timestamp": "2024-10-27T10:00:00Z", "nodes": [ { "name": "ip-10-0-1-5", "cpu_usage": 15.5, "memory_usage": 42.1, "os_disk_usage": 25, "connected": true }, { "name": "ip-10-0-1-6", "cpu_usage": 22.3, "memory_usage": 55, "os_disk_usage": 30, "connected": true } ], "cluster_disk_usage": 35.2, "components": { "API": "HEALTHY", "Databases": "HEALTHY", "External Gateways": "WARNING", "Playbook Engines": "HEALTHY", "Automation Layer": "HEALTHY", "System Scheduler": "HEALTHY", "System Orchestrators": "HEALTHY", "Execution Environments": "HEALTHY", "Telemetry": "HEALTHY", "Storage": "HEALTHY" }, "storage": { "Relational DB": 45, "Object Storage": 12.5, "Cache": 60.2, "Queue": 1.64, "Content": 3.04, "Document DB": 9.51, "Automation Layer": 1.54, "Execution Environments": 5.4 }, "queues": { "Manual": 0, "Automated": 12 }, "connectivity": { "connected": true, "since": "2024-10-20T08:00:00Z", "error": null } } ] } } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "reply": { "err_code": 400, "err_msg": "Bad request", "err_extra": null } } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "reply": { "err_code": 401, "err_msg": "Public API request unauthorized", "err_extra": null } } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "reply": { "err_code": 402, "err_msg": "Unauthorized license type", "err_extra": null } } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "reply": { "err_code": 403, "err_msg": "Forbidden. Access was denied to this resource.", "err_extra": "Insufficient permissions for api key" } } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "reply": { "err_code": 500, "err_msg": "Failed to get system diagnostics PAPI data", "err_extra": null } } } } } } } }, "/xsoar/public/v1/automation/load/{script_id}": { "post": { "tags": [ "Scripts" ], "summary": "Get details about a specific script", "description": "Retrieve detailed information about the specified script. You can use the script name or script ID as the path parameter to identify the script.", "operationId": "post-automation-load-script_id", "parameters": [ { "name": "script_id", "in": "path", "description": "Script name or ID", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "MainEngineInfo": { "type": "object", "properties": { "engine": { "type": "string" }, "engineGroup": { "type": "string" } } }, "arguments": { "type": "array", "items": { "type": "object", "properties": { "default": { "type": "boolean" }, "defaultValue": { "type": "string" }, "deprecated": { "type": "boolean" }, "description": { "type": "string" }, "hidden": { "type": "boolean" }, "name": { "type": "string" }, "required": { "type": "boolean" }, "secret": { "type": "boolean" }, "type": { "type": "string" } } } }, "cacheVersn": { "type": "integer" }, "comment": { "type": "string" }, "commitMessage": { "type": "string" }, "contextKeys": { "type": "array", "items": { "type": "object", "properties": {} } }, "definitionId": { "type": "string" }, "deprecated": { "type": "boolean" }, "detached": { "type": "boolean" }, "dockerImage": { "type": "string" }, "enabled": { "type": "boolean" }, "engine": { "type": "string" }, "engineGroup": { "type": "string" }, "fromServerVersion": { "type": "string" }, "id": { "type": "string" }, "itemVersion": { "type": "string" }, "locked": { "type": "boolean" }, "modified": { "type": "string" }, "name": { "type": "string" }, "packID": { "type": "string" }, "packName": { "type": "string" }, "packPropagationLabels": { "type": "array", "items": { "type": "string" } }, "permitted": { "type": "boolean" }, "prevName": { "type": "string" }, "primaryTerm": { "type": "integer" }, "propagationLabels": { "type": "array", "items": { "type": "object", "properties": {} } }, "pswd": { "type": "string" }, "pswdProtected": { "type": "boolean" }, "rawTags": { "type": "array", "items": { "type": "string" } }, "runAs": { "type": "string" }, "runOnce": { "type": "boolean" }, "script": { "type": "string" }, "scriptTarget": { "type": "integer" }, "searchableName": { "type": "string" }, "sensitive": { "type": "boolean" }, "sequenceNumber": { "type": "integer" }, "shouldCommit": { "type": "boolean" }, "subtype": { "type": "string" }, "system": { "type": "boolean" }, "tags": { "type": "array", "items": { "type": "string" } }, "timeout": { "type": "integer" }, "toServerVersion": { "type": "string" }, "type": { "type": "string" }, "user": { "type": "string" }, "vcShouldIgnore": { "type": "boolean" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean" }, "version": { "type": "integer" }, "visualScript": { "type": "string" } }, "x-examples": { "Example 1": { "MainEngineInfo": { "engine": "", "engineGroup": "" }, "arguments": [ { "default": true, "defaultValue": "${lastCompletedTaskEntries}", "deprecated": false, "description": "Entry IDs to add its output to Evidence Board", "hidden": false, "name": "entryIDs", "required": true, "secret": false, "type": "" }, { "default": false, "deprecated": true, "description": "Description to add to Evidence Board", "hidden": false, "name": "desc", "required": false, "secret": false, "type": "" }, { "default": false, "deprecated": false, "description": "Description to add to Evidence Board", "hidden": false, "name": "description", "required": false, "secret": false, "type": "" }, { "default": false, "deprecated": false, "description": "Occurred time of the evidence (time format: 2008-01-02T15:04:05)", "hidden": false, "name": "occurred", "required": false, "secret": false, "type": "" }, { "default": false, "deprecated": false, "description": "Evidence tags", "hidden": false, "name": "tags", "required": false, "secret": false, "type": "" } ], "cacheVersn": 0, "comment": "Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)\n", "commitMessage": "", "contextKeys": [], "definitionId": "", "deprecated": false, "detached": false, "dockerImage": "", "enabled": true, "engine": "", "engineGroup": "", "fromServerVersion": "5.0.0", "id": "AddEvidence", "itemVersion": "1.13.16", "locked": false, "modified": "2023-12-31T14:07:47.449149202Z", "name": "AddEvidence", "packID": "CommonScripts", "packName": "Common Scripts", "packPropagationLabels": [ "all" ], "permitted": true, "prevName": "AddEvidence", "primaryTerm": 12, "propagationLabels": [], "pswd": "", "pswdProtected": false, "rawTags": [ "Utility" ], "runAs": "DBotWeakRole", "runOnce": false, "script": "// pack version: 1.13.16\nif (!args.entryIDs) {\n throw 'Missing argument values for command AddEvidenceJS are : entryIDs';\n}\nvar entryIDs = args.entryIDs;\nvar entryTags = args.tags;\nvar desc = (args.description) ? args.description : args.desc ? args.desc : 'Evidence added by DBot';\nentryIDs = (Array.isArray(entryIDs)) ? entryIDs : [entryIDs];\nentryTags = (Array.isArray(entryTags)) ? entryTags.join(',') : entryTags;\n\nfor (var i=0;i str:\n return self.__title\n\n def set_header_labels(self, headers: List[Tag]):\n self.__headers = [header.text.strip() for header in headers]\n\n def get_header_labels(self) -> List[str]:\n return self.__headers\n\n def add_row(self, columns: List[Tag], labels: Optional[List[Tag]] = None):\n \"\"\"\n Add a row with cells and labels.\n\n :param columns: List of data cells of the row.\n :param labels: List of header cells of the row.\n \"\"\"\n rowspan_labels = self.__rowspan_labels\n\n # Normalize labels\n if labels and any(label.attrs.get('rowspan') for label in labels):\n self.__set_rowspan_labels(labels)\n\n normalized_labels = []\n if labels:\n for i, (count, label) in enumerate(rowspan_labels):\n if count >= 2:\n normalized_labels.append(label)\n\n for label in labels:\n try:\n colspan = int(label.attrs.get('colspan') or 1)\n except Exception:\n colspan = 1\n normalized_labels += [label.text.strip()] * max(1, colspan)\n\n # Normalize columns\n if any(col.attrs.get('rowspan') for col in columns):\n self.__set_rowspan_labels(columns)\n\n normalized_columns = []\n for i, (count, label) in enumerate(rowspan_labels):\n if count >= 2:\n normalized_columns.append(label)\n rowspan_labels[i] = count - 1, label\n\n for col in columns:\n try:\n colspan = int(col.attrs.get('colspan') or 1)\n except Exception:\n colspan = 1\n normalized_columns += [col.text.strip()] * max(1, colspan)\n\n self.__rows.append((normalized_labels, normalized_columns))\n\n def get_rows(self) -> List[Tuple[List[str], List[str]]]:\n return self.__rows\n\n def make_pretty_table_rows(self, default_header_line: Optional[str] = None) -> Any:\n \"\"\"\n Format a table\n\n :param default_header_line: Which table line handles as header by default, 'first_column' or 'first_row'\n :return: The table formatted in JSON structure.\n \"\"\"\n rows: List[Union[str, Dict[str, Any]]] = []\n temp_row: Dict[str, Any] = {}\n\n tbl_rows = self.__rows\n headers = self.__headers\n\n if default_header_line and default_header_line != 'none':\n if not headers and not any(labels for labels, cols in tbl_rows):\n if default_header_line in ('first_column', 'first_row'):\n # The first column or row is considered as header\n if default_header_line == 'first_column':\n # transpose\n tbl_rows = [([], list(cols)) for cols in zip(*[cols for labels, cols in tbl_rows])]\n\n labels, headers = tbl_rows[0]\n tbl_rows = tbl_rows[1:]\n else:\n raise ValueError(f'Unknown default header line: {default_header_line}')\n\n for labels, cols in tbl_rows:\n labels = labels[-1:]\n headers = labels + headers[len(labels):len(headers) - len(labels)]\n\n if not cols:\n continue\n\n elif len(cols) == 1:\n if len(headers) >= 1:\n # If there 1 header and 1 column, treat as key-value\n key = headers[0]\n vals = temp_row.get(key)\n if vals is None:\n temp_row[key] = cols[0]\n elif type(vals) == list:\n temp_row[key] = vals + [cols[0]]\n else:\n temp_row[key] = [vals, cols[0]]\n else:\n if temp_row:\n rows.append(temp_row)\n temp_row = {}\n\n # Single value in a table - just create an array of strings\n rows.append(cols[0])\n\n elif len(cols) == 2 and len(headers) == 0:\n # If there are 2 columns and no headers, treat as key-value\n key = cols[0]\n vals = temp_row.get(key)\n if vals is None:\n temp_row[key] = cols[1]\n elif type(vals) == list:\n temp_row[key] = vals + [cols[1]]\n else:\n temp_row[key] = [vals, cols[1]]\n else:\n if temp_row:\n rows.append(temp_row)\n temp_row = {}\n\n rows.append({headers[i] if i < len(headers) else 'cell' + str(i): col for i, col in enumerate(cols)})\n\n if temp_row:\n rows.append(temp_row)\n\n if len(rows) == 1 and type(rows[0]) == dict:\n return rows[0]\n return rows\n\n\ndef find_table_title(base: Optional[Union[BeautifulSoup, Tag, NavigableString]],\n node: Union[BeautifulSoup, Tag, NavigableString]) -> Optional[str]:\n \"\"\"\n Search for a table title from a node.\n\n :param base: The top node of the tree.\n :param node: The node from which searching starts.\n :return: A title found.\n \"\"\"\n title = ''\n orig = node\n prev = node.previous_element\n while prev and node is not base:\n node = prev\n if isinstance(node, Tag) and node.name in ('h1', 'h2', 'h3', 'h4', 'h5', 'h6'):\n title = ' '.join(node.text.strip().split())\n break\n\n prev = node.previous_element\n\n if not title or title.count(' ') >= TITLE_THRESHOLD:\n message = ''\n node = orig\n prev = node.previous_element\n while prev and node is not base:\n node = prev\n if isinstance(node, NavigableString):\n message = (str(node) if message else str(node).rstrip()) + message\n if message.lstrip() and any(c in message for c in ('\\n', '\\r')):\n break\n\n prev = node.previous_element\n\n message = ' '.join(message.strip().split())\n title = title if title and message.count(' ') >= title.count(' ') else message\n\n return title\n\n\ndef list_columns(node: Union[BeautifulSoup, Tag, NavigableString], name: str) -> List[Tag]:\n \"\"\"\n List columns of the row.\n\n :param node: The node which contains columns of the row.\n :param name: The name of the tag of columns.\n :return: The list of columns.\n \"\"\"\n vals = []\n ancestor = node\n name_list = ['table', 'td', 'th', name]\n node = node.find(name_list)\n while node and is_descendant(ancestor, node):\n if node.name in name_list:\n if node.name == name:\n tnode = copy.copy(node)\n for t in tnode.find_all('table'):\n t.decompose()\n vals.append(tnode)\n node = node.find_next_sibling(True)\n else:\n node = node.find_next(name_list)\n return vals\n\n\ndef is_descendant(ancestor: Optional[Union[BeautifulSoup, Tag, NavigableString]],\n node: Optional[Union[BeautifulSoup, Tag, NavigableString]]) -> bool:\n \"\"\"\n Check if a node is descendant in the tree.\n\n :param ancestor: The ancestor node.\n :param node: The node to be checked.\n :return: True - node is descendant, False - node is not descendant.\n \"\"\"\n return ancestor is not None and node is not None and any([ancestor is p for p in node.parents])\n\n\ndef parse_table(base: Optional[Union[BeautifulSoup, Tag, NavigableString]],\n table_node: Union[BeautifulSoup, Tag, NavigableString]) -> Generator[Table, None, None]:\n \"\"\"\n Parse a HTML table and enumerate tables found in the table.\n\n :param base: The top node of the HTML tree.\n :param table_node: The table node to parse.\n :return: Tables found.\n \"\"\"\n table = Table(title=find_table_title(base, table_node) or 'No Title')\n has_nested_tables = False\n\n node = table_node.find(['table', 'tr'])\n while node and is_descendant(table_node, node):\n if node.name == 'tr':\n ths = list_columns(node, 'th')\n tds = list_columns(node, 'td')\n if tds:\n table.add_row(columns=tds, labels=ths)\n if ths and not table.get_header_labels():\n table.set_header_labels(ths)\n\n node = node.find_next(['table', 'tr'])\n\n elif node.name == 'table':\n has_nested_tables = True\n yield from parse_table(base, node)\n\n base = node.previous_element\n node = node.find_next_sibling(True)\n else:\n node = node.find_next(['table', 'tr'])\n\n # Not to make a table if tr only has tables\n has_table = True\n if has_nested_tables:\n rows = table.get_rows()\n if len(rows) == 1:\n labels, cols = rows[0]\n if len(cols) == 1 and not cols[0]:\n has_table = False\n\n if has_table:\n yield table\n\n\ndef parse_tables(node: Union[BeautifulSoup, Tag, NavigableString]) -> Generator[Table, None, None]:\n \"\"\"\n Parse HTML tables and enumerate them.\n\n :param node: The node from which searching starts.\n :return: Tables found.\n \"\"\"\n base = None\n node = node.find('table')\n while node:\n yield from parse_table(base, node)\n base = node.next_sibling\n\n while node:\n next = node.find_next_sibling(True)\n if next:\n if next.name == 'table':\n break\n\n next = next.find_next('table')\n if next:\n break\n node = node.parent\n node = next\n\n\ndef main():\n args = demisto.args()\n html = args.get('value') or ''\n overwriting_title = args.get('title')\n filter_indexes = argToList(args.get('filter_indexes'))\n filter_titles = argToList(args.get('filter_titles'))\n default_header_line = args.get('default_header_line') or 'none'\n\n tables = []\n try:\n soup = BeautifulSoup(html, 'html.parser')\n index = -1\n for table in parse_tables(soup):\n rows = table.make_pretty_table_rows(default_header_line)\n if not rows:\n continue\n\n index = index + 1\n if filter_indexes and\\\n index not in filter_indexes and\\\n str(index) not in filter_indexes:\n continue\n\n original_title = table.get_title()\n if filter_titles and original_title not in filter_titles:\n continue\n\n tables.append({overwriting_title or original_title: rows})\n\n except Exception as err:\n # Don't return an error by return_error() as this is transformer.\n raise DemistoException(str(err))\n\n return_results(tables)\n\n\nif __name__ in ('__main__', '__builtin__', 'builtins'):\n main()\n\nregister_module_line('ParseHTMLTables', 'end', __line__())\n", "scriptTarget": 0, "searchableName": "ParseHTMLTables", "sensitive": false, "sequenceNumber": 41221646, "shouldCommit": false, "sizeInBytes": 15106, "subtype": "python3", "system": true, "tags": [ "transformer", "general" ], "timeout": 0, "toServerVersion": "", "type": "python", "user": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "version": 95, "visualScript": "" } } } } } } } }, "parameters": [ { "schema": { "type": "string" }, "name": "script_id", "in": "path", "required": true } ] }, "/xsoar/public/v1/automation/metadata": { "get": { "tags": [ "Scripts" ], "summary": "Get metadata details about all scripts in this tenant", "description": "Retrieve the metadata details for all scripts in this Cortex XSOAR tenant. Depending on the number of scripts in the instance, the response can be very large.", "operationId": "get-xsoar-automation-metadata", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "name": { "type": "string" }, "type": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "contextKeys": { "type": "array", "items": { "type": "object", "properties": {} } }, "comment": { "type": "string" }, "enabled": { "type": "boolean" }, "system": { "type": "boolean" }, "detached": { "type": "boolean" }, "locked": { "type": "boolean" }, "user": { "type": "string" }, "dockerImage": { "type": "string" }, "modified": { "type": "string" }, "scriptTarget": { "type": "integer" }, "arguments": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "required": { "type": "boolean" }, "deprecated": { "type": "boolean" }, "hidden": { "type": "boolean" }, "default": { "type": "boolean" }, "secret": { "type": "boolean" }, "auto": { "type": "string" }, "predefined": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "type": { "type": "string" } } } }, "runAs": { "type": "string" }, "outputs": { "type": "array", "items": { "type": "object", "properties": { "contentPath": { "type": "string" }, "contextPath": { "type": "string" }, "description": { "type": "string" }, "type": { "type": "string" } } } }, "permitted": { "type": "boolean" } } }, "x-examples": { "Example 1": [ { "id": "GenerateRandomUUID", "version": 158, "name": "GenerateRandomUUID", "type": "python", "tags": [], "contextKeys": [], "comment": "Generates a random UUID (UUID 4).", "enabled": true, "system": true, "detached": false, "locked": false, "user": "", "dockerImage": "demisto/python3:3.10.12.63474", "modified": "2023-12-31T14:07:48.276322159Z", "scriptTarget": 0, "runAs": "DBotWeakRole", "outputs": [ { "contentPath": "", "contextPath": "GeneratedUUID", "description": "The generated UUID.", "type": "string" } ], "permitted": true }, { "id": "FactAboutYou", "version": 48, "name": "FactAboutYou", "type": "python", "tags": [ "Utilities" ], "contextKeys": [], "comment": "Reveal some facts about yourself.", "enabled": true, "system": true, "detached": false, "locked": false, "user": "", "dockerImage": "demisto/python3:3.10.12.63474", "modified": "2023-07-27T22:00:47.726502484Z", "scriptTarget": 0, "arguments": [ { "name": "category", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "auto": "PREDEFINED", "predefined": [ "Dev", "Career", "History", "Money", "Movie", "Music", "Science", "Sport", "Travel" ], "description": "Filter fact by specific category.", "type": "" } ], "runAs": "DBotWeakRole", "permitted": true } ] } }, "examples": { "Example 1": { "value": [ { "id": "ReadProcessesFileXDR", "version": 50, "name": "ReadProcessesFileXDR", "type": "python", "tags": [ "dynamic-section" ], "contextKeys": [], "comment": "Return a process list from the XDRIR integration.", "enabled": true, "system": true, "detached": false, "locked": false, "user": "", "dockerImage": "demisto/python3:3.10.13.83255", "modified": "2024-01-12T21:36:30.371317155Z", "scriptTarget": 0, "arguments": null, "runAs": "DBotWeakRole", "roles": null, "permitted": true, "propagationLabels": null }, { "id": "QRadarPrintEvents", "version": 79, "name": "QRadarPrintEvents", "type": "python", "tags": [ "dynamic-section" ], "contextKeys": [], "comment": "This script prints the events fetched from the offense in a table format.", "enabled": true, "system": true, "detached": false, "locked": false, "user": "", "dockerImage": "demisto/python3:3.10.4.30607", "modified": "2024-02-20T21:06:29.757778897Z", "scriptTarget": 0, "arguments": null, "runAs": "DBotWeakRole", "roles": [], "permitted": true, "propagationLabels": null }, { "id": "EntryWidgetCoATechniquesList", "version": 52, "name": "EntryWidgetCoATechniquesList", "type": "python", "tags": [ "dynamic-section" ], "contextKeys": [], "comment": "Entry widget that shows the number of techniques that were not yet handled by the CoA playbooks.", "enabled": true, "system": true, "detached": false, "locked": false, "user": "", "dockerImage": "demisto/python3:3.10.8.37233", "modified": "2023-12-20T21:24:16.196888598Z", "scriptTarget": 0, "arguments": null, "runAs": "DBotWeakRole", "roles": null, "permitted": true, "propagationLabels": null } ] } } } } } } }, "parameters": [] }, "/xsoar/public/v1/automation/search": { "post": { "tags": [ "Scripts" ], "summary": "Search scripts", "description": "Search scripts using a filter.", "operationId": "post-xsoar-automation-search", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/automationScriptFilter" } } }, "required": false }, "responses": { "200": { "description": "OK automationScriptResult", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/automationScriptResult" } } } } }, "x-codegen-request-body-name": "body" }, "parameters": [] }, "/xsoar/public/v1/contentpacks/metadata/installed": { "get": { "tags": [ "Content Packs" ], "summary": "Get metadata for all installed content packs", "operationId": "get-xsoar-contentpacks-metadata-installed", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Content pack ID" }, "currentVersion": { "type": "string", "description": "Current version number" }, "name": { "type": "string", "description": "Content pack name" }, "lastInstallDate": { "type": "string", "description": "Last date the content pack was installed." }, "updateAvailable": { "type": "boolean", "description": "Whether there is an update to the content pack available." }, "propagationLabels": { "type": "array", "items": { "type": "string" } }, "userIsSubscribedToNotifications": { "type": "boolean", "description": "Whether the user is subscribed to receive notifications for this content pack." } } }, "x-examples": { "Example 1": [ { "id": "WhatIsMyBrowser", "currentVersion": "1.0.10", "name": "WhatIsMyBrowser", "lastInstallDate": "2023-06-24T19:17:45.734559942Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "GoogleCloudTranslate", "currentVersion": "1.0.8", "name": "Google Cloud Translate", "lastInstallDate": "2023-06-24T19:18:46.560391487Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "Blueliv", "currentVersion": "1.0.2", "name": "Blueliv (Beta)", "lastInstallDate": "2023-06-24T19:19:48.019747193Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "Syslog", "currentVersion": "2.0.16", "name": "Syslog", "lastInstallDate": "2023-06-24T19:32:37.193986069Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false } ] } }, "examples": { "Example 1": { "value": [ { "id": "Hey", "currentVersion": "1.0.2", "name": "Hey", "lastInstallDate": "2023-03-01T12:53:36.302121655Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "PaloAltoNetworks_PAN_OS_EDL_Management", "currentVersion": "1.1.5", "name": "Palo Alto Networks PAN-OS EDL Management (Deprecated)", "lastInstallDate": "2022-11-13T16:44:45.979960364Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "Compliance", "currentVersion": "1.0.11", "name": "Compliance", "lastInstallDate": "2022-11-13T16:44:45.979961797Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "Netcraft", "currentVersion": "1.0.15", "name": "Netcraft (Deprecated)", "lastInstallDate": "2023-02-13T18:36:45.477957519Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "Volatility", "currentVersion": "1.0.1", "name": "Volatility", "lastInstallDate": "2023-02-14T09:20:26.764618224Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false } ] } } }, "Example 1": { "example": [ { "id": "WhatIsMyBrowser", "currentVersion": "1.0.10", "name": "WhatIsMyBrowser", "lastInstallDate": "2023-06-24T19:17:45.734559942Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "GoogleCloudTranslate", "currentVersion": "1.0.8", "name": "Google Cloud Translate", "lastInstallDate": "2023-06-24T19:18:46.560391487Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "Blueliv", "currentVersion": "1.0.2", "name": "Blueliv (Beta)", "lastInstallDate": "2023-06-24T19:19:48.019747193Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false }, { "id": "Syslog", "currentVersion": "2.0.16", "name": "Syslog", "lastInstallDate": "2023-06-24T19:32:37.193986069Z", "updateAvailable": false, "propagationLabels": [ "all" ], "userIsSubscribedToNotifications": false } ] } } } }, "description": "Retrieve the metadata for all of the content packs installed in the system." }, "parameters": [] }, "/xsoar/public/v1/dashboards": { "get": { "tags": [ "Dashboards" ], "summary": "Get all dashboards details", "description": "Retrieve details of all the dashboards in the system. Only dashboards the user has view access to are returned.", "operationId": "get-dashboards", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "097e5436-d8f0-49b7-a19d-a05c60ed1039": { "id": "097e5436-d8f0-49b7-a19d-a05c60ed1039", "version": 62, "cacheVersn": 0, "sequenceNumber": 39322622, "primaryTerm": 12, "modified": "2024-02-05T14:06:16.072614399Z", "sizeInBytes": 13248, "sortValues": [ "96572" ], "packID": "CommonDashboards", "packName": "Common Dashboards", "itemVersion": "1.3.10", "fromServerVersion": "5.0.0", "toServerVersion": "", "propagationLabels": [], "packPropagationLabels": [ "all" ], "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z", "name": "Incidents", "prevName": "Incidents", "layout": [ { "id": "8efbf5c0-e4ff-11e7-b60b-df7995291baf", "forceRange": false, "x": 0, "y": 1, "i": "8efbf5c0-e4ff-11e7-b60b-df7995291baf", "w": 3, "h": 2, "widget": { "id": "active-incidents-by-severity", "version": -1, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "Active Incidents by Severity", "prevName": "", "dataType": "incidents", "widgetType": "pie", "query": "-category:job and -status:archived and -status:closed", "isPredefined": true, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "groupBy": [ "severity" ] }, "category": "" }, "reflectDimensions": false }, { "id": "8fa3a770-e4ff-11e7-b60b-df7995291baf", "forceRange": false, "x": 0, "y": 6, "i": "8fa3a770-e4ff-11e7-b60b-df7995291baf", "w": 12, "h": 2, "widget": { "id": "active-incidents-by-type", "version": -1, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "Active Incidents by Type", "prevName": "", "dataType": "incidents", "widgetType": "line", "query": "-category:job and -status:archived and -status:closed", "isPredefined": true, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "groupBy": [ "occurred(d)", "rawType" ] }, "category": "" }, "reflectDimensions": false }, { "id": "90f554c0-e4ff-11e7-b60b-df7995291baf", "forceRange": false, "x": 3, "y": 1, "i": "90f554c0-e4ff-11e7-b60b-df7995291baf", "w": 3, "h": 3, "widget": { "id": "unassigned-incidents", "version": -1, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "Unassigned Incidents", "prevName": "", "dataType": "incidents", "widgetType": "list", "query": "-category:job and -status:archived and -status:closed and owner:\"\"", "isPredefined": true, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "tableColumns": [ { "displayed": true, "isDefault": true, "key": "name" }, { "displayed": true, "isDefault": true, "key": "severity" } ] }, "category": "" }, "reflectDimensions": false }, { "id": "ab3a69b0-06a6-11e8-9f30-0903d8762b71", "forceRange": false, "x": 3, "y": 0, "i": "ab3a69b0-06a6-11e8-9f30-0903d8762b71", "w": 3, "h": 1, "widget": { "id": "", "version": -1, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "Unassigned Incidents", "prevName": "", "dataType": "incidents", "widgetType": "trend", "query": "-category:job and -status:archived and -status:closed and owner:\"\"", "isPredefined": true, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#FAC100": { "value": 0 } }, "type": "above" } }, "category": "" }, "reflectDimensions": false }, { "id": "b95f04b0-06a6-11e8-9f30-0903d8762b71", "forceRange": false, "x": 6, "y": 0, "i": "b95f04b0-06a6-11e8-9f30-0903d8762b71", "w": 3, "h": 1, "widget": { "id": "", "version": -1, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "Late Incidents", "prevName": "", "dataType": "incidents", "widgetType": "trend", "query": "-category:job and -status:archived and -status:closed and dueDate: Any:\n payload = {\n \"askToErasure\": None,\n \"changeConsent\": None,\n \"dataPortability\": None,\n \"disputeRequest\": None,\n \"dataSubjectId\": datasubject_id,\n \"id\": None,\n \"reason\": reason,\n \"updateDataSubjectDetails\": None\n }\n demisto.debug(f\"{payload}\")\n if datasubject_id:\n # create ticket id\n ticket_id = self._http_request(\n method=\"POST\",\n json_data={\"dataSubjectId\": datasubject_id},\n url_suffix=\"/dsr/api/dsar-management/tickets\",\n return_empty_response=True,\n retries=5\n )\n return ticket_id\n else:\n return None\n\n def create_ticket(self, datasubject_id: Any, reason: str) -> Dict[str, Any]:\n # new payload for ticket creation\n payload = {\n \"askToErasure\": None,\n \"changeConsent\": None,\n \"dataPortability\": None,\n \"disputeRequest\": None,\n \"dataSubjectId\": datasubject_id,\n \"id\": None,\n \"reason\": reason,\n \"updateDataSubjectDetails\": None\n }\n ticket_id = self.prepare_ticket(datasubject_id, reason)\n if ticket_id:\n demisto.debug(f\"{ticket_id}\")\n payload[\"id\"] = str(ticket_id)\n demisto.debug(f\"{payload}\")\n # create actual ticket\n ticket_id = self._http_request(\n method=\"POST\",\n json_data=payload,\n url_suffix=\"/dsr/api/dsar-management/tickets\",\n return_empty_response=True,\n retries=5\n )\n return ticket_id\n\n def get_ticket(self, ticket_id: Any) -> Dict:\n result = self._http_request(\n method=\"GET\",\n url_suffix=f\"/dsr/api/dsar-management/tickets/{ticket_id}\",\n return_empty_response=True,\n retries=5\n )\n return result\n\n def get_dsar(self, ticket_id: Any) -> Dict:\n ticket_details = self.get_ticket(ticket_id)\n demisto.debug(f\"{ticket_details}\")\n datasubject_id = ticket_details.get(\"piiId\", \"\")\n demisto.debug(f\"{datasubject_id}\")\n\n return self._http_request(\n method=\"GET\",\n url_suffix=f\"/dsr/api/dsar-management/personal-data-usage/ticket/{ticket_id}\",\n # url_suffix=f\"/pii/api/piis/{datasubject_id}/sources\",\n return_empty_response=True,\n retries=5\n )\n\n def get_sources(self, datasubject_id: Any) -> Dict:\n return self._http_request(\n method=\"GET\",\n url_suffix=f\"/pii/api/piis/{datasubject_id}/sources/details\",\n return_empty_response=True,\n retries=5\n )\n\n\n''' HELPER FUNCTIONS '''\n\n\ndef format_pii_entities(pii_entities):\n entities_listed = [[subitem for subitem in pii_entities[item]] for item in pii_entities]\n # return entities_listed\n result = list()\n for item in entities_listed:\n result.extend(item)\n result = {\"entities\": [item[\"entityName\"] for item in result]}\n return result\n\n\ndef generate_datasubject_payload(pii_entities, **kwargs):\n payload = []\n # fill initial payload\n for item in kwargs:\n if item.upper() in pii_entities:\n subpayload = {}\n subpayload[\"piiEntityType\"] = item.upper()\n subpayload[\"piiEntityValue\"] = kwargs[item]\n payload.append(subpayload)\n return payload\n\n\n''' COMMAND FUNCTIONS '''\n\n\ndef get_entities_command(client: Client) -> CommandResults:\n\n pii_entities = client.get_entities()\n\n result = format_pii_entities(pii_entities)\n return CommandResults(\n outputs_prefix=\"Inventa.Entities\",\n outputs_key_field=\"entity\",\n outputs=result\n )\n\n\ndef get_datasubjects_command(client: Client, **kwargs) -> CommandResults:\n results = client.get_datasubject(**kwargs)\n for result in results:\n result[\"personalInfo\"] = list(result[\"personalInfo\"].keys())\n result[\"personalInfo\"].sort()\n return CommandResults(outputs=result,\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"id\")\n\n\ndef get_datasubject_id_command(client: Client, **kwargs) -> CommandResults:\n found_piis = client.get_datasubject(**kwargs)\n # datasubs = found_piis.get(\"dataSubjects\", [])\n datasubs = found_piis\n if datasubs:\n datasubject_id = datasubs[0].get(\"id\", \"\")\n return CommandResults(outputs={\"datasubject_id\": datasubject_id},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n else:\n return CommandResults(outputs={\"datasubject_id\": 0},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n\n\ndef get_sources_command(client: Client, datasubject_id: str) -> CommandResults:\n if not datasubject_id:\n raise ValueError(\"No such datasubject_id found\")\n import json\n import copy\n result = []\n sources = client.get_sources(datasubject_id)\n sources = copy.deepcopy(sources)\n\n for source in sources:\n source_id = source[\"id\"]\n source_appliance_name = source[\"applianceName\"]\n source_ts = int(source[\"timestamp\"])\n source_key_type = source[\"key\"][\"keyType\"]\n source_path = source[\"key\"][\"path\"]\n source_url = source[\"key\"][\"repository\"][\"url\"]\n source_hostname = source[\"key\"][\"repository\"][\"hostName\"]\n source_db_name = source[\"key\"][\"repository\"][\"dbName\"]\n source_vendor = source[\"key\"][\"repository\"][\"vendor\"]\n source_type = source[\"key\"][\"repository\"][\"type\"]\n source_content = source[\"content\"]\n source_entity_types = source_content.pop(\"entityTypes\", None)\n source_content = json.dumps(source_content)\n\n result.append({\n \"id\": source_id,\n \"applianceName\": source_appliance_name,\n \"timestamp\": datetime.utcfromtimestamp(\n float(f\"{str(source_ts)[:10]}.{str(source_ts)[10:]}\")).strftime(\"%d %b %Y %H:%M:%S\"),\n \"keyType\": source_key_type,\n \"path\": source_path,\n \"url\": source_url,\n \"hostName\": source_hostname,\n \"dbName\": source_db_name,\n \"vendor\": source_vendor,\n \"type\": source_type,\n \"content\": source_content,\n \"entityTypes\": \", \".join(source_entity_types),\n })\n return CommandResults(outputs=result, outputs_prefix=\"Inventa.Sources.sources\", outputs_key_field=\"id\")\n\n\ndef get_sources_piis_command(client: Client, datasubject_id: str) -> CommandResults:\n sources = client.get_sources(datasubject_id)\n piis = []\n for item in sources:\n piis.extend(item[\"content\"][\"entityTypes\"])\n piis = list(set(piis))\n piis.sort()\n return CommandResults(outputs={\"piis\": piis}, outputs_prefix=\"Inventa.Sources\", outputs_key_field=\"piis\")\n\n\ndef create_ticket_command(client: Client, reason: str, datasubject_id: int) -> CommandResults:\n ticket_id = client.create_ticket(datasubject_id, reason)\n return CommandResults(outputs={\"ticket_id\": f\"{ticket_id}\"},\n outputs_prefix=\"Inventa.DataSubjects.Ticket\",\n outputs_key_field=\"ticket_id\")\n\n\ndef get_datasubjectid_from_ticket_command(client: Client, ticket_id: int) -> CommandResults:\n ticket_details = client.get_ticket(ticket_id)\n datasubject_id = ticket_details.get(\"piiId\", \"\")\n return CommandResults(outputs={\"datasubject_id\": datasubject_id},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n\n\ndef get_datasubject_details_command(client: Client, ticket_id: int) -> CommandResults:\n ticket_details = client.get_ticket(ticket_id)\n datasubject_name = ticket_details.get(\"name\", \"\")\n datasubject_email = ticket_details.get(\"email\", \"\")\n return CommandResults(outputs={\"name\": datasubject_name, \"email\": datasubject_email},\n outputs_prefix=\"Inventa.DataSubject\",\n outputs_key_field=\"name\")\n\n\ndef get_dsar_piis_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n piis = dsar.get(\"piis\", [])\n pii_list = list()\n for pii in piis:\n pii_list.append(pii.get(\"piiEntityType\", \"\"))\n\n demisto.debug(f\"{piis}\")\n demisto.debug(f\"{pii_list}\")\n\n return CommandResults(outputs={\"piis\": list(set(pii_list))},\n outputs_prefix=\"Inventa.Dsar.Piis\")\n\n\ndef get_dsar_transactions_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n transactions = dsar.get(\"copiesUsageData\", {}).get(\"transactions\", [])\n if \"entityTypes\" in transactions:\n transactions[\"entityTypes\"] = [transactions[\"entityTypes\"][\"type\"]\n for item in transactions[\"entityTypes\"] if item == \"type\"]\n\n for transaction in transactions:\n demisto.debug(f\"file: {transaction}\")\n if \"entityTypes\" in transaction:\n entityTypes = transaction[\"entityTypes\"]\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n demisto.debug(f\"stripped: {stripped}\")\n transaction[\"entityTypes\"] = stripped\n if transactions:\n return CommandResults(outputs={\"transactions\": transactions},\n outputs_prefix=\"Inventa.Dsar.Transactions\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"transactions\": [empty_transaction]},\n outputs_prefix=\"Inventa.Dsar.Transactions\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_files_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n demisto.debug(f\"{dsar}\")\n files = dsar.get(\"copiesUsageData\", {}).get(\"files\", [])\n demisto.debug(f\"{files}\")\n for file in files:\n # file.pop(\"path\")\n # file.pop(\"url\")\n demisto.debug(f\"file: {file}\")\n if \"entityTypes\" in file:\n entityTypes = file[\"entityTypes\"]\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n file[\"entityTypes\"] = \", \".join(stripped)\n if \"timestamp\" in file:\n ts = file.get(\"timestamp\", 0)\n if type(ts) is int:\n file[\"timestamp\"] = datetime.utcfromtimestamp(\n float(f\"{str(ts)[:10]}.{str(ts)[10:]}\")).strftime(\"%d %b %Y %H:%M:%S\")\n # file[\"entityTypes\"] = stripped\n if files:\n return CommandResults(outputs={\"files\": files},\n outputs_prefix=\"Inventa.Dsar.Files\",\n outputs_key_field=\"id\")\n\n else:\n return CommandResults(outputs={\"files\": [empty_file]},\n outputs_prefix=\"Inventa.Dsar.Files\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_databases_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n databases = dsar.get(\"copiesUsageData\", {}).get(\"databases\", [])\n tables = []\n for db in databases:\n demisto.debug(f\"db: {db}\")\n database_name = db.get(\"name\", \"\")\n if \"tables\" in db:\n for table in db[\"tables\"]:\n table[\"database\"] = database_name\n\n if \"entityTypes\" in table:\n entityTypes = table[\"entityTypes\"]\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n table[\"entityTypes\"] = \", \".join(stripped)\n # table[\"entityTypes\"] = stripped\n\n tables.append(table)\n\n if databases:\n return CommandResults(outputs={\"databases\": tables},\n outputs_prefix=\"Inventa.Dsar.Databases\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"databases\": [empty_database]},\n outputs_prefix=\"Inventa.Dsar.Databases\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_dataassets_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n dataAssets = dsar.get(\"copiesUsageData\", {}).get(\"dataAssets\", [])\n for da in dataAssets:\n demisto.debug(f\"file: {da}\")\n if \"piis\" in da:\n entityTypes = da[\"piis\"]\n if entityTypes:\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n da[\"piis\"] = \", \".join(stripped)\n else:\n da[\"piis\"] = \"None\"\n\n if \"reasonsOfProcessing\" in da:\n reasons = da[\"reasonsOfProcessing\"]\n if reasons:\n da[\"reasonsOfProcessing\"] = ', '.join(reasons)\n else:\n da[\"reasonsOfProcessing\"] = \"None\"\n\n if dataAssets:\n demisto.debug(f\"{dataAssets}\")\n return CommandResults(outputs={\"dataAssets\": dataAssets},\n outputs_prefix=\"Inventa.Dsar.DataAssets\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"dataAssets\": [empty_dataasset]},\n outputs_prefix=\"Inventa.Dsar.DataAssets\",\n outputs_key_field=\"id\")\n\n\ndef validate_incident_inputs_command(**kwargs):\n # ticket_id = kwargs.get(\"ticket_id\", \"\")\n datasubject_id = kwargs.get(\"datasubject_id\", \"\")\n national_id = kwargs.get(\"national_id\", \"\")\n passport_number = kwargs.get(\"passport_number\", \"\")\n driver_license = kwargs.get(\"driver_license\", \"\")\n tax_id = kwargs.get(\"tax_id\", \"\")\n cc_number = kwargs.get(\"cc_number\", \"\")\n given_name = kwargs.get(\"given_name\", \"\")\n surname = kwargs.get(\"surname\", \"\")\n full_name = kwargs.get(\"full_name\", \"\")\n vehicle_number = kwargs.get(\"vehicle_number\", \"\")\n phone_number = kwargs.get(\"phone_number\", \"\")\n birthday = kwargs.get(\"birthday\", \"\")\n city = kwargs.get(\"city\", \"\")\n street_address = kwargs.get(\"street_address\", \"\")\n\n demisto.debug(f\"{datasubject_id}\")\n\n constraints = [\n national_id,\n passport_number,\n driver_license,\n tax_id,\n cc_number,\n (given_name and vehicle_number),\n (given_name and phone_number),\n (given_name and surname and birthday),\n (given_name and surname and city and street_address),\n (full_name and birthday),\n (full_name and city and street_address)\n ]\n\n constraints_validated = False\n for constraint in constraints:\n if constraint:\n demisto.debug(f\"{constraint}\")\n constraints_validated = True\n break\n\n datasubject_id_validated = False\n if datasubject_id:\n datasubject_id_validated = True\n\n demisto.debug(\"CONSTRAINTS\")\n if constraints_validated:\n return CommandResults(outputs={\"validated\": True},\n outputs_prefix=\"Inventa.Incident\",\n outputs_key_field=\"validated\")\n elif datasubject_id_validated:\n return CommandResults(outputs={\"validated\": True},\n outputs_prefix=\"Inventa.Incident\",\n outputs_key_field=\"validated\")\n else:\n raise Exception(\"Validation failed: constraints missing. Check incident's inputs.\")\n\n\ndef test_module(client: Client) -> str:\n \"\"\"Tests API connectivity and authentication'\n\n Returning 'ok' indicates that the integration works like it is supposed to.\n Connection to the service is successful.\n Raises exceptions if something goes wrong.\n\n :type client: ``Client``\n :param Client: client to use\n\n :return: 'ok' if test passed, anything else will fail the test.\n :rtype: ``str``\n \"\"\"\n\n message: str = ''\n try:\n # TODO: ADD HERE some code to test connectivity and authentication to your service.\n # This should validate all the inputs given in the integration configuration panel,\n # either manually or by using an API that uses them.\n client.get_entities()\n message = 'ok'\n except DemistoException as e:\n if 'Forbidden' in str(e) or 'Authorization' in str(e): # TODO: make sure you capture authentication errors\n message = 'Authorization Error: make sure API Key is correctly set'\n else:\n raise e\n return message\n\n\n'''FETCH INCIDENTS'''\n\n\n''' MAIN FUNCTION '''\n\n\ndef main() -> None:\n \"\"\"main function, parses params and runs command functions\n\n :return:\n :rtype:\n \"\"\"\n\n try:\n # authentication\n api_key = demisto.params().get('apikey', \"\")\n\n # get the service API url\n base_url = demisto.params().get(\"url\", '')\n\n # if your Client class inherits from BaseClient, SSL verification is\n # handled out of the box by it, just pass ``verify_certificate`` to\n # the Client constructor\n verify_certificate = not demisto.params().get('insecure', False)\n\n # if your Client class inherits from BaseClient, system proxy is handled\n # out of the box by it, just pass ``proxy`` to the Client constructor\n proxy = demisto.params().get('proxy', False)\n\n demisto.debug(f'Command being called is {demisto.command()}')\n\n # TODO: Make sure you add the proper headers for authentication\n # (i.e. \"Authorization\": {api key})\n headers: Dict = {\n 'Authorization': f\"Bearer {api_key}\"\n }\n\n client = Client(\n base_url=base_url,\n verify=verify_certificate,\n headers=headers,\n proxy=proxy)\n\n if demisto.command() == 'test-module':\n # This is the call made when pressing the integration Test button.\n result = test_module(client)\n return_results(result)\n\n elif demisto.command() == 'inventa-get-datasubjects':\n return_results(get_datasubjects_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-get-datasubject-id':\n return_results(get_datasubject_id_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-create-ticket':\n return_results(create_ticket_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-get-datasubject-details':\n return_results(get_datasubject_details_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-piis':\n return_results(get_dsar_piis_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-transactions':\n return_results(get_dsar_transactions_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-files':\n return_results(get_dsar_files_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-databases':\n return_results(get_dsar_databases_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-dataassets':\n return_results(get_dsar_dataassets_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-datasubject-id-from-ticket':\n return_results(get_datasubjectid_from_ticket_command(client, demisto.args().get(\"ticket_id\", 0)))\n\n elif demisto.command() == \"inventa-get-sources\":\n return_results(get_sources_command(client, demisto.args().get(\"datasubject_id\", \"\")))\n\n elif demisto.command() == \"inventa-get-sources-piis\":\n return_results(get_sources_piis_command(client, demisto.args().get(\"datasubject_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-entities':\n return_results(get_entities_command(client))\n\n elif demisto.command() == 'inventa-validate-incident-inputs':\n return_results(validate_incident_inputs_command(**demisto.args()))\n\n # Log exceptions and return errors\n except Exception as e:\n demisto.error(traceback.format_exc()) # print the traceback\n return_error(f'Failed to execute {demisto.command()} command.\\nError:\\n{str(e)}')\n\n\n''' ENTRY POINT '''\n\n\nif __name__ in ('__main__', '__builtin__', 'builtins'):\n main()\n\nregister_module_line('Inventa', 'end', __line__())\n", "type": "python", "commands": [ { "name": "inventa-get-sources-piis", "deprecated": false, "arguments": [ { "name": "datasubject_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a datasubject.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.Sources.piis", "description": "List of piis containing info about data subject.", "type": "String" } ], "important": null, "description": "Get PII details from daatasubjest.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-sources", "deprecated": false, "arguments": [ { "name": "datasubject_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a datasubject.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.Sources.sources.id", "description": "Id of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.applianceName", "description": "Appliance name of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.timestamp", "description": "Timestamp of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.keyType", "description": "KeyType of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.path", "description": "Path of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.url", "description": "URL of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.hostname", "description": "Hostname of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.dbName", "description": "DB name of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.vendor", "description": "Vendor of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.type", "description": "Type of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.context", "description": "Additional info on a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.entityTypes", "description": "Types of sensitive data stored in a source containing info about data subject.", "type": "String" } ], "important": null, "description": "Get sources details.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-datasubjects", "deprecated": false, "arguments": [ { "name": "national_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "National ID of a PII.", "type": "" }, { "name": "passport_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Passport Number of a PII.", "type": "" }, { "name": "driver_license", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Driver's License of a PII.", "type": "" }, { "name": "tax_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Tax ID of a PII.", "type": "" }, { "name": "cc_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Credit Card Number of a PII.", "type": "" }, { "name": "given_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Given Name of a PII.", "type": "" }, { "name": "surname", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Surname of a PII.", "type": "" }, { "name": "full_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Full Name of a PII.", "type": "" }, { "name": "vehicle_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Vehicle Number of a PII.", "type": "" }, { "name": "phone_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Phone Number of a PII.", "type": "" }, { "name": "birthday", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Birthday of a PII.", "type": "" }, { "name": "city", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "City of Resdence of a PII.", "type": "" }, { "name": "street_address", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Street Address of a PII.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.id", "description": "ID of a Data Subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.id", "description": "ID of an Entity Type for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityType", "description": "Entity Type name for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityValue", "description": "Value of an Entity Type for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityValueNew", "description": "New Value of an Entity Type for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.action", "description": "Action of an Entity Type for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.total", "description": "Total number of PII Entities found for the PII.", "type": "String" } ], "important": null, "description": "Get Data Subject full details.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-transactions", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.Transactions.transactions", "description": "List of data transactions.", "type": "String" } ], "important": null, "description": "Retrieves data transactions' details containing info about data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-files", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.Files.files", "description": "List of files containing info about data subject.", "type": "String" } ], "important": null, "description": "Retrieves details of files contatining info about data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-databases", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.DataBases.databases", "description": "List of datatables containing info about data subject.", "type": "String" } ], "important": null, "description": "Retrieves list of databases and tables containing info about data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-datasubject-details", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubject.name", "description": "Name of a data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubject.email", "description": "Email address of a data subject.", "type": "String" } ], "important": null, "description": "Get datasubject name and email.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-dataassets", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.DataAssets.dataAssets", "description": "List of data assets containing info about data subject.", "type": "String" } ], "important": null, "description": "Retrieves list of data assets containing info about data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-piis", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.piis", "description": "List of PII categories related to data subject.", "type": "String" } ], "important": null, "description": "Get list of PII categories related to the data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-entities", "deprecated": false, "arguments": [], "outputs": [ { "contentPath": "", "contextPath": "Inventa.Entities.entity", "description": "List of PII entities described in Inventa.", "type": "String" } ], "important": null, "description": "Retrieves list of PII entities described in Inventa.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-datasubject-id-from-ticket", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubjects.datasubject_id", "description": "ID of a data subject within Inventa.", "type": "String" } ], "important": null, "description": "Retrieves ID of a data subject from Inventa's DSAR ticket.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-datasubject-id", "deprecated": false, "arguments": [ { "name": "national_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "National ID of a PII.", "type": "" }, { "name": "passport_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Passport Number of a PII.", "type": "" }, { "name": "driver_license", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Driver's License of a PII.", "type": "" }, { "name": "tax_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Tax ID of a PII.", "type": "" }, { "name": "cc_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Credit Card Number of a PII.", "type": "" }, { "name": "given_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Given Name of a PII.", "type": "" }, { "name": "surname", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Surname of a PII.", "type": "" }, { "name": "full_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Full Name of a PII.", "type": "" }, { "name": "vehicle_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Vehicle Number of a PII.", "type": "" }, { "name": "phone_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Phone Number of a PII.", "type": "" }, { "name": "birthday", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Birthday of a PII.", "type": "" }, { "name": "city", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "City of Resdence of a PII.", "type": "" }, { "name": "street_address", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Street Address of a PII.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubjects.datasubject_id", "description": "ID of a data subject within Inventa.", "type": "String" } ], "important": null, "description": "Retrieves ID of a data subject from passed constraints.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-validate-incident-inputs", "deprecated": false, "arguments": [ { "name": "national_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "National ID of a PII.", "type": "" }, { "name": "passport_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Passport Number of a PII.", "type": "" }, { "name": "driver_license", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Driver's License of a PII.", "type": "" }, { "name": "tax_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Tax ID of a PII.", "type": "" }, { "name": "cc_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Credit Card Number of a PII.", "type": "" }, { "name": "given_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Given Name of a PII.", "type": "" }, { "name": "surname", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Surname of a PII.", "type": "" }, { "name": "full_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Full Name of a PII.", "type": "" }, { "name": "vehicle_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Vehicle Number of a PII.", "type": "" }, { "name": "phone_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Phone Number of a PII.", "type": "" }, { "name": "birthday", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Birthday of a PII.", "type": "" }, { "name": "city", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "City of Resdence of a PII.", "type": "" }, { "name": "street_address", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Street Address of a PII.", "type": "" }, { "name": "ticket_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Inventa's ticket ID.", "type": "" }, { "name": "datasubject_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Inventa's Datasubject ID.", "type": "" }, { "name": "reason", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Report reason.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.Incident.validated", "description": "Whether incident inputs are validated.", "type": "Boolean" } ], "important": null, "description": "Validates incident's inputs.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-create-ticket", "deprecated": false, "arguments": [ { "name": "reason", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Reason for DSAR reporty.", "type": "" }, { "name": "datasubject_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a data subject within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubjects.Ticket.ticket_id", "description": "ID of a DSAR ticket, created within Inventa.", "type": "String" } ], "important": null, "description": "Creates Inventa ticket.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false } ], "dockerImage": "demisto/python3:3.10.13.84405", "isFetch": false, "isFetchEvents": false, "isFetchAssets": false, "feed": false, "isFetchCredentials": false, "runOnce": false, "longRunning": false, "longRunningPortMapping": false, "subtype": "python3", "isMappable": false, "isRemoteSyncIn": false, "isRemoteSyncOut": false, "isFetchSamples": false, "resetContext": false }, "system": true, "hidden": false, "canGetSamples": true } ], "engines": { "engines": [ { "id": "b9a6e9ec-dbf9-4238-a79d-2af71083c781", "version": 1585, "cacheVersn": 0, "sequenceNumber": 41993325, "primaryTerm": 12, "modified": "2024-02-25T09:21:51.901644445Z", "sizeInBytes": 1729, "sortValues": [ "110759" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "name": "lemon_373065a9b3cbb94f10933e40c56ef345", "allowOnTenant": false, "locked": false, "lastSeen": "2024-02-25T09:21:51.893916129Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "2024-02-25T09:21:51.484460675Z", "serviceName": "d1_lemon_373065a9b3cbb94f10933e40c56ef345", "host": "hostname-ngdev-syhansef", "user": "user@company.com", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-lemon_373065a9b3cbb94f10933e40c56ef345-8.6-847672.sh", "config": "{\"engine.handshake.max.retries.slow\": \"7200\", \"engine.connection.retry.timeoout\": \"7200\"}", "baseUrl": "10.180.194.141:8443,172.17.0.1:8443", "engineGroup": "", "protocolVersion": "2.5.1", "os": "linux", "demistoVersion": "8.5.0", "buildVersion": "28536e48e3d9264bccec3e9cd8fc980c0edf4434", "md5": "9493667ed12b1278abaf3b947fd5e27b", "underUpgrade": false, "tenantNames": null, "workers": 16, "isDefault": false, "isLegacy": false, "packageFileHash": "53719508543c1fd5844fd877c7171c97a0198ca60f69c2a06ade2c553e2f0064", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}iqDnqBcLScr8prMRpaozWqGkP2LF/q7ehux9h23+9EjWFOPQ6bMKc6tciKgNA/FDlpvYguAUaIqDUqWvG69pSFZ4xiQ8FCTFeJkR89Xcmxm8WcFUU1+WPFOisWG1QzABg03IZkgXDxr6sJEol4t2mu9Z4hh122MdXFK+UhNI5VENpJZsuYunwcMocTHyetTeFJf8UnA9i6Fa+jZGr5jCLzNc56J8q/5WIFvETKtPfNeAEhUru+lDdhiLlMiP5gGClKOMR7xC0lw5jY0XphWy6aMcQ3VaPYiPXZjhdturGo4=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": true, "modules": null } ], "total": 1, "pkgTypes": [ "shell" ], "requestedLogs": {}, "engineGroups": [] }, "health": { "AutoFocusTagsFeed_default_instance": { "id": "AutoFocusTagsFeed.AutoFocusTagsFeed_default_instance", "version": 45631, "cacheVersn": 0, "sequenceNumber": 42030715, "primaryTerm": 12, "modified": "2024-02-25T15:46:27.125445318Z", "sizeInBytes": 932, "sortValues": [ "112961" ], "brand": "AutoFocusTagsFeed", "instance": "AutoFocusTagsFeed_default_instance", "incidentsPulled": 0, "indicatorsPulled": 0, "eventsPulled": 0, "assetsPulled": 0, "type": 0, "incidentsDropped": 0, "lastPullTime": "2024-02-25T15:46:25.140760055Z", "lastError": "Script failed to run: \nError: [Traceback (most recent call last):\n \n File \"\", line 614, in \n File \"\", line 610, in main\n File \"\", line 7617, in return_error\n Exception: Failed to execute fetch-indicators command.\nError:\nError in API call [401] - Unauthorized\n{\"message\": \"API key not found\"}\n] (2604) (2603)", "lastIngestionDuration": 0, "fetchDuration": 0, "creation_time": "2023-02-07T08:48:08.429755153Z", "sum_hour": 0, "sum_day": 0, "sum_week": 0 } } } } }, "examples": { "Example 1": { "value": { "instances": [ { "id": "e227fc24-5e1d-4165-87b8-949f71030b22", "version": 74, "cacheVersn": 0, "sequenceNumber": 39320671, "primaryTerm": 12, "modified": "2024-02-05T14:05:11.127323408Z", "sizeInBytes": 1314, "sortValues": [ "92689" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "all" ], "definitionId": "", "prevName": "", "password": "", "enabled": "true", "name": "AutoFocusTagsFeed_default_instance", "configvalues": { "create_relationships": true, "feed": true, "feedBypassExclusionList": true, "feedFetchInterval": "10", "feedIncremental": true, "feedReliability": "A - Completely reliable", "url": "https://autofocus.paloaltonetworks.com/api/v1.0/" }, "configtypes": { "create_relationships": 8, "feed": 8, "feedBypassExclusionList": 8, "feedFetchInterval": 19, "feedIncremental": 8, "feedReliability": 15, "url": 0 }, "brand": "AutoFocusTagsFeed", "category": "", "path": "", "executable": "", "cmdline": "", "engine": "", "engineGroup": "", "hidden": false, "isIntegrationScript": true, "islongRunning": false, "mappingId": "", "outgoingMapperId": "", "incomingMapperId": "", "remoteSync": false, "isSystemIntegration": true, "canSample": false, "defaultIgnore": false, "integrationLogLevel": "", "commandsPermissions": null, "longRunningId": "", "incidentFetchInterval": 0, "eventFetchInterval": 0, "assetsFetchInterval": 0, "servicesID": "main", "isBuiltin": false, "configuration": { "id": "", "version": 0, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "", "prevName": "", "display": "", "brand": "", "category": "", "icon": "", "description": "", "configuration": null, "integrationScript": null, "hidden": false, "canGetSamples": false }, "data": [ { "display": "Bypass exclusion list", "displayPassword": "", "name": "feedBypassExclusionList", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.", "hasvalue": true, "value": true }, { "display": "Feed Fetch Interval", "displayPassword": "", "name": "feedFetchInterval", "defaultValue": "10", "type": 19, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": "10" }, { "display": "Incremental Feed", "displayPassword": "", "name": "feedIncremental", "defaultValue": "true", "type": 8, "required": false, "hidden": true, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.", "hasvalue": true, "value": true }, { "display": "Source Reliability", "displayPassword": "", "name": "feedReliability", "defaultValue": "A - Completely reliable", "type": 15, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "A - Completely reliable", "B - Usually reliable", "C - Fairly reliable", "D - Not usually reliable", "E - Unreliable", "F - Reliability cannot be judged" ], "info": "Reliability of the source providing the intelligence data.", "hasvalue": true, "value": "A - Completely reliable" }, { "display": "AutoFocus Endpoint URL", "displayPassword": "", "name": "url", "defaultValue": "https://autofocus.paloaltonetworks.com/api/v1.0/", "type": 0, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": "https://autofocus.paloaltonetworks.com/api/v1.0/" }, { "display": "Create relationships", "displayPassword": "", "name": "create_relationships", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": true }, { "display": "Fetch indicators", "displayPassword": "", "name": "feed", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": true } ], "displayPassword": "", "passwordProtected": false, "mappable": false, "remoteSyncableIn": false, "remoteSyncableOut": false, "isFetchSamples": false, "debugMode": false } ], "configurations": [ { "id": "Inventa", "version": 67, "cacheVersn": 0, "sequenceNumber": 37466148, "primaryTerm": 12, "modified": "2024-01-16T21:29:08.065365818Z", "sizeInBytes": 0, "sortValues": [ "moduleconfiguration_Inventa" ], "packID": "Inventa", "packName": "Inventa", "itemVersion": "1.1.11", "fromServerVersion": "5.5.0", "toServerVersion": "", "propagationLabels": [], "packPropagationLabels": [ "all" ], "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "Inventa", "prevName": "Inventa", "display": "1Touch.io's Inventa Connector (Partner Contribution)", "brand": "", "category": "Data Enrichment & Threat Intelligence", "icon": "", "image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABbJSURBVHhe7ZwHvF1VlYfP6y8vFQgQogHEUCIBQgcdOooDGorEwaFJm4hDhuIISC/SlCIiRSxIB5GRohAQAZESIENxaCIlBZDQSXv93fm+fc++Ofe8e19eMmQo5v9+67f3XrutvdbuZ9+XLMVSLMVSLMVHFTXHPTYn9faBmpqk0NOTJIVuA8ngEUOTyccckjx53UXJoBU/XUzTTxQKhaS7uzupq6sLlIfxHR0dSW1tbVJfXx/SZlGDLMaZTn9XV1fS1tYW/PIss6mpKfgrpddtb28PfqmhoSGkW0RMIO/PcFFK0ga1UO6VuJOgxUKP+k2hXMK2xHbkYbtFY2Nj8Jvfdsa8YubMmUlt6v+HhkqJilRJUVF9UCNJh0LLQCul/mHQYqGaET8IVDPwoUkh+Ql0CnQSElyCe4jNL9DR6pvoXU0DGNVLTrAPAxpPZUsLMXJ7miWLjtStCss1f/RnaUmhkoHPwJg/wv136HjoRMITSXpwoVDbNOTTQ5Pnbrsreeamy5KBw1c0/ScOLgsLUfpizXxL0pDVkBf0HIx5dOrPoTCrrr6upmPuvOTl+yYn899+O4ziTyo+KGPEUf9hIWtgjXtE6q+EQvOQAYWZD01NHrvy3GTYyqsyRXevA38baFPoC9Dm0ECoDB9Gz/2o4MM0rogGPmshxg3QTrXsOhtbBhloRvirobtTuge6g7Vr3bhRieRuuJj/42noxZUbfaS+Dw8a+KcY98hisD8obQxstbtH0QJ53hhMo2ptWCSh+3E1rkjbm4Y+XqjlaPtO6u8XguEYlbTYg1j+EN2KIjqiQtyseEbTjcb+R8BHqTM4gr/HceebuAVNkJphHlQuJULXcfprHjY86Wxt08iZ5GUIvGjkTxKylxGVYCc2jfRR6dBxDb6c8+0ePcjUk3RfXih0n1xmO7w1WHfOa28n9//oKAxHA+pqHcHl10zBroV5NvCTZlyR6bQVrWfcwjrB/zeKBkZcxP51d9K9Je6BLKOvFblFeE3ZNLAp6ero6n7ujpuShpbmzWF9jai4Bkc00Eh31VtA/wKtJzOHZmhH6DzoVtLfD02B7iF8FeQx7XNQNWwCfR3aCdod2iosGxnKwPZtCU2ATL8btCu0LFQJQyDL9hryLmR6GHoQ/43QidBGhC2zlxVjvRjY+1fruwF6gPSPQLfiZ9BU1Ec1LA99puhdfNQc+yjLaI09sybpruvGQmHH+5+Y9YchBdDALcOH3N0xd852vxo/rr5z/pwH6ptaNiamUk92VKsAN10X07hvyxQ0fm921UegjHWgOuLSmF5oJe01pDkd/0veNbsTb2hoqCfPdfDtXNbjhu6/cTV6KMwyM+W6+budNHY4ZdI47hG+jHuv6YgLRH374x6HfEGpmTKyaIe/L7K8TvqQPwL/KfB+QBnX19XV7Ui4km68tz6TOI1dAvnK6qOMLSnjCrzDiTsNOhtep3Gm8/7cvY3+hd9Fp2H5dSFgRV5I5gCn0IUgPd09rNkotvI0BezB8QZfg+gOouKrFRp3HOG+jCsGIOwB0FTS7yGjs7PTBpkpfqHQVYYG0hRsWKQcYrpS+tTNKvVc6voFeT8jr5ps8Jtw1sR1j1JCWudYyriRNu5EfC8hUni0PAn3eI0SSfhhIaUGyI6yCuUNxD2FTep6blQjKV9a50KhoVLFUEmYfarAdHU1SS21cxBq7tM8KSh3LsKo0KsQ9l+L3EXCMlR3LXm/6hcgGtdDmUWNLEA+nEc+3pGAWCVDngodrmdhUE/IUsNocSSX9h+WQ9xu0A5pmVVhPGUcS1vWtU2SPI1r+RKYHcshPJv070G9Rmh/UGbRvkRzTHe2ddXMf/Pv3T3d3c+xi54Ou6wnA4t4GnoQQV5EEVMR6kBoZ6eQHFT8b6FDoAOgM6FnoRJspPmampouGzRo0KcoB1bfCuwv0nLGU+ZxgdEbd0PfhfaHDoWUtYd8rt9+bMhvMAOIt/3/RvtdBiZCLiF5NDHNj3d69dOmiNMs1EkZh0F3438W9yDSvmAHkJyeNTL8kG9h6GPILoDn3o55nUl3Z1fTsqPH9vR0tO0F2w2DRs6ijcptlBut9fC7QTm5gjCvEbcDrmvphdAvoe9BG5L2B7glmBcjLEfjDiKPqKjYRUSPykJxh1eQbT5k+5TvbOgy6MfQ10i7G3QffjeXvXSHbE/gfBFyk3YHdCnpnbIfwV+CdWKocRi3VgNrNNpYIvAMZDnrQ/9lemlx0C8Di+6OtmTIyBVqtjvukqSrs6OdrvY+7N5rNQqioR30Pkf3zvjdDWYxF96OkCMkL3Ur/KOgS9NwgI2D51rs91frXWykinKzM4oyP28gC3iHQ1fjzU/tZryZOHfUI6Hi/WsKyvVzoVP93wNjAWaRxw5cBtIvCzU4apUpa2CJPOq20mfJEsg3HGcVaKRlVEK/DUyN4UFHF4ZuaGqxcBtYKb9HpeDBraTAa6EnKwkEPxA4C3pTjzAtjV6TOBvyXspeLFAGRRTmo9h/wvXDfQnEPUE9l1nfQlApwbOsqw+l/hLS9rwE5TtMaTFN02Th6PWFyJXEnYA7IJsG2Q9CzpuZhe5B1vAtgNloMlF+TyjO+Sn6b+AIGu9FR19QGKgOWjVlRbiGTbbXxp4bkW0AUCFPFb1FmBZaWW+Rs9jopq5WFGTPL4PKQq5wHKmEnIxloLxZKLyAG9Jl2wZcVirNCNWggV0mpEmUOTjV10D818O7lDrcP4yFtxr+NfHvQP3n4HcJWQMKWHQD9x+W7Tk0C+QpuLMuKSDvZpQ4O3WzsHfmtdyXokQ+3rAK7/UxGyXO9jgWNzxRpghly8iXh8ewavrsK64S3AdEOMV3Kg+4BPp6Roa3ITd170SdEuedgGfo8IRoSRrYkfBW0VsEldchqOfIoKjopnFBqT64w/WbcqkXZmCD8gYr23RFo1gepFbyI9IKXV7KpnpHHnnHzJ07N5k9e3YwsrwIy5XnObQKqlp+MVCaImkDVXa7b9maEbpXbB/4E7xtccfiboesf5SZ6nRT6GDDS9LAwt1gHt9ACA/zwQgRCqby5s+f76XGLgicN/A80s/A9aqzBPI5fQ2wc6SXIcEwlsUZU20sV0xZBPGNlDOINM+nrBLgbd/c3Lza4MGDo8HTmCIsX0J2ivjg7Kns+boi4PcgSydrrNesMd2b8Dy+/SXlPYFMuyDTC4YFPK9kl5yBVRB0ZxoMUDgE2RxhT640ElQacWtybDiDtE5rJRC+n/iZlJnX7BooaFvLVlERjjZoM+pbN2UFUIYVN1L/n3FLnzvNS9xyLS0tP+PoUrapiYDnTVQT5I65skX6CctH5hpnrFhXKkPwZ+CeQf6qtlG94j5FR3sp116XPo+lAaR3v7LER/BkKn0s9Wfhmdez4lqQF/yurSMQagIKvpVGjLIxWcC7El439ErKCiBPPXHfx+vzoRI0LKPxbNKXHWfAHPJ4lPG26PYiawHgbYvivL/ejKBHPGUbAn8sne/axsbGSShzFuH/k4FBLeV02NGpazThURqsQsd3269cYUkhrc4IZqfSTBZFIW6tjFguZ0vOwKlQ7Sj/OwTLdpDGIcyBkFOM2/tboD+T9tfwVs8IGfF7+DeoAOg2wqXzYZp2HPFTMOpVuKfBuwJjTIX8+hPSZTAFJc4knZ3GS/93i+wiUtm2Is4jz72Qsk0m/CTl7YJfxVZdiPsL6vG6s47Zyo8xj1HnQ4zKPVyiaEd2GNfTZvcuYTZUB8gyho7mh5jSMQ/+CZS3ie0S+P06t8RHsFBJpS9KOXhP7UO9L0H24miwLB5GaK8y47tjd43fjw3JoAXF7An/GPx7Q6XzeARxb0JHky6OhGdwTbtgrgOZfH62VDZl9J5UnsY1fS9BFxGvsBRsiKEupFz3EZ+iA12MwZ0xsrtoRKwZSBovWMLRUTnI54XMXQR/jPt73OwXqvfgXaynmoHLNjIpBqOSbHr9+e+qHj3KLg9SOB1/A3ojhPoHR/0VNMYrw1kyNIxED3ZKDg3IwoZLlUCDX4R2hTRqyg1wdnBDkr+BqgY7pUYu2yMAry979boU6iSvFzeGTY7ICAw80Ptppu7ssjIU+by79uy+D/6ZMtN8fgb15zLeDBq2/W2QL3QcCAk7lop/b0CvQjOg6UV/Mq3ASSajPhvpRfrfoL9C7kr/QuHhS0ikCAS4DmczeOfgPgfNlZ+DZbrGqnQfBewLla4mbURsCPg2ZdlpnCHCelMBdpKXSOd3aUfhA4GbA3G3UO7muN45vwiVjegUjqqnSXc/rp37ZUhlex+vzNOgaqPa9VOFqyN1pc7epawncb0WFcp6PuTyo25eTcm0YaMFHoc06jWQdWbl9ObPjagPG24OHFBz4uPZ2aAEz6Heczot9tQmNU0dhZ62umVa3nx1ygOFWybukDQPXVZl2yvtbRomSICSQh79gl6X+opIe57fcN3EfBZyA+OH+3m4HuptRFgjCQeyDMOSiHzLSvnrEd6IqBWgwVAHvLfhaQRfVajMMlnMH6Hf+LQ8R6LnS5eM+HsjlacxfBpsGmc4N2A2RsOoh1aodE63rEwdts+pV4Z51JnHH0dbLWn3IH4O/lstH/4g4uPxzvt56yd6wcCB50Z0A/im7SLs9P10Jj6ZMWNGUnP6C9U63QK45Lfar9jvvvrQI8lN+2+TNA9bLhSSh4WLbFzWnxq4jBcFim6Mi2mjYYx3l+k0ZpwU08d6I7K8WG4sJyuDFMuJbl+IefqC8cqZlalSHuUxTaw3L6fIlhXTR36l8uXFcoKBN9zOEd035r01K1n/gKOSz+2+Q/LCHVOS2w/bLWkaskyp0DzylSugwrl+6hfZvKY13oZK0YhZYY1nbQoXDRx/0pxF5OsTWV4sI/KkqETPocrFGhfqzabLQrlEzBfdLMynjH7EV/7YplhmTBPLNl5/XwY2LsooiZgui3z55vPJTs0KQx3hfaOroz0ZOHwERh2UdHdggPbWoAwrjIXpz1YqP8JGG6/g0dhZIc0vbEgsVyOaJqaLeTVw/EhuvqiMbFnmifyYP8bHMmN8a2tr+B4rRQNn88T0kaKSo8yxY8Q4/R51BgwYEOLSm69QlnHWaziWJ9+yYl0i+uWbR1DWEPJ6MUPUAt1Znn7bYX3qRn2bN7zJGsBUW4FaoNHQ6tLA5VdKesg07423ko657xcfvleHkSOg/IeGXogNUiCVEhUF7HWuL/FtV0XYsGio2GDLiMrvD2K+CMMaJT6liTIK/GNw3NX7C47AizJny8mXKeSZ1nJjJzFfNG412D5oC9J4VnZ3LPwuXnaCsSzlzpcVznYVaHfobuhx6Emy3M+JfNc6ekdtPTonTSWked0c+DHfX8GHCuVXg3H2PHu8o1aX6c1voPeRd7/YQ/sq44OG9cVREAHvGOScgteLmYehf5a/qLDs/sK06obZpQ09/A8sN47yT8Hvs9yFotpQXB0aBU2ksPGQi54H7e2hCHuTO97ToH0gD9qegycihD39AvJ9RyGB9fi4zWvLgyAvPrzhCpGmSXuqNIIe7vMcD/d7OfWobPjWfRF8e684Fzqs6A2j3bN2jPsW5K7S3zcrm++9rMuLizMgnwqdRflekwqfGalALwzWlpHKHVzIt9enkd6z9xr4Eaf2FKi4VhSfL/0BmgpN0AgZjIcehX4HxZs1B4FHsq8aAI7GCyAvVYS/FTuEtOpoAvU8iv9hZgB38d6t+47Nnb6fBW2zv+c+EIrwQ8RFeqoZOH5i86GZD8C3hqZR0akonzpqfAjmWyUv5b8M73JcK3Bajl20izzDEKqGtMYfR9jnsL46uJCwh/N6KCR2tKQ0nnSN0EnErUzYn6Wq5CbqOZjRvSllrkL84ZQVb292Y3o6kLRtpJlEj9cQzoNebFyOO4G4RshfrB8Nz94/lo4zB9kOJ88JlPkc/GWg20k3Lk6nKYKQ8P243oY7hvq2wPVI+HnkuBO+SaZR1oXUH27ukHEfyv8tcX7B2gj/o6TdjiiPSd+C98U0nwb36ja+gPGp0wWUdSx+B40PJ44kr/HxSObivBI8nx+tT9nn4VdGB8ap5A8/Hqhm4Dg3hfdUZPB7pGvAOAoYSeOdIu4lvBa0ITSVNL599kB/Pq7ZHLHHG0/Fvkzw8d0Ywlvj90bLRL3mXdI6mm4m7cmkbWfaNuz69Qd4/lBuI/hr2xjCvv3yrDqG8CWELe8M4n3OYl0bwHIk207ri+06j7idUMqypDsX/wuQ76Z+TvpRGOi7LhfEx07nZcpEOpejZwZpr0Qe9xm+4JhE2PP3L8n7C6iLZeZ4yh2G319D+MsNR/hoeOdTRjt5fS+uTufZDlzl9nJDwxm2Xe9DX8J/Ba4G1tD+PxBnCR/0eWfgy49WyruCsgdBo+h42mMk5OxV1cDBQiTyQjwwgAdrb6qsaATunTbeeMibJ6c7nJq4ufL9sHHhQRj0JwRxI6BgvjIMP3tJ48wojYacbj8Lb39oRZS8JTyXCEeLX6f8EOA3ZW+AXBO9ZF8bo9xK2g7iBrIbn+KHe/iW6ZrpxY1tCucr+Nensg03DaSxnPb2xH8LinpCA8fdOmgm/aXI7qhwb7E1hnqQdF6qDCKPDwy9dfOZ7VTS/gZ3GOlWMwy5zGjAw+BpcOPsOG2eHIjztin7QcYZzOUv5E3hiHVW1K+Og9/lC/dawq8ij0Z1JnW5CZ8Oqxk4bPMQwh5j438KbUJBZ6NAp2qfhx5JeCRC2qv1v2eFIAqxNq5GfJz0NsAPBMMxsve+X4G8ggwdKYL4PVPvUPI4PflCcxXyfAXluvv0a9H2kC8bfkK8Nz++ZBzKWv0Isvgw3o/ek0jr99ANCLskxF9LxvYun8poZ3sHep3wIdTzQ/wD8N9rZ6S42PHWQZ7phI8gTuNNgbcSaXxKY2e1A/mLBWebOfCeJ523cV7l2qaVCTs1K5trtNePPtXYCQOtQHgv0qrn8EGF/N49D6QNUT/KHe75SatBFd4BtzppvRVUv78i7N5lb1w7fThfVTNw+IRGZu9dnyeTn8lc727Ab09Tae40XoHcfPnaQrI3e13nurcf4Z8j5Ex4/4F/HP43GBWnE9a4xQPeAiiovc+NmNeOG5PO90W+td7X3yehEKdKO9L78Hwk/xR+DfBHFBKeByHzoYxmqmnyjvhG4l02XKecnqPCvNpzOTDum+TxGexThJ0V6jQmFAxs+ZAj4hnKdbNGsOD662+slM39hBssN2ga9AuEXyK/98du9qz7Zdp+J/nqacNfcf191JnIvB4zxXTiDpJHujCKyefjRL99l+SF3BepI8Pq1ytMf9qzrjzqc9MmvL9WnoCalVcOH/7zkBn/34Yj0qeZ4UO7DRfw1oB2hvzu+C58d86uk+1WiGuvdHTcht/wJqTZBtcO0Yzrhqf0jgg47exEGu9Tw1Mf+YS3QimDod+hEBvvSLAn+7He1xU+VXkcel6DpHAztAdplMdPhN5VewHvo4It8fuZ7Z1MW3wj7W5b5fhUNXQ+p78IeMriLndj6vEI+ZC8lJzx9oOWg38tNMOyjSPtCriO4vfwX0Nc0E+K7Uk3Gp477DWhGfj/RrwnBg3uUREncT13vXW2CD82IOzS5R7oN/h9dLci/tchO5zLTTJt2rSqBi4DmYOwIqOUEoks37TRjX7JNDF9dEXWn09jGOMGSg1cihOxDilj4LJ6oz/LF3mZI6K/goGD33pinkgR8iXTyjdtjM/mi8i2V+Tjoz+bRmTTpX5H9d64fiTx2XEyffr0qlP0UnxMkBref6Xo0uBj+WDcpViKpViKpfiII0n+F/Qd1xJP/Ig/AAAAAElFTkSuQmCC", "description": "Use the Inventa integration to generate DSAR reports within Inventa instance and retrieve DSAR data for the XSOAR.", "detailedDescription": "### Partner Contributed Integration\n#### Integration Author: 1Touch.io\nSupport and maintenance for this integration are provided by the author. Please use the following contact details:\n- **URL**: [1Touch.io](1Touch.io)\n***\n## Inventa Integration Help\n\nIn order to connect to Inventa instance you need:\n* Inventa instance's IP\n* Inventa instance's API key\n\nBoth should be provided to Integration during setup in order to enable API calls to Inventa instance.\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/inventa)", "configuration": [ { "display": "Your Inventa server URL", "displayPassword": "", "name": "url", "defaultValue": "https://", "type": 0, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "API Key", "displayPassword": "", "name": "apikey", "defaultValue": "", "type": 4, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "The API Key to use for connection" }, { "display": "Trust any certificate (not secure)", "displayPassword": "", "name": "insecure", "defaultValue": "", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Use system proxy settings", "displayPassword": "", "name": "proxy", "defaultValue": "", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" } ], "integrationScript": { "script": "register_module_line('Inventa', 'start', __line__())\n### pack version: 1.1.11\n\n\n\n\n\"\"\"IMPORTS\"\"\"\n\n\nimport traceback\nfrom typing import Any, Dict\nimport urllib3\n\n# Disable insecure warnings\nurllib3.disable_warnings() # pylint: disable=no-member\n\n\n''' CONSTANTS '''\n\nDATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ' # ISO8601 format with UTC, default in XSOAR\nempty_file = {\n \"id\": \"\",\n \"timestamp\": \"\",\n \"name\": \"\",\n \"size\": \"\",\n \"path\": \"\",\n \"url\": \"\",\n \"entityTypes\": \"\"\n}\nempty_transaction: Dict = {\n}\nempty_dataasset: Dict = {\n \"id\": \"\",\n \"name\": \"\",\n \"piis\": \"\",\n \"reasonsOfProcessing\": \"\"\n}\nempty_database: Dict = {\n \"id\": \"\",\n \"name\": \"\",\n \"database\": \"\",\n \"entityTypes\": \"\"\n}\nempty_pii: Dict = {\n \"entities\": []\n}\n\n\n''' CLIENT CLASS '''\n\n\nclass Client(BaseClient):\n \"\"\"Client class to interact with the service API\n\n This Client implements API calls, and does not contain any XSOAR logic.\n Should only do requests and return data.\n It inherits from BaseClient defined in CommonServer Python.\n Most calls use _http_request() that handles proxy, SSL verification, etc.\n For this implementation, no special attributes defined\n \"\"\"\n\n def get_entities(self):\n pii_entities = self._http_request(\n method=\"GET\",\n url_suffix=\"/pii/api/configuration/categories\",\n return_empty_response=True\n )\n return pii_entities\n\n def get_datasubject(self, **kwargs):\n pii_entities = format_pii_entities(self.get_entities())[\"entities\"]\n\n # payload = generate_datasubject_payload(pii_entities, **kwargs)\n\n query = \"?\"\n for entity in pii_entities:\n if kwargs.get(entity.lower(), None):\n query = f\"{query}{entity}={kwargs[entity.lower()]}&\"\n query = query[0:len(query) - 1]\n\n found_piis = self._http_request(\n method=\"GET\",\n url_suffix=f\"/pii/api/piis{query}\",\n return_empty_response=True,\n retries=5)\n\n return found_piis\n\n def prepare_ticket(self, datasubject_id: Any, reason: str) -> Any:\n payload = {\n \"askToErasure\": None,\n \"changeConsent\": None,\n \"dataPortability\": None,\n \"disputeRequest\": None,\n \"dataSubjectId\": datasubject_id,\n \"id\": None,\n \"reason\": reason,\n \"updateDataSubjectDetails\": None\n }\n demisto.debug(f\"{payload}\")\n if datasubject_id:\n # create ticket id\n ticket_id = self._http_request(\n method=\"POST\",\n json_data={\"dataSubjectId\": datasubject_id},\n url_suffix=\"/dsr/api/dsar-management/tickets\",\n return_empty_response=True,\n retries=5\n )\n return ticket_id\n else:\n return None\n\n def create_ticket(self, datasubject_id: Any, reason: str) -> Dict[str, Any]:\n # new payload for ticket creation\n payload = {\n \"askToErasure\": None,\n \"changeConsent\": None,\n \"dataPortability\": None,\n \"disputeRequest\": None,\n \"dataSubjectId\": datasubject_id,\n \"id\": None,\n \"reason\": reason,\n \"updateDataSubjectDetails\": None\n }\n ticket_id = self.prepare_ticket(datasubject_id, reason)\n if ticket_id:\n demisto.debug(f\"{ticket_id}\")\n payload[\"id\"] = str(ticket_id)\n demisto.debug(f\"{payload}\")\n # create actual ticket\n ticket_id = self._http_request(\n method=\"POST\",\n json_data=payload,\n url_suffix=\"/dsr/api/dsar-management/tickets\",\n return_empty_response=True,\n retries=5\n )\n return ticket_id\n\n def get_ticket(self, ticket_id: Any) -> Dict:\n result = self._http_request(\n method=\"GET\",\n url_suffix=f\"/dsr/api/dsar-management/tickets/{ticket_id}\",\n return_empty_response=True,\n retries=5\n )\n return result\n\n def get_dsar(self, ticket_id: Any) -> Dict:\n ticket_details = self.get_ticket(ticket_id)\n demisto.debug(f\"{ticket_details}\")\n datasubject_id = ticket_details.get(\"piiId\", \"\")\n demisto.debug(f\"{datasubject_id}\")\n\n return self._http_request(\n method=\"GET\",\n url_suffix=f\"/dsr/api/dsar-management/personal-data-usage/ticket/{ticket_id}\",\n # url_suffix=f\"/pii/api/piis/{datasubject_id}/sources\",\n return_empty_response=True,\n retries=5\n )\n\n def get_sources(self, datasubject_id: Any) -> Dict:\n return self._http_request(\n method=\"GET\",\n url_suffix=f\"/pii/api/piis/{datasubject_id}/sources/details\",\n return_empty_response=True,\n retries=5\n )\n\n\n''' HELPER FUNCTIONS '''\n\n\ndef format_pii_entities(pii_entities):\n entities_listed = [[subitem for subitem in pii_entities[item]] for item in pii_entities]\n # return entities_listed\n result = list()\n for item in entities_listed:\n result.extend(item)\n result = {\"entities\": [item[\"entityName\"] for item in result]}\n return result\n\n\ndef generate_datasubject_payload(pii_entities, **kwargs):\n payload = []\n # fill initial payload\n for item in kwargs:\n if item.upper() in pii_entities:\n subpayload = {}\n subpayload[\"piiEntityType\"] = item.upper()\n subpayload[\"piiEntityValue\"] = kwargs[item]\n payload.append(subpayload)\n return payload\n\n\n''' COMMAND FUNCTIONS '''\n\n\ndef get_entities_command(client: Client) -> CommandResults:\n\n pii_entities = client.get_entities()\n\n result = format_pii_entities(pii_entities)\n return CommandResults(\n outputs_prefix=\"Inventa.Entities\",\n outputs_key_field=\"entity\",\n outputs=result\n )\n\n\ndef get_datasubjects_command(client: Client, **kwargs) -> CommandResults:\n results = client.get_datasubject(**kwargs)\n for result in results:\n result[\"personalInfo\"] = list(result[\"personalInfo\"].keys())\n result[\"personalInfo\"].sort()\n return CommandResults(outputs=result,\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"id\")\n\n\ndef get_datasubject_id_command(client: Client, **kwargs) -> CommandResults:\n found_piis = client.get_datasubject(**kwargs)\n # datasubs = found_piis.get(\"dataSubjects\", [])\n datasubs = found_piis\n if datasubs:\n datasubject_id = datasubs[0].get(\"id\", \"\")\n return CommandResults(outputs={\"datasubject_id\": datasubject_id},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n else:\n return CommandResults(outputs={\"datasubject_id\": 0},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n\n\ndef get_sources_command(client: Client, datasubject_id: str) -> CommandResults:\n if not datasubject_id:\n raise ValueError(\"No such datasubject_id found\")\n import json\n import copy\n result = []\n sources = client.get_sources(datasubject_id)\n sources = copy.deepcopy(sources)\n\n for source in sources:\n source_id = source[\"id\"]\n source_appliance_name = source[\"applianceName\"]\n source_ts = int(source[\"timestamp\"])\n source_key_type = source[\"key\"][\"keyType\"]\n source_path = source[\"key\"][\"path\"]\n source_url = source[\"key\"][\"repository\"][\"url\"]\n source_hostname = source[\"key\"][\"repository\"][\"hostName\"]\n source_db_name = source[\"key\"][\"repository\"][\"dbName\"]\n source_vendor = source[\"key\"][\"repository\"][\"vendor\"]\n source_type = source[\"key\"][\"repository\"][\"type\"]\n source_content = source[\"content\"]\n source_entity_types = source_content.pop(\"entityTypes\", None)\n source_content = json.dumps(source_content)\n\n result.append({\n \"id\": source_id,\n \"applianceName\": source_appliance_name,\n \"timestamp\": datetime.utcfromtimestamp(\n float(f\"{str(source_ts)[:10]}.{str(source_ts)[10:]}\")).strftime(\"%d %b %Y %H:%M:%S\"),\n \"keyType\": source_key_type,\n \"path\": source_path,\n \"url\": source_url,\n \"hostName\": source_hostname,\n \"dbName\": source_db_name,\n \"vendor\": source_vendor,\n \"type\": source_type,\n \"content\": source_content,\n \"entityTypes\": \", \".join(source_entity_types),\n })\n return CommandResults(outputs=result, outputs_prefix=\"Inventa.Sources.sources\", outputs_key_field=\"id\")\n\n\ndef get_sources_piis_command(client: Client, datasubject_id: str) -> CommandResults:\n sources = client.get_sources(datasubject_id)\n piis = []\n for item in sources:\n piis.extend(item[\"content\"][\"entityTypes\"])\n piis = list(set(piis))\n piis.sort()\n return CommandResults(outputs={\"piis\": piis}, outputs_prefix=\"Inventa.Sources\", outputs_key_field=\"piis\")\n\n\ndef create_ticket_command(client: Client, reason: str, datasubject_id: int) -> CommandResults:\n ticket_id = client.create_ticket(datasubject_id, reason)\n return CommandResults(outputs={\"ticket_id\": f\"{ticket_id}\"},\n outputs_prefix=\"Inventa.DataSubjects.Ticket\",\n outputs_key_field=\"ticket_id\")\n\n\ndef get_datasubjectid_from_ticket_command(client: Client, ticket_id: int) -> CommandResults:\n ticket_details = client.get_ticket(ticket_id)\n datasubject_id = ticket_details.get(\"piiId\", \"\")\n return CommandResults(outputs={\"datasubject_id\": datasubject_id},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n\n\ndef get_datasubject_details_command(client: Client, ticket_id: int) -> CommandResults:\n ticket_details = client.get_ticket(ticket_id)\n datasubject_name = ticket_details.get(\"name\", \"\")\n datasubject_email = ticket_details.get(\"email\", \"\")\n return CommandResults(outputs={\"name\": datasubject_name, \"email\": datasubject_email},\n outputs_prefix=\"Inventa.DataSubject\",\n outputs_key_field=\"name\")\n\n\ndef get_dsar_piis_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n piis = dsar.get(\"piis\", [])\n pii_list = list()\n for pii in piis:\n pii_list.append(pii.get(\"piiEntityType\", \"\"))\n\n demisto.debug(f\"{piis}\")\n demisto.debug(f\"{pii_list}\")\n\n return CommandResults(outputs={\"piis\": list(set(pii_list))},\n outputs_prefix=\"Inventa.Dsar.Piis\")\n\n\ndef get_dsar_transactions_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n transactions = dsar.get(\"copiesUsageData\", {}).get(\"transactions\", [])\n if \"entityTypes\" in transactions:\n transactions[\"entityTypes\"] = [transactions[\"entityTypes\"][\"type\"]\n for item in transactions[\"entityTypes\"] if item == \"type\"]\n\n for transaction in transactions:\n demisto.debug(f\"file: {transaction}\")\n if \"entityTypes\" in transaction:\n entityTypes = transaction[\"entityTypes\"]\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n demisto.debug(f\"stripped: {stripped}\")\n transaction[\"entityTypes\"] = stripped\n if transactions:\n return CommandResults(outputs={\"transactions\": transactions},\n outputs_prefix=\"Inventa.Dsar.Transactions\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"transactions\": [empty_transaction]},\n outputs_prefix=\"Inventa.Dsar.Transactions\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_files_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n demisto.debug(f\"{dsar}\")\n files = dsar.get(\"copiesUsageData\", {}).get(\"files\", [])\n demisto.debug(f\"{files}\")\n for file in files:\n # file.pop(\"path\")\n # file.pop(\"url\")\n demisto.debug(f\"file: {file}\")\n if \"entityTypes\" in file:\n entityTypes = file[\"entityTypes\"]\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n file[\"entityTypes\"] = \", \".join(stripped)\n if \"timestamp\" in file:\n ts = file.get(\"timestamp\", 0)\n if type(ts) is int:\n file[\"timestamp\"] = datetime.utcfromtimestamp(\n float(f\"{str(ts)[:10]}.{str(ts)[10:]}\")).strftime(\"%d %b %Y %H:%M:%S\")\n # file[\"entityTypes\"] = stripped\n if files:\n return CommandResults(outputs={\"files\": files},\n outputs_prefix=\"Inventa.Dsar.Files\",\n outputs_key_field=\"id\")\n\n else:\n return CommandResults(outputs={\"files\": [empty_file]},\n outputs_prefix=\"Inventa.Dsar.Files\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_databases_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n databases = dsar.get(\"copiesUsageData\", {}).get(\"databases\", [])\n tables = []\n for db in databases:\n demisto.debug(f\"db: {db}\")\n database_name = db.get(\"name\", \"\")\n if \"tables\" in db:\n for table in db[\"tables\"]:\n table[\"database\"] = database_name\n\n if \"entityTypes\" in table:\n entityTypes = table[\"entityTypes\"]\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n table[\"entityTypes\"] = \", \".join(stripped)\n # table[\"entityTypes\"] = stripped\n\n tables.append(table)\n\n if databases:\n return CommandResults(outputs={\"databases\": tables},\n outputs_prefix=\"Inventa.Dsar.Databases\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"databases\": [empty_database]},\n outputs_prefix=\"Inventa.Dsar.Databases\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_dataassets_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n dataAssets = dsar.get(\"copiesUsageData\", {}).get(\"dataAssets\", [])\n for da in dataAssets:\n demisto.debug(f\"file: {da}\")\n if \"piis\" in da:\n entityTypes = da[\"piis\"]\n if entityTypes:\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n da[\"piis\"] = \", \".join(stripped)\n else:\n da[\"piis\"] = \"None\"\n\n if \"reasonsOfProcessing\" in da:\n reasons = da[\"reasonsOfProcessing\"]\n if reasons:\n da[\"reasonsOfProcessing\"] = ', '.join(reasons)\n else:\n da[\"reasonsOfProcessing\"] = \"None\"\n\n if dataAssets:\n demisto.debug(f\"{dataAssets}\")\n return CommandResults(outputs={\"dataAssets\": dataAssets},\n outputs_prefix=\"Inventa.Dsar.DataAssets\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"dataAssets\": [empty_dataasset]},\n outputs_prefix=\"Inventa.Dsar.DataAssets\",\n outputs_key_field=\"id\")\n\n\ndef validate_incident_inputs_command(**kwargs):\n # ticket_id = kwargs.get(\"ticket_id\", \"\")\n datasubject_id = kwargs.get(\"datasubject_id\", \"\")\n national_id = kwargs.get(\"national_id\", \"\")\n passport_number = kwargs.get(\"passport_number\", \"\")\n driver_license = kwargs.get(\"driver_license\", \"\")\n tax_id = kwargs.get(\"tax_id\", \"\")\n cc_number = kwargs.get(\"cc_number\", \"\")\n given_name = kwargs.get(\"given_name\", \"\")\n surname = kwargs.get(\"surname\", \"\")\n full_name = kwargs.get(\"full_name\", \"\")\n vehicle_number = kwargs.get(\"vehicle_number\", \"\")\n phone_number = kwargs.get(\"phone_number\", \"\")\n birthday = kwargs.get(\"birthday\", \"\")\n city = kwargs.get(\"city\", \"\")\n street_address = kwargs.get(\"street_address\", \"\")\n\n demisto.debug(f\"{datasubject_id}\")\n\n constraints = [\n national_id,\n passport_number,\n driver_license,\n tax_id,\n cc_number,\n (given_name and vehicle_number),\n (given_name and phone_number),\n (given_name and surname and birthday),\n (given_name and surname and city and street_address),\n (full_name and birthday),\n (full_name and city and street_address)\n ]\n\n constraints_validated = False\n for constraint in constraints:\n if constraint:\n demisto.debug(f\"{constraint}\")\n constraints_validated = True\n break\n\n datasubject_id_validated = False\n if datasubject_id:\n datasubject_id_validated = True\n\n demisto.debug(\"CONSTRAINTS\")\n if constraints_validated:\n return CommandResults(outputs={\"validated\": True},\n outputs_prefix=\"Inventa.Incident\",\n outputs_key_field=\"validated\")\n elif datasubject_id_validated:\n return CommandResults(outputs={\"validated\": True},\n outputs_prefix=\"Inventa.Incident\",\n outputs_key_field=\"validated\")\n else:\n raise Exception(\"Validation failed: constraints missing. Check incident's inputs.\")\n\n\ndef test_module(client: Client) -> str:\n \"\"\"Tests API connectivity and authentication'\n\n Returning 'ok' indicates that the integration works like it is supposed to.\n Connection to the service is successful.\n Raises exceptions if something goes wrong.\n\n :type client: ``Client``\n :param Client: client to use\n\n :return: 'ok' if test passed, anything else will fail the test.\n :rtype: ``str``\n \"\"\"\n\n message: str = ''\n try:\n # TODO: ADD HERE some code to test connectivity and authentication to your service.\n # This should validate all the inputs given in the integration configuration panel,\n # either manually or by using an API that uses them.\n client.get_entities()\n message = 'ok'\n except DemistoException as e:\n if 'Forbidden' in str(e) or 'Authorization' in str(e): # TODO: make sure you capture authentication errors\n message = 'Authorization Error: make sure API Key is correctly set'\n else:\n raise e\n return message\n\n\n'''FETCH INCIDENTS'''\n\n\n''' MAIN FUNCTION '''\n\n\ndef main() -> None:\n \"\"\"main function, parses params and runs command functions\n\n :return:\n :rtype:\n \"\"\"\n\n try:\n # authentication\n api_key = demisto.params().get('apikey', \"\")\n\n # get the service API url\n base_url = demisto.params().get(\"url\", '')\n\n # if your Client class inherits from BaseClient, SSL verification is\n # handled out of the box by it, just pass ``verify_certificate`` to\n # the Client constructor\n verify_certificate = not demisto.params().get('insecure', False)\n\n # if your Client class inherits from BaseClient, system proxy is handled\n # out of the box by it, just pass ``proxy`` to the Client constructor\n proxy = demisto.params().get('proxy', False)\n\n demisto.debug(f'Command being called is {demisto.command()}')\n\n # TODO: Make sure you add the proper headers for authentication\n # (i.e. \"Authorization\": {api key})\n headers: Dict = {\n 'Authorization': f\"Bearer {api_key}\"\n }\n\n client = Client(\n base_url=base_url,\n verify=verify_certificate,\n headers=headers,\n proxy=proxy)\n\n if demisto.command() == 'test-module':\n # This is the call made when pressing the integration Test button.\n result = test_module(client)\n return_results(result)\n\n elif demisto.command() == 'inventa-get-datasubjects':\n return_results(get_datasubjects_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-get-datasubject-id':\n return_results(get_datasubject_id_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-create-ticket':\n return_results(create_ticket_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-get-datasubject-details':\n return_results(get_datasubject_details_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-piis':\n return_results(get_dsar_piis_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-transactions':\n return_results(get_dsar_transactions_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-files':\n return_results(get_dsar_files_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-databases':\n return_results(get_dsar_databases_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-dataassets':\n return_results(get_dsar_dataassets_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-datasubject-id-from-ticket':\n return_results(get_datasubjectid_from_ticket_command(client, demisto.args().get(\"ticket_id\", 0)))\n\n elif demisto.command() == \"inventa-get-sources\":\n return_results(get_sources_command(client, demisto.args().get(\"datasubject_id\", \"\")))\n\n elif demisto.command() == \"inventa-get-sources-piis\":\n return_results(get_sources_piis_command(client, demisto.args().get(\"datasubject_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-entities':\n return_results(get_entities_command(client))\n\n elif demisto.command() == 'inventa-validate-incident-inputs':\n return_results(validate_incident_inputs_command(**demisto.args()))\n\n # Log exceptions and return errors\n except Exception as e:\n demisto.error(traceback.format_exc()) # print the traceback\n return_error(f'Failed to execute {demisto.command()} command.\\nError:\\n{str(e)}')\n\n\n''' ENTRY POINT '''\n\n\nif __name__ in ('__main__', '__builtin__', 'builtins'):\n main()\n\nregister_module_line('Inventa', 'end', __line__())\n", "type": "python", "commands": [ { "name": "inventa-get-sources-piis", "deprecated": false, "arguments": [ { "name": "datasubject_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a datasubject.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.Sources.piis", "description": "List of piis containing info about data subject.", "type": "String" } ], "important": null, "description": "Get PII details from daatasubjest.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-sources", "deprecated": false, "arguments": [ { "name": "datasubject_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a datasubject.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.Sources.sources.id", "description": "Id of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.applianceName", "description": "Appliance name of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.timestamp", "description": "Timestamp of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.keyType", "description": "KeyType of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.path", "description": "Path of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.url", "description": "URL of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.hostname", "description": "Hostname of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.dbName", "description": "DB name of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.vendor", "description": "Vendor of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.type", "description": "Type of a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.context", "description": "Additional info on a source containing info about data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.Sources.sources.entityTypes", "description": "Types of sensitive data stored in a source containing info about data subject.", "type": "String" } ], "important": null, "description": "Get sources details.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-datasubjects", "deprecated": false, "arguments": [ { "name": "national_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "National ID of a PII.", "type": "" }, { "name": "passport_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Passport Number of a PII.", "type": "" }, { "name": "driver_license", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Driver's License of a PII.", "type": "" }, { "name": "tax_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Tax ID of a PII.", "type": "" }, { "name": "cc_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Credit Card Number of a PII.", "type": "" }, { "name": "given_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Given Name of a PII.", "type": "" }, { "name": "surname", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Surname of a PII.", "type": "" }, { "name": "full_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Full Name of a PII.", "type": "" }, { "name": "vehicle_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Vehicle Number of a PII.", "type": "" }, { "name": "phone_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Phone Number of a PII.", "type": "" }, { "name": "birthday", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Birthday of a PII.", "type": "" }, { "name": "city", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "City of Resdence of a PII.", "type": "" }, { "name": "street_address", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Street Address of a PII.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.id", "description": "ID of a Data Subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.id", "description": "ID of an Entity Type for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityType", "description": "Entity Type name for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityValue", "description": "Value of an Entity Type for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityValueNew", "description": "New Value of an Entity Type for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.dataSubjects.piis.action", "description": "Action of an Entity Type for the PII.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubjects.total", "description": "Total number of PII Entities found for the PII.", "type": "String" } ], "important": null, "description": "Get Data Subject full details.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-transactions", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.Transactions.transactions", "description": "List of data transactions.", "type": "String" } ], "important": null, "description": "Retrieves data transactions' details containing info about data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-files", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.Files.files", "description": "List of files containing info about data subject.", "type": "String" } ], "important": null, "description": "Retrieves details of files contatining info about data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-databases", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.DataBases.databases", "description": "List of datatables containing info about data subject.", "type": "String" } ], "important": null, "description": "Retrieves list of databases and tables containing info about data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-datasubject-details", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubject.name", "description": "Name of a data subject.", "type": "String" }, { "contentPath": "", "contextPath": "Inventa.DataSubject.email", "description": "Email address of a data subject.", "type": "String" } ], "important": null, "description": "Get datasubject name and email.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-dataassets", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.DataAssets.dataAssets", "description": "List of data assets containing info about data subject.", "type": "String" } ], "important": null, "description": "Retrieves list of data assets containing info about data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-dsar-piis", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DSAR.piis", "description": "List of PII categories related to data subject.", "type": "String" } ], "important": null, "description": "Get list of PII categories related to the data subject.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-entities", "deprecated": false, "arguments": [], "outputs": [ { "contentPath": "", "contextPath": "Inventa.Entities.entity", "description": "List of PII entities described in Inventa.", "type": "String" } ], "important": null, "description": "Retrieves list of PII entities described in Inventa.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-datasubject-id-from-ticket", "deprecated": false, "arguments": [ { "name": "ticket_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a DSAR ticket within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubjects.datasubject_id", "description": "ID of a data subject within Inventa.", "type": "String" } ], "important": null, "description": "Retrieves ID of a data subject from Inventa's DSAR ticket.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-get-datasubject-id", "deprecated": false, "arguments": [ { "name": "national_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "National ID of a PII.", "type": "" }, { "name": "passport_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Passport Number of a PII.", "type": "" }, { "name": "driver_license", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Driver's License of a PII.", "type": "" }, { "name": "tax_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Tax ID of a PII.", "type": "" }, { "name": "cc_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Credit Card Number of a PII.", "type": "" }, { "name": "given_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Given Name of a PII.", "type": "" }, { "name": "surname", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Surname of a PII.", "type": "" }, { "name": "full_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Full Name of a PII.", "type": "" }, { "name": "vehicle_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Vehicle Number of a PII.", "type": "" }, { "name": "phone_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Phone Number of a PII.", "type": "" }, { "name": "birthday", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Birthday of a PII.", "type": "" }, { "name": "city", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "City of Resdence of a PII.", "type": "" }, { "name": "street_address", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Street Address of a PII.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubjects.datasubject_id", "description": "ID of a data subject within Inventa.", "type": "String" } ], "important": null, "description": "Retrieves ID of a data subject from passed constraints.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-validate-incident-inputs", "deprecated": false, "arguments": [ { "name": "national_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "National ID of a PII.", "type": "" }, { "name": "passport_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Passport Number of a PII.", "type": "" }, { "name": "driver_license", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Driver's License of a PII.", "type": "" }, { "name": "tax_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Tax ID of a PII.", "type": "" }, { "name": "cc_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Credit Card Number of a PII.", "type": "" }, { "name": "given_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Given Name of a PII.", "type": "" }, { "name": "surname", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Surname of a PII.", "type": "" }, { "name": "full_name", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Full Name of a PII.", "type": "" }, { "name": "vehicle_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Vehicle Number of a PII.", "type": "" }, { "name": "phone_number", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Phone Number of a PII.", "type": "" }, { "name": "birthday", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Birthday of a PII.", "type": "" }, { "name": "city", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "City of Resdence of a PII.", "type": "" }, { "name": "street_address", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Street Address of a PII.", "type": "" }, { "name": "ticket_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Inventa's ticket ID.", "type": "" }, { "name": "datasubject_id", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Inventa's Datasubject ID.", "type": "" }, { "name": "reason", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Report reason.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.Incident.validated", "description": "Whether incident inputs are validated.", "type": "Boolean" } ], "important": null, "description": "Validates incident's inputs.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false }, { "name": "inventa-create-ticket", "deprecated": false, "arguments": [ { "name": "reason", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "Reason for DSAR reporty.", "type": "" }, { "name": "datasubject_id", "required": true, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "ID of a data subject within Inventa.", "type": "" } ], "outputs": [ { "contentPath": "", "contextPath": "Inventa.DataSubjects.Ticket.ticket_id", "description": "ID of a DSAR ticket, created within Inventa.", "type": "String" } ], "important": null, "description": "Creates Inventa ticket.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false } ], "dockerImage": "demisto/python3:3.10.13.84405", "isFetch": false, "isFetchEvents": false, "isFetchAssets": false, "feed": false, "isFetchCredentials": false, "runOnce": false, "longRunning": false, "longRunningPortMapping": false, "subtype": "python3", "isMappable": false, "isRemoteSyncIn": false, "isRemoteSyncOut": false, "isFetchSamples": false, "resetContext": false }, "system": true, "hidden": false, "canGetSamples": true } ], "engines": { "engines": [ { "id": "b9a6e9ec-dbf9-4238-a79d-2af71083c781", "version": 1585, "cacheVersn": 0, "sequenceNumber": 41993325, "primaryTerm": 12, "modified": "2024-02-25T09:21:51.901644445Z", "sizeInBytes": 1729, "sortValues": [ "110759" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "name": "lemon_373065a9b3cbb94f10933e40c56ef345", "allowOnTenant": false, "locked": false, "lastSeen": "2024-02-25T09:21:51.893916129Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "2024-02-25T09:21:51.484460675Z", "serviceName": "d1_lemon_373065a9b3cbb94f10933e40c56ef345", "host": "hostname-ngdev-syhansef", "user": "user@company.com", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-lemon_373065a9b3cbb94f10933e40c56ef345-8.6-847672.sh", "config": "{\"engine.handshake.max.retries.slow\": \"7200\", \"engine.connection.retry.timeoout\": \"7200\"}", "baseUrl": "10.180.194.141:8443,172.17.0.1:8443", "engineGroup": "", "protocolVersion": "2.5.1", "os": "linux", "demistoVersion": "8.5.0", "buildVersion": "28536e48e3d9264bccec3e9cd8fc980c0edf4434", "md5": "9493667ed12b1278abaf3b947fd5e27b", "underUpgrade": false, "tenantNames": null, "workers": 16, "isDefault": false, "isLegacy": false, "packageFileHash": "53719508543c1fd5844fd877c7171c97a0198ca60f69c2a06ade2c553e2f0064", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}iqDnqBcLScr8prMRpaozWqGkP2LF/q7ehux9h23+9EjWFOPQ6bMKc6tciKgNA/FDlpvYguAUaIqDUqWvG69pSFZ4xiQ8FCTFeJkR89Xcmxm8WcFUU1+WPFOisWG1QzABg03IZkgXDxr6sJEol4t2mu9Z4hh122MdXFK+UhNI5VENpJZsuYunwcMocTHyetTeFJf8UnA9i6Fa+jZGr5jCLzNc56J8q/5WIFvETKtPfNeAEhUru+lDdhiLlMiP5gGClKOMR7xC0lw5jY0XphWy6aMcQ3VaPYiPXZjhdturGo4=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": true, "modules": null } ], "total": 1, "pkgTypes": [ "shell" ], "requestedLogs": {}, "engineGroups": [] }, "health": { "AutoFocusTagsFeed_default_instance": { "id": "AutoFocusTagsFeed.AutoFocusTagsFeed_default_instance", "version": 45631, "cacheVersn": 0, "sequenceNumber": 42030715, "primaryTerm": 12, "modified": "2024-02-25T15:46:27.125445318Z", "sizeInBytes": 932, "sortValues": [ "112961" ], "brand": "AutoFocusTagsFeed", "instance": "AutoFocusTagsFeed_default_instance", "incidentsPulled": 0, "indicatorsPulled": 0, "eventsPulled": 0, "assetsPulled": 0, "type": 0, "incidentsDropped": 0, "lastPullTime": "2024-02-25T15:46:25.140760055Z", "lastError": "Script failed to run: \nError: [Traceback (most recent call last):\n \n File \"\", line 614, in \n File \"\", line 610, in main\n File \"\", line 7617, in return_error\n Exception: Failed to execute fetch-indicators command.\nError:\nError in API call [401] - Unauthorized\n{\"message\": \"API key not found\"}\n] (2604) (2603)", "lastIngestionDuration": 0, "fetchDuration": 0, "creation_time": "2023-02-07T08:48:08.429755153Z", "sum_hour": 0, "sum_day": 0, "sum_week": 0 } } } } } } } } }, "operationId": "post-xsoar-settings-integration-search", "description": "Search for integration instances by instance ID.\r\n\r\n**Note:** This endpoint is supported in XSOAR 8.8 and later.", "parameters": [ { "schema": { "type": "string" }, "in": "query", "name": "id", "description": "Integration instance ID" } ] }, "parameters": [] }, "/public_api/v1/api_keys/get_api_keys": { "post": { "summary": "Get existing API keys", "tags": [ "API keys" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "reply": { "DATA": [ { "id": 25, "creation_time": 1709544947832, "created_by": "N/A", "user_name": "Public API - 21", "roles": [ "default" ], "security_level": "standard", "comment": null, "expiration": 1710149747184 }, { "id": 24, "creation_time": 1709544787367, "created_by": "N/A", "user_name": "Public API - 21", "roles": [ "default" ], "security_level": "standard", "comment": null, "expiration": 1710149586852 }, { "id": 23, "creation_time": 1709544227320, "created_by": "N/A", "user_name": "Public API - 21", "roles": [ "default" ], "security_level": "standard", "comment": null, "expiration": 1710149026834 } ], "FILTER_COUNT": 3, "TOTAL_COUNT": 70 } } }, "properties": { "reply": { "type": "object", "properties": { "data": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "integer" }, "creation_time": { "type": "integer" }, "created_by": { "type": "string" }, "user_name": { "type": "string" }, "roles": { "type": "array", "items": { "type": "string" } }, "security_level": { "type": "string" }, "comment": { "nullable": true }, "expiration": { "type": "integer" } } } }, "filter_count": { "type": "integer" }, "total_count": { "type": "integer", "description": "Note: The `total_count` value contains all API Keys, including ones that have expired." } } } } }, "examples": { "Example 1": { "value": { "reply": { "DATA": [ { "id": 25, "creation_time": 1709544947832, "created_by": "N/A", "user_name": "Public API - 21", "roles": [ "default" ], "security_level": "standard", "comment": null, "expiration": 1710149747184 }, { "id": 24, "creation_time": 1709544787367, "created_by": "N/A", "user_name": "Public API - 21", "roles": [ "default" ], "security_level": "standard", "comment": null, "expiration": 1710149586852 }, { "id": 23, "creation_time": 1709544227320, "created_by": "N/A", "user_name": "Public API - 21", "roles": [ "default" ], "security_level": "standard", "comment": null, "expiration": 1710149026834 } ], "FILTER_COUNT": 3, "TOTAL_COUNT": 70 } } } } } } } }, "operationId": "post-public_api-v1-api_keys-get_api_keys", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "filters": [ { "field": "expiration", "operator": "lte", "value": 1710149747184 } ] } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "array", "description": "An array of filter fields.", "items": { "type": "object", "properties": { "field": { "enum": [ "expiration", "roles", "id" ], "description": "Identifies the API key field the filter is matching. Filters are based on the following keywords:\r\n- `expiration`: Time the API key expires in epoch milliseconds.\r\n- `roles`: The role assigned to the API key at creation.\r\n- `id`: API key ID." }, "operator": { "enum": [ "gte", "lte", "contains", "in" ], "description": "Identifies the comparison operator you want to use for this filter. Valid keywords are:\r\n\r\n- `gte` / `lte` operator is used with `expiration` field (Integer in timestamp epoch milliseconds).\r\n\r\n- `contains` operator is used with `roles` field (Array of strings).\r\n\r\n- `in` operator is used with `id` field (Array of integers)." }, "value": { "type": [ "integer", "array" ], "description": "Value that this filter must match. The contents of this field will differ depending on the API key field that you specified for this filter:\r\n- `expiration`: Integer representing the number of milliseconds after the Unix epoch, UTC timezone.\r\n- `roles`: Array of strings representing the roles in the Cortex XSOAR system.\r\n- `id`: Array of integers representing the API key IDs.", "items": {} } } } } } } } }, "examples": { "Get API keys and filter by expiration": { "value": { "request_data": { "filters": [ { "field": "expiration", "operator": "gte", "value": 1721149909250 } ] } } }, "Get API keys and filter by roles": { "value": { "request_data": { "filters": [ { "field": "roles", "operator": "contains", "value": [ "Public API Action" ] } ] } } }, "Get API keys and filter by ID": { "value": { "request_data": { "filters": [ { "field": "id", "operator": "in", "value": [ 85 ] } ] } } } } } } }, "description": "Get a list of API keys filtered by expiration date, role, or ID.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ] } }, "/public_api/v1/api_keys/generate": { "post": { "summary": "Generate an API key", "tags": [ "API Keys" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "id": { "type": "integer" }, "key": { "type": "string" } } } }, "x-examples": { "Example 1": { "reply": { "id": 87, "key": "oZFaXmXALCeoWIJTb9ITSqUvl4OBLsUQqCeuYc5FdwMpmpY6QBn8OUePZiLMb" } } } }, "examples": { "Standard API key": { "value": { "reply": { "id": 4267, "key": "oZFaXmXCLCdoWIXTb9ITSqUvl4OBLsUQgCeuZc5FdwMpmpY5QBn8OUePZiLMb" } } } } } } } }, "operationId": "post-public_api-v1-api_keys-generate", "description": "Generate a new API key and define the roles assigned to it and whether the security level is standard or advanced.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "roles": [ "Public API Action" ], "security_level": "standard" } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "roles", "security_level" ], "properties": { "roles": { "type": "array", "description": "A list of roles to be assigned to the API key.", "items": { "type": "string" } }, "security_level": { "description": "The seurity level of the API key. API keys with advanced security are hashed with a nonce and timestamp, which is useful for proprietary scripts and are intended to prevent replay attacks. Standard security API keys can be used as-is and are suitable for curl.", "enum": [ "standard", "advanced" ] }, "expiration": { "type": "integer", "description": "Integer in timestamp epoch milliseconds. Default value is one week from the time of the API call. Maximum expiration date is six months from the time of the API call." }, "comment": { "type": "string" } } } } }, "examples": { "Generate a standard API key": { "value": { "request_data": { "roles": [ "Public API Action" ], "security_level": "standard", "comment": "Api key for John" } } }, "Generate a standard API key with expiration": { "value": { "request_data": { "roles": [ "Public API Action" ], "security_level": "standard", "expiration": 1725802080000, "comment": "API key for Joe" } } } } } } } } }, "/public_api/v1/api_keys/delete": { "post": { "summary": "Delete API keys", "tags": [ "API Keys" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "reply": { "update_count": 2 } } }, "properties": { "reply": { "type": "object", "properties": { "update_count": { "type": "integer", "description": "The number of API keys deleted." } } } } }, "examples": { "Example 1": { "value": { "reply": { "update_count": 2 } } } } } } } }, "operationId": "post-public_api-v1-api_keys-delete", "description": "Delete API keys by ID.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "filters": [ { "field": "id", "operator": "in", "value": [ 112, 114 ] } ] } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "array", "description": "An array of filter fields.", "items": { "type": "object", "properties": { "field": { "enum": [ "id" ], "description": "Identifies the API key field the filter is matching. Filters are based on the following keyword:\r\n- `id`: The API key ID.\r\n" }, "operator": { "enum": [ "in" ], "description": "Identifies the comparison operator you want to use for this filter. Valid keyword is:\r\n`in`\r\n- `id`: Integer representing the API key ID.\r\n" }, "value": { "type": "array", "description": "Array of API key IDs.", "items": { "type": "integer" } } } } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "filters": [ { "field": "id", "operator": "in", "value": [ 121, 134 ] } ] } } } } } } } } }, "/xsoar/public/v1/settings/integration/{instance_id}": { "parameters": [ { "schema": { "type": "string", "example": "5cd9f014-e3e8-41a8-accb-e6d37482ded5" }, "name": "instance_id", "in": "path", "required": true, "description": "Instance ID" } ], "delete": { "summary": "Delete an integration instance by its ID", "tags": [ "Integrations" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } } }, "operationId": "delete-settings-integration-id", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Delete an integration instance identified by its ID." } }, "/xsoar/public/v1/incident/load/{id}": { "parameters": [ { "schema": { "type": "string", "example": "162669" }, "name": "id", "in": "path", "required": true } ], "get": { "summary": "Get a specific incident", "tags": [ "Incidents" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Incident" }, "examples": { "Example 1": { "value": { "id": "178768", "version": 0, "cacheVersn": 0, "modified": "1970-01-01T00:00:00Z", "sizeInBytes": 0, "CustomFields": { "bmcassignee": [ {} ], "bmccustomer": [ {} ], "bmcrequester": [ {} ], "containmentsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "crowdstrikefalconbehaviourpatterndispositiondetails": [ {}, {}, {} ], "datadogcloudsiem": [ {}, {}, {} ], "dataminrpulserelatedterms": [ {}, {}, {} ], "decyfirdatadetails": [ {}, {}, {} ], "detectionsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 20, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "domaintoolsirisdetect": [ {}, {}, {} ], "endpoint": [ {} ], "externalid": "178768", "extrahoprevealxdetectiondevices": [ {}, {}, {} ], "extrahoprevealxmitretechniques": [ {}, {}, {} ], "filerelationships": [ {}, {}, {} ], "fortisiemattacktactics": [ {}, {} ], "fortisiemevents": [ {} ], "incidentduration": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 0, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "incidentrdpachehuntingstringssimilarity": [ {}, {}, {} ], "incidentrdpcachehuntingstringsifter": [ {}, {}, {} ], "inventasource": [ {} ], "microsoftsentinelowner": [], "qintelqwatchexposures": [ {}, {}, {} ], "remediationsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 7200, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "rsametasevents": [], "rsarawlogslist": [], "securitypolicymatch": [ {} ], "similarincidentsdbot": [ {} ], "spycloudcompassdevicedata": [ {}, {}, {} ], "suspiciousexecutions": [ {}, {}, {} ], "timetoassignment": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 0, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "triagesla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "urlsslverification": [], "xdralertsearchresults": [ {}, {}, {} ], "xdrinvestigationresults": [ {}, {}, {}, { "columnheader1": "" }, {}, { "columnheader1": "" }, {}, {} ], "xpanseserviceclassifications": [ {}, {}, {} ], "xpanseservicevalidation": [ { "columnheader1": "" }, {}, {} ] }, "account": "", "autime": 1712843499584000000, "type": "default_type", "rawType": "default_type", "name": "delete_integration_instance_ESEDFV0U", "rawName": "delete_integration_instance_ESEDFV0U", "status": 0, "custom_status": "", "resolution_status": "", "reason": "", "created": "2024-04-11T13:51:39.584Z", "occurred": "2024-04-11T13:51:38.183347Z", "closed": "0001-01-01T00:00:00Z", "sla": 0, "severity": 0, "investigationId": "", "labels": [ { "value": "Rocket Incident Generator", "type": "Brand" }, { "value": "delete_integration_instance_ESEDFV0U", "type": "Instance" }, { "value": "bar", "type": "foo" }, { "value": "{\"evidenceBoard\":\"https://fqdn.us.paloaltonetworks.com/EvidenceBoard/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\",\"investigation\":\"https://fqdn.us.paloaltonetworks.com/Details/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\",\"relatedIncidents\":\"https://fqdn.us.paloaltonetworks.com/Cluster/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\",\"server\":\"https://fqdn.us.paloaltonetworks.com\",\"warRoom\":\"https://fqdn.us.paloaltonetworks.com/WarRoom/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\",\"workPlan\":\"https://fqdn.us.paloaltonetworks.com/WorkPlan/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\"}", "type": "demisto_url" } ], "attachment": null, "details": "{\"foo\": \"bar\", \"demisto_url\": {\"evidenceBoard\": \"https://fqdn.us.paloaltonetworks.com/EvidenceBoard/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\", \"investigation\": \"https://fqdn.us.paloaltonetworks.com/Details/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\", \"relatedIncidents\": \"https://fqdn.us.paloaltonetworks.com/Cluster/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\", \"server\": \"https://fqdn.us.paloaltonetworks.com\", \"warRoom\": \"https://fqdn.us.paloaltonetworks.com/WarRoom/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\", \"workPlan\": \"https://fqdn.us.paloaltonetworks.com/WorkPlan/temp_a55ff05c-6e11-4544-86cf-f513687fc9fa\"}}", "openDuration": 0, "lastOpen": "0001-01-01T00:00:00Z", "closingUserId": "", "owner": "", "activated": "0001-01-01T00:00:00Z", "closeReason": "", "rawCloseReason": "", "closeNotes": "", "playbookId": "", "dueDate": "0001-01-01T00:00:00Z", "reminder": "0001-01-01T00:00:00Z", "runStatus": "", "notifyTime": "0001-01-01T00:00:00Z", "phase": "", "rawPhase": "", "isPlayground": false, "rawJSON": "", "parent": "", "parentXDRIncident": "", "retained": false, "category": "", "rawCategory": "", "linkedIncidents": null, "linkedCount": 0, "droppedCount": 0, "sourceInstance": "delete_integration_instance_ESEDFV0U", "sourceBrand": "Rocket Incident Generator", "canvases": null, "lastJobRunTime": "0001-01-01T00:00:00Z", "feedBased": false, "dbotMirrorId": "", "dbotMirrorInstance": "", "dbotMirrorDirection": "", "dbotDirtyFields": null, "dbotCurrentDirtyFields": null, "dbotMirrorTags": null, "dbotMirrorLastSync": "0001-01-01T00:00:00Z", "isDebug": false } } } } } } }, "operationId": "get-incident-load-id", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Get the incident details of the specified incident ID." } }, "/xsoar/public/v1/investigation/{investigation_id}/context": { "parameters": [ { "schema": { "type": "string" }, "name": "investigation_id", "in": "path", "required": true, "description": "Investigation ID" } ], "post": { "summary": "Get investigation ID context", "tags": [ "Investigations" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "my_key": { "type": "string" } }, "x-examples": { "Example 1": { "my_key": "my_value" } } }, "examples": { "Example 1": { "value": { "my_key": "my_value" } } } } } } }, "operationId": "post-investigation-id-context", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "query": { "type": "string" } }, "x-examples": { "Example 1": { "query": "${.}" } } }, "examples": { "Example 1": { "value": { "query": "${.}" } } } } }, "description": "" }, "description": "Retrieve all context values from the specified investigation.\r\n\r\nYou can use the [Cortex XSOAR Transform Language (DT)](https://xsoar.pan.dev/docs/integrations/dt).\r\n\r\nFor example, if you have context data in the specified investigation as follows: `my_key: \"my_value\"`, you can run the following API query:\r\n```\r\nhttps://api-{fqdn}/xsoar/public/v1/investigation/{investigation_id}/context' -H \"Authorization:$api_key\" -H \"x-xdr-auth-id:$api_key_id\" -H \"Content-Type:application/json\" -d '{\"query\":\"${.}\"}\r\n```\r\nyou would get the following response:\r\n```json\r\n{\r\n \"my_key\":\"my_value\"\r\n }\r\n```\r\n\r\nIf you run the following query:\r\n```\r\nhttps://api-{fqdn}/xsoar/public/v1/investigation/{investigation_id}/context' -H \"Authorization:$api_key\" -H \"x-xdr-auth-id:$api_key_id\" -H \"Content-Type:application/json\" -d '{\"query\":\"${.my_key}\"}\r\n```\r\nyou would get the following response:\r\n```json\r\n\"my_value\"\r\n```" } }, "/xsoar/public/v1/automation": { "post": { "summary": "Create or update a script", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/automationScriptResult" } } } } }, "operationId": "post-auotmation", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/automationScriptFilterWrapper" }, "examples": { "Example 1": { "value": { "script": { "name": "hello_world_2", "dockerImage": "demisto/python3:3.10.14.92207", "propagationLabels": [ "all" ] }, "savePassword": false } } } } } }, "description": "Create or update a script.", "tags": [ "Scripts" ] }, "parameters": [] }, "/xsoar/public/v1/evidence/delete": { "post": { "summary": "Delete evidence", "tags": [ "Evidence" ], "responses": { "200": { "description": "OK" } }, "operationId": "post-evidence-delete", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Delete an evidence entity.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "evidenceID": { "type": "string", "description": "ID of the evidence you want to delete." } } } } } } }, "parameters": [] }, "/xsoar/public/v1/evidence/search": { "post": { "summary": "Search evidence", "tags": [ "Evidence" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EvidencesSearchResponse" } } } } }, "operationId": "post-evidence-search", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Search for an evidence entity by filter.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "filter": { "$ref": "#/components/schemas/GenericStringDateFilter" }, "incidentID": { "type": "string" } } } } } } }, "parameters": [] }, "/xsoar/public/v1/incident/batch/exportToCsv": { "post": { "summary": "Batch export incidents to CSV", "tags": [ "Incidents" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "filename": { "type": "string", "example": " incidents_report_Thu_18_Apr_2024_10_06_04_UTC.csv", "description": "The CSV filename. Use this filename as the path header in `/xsoar/public/v1/incidents/csv/{filename}`." } } } } } }, "413": { "description": "Limit exceeded. Output file exceeded limit. Exported incidents reach limit [10,000].", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-incident-batch-exportToCsv", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Export a batch of incidents to a CSV file and receive the filename in response. You can then use [Get incidents as a CSV file](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/incidents#get-xsoar-public-v1-incident-csv-filename) to download the CSV file.\r\nYou can define the columns as well as filter the incidents to be included in the CSV file.\r\n\r\n**Note: ** You can retrieve up to 10,000 incidents.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateDataBatch" }, "examples": { "Include columns ID, Name, and Severity and filter from last 2 days": { "value": { "all": true, "columns": [ "id", "name", "severity" ], "filter": { "period": { "by": "days", "fromValue": 2 } } } } } } } } }, "parameters": [] }, "/xsoar/public/v1/incident/csv/{filename}": { "parameters": [ { "schema": { "type": "string", "example": "incidents_report_Thu_18_Apr_2024_10_06_04_UTC.csv" }, "name": "filename", "in": "path", "required": true, "description": "Filename of the CSV file outputted by the \"Batch export incidents to CSV\" API call" } ], "get": { "summary": "Get incidents as a CSV file", "tags": [ "Incidents" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary" } } } } }, "headers": {} } }, "operationId": "get-incident-csv-id", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Download the incident details in a CSV file format after preparing it by calling the [Batch export incidents to CSV](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/incidents#post-xsoar-public-v1-incident-batch-exporttocsv) API endpoint. The response of that call contains the prepared incident report filename with a timestamp. Use that filename as the path parameter in this API endpoint to download the file.\r\n\r\nNote: To use cURL to run this command, add the `-O` curl command for downloading a file to the current folder, or `-o /my_custom_location/my_custom_name.csv` to customize the destination of the downloaded file.\r\nFor example:\r\n``` curl\r\ncurl \"https://api-yourfqdn/xsoar/public/v1/incident/csv/incidents_report_Thu_18_Apr_2024_10_06_04_UTC.csv\" \r\n-H 'content-type: application/json' \r\n-H 'accept: application/json' \r\n-H \"Authorization:$api_key\" \r\n-H \"x-xdr-auth-id:$api_key_id\" \r\n-O \r\n```" } }, "/xsoar/public/v1/indicators/batchDelete": { "post": { "summary": "Batch delete indicators or add them to the exclusion list", "tags": [ "Indicators" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateResponse" } } } } }, "operationId": "post-indicators-batchDelete", "description": "Batch delete indicators or add them to the [exclusion list](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.5/learn-about-cortex-xsoar/indicators/indicator-management/exclusion-list).\r\nTo *delete* indicators, set `doNotWhitelist` field to `true`.\r\nTo add indicators to the exclusion list, set `doNotWhitelist` field to `false`.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/genericIndicatorUpdateBatch" }, "examples": { "Delete two endpoints": { "value": { "doNotWhitelist": true, "ids": [ "b3655bd7aad56513fcdacbd4254ed6b7", "79a290670239a8b19fb119b375f5dfa3" ], "filter": {} } } } } } } }, "parameters": [] }, "/xsoar/public/v1/investigation/{investigation_id}/close": { "parameters": [ { "schema": { "type": "string" }, "name": "investigation_id", "in": "path", "required": true, "description": "Investigation ID" } ], "post": { "summary": "Close an investigation", "tags": [ "Investigations" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "type": { "type": "integer" }, "created": { "type": "string" }, "incidentCreationTime": { "type": "string" }, "investigationCreationTime": { "type": "string" }, "retryTime": { "type": "string" }, "user": { "type": "string" }, "errorSource": { "type": "string" }, "contents": { "type": "string" }, "format": { "type": "string" }, "investigationId": { "type": "string" }, "file": { "type": "string" }, "fileID": { "type": "string" }, "parentId": { "type": "string" }, "pinned": { "type": "boolean" }, "fileMetadata": { "type": "null" }, "parentContent": { "type": "null" }, "parentEntryTruncated": { "type": "boolean" }, "system": { "type": "string" }, "reputations": { "type": "null" }, "category": { "type": "string" }, "note": { "type": "boolean" }, "isTodo": { "type": "boolean" }, "tags": { "type": "null" }, "tagsRaw": { "type": "null" }, "startDate": { "type": "string" }, "times": { "type": "integer" }, "recurrent": { "type": "boolean" }, "endingDate": { "type": "string" }, "timezoneOffset": { "type": "integer" }, "cronView": { "type": "boolean" }, "scheduled": { "type": "boolean" }, "scheduledEntryGuid": { "type": "string" }, "entryTask": { "type": "null" }, "taskId": { "type": "string" }, "playbookId": { "type": "string" }, "reputationSize": { "type": "integer" }, "contentsSize": { "type": "integer" }, "InstanceID": { "type": "string" }, "IndicatorTimeline": { "type": "null" }, "Relationships": { "type": "null" }, "mirrored": { "type": "boolean" } }, "x-examples": { "Example 1": { "id": "reopen_inv_id@153461", "version": 0, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "type": 4, "created": "2024-04-14T10:23:34.402486009Z", "incidentCreationTime": "0001-01-01T00:00:00Z", "investigationCreationTime": "0001-01-01T00:00:00Z", "retryTime": "0001-01-01T00:00:00Z", "user": "", "errorSource": "", "contents": "153461", "format": "closedInv", "investigationId": "153461", "file": "", "fileID": "", "parentId": "", "pinned": false, "fileMetadata": null, "parentContent": null, "parentEntryTruncated": false, "system": "", "reputations": null, "category": "", "note": false, "isTodo": false, "tags": null, "tagsRaw": null, "startDate": "0001-01-01T00:00:00Z", "times": 0, "recurrent": false, "endingDate": "0001-01-01T00:00:00Z", "timezoneOffset": 0, "cronView": false, "scheduled": false, "scheduledEntryGuid": "", "entryTask": null, "taskId": "", "playbookId": "", "reputationSize": 0, "contentsSize": 0, "InstanceID": "", "IndicatorTimeline": null, "Relationships": null, "mirrored": false } } }, "examples": { "Example 1": { "value": { "id": "reopen_inv_id@153461", "version": 0, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "type": 4, "created": "2024-04-14T10:23:34.402486009Z", "incidentCreationTime": "0001-01-01T00:00:00Z", "investigationCreationTime": "0001-01-01T00:00:00Z", "retryTime": "0001-01-01T00:00:00Z", "user": "", "errorSource": "", "contents": "153461", "format": "closedInv", "investigationId": "153461", "file": "", "fileID": "", "parentId": "", "pinned": false, "fileMetadata": null, "parentContent": null, "parentEntryTruncated": false, "system": "", "reputations": null, "category": "", "note": false, "isTodo": false, "tags": null, "tagsRaw": null, "startDate": "0001-01-01T00:00:00Z", "times": 0, "recurrent": false, "endingDate": "0001-01-01T00:00:00Z", "timezoneOffset": 0, "cronView": false, "scheduled": false, "scheduledEntryGuid": "", "entryTask": null, "taskId": "", "playbookId": "", "reputationSize": 0, "contentsSize": 0, "InstanceID": "", "IndicatorTimeline": null, "Relationships": null, "mirrored": false } } } } } } }, "operationId": "post-investigation-incident_id-close", "description": "Close the specified investigation.", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "id": "153467", "closeNotes": "just text", "closeReason": "Resolved - Known Issue" } }, "properties": { "closeNotes": { "type": "string", "description": "Descriptive notes explaining why the investigation is closed." }, "closeReason": { "type": "string", "description": "Reason the investigation is closed." } } }, "examples": { "Example 1": { "value": { "closeNotes": "just text", "closeReason": "Resolved - Known Issue" } } } } } } } }, "/xsoar/public/v1/settings/integration/search": { "post": { "summary": "Get details on integration instances, engines, and health", "tags": [ "Integrations" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "configurations": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "sortValues": { "type": "array", "items": { "type": "string" } }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "propagationLabels": { "type": "array", "items": { "type": "object", "properties": {} } }, "packPropagationLabels": { "type": "array", "items": { "type": "string" } }, "definitionId": { "type": "string" }, "vcShouldIgnore": { "type": "boolean" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean" }, "commitMessage": { "type": "string" }, "shouldCommit": { "type": "boolean" }, "name": { "type": "string" }, "prevName": { "type": "string" }, "display": { "type": "string" }, "brand": { "type": "string" }, "category": { "type": "string" }, "icon": { "type": "string" }, "image": { "type": "string" }, "description": { "type": "string" }, "detailedDescription": { "type": "string" }, "configuration": { "type": "array", "items": { "type": "object", "properties": { "display": { "type": "string" }, "displayPassword": { "type": "string" }, "name": { "type": "string" }, "defaultValue": { "type": "string" }, "type": { "type": "integer" }, "required": { "type": "boolean" }, "hidden": { "type": "boolean" }, "hiddenUsername": { "type": "boolean" }, "hiddenPassword": { "type": "boolean" }, "options": { "type": [ "array", "null" ], "items": { "type": "string" } }, "info": { "type": "string" } } } }, "integrationScript": { "type": "object", "properties": { "script": { "type": "string" }, "type": { "type": "string" }, "commands": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "deprecated": { "type": "boolean" }, "arguments": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "required": { "type": "boolean" }, "deprecated": { "type": "boolean" }, "hidden": { "type": "boolean" }, "default": { "type": "boolean" }, "secret": { "type": "boolean" }, "description": { "type": "string" }, "defaultValue": { "type": "string" }, "type": { "type": "string" } } } }, "outputs": { "type": "null" }, "important": { "type": "null" }, "description": { "type": "string" }, "execution": { "type": "boolean" }, "cartesian": { "type": "boolean" }, "hidden": { "type": "boolean" }, "docsHidden": { "type": "boolean" }, "sensitive": { "type": "boolean" }, "timeout": { "type": "integer" }, "permitted": { "type": "boolean" }, "indicatorAction": { "type": "boolean" }, "definitionId": { "type": "string" }, "gomAction": { "type": "boolean" }, "polling": { "type": "boolean" } } } }, "dockerImage": { "type": "string" }, "nativeImage": { "type": "array", "items": { "type": "string" } }, "isFetch": { "type": "boolean" }, "isFetchEvents": { "type": "boolean" }, "isFetchAssets": { "type": "boolean" }, "feed": { "type": "boolean" }, "isFetchCredentials": { "type": "boolean" }, "runOnce": { "type": "boolean" }, "longRunning": { "type": "boolean" }, "longRunningPortMapping": { "type": "boolean" }, "subtype": { "type": "string" }, "isMappable": { "type": "boolean" }, "isRemoteSyncIn": { "type": "boolean" }, "isRemoteSyncOut": { "type": "boolean" }, "isFetchSamples": { "type": "boolean" }, "resetContext": { "type": "boolean" } } }, "system": { "type": "boolean" }, "hidden": { "type": "boolean" }, "canGetSamples": { "type": "boolean" } } } }, "engines": { "type": "object", "properties": { "engines": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "sortValues": { "type": "array", "items": { "type": "string" } }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "definitionId": { "type": "string" }, "prevName": { "type": "string" }, "name": { "type": "string" }, "allowOnTenant": { "type": "boolean" }, "locked": { "type": "boolean" }, "lastSeen": { "type": "string" }, "firstSeen": { "type": "string" }, "lastConnectedApp": { "type": "string" }, "lastDisconnect": { "type": "string" }, "serviceName": { "type": "string" }, "host": { "type": "string" }, "user": { "type": "string" }, "pkgType": { "type": "string" }, "pkgName": { "type": "string" }, "config": { "type": "string" }, "baseUrl": { "type": "string" }, "engineGroup": { "type": "string" }, "protocolVersion": { "type": "string" }, "os": { "type": "string" }, "demistoVersion": { "type": "string" }, "buildVersion": { "type": "string" }, "md5": { "type": "string" }, "underUpgrade": { "type": "boolean" }, "tenantNames": { "type": "null" }, "workers": { "type": "integer" }, "isDefault": { "type": "boolean" }, "isLegacy": { "type": "boolean" }, "packageFileHash": { "type": "string" }, "pyramidAPIEncryptedAuthenticationHeader": { "type": "string" }, "pyramidAPIEncryptedAuthenticationHeaderTenants": { "type": "null" }, "connected": { "type": "boolean" }, "modules": { "type": "null" } } } }, "total": { "type": "integer" }, "pkgTypes": { "type": "array", "items": { "type": "string" } }, "requestedLogs": { "type": "object", "properties": {} }, "engineGroups": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "health": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "sortValues": { "type": "array", "items": { "type": "string" } }, "brand": { "type": "string" }, "instance": { "type": "string" }, "incidentsPulled": { "type": "integer" }, "indicatorsPulled": { "type": "integer" }, "eventsPulled": { "type": "integer" }, "assetsPulled": { "type": "integer" }, "type": { "type": "integer" }, "incidentsDropped": { "type": "integer" }, "lastPullTime": { "type": "string" }, "lastError": { "type": "string" }, "lastIngestionDuration": { "type": "integer" }, "fetchDuration": { "type": "integer" }, "creation_time": { "type": "string" }, "sum_hour": { "type": "integer" }, "sum_day": { "type": "integer" }, "sum_week": { "type": "integer" } } }, "rocket_test_xsoar_long_running_integration_fetch_incidents_NbrfwigR": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "sortValues": { "type": "array", "items": { "type": "string" } }, "brand": { "type": "string" }, "instance": { "type": "string" }, "incidentsPulled": { "type": "integer" }, "indicatorsPulled": { "type": "integer" }, "eventsPulled": { "type": "integer" }, "assetsPulled": { "type": "integer" }, "type": { "type": "integer" }, "incidentsDropped": { "type": "integer" }, "lastPullTime": { "type": "string" }, "lastError": { "type": "string" }, "lastIngestionDuration": { "type": "integer" }, "fetchDuration": { "type": "integer" }, "creation_time": { "type": "string" }, "sum_hour": { "type": "integer" }, "sum_day": { "type": "integer" }, "sum_week": { "type": "integer" } } }, "instances": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "sortValues": { "type": "array", "items": { "type": "string" } }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "propagationLabels": { "type": "array", "items": { "type": "string" } }, "definitionId": { "type": "string" }, "prevName": { "type": "string" }, "password": { "type": "string" }, "enabled": { "type": "string" }, "name": { "type": "string" }, "configvalues": { "type": "object", "properties": { "create_relationships": { "type": "boolean" }, "feed": { "type": "boolean" }, "feedBypassExclusionList": { "type": "boolean" }, "feedFetchInterval": { "type": "string" }, "feedIncremental": { "type": "boolean" }, "feedReliability": { "type": "string" }, "url": { "type": "string" } } }, "configtypes": { "type": "object", "properties": { "create_relationships": { "type": "integer" }, "feed": { "type": "integer" }, "feedBypassExclusionList": { "type": "integer" }, "feedFetchInterval": { "type": "integer" }, "feedIncremental": { "type": "integer" }, "feedReliability": { "type": "integer" }, "url": { "type": "integer" } } }, "brand": { "type": "string" }, "category": { "type": "string" }, "path": { "type": "string" }, "executable": { "type": "string" }, "cmdline": { "type": "string" }, "engine": { "type": "string" }, "engineGroup": { "type": "string" }, "hidden": { "type": "boolean" }, "isIntegrationScript": { "type": "boolean" }, "islongRunning": { "type": "boolean" }, "mappingId": { "type": "string" }, "outgoingMapperId": { "type": "string" }, "incomingMapperId": { "type": "string" }, "remoteSync": { "type": "boolean" }, "isSystemIntegration": { "type": "boolean" }, "canSample": { "type": "boolean" }, "defaultIgnore": { "type": "boolean" }, "integrationLogLevel": { "type": "string" }, "commandsPermissions": { "type": "null" }, "longRunningId": { "type": "string" }, "incidentFetchInterval": { "type": "integer" }, "eventFetchInterval": { "type": "integer" }, "assetsFetchInterval": { "type": "integer" }, "servicesID": { "type": "string" }, "isBuiltin": { "type": "boolean" }, "hybrid": { "type": "boolean" }, "configuration": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "definitionId": { "type": "string" }, "vcShouldIgnore": { "type": "boolean" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean" }, "commitMessage": { "type": "string" }, "shouldCommit": { "type": "boolean" }, "name": { "type": "string" }, "prevName": { "type": "string" }, "display": { "type": "string" }, "brand": { "type": "string" }, "category": { "type": "string" }, "icon": { "type": "string" }, "description": { "type": "string" }, "configuration": { "type": "null" }, "integrationScript": { "type": "null" }, "hidden": { "type": "boolean" }, "canGetSamples": { "type": "boolean" } } }, "data": { "type": "array", "items": { "type": "object", "properties": { "display": { "type": "string" }, "displayPassword": { "type": "string" }, "name": { "type": "string" }, "defaultValue": { "type": "string" }, "type": { "type": "integer" }, "required": { "type": "boolean" }, "hidden": { "type": "boolean" }, "hiddenUsername": { "type": "boolean" }, "hiddenPassword": { "type": "boolean" }, "options": { "type": "null" }, "info": { "type": "string" }, "hasvalue": { "type": "boolean" }, "value": { "type": [ "boolean", "string" ] } } } }, "displayPassword": { "type": "string" }, "passwordProtected": { "type": "boolean" }, "mappable": { "type": "boolean" }, "remoteSyncableIn": { "type": "boolean" }, "remoteSyncableOut": { "type": "boolean" }, "isFetchSamples": { "type": "boolean" }, "debugMode": { "type": "boolean" } } } } }, "x-examples": { "Example 1": { "configurations": [ { "id": "abuse.ch SSL Blacklist Feed", "version": 11, "cacheVersn": 0, "sequenceNumber": 41346907, "primaryTerm": 12, "modified": "2024-02-20T19:52:27.504394267Z", "sizeInBytes": 36219, "sortValues": [ "moduleconfiguration_abuse.ch SSL Blacklist Feed" ], "packID": "Feedsslabusech", "packName": "Abuse.ch SSL Blacklist Feed", "itemVersion": "1.1.26", "fromServerVersion": "5.5.0", "toServerVersion": "", "propagationLabels": [], "packPropagationLabels": [ "all" ], "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "abuse.ch SSL Blacklist Feed", "prevName": "abuse.ch SSL Blacklist Feed", "display": "abuse.ch SSL Blacklist Feed", "brand": "", "category": "Data Enrichment & Threat Intelligence", "icon": "", "image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAA5fSURBVHgB7VsLWBzV9T9nZnYX2BkWEv6SKCAmhAWSJlH8V/NSqqk2KU8t1vroF9t+bW3t10f8avu1VfqwfmlrG236tb76iFpbMSbBRDTVim1tJCkhYiQQFhKJIYmBBNhlnzP39txdIAvskqVNLLbz47vM3Dv3nLkz53HvOXcWwIQJEyZMmDBhwsRZB8ZurpG0gqbVnEt3UIdFHHgGAsocQKf6EHDoIcpGxuD3Qx1bXxpPrRVUzkQOtzBkn6RjHnBUATmdYoD+DdJ5B916p86N9b4D246M0NkXlGdiEOsRuFXUdcO/yte54zCY+JehxGq0O99YC0y6DxFkUcdhPaD/Fjqk0UkaHYskic+g4xgBp8+pdoRY6GkS4lUkUxghHOaSRP+S6Pw8alimgNxOx0dHaLmhSIhGEV23hQcnW+1g4t/CBAGT9S0Bxr4Pw8IltAtrJas9zsOWhVkkqHyyZmcs89etobuQ86vCFc7JaHE3StjEGXMTrYP4ZBHtQrLSrLgOxMRZQwwL5mvpvdsip9DKmbXE46o9MbZPtZxSaCyycJYR3erIuSndYJ5PIQ4LTuLr3W11Xxt/h7TcyjSWzJeRDh0FE+cUEwXMofh0RVo/UbgCtYZ3P+wZ38qSPUXkiDNH6rZevMc9kRj6D23pp8N2OEdIcpZdJEvS3KHMgQZoaNDj9VMXVp3H/OzSFOR/7W2vc8NZQoazXPNyXOFwGw1Hj27zxutnLyi9RtGVzgHXlk44R5BitKmnT41UmAIYl5Ki6+6ZcD78B6AAXisx+GPG0dTkyfoZfp4rI2z3oZ4LZxF+A7MFX49DXjxZP/JgGw2Z3zhStxdUfEDLqygTi1w4S4jF6NjpEeD3U51VH4G8VTZIACiHjoPwAcOwAD6i5lUUQXW1DCbOCBLGbVyGX0DR00pCBCUlSvLciuzMzGvsk/AcB+QPRtWSObB6Vba6NGfFI/b8ylu1gtX58TTMkznURtL98ygrgBUowZtqS6BJc5avE9ppv6g8E0zEBEUQvwSD3QqtN+iJ9E912VIVBbq8abaV8fpMEJTbY3uCVr/bxtwYgFa88BkJ+UbglnbVuXePWlB2/QRB03wnhZTbae38ThSxRPPyIjr5Oq3L6yQr9pCyPKPNqcyH9wpFRVaYKgQNWcgZ+wnvVFxsgbOAwf3bOjyu516l98rGXqF4M+JFY4UdCnAprkufeOGdWp/7QF2ZAewzxPg1crjB8V0oxFmEXHpGLWi+Z8IguzZ1IBgXE90PqbSIWCnGPa8HhbeqzvIPwTmEj+FlWkHFq6ox7xAdX9cKK6rOREPz4E1aPtHo+Z3aUYfwXBvt81ZPmEvtudWzaPw/01oC+1VP1kHVWfGCOq+qMC5jEhD1eUB1Vv4KFsZ2qWph+Y1aftVPo5owxVn+KQpdd5EXFfdoUfMr7hZKReP6MbMnPTzcby21PyUKjFOCuJL3tj/3mLu9brlbM9JJSMtJS74ZEXiUwDjcGUtI7gPbet0Htn6LyiKuy7NIIVZR5PQLIug6PXSgdQg+kptbkgTnBg5ZoiQKg3rKnn2RxnqAzp8l4X1jMiIJ+IVkL3+l8a2luH8dTVmXS5LlpZS88otH+qQVVOZKtuB+ck3XcY5P0H3W0vM1o6zPjcVTyy/NSJVtdZT4KaV+P4WWHUOx+qEBC2npVzFSV51lYvHyEOUVdhPd5+g5HqBeF0BXl5Bbr8S5L0IIbpT4oChk/WMEfGYX1LTNS/HDaxAp60iLrieBPUZcU4lTCr2MK6n9lXjkns7N79LhBVHySIuPoW0dDeTLw5fn9lnVXDq2wdmHJ6TDCl/n1pFU52bNWamRkt2lzq369fC4JoDi9vui60kXrX7eYrE0SjLSlATNos1gcD8dgjRRLvEe2Noz3PWPsfiJkCkAWM+AZcnIlw60PXcQEgTNbh+hQ+Ng+9YvRDWHM39uaFqXmnXtDLAn3ULK+zAZ4+bI5boxPKa6HOee9q3PEMO9oy0MZiZK7HLVB5jiWzemEaWE6acIw67w/ugGnev3iTQrl/kHJqHDlMLrZouMnqOw9BJrst1N6bhj5Lkc4qJI0tBDV9Gbe9LbXtczCR/gTMoJcNxJTs8Chm3hQHviwo0wwFMiY+gorFg5I2/VlELWEUw93hILCsQZI1WyRs8UqAGZ7f+i64xJQ/BewYhkzhDZjHhdSLD3Ssxwcc7+YjB5JzOCPYh8/igLqz4LRKqO831wBtB9RFZwPhr4hdgJo8kRQssG8pLtjPEdIcV2UMsv36LNKV0+FR4xctHla0N+aZP/0Ja3ISqmFcjIIHfjke8msSwYbqIoyrJr5Lq9qHIxhnAOevmr7iNb+sbztjnLnRKHn48sA4h5rzqodcSTMJdRnjSGrq1l48c4GWQrS6VNFMqgxlZKtaDqSjI7MUd/x6PO+hE0nWIz5gbPDynw/CgPSfEbtAyhqSnlTPcjNfg2Z/BdrkCtbW75lYHOOhdMAf722oN+gOW00DrfYsASQ5Jq0IJ16UWli0+1butOhEeMVCX+xGLl6yz55QdJUbsYiskcxF+mH/kCBDZr9AE4vJw8YN8xkuNDnTvJov9AubBBmu/IHXFRPLTittJmIYVafBE9ddQKEh88fvzxuBaMTGpQ3wj64153ltW4aTEIiYLhFeJ/MGRpjX0/fRmNz2vouBGaHg6JtpOdcJhWp6NxaX/b4m7N2fwuMhCLyw2T3Y40z+1mwSs1xbrPKuMLKXNWFp/qemkApojhqWCTWljWRgq6j8YnPEqUgOPbQGwXLXaSEPNogNeQEG+i482ksStp1XtauLT8khXj03EElBoWJkAl9byFhHsDnS+l84hwedgEfuv5xOJ7YXJkkBVkxS1cmmxeSiPN+HokfqyR7M5y2sFCCt3wcf/BZ9+ORcARxT61nSx9SfjmtECiKOF2ctGLTveqYdTvB/R+qkTIMnt2qbBkdOR8ND2l8NrZE5jSuiNJCq0Q/lq3pGxPyy1JgwSRVnjdhcP8AUS0YaBQKp3brOG5fDApPL3RcIyVYU8XI+M4QcAipCGaejrtHX+NxCK0mkIIvkYODV093k1Q/PsylS+LzXxSiolJdg5i0bOJM/4h94Ett0HN+IBeeAWyeg6diRRSun6IBw5d5HmKyXoosbKng0KU12mA7TyJEi5x4Jk9uJmU8VWykscpzjxEq1/hUj9Gwtk1pp8eeJhL+CAp+T2eVJksuuIgS1Y6ZG77Uiy+J1qfPybZjGvp6eYb1tT1CSVQCDpjP/JoMs29FR2qzUEhJq6nsOwH7jc3RaIOUh6qb6B3fbv2RuCIKtlcyXnXZUXzmHRDVmgl2GzpXAnKBjL3UOv242HHnBBqpJTClkwFgioy1MHK+gfe3H4K3gOEPzpwgNXTXNubnFd2mSzLOTQXHhjq2LJ3TEeyCi0pLcd942LXqLLRy1ePpC4loc6ml9c+dPPilhlPtJwfTOFBT8vY0MpBu1YMpQW0KEuhqb3bPcuzO7x7lXmrXUt3XzDT39996FDD6BQj0rSSTXKMtDvyKufKEDhx0lU/KK6LeFlnRpLPVR/JBBaXpqhD+P+kcLPIAfiZBV8f2ld3fOzT1kjJeXsvky08R9JlT5ZF/lNra20QTJgwYcKECRMmTJgwYcKEiX8DRUXV8H7EWft6778d3aFg0fi2kpKaGB+sTC+YAk4QKMFl49t29bx1AeavTuiL0/8UEvs8c5oia0k1+PoAe9uf5uFfU9TUQMZTe8LpV85twNOt/GTjk5C2uBJQtsCpptrRPnd84hLe0ADwZs9byJMMkHUZSuYD333CDoMnB1EKRDaQ0owQd7nqR+9ZXV0NL74FGOh8hZK2/itssm2n4cjpDg10M5iGmLYWPLu49Ix93H2+q4MYbLlozprId11P7dECAM1+wKYABpv1/qGvCBdqeNk3dU8gssnw6FvJfo5ND2z8m6PxcHM20e8NBfQ2nxF8eUebN32g59QKqrsED1GOSPIHo+/5/P5AJmfB+63Zl18u6laDlydnXvIATFNMSwHXkJV5hqAst2RNZJ6DifOdqFOi/046Vfpsg5Hvgo2Q+InqeZLs/zAl6G+iXck74dJLxSetGh/ZhzZ84meO53GmoiLDzbR71sJTbAX2gdQysRnCmJFMG3D7M1lwaSYLLfV11+6OHhsPYTa5iBdnZmXsFPWgjHW0Zz5tv/WelgLe8FSzBkye39czsLyxtzm7uPiz0Nj9jxyYd3q+e+PtXRfSzJhLAvoq5+wO0WcEnCX/BCS2gdz230u0slA079EfxolzxhoY4BXgCzzpc7irhEKF6RGK30XLg1TuhctXjdlN97ZfvIcZkNt3dHCZzOGgrDAfbXHugGmKaTkHezkrsKKyn7Yol1t0zN4XeHe3xYqroK3+5+EOZMl6UcXHwYBnBz38L6qGD+0bOCw+WQ1/94QQvI/2ZpMNYDsa32nJkiUpyIHbhNv39clWHbmieLiRNC/pdfZ2WqE39cQHDeC/6js20Ck0ngS2V+eh7wleJVCiN0BD1OhqmKcDHho35EdhmmJaWjD50KIg8neQM78ctLxmkeCHIUMe/S4KF9xgJf+8Jsj8v4Ge57zUstEqWz8/fJk8s7JcB76CGB236Sc9sgR/p83/j3mG5DJm5V+VGO/q7d3qdveFrnZrxz9sIE8nOoOHwB3eIpcgW0bLclEau5ty4H2MaSlgewhekBlko5X9zmcbIoPiOwMdp39imer22mmyfSTgejH8EZuC/sdIPPvBqtL6id9PG/VZKDGbjFjef6ihf8B++BVkeDfxuYoh10PAwlkL2qQXyrGMaJeRv77L07l5H6DeyRk+Te35okhKWPgmzgW0gqtnOpyVN+TmrjlXv35IfCzOitvAxH8v3q8CNjNZCcJiBDeBCRMmTJgwYcKECRMm/gfwT1ET1leeYmK5AAAAAElFTkSuQmCC", "description": "The SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has seen in the past 30 days and identified as being associated with a malicious SSL certificate.", "detailedDescription": "sslipblacklist.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past 30 days being associated with a malicious SSL certificate.\n\nsslipblacklist_aggressive.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past being associated with a malicious SSL certificate. Warning - High FP Rate!\n\nsslblacklist.csv:\nThe SSL IP Blacklist contains SHA1 Fingerprint of all SSL certificates blacklisted on SSLBL. \nThe SSL Certificate Blacklist (CSV) gets generated every 5 minutes. Please do not fetch it more often than every 5 minutes.\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/abusech-ssl-blacklist-feed)", "configuration": [ { "display": "Services", "displayPassword": "", "name": "url", "defaultValue": "", "type": 16, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "https://sslbl.abuse.ch/blacklist/sslipblacklist.csv", "https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv", "https://sslbl.abuse.ch/blacklist/sslblacklist.csv" ], "info": "" }, { "display": "Fetch indicators", "displayPassword": "", "name": "feed", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Indicator Reputation", "displayPassword": "", "name": "feedReputation", "defaultValue": "Bad", "type": 18, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "None", "Good", "Suspicious", "Bad" ], "info": "Indicators from this integration instance will be marked with this reputation." }, { "display": "Source Reliability", "displayPassword": "", "name": "feedReliability", "defaultValue": "B - Usually reliable", "type": 15, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "A - Completely reliable", "B - Usually reliable", "C - Fairly reliable", "D - Not usually reliable", "E - Unreliable", "F - Reliability cannot be judged" ], "info": "Reliability of the source providing the intelligence data" }, { "display": "Traffic Light Protocol Color", "displayPassword": "", "name": "tlp_color", "defaultValue": "", "type": 15, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "RED", "AMBER", "GREEN", "WHITE" ], "info": "The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed" }, { "display": "", "displayPassword": "", "name": "feedExpirationPolicy", "defaultValue": "indicatorType", "type": 17, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "never", "interval", "indicatorType", "suddenDeath" ], "info": "" }, { "display": "", "displayPassword": "", "name": "feedExpirationInterval", "defaultValue": "20160", "type": 1, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Feed Fetch Interval", "displayPassword": "", "name": "feedFetchInterval", "defaultValue": "60", "type": 19, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Bypass exclusion list", "displayPassword": "", "name": "feedBypassExclusionList", "defaultValue": "", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system." }, { "display": "Request Timeout", "displayPassword": "", "name": "polling_timeout", "defaultValue": "20", "type": 0, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "Time in seconds before http requests timeout." }, { "display": "Trust any certificate (not secure)", "displayPassword": "", "name": "insecure", "defaultValue": "", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Use system proxy settings", "displayPassword": "", "name": "proxy", "defaultValue": "", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Tags", "displayPassword": "", "name": "feedTags", "defaultValue": "", "type": 0, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "Supports CSV values." } ], "integrationScript": { "script": "register_module_line('abuse.ch SSL Blacklist Feed', 'start', __line__())\n### pack version: 1.1.26\n\n\n\ndef main():\n feed_url_to_config = {\n 'https://sslbl.abuse.ch/blacklist/sslipblacklist.csv': {\n 'fieldnames': ['firstseenbysource', 'value', 'port'],\n 'indicator_type': FeedIndicatorType.IP,\n 'mapping': {\n 'firstseenbysource': 'firstseenbysource',\n 'port': 'port'\n }\n },\n 'https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv': {\n 'fieldnames': ['firstseenbysource', 'value', 'port'],\n 'indicator_type': FeedIndicatorType.IP,\n 'mapping': {\n 'firstseenbysource': 'firstseenbysource',\n 'port': 'port'\n }\n },\n 'https://sslbl.abuse.ch/blacklist/sslblacklist.csv': {\n 'fieldnames': ['Listingdate', 'value', 'Listingreason'],\n 'indicator_type': 'Certificate',\n 'mapping': {\n 'firstseenbysource': 'Listingdate',\n 'relationship_entity_b': 'Listingreason',\n 'Tags': 'Listingreason',\n },\n 'relationship_entity_b_type': FeedIndicatorType.Malware,\n 'relationship_name': EntityRelationship.Relationships.INDICATOR_OF,\n 'auto_detect_type': False,\n\n }\n }\n\n params = {k: v for k, v in demisto.params().items() if v is not None}\n params['feed_url_to_config'] = feed_url_to_config\n params['ignore_regex'] = r'^#'\n params['delimiter'] = ','\n params['create_relationships'] = True\n\n # Main execution of the CSV API Module.\n # This function allows to add to or override this execution.\n feed_main('SSL Blacklist Feed', params, 'sslbl')\n\n\n\n### GENERATED CODE ###: from CSVFeedApiModule import * # noqa: E402\n# This code was inserted in place of an API module.\nregister_module_line('CSVFeedApiModule', 'start', __line__(), wrapper=-3)\n\n\n\n\n''' IMPORTS '''\nimport csv\nimport gzip\nimport urllib3\nfrom typing import Optional, Pattern, Dict, Any, Tuple, Union, List\n\n# disable insecure warnings\nurllib3.disable_warnings()\n\n# Globals\nDATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ'\nTHRESHOLD_IN_SECONDS = 43200 # 12 hours in seconds\n\n\nclass Client(BaseClient):\n def __init__(self, url: str, feed_url_to_config: Optional[Dict[str, dict]] = None, fieldnames: str = '',\n insecure: bool = False, credentials: dict = None, ignore_regex: str = None, encoding: str = 'latin-1',\n delimiter: str = ',', doublequote: bool = True, escapechar: str = '',\n quotechar: str = '\"', skipinitialspace: bool = False, polling_timeout: int = 20, proxy: bool = False,\n feedTags: Optional[str] = None, tlp_color: Optional[str] = None, value_field: str = 'value', **kwargs):\n \"\"\"\n :param url: URL of the feed.\n :param feed_url_to_config: for each URL, a configuration of the feed that contains\n If *null* the values in the first row of the file are used as names. Default: *null*\n Example:\n feed_url_to_config = {\n 'https://ipstack.com':\n {\n 'fieldnames': ['value'],\n 'indicator_type': 'IP',\n 'mapping': {\n 'Date': 'date' / 'Date': ('date', r'(regex_string)', 'The date is {}')\n }\n }\n }\n For the mapping you can use either:\n 1. 'indicator_field': 'value_from_feed'\n 2. 'indicator_field': ('value_from_feed', regex_string_extractor, string_formatter)\n * regex_string_extractor will extract the first match from the value_from_feed,\n Use None to get the full value of the field.\n * string_formatter will format the data in your preferred way, Use None to get the extracted field.\n 3. 'indicator_field': ('value_from_feed', 'field_mapper_function')\n * field_mapper_function will accept as an argument 'value_from_feed' and return the data\n in your preferred way.\n :param fieldnames: list of field names in the file. If *null* the values in the first row of the file are\n used as names. Default: *null*\n :param insecure: boolean, if *false* feed HTTPS server certificate is verified. Default: *false*\n :param credentials: username and password used for basic authentication.\n Can be also used as API key header and value by specifying _header in the username field.\n :param ignore_regex: python regular expression for lines that should be ignored. Default: *null*\n :param encoding: Encoding of the feed, latin-1 by default.\n :param delimiter: see `csv Python module\n `. Default: ,\n :param doublequote: see `csv Python module\n `. Default: true\n :param escapechar: see `csv Python module\n `. Default null\n :param quotechar: see `csv Python module\n `. Default \"\n :param skipinitialspace: see `csv Python module\n `. Default False\n :param polling_timeout: timeout of the polling request in seconds. Default: 20\n :param proxy: Sets whether use proxy when sending requests\n :param tlp_color: Traffic Light Protocol color.\n \"\"\"\n self.tags: List[str] = argToList(feedTags)\n self.tlp_color = tlp_color\n self.value_field = value_field\n if not credentials:\n credentials = {}\n\n auth: Optional[tuple] = None\n self.headers = {}\n\n username = credentials.get('identifier', '')\n if username.startswith('_header:'):\n header_name = username.split(':')[1]\n header_value = credentials.get('password', '')\n self.headers[header_name] = header_value\n else:\n password = credentials.get('password', '')\n auth = None\n if username and password:\n auth = (username, password)\n\n super().__init__(base_url=url, proxy=proxy, verify=not insecure, auth=auth)\n\n try:\n self.polling_timeout = int(polling_timeout)\n except (ValueError, TypeError):\n return_error('Please provide an integer value for \"Request Timeout\"')\n self.encoding = encoding\n self.ignore_regex: Optional[Pattern] = None\n if ignore_regex is not None:\n self.ignore_regex = re.compile(ignore_regex)\n self.feed_url_to_config: Optional[Dict[str, dict]] = feed_url_to_config\n self.fieldnames = argToList(fieldnames)\n self.dialect: Dict[str, Any] = {\n 'delimiter': delimiter,\n 'doublequote': doublequote,\n 'escapechar': escapechar,\n 'quotechar': quotechar,\n 'skipinitialspace': skipinitialspace\n }\n\n def _build_request(self, url):\n r = requests.Request(\n 'GET',\n url,\n auth=self._auth\n )\n\n return r.prepare()\n\n def build_iterator(self, **kwargs):\n results = []\n urls = self._base_url\n if not isinstance(urls, list):\n urls = [urls]\n for url in urls:\n _session = requests.Session()\n\n prepreq = self._build_request(url)\n\n # this is to honour the proxy environment variables\n kwargs.update(_session.merge_environment_settings(\n prepreq.url,\n {}, None, None, None # defaults\n ))\n kwargs['stream'] = True\n kwargs['verify'] = self._verify\n kwargs['timeout'] = self.polling_timeout\n\n if is_demisto_version_ge('6.5.0'):\n # Set the If-None-Match and If-Modified-Since headers if we have etag or\n # last_modified values in the context.\n last_run = demisto.getLastRun()\n etag = last_run.get(url, {}).get('etag')\n last_modified = last_run.get(url, {}).get('last_modified')\n last_updated = last_run.get(url, {}).get('last_updated')\n # To avoid issues with indicators expiring, if 'last_updated' is over X hours old,\n # we'll refresh the indicators to ensure their expiration time is updated.\n # For further details, refer to : https://confluence-dc.paloaltonetworks.com/display/DemistoContent/Json+Api+Module # noqa: E501\n if last_updated and has_passed_time_threshold(timestamp_str=last_updated, seconds_threshold=THRESHOLD_IN_SECONDS):\n last_modified = None\n etag = None\n demisto.debug(\"Since it's been a long time with no update, to make sure we are keeping the indicators alive, \\\n we will refetch them from scratch\")\n\n if etag:\n self.headers['If-None-Match'] = etag\n\n if last_modified:\n self.headers['If-Modified-Since'] = last_modified\n\n # set request headers\n if 'headers' in kwargs:\n self.headers.update(kwargs['headers'])\n del kwargs['headers']\n\n if self.headers:\n prepreq.headers.update(self.headers)\n\n try:\n r = _session.send(prepreq, **kwargs)\n except requests.exceptions.ConnectTimeout as exception:\n err_msg = 'Connection Timeout Error - potential reasons might be that the Server URL parameter' \\\n ' is incorrect or that the Server is not accessible from your host.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.SSLError as exception:\n # in case the \"Trust any certificate\" is already checked\n if not self._verify:\n raise\n err_msg = 'SSL Certificate Verification Failed - try selecting \\'Trust any certificate\\' checkbox in' \\\n ' the integration configuration.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.ProxyError as exception:\n err_msg = 'Proxy Error - if the \\'Use system proxy\\' checkbox in the integration configuration is' \\\n ' selected, try clearing the checkbox.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.ConnectionError as exception:\n # Get originating Exception in Exception chain\n error_class = str(exception.__class__)\n err_type = '<' + error_class[error_class.find('\\'') + 1: error_class.rfind('\\'')] + '>'\n err_msg = 'Verify that the server URL parameter' \\\n ' is correct and that you have access to the server from your host.' \\\n '\nError Type: {}\nError Number: [{}]\nMessage: {}\n' \\\n .format(err_type, exception.errno, exception.strerror)\n raise DemistoException(err_msg, exception)\n try:\n r.raise_for_status()\n except Exception:\n return_error(f'Exception in request: {r.status_code} {r.content.decode(\"utf-8\")}')\n raise\n\n response = self.get_feed_content_divided_to_lines(url, r)\n if self.feed_url_to_config:\n fieldnames = self.feed_url_to_config.get(url, {}).get('fieldnames', [])\n skip_first_line = self.feed_url_to_config.get(url, {}).get('skip_first_line', False)\n else:\n fieldnames = self.fieldnames\n skip_first_line = False\n if self.ignore_regex is not None:\n response = filter( # type: ignore\n lambda x: self.ignore_regex.match(x) is None, # type: ignore\n response\n )\n\n csvreader = csv.DictReader(\n response,\n fieldnames=fieldnames,\n **self.dialect\n )\n\n if skip_first_line:\n next(csvreader)\n no_update = get_no_update_value(r, url) if is_demisto_version_ge('6.5.0') else True\n results.append({url: {'result': csvreader, 'no_update': no_update}})\n\n return results\n\n def get_feed_content_divided_to_lines(self, url, raw_response):\n \"\"\"Fetch feed data and divides its content to lines\n\n Args:\n url: Current feed's url.\n raw_response: The raw response from the feed's url.\n\n Returns:\n List. List of lines from the feed content.\n \"\"\"\n if self.feed_url_to_config and self.feed_url_to_config.get(url).get('is_zipped_file'): # type: ignore\n response_content = gzip.decompress(raw_response.content)\n else:\n response_content = raw_response.content\n\n return response_content.decode(self.encoding).split('\n')\n\n\ndef get_no_update_value(response: requests.models.Response, url: str) -> bool:\n \"\"\"\n detect if the feed response has been modified according to the headers etag and last_modified.\n For more information, see this:\n https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Last-Modified\n https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag\n Args:\n response: (requests.Response) The feed response.\n url: (str) The feed URL (service).\n Returns:\n boolean with the value for noUpdate argument.\n The value should be False if the response was modified.\n \"\"\"\n if response.status_code == 304:\n demisto.debug('No new indicators fetched, createIndicators will be executed with noUpdate=True.')\n return True\n\n etag = response.headers.get('ETag')\n last_modified = response.headers.get('Last-Modified')\n current_time = datetime.utcnow()\n # Save the current time as the last updated time. This will be used to indicate the last time the feed was updated in XSOAR.\n last_updated = current_time.strftime(DATE_FORMAT)\n\n if not etag and not last_modified:\n demisto.debug('Last-Modified and Etag headers are not exists,'\n 'createIndicators will be executed with noUpdate=False.')\n return False\n\n last_run = demisto.getLastRun()\n last_run[url] = {'last_modified': last_modified, 'etag': etag, 'last_updated': last_updated}\n demisto.setLastRun(last_run)\n\n demisto.debug('New indicators fetched - the Last-Modified value has been updated,'\n ' createIndicators will be executed with noUpdate=False.')\n return False\n\n\ndef determine_indicator_type(indicator_type, default_indicator_type, auto_detect, value):\n \"\"\"\n Detect the indicator type of the given value.\n Args:\n indicator_type: (str) Indicator type given in the config.\n default_indicator_type: Indicator type which was inserted as a param of the integration by user.\n auto_detect: (bool) True whether auto detection of the indicator type is wanted.\n value: (str) The value which we'd like to get indicator type of.\n Returns:\n Str which stands for the indicator type after detection.\n \"\"\"\n if auto_detect:\n indicator_type = auto_detect_indicator_type(value)\n if not indicator_type:\n indicator_type = default_indicator_type\n return indicator_type\n\n\ndef module_test_command(client: Client, args):\n client.build_iterator()\n return 'ok', {}, {}\n\n\ndef date_format_parsing(date_string):\n \"\"\"\n formats a datestring to the ISO-8601 format which the server expects to recieve\n :param date_string: Date represented as a tring\n :return: ISO-8601 date string\n \"\"\"\n formatted_date = dateparser.parse(date_string, settings={'TIMEZONE': 'UTC'})\n assert formatted_date is not None, f\"failed parsing {date_string}\"\n return formatted_date.strftime(DATE_FORMAT)\n\n\ndef create_fields_mapping(raw_json: Dict[str, Any], mapping: Dict[str, Union[Tuple, str]]):\n fields_mapping = {} # type: dict\n\n for key, field in mapping.items():\n regex_extractor = None\n formatter_string = None\n field_mapper_function = None\n\n # case 'value_from_feed', regex_string_extractor, string_formatter\n if isinstance(field, tuple) and len(field) == 3:\n field, regex_extractor, formatter_string = field\n\n # case 'value_from_feed', 'field_mapper_function'\n elif isinstance(field, tuple) and len(field) == 2:\n field, field_mapper_function = field\n\n if not raw_json.get(field): # type: ignore\n continue\n\n if not regex_extractor:\n field_value = raw_json[field] # type: ignore\n else:\n try:\n field_value = re.match(regex_extractor, raw_json[field]).group(1) # type: ignore\n except Exception:\n field_value = raw_json[field] # type: ignore\n\n field_value = formatter_string.format(field_value) if formatter_string else field_value\n field_value = field_mapper_function(field_value) if field_mapper_function else field_value\n fields_mapping[key] = field_value\n\n if key in ['firstseenbysource', 'lastseenbysource']:\n fields_mapping[key] = date_format_parsing(fields_mapping[key])\n\n return fields_mapping\n\n\ndef fetch_indicators_command(client: Client, default_indicator_type: str, auto_detect: bool, limit: int = 0,\n create_relationships: bool = False, **kwargs):\n iterator = client.build_iterator(**kwargs)\n relationships_of_indicator = []\n indicators = []\n config = client.feed_url_to_config or {}\n\n # set noUpdate flag in createIndicators command True only when all the results from all the urls are True.\n no_update = all(next(iter(item.values())).get('no_update', False) for item in iterator)\n\n for url_to_reader in iterator:\n for url, reader in url_to_reader.items():\n mapping = config.get(url, {}).get('mapping', {})\n for item in reader.get('result', []):\n raw_json = dict(item)\n fields_mapping = create_fields_mapping(raw_json, mapping) if mapping else {}\n value = item.get(client.value_field) or fields_mapping.get('Value')\n if not value and len(item) > 1:\n value = next(iter(item.values()))\n if value:\n raw_json['value'] = value\n conf_indicator_type = config.get(url, {}).get('indicator_type')\n indicator_type = determine_indicator_type(conf_indicator_type, default_indicator_type, auto_detect,\n value)\n raw_json['type'] = indicator_type\n # if relationships param is True and also the url returns relationships\n if create_relationships and config.get(url, {}).get('relationship_name'):\n if fields_mapping.get('relationship_entity_b'):\n relationships_lst = EntityRelationship(\n name=config.get(url, {}).get('relationship_name'),\n entity_a=value,\n entity_a_type=indicator_type,\n entity_b=fields_mapping.get('relationship_entity_b'),\n entity_b_type=FeedIndicatorType.indicator_type_by_server_version(\n config.get(url, {}).get('relationship_entity_b_type')),\n )\n relationships_of_indicator = [relationships_lst.to_indicator()]\n\n indicator = {\n 'value': value,\n 'type': indicator_type,\n 'rawJSON': raw_json,\n 'fields': fields_mapping,\n 'relationships': relationships_of_indicator,\n }\n indicator['fields']['tags'] = client.tags\n\n if client.tlp_color:\n indicator['fields']['trafficlightprotocol'] = client.tlp_color\n\n indicators.append(indicator)\n # exit the loop if we have more indicators than the limit\n if limit and len(indicators) >= limit:\n return indicators, no_update\n\n return indicators, no_update\n\n\ndef get_indicators_command(client, args: dict, tags: Optional[List[str]] = None):\n if tags is None:\n tags = []\n itype = args.get('indicator_type', demisto.params().get('indicator_type'))\n try:\n limit = int(args.get('limit', 50))\n except ValueError:\n raise ValueError('The limit argument must be a number.')\n auto_detect = demisto.params().get('auto_detect_type')\n relationships = demisto.params().get('create_relationships', False)\n indicators_list, _ = fetch_indicators_command(client, itype, auto_detect, limit, relationships)\n entry_result = indicators_list[:limit]\n hr = tableToMarkdown('Indicators', entry_result, headers=['value', 'type', 'fields'])\n return hr, {}, indicators_list\n\n\ndef feed_main(feed_name, params=None, prefix=''): # pragma: no cover\n if not params:\n params = {k: v for k, v in demisto.params().items() if v is not None}\n handle_proxy()\n client = Client(**params)\n command = demisto.command()\n if command != 'fetch-indicators':\n demisto.info('Command being called is {}'.format(command))\n if prefix and not prefix.endswith('-'):\n prefix += '-'\n # Switch case\n commands: dict = {\n 'test-module': module_test_command,\n f'{prefix}get-indicators': get_indicators_command\n }\n try:\n if command == 'fetch-indicators':\n indicators, no_update = fetch_indicators_command(\n client,\n params.get('indicator_type'),\n params.get('auto_detect_type'),\n params.get('limit'),\n params.get('create_relationships')\n )\n\n # check if the version is higher than 6.5.0 so we can use noUpdate parameter\n if is_demisto_version_ge('6.5.0'):\n if not indicators:\n demisto.createIndicators(indicators, noUpdate=no_update) # type: ignore\n else:\n # we submit the indicators in batches\n for b in batch(indicators, batch_size=2000):\n demisto.createIndicators(b, noUpdate=no_update) # type: ignore\n else:\n # call createIndicators without noUpdate arg\n if not indicators:\n demisto.createIndicators(indicators) # type: ignore\n else:\n for b in batch(indicators, batch_size=2000): # type: ignore\n demisto.createIndicators(b)\n\n else:\n args = demisto.args()\n args['feed_name'] = feed_name\n readable_output, outputs, raw_response = commands[command](client, args)\n return_outputs(readable_output, outputs, raw_response)\n except Exception as e:\n err_msg = f'Error in {feed_name} Integration - Encountered an issue with createIndicators' if \\\n 'failed to create' in str(e) else f'Error in {feed_name} Integration [{e}]'\n return_error(err_msg)\n\nregister_module_line('CSVFeedApiModule', 'end', __line__(), wrapper=1)\n### END GENERATED CODE ###\n\nif __name__ == '__builtin__' or __name__ == 'builtins':\n main()\n\nregister_module_line('abuse.ch SSL Blacklist Feed', 'end', __line__())\n", "type": "python", "commands": [ { "name": "sslbl-get-indicators", "deprecated": false, "arguments": [ { "name": "limit", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "The maximum number of results to return. The default value is 50.", "defaultValue": "50", "type": "" }, { "name": "indicator_type", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "The indicator type.", "type": "" } ], "outputs": null, "important": null, "description": "Gets the feed indicators.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false } ], "dockerImage": "demisto/python3:3.10.13.86272", "nativeImage": [ "8.3", "8.4" ], "isFetch": false, "isFetchEvents": false, "isFetchAssets": false, "feed": true, "isFetchCredentials": false, "runOnce": false, "longRunning": false, "longRunningPortMapping": false, "subtype": "python3", "isMappable": false, "isRemoteSyncIn": false, "isRemoteSyncOut": false, "isFetchSamples": false, "resetContext": false }, "system": true, "hidden": false, "canGetSamples": true } ], "engines": { "engines": [ { "id": "6b1d6700-ee17-4af9-b071-d7fc642ea441", "version": 81, "cacheVersn": 0, "sequenceNumber": 47683350, "primaryTerm": 12, "modified": "2024-04-04T16:17:45.602959424Z", "sizeInBytes": 1530, "sortValues": [ "120227" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "name": "rocket_test_create_new_engine_engine_rpm_OaOx5RSd", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "rocket-auto-instance-admin@panw.com", "pkgType": "rpm", "pkgName": "/var/lib/demisto/downloads/x86_64/d1_rocket_test_create_new_engine_engine_rpm_OaOx5RSd-8.6_933863-1.x86_64.rpm", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "buildVersion": "21874e0e41eb2c5ce7653f6dcc07621d992f927c", "md5": "3192ca98dab68bebb124f99cbf5bb994", "underUpgrade": false, "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "76641c64c3dbbe9f8272fdc193942fb8b8647e00183d95c69b2e8b80eb43b714", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}XIoRrYJ+aA1QCktuBTDQWfXmZnNB3KtbdMYTp+XgX+fVdYU3LbeIxO+oztktxJR7h2coO27MIkU9YIamIsR3LoUjydrlJVI0x9wO/JcK7fKdnyPqR3HRY/kpf5oOMYu0IQcsaSBAfb3Ky9z8z/4PyQlkJEcrDkvunHAtueOcNJmfqucQQiuMeHfj2PcMEdTqa/ZLJsRvtvoHDEC2sc1u5W/MGKKBdSGmkDXRQhgsL8bVOJVHjaayce8j22PpawKYmHUH4SeUjQnvZluiR2isS7z16TQNHW/UWNXzlqt8TTk=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "b6b7b03e-632b-4c05-a087-23f68affd5d3", "version": 7, "cacheVersn": 0, "sequenceNumber": 47683375, "primaryTerm": 12, "modified": "2024-04-04T16:18:46.830805002Z", "sizeInBytes": 1519, "sortValues": [ "120228" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "name": "rocket_test_create_new_engine_engine_shell_pzv9a3Y3", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "rocket-auto-instance-admin@panw.com", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-rocket_test_create_new_engine_engine_shell_pzv9a3Y3-8.6-933863.sh", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "buildVersion": "21874e0e41eb2c5ce7653f6dcc07621d992f927c", "md5": "8ffbd7cc23e270f792d8afd738814818", "underUpgrade": false, "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "2afc44aac1dba5079bd963128de62b310454b4bd294bf1c9be1a6bfb9b32afa5", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}5w75Hmog7B4MPk6l/EkHNwILAOTnznRkUIb5dugxM2Ozw4vjPlj3B/STZundq8DYWl4NashmaYzZ7IUgy7ilbz0hT/LkFGJzM19RiRyGI4vudzkdNNSwb0qba2eZNVywS4nidmyKWUGXo+LIUJnBJYh8FyL3zDymBsMk8IHyPmejazDJ0ieVMRr8P8ztWNiD3wSEwJquX7tS9K/U8LnbBuwKGfx2VnY4nYpy1h0FiLFUaItLF+XJtgWDabFvgQhyUcF0Iz1YGM1ejTbT1pyCahHkVCVezqDASoJHda30nDA=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null } ], "total": 2, "pkgTypes": [ "shell", "zip", "deb", "rpm", "conf" ], "requestedLogs": {}, "engineGroups": [] }, "health": { "id": "Rocket Incident Generator.rocket_test_xsoar_long_running_integration_fetch_incidents_AI6tPtxq", "version": 1, "cacheVersn": 0, "sequenceNumber": 1390272, "primaryTerm": 2, "modified": "2022-11-29T09:10:37.116147451Z", "sizeInBytes": 0, "sortValues": [ "2912" ], "brand": "Rocket Incident Generator", "instance": "rocket_test_xsoar_long_running_integration_fetch_incidents_AI6tPtxq", "incidentsPulled": 0, "indicatorsPulled": 0, "eventsPulled": 0, "assetsPulled": 0, "type": 0, "incidentsDropped": 0, "lastPullTime": "2022-11-29T09:05:26.273935902Z", "lastError": "Script failed to run: \nTimeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)", "lastIngestionDuration": 0, "fetchDuration": 0, "creation_time": "0001-01-01T00:00:00Z", "sum_hour": 0, "sum_day": 0, "sum_week": 0 }, "rocket_test_xsoar_long_running_integration_fetch_incidents_NbrfwigR": { "id": "Rocket Incident Generator.rocket_test_xsoar_long_running_integration_fetch_incidents_NbrfwigR", "version": 1, "cacheVersn": 0, "sequenceNumber": 1680557, "primaryTerm": 2, "modified": "2022-12-03T15:30:44.971255467Z", "sizeInBytes": 0, "sortValues": [ "3035" ], "brand": "Rocket Incident Generator", "instance": "rocket_test_xsoar_long_running_integration_fetch_incidents_NbrfwigR", "incidentsPulled": 0, "indicatorsPulled": 0, "eventsPulled": 0, "assetsPulled": 0, "type": 0, "incidentsDropped": 0, "lastPullTime": "2022-12-03T15:25:34.220297587Z", "lastError": "Script failed to run: \nTimeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)", "lastIngestionDuration": 0, "fetchDuration": 0, "creation_time": "0001-01-01T00:00:00Z", "sum_hour": 0, "sum_day": 0, "sum_week": 0 }, "instances": [ { "id": "e227fc24-5e1d-4165-87b8-949f71030b22", "version": 74, "cacheVersn": 0, "sequenceNumber": 39320671, "primaryTerm": 12, "modified": "2024-02-05T14:05:11.127323408Z", "sizeInBytes": 1314, "sortValues": [ "79580" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "all" ], "definitionId": "", "prevName": "", "password": "", "enabled": "true", "name": "AutoFocusTagsFeed_default_instance", "configvalues": { "create_relationships": true, "feed": true, "feedBypassExclusionList": true, "feedFetchInterval": "10", "feedIncremental": true, "feedReliability": "A - Completely reliable", "url": "https://autofocus.paloaltonetworks.com/api/v1.0/" }, "configtypes": { "create_relationships": 8, "feed": 8, "feedBypassExclusionList": 8, "feedFetchInterval": 19, "feedIncremental": 8, "feedReliability": 15, "url": 0 }, "brand": "AutoFocusTagsFeed", "category": "", "path": "", "executable": "", "cmdline": "", "engine": "", "engineGroup": "", "hidden": false, "isIntegrationScript": true, "islongRunning": false, "mappingId": "", "outgoingMapperId": "", "incomingMapperId": "", "remoteSync": false, "isSystemIntegration": true, "canSample": false, "defaultIgnore": false, "integrationLogLevel": "", "commandsPermissions": null, "longRunningId": "", "incidentFetchInterval": 0, "eventFetchInterval": 0, "assetsFetchInterval": 0, "servicesID": "main", "isBuiltin": false, "hybrid": false, "configuration": { "id": "", "version": 0, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "", "prevName": "", "display": "", "brand": "", "category": "", "icon": "", "description": "", "configuration": null, "integrationScript": null, "hidden": false, "canGetSamples": false }, "data": [ { "display": "Create relationships", "displayPassword": "", "name": "create_relationships", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": true }, { "display": "Fetch indicators", "displayPassword": "", "name": "feed", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": true }, { "display": "Bypass exclusion list", "displayPassword": "", "name": "feedBypassExclusionList", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.", "hasvalue": true, "value": true }, { "display": "Feed Fetch Interval", "displayPassword": "", "name": "feedFetchInterval", "defaultValue": "10", "type": 19, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": "10" }, { "display": "Incremental Feed", "displayPassword": "", "name": "feedIncremental", "defaultValue": "true", "type": 8, "required": false, "hidden": true, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.", "hasvalue": true, "value": true }, { "display": "Source Reliability", "displayPassword": "", "name": "feedReliability", "defaultValue": "A - Completely reliable", "type": 15, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "A - Completely reliable", "B - Usually reliable", "C - Fairly reliable", "D - Not usually reliable", "E - Unreliable", "F - Reliability cannot be judged" ], "info": "Reliability of the source providing the intelligence data.", "hasvalue": true, "value": "A - Completely reliable" }, { "display": "AutoFocus Endpoint URL", "displayPassword": "", "name": "url", "defaultValue": "https://autofocus.paloaltonetworks.com/api/v1.0/", "type": 0, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": "https://autofocus.paloaltonetworks.com/api/v1.0/" } ], "displayPassword": "", "passwordProtected": false, "mappable": false, "remoteSyncableIn": false, "remoteSyncableOut": false, "isFetchSamples": false, "debugMode": false } ] } } }, "examples": { "Example 1": { "value": { "configurations": [ { "id": "abuse.ch SSL Blacklist Feed", "version": 11, "cacheVersn": 0, "sequenceNumber": 41346907, "primaryTerm": 12, "modified": "2024-02-20T19:52:27.504394267Z", "sizeInBytes": 36219, "sortValues": [ "moduleconfiguration_abuse.ch SSL Blacklist Feed" ], "packID": "Feedsslabusech", "packName": "Abuse.ch SSL Blacklist Feed", "itemVersion": "1.1.26", "fromServerVersion": "5.5.0", "toServerVersion": "", "propagationLabels": [], "packPropagationLabels": [ "all" ], "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "abuse.ch SSL Blacklist Feed", "prevName": "abuse.ch SSL Blacklist Feed", "display": "abuse.ch SSL Blacklist Feed", "brand": "", "category": "Data Enrichment & Threat Intelligence", "icon": "", "image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAA5fSURBVHgB7VsLWBzV9T9nZnYX2BkWEv6SKCAmhAWSJlH8V/NSqqk2KU8t1vroF9t+bW3t10f8avu1VfqwfmlrG236tb76iFpbMSbBRDTVim1tJCkhYiQQFhKJIYmBBNhlnzP39txdIAvskqVNLLbz47vM3Dv3nLkz53HvOXcWwIQJEyZMmDBhwsRZB8ZurpG0gqbVnEt3UIdFHHgGAsocQKf6EHDoIcpGxuD3Qx1bXxpPrRVUzkQOtzBkn6RjHnBUATmdYoD+DdJ5B916p86N9b4D246M0NkXlGdiEOsRuFXUdcO/yte54zCY+JehxGq0O99YC0y6DxFkUcdhPaD/Fjqk0UkaHYskic+g4xgBp8+pdoRY6GkS4lUkUxghHOaSRP+S6Pw8alimgNxOx0dHaLmhSIhGEV23hQcnW+1g4t/CBAGT9S0Bxr4Pw8IltAtrJas9zsOWhVkkqHyyZmcs89etobuQ86vCFc7JaHE3StjEGXMTrYP4ZBHtQrLSrLgOxMRZQwwL5mvpvdsip9DKmbXE46o9MbZPtZxSaCyycJYR3erIuSndYJ5PIQ4LTuLr3W11Xxt/h7TcyjSWzJeRDh0FE+cUEwXMofh0RVo/UbgCtYZ3P+wZ38qSPUXkiDNH6rZevMc9kRj6D23pp8N2OEdIcpZdJEvS3KHMgQZoaNDj9VMXVp3H/OzSFOR/7W2vc8NZQoazXPNyXOFwGw1Hj27zxutnLyi9RtGVzgHXlk44R5BitKmnT41UmAIYl5Ki6+6ZcD78B6AAXisx+GPG0dTkyfoZfp4rI2z3oZ4LZxF+A7MFX49DXjxZP/JgGw2Z3zhStxdUfEDLqygTi1w4S4jF6NjpEeD3U51VH4G8VTZIACiHjoPwAcOwAD6i5lUUQXW1DCbOCBLGbVyGX0DR00pCBCUlSvLciuzMzGvsk/AcB+QPRtWSObB6Vba6NGfFI/b8ylu1gtX58TTMkznURtL98ygrgBUowZtqS6BJc5avE9ppv6g8E0zEBEUQvwSD3QqtN+iJ9E912VIVBbq8abaV8fpMEJTbY3uCVr/bxtwYgFa88BkJ+UbglnbVuXePWlB2/QRB03wnhZTbae38ThSxRPPyIjr5Oq3L6yQr9pCyPKPNqcyH9wpFRVaYKgQNWcgZ+wnvVFxsgbOAwf3bOjyu516l98rGXqF4M+JFY4UdCnAprkufeOGdWp/7QF2ZAewzxPg1crjB8V0oxFmEXHpGLWi+Z8IguzZ1IBgXE90PqbSIWCnGPa8HhbeqzvIPwTmEj+FlWkHFq6ox7xAdX9cKK6rOREPz4E1aPtHo+Z3aUYfwXBvt81ZPmEvtudWzaPw/01oC+1VP1kHVWfGCOq+qMC5jEhD1eUB1Vv4KFsZ2qWph+Y1aftVPo5owxVn+KQpdd5EXFfdoUfMr7hZKReP6MbMnPTzcby21PyUKjFOCuJL3tj/3mLu9brlbM9JJSMtJS74ZEXiUwDjcGUtI7gPbet0Htn6LyiKuy7NIIVZR5PQLIug6PXSgdQg+kptbkgTnBg5ZoiQKg3rKnn2RxnqAzp8l4X1jMiIJ+IVkL3+l8a2luH8dTVmXS5LlpZS88otH+qQVVOZKtuB+ck3XcY5P0H3W0vM1o6zPjcVTyy/NSJVtdZT4KaV+P4WWHUOx+qEBC2npVzFSV51lYvHyEOUVdhPd5+g5HqBeF0BXl5Bbr8S5L0IIbpT4oChk/WMEfGYX1LTNS/HDaxAp60iLrieBPUZcU4lTCr2MK6n9lXjkns7N79LhBVHySIuPoW0dDeTLw5fn9lnVXDq2wdmHJ6TDCl/n1pFU52bNWamRkt2lzq369fC4JoDi9vui60kXrX7eYrE0SjLSlATNos1gcD8dgjRRLvEe2Noz3PWPsfiJkCkAWM+AZcnIlw60PXcQEgTNbh+hQ+Ng+9YvRDWHM39uaFqXmnXtDLAn3ULK+zAZ4+bI5boxPKa6HOee9q3PEMO9oy0MZiZK7HLVB5jiWzemEaWE6acIw67w/ugGnev3iTQrl/kHJqHDlMLrZouMnqOw9BJrst1N6bhj5Lkc4qJI0tBDV9Gbe9LbXtczCR/gTMoJcNxJTs8Chm3hQHviwo0wwFMiY+gorFg5I2/VlELWEUw93hILCsQZI1WyRs8UqAGZ7f+i64xJQ/BewYhkzhDZjHhdSLD3Ssxwcc7+YjB5JzOCPYh8/igLqz4LRKqO831wBtB9RFZwPhr4hdgJo8kRQssG8pLtjPEdIcV2UMsv36LNKV0+FR4xctHla0N+aZP/0Ja3ISqmFcjIIHfjke8msSwYbqIoyrJr5Lq9qHIxhnAOevmr7iNb+sbztjnLnRKHn48sA4h5rzqodcSTMJdRnjSGrq1l48c4GWQrS6VNFMqgxlZKtaDqSjI7MUd/x6PO+hE0nWIz5gbPDynw/CgPSfEbtAyhqSnlTPcjNfg2Z/BdrkCtbW75lYHOOhdMAf722oN+gOW00DrfYsASQ5Jq0IJ16UWli0+1butOhEeMVCX+xGLl6yz55QdJUbsYiskcxF+mH/kCBDZr9AE4vJw8YN8xkuNDnTvJov9AubBBmu/IHXFRPLTittJmIYVafBE9ddQKEh88fvzxuBaMTGpQ3wj64153ltW4aTEIiYLhFeJ/MGRpjX0/fRmNz2vouBGaHg6JtpOdcJhWp6NxaX/b4m7N2fwuMhCLyw2T3Y40z+1mwSs1xbrPKuMLKXNWFp/qemkApojhqWCTWljWRgq6j8YnPEqUgOPbQGwXLXaSEPNogNeQEG+i482ksStp1XtauLT8khXj03EElBoWJkAl9byFhHsDnS+l84hwedgEfuv5xOJ7YXJkkBVkxS1cmmxeSiPN+HokfqyR7M5y2sFCCt3wcf/BZ9+ORcARxT61nSx9SfjmtECiKOF2ctGLTveqYdTvB/R+qkTIMnt2qbBkdOR8ND2l8NrZE5jSuiNJCq0Q/lq3pGxPyy1JgwSRVnjdhcP8AUS0YaBQKp3brOG5fDApPL3RcIyVYU8XI+M4QcAipCGaejrtHX+NxCK0mkIIvkYODV093k1Q/PsylS+LzXxSiolJdg5i0bOJM/4h94Ett0HN+IBeeAWyeg6diRRSun6IBw5d5HmKyXoosbKng0KU12mA7TyJEi5x4Jk9uJmU8VWykscpzjxEq1/hUj9Gwtk1pp8eeJhL+CAp+T2eVJksuuIgS1Y6ZG77Uiy+J1qfPybZjGvp6eYb1tT1CSVQCDpjP/JoMs29FR2qzUEhJq6nsOwH7jc3RaIOUh6qb6B3fbv2RuCIKtlcyXnXZUXzmHRDVmgl2GzpXAnKBjL3UOv242HHnBBqpJTClkwFgioy1MHK+gfe3H4K3gOEPzpwgNXTXNubnFd2mSzLOTQXHhjq2LJ3TEeyCi0pLcd942LXqLLRy1ePpC4loc6ml9c+dPPilhlPtJwfTOFBT8vY0MpBu1YMpQW0KEuhqb3bPcuzO7x7lXmrXUt3XzDT39996FDD6BQj0rSSTXKMtDvyKufKEDhx0lU/KK6LeFlnRpLPVR/JBBaXpqhD+P+kcLPIAfiZBV8f2ld3fOzT1kjJeXsvky08R9JlT5ZF/lNra20QTJgwYcKECRMmTJgwYcKEiX8DRUXV8H7EWft6778d3aFg0fi2kpKaGB+sTC+YAk4QKMFl49t29bx1AeavTuiL0/8UEvs8c5oia0k1+PoAe9uf5uFfU9TUQMZTe8LpV85twNOt/GTjk5C2uBJQtsCpptrRPnd84hLe0ADwZs9byJMMkHUZSuYD333CDoMnB1EKRDaQ0owQd7nqR+9ZXV0NL74FGOh8hZK2/itssm2n4cjpDg10M5iGmLYWPLu49Ix93H2+q4MYbLlozprId11P7dECAM1+wKYABpv1/qGvCBdqeNk3dU8gssnw6FvJfo5ND2z8m6PxcHM20e8NBfQ2nxF8eUebN32g59QKqrsED1GOSPIHo+/5/P5AJmfB+63Zl18u6laDlydnXvIATFNMSwHXkJV5hqAst2RNZJ6DifOdqFOi/046Vfpsg5Hvgo2Q+InqeZLs/zAl6G+iXck74dJLxSetGh/ZhzZ84meO53GmoiLDzbR71sJTbAX2gdQysRnCmJFMG3D7M1lwaSYLLfV11+6OHhsPYTa5iBdnZmXsFPWgjHW0Zz5tv/WelgLe8FSzBkye39czsLyxtzm7uPiz0Nj9jxyYd3q+e+PtXRfSzJhLAvoq5+wO0WcEnCX/BCS2gdz230u0slA079EfxolzxhoY4BXgCzzpc7irhEKF6RGK30XLg1TuhctXjdlN97ZfvIcZkNt3dHCZzOGgrDAfbXHugGmKaTkHezkrsKKyn7Yol1t0zN4XeHe3xYqroK3+5+EOZMl6UcXHwYBnBz38L6qGD+0bOCw+WQ1/94QQvI/2ZpMNYDsa32nJkiUpyIHbhNv39clWHbmieLiRNC/pdfZ2WqE39cQHDeC/6js20Ck0ngS2V+eh7wleJVCiN0BD1OhqmKcDHho35EdhmmJaWjD50KIg8neQM78ctLxmkeCHIUMe/S4KF9xgJf+8Jsj8v4Ge57zUstEqWz8/fJk8s7JcB76CGB236Sc9sgR/p83/j3mG5DJm5V+VGO/q7d3qdveFrnZrxz9sIE8nOoOHwB3eIpcgW0bLclEau5ty4H2MaSlgewhekBlko5X9zmcbIoPiOwMdp39imer22mmyfSTgejH8EZuC/sdIPPvBqtL6id9PG/VZKDGbjFjef6ihf8B++BVkeDfxuYoh10PAwlkL2qQXyrGMaJeRv77L07l5H6DeyRk+Te35okhKWPgmzgW0gqtnOpyVN+TmrjlXv35IfCzOitvAxH8v3q8CNjNZCcJiBDeBCRMmTJgwYcKECRMm/gfwT1ET1leeYmK5AAAAAElFTkSuQmCC", "description": "The SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has seen in the past 30 days and identified as being associated with a malicious SSL certificate.", "detailedDescription": "sslipblacklist.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past 30 days being associated with a malicious SSL certificate.\n\nsslipblacklist_aggressive.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past being associated with a malicious SSL certificate. Warning - High FP Rate!\n\nsslblacklist.csv:\nThe SSL IP Blacklist contains SHA1 Fingerprint of all SSL certificates blacklisted on SSLBL. \nThe SSL Certificate Blacklist (CSV) gets generated every 5 minutes. Please do not fetch it more often than every 5 minutes.\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/abusech-ssl-blacklist-feed)", "configuration": [ { "display": "Services", "displayPassword": "", "name": "url", "defaultValue": "", "type": 16, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "https://sslbl.abuse.ch/blacklist/sslipblacklist.csv", "https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv", "https://sslbl.abuse.ch/blacklist/sslblacklist.csv" ], "info": "" }, { "display": "Fetch indicators", "displayPassword": "", "name": "feed", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Indicator Reputation", "displayPassword": "", "name": "feedReputation", "defaultValue": "Bad", "type": 18, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "None", "Good", "Suspicious", "Bad" ], "info": "Indicators from this integration instance will be marked with this reputation." }, { "display": "Source Reliability", "displayPassword": "", "name": "feedReliability", "defaultValue": "B - Usually reliable", "type": 15, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "A - Completely reliable", "B - Usually reliable", "C - Fairly reliable", "D - Not usually reliable", "E - Unreliable", "F - Reliability cannot be judged" ], "info": "Reliability of the source providing the intelligence data" }, { "display": "Traffic Light Protocol Color", "displayPassword": "", "name": "tlp_color", "defaultValue": "", "type": 15, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "RED", "AMBER", "GREEN", "WHITE" ], "info": "The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed" }, { "display": "", "displayPassword": "", "name": "feedExpirationPolicy", "defaultValue": "indicatorType", "type": 17, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "never", "interval", "indicatorType", "suddenDeath" ], "info": "" }, { "display": "", "displayPassword": "", "name": "feedExpirationInterval", "defaultValue": "20160", "type": 1, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Feed Fetch Interval", "displayPassword": "", "name": "feedFetchInterval", "defaultValue": "60", "type": 19, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Bypass exclusion list", "displayPassword": "", "name": "feedBypassExclusionList", "defaultValue": "", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system." }, { "display": "Request Timeout", "displayPassword": "", "name": "polling_timeout", "defaultValue": "20", "type": 0, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "Time in seconds before http requests timeout." }, { "display": "Trust any certificate (not secure)", "displayPassword": "", "name": "insecure", "defaultValue": "", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Use system proxy settings", "displayPassword": "", "name": "proxy", "defaultValue": "", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "" }, { "display": "Tags", "displayPassword": "", "name": "feedTags", "defaultValue": "", "type": 0, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "Supports CSV values." } ], "integrationScript": { "script": "register_module_line('abuse.ch SSL Blacklist Feed', 'start', __line__())\n### pack version: 1.1.26\n\n\n\ndef main():\n feed_url_to_config = {\n 'https://sslbl.abuse.ch/blacklist/sslipblacklist.csv': {\n 'fieldnames': ['firstseenbysource', 'value', 'port'],\n 'indicator_type': FeedIndicatorType.IP,\n 'mapping': {\n 'firstseenbysource': 'firstseenbysource',\n 'port': 'port'\n }\n },\n 'https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv': {\n 'fieldnames': ['firstseenbysource', 'value', 'port'],\n 'indicator_type': FeedIndicatorType.IP,\n 'mapping': {\n 'firstseenbysource': 'firstseenbysource',\n 'port': 'port'\n }\n },\n 'https://sslbl.abuse.ch/blacklist/sslblacklist.csv': {\n 'fieldnames': ['Listingdate', 'value', 'Listingreason'],\n 'indicator_type': 'Certificate',\n 'mapping': {\n 'firstseenbysource': 'Listingdate',\n 'relationship_entity_b': 'Listingreason',\n 'Tags': 'Listingreason',\n },\n 'relationship_entity_b_type': FeedIndicatorType.Malware,\n 'relationship_name': EntityRelationship.Relationships.INDICATOR_OF,\n 'auto_detect_type': False,\n\n }\n }\n\n params = {k: v for k, v in demisto.params().items() if v is not None}\n params['feed_url_to_config'] = feed_url_to_config\n params['ignore_regex'] = r'^#'\n params['delimiter'] = ','\n params['create_relationships'] = True\n\n # Main execution of the CSV API Module.\n # This function allows to add to or override this execution.\n feed_main('SSL Blacklist Feed', params, 'sslbl')\n\n\n\n### GENERATED CODE ###: from CSVFeedApiModule import * # noqa: E402\n# This code was inserted in place of an API module.\nregister_module_line('CSVFeedApiModule', 'start', __line__(), wrapper=-3)\n\n\n\n\n''' IMPORTS '''\nimport csv\nimport gzip\nimport urllib3\nfrom typing import Optional, Pattern, Dict, Any, Tuple, Union, List\n\n# disable insecure warnings\nurllib3.disable_warnings()\n\n# Globals\nDATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ'\nTHRESHOLD_IN_SECONDS = 43200 # 12 hours in seconds\n\n\nclass Client(BaseClient):\n def __init__(self, url: str, feed_url_to_config: Optional[Dict[str, dict]] = None, fieldnames: str = '',\n insecure: bool = False, credentials: dict = None, ignore_regex: str = None, encoding: str = 'latin-1',\n delimiter: str = ',', doublequote: bool = True, escapechar: str = '',\n quotechar: str = '\"', skipinitialspace: bool = False, polling_timeout: int = 20, proxy: bool = False,\n feedTags: Optional[str] = None, tlp_color: Optional[str] = None, value_field: str = 'value', **kwargs):\n \"\"\"\n :param url: URL of the feed.\n :param feed_url_to_config: for each URL, a configuration of the feed that contains\n If *null* the values in the first row of the file are used as names. Default: *null*\n Example:\n feed_url_to_config = {\n 'https://ipstack.com':\n {\n 'fieldnames': ['value'],\n 'indicator_type': 'IP',\n 'mapping': {\n 'Date': 'date' / 'Date': ('date', r'(regex_string)', 'The date is {}')\n }\n }\n }\n For the mapping you can use either:\n 1. 'indicator_field': 'value_from_feed'\n 2. 'indicator_field': ('value_from_feed', regex_string_extractor, string_formatter)\n * regex_string_extractor will extract the first match from the value_from_feed,\n Use None to get the full value of the field.\n * string_formatter will format the data in your preferred way, Use None to get the extracted field.\n 3. 'indicator_field': ('value_from_feed', 'field_mapper_function')\n * field_mapper_function will accept as an argument 'value_from_feed' and return the data\n in your preferred way.\n :param fieldnames: list of field names in the file. If *null* the values in the first row of the file are\n used as names. Default: *null*\n :param insecure: boolean, if *false* feed HTTPS server certificate is verified. Default: *false*\n :param credentials: username and password used for basic authentication.\n Can be also used as API key header and value by specifying _header in the username field.\n :param ignore_regex: python regular expression for lines that should be ignored. Default: *null*\n :param encoding: Encoding of the feed, latin-1 by default.\n :param delimiter: see `csv Python module\n `. Default: ,\n :param doublequote: see `csv Python module\n `. Default: true\n :param escapechar: see `csv Python module\n `. Default null\n :param quotechar: see `csv Python module\n `. Default \"\n :param skipinitialspace: see `csv Python module\n `. Default False\n :param polling_timeout: timeout of the polling request in seconds. Default: 20\n :param proxy: Sets whether use proxy when sending requests\n :param tlp_color: Traffic Light Protocol color.\n \"\"\"\n self.tags: List[str] = argToList(feedTags)\n self.tlp_color = tlp_color\n self.value_field = value_field\n if not credentials:\n credentials = {}\n\n auth: Optional[tuple] = None\n self.headers = {}\n\n username = credentials.get('identifier', '')\n if username.startswith('_header:'):\n header_name = username.split(':')[1]\n header_value = credentials.get('password', '')\n self.headers[header_name] = header_value\n else:\n password = credentials.get('password', '')\n auth = None\n if username and password:\n auth = (username, password)\n\n super().__init__(base_url=url, proxy=proxy, verify=not insecure, auth=auth)\n\n try:\n self.polling_timeout = int(polling_timeout)\n except (ValueError, TypeError):\n return_error('Please provide an integer value for \"Request Timeout\"')\n self.encoding = encoding\n self.ignore_regex: Optional[Pattern] = None\n if ignore_regex is not None:\n self.ignore_regex = re.compile(ignore_regex)\n self.feed_url_to_config: Optional[Dict[str, dict]] = feed_url_to_config\n self.fieldnames = argToList(fieldnames)\n self.dialect: Dict[str, Any] = {\n 'delimiter': delimiter,\n 'doublequote': doublequote,\n 'escapechar': escapechar,\n 'quotechar': quotechar,\n 'skipinitialspace': skipinitialspace\n }\n\n def _build_request(self, url):\n r = requests.Request(\n 'GET',\n url,\n auth=self._auth\n )\n\n return r.prepare()\n\n def build_iterator(self, **kwargs):\n results = []\n urls = self._base_url\n if not isinstance(urls, list):\n urls = [urls]\n for url in urls:\n _session = requests.Session()\n\n prepreq = self._build_request(url)\n\n # this is to honour the proxy environment variables\n kwargs.update(_session.merge_environment_settings(\n prepreq.url,\n {}, None, None, None # defaults\n ))\n kwargs['stream'] = True\n kwargs['verify'] = self._verify\n kwargs['timeout'] = self.polling_timeout\n\n if is_demisto_version_ge('6.5.0'):\n # Set the If-None-Match and If-Modified-Since headers if we have etag or\n # last_modified values in the context.\n last_run = demisto.getLastRun()\n etag = last_run.get(url, {}).get('etag')\n last_modified = last_run.get(url, {}).get('last_modified')\n last_updated = last_run.get(url, {}).get('last_updated')\n # To avoid issues with indicators expiring, if 'last_updated' is over X hours old,\n # we'll refresh the indicators to ensure their expiration time is updated.\n # For further details, refer to : https://confluence-dc.paloaltonetworks.com/display/DemistoContent/Json+Api+Module # noqa: E501\n if last_updated and has_passed_time_threshold(timestamp_str=last_updated, seconds_threshold=THRESHOLD_IN_SECONDS):\n last_modified = None\n etag = None\n demisto.debug(\"Since it's been a long time with no update, to make sure we are keeping the indicators alive, \\\n we will refetch them from scratch\")\n\n if etag:\n self.headers['If-None-Match'] = etag\n\n if last_modified:\n self.headers['If-Modified-Since'] = last_modified\n\n # set request headers\n if 'headers' in kwargs:\n self.headers.update(kwargs['headers'])\n del kwargs['headers']\n\n if self.headers:\n prepreq.headers.update(self.headers)\n\n try:\n r = _session.send(prepreq, **kwargs)\n except requests.exceptions.ConnectTimeout as exception:\n err_msg = 'Connection Timeout Error - potential reasons might be that the Server URL parameter' \\\n ' is incorrect or that the Server is not accessible from your host.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.SSLError as exception:\n # in case the \"Trust any certificate\" is already checked\n if not self._verify:\n raise\n err_msg = 'SSL Certificate Verification Failed - try selecting \\'Trust any certificate\\' checkbox in' \\\n ' the integration configuration.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.ProxyError as exception:\n err_msg = 'Proxy Error - if the \\'Use system proxy\\' checkbox in the integration configuration is' \\\n ' selected, try clearing the checkbox.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.ConnectionError as exception:\n # Get originating Exception in Exception chain\n error_class = str(exception.__class__)\n err_type = '<' + error_class[error_class.find('\\'') + 1: error_class.rfind('\\'')] + '>'\n err_msg = 'Verify that the server URL parameter' \\\n ' is correct and that you have access to the server from your host.' \\\n '\nError Type: {}\nError Number: [{}]\nMessage: {}\n' \\\n .format(err_type, exception.errno, exception.strerror)\n raise DemistoException(err_msg, exception)\n try:\n r.raise_for_status()\n except Exception:\n return_error(f'Exception in request: {r.status_code} {r.content.decode(\"utf-8\")}')\n raise\n\n response = self.get_feed_content_divided_to_lines(url, r)\n if self.feed_url_to_config:\n fieldnames = self.feed_url_to_config.get(url, {}).get('fieldnames', [])\n skip_first_line = self.feed_url_to_config.get(url, {}).get('skip_first_line', False)\n else:\n fieldnames = self.fieldnames\n skip_first_line = False\n if self.ignore_regex is not None:\n response = filter( # type: ignore\n lambda x: self.ignore_regex.match(x) is None, # type: ignore\n response\n )\n\n csvreader = csv.DictReader(\n response,\n fieldnames=fieldnames,\n **self.dialect\n )\n\n if skip_first_line:\n next(csvreader)\n no_update = get_no_update_value(r, url) if is_demisto_version_ge('6.5.0') else True\n results.append({url: {'result': csvreader, 'no_update': no_update}})\n\n return results\n\n def get_feed_content_divided_to_lines(self, url, raw_response):\n \"\"\"Fetch feed data and divides its content to lines\n\n Args:\n url: Current feed's url.\n raw_response: The raw response from the feed's url.\n\n Returns:\n List. List of lines from the feed content.\n \"\"\"\n if self.feed_url_to_config and self.feed_url_to_config.get(url).get('is_zipped_file'): # type: ignore\n response_content = gzip.decompress(raw_response.content)\n else:\n response_content = raw_response.content\n\n return response_content.decode(self.encoding).split('\n')\n\n\ndef get_no_update_value(response: requests.models.Response, url: str) -> bool:\n \"\"\"\n detect if the feed response has been modified according to the headers etag and last_modified.\n For more information, see this:\n https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Last-Modified\n https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag\n Args:\n response: (requests.Response) The feed response.\n url: (str) The feed URL (service).\n Returns:\n boolean with the value for noUpdate argument.\n The value should be False if the response was modified.\n \"\"\"\n if response.status_code == 304:\n demisto.debug('No new indicators fetched, createIndicators will be executed with noUpdate=True.')\n return True\n\n etag = response.headers.get('ETag')\n last_modified = response.headers.get('Last-Modified')\n current_time = datetime.utcnow()\n # Save the current time as the last updated time. This will be used to indicate the last time the feed was updated in XSOAR.\n last_updated = current_time.strftime(DATE_FORMAT)\n\n if not etag and not last_modified:\n demisto.debug('Last-Modified and Etag headers are not exists,'\n 'createIndicators will be executed with noUpdate=False.')\n return False\n\n last_run = demisto.getLastRun()\n last_run[url] = {'last_modified': last_modified, 'etag': etag, 'last_updated': last_updated}\n demisto.setLastRun(last_run)\n\n demisto.debug('New indicators fetched - the Last-Modified value has been updated,'\n ' createIndicators will be executed with noUpdate=False.')\n return False\n\n\ndef determine_indicator_type(indicator_type, default_indicator_type, auto_detect, value):\n \"\"\"\n Detect the indicator type of the given value.\n Args:\n indicator_type: (str) Indicator type given in the config.\n default_indicator_type: Indicator type which was inserted as a param of the integration by user.\n auto_detect: (bool) True whether auto detection of the indicator type is wanted.\n value: (str) The value which we'd like to get indicator type of.\n Returns:\n Str which stands for the indicator type after detection.\n \"\"\"\n if auto_detect:\n indicator_type = auto_detect_indicator_type(value)\n if not indicator_type:\n indicator_type = default_indicator_type\n return indicator_type\n\n\ndef module_test_command(client: Client, args):\n client.build_iterator()\n return 'ok', {}, {}\n\n\ndef date_format_parsing(date_string):\n \"\"\"\n formats a datestring to the ISO-8601 format which the server expects to recieve\n :param date_string: Date represented as a tring\n :return: ISO-8601 date string\n \"\"\"\n formatted_date = dateparser.parse(date_string, settings={'TIMEZONE': 'UTC'})\n assert formatted_date is not None, f\"failed parsing {date_string}\"\n return formatted_date.strftime(DATE_FORMAT)\n\n\ndef create_fields_mapping(raw_json: Dict[str, Any], mapping: Dict[str, Union[Tuple, str]]):\n fields_mapping = {} # type: dict\n\n for key, field in mapping.items():\n regex_extractor = None\n formatter_string = None\n field_mapper_function = None\n\n # case 'value_from_feed', regex_string_extractor, string_formatter\n if isinstance(field, tuple) and len(field) == 3:\n field, regex_extractor, formatter_string = field\n\n # case 'value_from_feed', 'field_mapper_function'\n elif isinstance(field, tuple) and len(field) == 2:\n field, field_mapper_function = field\n\n if not raw_json.get(field): # type: ignore\n continue\n\n if not regex_extractor:\n field_value = raw_json[field] # type: ignore\n else:\n try:\n field_value = re.match(regex_extractor, raw_json[field]).group(1) # type: ignore\n except Exception:\n field_value = raw_json[field] # type: ignore\n\n field_value = formatter_string.format(field_value) if formatter_string else field_value\n field_value = field_mapper_function(field_value) if field_mapper_function else field_value\n fields_mapping[key] = field_value\n\n if key in ['firstseenbysource', 'lastseenbysource']:\n fields_mapping[key] = date_format_parsing(fields_mapping[key])\n\n return fields_mapping\n\n\ndef fetch_indicators_command(client: Client, default_indicator_type: str, auto_detect: bool, limit: int = 0,\n create_relationships: bool = False, **kwargs):\n iterator = client.build_iterator(**kwargs)\n relationships_of_indicator = []\n indicators = []\n config = client.feed_url_to_config or {}\n\n # set noUpdate flag in createIndicators command True only when all the results from all the urls are True.\n no_update = all(next(iter(item.values())).get('no_update', False) for item in iterator)\n\n for url_to_reader in iterator:\n for url, reader in url_to_reader.items():\n mapping = config.get(url, {}).get('mapping', {})\n for item in reader.get('result', []):\n raw_json = dict(item)\n fields_mapping = create_fields_mapping(raw_json, mapping) if mapping else {}\n value = item.get(client.value_field) or fields_mapping.get('Value')\n if not value and len(item) > 1:\n value = next(iter(item.values()))\n if value:\n raw_json['value'] = value\n conf_indicator_type = config.get(url, {}).get('indicator_type')\n indicator_type = determine_indicator_type(conf_indicator_type, default_indicator_type, auto_detect,\n value)\n raw_json['type'] = indicator_type\n # if relationships param is True and also the url returns relationships\n if create_relationships and config.get(url, {}).get('relationship_name'):\n if fields_mapping.get('relationship_entity_b'):\n relationships_lst = EntityRelationship(\n name=config.get(url, {}).get('relationship_name'),\n entity_a=value,\n entity_a_type=indicator_type,\n entity_b=fields_mapping.get('relationship_entity_b'),\n entity_b_type=FeedIndicatorType.indicator_type_by_server_version(\n config.get(url, {}).get('relationship_entity_b_type')),\n )\n relationships_of_indicator = [relationships_lst.to_indicator()]\n\n indicator = {\n 'value': value,\n 'type': indicator_type,\n 'rawJSON': raw_json,\n 'fields': fields_mapping,\n 'relationships': relationships_of_indicator,\n }\n indicator['fields']['tags'] = client.tags\n\n if client.tlp_color:\n indicator['fields']['trafficlightprotocol'] = client.tlp_color\n\n indicators.append(indicator)\n # exit the loop if we have more indicators than the limit\n if limit and len(indicators) >= limit:\n return indicators, no_update\n\n return indicators, no_update\n\n\ndef get_indicators_command(client, args: dict, tags: Optional[List[str]] = None):\n if tags is None:\n tags = []\n itype = args.get('indicator_type', demisto.params().get('indicator_type'))\n try:\n limit = int(args.get('limit', 50))\n except ValueError:\n raise ValueError('The limit argument must be a number.')\n auto_detect = demisto.params().get('auto_detect_type')\n relationships = demisto.params().get('create_relationships', False)\n indicators_list, _ = fetch_indicators_command(client, itype, auto_detect, limit, relationships)\n entry_result = indicators_list[:limit]\n hr = tableToMarkdown('Indicators', entry_result, headers=['value', 'type', 'fields'])\n return hr, {}, indicators_list\n\n\ndef feed_main(feed_name, params=None, prefix=''): # pragma: no cover\n if not params:\n params = {k: v for k, v in demisto.params().items() if v is not None}\n handle_proxy()\n client = Client(**params)\n command = demisto.command()\n if command != 'fetch-indicators':\n demisto.info('Command being called is {}'.format(command))\n if prefix and not prefix.endswith('-'):\n prefix += '-'\n # Switch case\n commands: dict = {\n 'test-module': module_test_command,\n f'{prefix}get-indicators': get_indicators_command\n }\n try:\n if command == 'fetch-indicators':\n indicators, no_update = fetch_indicators_command(\n client,\n params.get('indicator_type'),\n params.get('auto_detect_type'),\n params.get('limit'),\n params.get('create_relationships')\n )\n\n # check if the version is higher than 6.5.0 so we can use noUpdate parameter\n if is_demisto_version_ge('6.5.0'):\n if not indicators:\n demisto.createIndicators(indicators, noUpdate=no_update) # type: ignore\n else:\n # we submit the indicators in batches\n for b in batch(indicators, batch_size=2000):\n demisto.createIndicators(b, noUpdate=no_update) # type: ignore\n else:\n # call createIndicators without noUpdate arg\n if not indicators:\n demisto.createIndicators(indicators) # type: ignore\n else:\n for b in batch(indicators, batch_size=2000): # type: ignore\n demisto.createIndicators(b)\n\n else:\n args = demisto.args()\n args['feed_name'] = feed_name\n readable_output, outputs, raw_response = commands[command](client, args)\n return_outputs(readable_output, outputs, raw_response)\n except Exception as e:\n err_msg = f'Error in {feed_name} Integration - Encountered an issue with createIndicators' if \\\n 'failed to create' in str(e) else f'Error in {feed_name} Integration [{e}]'\n return_error(err_msg)\n\nregister_module_line('CSVFeedApiModule', 'end', __line__(), wrapper=1)\n### END GENERATED CODE ###\n\nif __name__ == '__builtin__' or __name__ == 'builtins':\n main()\n\nregister_module_line('abuse.ch SSL Blacklist Feed', 'end', __line__())\n", "type": "python", "commands": [ { "name": "sslbl-get-indicators", "deprecated": false, "arguments": [ { "name": "limit", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "The maximum number of results to return. The default value is 50.", "defaultValue": "50", "type": "" }, { "name": "indicator_type", "required": false, "deprecated": false, "hidden": false, "default": false, "secret": false, "description": "The indicator type.", "type": "" } ], "outputs": null, "important": null, "description": "Gets the feed indicators.", "execution": false, "cartesian": false, "hidden": false, "docsHidden": false, "sensitive": false, "timeout": 0, "permitted": false, "indicatorAction": false, "definitionId": "", "gomAction": false, "polling": false } ], "dockerImage": "demisto/python3:3.10.13.86272", "nativeImage": [ "8.3", "8.4" ], "isFetch": false, "isFetchEvents": false, "isFetchAssets": false, "feed": true, "isFetchCredentials": false, "runOnce": false, "longRunning": false, "longRunningPortMapping": false, "subtype": "python3", "isMappable": false, "isRemoteSyncIn": false, "isRemoteSyncOut": false, "isFetchSamples": false, "resetContext": false }, "system": true, "hidden": false, "canGetSamples": true } ], "engines": { "engines": [ { "id": "6b1d6700-ee17-4af9-b071-d7fc642ea441", "version": 81, "cacheVersn": 0, "sequenceNumber": 47683350, "primaryTerm": 12, "modified": "2024-04-04T16:17:45.602959424Z", "sizeInBytes": 1530, "sortValues": [ "120227" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "name": "create_new_engine_engine_rpm_OaOx5RSd", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "user@company.com", "pkgType": "rpm", "pkgName": "/var/lib/demisto/downloads/x86_64/create_new_engine_engine_rpm_OaOx5RSd-8.6_933863-1.x86_64.rpm", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "buildVersion": "21874e0e41eb2c5ce7653f6dcc07621d992f927c", "md5": "3192ca98dab68bebb124f99cbf5bb994", "underUpgrade": false, "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "76641c64c3dbbe9f8272fdc193942fb8b8647e00183d95c69b2e8b80eb43b714", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}XIoRrYJ+aA1QCktuBTDQWfXmZnNB3KtbdMYTp+XgX+fVdYU3LbeIxO+oztktxJR7h2coO27MIkU9YIamIsR3LoUjydrlJVI0x9wO/JcK7fKdnyPqR3HRY/kpf5oOMYu0IQcsaSBAfb3Ky9z8z/4PyQlkJEcrDkvunHAtueOcNJmfqucQQiuMeHfj2PcMEdTqa/ZLJsRvtvoHDEC2sc1u5W/MGKKBdSGmkDXRQhgsL8bVOJVHjaayce8j22PpawKYmHUH4SeUjQnvZluiR2isS7z16TQNHW/UWNXzlqt8TTk=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "b6b7b03e-632b-4c05-a087-23f68affd5d3", "version": 7, "cacheVersn": 0, "sequenceNumber": 47683375, "primaryTerm": 12, "modified": "2024-04-04T16:18:46.830805002Z", "sizeInBytes": 1519, "sortValues": [ "120228" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "name": "create_new_engine_engine_shell_pzv9a3Y3", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "user@company.com", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/create_new_engine_engine_shell_pzv9a3Y3-8.6-933863.sh", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "buildVersion": "21874e0e41eb2c5ce7653f6dcc07621d992f927c", "md5": "8ffbd7cc23e270f792d8afd738814818", "underUpgrade": false, "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "2afc44aac1dba5079bd963128de62b310454b4bd294bf1c9be1a6bfb9b32afa5", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}5w75Hmog7B4MPk6l/EkHNwILAOTnznRkUIb5dugxM2Ozw4vjPlj3B/STZundq8DYWl4NashmaYzZ7IUgy7ilbz0hT/LkFGJzM19RiRyGI4vudzkdNNSwb0qba2eZNVywS4nidmyKWUGXo+LIUJnBJYh8FyL3zDymBsMk8IHyPmejazDJ0ieVMRr8P8ztWNiD3wSEwJquX7tS9K/U8LnbBuwKGfx2VnY4nYpy1h0FiLFUaItLF+XJtgWDabFvgQhyUcF0Iz1YGM1ejTbT1pyCahHkVCVezqDASoJHda30nDA=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null } ], "total": 2, "pkgTypes": [ "shell", "zip", "deb", "rpm", "conf" ], "requestedLogs": {}, "engineGroups": [] }, "health": { "id": "Rocket Incident Generator.long_running_integration_fetch_incidents_AI6tPtxq", "version": 1, "cacheVersn": 0, "sequenceNumber": 1390272, "primaryTerm": 2, "modified": "2022-11-29T09:10:37.116147451Z", "sizeInBytes": 0, "sortValues": [ "2912" ], "brand": "Rocket Incident Generator", "instance": "long_running_integration_fetch_incidents_AI6tPtxq", "incidentsPulled": 0, "indicatorsPulled": 0, "eventsPulled": 0, "assetsPulled": 0, "type": 0, "incidentsDropped": 0, "lastPullTime": "2022-11-29T09:05:26.273935902Z", "lastError": "Script failed to run: \nTimeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)", "lastIngestionDuration": 0, "fetchDuration": 0, "creation_time": "0001-01-01T00:00:00Z", "sum_hour": 0, "sum_day": 0, "sum_week": 0 }, "long_running_integration_fetch_incidents_NbrfwigR": { "id": "Rocket Incident Generator.long_running_integration_fetch_incidents_NbrfwigR", "version": 1, "cacheVersn": 0, "sequenceNumber": 1680557, "primaryTerm": 2, "modified": "2022-12-03T15:30:44.971255467Z", "sizeInBytes": 0, "sortValues": [ "3035" ], "brand": "Rocket Incident Generator", "instance": "long_running_integration_fetch_incidents_NbrfwigR", "incidentsPulled": 0, "indicatorsPulled": 0, "eventsPulled": 0, "assetsPulled": 0, "type": 0, "incidentsDropped": 0, "lastPullTime": "2022-12-03T15:25:34.220297587Z", "lastError": "Script failed to run: \nTimeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)", "lastIngestionDuration": 0, "fetchDuration": 0, "creation_time": "0001-01-01T00:00:00Z", "sum_hour": 0, "sum_day": 0, "sum_week": 0 }, "instances": [ { "id": "e227fc24-5e1d-4165-87b8-949f71030b22", "version": 74, "cacheVersn": 0, "sequenceNumber": 39320671, "primaryTerm": 12, "modified": "2024-02-05T14:05:11.127323408Z", "sizeInBytes": 1314, "sortValues": [ "79580" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "all" ], "definitionId": "", "prevName": "", "password": "", "enabled": "true", "name": "AutoFocusTagsFeed_default_instance", "configvalues": { "create_relationships": true, "feed": true, "feedBypassExclusionList": true, "feedFetchInterval": "10", "feedIncremental": true, "feedReliability": "A - Completely reliable", "url": "https://autofocus.paloaltonetworks.com/api/v1.0/" }, "configtypes": { "create_relationships": 8, "feed": 8, "feedBypassExclusionList": 8, "feedFetchInterval": 19, "feedIncremental": 8, "feedReliability": 15, "url": 0 }, "brand": "AutoFocusTagsFeed", "category": "", "path": "", "executable": "", "cmdline": "", "engine": "", "engineGroup": "", "hidden": false, "isIntegrationScript": true, "islongRunning": false, "mappingId": "", "outgoingMapperId": "", "incomingMapperId": "", "remoteSync": false, "isSystemIntegration": true, "canSample": false, "defaultIgnore": false, "integrationLogLevel": "", "commandsPermissions": null, "longRunningId": "", "incidentFetchInterval": 0, "eventFetchInterval": 0, "assetsFetchInterval": 0, "servicesID": "main", "isBuiltin": false, "hybrid": false, "configuration": { "id": "", "version": 0, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "", "prevName": "", "display": "", "brand": "", "category": "", "icon": "", "description": "", "configuration": null, "integrationScript": null, "hidden": false, "canGetSamples": false }, "data": [ { "display": "Create relationships", "displayPassword": "", "name": "create_relationships", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": true }, { "display": "Fetch indicators", "displayPassword": "", "name": "feed", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": true }, { "display": "Bypass exclusion list", "displayPassword": "", "name": "feedBypassExclusionList", "defaultValue": "true", "type": 8, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.", "hasvalue": true, "value": true }, { "display": "Feed Fetch Interval", "displayPassword": "", "name": "feedFetchInterval", "defaultValue": "10", "type": 19, "required": false, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": "10" }, { "display": "Incremental Feed", "displayPassword": "", "name": "feedIncremental", "defaultValue": "true", "type": 8, "required": false, "hidden": true, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.", "hasvalue": true, "value": true }, { "display": "Source Reliability", "displayPassword": "", "name": "feedReliability", "defaultValue": "A - Completely reliable", "type": 15, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": [ "A - Completely reliable", "B - Usually reliable", "C - Fairly reliable", "D - Not usually reliable", "E - Unreliable", "F - Reliability cannot be judged" ], "info": "Reliability of the source providing the intelligence data.", "hasvalue": true, "value": "A - Completely reliable" }, { "display": "AutoFocus Endpoint URL", "displayPassword": "", "name": "url", "defaultValue": "https://autofocus.paloaltonetworks.com/api/v1.0/", "type": 0, "required": true, "hidden": false, "hiddenUsername": false, "hiddenPassword": false, "options": null, "info": "", "hasvalue": true, "value": "https://autofocus.paloaltonetworks.com/api/v1.0/" } ], "displayPassword": "", "passwordProtected": false, "mappable": false, "remoteSyncableIn": false, "remoteSyncableOut": false, "isFetchSamples": false, "debugMode": false } ] } } } } } } }, "operationId": "post-settings-integration-search", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } } }, "description": "Get details on all of the integrations, integration instances, engines, and health.\r\n\r\nThe response is likely to be very large." }, "parameters": [] }, "/xsoar/public/v1/automation/load/{script_name}": { "parameters": [ { "schema": { "type": "string" }, "name": "script_name", "in": "path", "required": true, "description": "Name of an existing script (automation)" } ], "post": { "summary": "Get an existing script", "tags": [ "Scripts", "Automations" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "MainEngineInfo": { "type": "object", "properties": { "engine": { "type": "string" }, "engineGroup": { "type": "string" } } }, "arguments": { "type": "array", "items": { "type": "object", "properties": { "default": { "type": "boolean" }, "defaultValue": { "type": "string" }, "deprecated": { "type": "boolean" }, "description": { "type": "string" }, "hidden": { "type": "boolean" }, "name": { "type": "string" }, "required": { "type": "boolean" }, "secret": { "type": "boolean" }, "type": { "type": "string" } } } }, "cacheVersn": { "type": "integer" }, "comment": { "type": "string" }, "commitMessage": { "type": "string" }, "contextKeys": { "type": "array", "items": { "type": "object", "properties": {} } }, "definitionId": { "type": "string" }, "deprecated": { "type": "boolean" }, "detached": { "type": "boolean" }, "dockerImage": { "type": "string" }, "enabled": { "type": "boolean" }, "engine": { "type": "string" }, "engineGroup": { "type": "string" }, "fromServerVersion": { "type": "string" }, "id": { "type": "string" }, "important": { "type": "null" }, "itemVersion": { "type": "string" }, "locked": { "type": "boolean" }, "modified": { "type": "string" }, "name": { "type": "string" }, "nativeImage": { "type": "null" }, "outputs": { "type": "null" }, "packID": { "type": "string" }, "packName": { "type": "string" }, "packPropagationLabels": { "type": "array", "items": { "type": "string" } }, "permitted": { "type": "boolean" }, "prevName": { "type": "string" }, "primaryTerm": { "type": "integer" }, "propagationLabels": { "type": "array", "items": { "type": "object", "properties": {} } }, "pswd": { "type": "string" }, "pswdProtected": { "type": "boolean" }, "rawTags": { "type": "array", "items": { "type": "string" } }, "runAs": { "type": "string" }, "runOnce": { "type": "boolean" }, "script": { "type": "string" }, "scriptTarget": { "type": "integer" }, "searchableName": { "type": "string" }, "sensitive": { "type": "boolean" }, "sequenceNumber": { "type": "integer" }, "shouldCommit": { "type": "boolean" }, "sizeInBytes": { "type": "integer" }, "subtype": { "type": "string" }, "system": { "type": "boolean" }, "tags": { "type": "array", "items": { "type": "string" } }, "timeout": { "type": "integer" }, "toServerVersion": { "type": "string" }, "type": { "type": "string" }, "user": { "type": "string" }, "vcShouldIgnore": { "type": "boolean" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean" }, "version": { "type": "integer" }, "visualScript": { "type": "string" } }, "x-examples": { "Example 1": { "MainEngineInfo": { "engine": "", "engineGroup": "" }, "arguments": [ { "default": true, "defaultValue": "${lastCompletedTaskEntries}", "deprecated": false, "description": "Entry IDs to add its output to Evidence Board", "hidden": false, "name": "entryIDs", "required": true, "secret": false, "type": "" }, { "default": false, "deprecated": true, "description": "Description to add to Evidence Board", "hidden": false, "name": "desc", "required": false, "secret": false, "type": "" }, { "default": false, "deprecated": false, "description": "Description to add to Evidence Board", "hidden": false, "name": "description", "required": false, "secret": false, "type": "" }, { "default": false, "deprecated": false, "description": "Occurred time of the evidence (time format: 2008-01-02T15:04:05)", "hidden": false, "name": "occurred", "required": false, "secret": false, "type": "" }, { "default": false, "deprecated": false, "description": "Evidence tags", "hidden": false, "name": "tags", "required": false, "secret": false, "type": "" } ], "cacheVersn": 0, "comment": "Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)\n", "commitMessage": "", "contextKeys": [], "definitionId": "", "deprecated": false, "detached": false, "dockerImage": "", "enabled": true, "engine": "", "engineGroup": "", "fromServerVersion": "5.0.0", "id": "AddEvidence", "important": null, "itemVersion": "1.14.25", "locked": false, "modified": "2024-04-03T16:16:30.041688406Z", "name": "AddEvidence", "nativeImage": null, "outputs": null, "packID": "CommonScripts", "packName": "Common Scripts", "packPropagationLabels": [ "all" ], "permitted": true, "prevName": "AddEvidence", "primaryTerm": 12, "propagationLabels": [], "pswd": "", "pswdProtected": false, "rawTags": [ "Utility" ], "runAs": "DBotWeakRole", "runOnce": false, "script": "// pack version: 1.14.25\nif (!args.entryIDs) {\n throw 'Missing argument values for command AddEvidenceJS are : entryIDs';\n}\nvar entryIDs = args.entryIDs;\nvar entryTags = args.tags;\nvar desc = (args.description) ? args.description : args.desc ? args.desc : 'Evidence added by DBot';\nentryIDs = (Array.isArray(entryIDs)) ? entryIDs : [entryIDs];\nentryTags = (Array.isArray(entryTags)) ? entryTags.join(',') : entryTags;\n\nfor (var i=0;i **System** > **Custom Content** > **Export all custom content**.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary", "description": "Custom content file." } } } } } }, "tags": [ "Multi-tenant" ] } }, "/xsoar/public/v1/content/install": { "post": { "summary": "Install content on a production tenant", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } } }, "operationId": "post-xsoar-public-v1-content-install", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "After the new content is ready and committed to the development tenant, you can install it on the production tenant by using the output from [Check for new content](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/remote-repository#post-xsoar-public-v1-content-checknew) API as the input in this API.", "tags": [ "Remote repository" ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "sortValues": { "type": "array", "items": { "type": "string" } }, "hashLatest": { "type": "string" }, "releaseNotes": { "type": "string" }, "releaseDate": { "type": "string" }, "release": { "type": "string" }, "assetId": { "type": "integer" }, "installDate": { "type": "string" }, "ignoreGit": { "type": "boolean" }, "manual": { "type": "boolean" }, "gitId": { "type": "integer" }, "Force": { "type": "boolean" } }, "x-examples": { "Example 1": { "id": "c8084ef2151241e28f03e65beb40704f", "version": 1, "cacheVersn": 0, "sequenceNumber": 23777651, "primaryTerm": 4, "modified": "2024-04-09T07:36:51.875190701Z", "sizeInBytes": 638, "sortValues": [ "1712648211875" ], "hashLatest": "8aac48ad29724738eb3f05598955b453e77869e3", "releaseNotes": "## Release Notes for version 2024.04.09.065950\n##### Published on Tue, 09 Apr 2024 06:59:50 UTC (8aac48ad29724738eb3f05598955b453e77869e3)\n### Playbooks\n__new_uncommitted__\n- No commit message\n\n__api_test__\n- No commit message\n### Incident Fields\n__Asset Table__\n- No commit message\n", "releaseDate": "2024-04-09T06:59:50Z", "release": "2024.04.09.065950", "assetId": 0, "installDate": "0001-01-01T00:00:00Z", "ignoreGit": false, "manual": false, "gitId": 0, "Force": false } } }, "examples": { "Example 1": { "value": { "id": "c8084ef2151241e28f03e65beb40704f", "version": 1, "cacheVersn": 0, "sequenceNumber": 23777651, "primaryTerm": 4, "modified": "2024-04-09T07:36:51.875190701Z", "sizeInBytes": 638, "sortValues": [ "1712648211875" ], "hashLatest": "8aac48ad29724738eb3f05598955b453e77869e3", "releaseNotes": "## Release Notes for version 2024.04.09.065950\n##### Published on Tue, 09 Apr 2024 06:59:50 UTC (8aac48ad29724738eb3f05598955b453e77869e3)\n### Playbooks\n__new_uncommitted__\n- No commit message\n\n__api_test__\n- No commit message\n### Incident Fields\n__Asset Table__\n- No commit message\n", "releaseDate": "2024-04-09T06:59:50Z", "release": "2024.04.09.065950", "assetId": 0, "installDate": "0001-01-01T00:00:00Z", "ignoreGit": false, "manual": false, "gitId": 0, "Force": false } } } } } } } }, "/xsoar/public/v1/content/checkNew": { "post": { "summary": "Check for new content", "tags": [ "Remote repository" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "hashLatest": { "type": "string" }, "releaseNotes": { "type": "string" }, "releaseDate": { "type": "string" }, "release": { "type": "string" }, "assetId": { "type": "integer" }, "installDate": { "type": "string" }, "ignoreGit": { "type": "boolean" }, "manual": { "type": "boolean" }, "gitId": { "type": "integer" }, "Force": { "type": "boolean" } }, "x-examples": { "Example 1": { "id": "a68eb260e9884f1a8110816d15c3b6d9", "version": 1, "cacheVersn": 0, "sequenceNumber": 25114099, "primaryTerm": 4, "modified": "2024-04-24T06:35:16.279682561Z", "sizeInBytes": 729, "hashLatest": "efa3533e9cb43f2d25eef573440c25eac6d38911", "releaseNotes": "## Release Notes for version 2024.04.24.063055\n##### Published on Wed, 24 Apr 2024 06:30:55 UTC (efa3533e9cb43f2d25eef573440c25eac6d38911)\n### Playbooks\n__new_maya_test__\n- No commit message\n### Indicator Fields\n__Name__\n- Install pack Common Types at version 3.4.10\n### Pre-Process Rules\n__linked_rules__\n- Content import\n### Lists\n__Sharon's list__\n- No commit message\n", "releaseDate": "2024-04-24T06:30:55Z", "release": "2024.04.24.063055", "assetId": 0, "installDate": "0001-01-01T00:00:00Z", "ignoreGit": false, "manual": false, "gitId": 0, "Force": false } } }, "examples": { "Example 1": { "value": { "id": "a68eb260e9884f1a8110816d15c3b6d9", "version": 1, "cacheVersn": 0, "sequenceNumber": 25114099, "primaryTerm": 4, "modified": "2024-04-24T06:35:16.279682561Z", "sizeInBytes": 729, "hashLatest": "efa3533e9cb43f2d25eef573440c25eac6d38911", "releaseNotes": "## Release Notes for version 2024.04.24.063055\n##### Published on Wed, 24 Apr 2024 06:30:55 UTC (efa3533e9cb43f2d25eef573440c25eac6d38911)\n### Playbooks\n__new_maya_test__\n- No commit message\n### Indicator Fields\n__Name__\n- Install pack Common Types at version 3.4.10\n### Pre-Process Rules\n__linked_rules__\n- Content import\n### Lists\n__Sharon's list__\n- No commit message\n", "releaseDate": "2024-04-24T06:30:55Z", "release": "2024.04.24.063055", "assetId": 0, "installDate": "0001-01-01T00:00:00Z", "ignoreGit": false, "manual": false, "gitId": 0, "Force": false } } } } } } }, "operationId": "post-xsoar-public-v1-content-checkNew", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Check what new content has been pushed from the development tenant and are available to be installed or updated on the production tenant. All new content is returned in the response and you can verify that the content you expect to see there exists.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } } } }, "/xsoar/public/v1/vc/changes/uncommitted": { "get": { "summary": "Get a list of content available to be pushed to production", "tags": [ "Remote repository" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "x-examples": { "Example 1": [ { "name": "john_copy_1", "filename": "playbook/playbook-john_copy_1.yml", "type": "playbook", "action": "Insert", "message": "Content import", "authorName": "jdoe", "authorEmail": "user@company.com", "when": "2024-04-09T08:48:49.855374957Z" }, { "name": "new_john_test", "filename": "playbook/playbook-new_john_test.yml", "type": "playbook", "action": "Insert", "authorName": "jdoe", "authorEmail": "user@company.com", "when": "2024-04-24T06:14:14.25749347Z" }, { "name": "john_dev_field1", "filename": "incidentfield/incidentfield-john_dev_field1.json", "type": "incidentfield", "action": "Insert", "message": "Content import", "authorName": "jdoe", "authorEmail": "user@company.com", "when": "2024-04-09T08:48:51.060027034Z" } ] }, "items": { "type": "object", "properties": { "name": { "type": "string" }, "filename": { "type": "string" }, "type": { "type": "string" }, "action": { "type": "string" }, "message": { "type": "string" }, "authorName": { "type": "string" }, "authorEmail": { "type": "string" }, "when": { "type": "string" }, "commitHash": { "type": "string" }, "committerName": { "type": "string" }, "isCommitted": { "type": "boolean", "description": "Whether the content is committed." }, "isSystem": { "type": "boolean" }, "packID": { "type": "string" }, "subType": { "type": "string" }, "exclude": { "type": "boolean", "description": "Whether this content is excluded." } } } }, "examples": { "Example 1": { "value": [ { "name": "john_copy_1", "filename": "playbook/playbook-john_copy_1.yml", "type": "playbook", "action": "Insert", "message": "Content import", "authorName": "jdoe", "authorEmail": "user@company.com", "when": "2024-04-09T08:48:49.855374957Z", "exclude": true }, { "name": "new_john_test", "filename": "playbook/playbook-new_john_test.yml", "type": "playbook", "action": "Insert", "authorName": "jdoe", "authorEmail": "user@company.com", "when": "2024-04-24T06:14:14.25749347Z" }, { "name": "john_dev_field1", "filename": "incidentfield/incidentfield-john_dev_field1.json", "type": "incidentfield", "action": "Insert", "message": "Content import", "authorName": "jdoe", "authorEmail": "user@company.com", "when": "2024-04-09T08:48:51.060027034Z" } ] } } } } } }, "operationId": "get-xsoar-public-v1-vc-changes-uncommitted", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Get a list of custom content that is available on the development tenant to be pushed to the production tenant." } }, "/xsoar/public/v1/vc/changes/uncommitted/commit": { "post": { "summary": "Push custom content to production tenant", "tags": [ "Remote repository" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "filename": { "type": "string" }, "type": { "type": "string" }, "action": { "type": "string" }, "message": { "type": "string" }, "authorName": { "type": "string" }, "authorEmail": { "type": "string" }, "when": { "type": "string" }, "isSystem": { "type": "boolean" }, "packID": { "type": "string" } } }, "x-examples": { "Example 1": [ { "name": " Cortex XDR Disconnected Endpoints", "filename": "widget/widget-0361981e-c627-4c09-8fcc-085ffe0a7e56-Cortex_XDR_Disconnected_Endpoints.json", "type": "widget", "action": "Insert", "message": "Install pack Cortex XDR by Palo Alto Networks at version 6.1.28", "authorName": "John Doe", "authorEmail": "user@company.com", "when": "2024-04-21T13:25:15.709207541Z", "isSystem": true, "packID": "CortexXDR" }, { "name": "120", "filename": "playbook/playbook-120.yml", "type": "playbook", "action": "Insert", "message": "Content import", "authorName": "Jane Doe", "authorEmail": "user1@company.com", "when": "2024-04-09T08:48:45.619770656Z" }, { "name": "120_copy", "filename": "playbook/playbook-120_copy.yml", "type": "playbook", "action": "Insert", "message": "Content import", "authorName": "Jane Doe", "authorEmail": "user1@company.com", "when": "2024-04-09T08:48:45.719423579Z" }, { "name": "API Execution Metrics", "filename": "dashboard/dashboard-API_Execution_Metrics-API_Execution_Metrics.json", "type": "dashboard", "action": "Modify", "message": "Install pack Common Dashboards at version 1.4.1", "authorName": "DBot", "authorEmail": "DBot@demisto.com", "when": "2024-04-09T07:58:26.168618437Z", "isSystem": true, "packID": "CommonDashboards" } ] } }, "examples": { "Example 1": { "value": [ { "name": " Cortex XDR Disconnected Endpoints", "filename": "widget/widget-0361981e-c627-4c09-8fcc-085ffe0a7e56-Cortex_XDR_Disconnected_Endpoints.json", "type": "widget", "action": "Insert", "message": "Install pack Cortex XDR by Palo Alto Networks at version 6.1.28", "authorName": "John Doe", "authorEmail": "user@company.com", "when": "2024-04-21T13:25:15.709207541Z", "isSystem": true, "packID": "CortexXDR" }, { "name": "120", "filename": "playbook/playbook-120.yml", "type": "playbook", "action": "Insert", "message": "Content import", "authorName": "Jane Doe", "authorEmail": "user1@company.com", "when": "2024-04-09T08:48:45.619770656Z" }, { "name": "120_copy", "filename": "playbook/playbook-120_copy.yml", "type": "playbook", "action": "Insert", "message": "Content import", "authorName": "Jane Doe", "authorEmail": "user1@company.com", "when": "2024-04-09T08:48:45.719423579Z" }, { "name": "API Execution Metrics", "filename": "dashboard/dashboard-API_Execution_Metrics-API_Execution_Metrics.json", "type": "dashboard", "action": "Modify", "message": "Install pack Common Dashboards at version 1.4.1", "authorName": "DBot", "authorEmail": "DBot@demisto.com", "when": "2024-04-09T07:58:26.168618437Z", "isSystem": true, "packID": "CommonDashboards" } ] } } } } } }, "operationId": "post-xsoar-public-v1-vc-changes-uncommitted-commit", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" }, "changes": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "filename": { "type": "string" }, "type": { "type": "string" }, "action": { "type": "string" }, "authorName": { "type": "string" }, "authorEmail": { "type": "string" }, "when": { "type": "string" } } } }, "validateDependencies": { "type": "boolean" } }, "x-examples": { "Example 1": { "message": "", "changes": [ { "name": "xxx", "filename": "xxx", "type": "xxx", "action": "xxx", "authorName": "xxx", "authorEmail": "xxx", "when": "xxx" } ], "validateDependencies": true } } }, "examples": { "Example 1": { "value": { "message": "", "changes": [ { "name": "new_john_test", "filename": "playbook/playbook-new_ohn_test.yml", "type": "playbook", "action": "Insert", "authorName": "jdoe", "authorEmail": "user@company.com", "when": "2024-04-24T06:14:14.25749347Z" } ], "validateDependencies": true } } } } } }, "description": "Use the response from [Get a list of content available to be pushed to production](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/remote-repository#get-xsoar-public-v1-vc-changes-uncommitted) to customize what content you want to push to the production tenant.\r\nUse that customized content as the request in this API. Once this is performed successfully, that content should no longer appear when running [Get a list of content available to be pushed to production](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/remote-repository#get-xsoar-public-v1-vc-changes-uncommitted)." } }, "/xsoar/public/v1/report/{id}/latest": { "parameters": [ { "schema": { "type": "string" }, "name": "id", "in": "path", "required": true, "description": "Report ID" } ], "get": { "summary": "Get latest report by ID", "tags": [ "Reports" ], "responses": { "200": { "description": "OK - Returns a report file." } }, "operationId": "get-xsoar-public-v1-report-id-latest", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Get the latest report by its ID.\r\n\r\n**Note:** To get the report, it must be a scheduled report with recipients." } }, "/xsoar/public/v1/incident/batch": { "post": { "summary": "Update incidents in a batch", "tags": [ "Incidents" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IncidentSearchResponseWrapper" }, "examples": { "Example 1": { "value": { "total": 24, "data": [ { "id": "207461", "version": 1, "cacheVersn": 0, "modified": "2024-06-23T11:44:16.705Z", "sizeInBytes": 0, "sortValues": [ "1" ], "dbotCreatedBy": "user@company.com", "CustomFields": { "bmcassignee": [ {} ], "bmccustomer": [ {} ], "bmcrequester": [ {} ], "containmentsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "crowdstrikefalconbehaviourpatterndispositiondetails": [ {}, {}, {} ], "datadogcloudsiem": [ {}, {}, {} ], "dataminrpulserelatedterms": [ {}, {}, {} ], "decyfirdatadetails": [ {}, {}, {} ], "detectionsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 20, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "xpanseserviceclassifications": [ {}, {}, {} ], "xpanseservicevalidation": [ { "columnheader1": "" }, {}, {} ] }, "account": "", "autime": 1719143055300000000, "type": "default_type", "rawType": "default_type", "name": "KxdcIbCA", "rawName": "KxdcIbCA", "status": 1, "custom_status": "", "resolution_status": "", "reason": "", "created": "2024-06-23T11:44:15.3Z", "occurred": "2024-06-23T11:44:15.673434077Z", "closed": "0001-01-01T00:00:00Z", "sla": 0, "severity": 1, "investigationId": "207461", "labels": [ { "value": "user@company.com", "type": "Instance" }, { "value": "Manual", "type": "Brand" } ], "attachment": "None", "details": "", "openDuration": 0, "lastOpen": "0001-01-01T00:00:00Z", "closingUserId": "", "owner": "", "activated": "0001-01-01T00:00:00Z", "closeReason": "", "rawCloseReason": "", "closeNotes": "", "playbookId": "", "dueDate": "0001-01-01T00:00:00Z", "reminder": "0001-01-01T00:00:00Z", "runStatus": "", "notifyTime": "0001-01-01T00:00:00Z", "phase": "", "rawPhase": "", "isPlayground": false, "rawJSON": "", "parent": "", "parentXDRIncident": "", "retained": false, "category": "", "rawCategory": "", "linkedIncidents": [], "linkedCount": 0, "droppedCount": 0, "sourceInstance": "user@company.com", "sourceBrand": "Manual", "canvases": "None", "lastJobRunTime": "0001-01-01T00:00:00Z", "feedBased": false, "dbotMirrorId": "", "dbotMirrorInstance": "", "dbotMirrorDirection": "", "dbotDirtyFields": "None", "dbotCurrentDirtyFields": "None", "dbotMirrorTags": "None", "dbotMirrorLastSync": "0001-01-01T00:00:00Z", "isDebug": false, "changeStatus": "", "insights": 0 } ], "notUpdated": 0, "searchAfter": "None", "searchBefore": "None", "searchAfterElastic": "None", "searchBeforeElastic": "None", "accountErrors": "None", "totalAccounts": 0 } } } } } } }, "operationId": "post-xsoar-public-v1-incident-batch", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Update a batch of incidents.\r\n\r\nTo update custom fields, add `CustomFields` under the `data` parameter (the top-level `CutomFields` parameter is not used in this API). To update incident custom fields, make them lowercase and remove all spaces. For example: \"Scan IP\" -> \"scanip\".\r\nAlternatively, to get the actual key name, use the Cortex XSOAR CLI to run `/incident_add` and look for the key that you would like to update.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateDataBatch" }, "examples": { "Example 1": { "value": { "all": false, "data": { "severity": 3 }, "filter": { "page": 0, "period": { "by": "day", "fromValue": 2 }, "query": "-status:closed", "size": 50, "sort": [ { "asc": false, "field": "id" } ] }, "ids": [ "207460", "207461" ] } } } } } } } }, "/xsoar/public/v1/relationships/search": { "post": { "summary": "Search for indicator relationships", "tags": [ "Indicators" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "ErrorsPrivateDoNotUse": null, "total": 1, "data": [ { "id": "4c14fb81091bd6f5dbbe018bb0cc255f", "version": 1, "cacheVersn": 0, "sequenceNumber": 2132, "primaryTerm": 13, "modified": "2024-06-23T12: 31: 58.108344646Z", "sizeInBytes": 852, "sortValues": [ "1719145918108", "4c14fb81091bd6f5dbbe018bb0cc255f" ], "CustomFields": { "firstseenbysource": "2024-06-23T12: 31: 51.196004Z", "lastseenbysource": "2024-06-23T12: 31: 51.196058Z" }, "entityA": "211.155.197.40", "entityAFamily": "Indicator", "entityAType": "IP", "name": "related-to", "reverseName": "related-to", "entityB": "138.159.117.139", "entityBFamily": "Indicator", "entityBType": "IP", "type": "IndicatorToIndicator", "createdInSystem": "2024-06-23T12: 31: 58.108344197Z", "updatedInSystemBySource": "0001-01-01T00: 00: 00Z", "sources": [ { "CustomFields": { "firstseenbysource": "2024-06-23T12: 31: 51.196004Z", "lastseenbysource": "2024-06-23T12: 31: 51.196058Z" }, "createdInSystem": "2024-06-23T12: 31: 58.10772566Z", "updatedInSystem": "2024-06-23T12: 31: 58.10772566Z", "instance": "@", "isManual": true } ] } ], "SearchAfter": [ "1719145918108", "4c14fb81091bd6f5dbbe018bb0cc255f" ], "SearchBefore": [ "1719145918108", "4c14fb81091bd6f5dbbe018bb0cc255f" ] } }, "properties": { "total": { "type": "integer" }, "data": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "sortValues": { "type": "array", "items": { "type": "string" } }, "CustomFields": { "type": "object", "properties": { "firstseenbysource": { "type": "string" }, "lastseenbysource": { "type": "string" } } }, "entityA": { "type": "string" }, "entityAFamily": { "type": "string" }, "entityAType": { "type": "string" }, "name": { "type": "string" }, "reverseName": { "type": "string" }, "entityB": { "type": "string" }, "entityBFamily": { "type": "string" }, "entityBType": { "type": "string" }, "type": { "type": "string" }, "createdInSystem": { "type": "string" }, "updatedInSystemBySource": { "type": "string" }, "sources": { "type": "array", "items": { "type": "object", "properties": { "CustomFields": { "type": "object", "properties": { "firstseenbysource": { "type": "string" }, "lastseenbysource": { "type": "string" } } }, "createdInSystem": { "type": "string" }, "updatedInSystem": { "type": "string" }, "instance": { "type": "string" }, "isManual": { "type": "boolean" } } } } } } }, "SearchAfter": { "type": "array", "items": { "type": "string" } }, "SearchBefore": { "type": "array", "items": { "type": "string" } } } }, "examples": { "Example 1": { "value": { "ErrorsPrivateDoNotUse": null, "total": 1, "data": [ { "id": "4c14fb81091bd6f5dbbe018bb0cc255f", "version": 1, "cacheVersn": 0, "sequenceNumber": 2132, "primaryTerm": 13, "modified": "2024-06-23T12: 31: 58.108344646Z", "sizeInBytes": 852, "sortValues": [ "1719145918108", "4c14fb81091bd6f5dbbe018bb0cc255f" ], "CustomFields": { "firstseenbysource": "2024-06-23T12: 31: 51.196004Z", "lastseenbysource": "2024-06-23T12: 31: 51.196058Z" }, "entityA": "211.155.197.40", "entityAFamily": "Indicator", "entityAType": "IP", "name": "related-to", "reverseName": "related-to", "entityB": "138.159.117.139", "entityBFamily": "Indicator", "entityBType": "IP", "type": "IndicatorToIndicator", "createdInSystem": "2024-06-23T12: 31: 58.108344197Z", "updatedInSystemBySource": "0001-01-01T00: 00: 00Z", "sources": [ { "CustomFields": { "firstseenbysource": "2024-06-23T12: 31: 51.196004Z", "lastseenbysource": "2024-06-23T12: 31: 51.196058Z" }, "createdInSystem": "2024-06-23T12: 31: 58.10772566Z", "updatedInSystem": "2024-06-23T12: 31: 58.10772566Z", "instance": "@", "isManual": true } ] } ], "SearchAfter": [ "1719145918108", "4c14fb81091bd6f5dbbe018bb0cc255f" ], "SearchBefore": [ "1719145918108", "4c14fb81091bd6f5dbbe018bb0cc255f" ] } } } } } } }, "operationId": "post-xsoar-public-v1-relationships-search", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Search for a relationship between two indicators. You can search by indicator value, time, or retrieve all indicator relationships.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "fromDate": "2024-06-23T12:31:56.998186Z" } }, "properties": { "fromDate": { "type": "string" }, "entities": { "type": "array", "items": { "type": "string" } } } }, "examples": { "Search by date": { "value": { "fromDate": "2024-06-23T12:31:56.998186Z" } }, "Search by entities": { "value": { "entities": [ "188.240.220.62" ] } } } } } } } }, "/xsoar/public/v1/entry/upload/{incident_id}": { "post": { "summary": "Upload content to an incident War Room entry", "tags": [ "Entry" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "cacheVersn": 0, "category": "", "childs": null, "closed": "0001-01-01T00:00:00Z", "created": "2024-06-24T10:30:40.976Z", "creatingUserId": "user@company.com", "dbotCreatedBy": "user@company.com", "details": "", "entries": [ { "IndicatorTimeline": null, "InstanceID": "", "Relationships": null, "brand": "none", "cacheVersn": 0, "category": "artifact", "contents": "", "contentsSize": 0, "created": "2024-06-24T10:40:34.49701084Z", "cronView": false, "dbotCreatedBy": "user@company.com", "endingDate": "0001-01-01T00:00:00Z", "entryTask": null, "errorSource": "", "file": "1gnUV0aC.text", "fileID": "fda567c4-bc89-4d7c-6ad2-08b0bb911f14", "fileMetadata": { "info": "ASCII text, with no line terminators", "isMediaFile": false, "md5": "fddbae73afdf86e3dc83a48f8c14d718", "sha1": "b82a24c6b135c47c8652b58f9796bba4c7de76ab", "sha256": "70b2f290b658a1e7283555e6f01cb3741463b40208c5d4459cfa76740b52e555", "sha512": "cfba49672d091c16a3aa4c62b41cd2f6a8008e6bd9e0cf5980748c248ace8ec0c546c5d6603074561763afea1172d591a913a0b22f181b77e3997c4b12b5f9b5", "size": 15, "ssdeep": "3:NvREvnn:xy/", "type": "text" }, "format": "", "id": "a6aa39b4-de85-49b0-8e64-0f5321ab6bbf@209003", "incidentCreationTime": "2024-06-24T10:40:34.49701084Z", "investigationCreationTime": "2024-06-24T10:30:40.976Z", "investigationId": "209003", "isTodo": false, "mirrored": false, "modified": "2024-06-24T10:40:35.072703082Z", "note": false, "parentContent": null, "parentEntryTruncated": false, "parentId": "", "pinned": false, "playbookId": "", "recurrent": false, "reputationSize": 0, "reputations": null, "retryTime": "0001-01-01T00:00:00Z", "scheduled": false, "scheduledEntryGuid": "", "sizeInBytes": 0, "startDate": "0001-01-01T00:00:00Z", "system": "", "tags": [], "tagsRaw": [], "taskId": "", "times": 0, "timezoneOffset": 0, "type": 3, "user": "", "version": 2 } ], "entryUsers": null, "highPriority": false, "id": "209003", "invContext": null, "isDebug": false, "lastOpen": "0001-01-01T00:00:00Z", "mirrorAutoClose": null, "mirrorTypes": null, "modified": "0001-01-01T00:00:00Z", "name": "rocket_fkyPQPcS", "rawCategory": "", "reason": null, "runStatus": "", "sizeInBytes": 0, "slackMirrorAutoClose": false, "slackMirrorType": "", "status": 0, "systems": null, "tags": null, "totalEntries": 0, "type": 0, "users": [ "user@company.com" ], "version": 1 } }, "properties": { "cacheVersn": { "type": "integer" }, "category": { "type": "string" }, "childs": { "nullable": true }, "closed": { "type": "string" }, "created": { "type": "string" }, "creatingUserId": { "type": "string" }, "dbotCreatedBy": { "type": "string" }, "details": { "type": "string" }, "entries": { "type": "array", "items": { "$ref": "#/components/schemas/Entry" } }, "entryUsers": { "nullable": true }, "highPriority": { "type": "boolean" }, "id": { "type": "string" }, "invContext": { "nullable": true }, "isDebug": { "type": "boolean" }, "lastOpen": { "type": "string" }, "mirrorAutoClose": { "nullable": true }, "mirrorTypes": { "nullable": true }, "modified": { "type": "string" }, "name": { "type": "string" }, "rawCategory": { "type": "string" }, "reason": { "nullable": true }, "runStatus": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "slackMirrorAutoClose": { "type": "boolean" }, "slackMirrorType": { "type": "string" }, "status": { "type": "integer" }, "systems": { "nullable": true }, "tags": { "nullable": true }, "totalEntries": { "type": "integer" }, "type": { "type": "integer" }, "users": { "type": "array", "items": { "type": "string" } }, "version": { "type": "integer" } } }, "examples": { "Example 1": { "value": { "cacheVersn": 0, "category": "", "childs": null, "closed": "0001-01-01T00:00:00Z", "created": "2024-06-24T10:30:40.976Z", "creatingUserId": "user@company.com", "dbotCreatedBy": "user@company.com", "details": "", "entries": [ { "IndicatorTimeline": null, "InstanceID": "", "Relationships": null, "brand": "none", "cacheVersn": 0, "category": "artifact", "contents": "", "contentsSize": 0, "created": "2024-06-24T10:40:34.49701084Z", "cronView": false, "dbotCreatedBy": "user@company.com", "endingDate": "0001-01-01T00:00:00Z", "entryTask": null, "errorSource": "", "file": "1gnUV0aC.text", "fileID": "fda567c4-bc89-4d7c-6ad2-08b0bb911f14", "fileMetadata": { "info": "ASCII text, with no line terminators", "isMediaFile": false, "md5": "fddbae73afdf86e3dc83a48f8c14d718", "sha1": "b82a24c6b135c47c8652b58f9796bba4c7de76ab", "sha256": "70b2f290b658a1e7283555e6f01cb3741463b40208c5d4459cfa76740b52e555", "sha512": "cfba49672d091c16a3aa4c62b41cd2f6a8008e6bd9e0cf5980748c248ace8ec0c546c5d6603074561763afea1172d591a913a0b22f181b77e3997c4b12b5f9b5", "size": 15, "ssdeep": "3:NvREvnn:xy/", "type": "text" }, "format": "", "id": "a6aa39b4-de85-49b0-8e64-0f5321ab6bbf@209003", "incidentCreationTime": "2024-06-24T10:40:34.49701084Z", "investigationCreationTime": "2024-06-24T10:30:40.976Z", "investigationId": "209003", "isTodo": false, "mirrored": false, "modified": "2024-06-24T10:40:35.072703082Z", "note": false, "parentContent": null, "parentEntryTruncated": false, "parentId": "", "pinned": false, "playbookId": "", "recurrent": false, "reputationSize": 0, "reputations": null, "retryTime": "0001-01-01T00:00:00Z", "scheduled": false, "scheduledEntryGuid": "", "sizeInBytes": 0, "startDate": "0001-01-01T00:00:00Z", "system": "", "tags": [], "tagsRaw": [], "taskId": "", "times": 0, "timezoneOffset": 0, "type": 3, "user": "", "version": 2 } ], "entryUsers": null, "highPriority": false, "id": "209003", "invContext": null, "isDebug": false, "lastOpen": "0001-01-01T00:00:00Z", "mirrorAutoClose": null, "mirrorTypes": null, "modified": "0001-01-01T00:00:00Z", "name": "rocket_fkyPQPcS", "rawCategory": "", "reason": null, "runStatus": "", "sizeInBytes": 0, "slackMirrorAutoClose": false, "slackMirrorType": "", "status": 0, "systems": null, "tags": null, "totalEntries": 0, "type": 0, "users": [ "user@company.com" ], "version": 1 } } } } } } }, "operationId": "post-xsoar-public-v1-entry-upload", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary" }, "fileComment": { "type": "string" }, "isNoteEntry": { "type": "string" }, "showMediaFiles": { "type": "string" }, "tags": { "type": "string" } } } } } }, "x-internal": false }, "parameters": [ { "schema": { "type": "string" }, "name": "incident_id", "in": "path", "required": true } ] }, "/xsoar/public/v1/indicator/create": { "post": { "summary": "Create an indicator", "tags": [ "Indicators" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IocObject" }, "examples": { "Example 1": { "value": { "id": "7dfdd5a322a35b2f2784f94e95f478a9", "version": 1, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "comments": [ { "id": "a41130da-24af-4aa0-89cd-52ed3acae6ac", "version": 0, "cacheVersn": 0, "modified": "0001-01-01T00:00:00Z", "sizeInBytes": 0, "content": "Created", "user": "PAPIUser_9028", "created": "2024-06-24T10:49:59.765912207Z", "type": "IndicatorCommentTimeLine", "source": "PAPIUser_9028", "entryId": "", "category": "Sighting" } ], "indicator_type": "IP", "value": "205.170.200.177", "lastSeen": "2024-06-24T10:49:59.765942327Z", "firstSeen": "2024-06-24T10:49:59.765942327Z", "lastSeenEntryID": "Manual", "firstSeenEntryID": "Manual", "score": 0, "expiration": "2024-07-01T10:49:59.765941318Z", "expirationStatus": "active", "expirationSource": { "setTime": "2024-06-24T10:49:59.765941318Z", "source": "indicatorType", "user": "", "brand": "", "instance": "", "moduleId": "", "expirationPolicy": "indicatorType", "expirationInterval": 10080 }, "manuallyEditedFields": [ "indicator_type" ], "isDetectable": false, "isPreventable": false } } } } } } }, "operationId": "post-xsoar-public-v1-indicator-create", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Create an indicator entity. \r\n\r\nTo update indicator custom fields, they should be in lowercase with all spaces removed. For example: \"Scan IP\" -> \"scanip\".", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IndicatorContext" }, "examples": { "Example 1": { "value": { "indicator": { "indicator_type": "IP", "manuallyEditedFields": [ "indicator_type" ], "value": "204.190.200.188" }, "manually": true, "seenNow": true } } } } } } } }, "/xsoar/public/v1/indicators/batch/exportToCsv": { "post": { "summary": "Batch export indicators to CSV", "tags": [ "Indicators" ], "responses": { "200": { "description": "OK - returns the CSV filename.", "content": { "application/json": { "schema": { "type": "string" }, "examples": { "Example 1": { "value": { "indicators_report_Thu_15_Aug_2024_12_52_21_UTC.csv": null } } } } } } }, "operationId": "post-public_api-v1-indicators-batch-exportToCsv", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Export a batch of indicators to a CSV file and receive the file ID in response. You can then use [Get indicators as a CSV file](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/indicators#get-xsoar-public-v1-indicators-csv-filename) to download the CSV file.\r\nYou can define the columns as well as filter the indicators to be included in the CSV file.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/genericIndicatorUpdateBatch" }, "examples": { "Example 1": { "value": { "ids": [ "3d8b6c2cad7900ce8dea531898e9e5fb", "23efd9dee6cd3bcc948f141885ceb0be" ], "all": false, "filter": { "page": 0, "size": 50, "query": "", "sort": [ { "field": "id", "asc": false } ], "period": { "by": "day", "fromValue": 7 } }, "columns": [ "id", "value", "score", "expirationStatus" ] } } } } }, "description": "Required parameters are `columns` and `filter`. \r\nYou must include either `all` or `ids`.\r\n" } }, "parameters": [] }, "/xsoar/public/v1/indicators/csv/{filename}": { "parameters": [ { "schema": { "type": "string" }, "name": "filename", "in": "path", "required": true, "description": "Filename of the CSV file outputted by the \"Batch export indicators to CSV\" API call" } ], "get": { "summary": "Get a batch of indicators in a CSV file", "tags": [ "Indicators" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary", "description": "Example content of the CSV file:\r\n\r\n\"id,value,verdict,expirationStatus\r\n9072e24d0da6620bf4ede78e5f990ddc,indicator_mZe0qZxl,Unknown,active\r\n7dacf1c7866f34ac1b84711a5ddfd33c,indicator_u75KsXBB,Unknown,active\r\n\"" } } } } } } }, "operationId": "ge-public-v1-indicators-csv-file", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Download the indicator details in a CSV file format after preparing it by calling the [Batch export indicators to CSV](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/indicators#post-xsoar-public-v1-indicators-batch-exporttocsv) API endpoint. The response of that call contains the prepared indicator report filename with a timestamp. Use that filename as the path parameter in this API endpoint to download the file.\r\n\r\nNote: To use cURL to run this command, add the `-O` curl command for downloading a file to the current folder, or `-o /my_custom_location/my_custom_name.csv` to customize the destination of the downloaded file.\r\nFor example:\r\n``` curl\r\ncurl \"https://api-yourfqdn/xsoar/public/v1/indicators/csv/indicators_report_Mon_12_Aug_2024_10_06_04_UTC.csv\" \r\n-H 'content-type: application/json' \r\n-H 'accept: application/json' \r\n-H \"Authorization:$api_key\" \r\n-H \"x-xdr-auth-id:$api_key_id\" \r\n-O \r\n```" } }, "/xsoar/public/v1/indicators/feed/json": { "post": { "summary": "Create feed indicators from JSON", "tags": [ "Indicators" ], "responses": { "201": { "description": "Indicators created", "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } } }, "operationId": "post-public_api-v1-indicators-feed-json", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Create indicators from raw JSON (similar to ingesting from a feed). Builds indicators according to the specified feed classifier\r\nor uses the default one if not specified.\r\n\r\nThe following indicator properties can be used in the JSON to create indicators:\r\n\r\nSee the [Table for POST /xsoar/public/v1/indicators/feed/json](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/XSOAR-8-tables#table-for-post-xsoarpublicv1indicatorsfeedjson) for more details.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FeedIndicatorsRequest" }, "examples": { "Minimum required fields": { "value": { "indicators": [ { "type": "Domain", "value": "domainname.com" } ] } }, "Example": { "value": { "classifierId": "bf679c32-df59-4cd7-81ac-9af236c2db37", "mapperId": "f9e3eb36-7d29-4adf-807a-714f8dfb5365", "indicators": [ { "type": "Domain", "expirationPolicy": "interval", "expirationInterval": 10000, "value": "domainname.com", "tags": [ "MISP", "Domain" ] } ] } } } } } } }, "parameters": [] }, "/xsoar/public/v1/entry/execute/sync": { "post": { "summary": "Create new entry in existing investigation", "tags": [ "Entry" ], "responses": { "200": { "description": "OK - Returns an array of the child entries of the executed entry.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Entry" } }, "examples": { "Example 1": { "value": [ { "id": "c6f851e9-ebdf-4a7b-884a-f957856f64c1@242906", "version": 1, "cacheVersn": 0, "modified": "2024-08-15T12:50:44.693802365Z", "sizeInBytes": 0, "dbotCreatedBy": "user@company.com", "type": 1, "created": "2024-08-15T12:50:44.693779705Z", "incidentCreationTime": "2024-08-15T12:50:44.693779705Z", "investigationCreationTime": "2024-08-15T12:50:41.654Z", "retryTime": "0001-01-01T00:00:00Z", "user": "", "errorSource": "", "contents": "7ucpmYnx", "format": "markdown", "investigationId": "243905", "file": "", "fileID": "", "parentId": "a61045c9-5770-44de-8d7f-ffacdf613763@243905", "pinned": false, "fileMetadata": null, "parentContent": "!Print value=7ucpmYnx", "parentEntryTruncated": false, "system": "", "reputations": null, "category": "artifact", "note": false, "isTodo": false, "tags": null, "tagsRaw": null, "startDate": "0001-01-01T00:00:00Z", "times": 0, "recurrent": false, "endingDate": "0001-01-01T00:00:00Z", "timezoneOffset": 0, "cronView": false, "scheduled": false, "scheduledEntryGuid": "", "entryTask": null, "taskId": "", "playbookId": "", "reputationSize": 0, "contentsSize": 15, "brand": "Scripts", "instance": "Scripts", "InstanceID": "ScriptServicesModule", "IndicatorTimeline": null, "Relationships": null, "mirrored": false } ] } } } } }, "412": { "description": "Precondition Failed - The investigation is already closed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-entry-execute-sync", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Create a new entry in an existing investigation in markdown format, and get the child entries in response", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/updateEntry" }, "examples": { "Example 1": { "value": { "data": "!Print value=7ucpmYnx", "investigationId": "243905" } } } } } } }, "parameters": [] }, "/xsoar/public/v1/performance/incident/export/{incident_id}": { "parameters": [ { "schema": { "type": "string" }, "name": "incident_id", "in": "path", "required": true, "description": "Incident ID" } ], "get": { "summary": "Export an incident's history and workplan", "tags": [ "Incidents" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "filename": { "type": "string", "format": "binary", "description": "A tar.gz file containing the JSON files with the incident's history." } } } } } } }, "operationId": "get-xsoar-public_api-v1-performance-incident-export-incident_id", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Export the specified incident's history and workplan in a tar.gz file.\nNote that only playbook task entries are returned." } }, "/xsoar/public/v1/engines": { "post": { "summary": "Create an engine", "tags": [ "Engines" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "id": "0e8c1a1b-8e16-41e3-8533-f78f78a3adea", "version": -1, "cacheVersn": 0, "sequenceNumber": 2042067, "primaryTerm": 1, "modified": "2025-01-06T16:24:55.586630341Z", "sizeInBytes": 1493, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": null, "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine-sarah", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "d1_test-engine-sarah", "host": "", "user": "APIKeyUser_47", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-test-engine-sarah-8.9-1851546.sh", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "e5882e2c9b7fedf708d5ccdc0a997094", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "df2c8b968c53cd7820d1dfc5658d3934eaf8bf1f64980d74f919f2f6cab5f1bc", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}iRdHwJmIjsmePNE2nwj++hDptvtB0hozvRtziFRLwWfQMA478DW2oMOAiLUMhiBw+O24ps9dW3VTi2jAxMWdBje9T4DpYUlzYQvzgDRSVx37ganFExe7fMr8dxWIvJ2SKSxUGLvbsxxAzvbq8+57a68s0Qsl9jIK8MEPNcwFeHhuOhEbWOxZs0B9ou/r2H9utvzwUoojM1sajhnGGLNOq7IelgVYNWiTWyl+cy9IrjWksoZG6MYBQ5MFuak4YOxSLqSPxFwE1JDqY+bHGSPfBZOOLQQ1Vr+6bGizfXPbsEU=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null } }, "properties": { "id": { "type": "string", "description": "Engine ID" }, "version": { "type": "integer", "description": "Engine version" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "propagationLabels": { "nullable": true }, "definitionId": { "type": "string" }, "prevName": { "type": "string" }, "isOverridable": { "type": "boolean" }, "name": { "type": "string" }, "allowOnTenant": { "type": "boolean" }, "locked": { "type": "boolean" }, "lastSeen": { "type": "string" }, "firstSeen": { "type": "string" }, "lastConnectedApp": { "type": "string" }, "lastDisconnect": { "type": "string" }, "serviceName": { "type": "string" }, "host": { "type": "string" }, "user": { "type": "string" }, "pkgType": { "type": "string" }, "pkgName": { "type": "string" }, "config": { "type": "string" }, "baseUrl": { "type": "string" }, "engineGroup": { "type": "string" }, "protocolVersion": { "type": "string" }, "os": { "type": "string" }, "demistoVersion": { "type": "string" }, "upgradeAvailable": { "type": "boolean" }, "buildVersion": { "type": "string" }, "md5": { "type": "string" }, "underUpgrade": { "type": "boolean" }, "upgradeStartTime": { "type": "string" }, "tenantNames": { "nullable": true }, "workers": { "type": "integer" }, "isDefault": { "type": "boolean" }, "isLegacy": { "type": "boolean" }, "packageFileHash": { "type": "string" }, "pyramidAPIEncryptedAuthenticationHeader": { "type": "string" }, "pyramidAPIEncryptedAuthenticationHeaderTenants": { "nullable": true } } }, "examples": { "Example 1": { "value": { "id": "0e8c1a1b-8e16-41e3-8533-f78f78a3adea", "version": -1, "cacheVersn": 0, "sequenceNumber": 2042067, "primaryTerm": 1, "modified": "2025-01-06T16:24:55.586630341Z", "sizeInBytes": 1493, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": null, "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "d1_test-engine", "host": "", "user": "APIKeyUser_47", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-test-engine-8.9-1851546.sh", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "e5882e2c9b7fedf708d5ccdc0a997094", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "df2c8b968c52cd7820d1dfc5658d3934eaf8bc1f64980d74f919f2f6cdb5f4bc", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}iRdHwJmIjsnePNE2nwj++hDptvtB0hozvRtziFRLwWfQMA468DW2oMOAiLUMhiBw+O24ps9dW3XTi2jAxMWdBje9T4DpYUlzYQvzgDRSVx37ganFExe7fMr8dxWIvJ2SKSxUGLvbsxxAzvbq8+57a68s0Qsl9jIK8MEPNcwFeHhuOhEbWOxZs0B9ou/r2H9utvzwUoojM1sajhnGGLNOq7IelgVYNWiTWyl+cy9IrjWksoZG6MYBQ5MFuak4YOxSLqSPxFwE1JDqY+bHGSPfBZOOLQQ1Vr+6bGizfXPbsEU=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null } } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "id": "errEngineCreate", "status": 400, "title": "Failed failed creating engine", "detail": "Failed creating engine", "error": "test-engine-sarah (0e8c1a1b-8e16-41e3-8533-f78f78a3adea) already exists (33)", "encrypted": false, "multires": null } }, "properties": { "id": { "type": "string", "description": "Response ID" }, "status": { "type": "integer", "description": "Response code" }, "title": { "type": "string", "description": "Response title" }, "detail": { "type": "string", "description": "Response details" }, "error": { "type": "string", "description": "Error message" }, "encrypted": { "type": "boolean" }, "multires": { "nullable": true } } }, "examples": { "Example 1": { "value": { "id": "errEngineCreate", "status": 400, "title": "Failed failed creating engine", "detail": "Failed creating engine", "error": "test-engine (0e8c1a1b-8e16-41e3-8533-f78f78a3adea) already exists (33)", "encrypted": false, "multires": null } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 401, "err_msg": "Public API request unauthorized", "err_extra": null } } } } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-xsoar-public-v1-engines", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "An engine is a proxy server application that is installed on a remote machine and enables communication between the remote machine and the Cortex XSOAR tenant. You can run playbooks, scripts, commands, and integrations on the remote machine and the results are returned to the tenant.\n\nFor more information on Cortex XSOAR engines, see [What is an engine?](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/configure-cortex-xsiam/engines/what-is-an-engine).", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "name": "test-engine", "pkgType": "shell", "serviceName": "any-string" } }, "required": [ "name", "pkgType" ], "properties": { "name": { "type": "string", "description": "Unique name for the engine." }, "pkgType": { "enum": [ "shell", "zip", "deb", "rpm", "conf" ], "description": "Select the installer type:\n- `shell`: For all Linux deployments, including Ubuntu and SUSE. Automatically installs Docker/Podman, downloads Docker/Podman images, enables remote engine upgrade, and allows installation of multiple engines on the same machine.\n- `zip`: For Amazon Linux 2 machines.\n- `deb`: For Ubuntu operating systems.\n- `rpm`: For RHEL operating systems.\n- `conf`: A configuration file for download. When you install one of the other options, this configuration file (d1.conf) is installed on the engine machine.\n\n**Note:** Use `deb` and `rpm` installation when shell installation is not available. You need to manually install Docker or Podman and any dependencies, including enabling IPv4 forwarding. You must also install Python (including 3.x)." }, "serviceName": { "type": "string", "description": "If you are using a `shell` installer type and want to enable multiple engines to run on the same machine, enter the service name for the engine. The service name will have `d1_` added as a prefix. For example, \"d1_test-engine\"." } } }, "examples": { "Example 1": { "value": { "name": "test-engine", "pkgType": "shell", "serviceName": "test-engine" } } } } } } } }, "/xsoar/public/v1/engines/get": { "get": { "summary": "Get all engines", "tags": [ "Engines" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "engines": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "sortValues": { "type": "array", "items": { "type": "string" } }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "definitionId": { "type": "string" }, "prevName": { "type": "string" }, "isOverridable": { "type": "boolean" }, "name": { "type": "string" }, "allowOnTenant": { "type": "boolean" }, "locked": { "type": "boolean" }, "lastSeen": { "type": "string" }, "firstSeen": { "type": "string" }, "lastConnectedApp": { "type": "string" }, "lastDisconnect": { "type": "string" }, "serviceName": { "type": "string" }, "host": { "type": "string" }, "user": { "type": "string" }, "pkgType": { "type": "string" }, "pkgName": { "type": "string" }, "config": { "type": "string" }, "baseUrl": { "type": "string" }, "engineGroup": { "type": "string" }, "protocolVersion": { "type": "string" }, "os": { "type": "string" }, "demistoVersion": { "type": "string" }, "upgradeAvailable": { "type": "boolean" }, "buildVersion": { "type": "string" }, "md5": { "type": "string" }, "underUpgrade": { "type": "boolean" }, "upgradeStartTime": { "type": "string" }, "tenantNames": { "type": "null" }, "workers": { "type": "integer" }, "isDefault": { "type": "boolean" }, "isLegacy": { "type": "boolean" }, "packageFileHash": { "type": "string" }, "pyramidAPIEncryptedAuthenticationHeader": { "type": "string" }, "pyramidAPIEncryptedAuthenticationHeaderTenants": { "type": "null" }, "connected": { "type": "boolean" }, "modules": { "type": "null" }, "propagationLabels": { "type": "array", "items": { "type": "string" } } } } }, "total": { "type": "integer" }, "pkgTypes": { "type": "array", "items": { "type": "string" } }, "requestedLogs": { "type": "object", "properties": {} }, "engineGroups": { "type": "array", "items": { "type": "object", "properties": {} } } }, "x-examples": { "Example 1": { "engines": [ { "id": "3f4d65e0-3bd6-4348-82b2-17e32f8c90d7", "version": 4, "cacheVersn": 0, "sequenceNumber": 824009, "primaryTerm": 1, "modified": "2024-12-24T09:34:52.954219442Z", "sizeInBytes": 1503, "sortValues": [ "1351" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine7", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-test-engine7-8.9-1851546.sh", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "d09ec137a472510c73cbc10863533495", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "c72bf93cac3a2cdc5119574b35e916e69bdaa8ea8107dd5b8ea1bf4156ab480d", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}2geXpQuRFYiMvha+37b1WlozW6DyQPa1zi1sPZSnq2bIwGnby6+KOpE3EvPC0isznM/xVYfJSt+Hx2V/kG+kX3zQYhehXsD9H+whK67T0R5Ciaq1zggpJ7Z14mKb3C9a9qxj8jc35a7XaAHALjU925s9A7dcU9Vc/Wi0UipkinM2VSkw/IoOJdj6JDM5fP1FzLwsevaa+c1btdkP/jRbDt5TkoGGuYGmDjCjuoQEzyZRFpxM02j/rWNyLODzJ+2acL3kgFb6OL/ygLpMVINEAsyaRup5/L+2Hy9x6YZ27w4=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "99b398ef-4c41-4330-922b-bc0d7dde6026", "version": 1, "cacheVersn": 0, "sequenceNumber": 1459284, "primaryTerm": 1, "modified": "2024-12-31T07:53:26.695745201Z", "sizeInBytes": 1467, "sortValues": [ "1843" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "child1", "child2" ], "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine200", "allowOnTenant": true, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "zip", "pkgName": "/var/lib/demisto/downloads/d1_test-engine200.zip", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "3bcd9faddc7dfb0b3d8c12df4fc9bfea", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "7e6f47fb3c4456b32edb9a5d2190a9402b04e58e5e6048601551f47ef5414dfe", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}2JOPfhUjBOcbFN77NWbDmw282JaZgVHdGgrDEUi2EnIzOz+mDPY/9vFHOhludoEAZPj3lxUiTg4NujRkTrFW3d2xGjr3xTcTZmwTGNml0noVdpCJ2yhSgasUFFiTzQaeg7hFo7/XXCuTZGOjjHPT9ZK+di+AQEESDCEtgSOuLMyu9jV7ZnIXcPyFA9Y5ufGLFq2725JXH39lyZXfPyONTx49d3lqgEdbabror/lsTuAUnJI9gGJ21C7Y9v2JqgLQAq1zIUF6laG6hVVxoDKxM5tHAz8zkQ3ccFIVqHuYaHQ=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "6d091ae3-7b30-436a-9e80-ed6f2eafe9b1", "version": 1, "cacheVersn": 0, "sequenceNumber": 2036375, "primaryTerm": 1, "modified": "2025-01-06T15:10:07.979410327Z", "sizeInBytes": 1495, "sortValues": [ "5073" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "child1", "child2" ], "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine301", "allowOnTenant": true, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "rpm", "pkgName": "/var/lib/demisto/downloads/x86_64/d1_test-engine301-8.9_1851546-1.x86_64.rpm", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "8b59e476d1a10a6b5a9ad9133b43a3f3", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "ee7cecf3acc1ac35cdf9f15feeffab0595dd925d47d0125e07278041d04ebdb6", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}7FkkSjvFrbgSGRno2RZcWcl6pfj+8zv5BGIxp+h1zn3cnw8DoghtMQYK7LLigDXZ0YIVGIeBbGrZaTEwD3OzuClIm/vmnuhjFiObyJMUMt/eOGiRIL7ynHyjFHFjhY8a3hdH7N3OpdxpFwsAwDfHzathYpGoLtOrrthUkFMXF0qWiaumfbtL/AFZUpWwYk17+iY0b0N7U4Z7ASC0ntgHSgUUOvEIBvNQ1ZWw5pVP6Pl6gULiOhY/dqWlyJ4KNpnWuqq12uxJ1CtfG29ja24BF9Pz85wVdOwIByYTgB58ewc=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "c289e8e9-c3d6-4374-96ad-f6ba3c624af0", "version": 1, "cacheVersn": 0, "sequenceNumber": 2036769, "primaryTerm": 1, "modified": "2025-01-06T15:16:32.08660575Z", "sizeInBytes": 1484, "sortValues": [ "5074" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "child1", "child2" ], "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine302", "allowOnTenant": true, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "deb", "pkgName": "/var/lib/demisto/downloads/d1_test-engine302_8.9-1851546_amd64.deb", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "45580cd1ee0325e7b38389e7ed0f9505", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "cc6c0085ed0210c9fae95f65b12f7c1afa63e219caf25bb0f61bb45935f17a4f", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}E6fJMxT4+B+xE3o26o2YP7vQTeLRC250SHmZKLoD9jZq+FHclY+EaXQW0aiEYWsB+JLDEodLeQOOd1u2EpvitGwrxRyPjQu4NBnseA3UH7ZOS0SJ9Ez29zUvE96I1gE9k2weEctoCsW8387pnVbY8fxcBKgdEpE2rDEoxbh3hy753OO8xhTDL9BNv2PQ2XFwvus9e76/DBco17qsomQLmCT9VOJY0KdAPd1HtIfz3ksWetnZ9mZThMjWAV2uB3CvObx02KHQg8sEovHRrIGeIWB+Jv78lPT1GiphS6xBhIA=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "10fde7e5-21fd-29ca-972e-1a3ea099c10f", "version": 1, "cacheVersn": 0, "sequenceNumber": 2039242, "primaryTerm": 1, "modified": "2025-01-06T15:39:45.991670461Z", "sizeInBytes": 1447, "sortValues": [ "6128" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine305", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "conf", "pkgName": "/var/lib/demisto/downloads/test-engine305", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "85192e6df4f14e67d0ce782bf0e224c9", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "9aad326baa22469149b332f8a83afe8da5fe36b3a29b827e30e3b596a6e14dbd", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}NsN8Z1iNOzffU35YmPB8m8Xru2EK7cWeF0v5OY5rYdFSDXtdqL3nfad94h+ZwZ6FynyZDCWvSATa+e+qr3aaRl5RzCzBB/g8QWgALbpQky0RVvl3U9wrMC7gFJN/1dSbA1nG95Vvm3WA9lfstv5p7N2m8j6ANGVNlk5n/yASpSKogb6/SWDmZ9D4Z3B9lmxsgRLRXsKlwwDgWUG/FgybfzaCZ5x6C8pcMaLZZia8uvxpk54MsOA8Jxeim3TzGydB2cQMTZwzr2f5Gd87339il9r8gOqI3Iza0TliWryE7FU=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null } ], "total": 5, "pkgTypes": [ "shell", "zip", "deb", "rpm", "conf" ], "requestedLogs": {}, "engineGroups": [] } } }, "examples": { "Example 1": { "value": { "engines": [ { "id": "3f4d65e0-3bd6-4348-82b2-17e32f8c90d7", "version": 4, "cacheVersn": 0, "sequenceNumber": 824009, "primaryTerm": 1, "modified": "2024-12-24T09:34:52.954219442Z", "sizeInBytes": 1503, "sortValues": [ "1351" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine7", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-test-engine7-8.9-1851546.sh", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "d09ec137a472510c73cbc10863533495", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "c72bf93cac3a2cdc5119574b35e916e69bdaa8ea8107dd5b8ea1bf4156ab480d", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}2geXpQuRFYiMvha+37b1WlozW6DyQPa1zi1sPZSnq2bIwGnby6+KOpE3EvPC0isznM/xVYfJSt+Hx2V/kG+kX3zQYhehXsD9H+whK67T0R5Ciaq1zggpJ7Z14mKb3C9a9qxj8jc35a7XaAHALjU925s9A7dcU9Vc/Wi0UipkinM2VSkw/IoOJdj6JDM5fP1FzLwsevaa+c1btdkP/jRbDt5TkoGGuYGmDjCjuoQEzyZRFpxM02j/rWNyLODzJ+2acL3kgFb6OL/ygLpMVINEAsyaRup5/L+2Hy9x6YZ27w4=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "99b398ef-4c41-4330-922b-bc0d7dde6026", "version": 1, "cacheVersn": 0, "sequenceNumber": 1459284, "primaryTerm": 1, "modified": "2024-12-31T07:53:26.695745201Z", "sizeInBytes": 1467, "sortValues": [ "1843" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "child1", "child2" ], "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine200", "allowOnTenant": true, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "zip", "pkgName": "/var/lib/demisto/downloads/d1_test-engine200.zip", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "3bcd9faddc7dfb0b3d8c12df4fc9bfea", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "7e6f47fb3c4456b32edb9a5d2190a9402b04e58e5e6048601551f47ef5414dfe", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}2JOPfhUjBOcbFN77NWbDmw282JaZgVHdGgrDEUi2EnIzOz+mDPY/9vFHOhludoEAZPj3lxUiTg4NujRkTrFW3d2xGjr3xTcTZmwTGNml0noVdpCJ2yhSgasUFFiTzQaeg7hFo7/XXCuTZGOjjHPT9ZK+di+AQEESDCEtgSOuLMyu9jV7ZnIXcPyFA9Y5ufGLFq2725JXH39lyZXfPyONTx49d3lqgEdbabror/lsTuAUnJI9gGJ21C7Y9v2JqgLQAq1zIUF6laG6hVVxoDKxM5tHAz8zkQ3ccFIVqHuYaHQ=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "6d091ae3-7b30-436a-9e80-ed6f2eafe9b1", "version": 1, "cacheVersn": 0, "sequenceNumber": 2036375, "primaryTerm": 1, "modified": "2025-01-06T15:10:07.979410327Z", "sizeInBytes": 1495, "sortValues": [ "5073" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "child1", "child2" ], "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine301", "allowOnTenant": true, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "rpm", "pkgName": "/var/lib/demisto/downloads/x86_64/d1_test-engine301-8.9_1851546-1.x86_64.rpm", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "8b59e476d1a10a6b5a9ad9133b43a3f3", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "ee7cecf3acc1ac35cdf9f15feeffab0595dd925d47d0125e07278041d04ebdb6", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}7FkkSjvFrbgSGRno2RZcWcl6pfj+8zv5BGIxp+h1zn3cnw8DoghtMQYK7LLigDXZ0YIVGIeBbGrZaTEwD3OzuClIm/vmnuhjFiObyJMUMt/eOGiRIL7ynHyjFHFjhY8a3hdH7N3OpdxpFwsAwDfHzathYpGoLtOrrthUkFMXF0qWiaumfbtL/AFZUpWwYk17+iY0b0N7U4Z7ASC0ntgHSgUUOvEIBvNQ1ZWw5pVP6Pl6gULiOhY/dqWlyJ4KNpnWuqq12uxJ1CtfG29ja24BF9Pz85wVdOwIByYTgB58ewc=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "c289e8e9-c3d6-4374-96ad-f6ba3c624af0", "version": 1, "cacheVersn": 0, "sequenceNumber": 2036769, "primaryTerm": 1, "modified": "2025-01-06T15:16:32.08660575Z", "sizeInBytes": 1484, "sortValues": [ "5074" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "child1", "child2" ], "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine302", "allowOnTenant": true, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "deb", "pkgName": "/var/lib/demisto/downloads/d1_test-engine302_8.9-1851546_amd64.deb", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "45580cd1ee0325e7b38389e7ed0f9505", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "cc6c0085ed0210c9fae95f65b12f7c1afa63e219caf25bb0f61bb45935f17a4f", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}E6fJMxT4+B+xE3o26o2YP7vQTeLRC250SHmZKLoD9jZq+FHclY+EaXQW0aiEYWsB+JLDEodLeQOOd1u2EpvitGwrxRyPjQu4NBnseA3UH7ZOS0SJ9Ez29zUvE96I1gE9k2weEctoCsW8387pnVbY8fxcBKgdEpE2rDEoxbh3hy753OO8xhTDL9BNv2PQ2XFwvus9e76/DBco17qsomQLmCT9VOJY0KdAPd1HtIfz3ksWetnZ9mZThMjWAV2uB3CvObx02KHQg8sEovHRrIGeIWB+Jv78lPT1GiphS6xBhIA=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null }, { "id": "10fde7e5-21fd-29ca-972e-1a3ea099c10f", "version": 1, "cacheVersn": 0, "sequenceNumber": 2039242, "primaryTerm": 1, "modified": "2025-01-06T15:39:45.991670461Z", "sizeInBytes": 1447, "sortValues": [ "6128" ], "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine305", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "", "host": "", "user": "APIKeyUser_1", "pkgType": "conf", "pkgName": "/var/lib/demisto/downloads/test-engine305", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "85192e6df4f14e67d0ce782bf0e224c9", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "9aad326baa22469149b332f8a83afe8da5fe36b3a29b827e30e3b596a6e14dbd", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}NsN8Z1iNOzffU35YmPB8m8Xru2EK7cWeF0v5OY5rYdFSDXtdqL3nfad94h+ZwZ6FynyZDCWvSATa+e+qr3aaRl5RzCzBB/g8QWgALbpQky0RVvl3U9wrMC7gFJN/1dSbA1nG95Vvm3WA9lfstv5p7N2m8j6ANGVNlk5n/yASpSKogb6/SWDmZ9D4Z3B9lmxsgRLRXsKlwwDgWUG/FgybfzaCZ5x6C8pcMaLZZia8uvxpk54MsOA8Jxeim3TzGydB2cQMTZwzr2f5Gd87339il9r8gOqI3Iza0TliWryE7FU=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null } ], "total": 5, "pkgTypes": [ "shell", "zip", "deb", "rpm", "conf" ], "requestedLogs": {}, "engineGroups": [] } } } } } } }, "operationId": "get-xsoar-public-v1-engines-get", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Get detailed information on all of the tenant's engines, including engine names, hosts, status, and connection.\n\n**Note:** If the `name` returns with a \"d1_\" prefix, this indicates that it is a multiple engine (more than one engine running on the same machine)." } }, "/xsoar/public/v1/engines/get/{id}": { "parameters": [ { "schema": { "type": "string" }, "name": "id", "in": "path", "required": true, "description": "Engine ID" } ], "get": { "summary": "Get details by engine ID", "tags": [ "Engines" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "engines": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "definitionId": { "type": "string" }, "prevName": { "type": "string" }, "isOverridable": { "type": "boolean" }, "name": { "type": "string" }, "allowOnTenant": { "type": "boolean" }, "locked": { "type": "boolean" }, "lastSeen": { "type": "string" }, "firstSeen": { "type": "string" }, "lastConnectedApp": { "type": "string" }, "lastDisconnect": { "type": "string" }, "serviceName": { "type": "string" }, "host": { "type": "string" }, "user": { "type": "string" }, "pkgType": { "type": "string" }, "pkgName": { "type": "string" }, "config": { "type": "string" }, "baseUrl": { "type": "string" }, "engineGroup": { "type": "string" }, "protocolVersion": { "type": "string" }, "os": { "type": "string" }, "demistoVersion": { "type": "string" }, "upgradeAvailable": { "type": "boolean" }, "buildVersion": { "type": "string" }, "md5": { "type": "string" }, "underUpgrade": { "type": "boolean" }, "upgradeStartTime": { "type": "string" }, "tenantNames": { "type": "null" }, "workers": { "type": "integer" }, "isDefault": { "type": "boolean" }, "isLegacy": { "type": "boolean" }, "packageFileHash": { "type": "string" }, "pyramidAPIEncryptedAuthenticationHeader": { "type": "string" }, "pyramidAPIEncryptedAuthenticationHeaderTenants": { "type": "null" }, "connected": { "type": "boolean" }, "modules": { "type": "null" } } } }, "total": { "type": "integer" }, "pkgTypes": { "type": "array", "items": { "type": "string" } }, "requestedLogs": { "type": "object", "properties": {} }, "engineGroups": { "type": "array", "items": { "type": "object", "properties": {} } } }, "x-examples": { "Example 1": { "engines": [ { "id": "0e8c1a1b-8e16-41e3-8533-f78f78a3adea", "version": 1, "cacheVersn": 0, "sequenceNumber": 2042067, "primaryTerm": 1, "modified": "2025-01-06T16:24:55.586630341Z", "sizeInBytes": 1493, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine-sarah", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "d1_test-engine-sarah", "host": "", "user": "APIKeyUser_47", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-test-engine-sarah-8.9-1851546.sh", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "e5882e2c9b7fedf708d5ccdc0a997094", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "df2c8b968c53cd7820d1dfc5658d3934eaf8bf1f64980d74f919f2f6cab5f1bc", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}iRdHwJmIjsmePNE2nwj++hDptvtB0hozvRtziFRLwWfQMA478DW2oMOAiLUMhiBw+O24ps9dW3VTi2jAxMWdBje9T4DpYUlzYQvzgDRSVx37ganFExe7fMr8dxWIvJ2SKSxUGLvbsxxAzvbq8+57a68s0Qsl9jIK8MEPNcwFeHhuOhEbWOxZs0B9ou/r2H9utvzwUoojM1sajhnGGLNOq7IelgVYNWiTWyl+cy9IrjWksoZG6MYBQ5MFuak4YOxSLqSPxFwE1JDqY+bHGSPfBZOOLQQ1Vr+6bGizfXPbsEU=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null } ], "total": 1, "pkgTypes": [ "shell", "zip", "deb", "rpm", "conf" ], "requestedLogs": {}, "engineGroups": [] } } }, "examples": { "Example 1": { "value": { "engines": [ { "id": "0e8c1a1b-8e16-41e3-8533-f78f78a3adea", "version": 1, "cacheVersn": 0, "sequenceNumber": 2042067, "primaryTerm": 1, "modified": "2025-01-06T16:24:55.586630341Z", "sizeInBytes": 1493, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "definitionId": "", "prevName": "", "isOverridable": false, "name": "test-engine-sarah", "allowOnTenant": false, "locked": false, "lastSeen": "0001-01-01T00:00:00Z", "firstSeen": "0001-01-01T00:00:00Z", "lastConnectedApp": "", "lastDisconnect": "0001-01-01T00:00:00Z", "serviceName": "d1_test-engine-sarah", "host": "", "user": "APIKeyUser_47", "pkgType": "shell", "pkgName": "/var/lib/demisto/downloads/d1-test-engine-sarah-8.9-1851546.sh", "config": "", "baseUrl": "", "engineGroup": "", "protocolVersion": "", "os": "", "demistoVersion": "", "upgradeAvailable": false, "buildVersion": "5887a1b1fe3e0662c6a0b6d000c209407b7c0bde", "md5": "e5882e2c9b7fedf708d5ccdc0a997094", "underUpgrade": false, "upgradeStartTime": "0001-01-01T00:00:00Z", "tenantNames": null, "workers": 0, "isDefault": false, "isLegacy": false, "packageFileHash": "df2c8b968c53cd7820d1dfc5658d3934eaf8bf1f64980d74f919f2f6cab5f1bc", "pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}iRdHwJmIjsmePNE2nwj++hDptvtB0hozvRtziFRLwWfQMA478DW2oMOAiLUMhiBw+O24ps9dW3VTi2jAxMWdBje9T4DpYUlzYQvzgDRSVx37ganFExe7fMr8dxWIvJ2SKSxUGLvbsxxAzvbq8+57a68s0Qsl9jIK8MEPNcwFeHhuOhEbWOxZs0B9ou/r2H9utvzwUoojM1sajhnGGLNOq7IelgVYNWiTWyl+cy9IrjWksoZG6MYBQ5MFuak4YOxSLqSPxFwE1JDqY+bHGSPfBZOOLQQ1Vr+6bGizfXPbsEU=", "pyramidAPIEncryptedAuthenticationHeaderTenants": null, "connected": false, "modules": null } ], "total": 1, "pkgTypes": [ "shell", "zip", "deb", "rpm", "conf" ], "requestedLogs": {}, "engineGroups": [] } } } } } } }, "operationId": "get-xsoar-public-v1-engines-get-id", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Get detailed information on the specified engine, including engine name, host, status, and connection.\n\n**Note:** If the `name` returns with a \"d1_\" prefix, this indicates that it is a multiple engine (more than one engine running on the same machine)." } }, "/xsoar/public/v1/engines/download/{id}": { "parameters": [ { "schema": { "type": "string" }, "name": "id", "in": "path", "required": true, "description": "Engine ID" } ], "get": { "summary": "Download the engine configuration file", "tags": [ "Engines" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "LogLevel": { "type": "string" }, "LogFile": { "type": "string" }, "EngineURLs": { "type": "array", "items": { "type": "string" } }, "AgentURLs": { "type": "null" }, "BindAddress": { "type": "string" }, "EngineID": { "type": "string" }, "ServerPublic": { "type": "string" }, "ArtifactsFolder": { "type": "string" }, "TempFolder": { "type": "string" }, "Server.ExternalHostName": { "type": "string" }, "http.authentication.header": { "type": "string" }, "python.engine.docker": { "type": "boolean" }, "powershell.engine.docker": { "type": "boolean" } }, "x-examples": { "Example 1": { "LogLevel": "info", "LogFile": "/var/log/demisto/d1.log", "EngineURLs": [ "wss://api-mssp-xsoar-master.crtx-qa2-uat.us.paloaltonetworks.com/xsoar/d1ws" ], "AgentURLs": null, "BindAddress": ":8443", "EngineID": "10fde7e5-21fd-49ca-972e-1c3ea099c10f", "ServerPublic": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvUcSAmhhQQ4z5EDB67nHBMqggTbykBusLIAZTJA8vbBtU+bz+v/m5iJLEfZTCu8YdnYuJ8agF9F6alJW62XIN6YvO6nOzDfCQkIQhwSf1xl9E4ZRxaeuqzB9DpT2vjX7dA7PH35Ut7GDYpGO5yQTjA3h5610ZCVZlfrTQYQO8vlhq6PVaVrnnSYGufMwd68d95ei2nAEEZM52SdPA566Q/9YrNgoe10ImRGkRYHvIU58qs393GKyNT9eLtk3ptihHwP58Wq2RFOZyF6dihbVXMrbeb6NZa98KlP28zK54Bx2TU+tM/2Ifm0+J8jkhhTuL/E0bVpDYs80QRneeCrARQIDAQAB", "ArtifactsFolder": "", "TempFolder": "", "Server.ExternalHostName": "mssp-xsoar-master.crtx-qa2-uat.us.paloaltonetworks.com", "http.authentication.header": "{TOMMED}NsN8Z1iNOzffU35YmPB8m8Xru2EK7cWeF0v5OY5rYdFSDXtdqL3nfad94h+ZwZ6FynyZDCWvSATa+e+qr3aaRl5RzCzBB/g8QWgALbpQky0RVvl3U9wrMC7gFJN/1dSbA1nG95Vvm3WA9lfstv5p7N2m8j6ANGVNlk5n/yASpSKogb6/SWDmZ9D4Z3B9lmxsgRLRXsKlwwDgWUG/FgybfzaCZ5x6C8pcMaLZZia8uvxpk54MsOA8Jxeim3TzGydB2cQMTZwzr2f5Gd87339il9r8gOqI3Iza0TliWryE7FU=", "python.engine.docker": true, "powershell.engine.docker": true } } }, "examples": { "Example 1": { "value": { "LogLevel": "info", "LogFile": "/var/log/demisto/d1.log", "EngineURLs": [ "wss://api-xsoar.company.us.paloaltonetworks.com/xsoar/d1ws" ], "AgentURLs": null, "BindAddress": ":8443", "EngineID": "10fde7e5-21fe-49ca-972f-1c3ea399c10f", "ServerPublic": "MIIBIjANBgkqhdiG9w0BAQEFACOCAQ8AMIIBCgKCAQEAvUcSAmhhQQ4z5EDB67nHBMqhgTbykBusLIAZTJA8vbBtU+bz+v/m5iJLEfZTCu8YenYuJ8agF9F6alJW62ZIN6YvO6nOzDfCQkIQhwSf1xl9E4ZRxaeuqzB9DpT2vjX7dA7PH35Ut7GDYpGO5yQTjA3h5610ZCVZlfrTQYQO8vlhq6PVaVrnnSYGufMwd68d95ei2nAEEZM52SdPA566Q/9YrNgoe10ImRGkRYHvIU58qs393GKyNT9eLtk3ptihHwP58Wq2RFOZyF6dihbVXMrbeb6NZa98KlP28zK54Bx2TU+tM/2Ifm0+J8jkhhTuL/E0bVpDYs80QRneeCrARQIDAQAB", "ArtifactsFolder": "", "TempFolder": "", "Server.ExternalHostName": "xsoar.company.us.paloaltonetworks.com", "http.authentication.header": "{TOMMED}NsN8Z1iHOzffU35YmPB8m8Xru2EK7cWeF0v4OY5rYdFSDXtdqL3nfad94h+ZwZ6FynyZDCWvSATa+e+qr3abRl5RzCzBB/g8QWgALbpQky0RVvl3U9wrMC7gFJN/1dSbA1nG95Vvm3WA9lfstv5p7N2m8j6ANGVNlk5n/yASpSKogb6/SWDmZ9D4Z3B9lmxsgRLRXsKlwwDgWUG/FgybfzaCZ5x6C8pcMaLZZia8uvxpk54MsOA8Jxeim3TzGydB2cQMTZwzr2f5Gd87339il9r8gOqI3Iza0TliWryE7FU=", "python.engine.docker": true, "powershell.engine.docker": true } } } } } } }, "operationId": "get-xsoar-public-v1-engines-download-ID", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Download the `d1.conf` file to view the attribute values. This is only supported for engines installed with a configuration file (`\"pkgType\":\"conf\"`)." } }, "/xsoar/public/v1/engines/{id}": { "parameters": [ { "schema": { "type": "string" }, "name": "id", "in": "path", "required": true, "description": "Engine ID" } ], "delete": { "summary": "Delete an engine", "tags": [ "Engines" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "status": { "type": "integer" }, "title": { "type": "string" }, "detail": { "type": "string" }, "error": { "type": "string" }, "encrypted": { "type": "boolean" }, "multires": { "type": "null" } }, "x-examples": { "Example 1": { "id": "errEnginesRemove", "status": 400, "title": "Failed removing engines", "detail": "Failed removing engines", "error": "engine with id 461251e0-18ef-4c5e-a352-122ba85e262b not found", "encrypted": false, "multires": null } } }, "examples": { "Example 1": { "value": { "id": "errEnginesRemove", "status": 400, "title": "Failed removing engines", "detail": "Failed removing engines", "error": "engine with id 461231e0-18ef-4c5f-a352-122ba85e242b not found", "encrypted": false, "multires": null } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 401, "err_msg": "Public API request unauthorized", "err_extra": null } } } } } } } }, "operationId": "delete-xsoar-public-v1-engines-ID", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Delete the engine specified by engine ID." } }, "/xsoar/public/v1/engines/config": { "post": { "summary": "Update engine configuration", "tags": [ "Engines" ], "responses": { "200": { "description": "OK" }, "401": { "description": "Unauthorized" }, "405": { "description": "Method Not Allowed" } }, "operationId": "post-xsoar-public-v1-engines-config", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "id": "4c722c16-3de3-4fcd-b9ff-be12ae4d2d5d", "data": { "LogLevel": "debug", "LogFile": "/var/log/demisto/d1.log", "EngineURLs": [ "wss://api-guyba-dd.crtx-qa2-uat.us.paloaltonetworks.com/xsoar/d1ws" ], "AgentURLs": null, "BindAddress": ":8443", "EngineID": "4c722c16-3de3-4fcd-b9ff-be12ae4d2d5d", "ServerPublic": "MIIBIjANBgkqhkiG9w0GgfEPP1BbmQGKnkOK9Sfz2Z1YxBPdyBW17pjOYNAb47Ke7KjWTY9zc58pVYBXikvefrRUTAiTBdQIDAQAB", "ArtifactsFolder": "", "TempFolder": "", "Server.ExtealHostName": "guyba-dd.crtx-qa2-uat.us.paloaltonetworks.com", "http.authentication.header": "{TOMMED}Dh7MoZrkBajbbwBZvcUa2b/VYOIcA+o8Pc", "python.engine.docker": true, "powershell.engine.docker": true } } }, "properties": { "id": { "type": "string", "description": "Engine ID" }, "data": { "type": "object", "properties": { "LogLevel": { "type": "string" }, "LogFile": { "type": "string" }, "EngineURLs": { "type": "array", "items": { "type": "string" } }, "AgentURLs": { "nullable": true }, "BindAddress": { "type": "string" }, "EngineID": { "type": "string" }, "ServerPublic": { "type": "string" }, "ArtifactsFolder": { "type": "string" }, "TempFolder": { "type": "string" }, "Server.ExtealHostName": { "type": "string" }, "http.authentication.header": { "type": "string" }, "python.engine.docker": { "type": "boolean" }, "powershell.engine.docker": { "type": "boolean" } } } } }, "examples": { "Example 1": { "value": { "id": "4c732c16-3df3-4fcd-b5ff-be12ae4d2e5d", "data": { "LogLevel": "debug", "LogFile": "/var/log/demisto/d1.log", "EngineURLs": [ "wss://api-company.us.paloaltonetworks.com/xsoar/d1ws" ], "AgentURLs": null, "BindAddress": ":8443", "EngineID": "4c732c16-3df3-4fcd-b5ff-be12ae4d2e5d", "ServerPublic": "MIIBIjANBgkqhkiG9w0GgfEPP1BbmQGKnkOK9Sfz2Z1YxBPdyBW17pjOYNAb47Ke7KjWTY9zc58pVYBXikvefrRUTAiTBdQIDAQAB", "ArtifactsFolder": "", "TempFolder": "", "Server.ExtealHostName": "\u00e7", "http.authentication.header": "{TOMMED}Dh7MoZrkBajbbwBZvcUa2b/VYOIcA+o8Pc", "python.engine.docker": true, "powershell.engine.docker": true } } } } } } }, "description": "Update an engine configuration. \n\nSee [Configure Engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.5/configure-cortex-xsoar/engines/configure-engines) for a table that describes the common properties when editing an engine configuration.\n\n**Note:** The engine must be connected to update its configuration. " } }, "/xsoar/public/v1/engines/upgrade": { "post": { "summary": "Upgrade specified engines", "tags": [ "Engines" ], "responses": {}, "operationId": "post-xsoar-public-v1-engines-upgrade", "parameters": [ { "schema": { "type": "string", "example": "DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr" }, "in": "header", "name": "authorization", "description": "api_key", "required": true }, { "schema": { "type": "string", "example": "2841" }, "in": "header", "name": "x-xdr-auth-id", "description": "api_key_id", "required": true } ], "description": "Whenever there is a Cortex XSOAR major version change or a change in tenant-engine protocol version, your engines require an upgrade. In the UI on the **Engines** page, the `Status` column shows those engines that require upgrades. \n\nUse this endpoint to upgrade engines specified by their engine ID.\n\n**Note:** The engine must be connected to be upgraded. You can only upgrade engines if you have installed the engine using the Shell installer. If you didn't install the engine using the Shell installer, you need to remove the engine and do a fresh install.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "ids": [ "id1", "id2" ] } }, "properties": { "ids": { "type": "array", "description": "List of engine IDs you wish to upgrade.", "items": { "type": "string" } } } }, "examples": { "Example 1": { "value": { "ids": [ "0e8c1a1b-8e16-41e3-8533-f78f78a3adea" ] } } } } } } } }, "/public_api/v1/integrations/syslog/create": { "post": { "summary": "Create a syslog integration", "tags": [ "Syslog servers" ], "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "syslog_integration_id": { "type": "integer" }, "name": { "type": "string" } }, "x-examples": { "Example 1": { "syslog_integration_id": 630, "name": "Syslog_PAPI_Test_7H55R76T" } } }, "examples": { "Example 1": { "value": { "syslog_integration_id": 630, "name": "Test PAPI" } } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-integrations-syslog-create", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "name": "Test PAPI", "address": "34.24.11.16", "port": "1234", "protocol": "TLS", "facility": "FAC_USER", "security_info": { "certificate_name": "wf-verdict-service.key.pem", "ignore_cert_errors": false, "certificate_content": "" } } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "description": "A dictionary containing the API request fields.", "properties": { "name": { "type": "string", "description": "Unique name for the syslog server integration." }, "address": { "type": "string", "description": "IP address or fully qualified domain name (FQDN) of the syslog server." }, "port": { "type": "string", "description": "The port number on which the syslog server listens for messages." }, "protocol": { "description": "Select a method of communication:\n- TCP: No validation is made on the connection with the syslog server. However, if an error occurred with the domain used to make the connection, the Test connection will fail.\n- UDP: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.\n- TLS: Cortex validates the syslog server certificate and uses the certificate signature and public key to encrypt the data sent over the connection.", "enum": [ "TCP", "UDP", "TLS" ] }, "facility": { "type": "string", "description": "Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424)." }, "security_info": { "type": "object", "description": "The `security_info` parameters are necessary only when `protocol` is `TLS`.", "properties": { "certificate_name": { "type": "string", "description": "When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here." }, "ignore_cert_errors": { "type": "boolean", "description": "Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to `true`, logs will be forwarded even if the certificate contains errors." }, "certificate_content": { "type": "string", "format": "binary", "description": "Binary string of the certificate." } } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "address": "xdr-splunk-qa.traps.company.com", "facility": "FAC_USER", "name": "Syslog_PAPI_Test_7H55R76T", "port": 5006, "protocol": "TCP", "security_info": "None" } } }, "Example 2": { "value": { "request_data": { "address": "xdr-splunk-qa.traps.paloaltonetworks.com", "facility": "FAC_USER", "name": "Syslog_PAPI_Test_2QYH3VGS", "port": 5002, "protocol": "TLS", "security_info": { "ignore_cert_errors": false } } } } } } } }, "description": "Create a new syslog integration.\n\nYou must have **View/Edit Alert Notification** permissions to run this endpoint." } }, "/public_api/v1/integrations/syslog/get": { "post": { "summary": "Get all or filtered syslog servers", "tags": [ "Syslog servers" ], "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "objects_count": 4, "objects": [ { "SYSLOG_INTEGRATION_ID": 627, "SYSLOG_INTEGRATION_NAME": "EditSyslogFailedAuditLogsTest_72f97e2a94b043fd9f91d9b23f161e43", "SYSLOG_INTEGRATION_ADDRESS": "xdr-splunk-qa.traps.paloaltonetworks.com", "SYSLOG_INTEGRATION_PORT": 5004, "SYSLOG_INTEGRATION_PROTOCOL": "UDP", "FACILITY": "FAC_USER", "SYSLOG_INTEGRATION_STATUS": "ACTIVE", "SYSLOG_INTEGRATION_ERROR": null, "SYSLOG_INTEGRATION_CERTIFICATE_NAME": null }, { "SYSLOG_INTEGRATION_ID": 630, "SYSLOG_INTEGRATION_NAME": "Syslog_PAPI_Test_7H55R76T", "SYSLOG_INTEGRATION_ADDRESS": "xdr-splunk-qa.traps.paloaltonetworks.com", "SYSLOG_INTEGRATION_PORT": 5006, "SYSLOG_INTEGRATION_PROTOCOL": "TCP", "FACILITY": "FAC_USER", "SYSLOG_INTEGRATION_STATUS": "ACTIVE", "SYSLOG_INTEGRATION_ERROR": null, "SYSLOG_INTEGRATION_CERTIFICATE_NAME": null }, { "SYSLOG_INTEGRATION_ID": 631, "SYSLOG_INTEGRATION_NAME": "Syslog_PAPI_Test_2QYH3VGS", "SYSLOG_INTEGRATION_ADDRESS": "xdr-splunk-qa.traps.paloaltonetworks.com", "SYSLOG_INTEGRATION_PORT": 5002, "SYSLOG_INTEGRATION_PROTOCOL": "TLS", "FACILITY": "FAC_USER", "SYSLOG_INTEGRATION_STATUS": "ACTIVE", "SYSLOG_INTEGRATION_ERROR": null, "SYSLOG_INTEGRATION_CERTIFICATE_NAME": null, "SYSLOG_INTEGRATION_IGNORE_CERTIFICATE_ERROR": "FALSE" }, { "SYSLOG_INTEGRATION_ID": 632, "SYSLOG_INTEGRATION_NAME": "Syslog_PAPI_Test_6R951Z86", "SYSLOG_INTEGRATION_ADDRESS": "xdr-splunk-qa.traps.paloaltonetworks.com", "SYSLOG_INTEGRATION_PORT": 5006, "SYSLOG_INTEGRATION_PROTOCOL": "TCP", "FACILITY": "FAC_USER", "SYSLOG_INTEGRATION_STATUS": "ACTIVE", "SYSLOG_INTEGRATION_ERROR": null, "SYSLOG_INTEGRATION_CERTIFICATE_NAME": null } ] } }, "properties": { "objects_count": { "type": "integer", "description": "The number of syslog servers that are returned." }, "objects": { "type": "array", "description": "The syslog server details.", "items": { "type": "object", "properties": { "SYSLOG_INTEGRATION_ID": { "type": "integer" }, "SYSLOG_INTEGRATION_NAME": { "type": "string", "description": "Syslog server integration name." }, "SYSLOG_INTEGRATION_ADDRESS": { "type": "string", "description": "IP address or fully qualified domain name (FQDN) of the syslog server." }, "SYSLOG_INTEGRATION_PORT": { "type": "integer", "description": "The port number on which the syslog server listens for messages." }, "SYSLOG_INTEGRATION_PROTOCOL": { "type": "string", "description": "The communication protocol:\n- TCP: No validation is made on the connection with the syslog server. However, if an error occurred with the domain used to make the connection, the Test connection will fail.\n- UDP: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.\n- TLS: Cortex validates the syslog server certificate and uses the certificate signature and public key to encrypt the data sent over the connection." }, "FACILITY": { "type": "string" }, "SYSLOG_INTEGRATION_STATUS": { "type": "string" }, "SYSLOG_INTEGRATION_ERROR": { "nullable": true }, "SYSLOG_INTEGRATION_CERTIFICATE_NAME": { "nullable": true }, "SYSLOG_INTEGRATION_IGNORE_CERTIFICATE_ERROR": { "type": "string" } } } } } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-integrations-syslog-get", "description": "Get a complete or filtered list of syslog servers.\n\nYou must have **View Alert Notification** permissions to run this endpoint.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "filters": [ { "field": "name", "operator": "EQ", "value": "Test PAP" } ] } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "description": "A dictionary containing the API request fields. An empty dictionary returns all results.", "properties": { "filters": { "type": "array", "description": "Array of filter fields. Each JSON object must contain a field, operator, and value.", "items": { "type": "object", "properties": { "field": { "enum": [ "name", "id", "address", "status" ], "description": "String that identifies the syslog server field the filter is matching. Filters are based on the following case-sensitive keywords:\n\n- `name`\n- `id`\n- `address`\n- `status`" }, "operator": { "enum": [ "eq" ], "description": "String that identifies the comparison operator you want to use for this filter. Valid operator keywords and corresponding filter fields are:\n- **eq** - used with `name`, `id`, `address`, and `status`" }, "value": { "type": "string", "description": "Value that the filter must match. The contents of this field will differ depending on the website field that you specified for this filter:\n\n- name - string" } } } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "filters": [ { "field": "id", "operator": "eq", "value": "632" } ] } } }, "Example 2": { "value": { "request_data": { "filters": [ { "field": "status", "operator": "eq", "value": "ACTIVE" } ] } } } } } } } } }, "/public_api/v1/integrations/syslog/update": { "post": { "summary": "Update a syslog integration", "tags": [ "Syslog servers" ], "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "boolean", "description": "Whether the update was successful." } } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-integrations-syslog-update", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "syslog_id": "123456789", "name": "Test PAPI", "address": "35.27.11.16", "port": "1234", "protocol": "TLS", "facility": "FAC_USER", "security_info": { "certificate_name": "wf-verdict-service.key.pem", "ignore_cert_errors": false, "certificate_content": "" } } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "syslog_id" ], "description": "A dictionary containing the API request fields.", "properties": { "syslog_id": { "type": "string", "description": "ID of the syslog server" }, "name": { "type": "string", "description": "Unique name for the syslog server integration." }, "address": { "type": "string", "description": "IP address or fully qualified domain name (FQDN) of the syslog server." }, "port": { "type": "string", "description": "The port number on which the syslog server listens for messages." }, "protocol": { "description": "Select a method of communication:\n- `TCP`: No validation is made on the connection with the syslog server. However, if an error occurred with the domain used to make the connection, the Test connection will fail.\n- `UDP`: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.\n- `TLS`: Cortex validates the syslog server certificate and uses the certificate signature and public key to encrypt the data sent over the connection.", "enum": [ "TCP", "UDP", "TLS" ] }, "facility": { "type": "string", "description": "Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424)." }, "security_info": { "type": "object", "description": "The `security_info` parameters are relevant only when `protocol` is `TLS`.", "properties": { "certificate_name": { "type": "string", "description": "When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here." }, "ignore_cert_errors": { "type": "boolean", "description": "Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to `true`, logs will be forwarded even if the certificate contains errors." }, "certificate_content": { "type": "string", "description": "Binary string of the certificate.", "format": "binary" } } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "syslog_id": "123456789", "name": "Test PAPI", "address": "34.24.11.16", "port": "1234", "protocol": "TLS", "facility": "FAC_USER", "security_info": { "certificate_name": "wf-verdict-service.key.pem", "ignore_cert_errors": false, "certificate_content": "" } } } } } } } }, "description": "Update the details of the specified syslog integration.\n\nYou must have **View/Edit Alert Notification** permissions to run this endpoint." } }, "/public_api/v1/integrations/syslog/delete": { "post": { "summary": "Delete all or filtered syslog integrations", "tags": [ "Syslog servers" ], "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-integrations-syslog-delete", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "filters": [ { "field": "name", "operator": "EQ", "value": "Test PAP" } ] } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "description": "A dictionary containing the API request fields. An empty dictionary deletes all syslog servers.", "properties": { "filters": { "type": "array", "description": "Array of filter fields. Each JSON object must contain a field, operator, and value.", "items": { "type": "object", "properties": { "field": { "description": "String that identifies the syslog server field the filter is matching. Filters are based on the following case-sensitive keywords:\n\n- `name`", "enum": [ "name" ] }, "operator": { "description": "String that identifies the comparison operator you want to use for this filter. Valid operator keywords and corresponding filter fields are:\n- **eq** - used with `name`", "enum": [ "eq" ] }, "value": { "type": "string", "description": "Value that the filter must match. The contents of this field will differ depending on the website field that you specified for this filter:\n\n- name - string" } } } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "filters": [ { "field": "name", "operator": "eq", "value": "Default syslog server" } ] } } } } } } }, "description": "Delete all the syslog integrations or the ones who match the filter criteria.\n\nYou must have **View/Edit Alert Notification** permissions to run this endpoint." } }, "/public_api/v1/integrations/syslog/test": { "post": { "summary": "Test syslog integration", "tags": [ "Syslog servers" ], "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-integrations-syslog-test", "description": "Tests a syslog integration's validity.\n\nYou must have **View Alert Notification** permissions to run this endpoint.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "syslog_id": "123456789", "name": "Test PAPI", "address": "34.24.11.16", "port": "1234", "protocol": "TLS", "facility": "FAC_USER", "security_info": { "certificate_name": "wf-verdict-service.key.pem", "ignore_cert_errors": false, "certificate_content": "" } } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "description": "A dictionary containing the API request fields.", "properties": { "syslog_id": { "type": "string", "description": "If you include the `syslog_id` of an existing syslog integration, it will try to load the certificate data from the database to test the existing syslog integration." }, "name": { "type": "string", "description": "Unique name for the syslog server integration." }, "address": { "type": "string", "description": "IP address or fully qualified domain name (FQDN) of the syslog server." }, "port": { "type": "string", "description": "The port number on which the syslog server listens for messages." }, "protocol": { "description": "Select a method of communication:\n- `TCP`: No validation is made on the connection with the syslog server. However, if an error occurred with the domain used to make the connection, the Test connection will fail.\n- `UDP`: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.\n- `TLS`: Cortex validates the syslog server certificate and uses the certificate signature and public key to encrypt the data sent over the connection.", "enum": [ "TCP", "UDP", "TLS" ] }, "facility": { "type": "string", "description": "Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424)." }, "security_info": { "type": "object", "description": "The `security_info` parameters are relevant only when `protocol` is `TLS`.", "properties": { "certificate_name": { "type": "string", "description": "When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here." }, "ignore_cert_errors": { "type": "boolean", "description": "Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to `true`, logs will be forwarded even if the certificate contains errors." }, "certificate_content": { "type": "string", "format": "binary", "description": "Binary string of the certificate." } } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "name": "Test PAPI", "address": "34.24.11.16", "port": "1234", "protocol": "TLS", "facility": "FAC_USER" } } } } } } } } }, "/public_api/v1/authentication-settings/create": { "post": { "summary": "Create authentication settings for IdP SSO or metadata URL", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "boolean" } }, "x-examples": { "Example 1": { "reply": true } } }, "examples": { "Example 1": { "value": { "reply": true } } } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-authentication-settings-create", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Create authentication settings for IdP SSO or metadata URL. You must include either the `metadata_url` field or all of the following fields: `idp_sso_url`, `idp_issuer`, and `idp_certificate`.\n\nYou must have **Instance Administrator** permissions to run this endpoint.", "tags": [ "Authentication settings" ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "name": "str", "default_role": "", "is_account_role": false, "domain": " ", "mappings": { "email": "str", "firstname": "str", "lastname": "str", "group_name": "str" }, "advanced_settings": { "relay_state": " ", "idp_single_logout_url": " ", "service_provider_public_cert": " ", "service_provider_private_key": " ", "authn_context_enabled": " ", "force_authn": false }, "idp_sso_url": " ", "idp_certificate": " ", "idp_issuer": " ", "metadata_url": " " } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "name", "mappings" ], "properties": { "name": { "type": "string", "description": "The name of the SSO integration." }, "default_role": { "type": "string", "description": "The default role automatically assigned to every user who authenticates to Cortex using SAML. This is an inherited role and is not the same as a direct role assigned to the user.\n\nIf a role with the same name exists on both Cortex Gateway and the tenant, the role will mapped to the role from the tenant. If you want to use specifically the role from Cortex Gateway, use the `is_account_role` parameter set to `true`." }, "is_account_role": { "type": "boolean", "default": false, "description": "Whether the role was created in Cortex Gateway or in the tenant. When the value is `true`, the role was created in Cortex Gateway." }, "domain": { "type": "string", "description": "When configuring the first SSO, this parameter should be included as empty because it is the default SSO and has a fixed, read-only value. \nFor additional SSOs, specify this IdP with an email domain (user@). When logging in, users are redirected to the IdP associated with their email domain or to the default IdP if no association exists." }, "mappings": { "type": "object", "description": "These IdP attribute mappings are dependent on your organization's IdP.", "required": [ "email", "firstname", "lastname", "group_name" ], "properties": { "email": { "type": "string", "description": "The IdP attribute mapped to the user's email address in the Syslog server." }, "firstname": { "type": "string", "description": "The IdP attribute mapped to the user's first name." }, "lastname": { "type": "string", "description": "The IdP attribute mapped to the user's last name." }, "group_name": { "type": "string", "description": "The IdP attribute mapped to the user's group membership for authorization.\n\n**Note:** Cortex requires the IdP to send the group membership as part of the SAML token. Some IdPs send values in a format that include a comma, which is not compatible with Cortex. In that case, you must configure your IdP to send a single value without a comma for each group membership. For example, if your IdP sends the Group DN (a comma-separated list), by default, you must configure IdP to send the Group CN (Common Name) instead." } } }, "advanced_settings": { "type": "object", "description": "The advanced settings are optional to configure and some are specific for a particular IdP.", "properties": { "relay_state": { "type": "string", "description": "The URL for a specific page that you want users to be directed to after they've been authenticated by your organization's IdP and log in to Cortex." }, "idp_single_logout_url": { "type": "string", "description": "The URL of the IdP's Single Logout endpoint. This ensures that when a user initiates a logout from Cortex, the identity provider logs the user out of all applications in the current identity provider login session." }, "service_provider_public_cert": { "type": "string", "description": "The Syslog server's public X.509 certificate in PEM format for IdP validation." }, "service_provider_private_key": { "type": "string", "description": "The Syslog server's private key in PEM format for signing SAML responses. (This is mostly required for ADFS)" }, "authn_context_enabled": { "type": "boolean", "default": false, "description": "Whether to remove the `RequestedAuthnContext` parameter from SAML requests.\nIf `true`, allows users to log in by using additional authentication methods." }, "force_authn": { "type": "boolean", "default": false, "description": "Whether to force users to reauthenticate to access the Cortex tenant if requested by the IdP, even if they already authenticated to access other applications." } } }, "idp_sso_url": { "type": "string", "description": "The login URL of your IdP and should be copied from your SAML integration configuration on the IdP.\nFor example:\n- Okta: https://cortex-test.okta.com/app/cortex-test/eacbt6b2jj08CasdUQ7sdf15d7/sso/SAML\n- Microsoft Azure: https://login.microsoftonline.com/6a5a9780-96a4-41ef-bf45-0535d8a70025/saml2" }, "idp_certificate": { "type": "string", "description": "The Idp's public X.509 digital certificate in PEM format for verification, which is copied from your organization's IdP." }, "idp_issuer": { "type": "string", "description": "The unique identifier of the IdP issuing SAML assertions, which is copied from your organization's IdP." }, "metadata_url": { "type": "string", "description": "The metadata URL provides information about hte IdP's capabilities, endpoints, keys, and more. \nFor example: \n- Okta: https://cortex-test.okta.com/app/exkbuuzw77Bh04V6M6b8/sso/saml/metadata\n- Microsoft Azure: https://login.microsoftonline.com/6a5a9780-96a4-41ef-bf45-0535d8a70025/saml2/metadata" } } } } }, "examples": { "Example 1": { "value": { "request_data": { "name": "IdP configuration", "default_role": "Analyst", "domain": "my-test-domain.com", "mappings": { "email": "user@company.com", "firstname": "John", "lastname": "Smith", "group_name": "analysts" }, "idp_sso_url": "https://cortex-test.okta.com/app/cortex-test/xxxxxxx/sso/SAML", "idp_certificate": "MY_CERTIFICATE_FROM_OKTA", "idp_issuer": "https://cortex-test.okta.com/idp", "advanced_settings": {}, "is_account_role": true } } } } } } } }, "parameters": [] }, "/public_api/v1/authentication-settings/update": { "post": { "summary": "Update authentication settings", "tags": [ "Authentication settings" ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "name": "str", "default_role": "", "is_account_role": false, "domain": " ", "mappings": { "email": "str", "firstname": "str", "lastname": "str", "group_name": "str" }, "advanced_settings": { "relay_state": " ", "idp_single_logout_url": " ", "service_provider_public_cert": " ", "service_provider_private_key": " ", "authn_context_enabled": " ", "force_authn": false }, "idp_sso_url": " ", "idp_certificate": " ", "idp_issuer": " ", "metadata_url": " " } } }, "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "name", "mappings" ], "properties": { "name": { "type": "string", "description": "The name of the SSO integration." }, "default_role": { "type": "string", "description": "The default role automatically assigned to every user who authenticates to Cortex using SAML. This is an inherited role and is not the same as a direct role assigned to the user.\n\nIf a role with the same name exists on both Cortex Gateway and the tenant, the role will mapped to the role from the tenant. If you want to use specifically the role from Cortex Gateway, use the `is_account_role` parameter set to `true`." }, "is_account_role": { "type": "boolean", "default": false, "description": "Whether the role was created in Cortex Gateway or in the tenant. When the value is `true`, the role was created in Cortex Gateway." }, "current_domain_value": { "type": "string", "description": "The domain whose authentication settings you want to update." }, "new_domain_value": { "type": "string", "description": "If you want to update the domain value, include a new unique domain." }, "mappings": { "type": "object", "description": "These IdP attribute mappings are dependent on your organization's IdP.", "required": [ "email", "firstname", "lastname", "group_name" ], "properties": { "email": { "type": "string", "description": "The IdP attribute mapped to the user's email address in the Syslog server." }, "firstname": { "type": "string", "description": "The IdP attribute mapped to the user's first name." }, "lastname": { "type": "string", "description": "The IdP attribute mapped to the user's last name." }, "group_name": { "type": "string", "description": "The IdP attribute mapped to the user's group membership for authorization.\n\n**Note:** Cortex requires the IdP to send the group membership as part of the SAML token. Some IdPs send values in a format that include a comma, which is not compatible with Cortex. In that case, you must configure your IdP to send a single value without a comma for each group membership. For example, if your IdP sends the Group DN (a comma-separated list), by default, you must configure IdP to send the Group CN (Common Name) instead." } } }, "advanced_settings": { "type": "object", "description": "The advanced settings are optional to configure and some are specific for a particular IdP.", "properties": { "relay_state": { "type": "string", "description": "The URL for a specific page that you want users to be directed to after they've been authenticated by your organization's IdP and log in to Cortex." }, "idp_single_logout_url": { "type": "string", "description": "The URL of the IdP's Single Logout endpoint. This ensures that when a user initiates a logout from Cortex, the identity provider logs the user out of all applications in the current identity provider login session." }, "service_provider_public_cert": { "type": "string", "description": "The Syslog server's public X.509 certificate in PEM format for IdP validation." }, "service_provider_private_key": { "type": "string", "description": "The Syslog server's private key in PEM format for signing SAML responses. (This is mostly required for ADFS)" }, "authn_context_enabled": { "type": "boolean", "default": false, "description": "Whether to remove the `RequestedAuthnContext` parameter from SAML requests.\nIf `true`, allows users to log in by using additional authentication methods." }, "force_authn": { "type": "boolean", "default": false, "description": "Whether to force users to reauthenticate to access the Cortex tenant if requested by the IdP, even if they already authenticated to access other applications." } } }, "idp_sso_url": { "type": "string", "description": "The URL of your IdP's SSO, which is a fixed, read-only value based on your tenant's URL. If you are using this parameter, you must also specify: `idp_certificate` and `idp_issuer`." }, "idp_certificate": { "type": "string", "description": "The Idp's public X.509 digital certificate in PEM format for verification, which is copied from your organization's IdP." }, "idp_issuer": { "type": "string", "description": "The unique identifier of the IdP issuing SAML assertions, which is copied from your organization's IdP." }, "metadata_url": { "type": "string", "description": "Specify your IdP SSO URL, which is a fixed, read-only value based on your tenant's URL." } } } } }, "examples": { "Example 1": { "value": { "request_data": { "name": "IDP configuration", "default_role": "Analyst", "current_domain_value": "my-test-domain.com", "new_domain_value": "my-test-domain.org", "mappings": { "email": "user@company.com", "firstname": "John", "lastname": "Smith", "group_name": "analysts" }, "idp_sso_url": "https://cortex-test.okta.com/app/cortex-test/xxxxxxx/sso/SAML", "idp_certificate": "========MY_UPDATED_TEST_CERTIFICATE_FROM_OKTA======", "idp_issuer": "https://cortex-test.okta.com/idp", "advanced_settings": {}, "is_account_role": true } } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "boolean" } }, "x-examples": { "Example 1": { "reply": true } } } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-authentication-settings-update", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Update existing authentication settings. To update the default domain, include empty value for both `current_domain_value` and `new_domain_value`.\n\nYou must have **Instance Administrator** permissions to run this endpoint." }, "parameters": [] }, "/public_api/v1/authentication-settings/delete": { "post": { "summary": "Delete authentication settings by domain", "tags": [ "Authentication settings" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "boolean" } }, "x-examples": { "Example 1": { "reply": true } } }, "examples": { "Example 1": { "value": { "reply": true } } } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-authentication-settings-delete", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Delete all authentication settings for the specified domain. \n\n**Note:** The first configuration on the tenant is the default configuration and cannot be deleted.\n\nYou must have **Instance Administrator** permissions to run this endpoint.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "domain": "str" } } }, "properties": { "request_data": { "type": "object", "properties": { "domain": { "type": "string", "description": "The domain whose authentication settings you want to delete." } } } } }, "examples": { "Example 1": { "value": { "request_data": { "domain": "my-test-domain.org" } } } } } } } } }, "/public_api/v1/authentication-settings/get/settings": { "post": { "summary": "Get authentication settings for all configured domains", "tags": [ "Authentication settings" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "array", "items": { "type": "object", "properties": { "tenant_id": { "type": "string" }, "name": { "type": "string" }, "domain": { "type": "string" }, "idp_enabled": { "type": "boolean" }, "default_role": { "type": "null" }, "is_account_role": { "type": "null" }, "idp_certificate": { "type": "string" }, "idp_issuer": { "type": "string" }, "idp_sso_url": { "type": "string" }, "metadata_url": { "type": "string" }, "mappings": { "type": "object", "properties": { "email": { "type": "string" }, "firstname": { "type": "string" }, "group_name": { "type": "string" }, "lastname": { "type": "string" } } }, "advanced_settings": { "type": "object", "properties": { "authn_context_enabled": { "type": "boolean" }, "force_authn": { "type": "null" }, "idp_single_logout_url": { "type": "string" }, "relay_state": { "type": "string" }, "service_provider_private_key": { "type": "string" }, "service_provider_public_cert": { "type": "string" } } }, "sp_entity_id": { "type": "string" }, "sp_logout_url": { "type": "string" }, "sp_url": { "type": "string" } } } } }, "x-examples": { "Example 1": { "reply": [ { "tenant_id": "9949042437653", "name": "SSO Integration", "domain": "", "idp_enabled": true, "default_role": null, "is_account_role": null, "idp_certificate": "certificate", "idp_issuer": "http://test.com", "idp_sso_url": "http://test.com/", "metadata_url": "", "mappings": { "email": "user@company.com", "firstname": "John", "group_name": "Users", "lastname": "Smith" }, "advanced_settings": { "authn_context_enabled": false, "force_authn": null, "idp_single_logout_url": "", "relay_state": "", "service_provider_private_key": "", "service_provider_public_cert": "" }, "sp_entity_id": "https://tenant.cortex.us.paloaltonetworks.com", "sp_logout_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/logout", "sp_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/saml" } ] } } }, "examples": { "Example 1": { "value": { "reply": [ { "tenant_id": "9949042437653", "name": "SSO Integration", "domain": "", "idp_enabled": true, "default_role": null, "is_account_role": null, "idp_certificate": "certificate", "idp_issuer": "http://test.com", "idp_sso_url": "http://test.com/", "metadata_url": "", "mappings": { "email": "user@company.com", "firstname": "John", "group_name": "Users", "lastname": "Smith" }, "advanced_settings": { "authn_context_enabled": false, "force_authn": null, "idp_single_logout_url": "", "relay_state": "", "service_provider_private_key": "", "service_provider_public_cert": "" }, "sp_entity_id": "https://tenant.cortex.us.paloaltonetworks.com", "sp_logout_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/logout", "sp_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/saml" } ] } } } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-authentication-settings-get-settings", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Get all the authentication settings for every configured domain in the tenant.\n\nYou must have **Instance Administrator** permissions to run this endpoint.\n", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": {} } }, "x-examples": { "Example 1": { "request_data": {} } } } } } } } }, "/public_api/v1/authentication-settings/get/metadata": { "post": { "summary": "Get IdP metadata", "tags": [ "Authentication settings" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "reply": { "sp_entity_id": "", "Sp_logout_url": "", "sp_url": "", "tenant_id": "" } } }, "properties": { "reply": { "type": "object", "properties": { "sp_entity_id": { "type": "string" }, "sp_logout_url": { "type": "string" }, "sp_url": { "type": "string" }, "tenant_id": { "type": "string" } } } } }, "examples": { "Example 1": { "value": { "reply": { "sp_entity_id": "https://tenant.cortex.us.paloaltonetworks.com", "sp_logout_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/logout", "sp_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/saml", "tenant_id": "9949042437653" } } } } } } }, "400": { "description": "Bad Request. Got an invalid JSON.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "402": { "description": "Unauthorized access. User does not have the required license type to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/reply" } } } } }, "operationId": "post-public_api-v1-authentication-settings-get-metadata", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Get the metadata for all IdPs.\n\nYou must have **Instance Administrator** permissions to run this endpoint.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": {} } }, "x-examples": { "Example 1": { "request_data": {} } } } } } } } }, "/xsoar/public/v1/indicator/edit": { "post": { "description": "Edit an indicator.\n\nTo update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip", "summary": "Edit indicator", "operationId": "post-public_api-v1-indicators-edit", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/components/schemas/IocObject" }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IocObject" }, "examples": { "Example 1": { "value": { "id": "9388", "value": "test_indicator", "indicator_type": "Host", "investigationIDs": "None", "modifiedTime": "None", "created": "0001-01-01T00:00:00Z", "modified": "0001-01-01T00:00:00Z", "calculatedTime": "None", "score": 1, "manualScore": true, "enrichAfterSave": "None", "sourceInstances": "None", "moduleToFeedMap": "None", "CustomFields": {}, "comments": [ { "content": "Created", "id": "3c4185c1-b6c8-46c9-82ed-432ca724b4b3", "source": "admin", "category": "Sighting", "type": "IndicatorCommentTimeLine", "created": "2025-01-08T07:24:46.049963Z", "modified": "0001-01-01T00:00:00Z" } ], "expirationStatus": "active", "expirationSource": { "setTime": "2025-01-08T07:24:46.049993388Z", "source": "indicatorType", "user": "", "brand": "", "instance": "", "moduleId": "", "expirationPolicy": "never", "expirationInterval": 0 }, "relatedIncCount": "None", "manuallyEditedFields": [ "indicator_type" ], "firstSeen": "2025-01-08T07:24:46.049994Z", "lastSeen": "2025-01-08T07:24:46.049994Z" } } } } } } }, "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IocObject" }, "examples": { "Example 1": { "value": { "id": "9388", "value": "test_indicator", "indicator_type": "Host", "investigationIDs": "None", "modifiedTime": "None", "created": "0001-01-01T00:00:00Z", "modified": "0001-01-01T00:00:00Z", "calculatedTime": "None", "score": 1, "manualScore": true, "enrichAfterSave": "None", "sourceInstances": "None", "moduleToFeedMap": "None", "CustomFields": {}, "comments": [ { "content": "Created", "id": "3c4185c1-b6c8-46c9-82ed-432ca724b4b3", "source": "admin", "category": "Sighting", "type": "IndicatorCommentTimeLine", "created": "2025-01-08T07:24:46.049963Z", "modified": "0001-01-01T00:00:00Z" } ], "expirationStatus": "active", "expirationSource": { "setTime": "2025-01-08T07:24:46.049993388Z", "source": "indicatorType", "user": "", "brand": "", "instance": "", "moduleId": "", "expirationPolicy": "never", "expirationInterval": 0 }, "relatedIncCount": "None", "manuallyEditedFields": [ "indicator_type" ], "firstSeen": "2025-01-08T07:24:46.049994Z", "lastSeen": "2025-01-08T07:24:46.049994Z" } } } } } }, "tags": [ "Indicators" ] } }, "/xsoar/public/v1/incident/batchDelete": { "post": { "summary": "Delete a batch of incidents", "tags": [ "Incidents" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IncidentSearchResponseWrapper" } } } } }, "operationId": "post-xsoar-public-v1-incident-batchDelete", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Delete a batch of incidents.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateDataBatch" }, "examples": { "Example 1": { "value": { "all": false, "filter": { "page": 0, "period": { "by": "day", "fromValue": 2 }, "query": "", "size": 50, "sort": [ { "asc": false, "field": "id" } ] }, "ids": [ "12128", "12129" ] } } } } } } } }, "/xsoar/public/v1/lists/download/{list_id}": { "parameters": [ { "schema": { "type": "string" }, "name": "list_id", "in": "path", "required": true } ], "get": { "summary": "Get the specified list", "tags": [ "Lists" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" } }, "examples": { "Example 1": { "value": [ "item1", "item2" ] } } } } } }, "operationId": "get-xsoar-public-v1-lists-download-list_id", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Download the list specified by list ID.\n\nFor more details on lists in XSOAR, see [Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.10/learn-about-cortex-xsoar/lists)." } }, "/xsoar/public/v1/incident/upload/{incident_id}": { "parameters": [ { "schema": { "type": "string" }, "name": "incident_id", "in": "path", "required": true } ], "post": { "summary": "Upload a file to an incident", "tags": [ "Incidents" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IncidentWrapper" }, "examples": { "Example 1": { "value": { "id": "294018", "version": -1, "cacheVersn": 0, "modified": "2025-04-27T09:43:07.284Z", "sizeInBytes": 0, "dbotCreatedBy": "user@company.com", "CustomFields": { "actionsoncampaignincidents": "Close", "actionsonlowsimilarityincidents": "Add To Campaign", "bmcassignee": [ {} ], "bmccustomer": [ {} ], "bmcrequester": [ {} ], "chronicleautoblockentities": "Yes", "chronicleskipentityisolation": "Yes", "containmentsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "crowdstrikefalconbehaviourpatterndispositiondetails": [ {}, {}, {} ], "datadogcloudsiem": [ {}, {}, {} ], "dataminrpulserelatedterms": [ {}, {}, {} ], "dbotmirrordirection": "", "decyfirdatadetails": [ {}, {}, {} ], "detectionsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 20, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "domaintoolsirisdetect": [ {}, {}, {} ], "dsassets": [ {}, {}, {} ], "dscomments": [ {}, {}, {} ], "emaildeletefrombrand": "Unspecified", "emaildeletetype": "soft", "endpoint": [ {} ], "externalid": "294018", "extrahoprevealxdetectiondevices": [ {}, {}, {} ], "extrahoprevealxmitretechniques": [ {}, {}, {} ], "filerelationships": [ {}, {}, {} ], "fortisiemattacktactics": [ {}, {} ], "fortisiemevents": [ {} ], "incidentduration": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 0, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "incidentrdpachehuntingstringssimilarity": [ {}, {}, {} ], "incidentrdpcachehuntingstringsifter": [ {}, {}, {} ], "inventasource": [ {} ], "isactive": "true", "microsoft365defendercomments": [ {}, {}, {} ], "microsoftsentinelowner": [], "qintelqwatchexposures": [ {}, {}, {} ], "remediationsla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 7200, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "riskiqautoexcludewhitelistedipaddress": "Yes", "riskiqautowhitelistipaddress": "Yes", "rsametasevents": [], "rsarawlogslist": [], "saassecuritycategory": "no_reason", "saassecurityremediationtype": "Remove public sharing", "saassecuritystate": "open", "saassecuritystatus": "open-new", "securitypolicymatch": [ {} ], "selectaction": "Close", "servicenowbusinessimpact": "1 - Critical", "servicenowcategory": "Inquiry / Help", "servicenowimpact": "1 - High", "servicenownotify": "Send Email", "servicenowpriority": "1 - Critical", "servicenowseverity": "1 - High", "servicenowsircategory": "Confidential personal identity data exposure", "servicenowsirstate": "New", "servicenowstate": "1 - New", "servicenowurgency": "1 - High", "similarincidentsdbot": [ {} ], "spycloudcompassdevicedata": [ {}, {}, {} ], "suspiciousexecutions": [ {}, {}, {} ], "timetoassignment": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 0, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "triagesla": { "accumulatedPause": 0, "breachTriggered": false, "dueDate": "0001-01-01T00:00:00Z", "endDate": "0001-01-01T00:00:00Z", "lastPauseDate": "0001-01-01T00:00:00Z", "runStatus": "idle", "sla": 30, "slaStatus": -1, "startDate": "0001-01-01T00:00:00Z", "totalDuration": 0 }, "urlsslverification": [], "xdralertsearchresults": [ {}, {}, {} ], "xdrinvestigationresults": [ {}, {}, {}, { "columnheader1": "" }, {}, { "columnheader1": "" }, {}, {} ], "xpanseserviceclassifications": [ {}, {}, {} ], "xpanseservicevalidation": [ { "columnheader1": "" }, {}, {} ] }, "account": "", "autime": 1745746984163000000, "type": "default_type", "rawType": "default_type", "name": "VhAYsOwx", "rawName": "VhAYsOwx", "status": 1, "custom_status": "", "resolution_status": "", "reason": "", "created": "2025-04-27T09:43:04.163Z", "occurred": "2025-04-27T09:43:04.551517754Z", "closed": "0001-01-01T00:00:00Z", "sla": 0, "severity": 1, "investigationId": "", "labels": [ { "value": "user@company.com", "type": "Instance" }, { "value": "Manual", "type": "Brand" } ], "attachment": [ { "name": "TUdZ0Ddm.text", "type": "text/plain", "path": "294018_c1790a2c-61d7-4ac8-8329-8883d70dae50_TUdZ0Ddm.text", "description": "", "showMediaFile": false, "isTempPath": false } ], "details": "", "openDuration": 0, "lastOpen": "0001-01-01T00:00:00Z", "closingUserId": "", "owner": "", "activated": "0001-01-01T00:00:00Z", "closeReason": "", "rawCloseReason": "", "closeNotes": "", "playbookId": "", "dueDate": "0001-01-01T00:00:00Z", "reminder": "0001-01-01T00:00:00Z", "runStatus": "", "notifyTime": "0001-01-01T00:00:00Z", "phase": "", "rawPhase": "", "isPlayground": false, "rawJSON": "", "parent": "", "parentXDRIncident": "", "retained": false, "exported": false, "category": "", "rawCategory": "", "linkedIncidents": [], "linkedCount": 0, "droppedCount": 0, "sourceInstance": "user@company.com", "sourceBrand": "Manual", "canvases": null, "lastJobRunTime": "0001-01-01T00:00:00Z", "feedBased": false, "dbotMirrorId": "", "dbotMirrorInstance": "", "dbotMirrorDirection": "", "dbotDirtyFields": null, "dbotCurrentDirtyFields": null, "dbotMirrorTags": null, "dbotMirrorLastSync": "0001-01-01T00:00:00Z", "isDebug": false, "dedupID": "", "haIntegrationEventID": "", "haOriginalID": "", "changeStatus": "", "insights": 0 } } } } } } }, "operationId": "post-xsoar-public-v1-incident-upload-incident_id", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Add a file attachment to an incident.", "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "required": [ "file" ], "properties": { "fileName": { "type": "string", "description": "File name" }, "fileComment": { "type": "string", "description": "Comment to add to the file" }, "field": { "type": "string", "description": "Field name to hold the attachment details. If not specified, `attachment` is used." }, "showMediaFile": { "type": "boolean", "description": "Whether to show media files." }, "last": { "type": "boolean", "description": "If set to `true`, creates an investigation. This is used for uploading after creating an incident." }, "file": { "type": "string", "description": "File", "format": "binary" } } }, "examples": { "Example 1": { "value": { "fileName": "documentation.log", "fileComment": "Some important comment", "field": "string", "showMediaFile": true, "last": true, "file": "documentation.log" } } } } } } } }, "/xsoar/public/v1/playbook/save/yaml": { "post": { "summary": "Upload a playbook from a YAML file", "tags": [ "Playbooks" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "playbook": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "propagationLabels": { "type": "array", "items": { "type": "string" } }, "definitionId": { "type": "string" }, "isOverridable": { "type": "boolean" }, "vcShouldIgnore": { "type": "boolean" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean" }, "commitMessage": { "type": "string" }, "shouldCommit": { "type": "boolean" }, "name": { "type": "string" }, "nameRaw": { "type": "string" }, "prevName": { "type": "string" }, "startTaskId": { "type": "string" }, "tasks": { "type": "object", "properties": { "0": { "type": "object", "properties": { "id": { "type": "string" }, "taskId": { "type": "string" }, "type": { "type": "string" }, "task": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" } } }, "nextTasks": { "type": "object", "properties": { "#none#": { "type": "array", "items": { "type": "string" } } } }, "continueOnErrorType": { "type": "string" }, "view": { "type": "object", "properties": { "position": { "type": "object", "properties": { "x": { "type": "integer" }, "y": { "type": "integer" } } } } }, "evidenceData": { "type": "object", "properties": {} } } }, "1": { "type": "object", "properties": { "id": { "type": "string" }, "taskId": { "type": "string" }, "type": { "type": "string" }, "task": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "name": { "type": "string" }, "description": { "type": "string" }, "scriptId": { "type": "string" }, "type": { "type": "string" }, "isCommand": { "type": "boolean" }, "brand": { "type": "string" } } }, "scriptArguments": { "type": "object", "properties": { "accountid": { "type": "object", "properties": { "complex": { "type": "object", "properties": { "root": { "type": "string" }, "filters": { "type": "null" }, "accessor": { "type": "string" }, "transformers": { "type": "array", "items": { "type": "object", "properties": { "operator": { "type": "string" }, "args": { "type": "object", "properties": { "prefix": { "type": "object", "properties": { "isContext": { "type": "boolean" } } }, "suffix": { "type": "object", "properties": { "value": { "type": "object", "properties": { "simple": { "type": "string" } } }, "isContext": { "type": "boolean" } } } } } } } } } } } } } }, "continueOnErrorType": { "type": "string" }, "view": { "type": "object", "properties": { "position": { "type": "object", "properties": { "x": { "type": "integer" }, "y": { "type": "integer" } } } } }, "evidenceData": { "type": "object", "properties": {} } } } } }, "taskIds": { "type": "array", "items": { "type": "string" } }, "scriptIds": { "type": "array", "items": { "type": "object", "properties": {} } }, "commands": { "type": "array", "items": { "type": "string" } }, "brands": { "type": "array", "items": { "type": "string" } }, "view": { "type": "object", "properties": { "linkLabelsPosition": { "type": "object", "properties": {} }, "paper": { "type": "object", "properties": { "dimensions": { "type": "object", "properties": { "height": { "type": "integer" }, "width": { "type": "integer" }, "x": { "type": "integer" }, "y": { "type": "integer" } } } } } } }, "inputs": { "type": "array", "items": { "type": "object", "properties": {} } }, "outputs": { "type": "array", "items": { "type": "object", "properties": {} } }, "dirtyInputs": { "type": "boolean" } } }, "warnings": { "type": "null" } }, "x-examples": { "Example 1": { "playbook": { "id": "690d9382-a937-48a7-8824-8e43d5b8f9a9", "version": 1, "cacheVersn": 0, "sequenceNumber": 91021398, "primaryTerm": 14, "modified": "2025-04-27T11:42:56.923934719Z", "sizeInBytes": 2065, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "all" ], "definitionId": "", "isOverridable": false, "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "rocket_test_upload_playbook_via_public_api_sZuIxk", "nameRaw": "rocket_test_upload_playbook_via_public_api_sZuIxk", "prevName": "rocket_test_upload_playbook_via_public_api_sZuIxk", "startTaskId": "0", "tasks": { "0": { "id": "0", "taskId": "92acfbef-2732-4a92-8781-d31be823a8ec", "type": "start", "task": { "id": "92acfbef-2732-4a92-8781-d31be823a8ec", "version": 2, "cacheVersn": 0, "sequenceNumber": 91021396, "primaryTerm": 14, "modified": "2025-04-27T11:42:56.866094324Z", "sizeInBytes": 179 }, "nextTasks": { "#none#": [ "1" ] }, "continueOnErrorType": "", "view": { "position": { "x": 450, "y": 50 } }, "evidenceData": {} }, "1": { "id": "1", "taskId": "f90c2665-c2cb-4819-8fa4-066d5671ac0d", "type": "regular", "task": { "id": "f90c2665-c2cb-4819-8fa4-066d5671ac0d", "version": 2, "cacheVersn": 0, "sequenceNumber": 91021397, "primaryTerm": 14, "modified": "2025-04-27T11:42:56.894923251Z", "sizeInBytes": 340, "name": "setIncident", "description": "Change the properties of an incident", "scriptId": "Builtin|||setIncident", "type": "regular", "isCommand": true, "brand": "Builtin" }, "scriptArguments": { "accountid": { "complex": { "root": "incident", "filters": null, "accessor": "name", "transformers": [ { "operator": "concat", "args": { "prefix": { "isContext": false }, "suffix": { "value": { "simple": "-changed_by_rocket_test_upload_playbook_via_public_api_sZuIxk" }, "isContext": false } } } ] } } }, "continueOnErrorType": "", "view": { "position": { "x": 450, "y": 230 } }, "evidenceData": {} } }, "taskIds": [ "92acfbef-2732-4a92-8781-d31be823a8ec", "f90c2665-c2cb-4819-8fa4-066d5671ac0d" ], "scriptIds": [], "commands": [ "setIncident" ], "brands": [ "Builtin" ], "view": { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 275, "width": 380, "x": 450, "y": 50 } } }, "inputs": [], "outputs": [], "dirtyInputs": true }, "warnings": null } } }, "examples": { "Example 1": { "value": { "playbook": { "id": "690d9332-c937-48a7-8824-8e43d2b8f9a9", "version": 1, "cacheVersn": 0, "sequenceNumber": 91021398, "primaryTerm": 14, "modified": "2025-04-27T11:42:56.923934719Z", "sizeInBytes": 2065, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "all" ], "definitionId": "", "isOverridable": false, "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "upload_playbook", "nameRaw": "upload_playbook", "prevName": "upload_playbook", "startTaskId": "0", "tasks": { "0": { "id": "0", "taskId": "92acabef-2752-4a92-3781-d31bc823a8ec", "type": "start", "task": { "id": "92acabef-2752-4a92-3781-d31bc823a8ec", "version": 2, "cacheVersn": 0, "sequenceNumber": 91021396, "primaryTerm": 14, "modified": "2025-04-27T11:42:56.866094324Z", "sizeInBytes": 179 }, "nextTasks": { "#none#": [ "1" ] }, "continueOnErrorType": "", "view": { "position": { "x": 450, "y": 50 } }, "evidenceData": {} }, "1": { "id": "1", "taskId": "f90c2695-c2ca-4819-3fa4-066d5971ac0d", "type": "regular", "task": { "id": "f90c2695-c2ca-4819-3fa4-066d5971ac0d", "version": 2, "cacheVersn": 0, "sequenceNumber": 91021397, "primaryTerm": 14, "modified": "2025-04-27T11:42:56.894923251Z", "sizeInBytes": 340, "name": "setIncident", "description": "Change the properties of an incident", "scriptId": "Builtin|||setIncident", "type": "regular", "isCommand": true, "brand": "Builtin" }, "scriptArguments": { "accountid": { "complex": { "root": "incident", "filters": null, "accessor": "name", "transformers": [ { "operator": "concat", "args": { "prefix": { "isContext": false }, "suffix": { "value": { "simple": "upload_playbook_via_public_api" }, "isContext": false } } } ] } } }, "continueOnErrorType": "", "view": { "position": { "x": 450, "y": 230 } }, "evidenceData": {} } }, "taskIds": [ "92acabef-2752-4a92-3781-d31bc823a8ec", "f90c2695-c2ca-4819-3fa4-066d5971ac0d" ], "scriptIds": [], "commands": [ "setIncident" ], "brands": [ "Builtin" ], "view": { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 275, "width": 380, "x": 450, "y": 50 } } }, "inputs": [], "outputs": [], "dirtyInputs": true }, "warnings": null } } } } } } }, "operationId": "post-xsoar-public-v1-playbook-save-yaml", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Import and override an existing playbook by uploading its YAML file.", "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary", "description": "File" } } } } } } } }, "/xsoar/public/v1/inv-playbook/task/add/{investigationId}": { "parameters": [ { "schema": { "type": "string" }, "name": "investigationId", "in": "path", "required": true } ], "post": { "summary": "Add ad-hoc playbook task", "tags": [ "Playbooks" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvestigationPlaybook" } } } } }, "operationId": "post-xsoar-public-v1-inv-playbook-task-add-investigationId", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Add an ad-hoc task to a running playbook.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvestigationPlaybook" } } } } } }, "/xsoar/public/v1/playbook/clone/{playbook_id}": { "parameters": [ { "schema": { "type": "string" }, "name": "playbook_id", "in": "path", "required": true, "description": "Playbook ID" } ], "post": { "summary": "Duplicate a playbook", "tags": [ "Playbooks" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "packID": { "type": "string" }, "packName": { "type": "string" }, "itemVersion": { "type": "string" }, "fromServerVersion": { "type": "string" }, "toServerVersion": { "type": "string" }, "propagationLabels": { "type": "array", "items": { "type": "string" } }, "definitionId": { "type": "string" }, "isOverridable": { "type": "boolean" }, "vcShouldIgnore": { "type": "boolean" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean" }, "commitMessage": { "type": "string" }, "shouldCommit": { "type": "boolean" }, "name": { "type": "string" }, "nameRaw": { "type": "string" }, "prevName": { "type": "string" }, "startTaskId": { "type": "string" }, "tasks": { "type": "object", "properties": { "0": { "type": "object", "properties": { "id": { "type": "string" }, "taskId": { "type": "string" }, "type": { "type": "string" }, "task": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "description": { "type": "string" }, "type": { "type": "string" } } }, "nextTasks": { "type": "object", "properties": { "#none#": { "type": "array", "items": { "type": "string" } } } }, "continueOnErrorType": { "type": "string" }, "view": { "type": "object", "properties": { "position": { "type": "object", "properties": { "x": { "type": "integer" }, "y": { "type": "integer" } } } } }, "evidenceData": { "type": "object", "properties": {} } } }, "1": { "type": "object", "properties": { "id": { "type": "string" }, "taskId": { "type": "string" }, "type": { "type": "string" }, "task": { "type": "object", "properties": { "id": { "type": "string" }, "version": { "type": "integer" }, "cacheVersn": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "primaryTerm": { "type": "integer" }, "modified": { "type": "string" }, "sizeInBytes": { "type": "integer" }, "name": { "type": "string" }, "description": { "type": "string" }, "scriptId": { "type": "string" }, "type": { "type": "string" }, "isCommand": { "type": "boolean" } } }, "scriptArguments": { "type": "object", "properties": { "value": { "type": "object", "properties": { "simple": { "type": "string" } } } } }, "continueOnErrorType": { "type": "string" }, "view": { "type": "object", "properties": { "position": { "type": "object", "properties": { "x": { "type": "integer" }, "y": { "type": "integer" } } } } }, "evidenceData": { "type": "object", "properties": {} } } } } }, "taskIds": { "type": "array", "items": { "type": "string" } }, "scriptIds": { "type": "array", "items": { "type": "object", "properties": {} } }, "commands": { "type": "array", "items": { "type": "string" } }, "brands": { "type": "array", "items": { "type": "string" } }, "view": { "type": "object", "properties": { "linkLabelsPosition": { "type": "object", "properties": {} }, "paper": { "type": "object", "properties": { "dimensions": { "type": "object", "properties": { "height": { "type": "integer" }, "width": { "type": "integer" }, "x": { "type": "integer" }, "y": { "type": "integer" } } } } } } }, "inputs": { "type": "null" }, "outputs": { "type": "null" }, "sourcePlaybookID": { "type": "string" } }, "x-examples": { "Example 1": { "id": "96a0127e-cc9b-4946-4b08-68c5ee763328", "version": 1, "cacheVersn": 0, "sequenceNumber": 91021006, "primaryTerm": 14, "modified": "2025-04-27T11:38:55.652786718Z", "sizeInBytes": 1850, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "all" ], "definitionId": "", "isOverridable": false, "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "playbook_mkj7jS4K_copy", "nameRaw": "playbook_mkj7jS4K_copy", "prevName": "playbook_mkj7jS4K_copy", "startTaskId": "0", "tasks": { "0": { "id": "0", "taskId": "db7a60dc-7e49-44a0-8111-eab74746aa8d", "type": "start", "task": { "id": "db7a60dc-7e49-44a0-8111-eab74746aa8d", "version": 1, "cacheVersn": 0, "sequenceNumber": 91020997, "primaryTerm": 14, "modified": "2025-04-27T11:38:49.956893197Z", "sizeInBytes": 174, "description": "hQLBLw", "type": "regular" }, "nextTasks": { "#none#": [ "1" ] }, "continueOnErrorType": "", "view": { "position": { "x": 50, "y": 250 } }, "evidenceData": {} }, "1": { "id": "1", "taskId": "41fc95d2-227c-4c75-87e6-39f4369f474c", "type": "regular", "task": { "id": "41fc95d2-227c-4c75-87e6-39f4369f474c", "version": 1, "cacheVersn": 0, "sequenceNumber": 91020998, "primaryTerm": 14, "modified": "2025-04-27T11:38:49.976719806Z", "sizeInBytes": 248, "name": "print task uA5ts2pH", "description": "kvkIfkhh", "scriptId": "Print", "type": "regular", "isCommand": true }, "scriptArguments": { "value": { "simple": "2pOobkAM" } }, "continueOnErrorType": "", "view": { "position": { "x": 50, "y": 430 } }, "evidenceData": {} } }, "taskIds": [ "db7a60dc-7e49-44a0-8111-eab74746aa8d", "41fc95d2-227c-4c75-87e6-39f4369f474c" ], "scriptIds": [], "commands": [ "Print" ], "brands": [ "" ], "view": { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 65, "width": 380, "x": 50, "y": 50 } } }, "inputs": null, "outputs": null, "sourcePlaybookID": "3d7a44e2-60ee-4493-8e2c-013e68ed042f" } } }, "examples": { "Example 1": { "value": { "id": "96a0127e-cc9b-4946-4b08-68c5ee763328", "version": 1, "cacheVersn": 0, "sequenceNumber": 91021006, "primaryTerm": 14, "modified": "2025-04-27T11:38:55.652786718Z", "sizeInBytes": 1850, "packID": "", "packName": "", "itemVersion": "", "fromServerVersion": "", "toServerVersion": "", "propagationLabels": [ "all" ], "definitionId": "", "isOverridable": false, "vcShouldIgnore": false, "vcShouldKeepItemLegacyProdMachine": false, "commitMessage": "", "shouldCommit": false, "name": "playbook_mkj7jS4K_copy", "nameRaw": "playbook_mkj7jS4K_copy", "prevName": "playbook_mkj7jS4K_copy", "startTaskId": "0", "tasks": { "0": { "id": "0", "taskId": "db7a60dc-7e49-44a0-8111-eab74746aa8d", "type": "start", "task": { "id": "db7a60dc-7e49-44a0-8111-eab74746aa8d", "version": 1, "cacheVersn": 0, "sequenceNumber": 91020997, "primaryTerm": 14, "modified": "2025-04-27T11:38:49.956893197Z", "sizeInBytes": 174, "description": "hQLBLw", "type": "regular" }, "nextTasks": { "#none#": [ "1" ] }, "continueOnErrorType": "", "view": { "position": { "x": 50, "y": 250 } }, "evidenceData": {} }, "1": { "id": "1", "taskId": "41fc95d2-227c-4c75-87e6-39f4369f474c", "type": "regular", "task": { "id": "41fc95d2-227c-4c75-87e6-39f4369f474c", "version": 1, "cacheVersn": 0, "sequenceNumber": 91020998, "primaryTerm": 14, "modified": "2025-04-27T11:38:49.976719806Z", "sizeInBytes": 248, "name": "print task uA5ts2pH", "description": "kvkIfkhh", "scriptId": "Print", "type": "regular", "isCommand": true }, "scriptArguments": { "value": { "simple": "2pOobkAM" } }, "continueOnErrorType": "", "view": { "position": { "x": 50, "y": 430 } }, "evidenceData": {} } }, "taskIds": [ "db7a60dc-7e49-44a0-8111-eab74746aa8d", "41fc95d2-227c-4c75-87e6-39f4369f474c" ], "scriptIds": [], "commands": [ "Print" ], "brands": [ "" ], "view": { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 65, "width": 380, "x": 50, "y": 50 } } }, "inputs": null, "outputs": null, "sourcePlaybookID": "3d7a44e2-60ee-4493-8e2c-013e68ed042f" } } } } } } }, "operationId": "post-xsoar-public-v1-playbook-clone-playbook_id", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Clone an existing playbook by specifying its playbook ID." } }, "/xsoar/public/v1/settings/integration/reset/{instance_id}": { "parameters": [ { "schema": { "type": "string" }, "name": "instance_id", "in": "path", "required": true } ], "post": { "summary": "Reset integration instance last run timestamp", "tags": [ "Integrations" ], "responses": { "200": { "description": "OK" } }, "operationId": "post-xsoar-public-v1-settings-integration-reset-instance_id", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Reset the last run timestamp on the specified integration instance.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } } } }, "/xsoar/public/v1/settings/credentials/delete": { "post": { "summary": "Delete credentials", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } } }, "operationId": "post-xsoar-public-v1-settings-credentials-delete", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Delete the integration instance credentials specified by ID.\n\nFor more information on integration instance credentials, see [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/manage-credentials).", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" } }, "x-examples": { "Example 1": { "id": "rocket_X33wZG7N" } } }, "examples": { "Example 1": { "value": { "id": "jsmith" } } } } } }, "tags": [ "Integrations" ] } }, "/xsoar/public/v1/settings/credentials": { "post": { "summary": "Get all credentials", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "credentials": [ { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_ZMKzPGsy", "locked": false, "modified": "2025-03-03T16:54:09.855226363Z", "name": "rocket_ZMKzPGsy", "primaryTerm": 10, "sequenceNumber": 84731248, "sizeInBytes": 255, "user": "rocket_sXJgXzZ1", "vaultInstanceId": "", "version": 1, "workgroup": "" }, { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_N8HdicIH", "locked": false, "modified": "2025-03-31T18:14:20.472931836Z", "name": "rocket_N8HdicIH", "primaryTerm": 10, "sequenceNumber": 88067677, "sizeInBytes": 255, "user": "rocket_Tzh15pny", "vaultInstanceId": "", "version": 1, "workgroup": "" }, { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_4MSK7GWn", "locked": false, "modified": "2025-04-15T06:57:16.491793756Z", "name": "rocket_4MSK7GWn", "primaryTerm": 11, "sequenceNumber": 89289871, "sizeInBytes": 255, "user": "rocket_t9L8y6DI", "vaultInstanceId": "", "version": 1, "workgroup": "" }, { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_FnUCAjCc", "locked": false, "modified": "2025-04-27T12:47:24.344273235Z", "name": "rocket_FnUCAjCc", "primaryTerm": 14, "sequenceNumber": 91028639, "sizeInBytes": 255, "user": "rocket_2GBNYdBi", "vaultInstanceId": "", "version": 1, "workgroup": "" } ], "total": 4 } }, "properties": { "credentials": { "type": "array", "items": { "type": "object", "properties": { "cacheVersn": { "type": "integer" }, "hasCertificate": { "type": "boolean" }, "hasCertificatePass": { "type": "boolean" }, "hasPassword": { "type": "boolean" }, "id": { "type": "string" }, "locked": { "type": "boolean" }, "modified": { "type": "string" }, "name": { "type": "string" }, "primaryTerm": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "sizeInBytes": { "type": "integer" }, "user": { "type": "string" }, "vaultInstanceId": { "type": "string" }, "version": { "type": "integer" }, "workgroup": { "type": "string" } } } }, "total": { "type": "integer", "description": "Total number of credentials returned." } } }, "examples": { "Example 1": { "value": { "credentials": [ { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_ZMKzPGsy", "locked": false, "modified": "2025-03-03T16:54:09.855226363Z", "name": "rocket_ZMKzPGsy", "primaryTerm": 10, "sequenceNumber": 84731248, "sizeInBytes": 255, "user": "rocket_sXJgXzZ1", "vaultInstanceId": "", "version": 1, "workgroup": "" }, { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_N8HdicIH", "locked": false, "modified": "2025-03-31T18:14:20.472931836Z", "name": "rocket_N8HdicIH", "primaryTerm": 10, "sequenceNumber": 88067677, "sizeInBytes": 255, "user": "rocket_Tzh15pny", "vaultInstanceId": "", "version": 1, "workgroup": "" }, { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_4MSK7GWn", "locked": false, "modified": "2025-04-15T06:57:16.491793756Z", "name": "rocket_4MSK7GWn", "primaryTerm": 11, "sequenceNumber": 89289871, "sizeInBytes": 255, "user": "rocket_t9L8y6DI", "vaultInstanceId": "", "version": 1, "workgroup": "" }, { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_FnUCAjCc", "locked": false, "modified": "2025-04-27T12:47:24.344273235Z", "name": "rocket_FnUCAjCc", "primaryTerm": 14, "sequenceNumber": 91028639, "sizeInBytes": 255, "user": "rocket_2GBNYdBi", "vaultInstanceId": "", "version": 1, "workgroup": "" } ], "total": 4 } } } } } } }, "operationId": "post-xsoar-public-v1-settings-credentials", "parameters": [ { "schema": { "type": "string" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "description": "Get all integration instance credentials and their details.\n\nFor more information on integration instance credentials, see [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/manage-credentials).", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "page": { "type": "integer" }, "size": { "type": "integer" }, "query": { "type": "string" } }, "x-examples": { "Example 1": { "page": 0, "size": 200, "query": "" } } } } } }, "tags": [ "Integrations" ] }, "put": { "summary": "Create or update credentials", "description": "Create integration instance credentials or update existing credentials.\n\nFor more information on integration instance credentials, see [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/manage-credentials).", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "cacheVersn": { "type": "integer" }, "hasCertificate": { "type": "boolean" }, "hasCertificatePass": { "type": "boolean" }, "hasPassword": { "type": "boolean" }, "id": { "type": "string" }, "locked": { "type": "boolean" }, "modified": { "type": "string" }, "name": { "type": "string" }, "primaryTerm": { "type": "integer" }, "sequenceNumber": { "type": "integer" }, "sizeInBytes": { "type": "integer" }, "user": { "type": "string" }, "vaultInstanceId": { "type": "string" }, "version": { "type": "integer" }, "workgroup": { "type": "string" } }, "x-examples": { "Example 1": { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "rocket_lD2xFYKv", "locked": false, "modified": "2025-04-27T12:37:21.144981996Z", "name": "rocket_lD2xFYKv", "primaryTerm": 14, "sequenceNumber": 91027660, "sizeInBytes": 255, "user": "rocket_WfW9OLYl", "vaultInstanceId": "", "version": 1, "workgroup": "" } } }, "examples": { "Example 1": { "value": { "cacheVersn": 0, "hasCertificate": false, "hasCertificatePass": false, "hasPassword": false, "id": "jsmith", "locked": false, "modified": "2025-04-27T12:37:21.144981996Z", "name": "John Smith", "primaryTerm": 14, "sequenceNumber": 91027660, "sizeInBytes": 255, "user": "jsmith", "vaultInstanceId": "", "version": 1, "workgroup": "" } } } } } } }, "tags": [ "Integrations" ] } } }, "components": { "schemas": { "AdvanceArg": { "title": "AdvanceArg - advance argument can be one of the following:", "type": "object", "properties": { "complex": { "$ref": "#/components/schemas/ComplexArg" }, "keyValue": { "type": "array", "items": { "$ref": "#/components/schemas/KeyValueArg" }, "x-go-name": "KeyValue" }, "simple": { "type": "string", "x-go-name": "Simple" } }, "description": "Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value", "x-go-package": "github.com/demisto/server/domain" }, "APIExecutionMetric": { "type": "object", "properties": { "apiCallsCount": { "type": "integer", "format": "int64", "x-go-name": "APICallsCount" }, "type": { "type": "string", "x-go-name": "Type" } }, "description": "APIExecutionMetric is used by an entry to indicate the api details of an execution", "x-go-package": "github.com/demisto/server/domain", "title": "", "x-internal": true }, "ArgAtomicFilter": { "type": "object", "properties": { "ignoreCase": { "type": "boolean", "x-go-name": "IgnoreCase" }, "left": { "$ref": "#/components/schemas/OperatorArgument" }, "operator": { "$ref": "#/components/schemas/FilterOperatorID" }, "right": { "$ref": "#/components/schemas/OperatorArgument" }, "type": { "type": "string", "x-go-name": "Type" } }, "description": "ArgAtomicFilter - operator with two sides that return true/false", "x-go-package": "github.com/demisto/server/domain" }, "ArgFilter": { "type": "array", "description": "ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)", "items": { "$ref": "#/components/schemas/ArgAtomicFilter" }, "x-go-package": "github.com/demisto/server/domain" }, "ArgTransformer": { "title": "ArgTransformer ...", "type": "object", "properties": { "args": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/OperatorArgument" }, "x-go-name": "Args" }, "operator": { "$ref": "#/components/schemas/TransformerOperatorID" } }, "x-go-package": "github.com/demisto/server/domain" }, "Argument": { "type": "object", "properties": { "auto": { "type": "string", "x-go-name": "Auto" }, "default": { "type": "boolean", "x-go-name": "Default" }, "defaultValue": { "type": "string", "x-go-name": "DefaultValue" }, "deprecated": { "type": "boolean", "x-go-name": "Deprecated" }, "description": { "type": "string", "x-go-name": "Description" }, "hidden": { "type": "boolean", "x-go-name": "Hidden" }, "isArray": { "type": "boolean", "x-go-name": "IsArray" }, "name": { "type": "string", "x-go-name": "Name" }, "predefined": { "type": "array", "items": { "type": "string" }, "x-go-name": "Predefined" }, "required": { "type": "boolean", "x-go-name": "Required" }, "secret": { "type": "boolean", "x-go-name": "Secret" }, "type": { "$ref": "#/components/schemas/ArgumentType" } }, "description": "Argument to a module command", "x-go-package": "github.com/demisto/server/domain" }, "ArgumentType": { "title": "ArgumentType ...", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "ArrayPositions": { "type": "array", "items": { "type": "integer", "format": "uint64" }, "x-go-package": "github.com/blevesearch/bleve/v2/search" }, "Attachment": { "title": "Attachment", "type": "object", "properties": { "description": { "type": "string", "x-go-name": "Description" }, "isTempPath": { "type": "boolean", "x-go-name": "IsTempPath" }, "name": { "type": "string", "x-go-name": "Name" }, "path": { "type": "string", "x-go-name": "Path" }, "showMediaFile": { "type": "boolean", "x-go-name": "ShowMediaFile" }, "type": { "type": "string", "x-go-name": "Type" } }, "description": "", "x-go-package": "github.com/demisto/server/domain" }, "AutomationScript": { "type": "object", "properties": { "MainEngineInfo": { "$ref": "#/components/schemas/EngineInfo" }, "allRead": { "type": "boolean", "x-go-name": "IsAllRead" }, "allReadWrite": { "type": "boolean", "x-go-name": "IsAllReadWrite" }, "arguments": { "type": "array", "items": { "$ref": "#/components/schemas/Argument" }, "x-go-name": "Args" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "comment": { "type": "string", "x-go-name": "Comment" }, "commitMessage": { "type": "string", "x-go-name": "CommitMessage" }, "contextKeys": { "type": "array", "items": { "type": "string" }, "x-go-name": "ContextKeys" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "dbotCreatedBy": { "type": "string", "description": "Who has created this event - relevant only for manual incidents", "x-go-name": "CreatedBy" }, "definitionId": { "type": "string", "x-go-name": "DefinitionID" }, "dependsOn": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "This fields indicates which commands this script depends on", "x-go-name": "DependsOn" }, "deprecated": { "type": "boolean", "x-go-name": "Deprecated" }, "detached": { "type": "boolean", "x-go-name": "Detached" }, "dockerImage": { "type": "string", "x-go-name": "DockerImage" }, "enabled": { "type": "boolean", "x-go-name": "Enabled" }, "engine": { "type": "string", "description": "Engine that will run the script", "x-go-name": "Engine" }, "engineGroup": { "type": "string", "description": "EngineGroup that will run the script", "x-go-name": "EngineGroup" }, "fromServerVersion": { "$ref": "#/components/schemas/Version" }, "hasRole": { "type": "boolean", "description": "Internal field to make queries on role faster", "x-go-name": "HasRole" }, "hidden": { "type": "boolean", "x-go-name": "Hidden" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "important": { "type": "array", "items": { "$ref": "#/components/schemas/Important" }, "x-go-name": "Important" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "itemVersion": { "$ref": "#/components/schemas/Version" }, "locked": { "type": "boolean", "x-go-name": "Locked" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "x-go-name": "Name" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "outputs": { "type": "array", "items": { "$ref": "#/components/schemas/Output" }, "x-go-name": "Outputs" }, "packID": { "type": "string", "x-go-name": "PackID" }, "packName": { "type": "string", "x-go-name": "PackName" }, "packPropagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PackPropagationLabels" }, "polling": { "type": "boolean", "x-go-name": "Polling" }, "prevName": { "type": "string", "x-go-name": "PrevName" }, "previousAllRead": { "type": "boolean", "x-go-name": "PreviousAllRead" }, "previousAllReadWrite": { "type": "boolean", "x-go-name": "PreviousAllReadWrite" }, "previousRoles": { "type": "array", "description": "Do not change this field manually", "items": { "type": "string" }, "x-go-name": "PreviousRoleName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "private": { "type": "boolean", "x-go-name": "Private" }, "propagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PropagationLabels" }, "pswd": { "type": "string", "x-go-name": "Password" }, "rawTags": { "type": "array", "items": { "type": "string" }, "x-go-name": "RawTags" }, "remote": { "type": "boolean", "x-go-name": "Remote" }, "roles": { "type": "array", "description": "The role assigned to this investigation", "items": { "type": "string" }, "x-go-name": "RoleName" }, "runAs": { "type": "string", "x-go-name": "RunAs" }, "runOnce": { "type": "boolean", "x-go-name": "RunOnce" }, "script": { "type": "string", "x-go-name": "Script" }, "scriptTarget": { "$ref": "#/components/schemas/ScriptTarget" }, "searchableName": { "type": "string", "x-go-name": "DoNotUseName" }, "sensitive": { "type": "boolean", "x-go-name": "Sensitive" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "shouldCommit": { "type": "boolean", "x-go-name": "ShouldCommit" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "sourceScripID": { "type": "string", "x-go-name": "SourceScripID" }, "subtype": { "$ref": "#/components/schemas/ScriptSubType" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "system": { "type": "boolean", "x-go-name": "System" }, "tags": { "type": "array", "items": { "type": "string" }, "x-go-name": "Tags" }, "timeout": { "$ref": "#/components/schemas/Duration" }, "toServerVersion": { "$ref": "#/components/schemas/Version" }, "type": { "$ref": "#/components/schemas/ScriptType" }, "user": { "type": "string", "x-go-name": "User" }, "vcShouldIgnore": { "type": "boolean", "x-go-name": "VCShouldIgnore" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean", "x-go-name": "VCShouldKeepItemLegacyProdMachine" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "visualScript": { "type": "string", "x-go-name": "VisualScript" }, "xsoarHasReadOnlyRole": { "type": "boolean", "x-go-name": "HasReadOnlyRole" }, "xsoarPreviousReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousReadOnlyRoleName" }, "xsoarReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReadOnlyRoleName" } }, "description": "AutomationScript represents a script that will run on the system", "x-go-package": "github.com/demisto/server/domain" }, "automationScriptFilter": { "type": "object", "properties": { "Cache": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "Cache of join functions" }, "ignoreWorkers": { "type": "boolean", "description": "Do not use workers mechanism while searching bleve", "x-go-name": "IgnoreWorkers" }, "page": { "type": "integer", "description": "0-based page", "format": "int64", "x-go-name": "Page" }, "query": { "type": "string", "x-go-name": "Query" }, "searchAfter": { "type": "array", "description": "Efficient next page, pass max sort value from previous page", "items": { "type": "string" }, "x-go-name": "SearchAfter" }, "searchAfterElastic": { "type": "array", "description": "Efficient next page, pass max ES sort value from previous page", "items": { "type": "string" }, "x-go-name": "SearchAfterElastic" }, "searchAfterMap": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.", "x-go-name": "SearchAfterMap" }, "searchAfterMapOrder": { "type": "object", "additionalProperties": { "type": "integer", "format": "int64" }, "x-go-name": "SearchAfterMapOrder" }, "searchBefore": { "type": "array", "description": "Efficient prev page, pass min sort value from next page", "items": { "type": "string" }, "x-go-name": "SearchBefore" }, "searchBeforeElastic": { "type": "array", "description": "Efficient prev page, pass min ES sort value from next page", "items": { "type": "string" }, "x-go-name": "SearchBeforeElastic" }, "size": { "type": "integer", "description": "Size is limited to 1000, if not passed it defaults to 0, and no results will return", "format": "int64", "x-go-name": "Size" }, "sort": { "type": "array", "description": "The sort order", "items": { "$ref": "#/components/schemas/Order" }, "x-go-name": "Sort" }, "stripContext": { "type": "boolean", "x-go-name": "StripContext" } }, "description": "automationScriptFilter is a general filter that fetches entities using a query string query using the Query value", "x-go-package": "github.com/demisto/server/web" }, "automationScriptFilterWrapper": { "title": "automationScriptFilterWrapper ...", "type": "object", "x-go-package": "github.com/demisto/server/web", "properties": { "savePassword": { "type": "boolean", "x-go-name": "StorePassword", "description": "To have this script password protected, set this to `true` and include the password value in the `pswd` field.\r\nTo leave this script without a password, set this to `false` and leave the value of the `pswd` field empty." }, "script": { "$ref": "#/components/schemas/AutomationScript" } } }, "automationScriptResult": { "title": "automationScriptResult ...", "type": "object", "properties": { "pythonEnabled": { "type": "boolean", "x-go-name": "PythonEnabled" }, "scripts": { "type": "array", "items": { "$ref": "#/components/schemas/ScriptAPI" }, "x-go-name": "Scripts" }, "selectedScript": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "SelectedScript" }, "suggestions": { "type": "array", "items": { "type": "string" }, "x-go-name": "Tags" } }, "x-go-package": "github.com/demisto/server/web" }, "Comment": { "title": "Comment", "type": "object", "properties": { "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "category": { "type": "string", "x-go-name": "Category" }, "content": { "type": "string", "x-go-name": "Content" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "entryId": { "type": "string", "x-go-name": "EntryID" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "source": { "type": "string", "x-go-name": "Source" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "type": { "$ref": "#/components/schemas/CommentType" }, "user": { "type": "string", "x-go-name": "User" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" } }, "x-go-package": "github.com/demisto/server/domain" }, "CommentType": { "title": "CommentType", "type": "string", "description": "Comment types: regular comment, timeline, etc...", "x-go-package": "github.com/demisto/server/domain" }, "Comments": { "title": "Comments", "type": "array", "items": { "$ref": "#/components/schemas/Comment" }, "x-go-package": "github.com/demisto/server/domain" }, "ComplexArg": { "type": "object", "properties": { "accessor": { "type": "string", "x-go-name": "Accessor" }, "filters": { "type": "array", "items": { "$ref": "#/components/schemas/ArgFilter" }, "x-go-name": "Filters" }, "root": { "type": "string", "x-go-name": "Root" }, "transformers": { "type": "array", "items": { "$ref": "#/components/schemas/ArgTransformer" }, "x-go-name": "Transformers" } }, "description": "**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation.", "x-go-package": "github.com/demisto/server/domain" }, "ContinueOnErrorType": { "title": "ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path.", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "CreateIncidentRequest": { "title": "CreateIncidentRequest", "type": "object", "x-go-package": "github.com/demisto/server/domain", "x-examples": { "Example 1": { "severity": 3, "reason": "reason", "closeNotes": "closeNotes", "sla": 6.027456183070403, "rawJSON": "rawJSON", "type": "Unclassified", "createInvestigation": true, "labels": [ { "type": "type", "value": "value" }, { "type": "type", "value": "value" } ], "name": "name", "closed": "2000-01-23T04:56:07.000+00:00", "details": "details", "closeReason": "closeReason" } }, "required": [ "name" ], "properties": { "closeNotes": { "type": "string", "description": "Notes for closing the incident.", "x-go-name": "CloseNotes" }, "closeReason": { "type": "string", "description": "The reason for closing the incident (select from existing predefined values).", "x-go-name": "ArchiveReason" }, "closed": { "type": "string", "description": "Use `createInvestigation: true` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. \r\nUse 'createInvestigation: false", "format": "date-time", "x-go-name": "Closed" }, "createInvestigation": { "type": "boolean", "x-go-name": "CreateInvestigation", "description": "Use `createInvestigation: true` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. " }, "customFields": { "type": "object", "additionalProperties": { "type": "object" } }, "details": { "type": "string", "description": "The details of the incident.", "x-go-name": "Details" }, "labels": { "type": "array", "description": "Labels related to incident - each label is composed of a type and value", "x-go-name": "Labels", "items": { "$ref": "#/components/schemas/Label" } }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified", "description": "Date modified." }, "name": { "type": "string", "description": "Incident name.", "x-go-name": "Name" }, "playbookId": { "type": "string", "description": "The associated playbook for this incident.", "x-go-name": "PlaybookID" }, "rawJSON": { "type": "string", "x-go-name": "RawJSONData" }, "reason": { "type": "string", "description": "The reason an incident was closed.", "x-go-name": "Reason" }, "severity": { "$ref": "#/components/schemas/Severity" }, "sla": { "$ref": "#/components/schemas/SLAState" }, "status": { "$ref": "#/components/schemas/IncidentStatus" }, "type": { "type": "string", "description": "Incident type.", "example": "Unclassified", "x-go-name": "Type" } } }, "CustomFields": { "title": "CustomFields", "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "description": "The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update.", "x-go-package": "github.com/demisto/server/domain" }, "DBotScore": { "title": "DBotScore", "type": "object", "properties": { "content": { "type": "string", "x-go-name": "Content" }, "contentFormat": { "type": "string", "x-go-name": "ContentFormat" }, "context": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "Context" }, "isTypedIndicator": { "type": "boolean", "x-go-name": "IsTypedIndicator" }, "reliability": { "type": "string", "x-go-name": "SourceReliability" }, "score": { "type": "integer", "format": "int64", "x-go-name": "Score" }, "scoreChangeTimestamp": { "type": "string", "description": "We need to track when the score changes to know if we need to re-calculate the overall score", "format": "date-time", "x-go-name": "ScoreChangeTimeStamp" }, "timestamp": { "type": "string", "format": "date-time", "x-go-name": "TimeStamp" }, "type": { "type": "string", "x-go-name": "Type" } }, "description": "Contains the score of a specific brand for a specific insight.", "x-go-package": "github.com/demisto/server/domain" }, "DataCollectionForm": { "title": "DataCollectionForm - a data collection form with questions.", "type": "object", "properties": { "description": { "type": "string", "x-go-name": "Description" }, "expired": { "type": "boolean", "x-go-name": "Expired" }, "questions": { "type": "array", "items": { "$ref": "#/components/schemas/Question" }, "x-go-name": "Questions" }, "sender": { "type": "string", "x-go-name": "Sender" }, "title": { "type": "string", "x-go-name": "Title" }, "totalAnswers": { "type": "integer", "format": "uint64", "x-go-name": "TotalAnswers" } }, "x-go-package": "github.com/demisto/server/domain" }, "DateRangeFilter": { "title": "DateRangeFilter", "type": "object", "properties": { "fromDate": { "type": "string", "format": "date-time", "x-go-name": "FromDate" }, "fromDateLicense": { "type": "string", "format": "date-time", "x-go-name": "FromDateLicenseVal" }, "period": { "$ref": "#/components/schemas/Period" }, "timeFrame": { "$ref": "#/components/schemas/Duration" }, "toDate": { "type": "string", "format": "date-time", "x-go-name": "ToDate" } }, "description": "DateRangeFilter provides common fields for date filtering.", "x-go-package": "github.com/demisto/server/repo/entities" }, "Duration": { "title": "Duration", "type": "integer", "description": "A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.", "format": "int64", "x-go-package": "time" }, "EndingType": { "type": "string", "description": "EndingType holds the type of schedule Ending", "x-go-package": "github.com/demisto/server/domain" }, "EngineInfo": { "title": "EngineInfo ...", "type": "object", "properties": { "engine": { "type": "string", "description": "Engine that will run the script", "x-go-name": "Engine" }, "engineGroup": { "type": "string", "description": "EngineGroup that will run the script", "x-go-name": "EngineGroup" } }, "x-go-package": "github.com/demisto/server/domain" }, "Entry": { "type": "object", "properties": { "IndicatorTimeline": { "$ref": "#/components/schemas/IndicatorTimeline" }, "InstanceID": { "type": "string" }, "Relationships": { "$ref": "#/components/schemas/RelationshipsAPI" }, "ShardID": { "type": "integer", "format": "int64" }, "allRead": { "type": "boolean", "x-go-name": "IsAllRead" }, "allReadWrite": { "type": "boolean", "x-go-name": "IsAllReadWrite" }, "apiExecutionMetrics": { "type": "array", "items": { "$ref": "#/components/schemas/APIExecutionMetric" }, "x-go-name": "APIExecutionMetrics" }, "brand": { "type": "string", "x-go-name": "Brand" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "category": { "$ref": "#/components/schemas/EntryCategory" }, "contents": { "type": "object", "properties": {}, "description": "The contents of the entry that is actually indexed - should not be used", "x-go-name": "DoNotUseContents" }, "contentsSize": { "type": "integer", "description": "ContentsSize the total size of the contents", "format": "int64", "x-go-name": "ContentsSize" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "cron": { "type": "string", "x-go-name": "Cron" }, "cronView": { "type": "boolean", "x-go-name": "CronView" }, "dbotCreatedBy": { "type": "string", "description": "Who has created this event - relevant only for manual incidents", "x-go-name": "CreatedBy" }, "deleted": { "type": "boolean", "x-go-name": "Deleted" }, "deletedBy": { "type": "string", "x-go-name": "DeletedBy" }, "deletedFromFS": { "type": "boolean", "x-go-name": "DeletedFromFS" }, "endingDate": { "type": "string", "format": "date-time", "x-go-name": "EndingDate" }, "endingType": { "$ref": "#/components/schemas/EndingType" }, "entryTask": { "$ref": "#/components/schemas/EntryTask" }, "errorSource": { "type": "string", "description": "Source of the error", "x-go-name": "ErrorSource" }, "file": { "type": "string", "description": "Filename of associated content", "x-go-name": "File" }, "fileID": { "type": "string", "description": "FileID is the file name when saved in the server", "x-go-name": "FileID" }, "fileMetadata": { "$ref": "#/components/schemas/FileMetadata" }, "format": { "type": "string", "description": "Holds information on how content is formatted", "x-go-name": "ContentsFormat" }, "hasRole": { "type": "boolean", "description": "Internal field to make queries on role faster", "x-go-name": "HasRole" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "history": { "type": "array", "description": "Edit history", "items": { "$ref": "#/components/schemas/EntryHistory" }, "x-go-name": "History" }, "humanCron": { "$ref": "#/components/schemas/HumanCron" }, "id": { "type": "string", "x-go-name": "ID" }, "incidentCreationTime": { "type": "string", "description": "store the entry based on IncidentCreationTime", "format": "date-time", "x-go-name": "IncidentCreationTime" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "instance": { "type": "string", "x-go-name": "Instance" }, "investigationId": { "type": "string", "description": "The id of the investigation it belongs to", "x-go-name": "InvestigationID" }, "isTodo": { "type": "boolean", "description": "IsTodo", "x-go-name": "IsTodo" }, "mirrored": { "type": "boolean", "description": "Only used for outbound mirroring to mark that it is already mirrored to remote system", "x-go-name": "Mirrored" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "note": { "type": "boolean", "description": "Note", "x-go-name": "Note" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "parentContent": { "type": "object", "properties": {}, "description": "ParentEntry content - for reference", "x-go-name": "ParentEntryContent" }, "parentEntryTruncated": { "type": "boolean", "description": "ParentEntryTruncated - indicates weather entry content was truncated", "x-go-name": "ParentEntryTruncated" }, "parentId": { "type": "string", "description": "ParentId is the ID of the parent entry", "x-go-name": "ParentID" }, "pinned": { "type": "boolean", "description": "Mark entry as pinned = evidence", "x-go-name": "Pinned" }, "playbookId": { "type": "string", "description": "PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook", "x-go-name": "PlaybookID" }, "polling": { "type": "boolean", "description": "Only used for polling entries", "x-go-name": "Polling" }, "pollingArgs": { "$ref": "#/components/schemas/ModuleArgs" }, "pollingCommand": { "type": "string", "x-go-name": "PollingCommand" }, "pollingItemsRemaining": { "type": "integer", "format": "int64", "x-go-name": "PollingItemsRemaining" }, "previousAllRead": { "type": "boolean", "x-go-name": "PreviousAllRead" }, "previousAllReadWrite": { "type": "boolean", "x-go-name": "PreviousAllReadWrite" }, "previousRoles": { "type": "array", "description": "Do not change this field manually", "items": { "type": "string" }, "x-go-name": "PreviousRoleName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "readOnly": { "type": "boolean", "description": "ReadOnly", "x-go-name": "ReadOnly" }, "recurrent": { "type": "boolean", "x-go-name": "Recurrent" }, "reputationSize": { "type": "integer", "description": "ReputationSize the total size of the reputation", "format": "int64", "x-go-name": "ReputationSize" }, "retryTime": { "type": "string", "description": "When retry took place", "format": "date-time", "x-go-name": "RetryTime" }, "roles": { "type": "array", "description": "The role assigned to this investigation", "items": { "type": "string" }, "x-go-name": "RoleName" }, "scheduled": { "type": "boolean", "description": "is it scheduled", "x-go-name": "Scheduled" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "startDate": { "type": "string", "format": "date-time", "x-go-name": "StartDate" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "system": { "type": "string", "description": "The name of the system associated with this entry", "x-go-name": "SystemName" }, "tags": { "type": "array", "description": "Tags", "items": { "type": "string" }, "x-go-name": "Tags" }, "tagsRaw": { "type": "array", "description": "TagsRaw", "items": { "type": "string" }, "x-go-name": "TagsRaw" }, "taskId": { "type": "string", "description": "TaskID - used if the entry is assigned as note to a playbook task", "x-go-name": "TaskID" }, "times": { "type": "integer", "format": "int64", "x-go-name": "Times" }, "timesRan": { "type": "integer", "format": "int64", "x-go-name": "TimesRan" }, "timezone": { "type": "string", "x-go-name": "Timezone" }, "timezoneOffset": { "type": "integer", "format": "int64", "x-go-name": "TimezoneOffset" }, "type": { "$ref": "#/components/schemas/EntryType" }, "user": { "type": "string", "description": "The user who created the entry", "x-go-name": "User" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "xsoarHasReadOnlyRole": { "type": "boolean", "x-go-name": "HasReadOnlyRole" }, "xsoarPreviousReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousReadOnlyRoleName" }, "xsoarReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReadOnlyRoleName" } }, "description": "Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined", "x-go-package": "github.com/demisto/server/domain" }, "EntryCategory": { "title": "EntryCategory ...", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "EntryHistory": { "title": "EntryHistory ...", "type": "object", "properties": { "contentDate": { "type": "string", "format": "date-time", "x-go-name": "ContentDate" }, "contents": { "type": "string", "x-go-name": "Contents" }, "contentsFormat": { "type": "string", "x-go-name": "ContentsFormat" }, "user": { "type": "string", "x-go-name": "User" } }, "x-go-package": "github.com/demisto/server/domain" }, "EntryTask": { "type": "object", "properties": { "playbookName": { "type": "string", "x-go-name": "PlaybookName" }, "quiet": { "type": "boolean", "x-go-name": "Quiet" }, "taskId": { "type": "string", "x-go-name": "TaskID" }, "taskName": { "type": "string", "x-go-name": "TaskName" }, "taskStatus": { "type": "string", "x-go-name": "TaskStatus" } }, "description": "EntryTask holds information regarding the related task", "x-go-package": "github.com/demisto/server/domain" }, "EntryType": { "type": "number", "description": "EntryType specifies the type of the entry", "format": "double", "x-go-package": "github.com/demisto/server/domain" }, "Evidence": { "type": "object", "title": "Evidence details.", "properties": { "ShardID": { "type": "integer", "format": "int64" }, "allRead": { "type": "boolean", "x-go-name": "IsAllRead" }, "allReadWrite": { "type": "boolean", "x-go-name": "IsAllReadWrite" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "dbotCreatedBy": { "description": "Who has created this event - relevant only for manual incidents", "type": "string", "x-go-name": "CreatedBy" }, "description": { "description": "The description for the resolve", "type": "string", "x-go-name": "Description" }, "entryId": { "description": "The entry ID", "type": "string", "x-go-name": "EntryID" }, "fetched": { "description": "when the evidence entry was fetched", "type": "string", "format": "date-time", "x-go-name": "Fetched" }, "hasRole": { "description": "Internal field to make queries on role faster", "type": "boolean", "x-go-name": "HasRole" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "incidentId": { "description": "The incident ID", "type": "string", "x-go-name": "IncidentID" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "markedBy": { "description": "the user that marked this evidence", "type": "string", "x-go-name": "MarkedBy" }, "markedDate": { "description": "when this evidence was marked", "type": "string", "format": "date-time", "x-go-name": "MarkedDate" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "occurred": { "description": "When this evidence has occurred", "type": "string", "format": "date-time", "x-go-name": "Occurred" }, "previousAllRead": { "type": "boolean", "x-go-name": "PreviousAllRead" }, "previousAllReadWrite": { "type": "boolean", "x-go-name": "PreviousAllReadWrite" }, "previousRoles": { "description": "Do not change this field manually", "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousRoleName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "roles": { "description": "The role assigned to this investigation", "type": "array", "items": { "type": "string" }, "x-go-name": "RoleName" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "tags": { "description": "Tags", "type": "array", "items": { "type": "string" }, "x-go-name": "Tags" }, "tagsRaw": { "description": "TagsRaw", "type": "array", "items": { "type": "string" }, "x-go-name": "TagsRaw" }, "taskId": { "description": "when the evidence entry was fetched", "type": "string", "x-go-name": "TaskID" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "xsoarHasReadOnlyRole": { "type": "boolean", "x-go-name": "HasReadOnlyRole" }, "xsoarPreviousReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousReadOnlyRoleName" }, "xsoarReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReadOnlyRoleName" } }, "x-go-package": "github.com/demisto/server/domain" }, "EvidenceData": { "type": "object", "properties": { "customFields": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/AdvanceArg" }, "description": "This field must have empty json key", "x-go-name": "CustomFields" }, "description": { "$ref": "#/components/schemas/AdvanceArg" }, "occurred": { "$ref": "#/components/schemas/AdvanceArg" }, "tags": { "$ref": "#/components/schemas/AdvanceArg" } }, "description": "EvidenceData - all evidence properties to evaluate in task process", "x-go-package": "github.com/demisto/server/domain" }, "Evidences": { "description": "Evidences is a list of evidence entities", "type": "array", "items": { "$ref": "#/components/schemas/Evidence" }, "x-go-package": "github.com/demisto/server/domain" }, "EvidencesSearchResponse": { "description": "EvidencesSearchResponse returns the response from the evidences search", "type": "object", "properties": { "evidences": { "$ref": "#/components/schemas/Evidences" }, "total": { "type": "integer", "format": "int64", "x-go-name": "Total" } }, "x-go-package": "github.com/demisto/server/repo/entities" }, "ExpirationPolicy": { "title": "ExpirationPolicy", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "ExpirationSettingsSource": { "title": "ExpirationSettingsSource", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "ExpirationSource": { "title": "ExpirationSource", "type": "object", "properties": { "brand": { "type": "string", "x-go-name": "Brand" }, "expirationInterval": { "type": "integer", "format": "int64", "x-go-name": "ExpirationInterval" }, "expirationPolicy": { "$ref": "#/components/schemas/ExpirationPolicy" }, "instance": { "type": "string", "x-go-name": "Instance" }, "moduleId": { "type": "string", "x-go-name": "ModuleID" }, "setTime": { "type": "string", "format": "date-time", "x-go-name": "SetTime" }, "source": { "$ref": "#/components/schemas/ExpirationSettingsSource" }, "user": { "type": "string", "x-go-name": "User" } }, "x-go-package": "github.com/demisto/server/domain" }, "ExpirationStatus": { "title": "ExpirationStatus", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "ExtractSettingsMode": { "title": "ExtractSettingsMode", "type": "string", "description": "", "x-go-package": "github.com/demisto/server/domain" }, "FeedIndicator": { "title": "FeedIndicator", "type": "object", "properties": { "ExpirationSource": { "$ref": "#/components/schemas/ExpirationSource" }, "bypassExclusionList": { "type": "boolean", "x-go-name": "ShouldBypassExclusionList" }, "classifierId": { "type": "string", "x-go-name": "ClassifierID" }, "classifierVersion": { "type": "integer", "format": "int64", "x-go-name": "ClassifierVersion" }, "comments": { "type": "array", "items": { "$ref": "#/components/schemas/FeedIndicatorComment" }, "x-go-name": "Comments" }, "expirationInterval": { "type": "integer", "format": "int64", "x-go-name": "ExpirationInterval" }, "expirationPolicy": { "$ref": "#/components/schemas/ExpirationPolicy" }, "fetchTime": { "type": "string", "format": "date-time", "x-go-name": "FetchTime" }, "fields": { "$ref": "#/components/schemas/CustomFields" }, "isEnrichment": { "type": "boolean", "x-go-name": "IsEnrichment" }, "mapperId": { "type": "string", "x-go-name": "MapperID" }, "mapperVersion": { "type": "integer", "format": "int64", "x-go-name": "MapperVersion" }, "modifiedTime": { "type": "string", "format": "date-time", "x-go-name": "ModifiedTime" }, "moduleId": { "type": "string", "x-go-name": "ModuleID" }, "rawJSON": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "RawJSON" }, "relationships": { "$ref": "#/components/schemas/RelationshipsAPI" }, "reliability": { "$ref": "#/components/schemas/Reliability" }, "score": { "type": "integer", "format": "int64", "x-go-name": "Score" }, "sourceBrand": { "type": "string", "x-go-name": "Brand" }, "sourceInstance": { "type": "string", "x-go-name": "Instance" }, "timestamp": { "type": "string", "format": "date-time", "x-go-name": "TimeStamp" }, "type": { "type": "string", "x-go-name": "Type" }, "value": { "type": "string", "x-go-name": "Value" } }, "description": "", "x-go-package": "github.com/demisto/server/domain" }, "FeedIndicatorComment": { "title": "FeedIndicatorComment", "type": "object", "properties": { "content": { "type": "string", "x-go-name": "Content" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "id": { "type": "string", "x-go-name": "ID" }, "user": { "type": "string", "x-go-name": "User" } }, "x-go-package": "github.com/demisto/server/domain" }, "FeedIndicatorsRequest": { "description": "FeedIndicatorsRequest is the input for JSON feed indicator ingestion", "type": "object", "properties": { "bypassExclusionList": { "type": "boolean", "x-go-name": "ShouldBypassExclusionList" }, "classifierId": { "type": "string", "x-go-name": "ClassifierID" }, "indicators": { "type": "array", "items": { "$ref": "#/components/schemas/RawFeedIndicator" }, "x-go-name": "Indicators" }, "mapperId": { "type": "string", "x-go-name": "MapperID" } }, "x-go-package": "github.com/demisto/server/web" }, "FieldExtractSetting": { "title": "FieldExtractSetting", "type": "object", "properties": { "extractAsIsIndicatorTypeId": { "type": "string", "x-go-name": "ExtractAsIsIndicatorTypeID" }, "extractIndicatorTypesIDs": { "type": "array", "items": { "type": "string" }, "x-go-name": "ExtractIndicatorTypesIDs" }, "isExtractingAllIndicatorTypes": { "type": "boolean", "x-go-name": "IsExtractingAllIndicatorTypes" } }, "x-go-package": "github.com/demisto/server/domain" }, "FieldMapping": { "type": "object", "properties": { "fieldId": { "type": "string", "x-go-name": "IncidentField" }, "output": { "$ref": "#/components/schemas/AdvanceArg" } }, "description": "FieldMapping - Map a task output (complex or simple value) to an incident field", "x-go-package": "github.com/demisto/server/domain" }, "FieldsAlias": { "type": "object", "title": "FieldsAlias", "properties": { "cliName": { "type": "string", "x-go-name": "CliName" }, "type": { "type": "string", "x-go-name": "Type" } }, "x-go-package": "github.com/demisto/server/domain" }, "FieldGroup": { "description": "FieldGroup is the field group", "type": "number", "format": "double", "x-go-package": "github.com/demisto/server/domain" }, "FieldMergeStrategy": { "description": "FieldMergeStrategy strategy for merging of indicator fields", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "FileMetadata": { "title": "FileMetadata ...", "type": "object", "properties": { "info": { "type": "string", "x-go-name": "Info" }, "isMediaFile": { "type": "boolean", "x-go-name": "IsMediaFile" }, "md5": { "type": "string", "x-go-name": "MD5" }, "sha1": { "type": "string", "x-go-name": "SHA1" }, "sha256": { "type": "string", "x-go-name": "SHA256" }, "sha512": { "type": "string", "x-go-name": "SHA512" }, "size": { "type": "integer", "format": "int64", "x-go-name": "Size" }, "ssdeep": { "type": "string", "x-go-name": "SSDeep" }, "type": { "type": "string", "x-go-name": "Type" } }, "x-go-package": "github.com/demisto/server/domain" }, "FilterOperatorID": { "title": "FilterOperatorID ...", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "FormDisplay": { "title": "FormDisplay - display options for communication/ask task (for both email and web forms).", "type": "object", "properties": { "bodyBackgroundColor": { "type": "string", "x-go-name": "BodyBackgroundColor" }, "bodyFontColor": { "type": "string", "x-go-name": "BodyFontColor" }, "headerBackgroundColor": { "type": "string", "x-go-name": "HeaderBackgroundColor" }, "headerFontColor": { "type": "string", "x-go-name": "HeaderFontColor" }, "isExternalRtl": { "type": "boolean", "x-go-name": "IsExternalRtl" }, "sender": { "type": "string", "x-go-name": "Sender" }, "submitButtonBackgroundColor": { "type": "string", "x-go-name": "SubmitButtonBackgroundColor" }, "submitButtonFontColor": { "type": "string", "x-go-name": "SubmitButtonFontColor" }, "submitText": { "type": "string", "x-go-name": "SubmitText" } }, "x-go-package": "github.com/demisto/server/domain" }, "genericIndicatorUpdateBatch": { "type": "object", "x-go-package": "github.com/demisto/server/web", "properties": { "all": { "type": "boolean", "x-go-name": "All", "default": false, "description": "Warning: When updating or deleting indicator in a batch, setting this field to `true` will inverse your request and apply the action to all indicators *except* for the ones specified. If there are no indicators that match the filter settings or no indicators specified in the `ids` field, the action will be applied to all indicators. Setting this field to `false` will apply the action only on the indicators specified." }, "columns": { "type": "array", "x-go-name": "Columns", "items": { "type": "string" } }, "doNotWhitelist": { "type": "boolean", "x-go-name": "DoNotWhitelist", "description": "To delete a batch of indicators, set this to `true`." }, "filter": { "$ref": "#/components/schemas/IndicatorFilter" }, "ids": { "type": "array", "x-go-name": "IDs", "items": { "type": "string" } }, "reason": { "type": "string", "x-go-name": "Reason" }, "reputations": { "type": "array", "x-go-name": "Reputations", "items": { "type": "string" } } } }, "GenericStringDateFilter": { "description": "GenericStringDateFilter is a general filter that will fetch entities using the Query value and a date filter", "type": "object", "properties": { "Cache": { "description": "Cache of join functions", "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, "accounts": { "type": "object", "additionalProperties": { "type": "object" }, "x-go-name": "Accounts" }, "fields": { "type": "array", "items": { "type": "string" }, "x-go-name": "Fields" }, "filterobjectquery": { "type": "string", "x-go-name": "FilterObjectQuery" }, "fromDate": { "type": "string", "format": "date-time", "x-go-name": "FromDate" }, "fromDateLicense": { "type": "string", "format": "date-time", "x-go-name": "FromDateLicenseVal" }, "ignoreWorkers": { "description": "Do not use workers mechanism while searching bleve", "type": "boolean", "x-go-name": "IgnoreWorkers" }, "page": { "description": "0-based page", "type": "integer", "format": "int64", "x-go-name": "Page" }, "period": { "$ref": "#/components/schemas/Period" }, "query": { "type": "string", "x-go-name": "Query" }, "searchAfter": { "description": "Efficient next page, pass max sort value from previous page", "type": "array", "items": { "type": "string" }, "x-go-name": "SearchAfter" }, "searchAfterElastic": { "description": "Efficient next page, pass max ES sort value from previous page", "type": "array", "items": { "type": "string" }, "x-go-name": "SearchAfterElastic" }, "searchAfterMap": { "description": "Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.", "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "SearchAfterMap" }, "searchAfterMapOrder": { "type": "object", "additionalProperties": { "type": "integer", "format": "int64" }, "x-go-name": "SearchAfterMapOrder" }, "searchBefore": { "description": "Efficient prev page, pass min sort value from next page", "type": "array", "items": { "type": "string" }, "x-go-name": "SearchBefore" }, "searchBeforeElastic": { "description": "Efficient prev page, pass min ES sort value from next page", "type": "array", "items": { "type": "string" }, "x-go-name": "SearchBeforeElastic" }, "size": { "description": "Size is limited to 1000, if not passed it defaults to 0, and no results will return", "type": "integer", "format": "int64", "x-go-name": "Size" }, "sort": { "description": "The sort order", "type": "array", "items": { "$ref": "#/components/schemas/Order" }, "x-go-name": "Sort" }, "timeFrame": { "$ref": "#/components/schemas/Duration" }, "toDate": { "type": "string", "format": "date-time", "x-go-name": "ToDate" }, "trim_events": { "type": "integer", "format": "int64", "x-go-name": "TrimEvents" } }, "x-go-package": "github.com/demisto/server/repo/entities" }, "GenericStringFilter": { "type": "object", "properties": { "Cache": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "Cache of join functions" }, "ignoreWorkers": { "type": "boolean", "description": "Do not use workers mechanism while searching bleve", "x-go-name": "IgnoreWorkers" }, "page": { "type": "integer", "description": "0-based page", "format": "int64", "x-go-name": "Page" }, "query": { "type": "string", "x-go-name": "Query" }, "searchAfter": { "type": "array", "description": "Efficient next page, pass max sort value from previous page", "items": { "type": "string" }, "x-go-name": "SearchAfter" }, "searchAfterElastic": { "type": "array", "description": "Efficient next page, pass max ES sort value from previous page", "items": { "type": "string" }, "x-go-name": "SearchAfterElastic" }, "searchAfterMap": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.", "x-go-name": "SearchAfterMap" }, "searchAfterMapOrder": { "type": "object", "additionalProperties": { "type": "integer", "format": "int64" }, "x-go-name": "SearchAfterMapOrder" }, "searchBefore": { "type": "array", "description": "Efficient prev page, pass min sort value from next page", "items": { "type": "string" }, "x-go-name": "SearchBefore" }, "searchBeforeElastic": { "type": "array", "description": "Efficient prev page, pass min ES sort value from next page", "items": { "type": "string" }, "x-go-name": "SearchBeforeElastic" }, "size": { "type": "integer", "description": "Size is limited to 1000, if not passed it defaults to 0, and no results will return", "format": "int64", "x-go-name": "Size" }, "sort": { "type": "array", "description": "The sort order", "items": { "$ref": "#/components/schemas/Order" }, "x-go-name": "Sort" } }, "description": "GenericStringFilter is a general filter that will fetch entities using the Query value", "x-go-package": "github.com/demisto/server/repo/entities" }, "GridColumn": { "title": "GridColumn", "type": "object", "properties": { "displayName": { "type": "string", "x-go-name": "DisplayName" }, "fieldCalcScript": { "type": "string", "x-go-name": "FieldCalcScript" }, "isDefault": { "type": "boolean", "x-go-name": "IsDefault" }, "isReadOnly": { "type": "boolean", "x-go-name": "IsReadOnly" }, "key": { "type": "string", "x-go-name": "Key" }, "orgType": { "type": "string", "x-go-name": "OrgType" }, "required": { "type": "boolean", "x-go-name": "Required" }, "script": { "type": "string", "x-go-name": "Script" }, "selectValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SelectValues" }, "type": { "type": "string", "x-go-name": "Type" }, "width": { "type": "integer", "format": "int64", "x-go-name": "Width" } }, "x-go-package": "github.com/demisto/server/domain" }, "Group": { "type": "object", "title": "Group is the response that returns from a statistics query, describing a grouped value.", "properties": { "color": { "description": "color used to identify the group", "type": "string", "x-go-name": "Color" }, "count": { "description": "The number of participants in the group", "type": "integer", "format": "int64", "x-go-name": "Count" }, "data": { "description": "The data value provided in array of integer values.", "type": "array", "items": { "type": "integer", "format": "int64" }, "x-go-name": "Data" }, "dataType": { "type": "string", "x-go-name": "GoToDataType" }, "floatData": { "description": "The data value provided in array of float values.", "type": "array", "items": { "type": "number", "format": "double" }, "x-go-name": "FloatData" }, "groups": { "$ref": "#/components/schemas/Groups" }, "name": { "type": "string", "x-go-name": "Name" }, "pivot": { "type": "string", "x-go-name": "Pivot" }, "query": { "type": "string", "x-go-name": "GoToQuery" }, "x": { "type": "number", "format": "double", "x-go-name": "X" }, "y": { "type": "number", "format": "double", "x-go-name": "Y" }, "z": { "type": "number", "format": "double", "x-go-name": "Z" } }, "x-go-package": "github.com/demisto/server/repo/entities" }, "Groups": { "description": "Groups is a list of group entities", "type": "array", "items": { "$ref": "#/components/schemas/Group" }, "x-go-package": "github.com/demisto/server/repo/entities" }, "HumanCron": { "title": "HumanCron ...", "type": "object", "properties": { "atTimeHour": { "type": "string", "x-go-name": "AtTimeHour" }, "atTimeMinute": { "type": "string", "x-go-name": "AtTimeMinute" }, "days": { "type": "array", "items": { "type": "string" }, "x-go-name": "Days" }, "schedulingType": { "type": "string", "description": "the following fields are deprecated. do not use them.", "x-go-name": "SchedulingType" }, "timePeriod": { "type": "integer", "format": "int64", "x-go-name": "TimePeriod" }, "timePeriodType": { "type": "string", "x-go-name": "TimePeriodType" } }, "x-go-package": "github.com/demisto/server/domain" }, "Important": { "type": "object", "properties": { "contextPath": { "type": "string", "x-go-name": "ContextPath" }, "description": { "type": "string", "description": "Description is either a string or a map from string to interface", "x-go-name": "Description" }, "related": { "type": "string", "description": "To what other context path this output is related", "x-go-name": "Related" } }, "description": "Important The important outputs of a given command", "x-go-package": "github.com/demisto/server/domain" }, "Incident": { "title": "Incident", "type": "object", "properties": { "account": { "type": "string", "description": "Account holds the tenant name so that slicing and dicing on the master can leverage bleve", "x-go-name": "Account" }, "activated": { "type": "string", "description": "When was this activated", "format": "date-time", "x-go-name": "Activated" }, "activatingingUserId": { "type": "string", "description": "The user that activated this investigation", "x-go-name": "ActivatingUserID" }, "allRead": { "type": "boolean", "x-go-name": "IsAllRead" }, "allReadWrite": { "type": "boolean", "x-go-name": "IsAllReadWrite" }, "attachment": { "type": "array", "description": "Attachments", "items": { "$ref": "#/components/schemas/Attachment" }, "x-go-name": "Attachments" }, "autime": { "type": "integer", "description": "AlmostUniqueTime is an attempt to have a unique sortable ID for an incident", "format": "int64", "example": 1682865388000000000, "x-go-name": "AlmostUniqueTime" }, "cacheVersn": { "type": "integer", "format": "int64", "example": 0, "x-go-name": "CacheVersn" }, "canvases": { "type": "array", "description": "Canvases of the incident", "items": { "type": "string" }, "x-go-name": "Canvases" }, "category": { "type": "string", "description": "Category", "x-go-name": "Category" }, "closeNotes": { "type": "string", "description": "Notes for closing the incident", "x-go-name": "CloseNotes" }, "closeReason": { "type": "string", "description": "The reason for closing the incident (select from existing predefined values)", "x-go-name": "ArchiveReason" }, "closed": { "type": "string", "description": "When was this closed", "format": "date-time", "x-go-name": "Closed" }, "closingUserId": { "type": "string", "description": "The user ID that closed this investigation", "x-go-name": "ClosingUserID" }, "created": { "type": "string", "description": "When was this created", "format": "date-time", "x-go-name": "Created" }, "dbotCreatedBy": { "type": "string", "description": "Who has created this event - relevant only for manual incidents", "x-go-name": "CreatedBy" }, "dbotCurrentDirtyFields": { "type": "array", "description": "For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration", "items": { "type": "string" }, "x-go-name": "DBotCurrentDirtyFields" }, "dbotDirtyFields": { "type": "array", "description": "For mirroring, manage a list of dirty fields to not override them from the source of the incident", "items": { "type": "string" }, "x-go-name": "DBotDirtyFields" }, "dbotMirrorDirection": { "type": "string", "description": "DBotMirrorDirection of how to mirror the incident (in/out/both)", "x-go-name": "DBotMirrorDirection" }, "dbotMirrorId": { "type": "string", "description": "DBotMirrorID of a remote system we are syncing with", "x-go-name": "DBotMirrorID" }, "dbotMirrorInstance": { "type": "string", "description": "DBotMirrorInstance name of a mirror integration instance", "x-go-name": "DBotMirrorInstance" }, "dbotMirrorLastSync": { "type": "string", "description": "The last time we synced this incident even if we did not update anything", "format": "date-time", "x-go-name": "DBotMirrorLastSync" }, "dbotMirrorTags": { "type": "array", "description": "The entry tags I want to sync to remote system", "items": { "type": "string" }, "x-go-name": "DBotMirrorEntryTags" }, "details": { "type": "string", "description": "The details of the incident - reason, etc.", "x-go-name": "Details" }, "droppedCount": { "type": "integer", "description": "DroppedCount ...", "format": "int64", "example": 0, "x-go-name": "DroppedCount" }, "dueDate": { "type": "string", "description": "SLA", "format": "date-time", "x-go-name": "DueDate" }, "feedBased": { "type": "boolean", "description": "If this incident was triggered by a feed job", "x-go-name": "FeedBased" }, "hasRole": { "type": "boolean", "description": "Internal field to make queries on role faster", "x-go-name": "HasRole" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "investigationId": { "type": "string", "description": "Investigation that was opened as a result of the incoming event", "x-go-name": "Investigation" }, "isDebug": { "type": "boolean", "description": "IsDebug ...", "x-go-name": "IsDebug" }, "isPlayground": { "type": "boolean", "description": "IsPlayGround", "x-go-name": "IsPlayGround" }, "labels": { "type": "array", "description": "Labels related to incident - each label is composed of a type and value", "items": { "$ref": "#/components/schemas/Label" }, "x-go-name": "Labels" }, "lastJobRunTime": { "type": "string", "description": "If this incident was triggered by a job, this would be the time the **previous** job started", "format": "date-time", "x-go-name": "LastJobRunTime" }, "lastOpen": { "type": "string", "format": "date-time", "x-go-name": "LastOpen" }, "linkedCount": { "type": "integer", "description": "LinkedCount ...", "format": "int64", "example": 0, "x-go-name": "LinkedCount" }, "linkedIncidents": { "type": "array", "description": "LinkedIncidents incidents that were marked as linked by user", "items": { "type": "string" }, "x-go-name": "LinkedIncidents" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "description": "Incident Name - given by user", "x-go-name": "Name" }, "notifyTime": { "type": "string", "description": "Incdicates when last this field was changed with a value that supposed to send a notification", "format": "date-time", "x-go-name": "NotifyTime" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "occurred": { "type": "string", "description": "When this incident has really occurred", "format": "date-time", "x-go-name": "Occurred" }, "openDuration": { "type": "integer", "description": "Duration incident was open", "format": "int64", "example": 0, "x-go-name": "OpenDuration" }, "owner": { "type": "string", "description": "The user who owns this incident", "x-go-name": "OwnerID" }, "parent": { "type": "string", "description": "Parent", "x-go-name": "Parent" }, "phase": { "type": "string", "description": "Phase", "x-go-name": "Phase" }, "playbookId": { "type": "string", "description": "The associated playbook for this incident", "x-go-name": "PlaybookID" }, "previousAllRead": { "type": "boolean", "x-go-name": "PreviousAllRead" }, "previousAllReadWrite": { "type": "boolean", "x-go-name": "PreviousAllReadWrite" }, "previousRoles": { "type": "array", "description": "Do not change this field manually", "items": { "type": "string" }, "x-go-name": "PreviousRoleName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "rawCategory": { "type": "string", "x-go-name": "RawCategory" }, "rawCloseReason": { "type": "string", "description": "The reason for closing the incident (select from existing predefined values)", "x-go-name": "RawArchiveReason" }, "rawJSON": { "type": "string", "x-go-name": "RawJSONData" }, "rawName": { "type": "string", "description": "Incident RawName", "x-go-name": "RawName" }, "rawPhase": { "type": "string", "description": "RawPhase", "x-go-name": "RawPhase" }, "rawType": { "type": "string", "description": "Incident raw type", "x-go-name": "RawType" }, "reason": { "type": "string", "description": "The reason for the resolve", "x-go-name": "Reason" }, "reminder": { "type": "string", "description": "When if at all to send a reminder", "format": "date-time", "x-go-name": "Reminder" }, "roles": { "type": "array", "description": "The role assigned to this investigation", "items": { "type": "string" }, "x-go-name": "RoleName" }, "runStatus": { "$ref": "#/components/schemas/RunStatus" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "severity": { "$ref": "#/components/schemas/Severity" }, "sla": { "$ref": "#/components/schemas/SLAState" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "sourceBrand": { "type": "string", "description": "SourceBrand ...", "x-go-name": "SourceBrand" }, "sourceInstance": { "type": "string", "description": "SourceInstance ...", "x-go-name": "SourceInstance" }, "status": { "$ref": "#/components/schemas/IncidentStatus" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "todoTaskIds": { "type": "array", "description": "ToDoTaskIDs list of to do task ids", "items": { "type": "string" }, "x-go-name": "ToDoTaskIDs" }, "type": { "type": "string", "description": "Incident type", "x-go-name": "Type" }, "version": { "type": "integer", "format": "int64", "example": 0, "x-go-name": "Versn" }, "xsoarHasReadOnlyRole": { "type": "boolean", "x-go-name": "HasReadOnlyRole" }, "xsoarPreviousReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousReadOnlyRoleName" }, "xsoarReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReadOnlyRoleName" } }, "description": "Note: CustomFields (an optional generic object type) is missing from the following definition.", "x-go-package": "github.com/demisto/server/domain" }, "IncidentField": { "type": "object", "title": "IncidentField ...", "properties": { "aliasTo": { "type": "string", "x-go-name": "AliasTo" }, "aliases": { "type": "array", "items": { "$ref": "#/components/schemas/FieldsAlias" }, "x-go-name": "Aliases" }, "associatedToAll": { "type": "boolean", "x-go-name": "AssociatedToAll" }, "associatedTypes": { "description": "AssociatedTypes - list of incident (case) types IDs related to specific incident field", "type": "array", "items": { "type": "string" }, "x-go-name": "AssociatedTypes" }, "autoCompleteTags": { "type": "array", "items": { "type": "string" }, "x-go-name": "AutoCompleteTags" }, "breachScript": { "type": "string", "x-go-name": "BreachScript" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "caseInsensitive": { "type": "boolean", "x-go-name": "CaseInsensitive" }, "cliName": { "type": "string", "x-go-name": "CliName" }, "closeForm": { "type": "boolean", "x-go-name": "CloseForm" }, "columns": { "type": "array", "items": { "$ref": "#/components/schemas/GridColumn" }, "x-go-name": "GridColumns" }, "commitMessage": { "type": "string", "x-go-name": "CommitMessage" }, "content": { "type": "boolean", "x-go-name": "Content" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "defaultRows": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "object" } }, "x-go-name": "DefaultRows" }, "definitionId": { "type": "string", "x-go-name": "DefinitionID" }, "description": { "type": "string", "x-go-name": "Description" }, "editForm": { "type": "boolean", "x-go-name": "EditForm" }, "fieldCalcScript": { "type": "string", "x-go-name": "FieldCalcScript" }, "fromServerVersion": { "$ref": "#/components/schemas/Version" }, "group": { "$ref": "#/components/schemas/FieldGroup" }, "hidden": { "type": "boolean", "x-go-name": "Hidden" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "isReadOnly": { "type": "boolean", "x-go-name": "IsReadOnly" }, "itemVersion": { "$ref": "#/components/schemas/Version" }, "locked": { "type": "boolean", "x-go-name": "Locked" }, "mergeStrategy": { "$ref": "#/components/schemas/FieldMergeStrategy" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "x-go-name": "Name" }, "neverSetAsRequired": { "type": "boolean", "x-go-name": "NeverSetAsRequired" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "openEnded": { "type": "boolean", "x-go-name": "OpenEnded" }, "orgType": { "type": "string", "x-go-name": "OrgType" }, "ownerOnly": { "type": "boolean", "x-go-name": "OwnerOnly" }, "packID": { "type": "string", "x-go-name": "PackID" }, "packName": { "type": "string", "x-go-name": "PackName" }, "packPropagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PackPropagationLabels" }, "placeholder": { "type": "string", "x-go-name": "Placeholder" }, "prevName": { "type": "string", "x-go-name": "PrevName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "propagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PropagationLabels" }, "remote": { "type": "boolean", "x-go-name": "Remote" }, "required": { "type": "boolean", "x-go-name": "Required" }, "runScriptAfterUpdate": { "type": "boolean", "x-go-name": "RunScriptAfterIncUpdate" }, "script": { "type": "string", "x-go-name": "Script" }, "selectValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SelectValues" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "shouldCommit": { "type": "boolean", "x-go-name": "ShouldCommit" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "sla": { "type": "integer", "format": "int64", "x-go-name": "SLA" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "system": { "type": "boolean", "x-go-name": "System" }, "systemAssociatedTypes": { "type": "array", "items": { "type": "string" }, "x-go-name": "SystemAssociatedTypes" }, "template": { "type": "string", "x-go-name": "Template" }, "threshold": { "type": "number", "format": "double", "x-go-name": "Threshold" }, "toServerVersion": { "$ref": "#/components/schemas/Version" }, "type": { "type": "string", "x-go-name": "Type" }, "unmapped": { "type": "boolean", "x-go-name": "Unmapped" }, "unsearchable": { "type": "boolean", "x-go-name": "UnSearchable" }, "useAsKpi": { "type": "boolean", "x-go-name": "UseAsKpi" }, "validatedError": { "type": "string", "x-go-name": "ValidatedError" }, "validationRegex": { "type": "string", "x-go-name": "ValidationRegex" }, "vcShouldIgnore": { "type": "boolean", "x-go-name": "VCShouldIgnore" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean", "x-go-name": "VCShouldKeepItemLegacyProdMachine" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "x2_fields": { "type": "string", "x-go-name": "XSIAMFields" } }, "x-go-package": "github.com/demisto/server/domain" }, "IncidentFilter": { "title": "IncidentFilter", "type": "object", "description": "IncidentFilter allows for very simple filtering.", "x-go-package": "github.com/demisto/server/repo/entities", "properties": { "andOp": { "type": "boolean", "x-go-name": "AndOp" }, "category": { "type": "array", "x-go-name": "Category", "items": { "type": "string" } }, "details": { "type": "string", "x-go-name": "Details" }, "files": { "type": "array", "x-go-name": "Files", "items": { "type": "string" } }, "fromDate": { "type": "string", "format": "date-time", "x-go-name": "FromDate" }, "id": { "type": "array", "x-go-name": "ID", "items": { "type": "string" } }, "investigation": { "type": "array", "x-go-name": "Investigation", "items": { "type": "string" } }, "level": { "type": "array", "x-go-name": "Level", "items": { "$ref": "#/components/schemas/Severity" } }, "name": { "type": "array", "x-go-name": "Name", "items": { "type": "string" } }, "notInvestigation": { "type": "array", "x-go-name": "NotInvestigation", "items": { "type": "string" } }, "page": { "type": "integer", "description": "0-based page", "format": "int64", "x-go-name": "Page" }, "period": { "$ref": "#/components/schemas/Period" }, "query": { "type": "string", "x-go-name": "Query", "description": "If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value." }, "reason": { "type": "array", "x-go-name": "Reason", "items": { "type": "string" } }, "size": { "maximum": 10000, "type": "integer", "description": "Size is limited to 10000. If not specified, it defaults to 25.", "format": "int64", "default": 25, "x-go-name": "Size" }, "sort": { "type": "array", "description": "The sort order", "x-go-name": "Sort", "items": { "$ref": "#/components/schemas/Order" } }, "status": { "type": "array", "x-go-name": "Status", "items": { "$ref": "#/components/schemas/IncidentStatus" } }, "timeFrame": { "$ref": "#/components/schemas/Duration" }, "toDate": { "type": "string", "format": "date-time", "x-go-name": "ToDate" }, "type": { "type": "array", "x-go-name": "Type", "items": { "type": "string" } }, "urls": { "type": "array", "x-go-name": "Urls", "items": { "type": "string" } } } }, "IncidentSearchResponseWrapper": { "description": "IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)", "type": "object", "properties": { "accountErrors": { "type": "array", "items": { "type": "string" }, "x-go-name": "AccountErrors" }, "data": { "description": "in: body", "type": "array", "items": { "$ref": "#/components/schemas/IncidentWrapper" }, "x-go-name": "Data" }, "notUpdated": { "type": "integer", "format": "uint64", "x-go-name": "NotUpdated" }, "searchAfter": { "type": "array", "items": { "type": "string" }, "x-go-name": "SearchAfter" }, "searchAfterElastic": { "type": "array", "items": { "type": "string" }, "x-go-name": "SearchAfterElastic" }, "searchBefore": { "type": "array", "items": { "type": "string" }, "x-go-name": "SearchBefore" }, "searchBeforeElastic": { "type": "array", "items": { "type": "string" }, "x-go-name": "SearchBeforeElastic" }, "total": { "type": "integer", "format": "int64", "x-go-name": "Total" }, "totalAccounts": { "type": "integer", "format": "int64", "x-go-name": "TotalAccounts" } }, "x-go-package": "github.com/demisto/server/domain" }, "IncidentStatus": { "title": "IncidentStatus", "maximum": 2, "minimum": 0, "type": "number", "description": "IncidentStatus is the status of the incident", "format": "double", "example": 2, "x-go-package": "github.com/demisto/server/domain" }, "IncidentType": { "title": "IncidentType", "type": "object", "properties": { "autorun": { "type": "boolean", "x-go-name": "IsAutoRun" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "closureScript": { "type": "string", "x-go-name": "ClosureScript" }, "color": { "type": "string", "x-go-name": "Color" }, "commitMessage": { "type": "string", "x-go-name": "CommitMessage" }, "days": { "type": "integer", "format": "int64", "x-go-name": "Days" }, "daysR": { "type": "integer", "format": "int64", "x-go-name": "DaysReminder" }, "default": { "type": "boolean", "x-go-name": "IsDefaultType" }, "definitionId": { "type": "string", "x-go-name": "DefinitionID" }, "detached": { "type": "boolean", "x-go-name": "Detached" }, "disabled": { "type": "boolean", "x-go-name": "Disabled" }, "extractSettings": { "$ref": "#/components/schemas/IncidentTypeExtractSettings" }, "fromServerVersion": { "$ref": "#/components/schemas/Version" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "hours": { "type": "integer", "format": "int64", "x-go-name": "Hours" }, "hoursR": { "type": "integer", "format": "int64", "x-go-name": "HoursReminder" }, "id": { "type": "string", "x-go-name": "ID" }, "itemVersion": { "$ref": "#/components/schemas/Version" }, "layout": { "type": "string", "x-go-name": "Layout" }, "locked": { "type": "boolean", "x-go-name": "Locked" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "x-go-name": "Name" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "onChangeRepAlg": { "$ref": "#/components/schemas/ReputationCalcAlg" }, "packID": { "type": "string", "x-go-name": "PackID" }, "packName": { "type": "string", "x-go-name": "PackName" }, "packPropagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PackPropagationLabels" }, "playbookId": { "type": "string", "x-go-name": "PlaybookID" }, "preProcessingScript": { "type": "string", "x-go-name": "PreProcessingScript" }, "prevName": { "type": "string", "x-go-name": "PrevName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "propagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PropagationLabels" }, "readonly": { "type": "boolean", "x-go-name": "ReadOnly" }, "remote": { "type": "boolean", "x-go-name": "Remote" }, "reputationCalc": { "$ref": "#/components/schemas/ReputationCalcAlg" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "shouldCommit": { "type": "boolean", "x-go-name": "ShouldCommit" }, "sla": { "type": "integer", "format": "int64", "x-go-name": "SLA" }, "slaReminder": { "type": "integer", "format": "int64", "x-go-name": "SLAReminder" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "system": { "type": "boolean", "x-go-name": "System" }, "toServerVersion": { "$ref": "#/components/schemas/Version" }, "vcShouldIgnore": { "type": "boolean", "x-go-name": "VCShouldIgnore" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean", "x-go-name": "VCShouldKeepItemLegacyProdMachine" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "weeks": { "type": "integer", "format": "int64", "x-go-name": "Weeks" }, "weeksR": { "type": "integer", "format": "int64", "x-go-name": "WeeksReminder" } }, "description": "", "x-go-package": "github.com/demisto/server/domain" }, "IncidentTypeRequest": { "title": "IncidentTypeRequest", "type": "object", "properties": { "autorun": { "type": "boolean", "x-go-name": "IsAutoRun" }, "closureScript": { "type": "string", "x-go-name": "ClosureScript" }, "extractSettings": { "$ref": "#/components/schemas/IncidentTypeExtractSettings" }, "id": { "type": "string", "x-go-name": "ID" }, "layout": { "type": "string", "x-go-name": "Layout" }, "name": { "type": "string", "x-go-name": "Name" }, "playbookId": { "type": "string", "x-go-name": "PlaybookID" }, "preProcessingScript": { "type": "string", "x-go-name": "PreProcessingScript" }, "sla": { "type": "integer", "format": "int64", "x-go-name": "SLA" }, "slaReminder": { "type": "integer", "format": "int64", "x-go-name": "SLAReminder" }, "color": { "type": "string" } }, "x-go-package": "github.com/demisto/server/domain" }, "IncidentTypeExtractSettings": { "title": "IncidentTypeExtractSettings", "type": "object", "properties": { "fieldCliNameToExtractSettings": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/FieldExtractSetting" }, "x-go-name": "FieldCliNameToExtractSettings" }, "mode": { "$ref": "#/components/schemas/ExtractSettingsMode" } }, "x-go-package": "github.com/demisto/server/domain" }, "IncidentWrapper": { "type": "object", "properties": { "ShardID": { "type": "integer", "format": "int64" }, "account": { "type": "string", "description": "Account holds the tenant name so that slicing and dicing on the master can leverage bleve", "x-go-name": "Account" }, "activated": { "type": "string", "description": "When was this activated", "format": "date-time", "x-go-name": "Activated" }, "activatingingUserId": { "type": "string", "description": "The user that activated this investigation", "x-go-name": "ActivatingUserID" }, "allRead": { "type": "boolean", "x-go-name": "IsAllRead" }, "allReadWrite": { "type": "boolean", "x-go-name": "IsAllReadWrite" }, "attachment": { "type": "array", "description": "Attachments", "items": { "$ref": "#/components/schemas/Attachment" }, "x-go-name": "Attachments" }, "autime": { "type": "integer", "description": "AlmostUniqueTime is an attempt to have a unique sortable ID for an incident", "format": "int64", "x-go-name": "AlmostUniqueTime" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "canvases": { "type": "array", "description": "Canvases of the incident", "items": { "type": "string" }, "x-go-name": "Canvases" }, "category": { "type": "string", "description": "Category", "x-go-name": "Category" }, "changeStatus": { "type": "string", "x-go-name": "ChangeStatus" }, "closeNotes": { "type": "string", "description": "Notes for closing the incident", "x-go-name": "CloseNotes" }, "closeReason": { "type": "string", "description": "The reason for closing the incident (select from existing predefined values)", "x-go-name": "ArchiveReason" }, "closed": { "type": "string", "description": "When was this closed", "format": "date-time", "x-go-name": "Closed" }, "closingUserId": { "type": "string", "description": "The user ID that closed this investigation", "x-go-name": "ClosingUserID" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "dbotCreatedBy": { "type": "string", "description": "Who has created this event - relevant only for manual incidents", "x-go-name": "CreatedBy" }, "dbotCurrentDirtyFields": { "type": "array", "description": "For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration", "items": { "type": "string" }, "x-go-name": "DBotCurrentDirtyFields" }, "dbotDirtyFields": { "type": "array", "description": "For mirroring, manage a list of dirty fields to not override them from the source of the incident", "items": { "type": "string" }, "x-go-name": "DBotDirtyFields" }, "dbotMirrorDirection": { "type": "string", "description": "DBotMirrorDirection of how to mirror the incident (in/out/both)", "x-go-name": "DBotMirrorDirection" }, "dbotMirrorId": { "type": "string", "description": "DBotMirrorID of a remote system we are syncing with", "x-go-name": "DBotMirrorID" }, "dbotMirrorInstance": { "type": "string", "description": "DBotMirrorInstance name of a mirror integration instance", "x-go-name": "DBotMirrorInstance" }, "dbotMirrorLastSync": { "type": "string", "description": "The last time we synced this incident even if we did not update anything", "format": "date-time", "x-go-name": "DBotMirrorLastSync" }, "dbotMirrorTags": { "type": "array", "description": "The entry tags I want to sync to remote system", "items": { "type": "string" }, "x-go-name": "DBotMirrorEntryTags" }, "details": { "type": "string", "description": "The details of the incident - reason, etc.", "x-go-name": "Details" }, "droppedCount": { "type": "integer", "description": "DroppedCount ...", "format": "int64", "x-go-name": "DroppedCount" }, "dueDate": { "type": "string", "description": "SLA", "format": "date-time", "x-go-name": "DueDate" }, "feedBased": { "type": "boolean", "description": "If this incident was triggered by a feed job", "x-go-name": "FeedBased" }, "hasRole": { "type": "boolean", "description": "Internal field to make queries on role faster", "x-go-name": "HasRole" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "insights": { "type": "integer", "format": "uint64", "x-go-name": "Insights" }, "investigationId": { "type": "string", "description": "Investigation that was opened as a result of the incoming event", "x-go-name": "Investigation" }, "isDebug": { "type": "boolean", "description": "IsDebug ...", "x-go-name": "IsDebug" }, "isPlayground": { "type": "boolean", "description": "IsPlayGround", "x-go-name": "IsPlayGround" }, "labels": { "type": "array", "description": "Labels related to incident - each label is composed of a type and value", "items": { "$ref": "#/components/schemas/Label" }, "x-go-name": "Labels" }, "lastJobRunTime": { "type": "string", "description": "If this incident was triggered by a job, this would be the time the **previous** job started", "format": "date-time", "x-go-name": "LastJobRunTime" }, "lastOpen": { "type": "string", "format": "date-time", "x-go-name": "LastOpen" }, "linkedCount": { "type": "integer", "description": "LinkedCount ...", "format": "int64", "x-go-name": "LinkedCount" }, "linkedIncidents": { "type": "array", "description": "LinkedIncidents incidents that were marked as linked by user", "items": { "type": "string" }, "x-go-name": "LinkedIncidents" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "description": "Incident Name - given by user", "x-go-name": "Name" }, "notifyTime": { "type": "string", "description": "Incdicates when last this field was changed with a value that supposed to send a notification", "format": "date-time", "x-go-name": "NotifyTime" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "occurred": { "type": "string", "description": "When this incident has really occurred", "format": "date-time", "x-go-name": "Occurred" }, "openDuration": { "type": "integer", "description": "Duration incident was open", "format": "int64", "x-go-name": "OpenDuration" }, "owner": { "type": "string", "description": "The user who owns this incident", "x-go-name": "OwnerID" }, "parent": { "type": "string", "description": "Parent", "x-go-name": "Parent" }, "phase": { "type": "string", "description": "Phase", "x-go-name": "Phase" }, "playbookId": { "type": "string", "description": "The associated playbook for this incident", "x-go-name": "PlaybookID" }, "previousAllRead": { "type": "boolean", "x-go-name": "PreviousAllRead" }, "previousAllReadWrite": { "type": "boolean", "x-go-name": "PreviousAllReadWrite" }, "previousRoles": { "type": "array", "description": "Do not change this field manually", "items": { "type": "string" }, "x-go-name": "PreviousRoleName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "rawCategory": { "type": "string", "x-go-name": "RawCategory" }, "rawCloseReason": { "type": "string", "description": "The reason for closing the incident (select from existing predefined values)", "x-go-name": "RawArchiveReason" }, "rawJSON": { "type": "string", "x-go-name": "RawJSONData" }, "rawName": { "type": "string", "description": "Incident RawName", "x-go-name": "RawName" }, "rawPhase": { "type": "string", "description": "RawPhase", "x-go-name": "RawPhase" }, "rawType": { "type": "string", "description": "Incident raw type", "x-go-name": "RawType" }, "reason": { "type": "string", "description": "The reason for the resolve", "x-go-name": "Reason" }, "reminder": { "type": "string", "description": "When if at all to send a reminder", "format": "date-time", "x-go-name": "Reminder" }, "roles": { "type": "array", "description": "The role assigned to this investigation", "items": { "type": "string" }, "x-go-name": "RoleName" }, "runStatus": { "$ref": "#/components/schemas/RunStatus" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "severity": { "$ref": "#/components/schemas/Severity" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "sla": { "$ref": "#/components/schemas/SLAState" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "sourceBrand": { "type": "string", "description": "SourceBrand ...", "x-go-name": "SourceBrand" }, "sourceInstance": { "type": "string", "description": "SourceInstance ...", "x-go-name": "SourceInstance" }, "status": { "$ref": "#/components/schemas/IncidentStatus" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "todoTaskIds": { "type": "array", "description": "ToDoTaskIDs list of to do task ids", "items": { "type": "string" }, "x-go-name": "ToDoTaskIDs" }, "type": { "type": "string", "description": "Incident type", "x-go-name": "Type" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "xsoarHasReadOnlyRole": { "type": "boolean", "x-go-name": "HasReadOnlyRole" }, "xsoarPreviousReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousReadOnlyRoleName" }, "xsoarReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReadOnlyRoleName" } }, "description": "IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client", "x-go-package": "github.com/demisto/server/domain" }, "IndicatorContext": { "type": "object", "properties": { "entryId": { "type": "string", "x-go-name": "EntryID" }, "indicator": { "$ref": "#/components/schemas/IocObject" }, "investigationId": { "type": "string", "x-go-name": "InvestigationID" }, "manually": { "type": "boolean", "x-go-name": "Manually" }, "seenNow": { "type": "boolean", "x-go-name": "SeenNow" } }, "x-go-package": "github.com/demisto/server/web", "title": "" }, "IndicatorFilter": { "title": "IndicatorFilter", "type": "object", "description": "IndicatorFilter is a general filter that fetches entities using a query string query using the Query value", "x-go-package": "github.com/demisto/server/repo/entities", "properties": { "filterobjectquery": { "type": "string", "x-go-name": "FilterObjectQuery" }, "firstSeen": { "$ref": "#/components/schemas/DateRangeFilter" }, "fromDate": { "type": "string", "format": "date-time", "x-go-name": "FromDate" }, "lastSeen": { "$ref": "#/components/schemas/DateRangeFilter" }, "period": { "$ref": "#/components/schemas/Period" }, "query": { "type": "string", "x-go-name": "Query" }, "size": { "maximum": 10000, "type": "integer", "description": "Size is limited to 10000. If not specified, it defaults to 100.", "format": "int64", "example": 1000, "default": 100, "x-go-name": "Size" }, "sort": { "type": "array", "description": "The sort order", "x-go-name": "Sort", "items": { "$ref": "#/components/schemas/Order" } }, "timeFrame": { "$ref": "#/components/schemas/Duration" }, "toDate": { "type": "string", "format": "date-time", "x-go-name": "ToDate" } } }, "IndicatorResult": { "title": "IndicatorResult", "type": "object", "properties": { "accountErrors": { "type": "array", "items": { "type": "string" }, "x-go-name": "AccountErrors" }, "iocObjects": { "$ref": "#/components/schemas/IocObjects" }, "total": { "type": "integer", "format": "int64", "x-go-name": "Total" }, "totalAccounts": { "type": "integer", "format": "int64", "x-go-name": "TotalAccounts" } }, "x-go-package": "github.com/demisto/server/web" }, "IndicatorTimeline": { "title": "IndicatorTimeline ...", "type": "array", "items": { "$ref": "#/components/schemas/IndicatorTimelineFromEntry" }, "x-go-package": "github.com/demisto/server/domain" }, "IndicatorTimelineFromEntry": { "title": "IndicatorTimelineFromEntry ...", "type": "object", "properties": { "Category": { "type": "string" }, "Message": { "type": "string" }, "Source": { "type": "string" }, "Time": { "type": "string", "format": "date-time" }, "User": { "type": "string" }, "Value": { "type": "array", "items": { "type": "string" } } }, "x-go-package": "github.com/demisto/server/domain" }, "InsightCache": { "title": "InsightCache", "type": "object", "properties": { "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "scores": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/DBotScore" }, "x-go-name": "Scores" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" } }, "description": "InsightCache - map insight name to all its metadata. Name is case insensitive.", "x-go-package": "github.com/demisto/server/domain" }, "Investigation": { "description": "A special investigation called playground is created for each user-project combination and is a private space for the researcher to play in.", "type": "object", "title": "Investigation contains the investigation of a particular incident.", "properties": { "ShardID": { "type": "integer", "format": "int64" }, "allRead": { "type": "boolean", "x-go-name": "IsAllRead" }, "allReadWrite": { "type": "boolean", "x-go-name": "IsAllReadWrite" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "category": { "description": "Category of the investigation", "type": "string", "x-go-name": "Category" }, "childInvestigations": { "description": "ChildInvestigations id's", "type": "array", "items": { "type": "string" }, "x-go-name": "ChildInvestigations" }, "closed": { "description": "When was this closed", "type": "string", "format": "date-time", "x-go-name": "Closed" }, "closingUserId": { "description": "The user ID that closed this investigation", "type": "string", "x-go-name": "ClosingUserID" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "creatingUserId": { "description": "The user ID that created this investigation", "type": "string", "x-go-name": "CreatingUserID" }, "dbotCreatedBy": { "description": "Who has created this event - relevant only for manual incidents", "type": "string", "x-go-name": "CreatedBy" }, "details": { "description": "User defined free text details", "type": "string", "x-go-name": "Details" }, "entitlements": { "description": "One time entitlements", "type": "array", "items": { "type": "string" }, "x-go-name": "Entitlements" }, "entryUsers": { "description": "EntryUsers", "type": "array", "items": { "type": "string" }, "x-go-name": "EntryUsers" }, "hasRole": { "description": "Internal field to make queries on role faster", "type": "boolean", "x-go-name": "HasRole" }, "highPriority": { "description": "HighPriority - tasks of this investigation should run in high priority", "type": "boolean", "x-go-name": "HighPriority" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "isChildInvestigation": { "description": "IsChildInvestigation", "type": "boolean", "x-go-name": "IsChildInvestigation" }, "isDebug": { "description": "IsDebug ...", "type": "boolean", "x-go-name": "IsDebug" }, "lastOpen": { "type": "string", "format": "date-time", "x-go-name": "LastOpen" }, "mirrorAutoClose": { "description": "MirrorAutoClose will tell us to close the Chat Module channel if we close investigation", "type": "object", "additionalProperties": { "type": "boolean" }, "x-go-name": "MirrorAutoClose" }, "mirrorTypes": { "description": "MirrorTypes holds info about mirror direction and message type to be mirrored\nmessage type can be either 'all' or 'chat'\ndirection can be either 'FromDemisto', 'ToDemisto' or 'Both' if this investigation is mirrored", "type": "object", "additionalProperties": { "type": "string" }, "x-go-name": "MirrorTypes" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "description": "The name of the investigation, which is unique to the project", "type": "string", "x-go-name": "Name" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "openDuration": { "description": "Duration from open to close time", "type": "integer", "format": "int64", "x-go-name": "OpenDuration" }, "parentInvestigation": { "description": "ParentInvestigation - parent id, in case this is a child investigation of another investigation", "type": "string", "x-go-name": "ParentInvestigation" }, "persistentEntitlements": { "description": "Persistent entitlement per tag. Empty tag will also return an entitlement", "type": "object", "additionalProperties": { "type": "string" }, "x-go-name": "PersistentEntitlements" }, "previousAllRead": { "type": "boolean", "x-go-name": "PreviousAllRead" }, "previousAllReadWrite": { "type": "boolean", "x-go-name": "PreviousAllReadWrite" }, "previousRoles": { "description": "Do not change this field manually", "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousRoleName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "rawCategory": { "type": "string", "x-go-name": "RawCategory" }, "reason": { "description": "The reason for the status (resolve)", "type": "object", "additionalProperties": { "type": "string" }, "x-go-name": "Reason" }, "roles": { "description": "The role assigned to this investigation", "type": "array", "items": { "type": "string" }, "x-go-name": "RoleName" }, "runStatus": { "$ref": "#/components/schemas/RunStatus" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "slackMirrorAutoClose": { "description": "DEPRECATED - DeprecatedSlackMirrorAutoClose will tell us to close the Slack channel if we close investigation", "type": "boolean", "x-go-name": "DeprecatedSlackMirrorAutoClose" }, "slackMirrorType": { "description": "DEPRECATED - DeprecatedSlackMirrorType holds info about mirror direction and message type to be mirror\nmessage type can be either 'all' or 'chat'\ndirection can be either 'demisto2Slack', 'slack2Demisto' or 'both' if this investigation is mirrored to Slack", "type": "string", "x-go-name": "DeprecatedSlackMirrorType" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "status": { "$ref": "#/components/schemas/InvestigationStatus" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "systems": { "description": "The systems involved", "type": "array", "items": { "$ref": "#/components/schemas/System" }, "x-go-name": "Systems" }, "tags": { "description": "Tags", "type": "array", "items": { "type": "string" }, "x-go-name": "Tags" }, "type": { "$ref": "#/components/schemas/InvestigationType" }, "users": { "description": "The users who share this investigation", "type": "array", "items": { "type": "string" }, "x-go-name": "Users" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "xsoarHasReadOnlyRole": { "type": "boolean", "x-go-name": "HasReadOnlyRole" }, "xsoarPreviousReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousReadOnlyRoleName" }, "xsoarReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReadOnlyRoleName" } }, "x-go-package": "github.com/demisto/server/domain" }, "InvestigationPlaybook": { "type": "object", "properties": { "Dirty": { "type": "boolean" }, "ReadyPlaybookInputs": { "type": "object", "additionalProperties": { "type": "object", "additionalProperties": { "type": "object", "properties": {} } } }, "ReplacedPlaybook": { "type": "boolean", "description": "Indicate whether this playbook has new history during this session" }, "ShardID": { "type": "integer", "format": "int64" }, "UpdatedOperatorIDs": { "type": "boolean" }, "allRead": { "type": "boolean", "x-go-name": "IsAllRead" }, "allReadWrite": { "type": "boolean", "x-go-name": "IsAllReadWrite" }, "autoExtracting": { "type": "boolean", "x-go-name": "AutoExtracting" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "comment": { "type": "string", "x-go-name": "Description" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "dbotCreatedBy": { "type": "string", "description": "Who has created this event - relevant only for manual incidents", "x-go-name": "CreatedBy" }, "hasRole": { "type": "boolean", "description": "Internal field to make queries on role faster", "x-go-name": "HasRole" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "incidentCreateDate": { "type": "string", "description": "Incident create date", "format": "date-time", "x-go-name": "IncidentCreateDate" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "inputs": { "$ref": "#/components/schemas/PlaybookInputs" }, "invPBDebugInfo": { "$ref": "#/components/schemas/InvPlaybookDebugInfo" }, "investigationId": { "type": "string", "x-go-name": "InvestigationID" }, "isTIM": { "type": "boolean", "x-go-name": "IsTIM" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "x-go-name": "Name" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "outputs": { "$ref": "#/components/schemas/PlaybookOutputs" }, "pbHistory": { "type": "array", "description": "in: body", "items": { "$ref": "#/components/schemas/InvestigationPlaybookData" }, "x-go-name": "PbHistory" }, "pendingTasks": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "description": "Tasks that are marked for running, but cannot yet run due to incomplete parents", "x-go-name": "PendingTasks" }, "playbookId": { "type": "string", "x-go-name": "PlaybookID" }, "previousAllRead": { "type": "boolean", "x-go-name": "PreviousAllRead" }, "previousAllReadWrite": { "type": "boolean", "x-go-name": "PreviousAllReadWrite" }, "previousRoles": { "type": "array", "description": "Do not change this field manually", "items": { "type": "string" }, "x-go-name": "PreviousRoleName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "quiet": { "type": "boolean", "x-go-name": "Quiet" }, "recoveryAttempts": { "type": "integer", "format": "int64", "x-go-name": "RecoveryAttempts" }, "roles": { "type": "array", "description": "The role assigned to this investigation", "items": { "type": "string" }, "x-go-name": "RoleName" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "serverId": { "type": "string", "description": "Holds the ID of the responsible cluster app server", "x-go-name": "ServerID" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "startDate": { "type": "string", "format": "date-time", "x-go-name": "StartDate" }, "startTaskId": { "type": "string", "description": "FirstTask is the root task of the playbook", "x-go-name": "StartTaskID" }, "state": { "$ref": "#/components/schemas/InvestigationPlaybookState" }, "subPlaybookInputs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/PlaybookInputs" }, "x-go-name": "SubPlaybookInputs" }, "subPlaybookOutputs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/PlaybookOutputs" }, "x-go-name": "SubPlaybookOutputs" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "tasks": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/InvestigationPlaybookTask" }, "x-go-name": "Tasks" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "view": { "$ref": "#/components/schemas/PlaybookView" }, "xsoarHasReadOnlyRole": { "type": "boolean", "x-go-name": "HasReadOnlyRole" }, "xsoarPreviousReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousReadOnlyRoleName" }, "xsoarReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReadOnlyRoleName" } }, "description": "InvestigationPlaybook is a wrapper for a linked list of Playbook tasks", "x-go-package": "github.com/demisto/server/domain" }, "InvestigationPlaybookData": { "type": "object", "properties": { "ReadyPlaybookInputs": { "type": "object", "additionalProperties": { "type": "object", "additionalProperties": { "type": "object", "properties": {} } } }, "autoExtracting": { "type": "boolean", "x-go-name": "AutoExtracting" }, "comment": { "type": "string", "x-go-name": "Description" }, "inputs": { "$ref": "#/components/schemas/PlaybookInputs" }, "investigationId": { "type": "string", "x-go-name": "InvestigationID" }, "isTIM": { "type": "boolean", "x-go-name": "IsTIM" }, "name": { "type": "string", "x-go-name": "Name" }, "outputs": { "$ref": "#/components/schemas/PlaybookOutputs" }, "pendingTasks": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "description": "Tasks that are marked for running, but cannot yet run due to incomplete parents", "x-go-name": "PendingTasks" }, "playbookId": { "type": "string", "x-go-name": "PlaybookID" }, "quiet": { "type": "boolean", "x-go-name": "Quiet" }, "startDate": { "type": "string", "format": "date-time", "x-go-name": "StartDate" }, "startTaskId": { "type": "string", "description": "FirstTask is the root task of the playbook", "x-go-name": "StartTaskID" }, "state": { "$ref": "#/components/schemas/InvestigationPlaybookState" }, "subPlaybookInputs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/PlaybookInputs" }, "x-go-name": "SubPlaybookInputs" }, "subPlaybookOutputs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/PlaybookOutputs" }, "x-go-name": "SubPlaybookOutputs" }, "tasks": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/InvestigationPlaybookTask" }, "x-go-name": "Tasks" }, "view": { "$ref": "#/components/schemas/PlaybookView" } }, "description": "InvestigationPlaybookData returns all data of an investigation playbook, not including history", "x-go-package": "github.com/demisto/server/domain" }, "InvestigationPlaybookState": { "type": "string", "description": "InvestigationPlaybookState indicates the state of the running playbook", "x-go-package": "github.com/demisto/server/domain" }, "InvestigationPlaybookTask": { "type": "object", "properties": { "Reopen": { "type": "boolean" }, "arguments": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "Arguments" }, "assignee": { "type": "string", "x-go-name": "Assignee" }, "assigneeSet": { "type": "boolean", "x-go-name": "AssigneeSet" }, "blockingTasks": { "type": "array", "items": { "type": "string" }, "x-go-name": "BlockingTasks" }, "calculatedDescription": { "type": "string", "x-go-name": "CalculatedDescription" }, "calculatedTaskName": { "type": "string", "x-go-name": "CalculatedTaskName" }, "comments": { "type": "boolean", "description": "Whether this task had any comments or not", "x-go-name": "Comments" }, "completedBy": { "type": "string", "x-go-name": "CompletedBy" }, "completedCount": { "type": "integer", "format": "int64", "x-go-name": "CompletedCount" }, "completedDate": { "type": "string", "format": "date-time", "x-go-name": "CompletedDate" }, "conditions": { "type": "array", "description": "Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)", "items": { "$ref": "#/components/schemas/TaskCondition" }, "x-go-name": "Conditions" }, "continueOnError": { "type": "boolean", "x-go-name": "ContinueOnError" }, "continueOnErrorType": { "$ref": "#/components/schemas/ContinueOnErrorType" }, "defaultAssignee": { "type": "string", "x-go-name": "DefaultAssignee" }, "defaultAssigneeComplex": { "$ref": "#/components/schemas/AdvanceArg" }, "defaultReminder": { "type": "integer", "format": "int64", "x-go-name": "DefaultReminder" }, "doNotSaveTaskHistory": { "type": "boolean", "x-go-name": "DoNotSaveTaskHistory" }, "dueDate": { "type": "string", "format": "date-time", "x-go-name": "DueDate" }, "dueDateDuration": { "type": "integer", "format": "int64", "x-go-name": "DueDateDuration" }, "dueDateDurationUnit": { "$ref": "#/components/schemas/SLADurationUnit" }, "dueDateSet": { "type": "boolean", "x-go-name": "DueDateSet" }, "entries": { "type": "array", "items": { "type": "string" }, "x-go-name": "Entries" }, "evidenceData": { "$ref": "#/components/schemas/EvidenceData" }, "executionCount": { "type": "integer", "format": "int64", "x-go-name": "ExecutionCount" }, "externalFormUseAuth": { "type": "boolean", "x-go-name": "ExternalFormUseAuth" }, "fieldMapping": { "type": "array", "items": { "$ref": "#/components/schemas/FieldMapping" }, "x-go-name": "FieldMappingArray" }, "forEachIndex": { "type": "integer", "description": "Parameters needed for loops", "format": "int64", "x-go-name": "ForEachIndex" }, "forEachInputs": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "object", "properties": {} } }, "x-go-name": "ForEachInputs" }, "form": { "$ref": "#/components/schemas/DataCollectionForm" }, "formDisplay": { "$ref": "#/components/schemas/FormDisplay" }, "hasErrorEntries": { "type": "boolean", "x-go-name": "CompletedWithErrorEntries" }, "id": { "type": "string", "x-go-name": "ID" }, "ignoreWorker": { "type": "boolean", "description": "Do not run this task in a worker", "x-go-name": "IgnoreWorker" }, "indent": { "type": "integer", "format": "int64", "x-go-name": "Indent" }, "input": { "type": "string", "x-go-name": "Input" }, "isAutoSwitchedToQuietMode": { "type": "boolean", "x-go-name": "IsAutoSwitchedToQuietMode" }, "isOverSize": { "type": "boolean", "x-go-name": "IsOverSize" }, "loop": { "$ref": "#/components/schemas/TaskLoop" }, "message": { "$ref": "#/components/schemas/NotifiableItem" }, "missingContentItem": { "type": "string", "description": "content item which caused task to skip", "x-go-name": "MissingContentItem" }, "nextPollingTime": { "type": "string", "description": "NextPollTime Time of the next scheduled command execution", "format": "date-time", "x-go-name": "NextPollTime" }, "nextTasks": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "NextTasks" }, "note": { "type": "boolean", "x-go-name": "Note" }, "outputs": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "Outputs" }, "parentBlockCount": { "type": "integer", "description": "the number of tasks that are waiting on blocked in subplaybooks of this task", "format": "int64", "x-go-name": "ParentBlockCount" }, "parentPlaybookID": { "type": "string", "x-go-name": "ParentPlaybookTaskID" }, "patched": { "type": "boolean", "description": "Indicates whether this task was patched to InvPB and did not originally belong to the playbook", "x-go-name": "Patched" }, "playbookInputs": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "PlaybookInputs" }, "pollingEntries": { "type": "array", "description": "PollingEntryIDs IDs of entries that are still polling", "items": { "type": "string" }, "x-go-name": "PollingEntryIDs" }, "pollingTimeoutTime": { "type": "string", "format": "date-time", "x-go-name": "PollingTimeoutTime" }, "previousTasks": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "PreviousTasks" }, "quietMode": { "$ref": "#/components/schemas/QuietMode" }, "reminder": { "type": "integer", "description": "Duration in minutes, this field is not persisted here", "format": "int64", "x-go-name": "Reminder" }, "reputationCalc": { "$ref": "#/components/schemas/ReputationCalcAlg" }, "restrictedCompletion": { "type": "boolean", "x-go-name": "RestrictedCompletion" }, "scriptArguments": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/AdvanceArg" }, "x-go-name": "ScriptArguments" }, "separateContext": { "type": "boolean", "x-go-name": "SeparateContext" }, "skip": { "type": "boolean", "description": "Skip - if true then this task will be skipped and all the tasks which comes after this task and depend on it\nwill skip (WillNotExecute)", "x-go-name": "Skip" }, "skipUnavailable": { "type": "boolean", "description": "SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto", "x-go-name": "SkipUnavailable" }, "sla": { "$ref": "#/components/schemas/SLA" }, "slaReminder": { "$ref": "#/components/schemas/SLA" }, "startDate": { "type": "string", "format": "date-time", "x-go-name": "StartDate" }, "startedExecutingHarmfulScript": { "type": "boolean", "x-go-name": "StartedExecutingHarmfulScript" }, "state": { "$ref": "#/components/schemas/TaskState" }, "subPlaybook": { "$ref": "#/components/schemas/InvestigationPlaybook" }, "task": { "$ref": "#/components/schemas/Task" }, "taskCompleteData": { "type": "array", "description": "History complete data", "items": { "$ref": "#/components/schemas/InvPlaybookTaskCompleteData" }, "x-go-name": "TaskCompleteData" }, "taskDebug": { "$ref": "#/components/schemas/InvTaskDebug" }, "taskId": { "type": "string", "x-go-name": "TaskID" }, "taskSize": { "type": "integer", "format": "int64", "x-go-name": "TaskSize" }, "timerTriggers": { "type": "array", "description": "SLA fields", "items": { "$ref": "#/components/schemas/TimerTrigger" }, "x-go-name": "TimerTriggers" }, "timesPolled": { "type": "integer", "format": "int64", "x-go-name": "TimesPolled" }, "type": { "$ref": "#/components/schemas/TaskType" }, "view": { "$ref": "#/components/schemas/TaskView" }, "willNotExecuteCount": { "type": "integer", "format": "int64", "x-go-name": "WillNotExecuteCount" }, "willNotExecuteReason": { "type": "string", "x-go-name": "WillNotExecuteReason" } }, "description": "InvestigationPlaybookTask is the Task in the playbook context as a node", "x-go-package": "github.com/demisto/server/domain" }, "InvestigationStatus": { "description": "InvestigationStatus is the status type", "type": "number", "format": "double", "x-go-package": "github.com/demisto/server/domain" }, "InvestigationType": { "type": "number", "format": "double", "title": "InvestigationType ...", "x-go-package": "github.com/demisto/server/domain" }, "InvPlaybookDebugInfo": { "title": "InvPlaybookDebugInfo ...", "type": "object", "properties": { "originalInvPBId": { "type": "string", "x-go-name": "OriginalInvPBID" } }, "x-go-package": "github.com/demisto/server/domain" }, "InvPlaybookTaskCompleteData": { "title": "InvPlaybookTaskCompleteData ...", "type": "object", "properties": { "arguments": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "Arguments" }, "calculatedDescription": { "type": "string", "x-go-name": "CalculatedDescription" }, "calculatedTaskName": { "type": "string", "x-go-name": "CalculatedTaskName" }, "completedBy": { "type": "string", "x-go-name": "CompletedBy" }, "completedCount": { "type": "integer", "format": "int64", "x-go-name": "CompletedCount" }, "completedDate": { "type": "string", "format": "date-time", "x-go-name": "CompletedDate" }, "entries": { "type": "array", "items": { "type": "string" }, "x-go-name": "Entries" }, "hasErrorEntries": { "type": "boolean", "x-go-name": "CompletedWithErrorEntries" }, "input": { "type": "string", "x-go-name": "Input" }, "outputs": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "Outputs" }, "playbookInputs": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "PlaybookInputs" }, "startDate": { "type": "string", "format": "date-time", "x-go-name": "StartDate" }, "state": { "$ref": "#/components/schemas/TaskState" }, "willNotExecuteCount": { "type": "integer", "format": "int64", "x-go-name": "WillNotExecuteCount" }, "willNotExecuteReason": { "type": "string", "x-go-name": "WillNotExecuteReason" } }, "x-go-package": "github.com/demisto/server/domain" }, "InvPlaybookTaskData": { "type": "object", "title": "InvPlaybookTaskData ...", "properties": { "addAfter": { "type": "boolean", "x-go-name": "AddAfter" }, "addToSeparateBranch": { "type": "boolean", "x-go-name": "AddToSeparateBranch" }, "automationScript": { "type": "string", "x-go-name": "AutomationScript" }, "description": { "type": "string", "x-go-name": "Description" }, "loop": { "$ref": "#/components/schemas/TaskLoop" }, "name": { "type": "string", "x-go-name": "Name" }, "neighborInvPBTaskId": { "type": "string", "x-go-name": "NeighborInvPBTaskID" }, "playbookId": { "type": "string", "x-go-name": "PlaybookID" }, "scriptArguments": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/AdvanceArg" }, "x-go-name": "ScriptArguments" }, "separateContext": { "type": "boolean", "x-go-name": "SeparateContext" }, "tags": { "type": "array", "items": { "type": "string" }, "x-go-name": "Tags" }, "type": { "$ref": "#/components/schemas/TaskType" } }, "x-go-package": "github.com/demisto/server/services" }, "InvTaskDebug": { "title": "InvTaskDebug ...", "type": "object", "properties": { "breakpointCondition": { "$ref": "#/components/schemas/ArgFilter" }, "inputOverrides": { "type": "object", "additionalProperties": { "type": "string" }, "x-go-name": "InputOverrides" }, "isMarkedWithBreakpoint": { "type": "boolean", "x-go-name": "IsMarkedWithBreakpoint" }, "isMarkedWithSkip": { "type": "boolean", "x-go-name": "IsMarkedWithSkip" }, "outputOverrides": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "x-go-name": "OutputOverrides" }, "shouldOverrideDebugInfo": { "type": "boolean", "x-go-name": "ShouldOverrideDebugInfo" }, "skipConditionOverrideTo": { "type": "string", "x-go-name": "SkipConditionOverrideTo" }, "taskOriginalId": { "type": "string", "x-go-name": "OriginalID" } }, "x-go-package": "github.com/demisto/server/domain" }, "invTaskInfo": { "type": "object", "x-go-package": "github.com/demisto/server/web", "properties": { "args": { "type": "object", "x-go-name": "Args", "additionalProperties": { "$ref": "#/components/schemas/AdvanceArg" } }, "comment": { "type": "string", "x-go-name": "Comment" }, "inTaskID": { "type": "string", "x-go-name": "TaskID" }, "input": { "type": "string", "x-go-name": "Input" }, "invId": { "type": "string", "x-go-name": "ID" } } }, "IocObject": { "title": "IocObject", "type": "object", "properties": { "CustomFields": { "$ref": "#/components/schemas/CustomFields" }, "account": { "type": "string", "x-go-name": "Account" }, "aggregatedReliability": { "type": "string", "x-go-name": "AggregatedReliability" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "calculatedTime": { "type": "string", "description": "Do not set the fields bellow this line", "format": "date-time", "x-go-name": "CalculatedTime" }, "comment": { "type": "string", "x-go-name": "Comment" }, "comments": { "$ref": "#/components/schemas/Comments" }, "deletedFeedFetchTime": { "type": "string", "format": "date-time", "x-go-name": "DeletedFeedFetchTime" }, "expiration": { "type": "string", "format": "date-time", "x-go-name": "ExpirationTime" }, "expirationSource": { "$ref": "#/components/schemas/ExpirationSource" }, "expirationStatus": { "$ref": "#/components/schemas/ExpirationStatus" }, "firstSeen": { "type": "string", "format": "date-time", "x-go-name": "FirstSeen" }, "firstSeenEntryID": { "type": "string", "x-go-name": "FirstSeenEntryID" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "indicator_type": { "type": "string", "x-go-name": "Type" }, "insightCache": { "$ref": "#/components/schemas/InsightCache" }, "investigationIDs": { "type": "array", "items": { "type": "string" }, "x-go-name": "InvestigationIDs" }, "isDetectable": { "type": "boolean", "x-go-name": "IsDetectable" }, "isPreventable": { "type": "boolean", "x-go-name": "IsPreventable" }, "isShared": { "type": "boolean", "x-go-name": "IsShared" }, "lastReputationRun": { "type": "string", "format": "date-time", "x-go-name": "LastReputationRun" }, "lastSeen": { "type": "string", "format": "date-time", "x-go-name": "LastSeen" }, "lastSeenEntryID": { "type": "string", "x-go-name": "LastSeenEntryID" }, "manualExpirationTime": { "type": "string", "format": "date-time", "x-go-name": "ManualExpirationTime" }, "manualScore": { "type": "boolean", "x-go-name": "ManualScore" }, "manualSetTime": { "type": "string", "format": "date-time", "x-go-name": "ManualSetTime" }, "manuallyEditedFields": { "type": "array", "items": { "type": "string" }, "x-go-name": "ManuallyEditedFields" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "modifiedTime": { "type": "string", "format": "date-time", "x-go-name": "ModifiedTime" }, "moduleToFeedMap": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/FeedIndicator" }, "x-go-name": "ModuleToFeedMap" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "relatedIncCount": { "type": "integer", "format": "int64", "x-go-name": "RelatedIncCount" }, "score": { "type": "integer", "format": "int64", "x-go-name": "Score" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "setBy": { "type": "string", "x-go-name": "SetBy" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "source": { "type": "string", "x-go-name": "Source" }, "sourceBrands": { "type": "array", "items": { "type": "string" }, "x-go-name": "SourceBrands" }, "sourceInstances": { "type": "array", "items": { "type": "string" }, "x-go-name": "SourceInstances" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "timestamp": { "type": "string", "format": "date-time", "x-go-name": "TimeStamp" }, "value": { "type": "string", "x-go-name": "Value" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" } }, "description": "IocObject - represents an Ioc (or simply an indicator) object", "x-go-package": "github.com/demisto/server/domain" }, "IocObjects": { "title": "IocObjects", "type": "array", "items": { "$ref": "#/components/schemas/IocObject" }, "x-go-package": "github.com/demisto/server/domain" }, "KeyValueArg": { "title": "KeyValueArg ...", "type": "object", "properties": { "key": { "type": "string", "x-go-name": "Key" }, "value": { "$ref": "#/components/schemas/AdvanceArg" } }, "x-go-package": "github.com/demisto/server/domain" }, "Label": { "title": "Label", "type": "object", "properties": { "type": { "type": "string", "x-go-name": "Type" }, "value": { "type": "string", "x-go-name": "Value" } }, "x-go-package": "github.com/demisto/server/domain" }, "ModuleArgs": { "type": "object", "additionalProperties": { "type": "object", "properties": {} }, "description": "ModuleArgs represents module args", "x-go-package": "github.com/demisto/server/domain" }, "NotifiableItem": { "title": "NotifiableItem ...", "type": "object", "properties": { "bcc": { "$ref": "#/components/schemas/AdvanceArg" }, "body": { "$ref": "#/components/schemas/AdvanceArg" }, "cc": { "$ref": "#/components/schemas/AdvanceArg" }, "defaultOption": { "type": "string", "x-go-name": "DefaultOption" }, "format": { "type": "string", "x-go-name": "Format" }, "methods": { "type": "array", "items": { "type": "string" }, "x-go-name": "Methods" }, "replyOptions": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReplyOptions" }, "subject": { "$ref": "#/components/schemas/AdvanceArg" }, "timings": { "$ref": "#/components/schemas/NotifyTimings" }, "to": { "$ref": "#/components/schemas/AdvanceArg" } }, "x-go-package": "github.com/demisto/server/domain" }, "NotifyTimings": { "title": "NotifyTimings - time control on notify items - retries max count and intervals.", "type": "object", "properties": { "completeAfterReplies": { "type": "integer", "format": "uint64", "x-go-name": "CompleteAfterReplies" }, "completeAfterSLA": { "type": "boolean", "x-go-name": "CompleteAfterSLA" }, "completeAfterV2": { "type": "boolean", "x-go-name": "CompleteAfterV2" }, "retriesCount": { "type": "integer", "format": "uint64", "x-go-name": "RetriesCount" }, "retriesInterval": { "type": "integer", "format": "uint64", "x-go-name": "RetriesInterval" } }, "x-go-package": "github.com/demisto/server/domain" }, "OperatorArgument": { "title": "OperatorArgument ...", "type": "object", "properties": { "isContext": { "type": "boolean", "x-go-name": "IsContext" }, "value": { "$ref": "#/components/schemas/AdvanceArg" } }, "x-go-package": "github.com/demisto/server/domain" }, "Order": { "title": "Order", "type": "object", "properties": { "asc": { "type": "boolean", "x-go-name": "Asc" }, "field": { "type": "string", "x-go-name": "Field" }, "fieldType": { "type": "string", "x-go-name": "FieldType" } }, "description": "Order structure holds a sort field and the direction of sorting", "x-go-package": "github.com/demisto/server/domain" }, "Output": { "type": "object", "properties": { "contentPath": { "type": "string", "x-go-name": "ContentPath" }, "contextPath": { "type": "string", "x-go-name": "ContextPath" }, "description": { "type": "object", "properties": {}, "description": "Description is either a string or a map from string to interface", "x-go-name": "Description" }, "type": { "$ref": "#/components/schemas/OutputType" } }, "description": "Output of a module command", "x-go-package": "github.com/demisto/server/domain" }, "OutputType": { "title": "OutputType ...", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "Period": { "title": "Period", "type": "object", "properties": { "by": { "type": "string" }, "byFrom": { "type": "string", "x-go-name": "ByFrom" }, "byTo": { "type": "string", "x-go-name": "ByTo" }, "field": { "type": "string", "x-go-name": "Field" }, "fromValue": { "type": "string", "format": "duration", "x-go-name": "FromValue" }, "toValue": { "type": "string", "format": "duration", "x-go-name": "ToValue" } }, "description": "Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.", "x-go-package": "github.com/demisto/server/domain" }, "Playbook": { "description": "Playbook is a collection of tasks", "type": "object", "properties": { "allRead": { "type": "boolean", "x-go-name": "IsAllRead" }, "allReadWrite": { "type": "boolean", "x-go-name": "IsAllReadWrite" }, "brands": { "type": "array", "items": { "type": "string" }, "x-go-name": "Brands" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "commands": { "type": "array", "items": { "type": "string" }, "x-go-name": "Commands" }, "comment": { "type": "string", "x-go-name": "Description" }, "commitMessage": { "type": "string", "x-go-name": "CommitMessage" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "dbotCreatedBy": { "description": "Who has created this event - relevant only for manual incidents", "type": "string", "x-go-name": "CreatedBy" }, "definitionId": { "type": "string", "x-go-name": "DefinitionID" }, "deprecated": { "type": "boolean", "x-go-name": "Deprecated" }, "detached": { "type": "boolean", "x-go-name": "Detached" }, "encTasks": { "type": "string", "x-go-name": "EncTasks" }, "fromServerVersion": { "$ref": "#/components/schemas/Version" }, "hasRole": { "description": "Internal field to make queries on role faster", "type": "boolean", "x-go-name": "HasRole" }, "hidden": { "type": "boolean", "x-go-name": "Hidden" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "inputs": { "$ref": "#/components/schemas/PlaybookInputs" }, "itemVersion": { "$ref": "#/components/schemas/Version" }, "locked": { "type": "boolean", "x-go-name": "Locked" }, "missingScriptsIds": { "type": "array", "items": { "type": "string" }, "x-go-name": "MissingScriptsIDs" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "x-go-name": "Name" }, "nameRaw": { "type": "string", "x-go-name": "NameRaw" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "outputs": { "$ref": "#/components/schemas/PlaybookOutputs" }, "packID": { "type": "string", "x-go-name": "PackID" }, "packName": { "type": "string", "x-go-name": "PackName" }, "packPropagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PackPropagationLabels" }, "prevName": { "type": "string", "x-go-name": "PrevName" }, "previousAllRead": { "type": "boolean", "x-go-name": "PreviousAllRead" }, "previousAllReadWrite": { "type": "boolean", "x-go-name": "PreviousAllReadWrite" }, "previousRoles": { "description": "Do not change this field manually", "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousRoleName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "private": { "type": "boolean", "x-go-name": "Private" }, "propagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PropagationLabels" }, "quiet": { "type": "boolean", "x-go-name": "Quiet" }, "remote": { "type": "boolean", "x-go-name": "Remote" }, "roles": { "description": "The role assigned to this investigation", "type": "array", "items": { "type": "string" }, "x-go-name": "RoleName" }, "scriptIds": { "type": "array", "items": { "type": "string" }, "x-go-name": "ScriptIDs" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "shouldCommit": { "type": "boolean", "x-go-name": "ShouldCommit" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "sourcePlaybookID": { "type": "string", "x-go-name": "SourcePlaybookID" }, "startTaskId": { "type": "string", "x-go-name": "StartTaskID" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "system": { "type": "boolean", "x-go-name": "System" }, "tags": { "type": "array", "items": { "type": "string" }, "x-go-name": "Tags" }, "taskIds": { "description": "auto generated field that will contain all task ids in this playbook\nNeeded for searching with bleve", "type": "array", "items": { "type": "string" }, "x-go-name": "TaskIDs" }, "tasks": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/PlaybookTask" }, "x-go-name": "Tasks" }, "toServerVersion": { "$ref": "#/components/schemas/Version" }, "vcShouldIgnore": { "type": "boolean", "x-go-name": "VCShouldIgnore" }, "vcShouldKeepItemLegacyProdMachine": { "type": "boolean", "x-go-name": "VCShouldKeepItemLegacyProdMachine" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" }, "view": { "$ref": "#/components/schemas/PlaybookView" }, "xsoarHasReadOnlyRole": { "type": "boolean", "x-go-name": "HasReadOnlyRole" }, "xsoarPreviousReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "PreviousReadOnlyRoleName" }, "xsoarReadOnlyRoles": { "type": "array", "items": { "type": "string" }, "x-go-name": "ReadOnlyRoleName" } }, "x-go-package": "github.com/demisto/server/domain" }, "PlaybookInput": { "type": "object", "properties": { "description": { "type": "string", "x-go-name": "Description" }, "key": { "type": "string", "x-go-name": "Key" }, "playbookInputQuery": { "$ref": "#/components/schemas/PlaybookInputQuery" }, "required": { "type": "boolean", "x-go-name": "Required" }, "value": { "$ref": "#/components/schemas/AdvanceArg" } }, "description": "PlaybookInput represents the playbook input", "x-go-package": "github.com/demisto/server/domain" }, "PlaybookInputQuery": { "type": "object", "properties": { "fromDate": { "type": "string", "format": "date-time", "x-go-name": "FromDate" }, "fromDateLicense": { "type": "string", "format": "date-time", "x-go-name": "FromDateLicenseVal" }, "period": { "$ref": "#/components/schemas/Period" }, "query": { "type": "string", "x-go-name": "Query" }, "queryEntity": { "type": "string", "x-go-name": "QueryEntity" }, "queryState": { "$ref": "#/components/schemas/QueryState" }, "results": { "type": "object", "properties": {}, "x-go-name": "Results" }, "runFromLastJobTime": { "type": "boolean", "x-go-name": "RunFromLastJobTime" }, "toDate": { "type": "string", "format": "date-time", "x-go-name": "ToDate" } }, "description": "PlaybookInputQuery represents the playbook query input", "x-go-package": "github.com/demisto/server/domain" }, "PlaybookInputs": { "type": "array", "description": "PlaybookInputs - array of PlaybookInput", "items": { "$ref": "#/components/schemas/PlaybookInput" }, "x-go-package": "github.com/demisto/server/domain" }, "PlaybookOutput": { "type": "object", "properties": { "contextPath": { "type": "string", "x-go-name": "ContextPath" }, "description": { "type": "string", "x-go-name": "Description" }, "type": { "$ref": "#/components/schemas/OutputType" } }, "description": "PlaybookOutput represents the playbook output", "x-go-package": "github.com/demisto/server/domain" }, "PlaybookOutputs": { "type": "array", "description": "PlaybookOutputs - array of PlaybookOutput", "items": { "$ref": "#/components/schemas/PlaybookOutput" }, "x-go-package": "github.com/demisto/server/domain" }, "PlaybookTask": { "type": "object", "title": "PlaybookTask ...", "properties": { "conditions": { "description": "Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)", "type": "array", "items": { "$ref": "#/components/schemas/TaskCondition" }, "x-go-name": "Conditions" }, "continueOnError": { "type": "boolean", "x-go-name": "ContinueOnError" }, "continueOnErrorType": { "$ref": "#/components/schemas/ContinueOnErrorType" }, "defaultAssignee": { "type": "string", "x-go-name": "DefaultAssignee" }, "defaultAssigneeComplex": { "$ref": "#/components/schemas/AdvanceArg" }, "defaultReminder": { "type": "integer", "format": "int64", "x-go-name": "DefaultReminder" }, "evidenceData": { "$ref": "#/components/schemas/EvidenceData" }, "externalFormUseAuth": { "type": "boolean", "x-go-name": "ExternalFormUseAuth" }, "fieldMapping": { "type": "array", "items": { "$ref": "#/components/schemas/FieldMapping" }, "x-go-name": "FieldMappingArray" }, "form": { "$ref": "#/components/schemas/DataCollectionForm" }, "formDisplay": { "$ref": "#/components/schemas/FormDisplay" }, "id": { "type": "string", "x-go-name": "ID" }, "ignoreWorker": { "description": "Do not run this task in a worker", "type": "boolean", "x-go-name": "IgnoreWorker" }, "isAutoSwitchedToQuietMode": { "type": "boolean", "x-go-name": "IsAutoSwitchedToQuietMode" }, "isOverSize": { "type": "boolean", "x-go-name": "IsOverSize" }, "loop": { "$ref": "#/components/schemas/TaskLoop" }, "message": { "$ref": "#/components/schemas/NotifiableItem" }, "nextTasks": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "NextTasks" }, "note": { "type": "boolean", "x-go-name": "Note" }, "quietMode": { "$ref": "#/components/schemas/QuietMode" }, "reputationCalc": { "$ref": "#/components/schemas/ReputationCalcAlg" }, "restrictedCompletion": { "type": "boolean", "x-go-name": "RestrictedCompletion" }, "scriptArguments": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/AdvanceArg" }, "x-go-name": "ScriptArguments" }, "separateContext": { "type": "boolean", "x-go-name": "SeparateContext" }, "skipUnavailable": { "description": "SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto", "type": "boolean", "x-go-name": "SkipUnavailable" }, "sla": { "$ref": "#/components/schemas/SLA" }, "slaReminder": { "$ref": "#/components/schemas/SLA" }, "task": { "$ref": "#/components/schemas/Task" }, "taskId": { "type": "string", "x-go-name": "TaskID" }, "timerTriggers": { "description": "SLA fields", "type": "array", "items": { "$ref": "#/components/schemas/TimerTrigger" }, "x-go-name": "TimerTriggers" }, "type": { "$ref": "#/components/schemas/TaskType" }, "view": { "$ref": "#/components/schemas/TaskView" } }, "x-go-package": "github.com/demisto/server/domain" }, "PlaybookView": { "type": "object", "description": "PlaybookView represents the view in client of playbook graph", "x-go-package": "github.com/demisto/server/domain" }, "playbookWithWarnings": { "type": "object", "properties": { "playbook": { "$ref": "#/components/schemas/Playbook" }, "warnings": { "type": "array", "items": { "type": "string" }, "x-go-name": "Warnings" } }, "x-go-package": "github.com/demisto/server/web" }, "QueryState": { "type": "object", "properties": { "batchSize": { "type": "integer", "format": "int64", "x-go-name": "BatchSize" }, "currentPage": { "type": "integer", "format": "int64", "x-go-name": "CurrentPage" }, "searchAfter": { "type": "array", "items": { "type": "string" }, "x-go-name": "SearchAfter" }, "totalResults": { "type": "integer", "format": "int64", "x-go-name": "TotalResults" } }, "description": "QueryState represents the playbook query state", "x-go-package": "github.com/demisto/server/domain" }, "Question": { "title": "Question - question for a form with a given type.", "type": "object", "properties": { "columns": { "type": "array", "items": { "$ref": "#/components/schemas/GridColumn" }, "x-go-name": "GridColumns" }, "defaultRows": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "object", "properties": {} } }, "x-go-name": "DefaultRows" }, "fieldAssociated": { "type": "string", "x-go-name": "FieldAssociated" }, "id": { "type": "string", "x-go-name": "ID" }, "label": { "type": "string", "x-go-name": "Label" }, "labelArg": { "$ref": "#/components/schemas/AdvanceArg" }, "options": { "type": "array", "items": { "type": "string" }, "x-go-name": "Options" }, "optionsArg": { "type": "array", "items": { "$ref": "#/components/schemas/AdvanceArg" }, "x-go-name": "OptionsArg" }, "placeholder": { "type": "string", "x-go-name": "Placeholder" }, "readOnly": { "type": "boolean", "x-go-name": "ReadOnly" }, "required": { "type": "boolean", "x-go-name": "Required" }, "tooltip": { "type": "string", "x-go-name": "Tooltip" }, "type": { "type": "string", "x-go-name": "Type" } }, "x-go-package": "github.com/demisto/server/domain" }, "QuietMode": { "type": "integer", "description": "QuietMode quiet mode for playbook task", "format": "int64", "x-go-package": "github.com/demisto/server/domain" }, "RawFeedIndicator": { "description": "RawFeedIndicator is an unparsed feed indicator from JSON ingestion", "type": "object", "additionalProperties": { "type": "object" }, "x-go-package": "github.com/demisto/server/web" }, "RelationshipAPI": { "title": "RelationshipAPI", "type": "object", "properties": { "brand": { "type": "string", "x-go-name": "Brand" }, "entityA": { "type": "string", "x-go-name": "EntityA" }, "entityAFamily": { "type": "string", "x-go-name": "EntityAFamily" }, "entityAType": { "type": "string", "x-go-name": "EntityAType" }, "entityB": { "type": "string", "x-go-name": "EntityB" }, "entityBFamily": { "type": "string", "x-go-name": "EntityBFamily" }, "entityBType": { "type": "string", "x-go-name": "EntityBType" }, "fields": { "$ref": "#/components/schemas/CustomFields" }, "id": { "type": "string", "x-go-name": "ID" }, "instance": { "type": "string", "x-go-name": "Instance" }, "name": { "type": "string", "x-go-name": "Name" }, "reliability": { "$ref": "#/components/schemas/Reliability" }, "reverseName": { "type": "string", "x-go-name": "ReverseName" }, "startTime": { "type": "string", "format": "date-time", "x-go-name": "StartTime" }, "type": { "type": "string", "x-go-name": "TypeID" } }, "description": "", "x-go-package": "github.com/demisto/server/domain" }, "RelationshipsAPI": { "title": "RelationshipsAPI", "type": "array", "items": { "$ref": "#/components/schemas/RelationshipAPI" }, "x-go-package": "github.com/demisto/server/domain" }, "Reliability": { "title": "Reliability", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "reply": { "title": "reply", "type": "object", "properties": { "err_code": { "type": "string", "description": "HTTP response code." }, "err_msg": { "type": "string", "description": "Error message." }, "err_extra": { "type": "string", "description": "Additional information describing the error." } }, "description": "The query result upon error." }, "ReputationCalcAlg": { "type": "number", "format": "double", "title": "ReputationCalcAlg ...", "x-go-package": "github.com/demisto/server/domain" }, "RunStatus": { "title": "RunStatus", "type": "string", "description": "Run status of a job.", "x-go-package": "github.com/demisto/server/domain" }, "ScriptAPI": { "title": "ScriptAPI ...", "type": "object", "properties": { "arguments": { "type": "array", "items": { "$ref": "#/components/schemas/Argument" }, "x-go-name": "Args" }, "comment": { "type": "string", "x-go-name": "Comment" }, "contextKeys": { "type": "array", "items": { "type": "string" }, "x-go-name": "ContextKeys" }, "dependsOn": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "DependsOn" }, "deprecated": { "type": "boolean", "x-go-name": "Deprecated" }, "detached": { "type": "boolean", "x-go-name": "Detached" }, "dockerImage": { "type": "string", "x-go-name": "DockerImage" }, "enabled": { "type": "boolean", "x-go-name": "Enabled" }, "hidden": { "type": "boolean", "x-go-name": "Hidden" }, "id": { "type": "string", "x-go-name": "ID" }, "locked": { "type": "boolean", "x-go-name": "Locked" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "x-go-name": "Name" }, "outputs": { "type": "array", "items": { "$ref": "#/components/schemas/Output" }, "x-go-name": "Outputs" }, "permitted": { "type": "boolean", "x-go-name": "Permitted" }, "polling": { "type": "boolean", "x-go-name": "Polling" }, "propagationLabels": { "type": "array", "items": { "type": "string" }, "x-go-name": "PropagationLabels" }, "roles": { "type": "array", "items": { "type": "string" }, "x-go-name": "Roles" }, "runAs": { "type": "string", "x-go-name": "RunAs" }, "scriptTarget": { "$ref": "#/components/schemas/ScriptTarget" }, "system": { "type": "boolean", "x-go-name": "System" }, "tags": { "type": "array", "items": { "type": "string" }, "x-go-name": "Tags" }, "type": { "$ref": "#/components/schemas/ScriptType" }, "user": { "type": "string", "x-go-name": "User" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Version" } }, "x-go-package": "github.com/demisto/server/services/automation" }, "ScriptSubType": { "type": "string", "description": "ScriptSubType holds the script type version", "x-go-package": "github.com/demisto/server/domain" }, "ScriptTarget": { "type": "integer", "description": "ScriptTarget represents the module where this script should run", "format": "int64", "x-go-package": "github.com/demisto/server/domain" }, "ScriptType": { "type": "string", "description": "ScriptType holds the type of a script", "x-go-package": "github.com/demisto/server/domain" }, "SLA": { "title": "SLA ...", "type": "object", "properties": { "days": { "type": "integer", "format": "int64", "x-go-name": "Days" }, "hours": { "type": "integer", "format": "int64", "x-go-name": "Hours" }, "minutes": { "type": "integer", "format": "int64", "x-go-name": "Minutes" }, "weeks": { "type": "integer", "format": "int64", "x-go-name": "Weeks" } }, "x-go-package": "github.com/demisto/server/domain" }, "SLADurationUnit": { "type": "integer", "description": "SLADurationUnit is a helper to calculate if SLA in hours or minutes", "format": "int64", "x-go-package": "github.com/demisto/server/domain" }, "SLAState": { "title": "SLAState", "type": "number", "description": "SLAState is the incident SLA at closure time, in minutes.", "format": "double", "x-go-package": "github.com/demisto/server/domain" }, "SearchIncidentsData": { "title": "SearchIncidentsData", "type": "object", "properties": { "filter": { "$ref": "#/components/schemas/IncidentFilter" } }, "x-go-package": "github.com/demisto/server/repo/entities" }, "Severity": { "title": "Severity", "maximum": 4, "minimum": 0, "type": "number", "description": "Severity is the incident severity", "format": "double", "example": 2, "x-go-package": "github.com/demisto/server/domain" }, "StatsResponseWithReferenceLine": { "type": "object", "title": "StatsResponseWithReferenceLine - Describe the data returned related to a specific Line/Column chart widget cell in a dashboard.", "properties": { "groups": { "$ref": "#/components/schemas/Groups" }, "referenceLineY": { "type": "number", "format": "double", "x-go-name": "ReferenceLineY" } }, "x-go-package": "github.com/demisto/server/repo/entities" }, "StatsTextResponse": { "type": "object", "title": "StatsTextResponse - Describe the data returned related to a specific text widget cell in a dashboard.", "properties": { "groups": { "$ref": "#/components/schemas/Groups" }, "text": { "description": "Describe the complete text for the text widget, after placeholders injection.", "type": "string", "x-go-name": "Text" } }, "x-go-package": "github.com/demisto/server/repo/entities" }, "StatsTrendsResponse": { "description": "StatsTrendsResponse - Represent a trend response from statistics. Provides information about\nthe current value and the previous value based on the period.", "type": "object", "properties": { "currSum": { "type": "number", "format": "double", "x-go-name": "CurrSum" }, "prevSum": { "type": "number", "format": "double", "x-go-name": "PrevSum" } }, "x-go-package": "github.com/demisto/server/domain" }, "System": { "description": "System - URL stands for ip or hostname", "type": "object", "properties": { "agent": { "$ref": "#/components/schemas/SystemAgent" }, "arch": { "type": "string", "x-go-name": "Arch" }, "ciphers": { "type": "array", "items": { "type": "string" }, "x-go-name": "Ciphers" }, "credentials": { "type": "string", "x-go-name": "CredentialsName" }, "engineId": { "type": "string", "x-go-name": "EngineID" }, "host": { "type": "string", "x-go-name": "Host" }, "integrationinstanceid": { "type": "string", "x-go-name": "IntegrationInstanceID" }, "issharedagent": { "type": "boolean", "x-go-name": "IsSharedAgent" }, "name": { "type": "string", "x-go-name": "Name" }, "os": { "type": "string", "x-go-name": "OS" }, "password": { "type": "string", "x-go-name": "Password" }, "servicesID": { "type": "string", "x-go-name": "ServicesID" }, "smb": { "type": "integer", "format": "int64", "x-go-name": "SMBv" }, "smbport": { "type": "integer", "format": "uint16", "x-go-name": "SMBPort" }, "sshkey": { "type": "string", "x-go-name": "SSHKey" }, "sshport": { "type": "integer", "format": "uint16", "x-go-name": "SSHPort" }, "terminalOptions": { "$ref": "#/components/schemas/TerminalOptions" }, "user": { "type": "string", "x-go-name": "User" }, "workgroup": { "type": "string", "x-go-name": "Workgroup" } }, "x-go-package": "github.com/demisto/server/domain" }, "SystemAgent": { "description": "SystemAgent - represents agent status and holds server context", "type": "object", "properties": { "servercontext": { "type": "array", "items": { "type": "integer", "format": "uint8" }, "x-go-name": "ServerContext" } }, "x-go-package": "github.com/demisto/server/domain" }, "Task": { "type": "object", "properties": { "brand": { "type": "string", "x-go-name": "Brand" }, "cacheVersn": { "type": "integer", "format": "int64", "x-go-name": "CacheVersn" }, "clonedFrom": { "type": "string", "x-go-name": "ClonedFrom" }, "comment": { "type": "string", "x-go-name": "Comment" }, "conditions": { "type": "array", "items": { "type": "string" }, "x-go-name": "ConditionnKeys" }, "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "description": { "type": "string", "x-go-name": "Description" }, "highlight": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "x-go-name": "Highlight" }, "id": { "type": "string", "x-go-name": "ID" }, "indexName": { "type": "string", "x-go-name": "IndexName" }, "isCommand": { "type": "boolean", "x-go-name": "IsCommand" }, "isLocked": { "type": "boolean", "x-go-name": "IsLocked" }, "isTitleTask": { "type": "boolean", "x-go-name": "IsTitleTask" }, "modified": { "type": "string", "format": "date-time", "x-go-name": "Modified" }, "name": { "type": "string", "x-go-name": "Name" }, "numericId": { "type": "integer", "format": "int64", "x-go-name": "NumericID" }, "playbookId": { "type": "string", "x-go-name": "PlaybookID" }, "playbookName": { "type": "string", "x-go-name": "PlaybookName" }, "primaryTerm": { "type": "integer", "format": "int64", "x-go-name": "PrimaryTerm" }, "scriptId": { "type": "string", "x-go-name": "AutomationScriptID" }, "sequenceNumber": { "type": "integer", "format": "int64", "x-go-name": "SeqNum" }, "sizeInBytes": { "type": "integer", "format": "int64", "x-go-name": "SizeInBytes" }, "sortValues": { "type": "array", "items": { "type": "string" }, "x-go-name": "SortValues" }, "syncHash": { "type": "string", "x-go-name": "SyncHash" }, "tags": { "type": "array", "items": { "type": "string" }, "x-go-name": "Tags" }, "type": { "$ref": "#/components/schemas/TaskType" }, "version": { "type": "integer", "format": "int64", "x-go-name": "Versn" } }, "description": "Task is the basic task in the task repository that can be associated to an incident via playbook", "x-go-package": "github.com/demisto/server/domain" }, "TaskCondition": { "type": "object", "properties": { "condition": { "type": "array", "items": { "$ref": "#/components/schemas/ArgFilter" }, "x-go-name": "Condition" }, "label": { "type": "string", "x-go-name": "Label" } }, "description": "TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)", "x-go-package": "github.com/demisto/server/domain" }, "TaskLoop": { "type": "object", "properties": { "brand": { "type": "string", "x-go-name": "Brand" }, "builtinCondition": { "type": "array", "items": { "$ref": "#/components/schemas/ArgFilter" }, "x-go-name": "BuiltInCondition" }, "exitCondition": { "type": "string", "x-go-name": "ExitCondition" }, "forEach": { "type": "boolean", "x-go-name": "ForEach" }, "isCommand": { "type": "boolean", "x-go-name": "IsCommand" }, "max": { "type": "integer", "format": "int64", "x-go-name": "MaxIterations" }, "scriptArguments": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/AdvanceArg" }, "x-go-name": "ScriptArguments" }, "scriptId": { "type": "string", "x-go-name": "AutomationScriptID" }, "scriptName": { "type": "string", "x-go-name": "AutomationScriptName" }, "wait": { "type": "integer", "format": "int64", "x-go-name": "WaitBetweenIterations" } }, "description": "TaskLoop contains loop details", "x-go-package": "github.com/demisto/server/domain" }, "TaskState": { "type": "string", "description": "TaskState indicates the state of the task during the incident/investigation execution", "x-go-package": "github.com/demisto/server/domain" }, "TaskType": { "type": "string", "description": "TaskType is the Task in the playbook context as a node", "x-go-package": "github.com/demisto/server/domain" }, "TaskView": { "type": "object", "description": "TaskView represents the view in client of the tasks graph", "x-go-package": "github.com/demisto/server/domain" }, "TerminalOptions": { "description": "TerminalOptions - terminal options to use in case of using pty", "type": "object", "properties": { "Echo": { "type": "integer", "format": "uint32" }, "Terminal": { "type": "boolean" }, "TerminalHeight": { "type": "integer", "format": "int64" }, "TerminalType": { "type": "string" }, "TerminalWidth": { "type": "integer", "format": "int64" }, "TyISpeed": { "type": "integer", "format": "uint32" }, "TyOSpeed": { "type": "integer", "format": "uint32" } }, "x-go-package": "github.com/demisto/server/domain" }, "TimerAction": { "title": "TimerAction ...", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "TimerTrigger": { "title": "TimerTrigger ...", "type": "object", "properties": { "action": { "$ref": "#/components/schemas/TimerAction" }, "fieldName": { "type": "string", "x-go-name": "FieldName" } }, "x-go-package": "github.com/demisto/server/domain" }, "TransformerOperatorID": { "title": "TransformerOperatorID ...", "type": "string", "x-go-package": "github.com/demisto/server/domain" }, "UpdateDataBatch": { "type": "object", "title": "UpdateDataBatch ...", "x-go-package": "github.com/demisto/server/web", "properties": { "CustomFields": { "type": "object", "additionalProperties": { "type": "object" } }, "all": { "type": "boolean", "x-go-name": "All", "description": "When `all` is `true`, all of the incidents are exported to CSV. \r\n\r\n**Note:** When `all`:`true`, all settings relating to page size and number are ignored." }, "closeNotes": { "type": "string", "x-go-name": "CloseNotes" }, "closeReason": { "type": "string", "x-go-name": "CloseReason" }, "columns": { "type": "array", "x-go-name": "Columns", "items": { "type": "string" } }, "data": { "type": "object", "x-go-name": "Data", "additionalProperties": { "type": "object" } }, "filter": { "$ref": "#/components/schemas/IncidentFilter" }, "force": { "type": "boolean", "x-go-name": "Force" }, "ids": { "type": "array", "x-go-name": "IDs", "description": "Specify the list of incident IDs to be included in the CSV file. \r\n\r\n**Note:** When you choose to specify the IDs, all settings relating to page size and number are ignored.", "items": { "type": "string" } }, "line": { "type": "string", "x-go-name": "Line" }, "originalIncidentId": { "type": "string", "x-go-name": "OriginalIncidentID" }, "overrideInvestigation": { "type": "boolean", "x-go-name": "OverrideInvestigation" } } }, "updateEntry": { "type": "object", "properties": { "args": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/AdvanceArg" }, "x-go-name": "Args" }, "data": { "type": "string", "x-go-name": "Data" }, "id": { "type": "string", "x-go-name": "ID" }, "investigationId": { "type": "string", "x-go-name": "InvestigationID" } }, "x-go-package": "github.com/demisto/server/web" }, "updateEntryTags": { "type": "object", "x-go-package": "github.com/demisto/server/web", "properties": { "id": { "type": "string", "x-go-name": "ID" }, "investigationId": { "type": "string", "x-go-name": "InvestigationID" }, "tags": { "type": "array", "x-go-name": "Tags", "items": { "type": "string" } } } }, "UpdateResponse": { "type": "object", "title": "UpdateResponse ...", "properties": { "notUpdated": { "type": "integer", "format": "int64", "x-go-name": "NotUpdated" }, "updatedIds": { "type": "array", "items": { "type": "string" }, "x-go-name": "UpdatedIds" }, "uppdated": { "type": "integer", "format": "int64", "x-go-name": "Updated" } }, "x-go-package": "github.com/demisto/server/repo/entities" }, "Version": { "title": "Version", "type": "object", "properties": { "Digits": { "type": "array", "description": "WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.", "items": { "type": "integer", "format": "int64" } }, "Label": { "type": "string" } }, "description": "Version represents a version.", "x-go-package": "github.com/demisto/server/domain" }, "WhitelistedIndicator": { "type": "object", "description": "WhitelistedIndicator Excluded indicator", "x-go-package": "github.com/demisto/server/domain", "properties": { "created": { "type": "string", "format": "date-time", "x-go-name": "Created" }, "id": { "type": "string", "x-go-name": "ID" }, "locked": { "type": "boolean", "x-go-name": "Locked" }, "reason": { "type": "string", "x-go-name": "Reason" }, "reputations": { "type": "array", "x-go-name": "Reputations", "items": { "type": "string" } }, "type": { "type": "string", "x-go-name": "Type" }, "value": { "type": "string", "x-go-name": "Value" }, "whitelistTime": { "type": "string", "format": "date-time", "x-go-name": "WhitelistTime" } } }, "securityDefinitions": { "type": "object" }, "SystemDiagnosticsResponse": { "type": "object", "required": [ "reply" ], "properties": { "reply": { "$ref": "#/components/schemas/SystemDiagnosticsResults" } } }, "SystemDiagnosticsResults": { "type": "object", "required": [ "results" ], "properties": { "results": { "type": "array", "description": "List of system diagnostics snapshots ordered by timestamp descending (most recent first).", "items": { "$ref": "#/components/schemas/SystemDiagnosticsSnapshot" } } } }, "SystemDiagnosticsSnapshot": { "type": "object", "description": "A point-in-time system diagnostics snapshot.", "required": [ "timestamp" ], "properties": { "timestamp": { "type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of the diagnostics snapshot.", "example": "2024-10-27T10:00:00Z" }, "nodes": { "type": "array", "description": "List of node-level health metrics.", "items": { "$ref": "#/components/schemas/NodeMetrics" } }, "cluster_disk_usage": { "type": "number", "format": "float", "nullable": true, "description": "Cluster-wide disk usage percentage (0.0\u2013100.0).", "example": 35.2 }, "components": { "type": "object", "description": "Component group names mapped to their health status. Possible statuses: HEALTHY, WARNING, ERROR.", "additionalProperties": { "type": "string", "enum": [ "HEALTHY", "WARNING", "ERROR" ] }, "example": { "API": "HEALTHY", "Databases": "HEALTHY", "External Gateways": "WARNING" } }, "storage": { "type": "object", "description": "Storage group names mapped to their usage percentage.", "additionalProperties": { "type": "number", "format": "float" }, "example": { "Relational DB": 45, "Cache": 60.2, "Object Storage": 12.5 } }, "queues": { "type": "object", "description": "Queue names mapped to their current depth (number of items).", "additionalProperties": { "type": "integer" }, "example": { "Manual": 0, "Automated": 12 } }, "connectivity": { "$ref": "#/components/schemas/ConnectivityStatus" } } }, "NodeMetrics": { "type": "object", "description": "Health metrics for a single cluster node.", "required": [ "name", "connected" ], "properties": { "name": { "type": "string", "description": "Node name identifier (typically the hostname or IP-based name).", "example": "ip-10-0-1-5" }, "cpu_usage": { "type": "number", "format": "float", "nullable": true, "description": "CPU usage percentage (0.0\u2013100.0).", "example": 15.5 }, "memory_usage": { "type": "number", "format": "float", "nullable": true, "description": "Memory usage percentage (0.0\u2013100.0).", "example": 42.1 }, "os_disk_usage": { "type": "number", "format": "float", "nullable": true, "description": "OS disk usage percentage (0.0\u2013100.0).", "example": 25 }, "connected": { "type": "boolean", "description": "Whether the node is currently connected and reporting metrics.", "example": true } } }, "ConnectivityStatus": { "type": "object", "description": "External connectivity status to Palo Alto Networks cloud services.", "required": [ "connected" ], "properties": { "connected": { "type": "boolean", "description": "Whether external connectivity is currently established.", "example": true }, "since": { "type": "string", "format": "date-time", "nullable": true, "description": "ISO 8601 UTC timestamp of when the current connectivity status began. Null if no connectivity data is available.", "example": "2024-10-20T08:00:00Z" }, "error": { "type": "string", "nullable": true, "description": "Error message describing the connectivity issue. Null when connected successfully.", "example": null } } }, "ErrorResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "err_code": { "type": "integer", "description": "HTTP response code." }, "err_msg": { "type": "string", "description": "Error message." }, "err_extra": { "type": "string", "nullable": true, "description": "Additional information describing the error." } } } } } } }, "x-original-swagger-version": "2.0" }