Integrations
APIs for managing integration instances and credentials.
Get all integrations.
Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Responses
200
OK
application/json
idstringOptional
namestringOptional
displaystringOptional
categorystringOptional
descriptionstringOptional
detailedDescriptionstringOptional
feedbooleanOptional
get/xsoar/public/v1/settings/integration-commands
GET /xsoar/public/v1/settings/integration-commands HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
200
OK
[
{
"id": "abuse.ch SSL Blacklist Feed",
"name": "abuse.ch SSL Blacklist Feed",
"display": "abuse.ch SSL Blacklist Feed",
"category": "Data Enrichment & Threat Intelligence",
"description": "The SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has seen in the past 30 days and identified as being associated with a malicious SSL certificate.",
"detailedDescription": "sslipblacklist.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past 30 days being associated with a malicious SSL certificate.\n\nsslipblacklist_aggressive.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past being associated with a malicious SSL certificate. Warning - High FP Rate!\n\nsslblacklist.csv:\nThe SSL IP Blacklist contains SHA1 Fingerprint of all SSL certificates blacklisted on SSLBL. \nThe SSL Certificate Blacklist (CSV) gets generated every 5 minutes. Please do not fetch it more often than every 5 minutes.\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/abusech-ssl-blacklist-feed)",
"feed": true,
"commands": [
{
"name": "sslbl-get-indicators",
"deprecated": false,
"arguments": [
{
"name": "limit",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The maximum number of results to return. The default value is 50.",
"defaultValue": "50",
"type": ""
},
{
"name": "indicator_type",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The indicator type.",
"type": ""
}
],
"outputs": null,
"important": null,
"description": "Gets the feed indicators.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
}
]
},
{
"id": "ACTI Indicator Feed",
"name": "ACTI Indicator Feed",
"display": "ACTI Indicator Feed (Partner Contribution)",
"category": "Data Enrichment & Threat Intelligence",
"description": "Fetches indicators from a ACTI feed. You can filter returned indicators by indicator type, indicator severity, threat type, confidence, and malware family (each of these are an integration parameter).",
"detailedDescription": "### Partner Contributed Integration\n#### Integration Author: Accenture\nSupport and maintenance for this integration are provided by the author. Please use the following contact details:\n- **Email**: [CTI.AcctManagement@accenture.com](mailto:CTI.AcctManagement@accenture.com)\n- **URL**: [https://www.accenture.com/us-en/services/security/cyber-defense](https://www.accenture.com/us-en/services/security/cyber-defense)\n***\nFetch indicators from a Accenture CTI feed. You can apply filters to the feed to focus which indicators you want to ingest, for example, indicator severity, confidence, threat type and malware family. By default, the feed fetches three indicator types: IP, Domain and URL. \n\n## Get Your API Key\n This feed requires that you have an ACTI API key. To get your API key refer to the **Obtain API token** section in the [Accenture CTI documentation](https://intelgraph.idefense.com/#/docs/view#page-section-2-0).\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/acti-indicator-feed)",
"feed": true,
"commands": [
{
"name": "acti-get-indicators",
"deprecated": false,
"arguments": [
{
"name": "limit",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The maximum number of results to return. The default value is 50.",
"defaultValue": "50",
"type": ""
}
],
"outputs": null,
"important": null,
"description": "Gets the feed indicators.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
}
]
}
]Delete an integration instance identified by its ID.
Path parameters
instance_idstringRequiredExample:
Instance ID
5cd9f014-e3e8-41a8-accb-e6d37482ded5Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Responses
200
OK
application/json
objectOptional
delete/xsoar/public/v1/settings/integration/{instance_id}
DELETE /xsoar/public/v1/settings/integration/{instance_id} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
200
OK
{}Get details on all of the integrations, integration instances, engines, and health.
The response is likely to be very large.
Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Body
objectOptional
Responses
200
OK
application/json
post/xsoar/public/v1/settings/integration/search
POST /xsoar/public/v1/settings/integration/search HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}200
OK
{
"configurations": [
{
"id": "abuse.ch SSL Blacklist Feed",
"version": 11,
"cacheVersn": 0,
"sequenceNumber": 41346907,
"primaryTerm": 12,
"modified": "2024-02-20T19:52:27.504394267Z",
"sizeInBytes": 36219,
"sortValues": [
"moduleconfiguration_abuse.ch SSL Blacklist Feed"
],
"packID": "Feedsslabusech",
"packName": "Abuse.ch SSL Blacklist Feed",
"itemVersion": "1.1.26",
"fromServerVersion": "5.5.0",
"toServerVersion": "",
"propagationLabels": [],
"packPropagationLabels": [
"all"
],
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "abuse.ch SSL Blacklist Feed",
"prevName": "abuse.ch SSL Blacklist Feed",
"display": "abuse.ch SSL Blacklist Feed",
"brand": "",
"category": "Data Enrichment & Threat Intelligence",
"icon": "",
"image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAA5fSURBVHgB7VsLWBzV9T9nZnYX2BkWEv6SKCAmhAWSJlH8V/NSqqk2KU8t1vroF9t+bW3t10f8avu1VfqwfmlrG236tb76iFpbMSbBRDTVim1tJCkhYiQQFhKJIYmBBNhlnzP39txdIAvskqVNLLbz47vM3Dv3nLkz53HvOXcWwIQJEyZMmDBhwsRZB8ZurpG0gqbVnEt3UIdFHHgGAsocQKf6EHDoIcpGxuD3Qx1bXxpPrRVUzkQOtzBkn6RjHnBUATmdYoD+DdJ5B916p86N9b4D246M0NkXlGdiEOsRuFXUdcO/yte54zCY+JehxGq0O99YC0y6DxFkUcdhPaD/Fjqk0UkaHYskic+g4xgBp8+pdoRY6GkS4lUkUxghHOaSRP+S6Pw8alimgNxOx0dHaLmhSIhGEV23hQcnW+1g4t/CBAGT9S0Bxr4Pw8IltAtrJas9zsOWhVkkqHyyZmcs89etobuQ86vCFc7JaHE3StjEGXMTrYP4ZBHtQrLSrLgOxMRZQwwL5mvpvdsip9DKmbXE46o9MbZPtZxSaCyycJYR3erIuSndYJ5PIQ4LTuLr3W11Xxt/h7TcyjSWzJeRDh0FE+cUEwXMofh0RVo/UbgCtYZ3P+wZ38qSPUXkiDNH6rZevMc9kRj6D23pp8N2OEdIcpZdJEvS3KHMgQZoaNDj9VMXVp3H/OzSFOR/7W2vc8NZQoazXPNyXOFwGw1Hj27zxutnLyi9RtGVzgHXlk44R5BitKmnT41UmAIYl5Ki6+6ZcD78B6AAXisx+GPG0dTkyfoZfp4rI2z3oZ4LZxF+A7MFX49DXjxZP/JgGw2Z3zhStxdUfEDLqygTi1w4S4jF6NjpEeD3U51VH4G8VTZIACiHjoPwAcOwAD6i5lUUQXW1DCbOCBLGbVyGX0DR00pCBCUlSvLciuzMzGvsk/AcB+QPRtWSObB6Vba6NGfFI/b8ylu1gtX58TTMkznURtL98ygrgBUowZtqS6BJc5avE9ppv6g8E0zEBEUQvwSD3QqtN+iJ9E912VIVBbq8abaV8fpMEJTbY3uCVr/bxtwYgFa88BkJ+UbglnbVuXePWlB2/QRB03wnhZTbae38ThSxRPPyIjr5Oq3L6yQr9pCyPKPNqcyH9wpFRVaYKgQNWcgZ+wnvVFxsgbOAwf3bOjyu516l98rGXqF4M+JFY4UdCnAprkufeOGdWp/7QF2ZAewzxPg1crjB8V0oxFmEXHpGLWi+Z8IguzZ1IBgXE90PqbSIWCnGPa8HhbeqzvIPwTmEj+FlWkHFq6ox7xAdX9cKK6rOREPz4E1aPtHo+Z3aUYfwXBvt81ZPmEvtudWzaPw/01oC+1VP1kHVWfGCOq+qMC5jEhD1eUB1Vv4KFsZ2qWph+Y1aftVPo5owxVn+KQpdd5EXFfdoUfMr7hZKReP6MbMnPTzcby21PyUKjFOCuJL3tj/3mLu9brlbM9JJSMtJS74ZEXiUwDjcGUtI7gPbet0Htn6LyiKuy7NIIVZR5PQLIug6PXSgdQg+kptbkgTnBg5ZoiQKg3rKnn2RxnqAzp8l4X1jMiIJ+IVkL3+l8a2luH8dTVmXS5LlpZS88otH+qQVVOZKtuB+ck3XcY5P0H3W0vM1o6zPjcVTyy/NSJVtdZT4KaV+P4WWHUOx+qEBC2npVzFSV51lYvHyEOUVdhPd5+g5HqBeF0BXl5Bbr8S5L0IIbpT4oChk/WMEfGYX1LTNS/HDaxAp60iLrieBPUZcU4lTCr2MK6n9lXjkns7N79LhBVHySIuPoW0dDeTLw5fn9lnVXDq2wdmHJ6TDCl/n1pFU52bNWamRkt2lzq369fC4JoDi9vui60kXrX7eYrE0SjLSlATNos1gcD8dgjRRLvEe2Noz3PWPsfiJkCkAWM+AZcnIlw60PXcQEgTNbh+hQ+Ng+9YvRDWHM39uaFqXmnXtDLAn3ULK+zAZ4+bI5boxPKa6HOee9q3PEMO9oy0MZiZK7HLVB5jiWzemEaWE6acIw67w/ugGnev3iTQrl/kHJqHDlMLrZouMnqOw9BJrst1N6bhj5Lkc4qJI0tBDV9Gbe9LbXtczCR/gTMoJcNxJTs8Chm3hQHviwo0wwFMiY+gorFg5I2/VlELWEUw93hILCsQZI1WyRs8UqAGZ7f+i64xJQ/BewYhkzhDZjHhdSLD3Ssxwcc7+YjB5JzOCPYh8/igLqz4LRKqO831wBtB9RFZwPhr4hdgJo8kRQssG8pLtjPEdIcV2UMsv36LNKV0+FR4xctHla0N+aZP/0Ja3ISqmFcjIIHfjke8msSwYbqIoyrJr5Lq9qHIxhnAOevmr7iNb+sbztjnLnRKHn48sA4h5rzqodcSTMJdRnjSGrq1l48c4GWQrS6VNFMqgxlZKtaDqSjI7MUd/x6PO+hE0nWIz5gbPDynw/CgPSfEbtAyhqSnlTPcjNfg2Z/BdrkCtbW75lYHOOhdMAf722oN+gOW00DrfYsASQ5Jq0IJ16UWli0+1butOhEeMVCX+xGLl6yz55QdJUbsYiskcxF+mH/kCBDZr9AE4vJw8YN8xkuNDnTvJov9AubBBmu/IHXFRPLTittJmIYVafBE9ddQKEh88fvzxuBaMTGpQ3wj64153ltW4aTEIiYLhFeJ/MGRpjX0/fRmNz2vouBGaHg6JtpOdcJhWp6NxaX/b4m7N2fwuMhCLyw2T3Y40z+1mwSs1xbrPKuMLKXNWFp/qemkApojhqWCTWljWRgq6j8YnPEqUgOPbQGwXLXaSEPNogNeQEG+i482ksStp1XtauLT8khXj03EElBoWJkAl9byFhHsDnS+l84hwedgEfuv5xOJ7YXJkkBVkxS1cmmxeSiPN+HokfqyR7M5y2sFCCt3wcf/BZ9+ORcARxT61nSx9SfjmtECiKOF2ctGLTveqYdTvB/R+qkTIMnt2qbBkdOR8ND2l8NrZE5jSuiNJCq0Q/lq3pGxPyy1JgwSRVnjdhcP8AUS0YaBQKp3brOG5fDApPL3RcIyVYU8XI+M4QcAipCGaejrtHX+NxCK0mkIIvkYODV093k1Q/PsylS+LzXxSiolJdg5i0bOJM/4h94Ett0HN+IBeeAWyeg6diRRSun6IBw5d5HmKyXoosbKng0KU12mA7TyJEi5x4Jk9uJmU8VWykscpzjxEq1/hUj9Gwtk1pp8eeJhL+CAp+T2eVJksuuIgS1Y6ZG77Uiy+J1qfPybZjGvp6eYb1tT1CSVQCDpjP/JoMs29FR2qzUEhJq6nsOwH7jc3RaIOUh6qb6B3fbv2RuCIKtlcyXnXZUXzmHRDVmgl2GzpXAnKBjL3UOv242HHnBBqpJTClkwFgioy1MHK+gfe3H4K3gOEPzpwgNXTXNubnFd2mSzLOTQXHhjq2LJ3TEeyCi0pLcd942LXqLLRy1ePpC4loc6ml9c+dPPilhlPtJwfTOFBT8vY0MpBu1YMpQW0KEuhqb3bPcuzO7x7lXmrXUt3XzDT39996FDD6BQj0rSSTXKMtDvyKufKEDhx0lU/KK6LeFlnRpLPVR/JBBaXpqhD+P+kcLPIAfiZBV8f2ld3fOzT1kjJeXsvky08R9JlT5ZF/lNra20QTJgwYcKECRMmTJgwYcKEiX8DRUXV8H7EWft6778d3aFg0fi2kpKaGB+sTC+YAk4QKMFl49t29bx1AeavTuiL0/8UEvs8c5oia0k1+PoAe9uf5uFfU9TUQMZTe8LpV85twNOt/GTjk5C2uBJQtsCpptrRPnd84hLe0ADwZs9byJMMkHUZSuYD333CDoMnB1EKRDaQ0owQd7nqR+9ZXV0NL74FGOh8hZK2/itssm2n4cjpDg10M5iGmLYWPLu49Ix93H2+q4MYbLlozprId11P7dECAM1+wKYABpv1/qGvCBdqeNk3dU8gssnw6FvJfo5ND2z8m6PxcHM20e8NBfQ2nxF8eUebN32g59QKqrsED1GOSPIHo+/5/P5AJmfB+63Zl18u6laDlydnXvIATFNMSwHXkJV5hqAst2RNZJ6DifOdqFOi/046Vfpsg5Hvgo2Q+InqeZLs/zAl6G+iXck74dJLxSetGh/ZhzZ84meO53GmoiLDzbR71sJTbAX2gdQysRnCmJFMG3D7M1lwaSYLLfV11+6OHhsPYTa5iBdnZmXsFPWgjHW0Zz5tv/WelgLe8FSzBkye39czsLyxtzm7uPiz0Nj9jxyYd3q+e+PtXRfSzJhLAvoq5+wO0WcEnCX/BCS2gdz230u0slA079EfxolzxhoY4BXgCzzpc7irhEKF6RGK30XLg1TuhctXjdlN97ZfvIcZkNt3dHCZzOGgrDAfbXHugGmKaTkHezkrsKKyn7Yol1t0zN4XeHe3xYqroK3+5+EOZMl6UcXHwYBnBz38L6qGD+0bOCw+WQ1/94QQvI/2ZpMNYDsa32nJkiUpyIHbhNv39clWHbmieLiRNC/pdfZ2WqE39cQHDeC/6js20Ck0ngS2V+eh7wleJVCiN0BD1OhqmKcDHho35EdhmmJaWjD50KIg8neQM78ctLxmkeCHIUMe/S4KF9xgJf+8Jsj8v4Ge57zUstEqWz8/fJk8s7JcB76CGB236Sc9sgR/p83/j3mG5DJm5V+VGO/q7d3qdveFrnZrxz9sIE8nOoOHwB3eIpcgW0bLclEau5ty4H2MaSlgewhekBlko5X9zmcbIoPiOwMdp39imer22mmyfSTgejH8EZuC/sdIPPvBqtL6id9PG/VZKDGbjFjef6ihf8B++BVkeDfxuYoh10PAwlkL2qQXyrGMaJeRv77L07l5H6DeyRk+Te35okhKWPgmzgW0gqtnOpyVN+TmrjlXv35IfCzOitvAxH8v3q8CNjNZCcJiBDeBCRMmTJgwYcKECRMm/gfwT1ET1leeYmK5AAAAAElFTkSuQmCC",
"description": "The SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has seen in the past 30 days and identified as being associated with a malicious SSL certificate.",
"detailedDescription": "sslipblacklist.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past 30 days being associated with a malicious SSL certificate.\n\nsslipblacklist_aggressive.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past being associated with a malicious SSL certificate. Warning - High FP Rate!\n\nsslblacklist.csv:\nThe SSL IP Blacklist contains SHA1 Fingerprint of all SSL certificates blacklisted on SSLBL. \nThe SSL Certificate Blacklist (CSV) gets generated every 5 minutes. Please do not fetch it more often than every 5 minutes.\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/abusech-ssl-blacklist-feed)",
"configuration": [
{
"display": "Services",
"displayPassword": "",
"name": "url",
"defaultValue": "",
"type": 16,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"https://sslbl.abuse.ch/blacklist/sslipblacklist.csv",
"https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv",
"https://sslbl.abuse.ch/blacklist/sslblacklist.csv"
],
"info": ""
},
{
"display": "Fetch indicators",
"displayPassword": "",
"name": "feed",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Indicator Reputation",
"displayPassword": "",
"name": "feedReputation",
"defaultValue": "Bad",
"type": 18,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"None",
"Good",
"Suspicious",
"Bad"
],
"info": "Indicators from this integration instance will be marked with this reputation."
},
{
"display": "Source Reliability",
"displayPassword": "",
"name": "feedReliability",
"defaultValue": "B - Usually reliable",
"type": 15,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"A - Completely reliable",
"B - Usually reliable",
"C - Fairly reliable",
"D - Not usually reliable",
"E - Unreliable",
"F - Reliability cannot be judged"
],
"info": "Reliability of the source providing the intelligence data"
},
{
"display": "Traffic Light Protocol Color",
"displayPassword": "",
"name": "tlp_color",
"defaultValue": "",
"type": 15,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"RED",
"AMBER",
"GREEN",
"WHITE"
],
"info": "The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed"
},
{
"display": "",
"displayPassword": "",
"name": "feedExpirationPolicy",
"defaultValue": "indicatorType",
"type": 17,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"never",
"interval",
"indicatorType",
"suddenDeath"
],
"info": ""
},
{
"display": "",
"displayPassword": "",
"name": "feedExpirationInterval",
"defaultValue": "20160",
"type": 1,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Feed Fetch Interval",
"displayPassword": "",
"name": "feedFetchInterval",
"defaultValue": "60",
"type": 19,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Bypass exclusion list",
"displayPassword": "",
"name": "feedBypassExclusionList",
"defaultValue": "",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system."
},
{
"display": "Request Timeout",
"displayPassword": "",
"name": "polling_timeout",
"defaultValue": "20",
"type": 0,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "Time in seconds before http requests timeout."
},
{
"display": "Trust any certificate (not secure)",
"displayPassword": "",
"name": "insecure",
"defaultValue": "",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Use system proxy settings",
"displayPassword": "",
"name": "proxy",
"defaultValue": "",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Tags",
"displayPassword": "",
"name": "feedTags",
"defaultValue": "",
"type": 0,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "Supports CSV values."
}
],
"integrationScript": {
"script": "register_module_line('abuse.ch SSL Blacklist Feed', 'start', __line__())\n### pack version: 1.1.26\n\n\n\ndef main():\n feed_url_to_config = {\n 'https://sslbl.abuse.ch/blacklist/sslipblacklist.csv': {\n 'fieldnames': ['firstseenbysource', 'value', 'port'],\n 'indicator_type': FeedIndicatorType.IP,\n 'mapping': {\n 'firstseenbysource': 'firstseenbysource',\n 'port': 'port'\n }\n },\n 'https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv': {\n 'fieldnames': ['firstseenbysource', 'value', 'port'],\n 'indicator_type': FeedIndicatorType.IP,\n 'mapping': {\n 'firstseenbysource': 'firstseenbysource',\n 'port': 'port'\n }\n },\n 'https://sslbl.abuse.ch/blacklist/sslblacklist.csv': {\n 'fieldnames': ['Listingdate', 'value', 'Listingreason'],\n 'indicator_type': 'Certificate',\n 'mapping': {\n 'firstseenbysource': 'Listingdate',\n 'relationship_entity_b': 'Listingreason',\n 'Tags': 'Listingreason',\n },\n 'relationship_entity_b_type': FeedIndicatorType.Malware,\n 'relationship_name': EntityRelationship.Relationships.INDICATOR_OF,\n 'auto_detect_type': False,\n\n }\n }\n\n params = {k: v for k, v in demisto.params().items() if v is not None}\n params['feed_url_to_config'] = feed_url_to_config\n params['ignore_regex'] = r'^#'\n params['delimiter'] = ','\n params['create_relationships'] = True\n\n # Main execution of the CSV API Module.\n # This function allows to add to or override this execution.\n feed_main('SSL Blacklist Feed', params, 'sslbl')\n\n\n\n### GENERATED CODE ###: from CSVFeedApiModule import * # noqa: E402\n# This code was inserted in place of an API module.\nregister_module_line('CSVFeedApiModule', 'start', __line__(), wrapper=-3)\n\n\n\n\n''' IMPORTS '''\nimport csv\nimport gzip\nimport urllib3\nfrom typing import Optional, Pattern, Dict, Any, Tuple, Union, List\n\n# disable insecure warnings\nurllib3.disable_warnings()\n\n# Globals\nDATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ'\nTHRESHOLD_IN_SECONDS = 43200 # 12 hours in seconds\n\n\nclass Client(BaseClient):\n def __init__(self, url: str, feed_url_to_config: Optional[Dict[str, dict]] = None, fieldnames: str = '',\n insecure: bool = False, credentials: dict = None, ignore_regex: str = None, encoding: str = 'latin-1',\n delimiter: str = ',', doublequote: bool = True, escapechar: str = '',\n quotechar: str = '\"', skipinitialspace: bool = False, polling_timeout: int = 20, proxy: bool = False,\n feedTags: Optional[str] = None, tlp_color: Optional[str] = None, value_field: str = 'value', **kwargs):\n \"\"\"\n :param url: URL of the feed.\n :param feed_url_to_config: for each URL, a configuration of the feed that contains\n If *null* the values in the first row of the file are used as names. Default: *null*\n Example:\n feed_url_to_config = {\n 'https://ipstack.com':\n {\n 'fieldnames': ['value'],\n 'indicator_type': 'IP',\n 'mapping': {\n 'Date': 'date' / 'Date': ('date', r'(regex_string)', 'The date is {}')\n }\n }\n }\n For the mapping you can use either:\n 1. 'indicator_field': 'value_from_feed'\n 2. 'indicator_field': ('value_from_feed', regex_string_extractor, string_formatter)\n * regex_string_extractor will extract the first match from the value_from_feed,\n Use None to get the full value of the field.\n * string_formatter will format the data in your preferred way, Use None to get the extracted field.\n 3. 'indicator_field': ('value_from_feed', 'field_mapper_function')\n * field_mapper_function will accept as an argument 'value_from_feed' and return the data\n in your preferred way.\n :param fieldnames: list of field names in the file. If *null* the values in the first row of the file are\n used as names. Default: *null*\n :param insecure: boolean, if *false* feed HTTPS server certificate is verified. Default: *false*\n :param credentials: username and password used for basic authentication.\n Can be also used as API key header and value by specifying _header in the username field.\n :param ignore_regex: python regular expression for lines that should be ignored. Default: *null*\n :param encoding: Encoding of the feed, latin-1 by default.\n :param delimiter: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default: ,\n :param doublequote: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default: true\n :param escapechar: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default null\n :param quotechar: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default \"\n :param skipinitialspace: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default False\n :param polling_timeout: timeout of the polling request in seconds. Default: 20\n :param proxy: Sets whether use proxy when sending requests\n :param tlp_color: Traffic Light Protocol color.\n \"\"\"\n self.tags: List[str] = argToList(feedTags)\n self.tlp_color = tlp_color\n self.value_field = value_field\n if not credentials:\n credentials = {}\n\n auth: Optional[tuple] = None\n self.headers = {}\n\n username = credentials.get('identifier', '')\n if username.startswith('_header:'):\n header_name = username.split(':')[1]\n header_value = credentials.get('password', '')\n self.headers[header_name] = header_value\n else:\n password = credentials.get('password', '')\n auth = None\n if username and password:\n auth = (username, password)\n\n super().__init__(base_url=url, proxy=proxy, verify=not insecure, auth=auth)\n\n try:\n self.polling_timeout = int(polling_timeout)\n except (ValueError, TypeError):\n return_error('Please provide an integer value for \"Request Timeout\"')\n self.encoding = encoding\n self.ignore_regex: Optional[Pattern] = None\n if ignore_regex is not None:\n self.ignore_regex = re.compile(ignore_regex)\n self.feed_url_to_config: Optional[Dict[str, dict]] = feed_url_to_config\n self.fieldnames = argToList(fieldnames)\n self.dialect: Dict[str, Any] = {\n 'delimiter': delimiter,\n 'doublequote': doublequote,\n 'escapechar': escapechar,\n 'quotechar': quotechar,\n 'skipinitialspace': skipinitialspace\n }\n\n def _build_request(self, url):\n r = requests.Request(\n 'GET',\n url,\n auth=self._auth\n )\n\n return r.prepare()\n\n def build_iterator(self, **kwargs):\n results = []\n urls = self._base_url\n if not isinstance(urls, list):\n urls = [urls]\n for url in urls:\n _session = requests.Session()\n\n prepreq = self._build_request(url)\n\n # this is to honour the proxy environment variables\n kwargs.update(_session.merge_environment_settings(\n prepreq.url,\n {}, None, None, None # defaults\n ))\n kwargs['stream'] = True\n kwargs['verify'] = self._verify\n kwargs['timeout'] = self.polling_timeout\n\n if is_demisto_version_ge('6.5.0'):\n # Set the If-None-Match and If-Modified-Since headers if we have etag or\n # last_modified values in the context.\n last_run = demisto.getLastRun()\n etag = last_run.get(url, {}).get('etag')\n last_modified = last_run.get(url, {}).get('last_modified')\n last_updated = last_run.get(url, {}).get('last_updated')\n # To avoid issues with indicators expiring, if 'last_updated' is over X hours old,\n # we'll refresh the indicators to ensure their expiration time is updated.\n # For further details, refer to : https://confluence-dc.paloaltonetworks.com/display/DemistoContent/Json+Api+Module # noqa: E501\n if last_updated and has_passed_time_threshold(timestamp_str=last_updated, seconds_threshold=THRESHOLD_IN_SECONDS):\n last_modified = None\n etag = None\n demisto.debug(\"Since it's been a long time with no update, to make sure we are keeping the indicators alive, \\\n we will refetch them from scratch\")\n\n if etag:\n self.headers['If-None-Match'] = etag\n\n if last_modified:\n self.headers['If-Modified-Since'] = last_modified\n\n # set request headers\n if 'headers' in kwargs:\n self.headers.update(kwargs['headers'])\n del kwargs['headers']\n\n if self.headers:\n prepreq.headers.update(self.headers)\n\n try:\n r = _session.send(prepreq, **kwargs)\n except requests.exceptions.ConnectTimeout as exception:\n err_msg = 'Connection Timeout Error - potential reasons might be that the Server URL parameter' \\\n ' is incorrect or that the Server is not accessible from your host.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.SSLError as exception:\n # in case the \"Trust any certificate\" is already checked\n if not self._verify:\n raise\n err_msg = 'SSL Certificate Verification Failed - try selecting \\'Trust any certificate\\' checkbox in' \\\n ' the integration configuration.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.ProxyError as exception:\n err_msg = 'Proxy Error - if the \\'Use system proxy\\' checkbox in the integration configuration is' \\\n ' selected, try clearing the checkbox.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.ConnectionError as exception:\n # Get originating Exception in Exception chain\n error_class = str(exception.__class__)\n err_type = '<' + error_class[error_class.find('\\'') + 1: error_class.rfind('\\'')] + '>'\n err_msg = 'Verify that the server URL parameter' \\\n ' is correct and that you have access to the server from your host.' \\\n '\nError Type: {}\nError Number: [{}]\nMessage: {}\n' \\\n .format(err_type, exception.errno, exception.strerror)\n raise DemistoException(err_msg, exception)\n try:\n r.raise_for_status()\n except Exception:\n return_error(f'Exception in request: {r.status_code} {r.content.decode(\"utf-8\")}')\n raise\n\n response = self.get_feed_content_divided_to_lines(url, r)\n if self.feed_url_to_config:\n fieldnames = self.feed_url_to_config.get(url, {}).get('fieldnames', [])\n skip_first_line = self.feed_url_to_config.get(url, {}).get('skip_first_line', False)\n else:\n fieldnames = self.fieldnames\n skip_first_line = False\n if self.ignore_regex is not None:\n response = filter( # type: ignore\n lambda x: self.ignore_regex.match(x) is None, # type: ignore\n response\n )\n\n csvreader = csv.DictReader(\n response,\n fieldnames=fieldnames,\n **self.dialect\n )\n\n if skip_first_line:\n next(csvreader)\n no_update = get_no_update_value(r, url) if is_demisto_version_ge('6.5.0') else True\n results.append({url: {'result': csvreader, 'no_update': no_update}})\n\n return results\n\n def get_feed_content_divided_to_lines(self, url, raw_response):\n \"\"\"Fetch feed data and divides its content to lines\n\n Args:\n url: Current feed's url.\n raw_response: The raw response from the feed's url.\n\n Returns:\n List. List of lines from the feed content.\n \"\"\"\n if self.feed_url_to_config and self.feed_url_to_config.get(url).get('is_zipped_file'): # type: ignore\n response_content = gzip.decompress(raw_response.content)\n else:\n response_content = raw_response.content\n\n return response_content.decode(self.encoding).split('\n')\n\n\ndef get_no_update_value(response: requests.models.Response, url: str) -> bool:\n \"\"\"\n detect if the feed response has been modified according to the headers etag and last_modified.\n For more information, see this:\n https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Last-Modified\n https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag\n Args:\n response: (requests.Response) The feed response.\n url: (str) The feed URL (service).\n Returns:\n boolean with the value for noUpdate argument.\n The value should be False if the response was modified.\n \"\"\"\n if response.status_code == 304:\n demisto.debug('No new indicators fetched, createIndicators will be executed with noUpdate=True.')\n return True\n\n etag = response.headers.get('ETag')\n last_modified = response.headers.get('Last-Modified')\n current_time = datetime.utcnow()\n # Save the current time as the last updated time. This will be used to indicate the last time the feed was updated in XSOAR.\n last_updated = current_time.strftime(DATE_FORMAT)\n\n if not etag and not last_modified:\n demisto.debug('Last-Modified and Etag headers are not exists,'\n 'createIndicators will be executed with noUpdate=False.')\n return False\n\n last_run = demisto.getLastRun()\n last_run[url] = {'last_modified': last_modified, 'etag': etag, 'last_updated': last_updated}\n demisto.setLastRun(last_run)\n\n demisto.debug('New indicators fetched - the Last-Modified value has been updated,'\n ' createIndicators will be executed with noUpdate=False.')\n return False\n\n\ndef determine_indicator_type(indicator_type, default_indicator_type, auto_detect, value):\n \"\"\"\n Detect the indicator type of the given value.\n Args:\n indicator_type: (str) Indicator type given in the config.\n default_indicator_type: Indicator type which was inserted as a param of the integration by user.\n auto_detect: (bool) True whether auto detection of the indicator type is wanted.\n value: (str) The value which we'd like to get indicator type of.\n Returns:\n Str which stands for the indicator type after detection.\n \"\"\"\n if auto_detect:\n indicator_type = auto_detect_indicator_type(value)\n if not indicator_type:\n indicator_type = default_indicator_type\n return indicator_type\n\n\ndef module_test_command(client: Client, args):\n client.build_iterator()\n return 'ok', {}, {}\n\n\ndef date_format_parsing(date_string):\n \"\"\"\n formats a datestring to the ISO-8601 format which the server expects to recieve\n :param date_string: Date represented as a tring\n :return: ISO-8601 date string\n \"\"\"\n formatted_date = dateparser.parse(date_string, settings={'TIMEZONE': 'UTC'})\n assert formatted_date is not None, f\"failed parsing {date_string}\"\n return formatted_date.strftime(DATE_FORMAT)\n\n\ndef create_fields_mapping(raw_json: Dict[str, Any], mapping: Dict[str, Union[Tuple, str]]):\n fields_mapping = {} # type: dict\n\n for key, field in mapping.items():\n regex_extractor = None\n formatter_string = None\n field_mapper_function = None\n\n # case 'value_from_feed', regex_string_extractor, string_formatter\n if isinstance(field, tuple) and len(field) == 3:\n field, regex_extractor, formatter_string = field\n\n # case 'value_from_feed', 'field_mapper_function'\n elif isinstance(field, tuple) and len(field) == 2:\n field, field_mapper_function = field\n\n if not raw_json.get(field): # type: ignore\n continue\n\n if not regex_extractor:\n field_value = raw_json[field] # type: ignore\n else:\n try:\n field_value = re.match(regex_extractor, raw_json[field]).group(1) # type: ignore\n except Exception:\n field_value = raw_json[field] # type: ignore\n\n field_value = formatter_string.format(field_value) if formatter_string else field_value\n field_value = field_mapper_function(field_value) if field_mapper_function else field_value\n fields_mapping[key] = field_value\n\n if key in ['firstseenbysource', 'lastseenbysource']:\n fields_mapping[key] = date_format_parsing(fields_mapping[key])\n\n return fields_mapping\n\n\ndef fetch_indicators_command(client: Client, default_indicator_type: str, auto_detect: bool, limit: int = 0,\n create_relationships: bool = False, **kwargs):\n iterator = client.build_iterator(**kwargs)\n relationships_of_indicator = []\n indicators = []\n config = client.feed_url_to_config or {}\n\n # set noUpdate flag in createIndicators command True only when all the results from all the urls are True.\n no_update = all(next(iter(item.values())).get('no_update', False) for item in iterator)\n\n for url_to_reader in iterator:\n for url, reader in url_to_reader.items():\n mapping = config.get(url, {}).get('mapping', {})\n for item in reader.get('result', []):\n raw_json = dict(item)\n fields_mapping = create_fields_mapping(raw_json, mapping) if mapping else {}\n value = item.get(client.value_field) or fields_mapping.get('Value')\n if not value and len(item) > 1:\n value = next(iter(item.values()))\n if value:\n raw_json['value'] = value\n conf_indicator_type = config.get(url, {}).get('indicator_type')\n indicator_type = determine_indicator_type(conf_indicator_type, default_indicator_type, auto_detect,\n value)\n raw_json['type'] = indicator_type\n # if relationships param is True and also the url returns relationships\n if create_relationships and config.get(url, {}).get('relationship_name'):\n if fields_mapping.get('relationship_entity_b'):\n relationships_lst = EntityRelationship(\n name=config.get(url, {}).get('relationship_name'),\n entity_a=value,\n entity_a_type=indicator_type,\n entity_b=fields_mapping.get('relationship_entity_b'),\n entity_b_type=FeedIndicatorType.indicator_type_by_server_version(\n config.get(url, {}).get('relationship_entity_b_type')),\n )\n relationships_of_indicator = [relationships_lst.to_indicator()]\n\n indicator = {\n 'value': value,\n 'type': indicator_type,\n 'rawJSON': raw_json,\n 'fields': fields_mapping,\n 'relationships': relationships_of_indicator,\n }\n indicator['fields']['tags'] = client.tags\n\n if client.tlp_color:\n indicator['fields']['trafficlightprotocol'] = client.tlp_color\n\n indicators.append(indicator)\n # exit the loop if we have more indicators than the limit\n if limit and len(indicators) >= limit:\n return indicators, no_update\n\n return indicators, no_update\n\n\ndef get_indicators_command(client, args: dict, tags: Optional[List[str]] = None):\n if tags is None:\n tags = []\n itype = args.get('indicator_type', demisto.params().get('indicator_type'))\n try:\n limit = int(args.get('limit', 50))\n except ValueError:\n raise ValueError('The limit argument must be a number.')\n auto_detect = demisto.params().get('auto_detect_type')\n relationships = demisto.params().get('create_relationships', False)\n indicators_list, _ = fetch_indicators_command(client, itype, auto_detect, limit, relationships)\n entry_result = indicators_list[:limit]\n hr = tableToMarkdown('Indicators', entry_result, headers=['value', 'type', 'fields'])\n return hr, {}, indicators_list\n\n\ndef feed_main(feed_name, params=None, prefix=''): # pragma: no cover\n if not params:\n params = {k: v for k, v in demisto.params().items() if v is not None}\n handle_proxy()\n client = Client(**params)\n command = demisto.command()\n if command != 'fetch-indicators':\n demisto.info('Command being called is {}'.format(command))\n if prefix and not prefix.endswith('-'):\n prefix += '-'\n # Switch case\n commands: dict = {\n 'test-module': module_test_command,\n f'{prefix}get-indicators': get_indicators_command\n }\n try:\n if command == 'fetch-indicators':\n indicators, no_update = fetch_indicators_command(\n client,\n params.get('indicator_type'),\n params.get('auto_detect_type'),\n params.get('limit'),\n params.get('create_relationships')\n )\n\n # check if the version is higher than 6.5.0 so we can use noUpdate parameter\n if is_demisto_version_ge('6.5.0'):\n if not indicators:\n demisto.createIndicators(indicators, noUpdate=no_update) # type: ignore\n else:\n # we submit the indicators in batches\n for b in batch(indicators, batch_size=2000):\n demisto.createIndicators(b, noUpdate=no_update) # type: ignore\n else:\n # call createIndicators without noUpdate arg\n if not indicators:\n demisto.createIndicators(indicators) # type: ignore\n else:\n for b in batch(indicators, batch_size=2000): # type: ignore\n demisto.createIndicators(b)\n\n else:\n args = demisto.args()\n args['feed_name'] = feed_name\n readable_output, outputs, raw_response = commands[command](client, args)\n return_outputs(readable_output, outputs, raw_response)\n except Exception as e:\n err_msg = f'Error in {feed_name} Integration - Encountered an issue with createIndicators' if \\\n 'failed to create' in str(e) else f'Error in {feed_name} Integration [{e}]'\n return_error(err_msg)\n\nregister_module_line('CSVFeedApiModule', 'end', __line__(), wrapper=1)\n### END GENERATED CODE ###\n\nif __name__ == '__builtin__' or __name__ == 'builtins':\n main()\n\nregister_module_line('abuse.ch SSL Blacklist Feed', 'end', __line__())\n",
"type": "python",
"commands": [
{
"name": "sslbl-get-indicators",
"deprecated": false,
"arguments": [
{
"name": "limit",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The maximum number of results to return. The default value is 50.",
"defaultValue": "50",
"type": ""
},
{
"name": "indicator_type",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The indicator type.",
"type": ""
}
],
"outputs": null,
"important": null,
"description": "Gets the feed indicators.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
}
],
"dockerImage": "demisto/python3:3.10.13.86272",
"nativeImage": [
"8.3",
"8.4"
],
"isFetch": false,
"isFetchEvents": false,
"isFetchAssets": false,
"feed": true,
"isFetchCredentials": false,
"runOnce": false,
"longRunning": false,
"longRunningPortMapping": false,
"subtype": "python3",
"isMappable": false,
"isRemoteSyncIn": false,
"isRemoteSyncOut": false,
"isFetchSamples": false,
"resetContext": false
},
"system": true,
"hidden": false,
"canGetSamples": true
}
],
"engines": {
"engines": [
{
"id": "6b1d6700-ee17-4af9-b071-d7fc642ea441",
"version": 81,
"cacheVersn": 0,
"sequenceNumber": 47683350,
"primaryTerm": 12,
"modified": "2024-04-04T16:17:45.602959424Z",
"sizeInBytes": 1530,
"sortValues": [
"120227"
],
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"definitionId": "",
"prevName": "",
"name": "create_new_engine_engine_rpm_OaOx5RSd",
"allowOnTenant": false,
"locked": false,
"lastSeen": "0001-01-01T00:00:00Z",
"firstSeen": "0001-01-01T00:00:00Z",
"lastConnectedApp": "",
"lastDisconnect": "0001-01-01T00:00:00Z",
"serviceName": "",
"host": "",
"user": "user@company.com",
"pkgType": "rpm",
"pkgName": "/var/lib/demisto/downloads/x86_64/create_new_engine_engine_rpm_OaOx5RSd-8.6_933863-1.x86_64.rpm",
"config": "",
"baseUrl": "",
"engineGroup": "",
"protocolVersion": "",
"os": "",
"demistoVersion": "",
"buildVersion": "21874e0e41eb2c5ce7653f6dcc07621d992f927c",
"md5": "3192ca98dab68bebb124f99cbf5bb994",
"underUpgrade": false,
"tenantNames": null,
"workers": 0,
"isDefault": false,
"isLegacy": false,
"packageFileHash": "76641c64c3dbbe9f8272fdc193942fb8b8647e00183d95c69b2e8b80eb43b714",
"pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}XIoRrYJ+aA1QCktuBTDQWfXmZnNB3KtbdMYTp+XgX+fVdYU3LbeIxO+oztktxJR7h2coO27MIkU9YIamIsR3LoUjydrlJVI0x9wO/JcK7fKdnyPqR3HRY/kpf5oOMYu0IQcsaSBAfb3Ky9z8z/4PyQlkJEcrDkvunHAtueOcNJmfqucQQiuMeHfj2PcMEdTqa/ZLJsRvtvoHDEC2sc1u5W/MGKKBdSGmkDXRQhgsL8bVOJVHjaayce8j22PpawKYmHUH4SeUjQnvZluiR2isS7z16TQNHW/UWNXzlqt8TTk=",
"pyramidAPIEncryptedAuthenticationHeaderTenants": null,
"connected": false,
"modules": null
},
{
"id": "b6b7b03e-632b-4c05-a087-23f68affd5d3",
"version": 7,
"cacheVersn": 0,
"sequenceNumber": 47683375,
"primaryTerm": 12,
"modified": "2024-04-04T16:18:46.830805002Z",
"sizeInBytes": 1519,
"sortValues": [
"120228"
],
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"definitionId": "",
"prevName": "",
"name": "create_new_engine_engine_shell_pzv9a3Y3",
"allowOnTenant": false,
"locked": false,
"lastSeen": "0001-01-01T00:00:00Z",
"firstSeen": "0001-01-01T00:00:00Z",
"lastConnectedApp": "",
"lastDisconnect": "0001-01-01T00:00:00Z",
"serviceName": "",
"host": "",
"user": "user@company.com",
"pkgType": "shell",
"pkgName": "/var/lib/demisto/downloads/create_new_engine_engine_shell_pzv9a3Y3-8.6-933863.sh",
"config": "",
"baseUrl": "",
"engineGroup": "",
"protocolVersion": "",
"os": "",
"demistoVersion": "",
"buildVersion": "21874e0e41eb2c5ce7653f6dcc07621d992f927c",
"md5": "8ffbd7cc23e270f792d8afd738814818",
"underUpgrade": false,
"tenantNames": null,
"workers": 0,
"isDefault": false,
"isLegacy": false,
"packageFileHash": "2afc44aac1dba5079bd963128de62b310454b4bd294bf1c9be1a6bfb9b32afa5",
"pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}5w75Hmog7B4MPk6l/EkHNwILAOTnznRkUIb5dugxM2Ozw4vjPlj3B/STZundq8DYWl4NashmaYzZ7IUgy7ilbz0hT/LkFGJzM19RiRyGI4vudzkdNNSwb0qba2eZNVywS4nidmyKWUGXo+LIUJnBJYh8FyL3zDymBsMk8IHyPmejazDJ0ieVMRr8P8ztWNiD3wSEwJquX7tS9K/U8LnbBuwKGfx2VnY4nYpy1h0FiLFUaItLF+XJtgWDabFvgQhyUcF0Iz1YGM1ejTbT1pyCahHkVCVezqDASoJHda30nDA=",
"pyramidAPIEncryptedAuthenticationHeaderTenants": null,
"connected": false,
"modules": null
}
],
"total": 2,
"pkgTypes": [
"shell",
"zip",
"deb",
"rpm",
"conf"
],
"requestedLogs": {},
"engineGroups": []
},
"health": {
"id": "Rocket Incident Generator.long_running_integration_fetch_incidents_AI6tPtxq",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 1390272,
"primaryTerm": 2,
"modified": "2022-11-29T09:10:37.116147451Z",
"sizeInBytes": 0,
"sortValues": [
"2912"
],
"brand": "Rocket Incident Generator",
"instance": "long_running_integration_fetch_incidents_AI6tPtxq",
"incidentsPulled": 0,
"indicatorsPulled": 0,
"eventsPulled": 0,
"assetsPulled": 0,
"type": 0,
"incidentsDropped": 0,
"lastPullTime": "2022-11-29T09:05:26.273935902Z",
"lastError": "Script failed to run: \nTimeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)",
"lastIngestionDuration": 0,
"fetchDuration": 0,
"creation_time": "0001-01-01T00:00:00Z",
"sum_hour": 0,
"sum_day": 0,
"sum_week": 0
},
"long_running_integration_fetch_incidents_NbrfwigR": {
"id": "Rocket Incident Generator.long_running_integration_fetch_incidents_NbrfwigR",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 1680557,
"primaryTerm": 2,
"modified": "2022-12-03T15:30:44.971255467Z",
"sizeInBytes": 0,
"sortValues": [
"3035"
],
"brand": "Rocket Incident Generator",
"instance": "long_running_integration_fetch_incidents_NbrfwigR",
"incidentsPulled": 0,
"indicatorsPulled": 0,
"eventsPulled": 0,
"assetsPulled": 0,
"type": 0,
"incidentsDropped": 0,
"lastPullTime": "2022-12-03T15:25:34.220297587Z",
"lastError": "Script failed to run: \nTimeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)",
"lastIngestionDuration": 0,
"fetchDuration": 0,
"creation_time": "0001-01-01T00:00:00Z",
"sum_hour": 0,
"sum_day": 0,
"sum_week": 0
},
"instances": [
{
"id": "e227fc24-5e1d-4165-87b8-949f71030b22",
"version": 74,
"cacheVersn": 0,
"sequenceNumber": 39320671,
"primaryTerm": 12,
"modified": "2024-02-05T14:05:11.127323408Z",
"sizeInBytes": 1314,
"sortValues": [
"79580"
],
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "",
"prevName": "",
"password": "",
"enabled": "true",
"name": "AutoFocusTagsFeed_default_instance",
"configvalues": {
"create_relationships": true,
"feed": true,
"feedBypassExclusionList": true,
"feedFetchInterval": "10",
"feedIncremental": true,
"feedReliability": "A - Completely reliable",
"url": "https://autofocus.paloaltonetworks.com/api/v1.0/"
},
"configtypes": {
"create_relationships": 8,
"feed": 8,
"feedBypassExclusionList": 8,
"feedFetchInterval": 19,
"feedIncremental": 8,
"feedReliability": 15,
"url": 0
},
"brand": "AutoFocusTagsFeed",
"category": "",
"path": "",
"executable": "",
"cmdline": "",
"engine": "",
"engineGroup": "",
"hidden": false,
"isIntegrationScript": true,
"islongRunning": false,
"mappingId": "",
"outgoingMapperId": "",
"incomingMapperId": "",
"remoteSync": false,
"isSystemIntegration": true,
"canSample": false,
"defaultIgnore": false,
"integrationLogLevel": "",
"commandsPermissions": null,
"longRunningId": "",
"incidentFetchInterval": 0,
"eventFetchInterval": 0,
"assetsFetchInterval": 0,
"servicesID": "main",
"isBuiltin": false,
"hybrid": false,
"configuration": {
"id": "",
"version": 0,
"cacheVersn": 0,
"modified": "0001-01-01T00:00:00Z",
"sizeInBytes": 0,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "",
"prevName": "",
"display": "",
"brand": "",
"category": "",
"icon": "",
"description": "",
"configuration": null,
"integrationScript": null,
"hidden": false,
"canGetSamples": false
},
"data": [
{
"display": "Create relationships",
"displayPassword": "",
"name": "create_relationships",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": true
},
{
"display": "Fetch indicators",
"displayPassword": "",
"name": "feed",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": true
},
{
"display": "Bypass exclusion list",
"displayPassword": "",
"name": "feedBypassExclusionList",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.",
"hasvalue": true,
"value": true
},
{
"display": "Feed Fetch Interval",
"displayPassword": "",
"name": "feedFetchInterval",
"defaultValue": "10",
"type": 19,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": "10"
},
{
"display": "Incremental Feed",
"displayPassword": "",
"name": "feedIncremental",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": true,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.",
"hasvalue": true,
"value": true
},
{
"display": "Source Reliability",
"displayPassword": "",
"name": "feedReliability",
"defaultValue": "A - Completely reliable",
"type": 15,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"A - Completely reliable",
"B - Usually reliable",
"C - Fairly reliable",
"D - Not usually reliable",
"E - Unreliable",
"F - Reliability cannot be judged"
],
"info": "Reliability of the source providing the intelligence data.",
"hasvalue": true,
"value": "A - Completely reliable"
},
{
"display": "AutoFocus Endpoint URL",
"displayPassword": "",
"name": "url",
"defaultValue": "https://autofocus.paloaltonetworks.com/api/v1.0/",
"type": 0,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": "https://autofocus.paloaltonetworks.com/api/v1.0/"
}
],
"displayPassword": "",
"passwordProtected": false,
"mappable": false,
"remoteSyncableIn": false,
"remoteSyncableOut": false,
"isFetchSamples": false,
"debugMode": false
}
]
}For integrations that fetch incidents or indicators in predefined intervals, fetch the execution history for the specified integration instance.
Note: The lastRun field in each history entry is a serialized JSON string representing internal integration state. This field has a size limitation and may be truncated for integrations with large state objects. When truncated, the value may not be valid JSON. Do not rely on parsing lastRun for production monitoring workflows.
Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Body
brandstringOptional
Integration name
instancestringOptional
Instance name
Responses
200
OK
application/json
totalintegerOptional
instancestringOptional
brandstringOptional
post/xsoar/public/v1/settings/integration/fetch-history
POST /xsoar/public/v1/settings/integration/fetch-history HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 91
{
"brand": "JSONSampleIncidentGenerator",
"instance": "JSONSampleIncidentGenerator_instance_1"
}200
OK
{
"total": 1,
"data": [
{
"id": "JSONSampleIncidentGenerator.JSONSampleIncidentGenerator_instance_1",
"version": -1,
"cacheVersn": 0,
"modified": "0001-01-01T00:00:00Z",
"sizeInBytes": 0,
"brand": "JSONSampleIncidentGenerator",
"instance": "JSONSampleIncidentGenerator_instance_1",
"incidentsPulled": 1,
"indicatorsPulled": 0,
"eventsPulled": 2,
"assetsPulled": 0,
"type": 0,
"incidentsDropped": 0,
"lastPullTime": "2024-04-17T09:21:38.240062103Z",
"lastError": "",
"lastIngestionDuration": 313779970,
"fetchDuration": 9090520,
"creation_time": "0001-01-01T00:00:00Z",
"sum_hour": 0,
"sum_day": 0,
"sum_week": 0,
"status": "success",
"lastRun": ""
}
],
"instance": "JSONSampleIncidentGenerator_instance_1",
"brand": "JSONSampleIncidentGenerator"
}Create a new instance of an integration.
Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Body
namestringOptional
Instance name
idstringOptional
enginestringOptional
engineGroupstringOptional
defaultIgnorebooleanOptional
enabledstringOptional
propagationLabelsstring[]Optional
brandstringOptional
canSamplebooleanOptional
categorystringOptional
versionintegerOptional
isIntegrationScriptbooleanOptional
isLongRunningbooleanOptional
passwordProtectedbooleanOptional
mappingIdstringOptional
incomingMapperIdstringOptional
outgoingMapperIdstringOptional
resetContextbooleanOptional
integrationLogLevelstringOptional
Responses
200
OK
application/json
assetsFetchIntervalintegerOptional
brandstringOptional
cacheVersnintegerOptional
canSamplebooleanOptional
categorystringOptional
cmdlinestringOptional
commandsPermissionsobject · nullableOptional
configtypesobject · nullableOptional
configvaluesobjectOptional
dataobject · nullableOptional
debugModebooleanOptional
defaultIgnorebooleanOptional
definitionIdstringOptional
displayPasswordstringOptional
enabledstringOptional
enginestringOptional
engineGroupstringOptional
eventFetchIntervalintegerOptional
executablestringOptional
fromServerVersionstringOptional
hiddenbooleanOptional
hybridbooleanOptional
idstringOptional
incidentFetchIntervalintegerOptional
incomingMapperIdstringOptional
integrationLogLevelstringOptional
isBuiltinbooleanOptional
isFetchSamplesbooleanOptional
isIntegrationScriptbooleanOptional
isSystemIntegrationbooleanOptional
islongRunningbooleanOptional
itemVersionstringOptional
longRunningIdstringOptional
mappablebooleanOptional
mappingIdstringOptional
modifiedstringOptional
namestringOptional
outgoingMapperIdstringOptional
packIDstringOptional
packNamestringOptional
passwordProtectedbooleanOptional
pathstringOptional
prevNamestringOptional
primaryTermintegerOptional
propagationLabelsstring[]Optional
remoteSyncbooleanOptional
remoteSyncableInbooleanOptional
remoteSyncableOutbooleanOptional
sequenceNumberintegerOptional
servicesIDstringOptional
sizeInBytesintegerOptional
toServerVersionstringOptional
versionintegerOptional
put/xsoar/public/v1/settings/integration
PUT /xsoar/public/v1/settings/integration HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 13040
{
"assetsFetchInterval": 0,
"brand": "JSONSampleIncidentGenerator",
"cacheVersn": 0,
"canSample": true,
"category": "Utilities",
"cmdline": "",
"commandsPermissions": null,
"configtypes": {
"JSON": 12,
"incidentFetchInterval": 19,
"incidentType": 13,
"isFetch": 8,
"name": 0
},
"configuration": {
"brand": "",
"cacheVersn": 0,
"canGetSamples": true,
"category": "Utilities",
"commitMessage": "",
"configuration": [
{
"defaultValue": "",
"display": "Fetch incidents",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "isFetch",
"options": null,
"required": false,
"type": 8
},
{
"defaultValue": "",
"display": "Incident type",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentType",
"options": null,
"required": false,
"type": 13
},
{
"defaultValue": "1",
"display": "Incidents Fetch Interval",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentFetchInterval",
"options": null,
"required": false,
"type": 19
},
{
"defaultValue": "",
"display": "The raw JSON string to use as the sample data",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "JSON",
"options": null,
"required": true,
"type": 12
},
{
"defaultValue": "",
"display": "The incident name to give to the created incident",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "name",
"options": null,
"required": false,
"type": 0
}
],
"definitionId": "",
"description": "A utility for testing incident fetching with mock JSON data.",
"detailedDescription": "### Community Contributed Integration\n #### Integration Author: Nicholas Ericksen\n No support or maintenance is provided by the author. Customers are encouraged to engage with the user community for questions and guidance at the [Cortex XSOAR Live Discussions](https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/bd-p/Cortex_XSOAR_Discussions).\n***\n## JSON Sample Incident Generator\n- Add a string of JSON to the integration parameter denoted `The raw JSON string to use as the sample data` \n- Add a incident name to be used for the created incident (if a mapper is not used)\n- (optional) Configure a classifier and a mapper\n- Set the fetch interval and enable fetching\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/json-sample-incident-generator)",
"display": "JSON Sample Incident Generator (Community Contribution)",
"fromServerVersion": "6.0.0",
"hidden": false,
"icon": "",
"id": "JSONSampleIncidentGenerator",
"image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEQAAABACAYAAACjgtGkAAAMR2lDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnltSSWiBCEgJvYkiSJcSQosgIFWwEZJAQokxIYjYkUUF1y4iYENXRRRdCyBrxV4Wxd4fFlSUdbFgQ+VNCujq99773vm+uffPmXP+UzL33hkAdKp5UmkOqgtAriRPFhcezBqbksoiPQYIoAMt4A7ceHy5lB0bGwWg9N//Ke+uQ2soV1yUXD/P/1fREwjlfACQWIjTBXJ+LsT7AMCL+VJZHgBEb6i3nponVeLxEBvIYIIQS5U4U42LlThdjStUNglxHIh3AECm8XiyTAC0m6Celc/PhDzaNyF2lQjEEgB0yBAH8EU8AcQREA/JzZ2sxNAOOKR/x5P5D870AU4eL3MAq2tRCTlELJfm8Kb9n+3435Kbo+iPYQcHTSSLiFPWDPt2M3typBLTIO6SpEfHQKwP8QexQGUPMUoVKSIS1faoKV/OgT0DTIhdBbyQSIhNIQ6T5ERHafTpGeIwLsRwhaAF4jxugsZ3gVAeGq/hrJZNjovpxxkyDlvjW8+TqeIq7U8oshPZGv6bIiG3n/9toSghWZ0zRs0XJ0VDrA0xU54dH6m2wWwKRZzofhuZIk6Zvw3EvkJJeLCaH5uYIQuL09jLcuX99WILRGJutAZX5okSIjQ8O/g8Vf5GEDcJJezEfh6hfGxUfy0CYUiounbsklCSqKkXa5fmBcdpfF9Lc2I19jhVmBOu1FtBbCrPj9f44gF5cEGq+fFoaV5sgjpPPD2LNypWnQ9eAKIAB4QAFlDAkQ4mgywgbu1q7IK/1DNhgAdkIBMIgYtG0++RrJqRwGs8KAR/QSQE8gG/YNWsEORD/ZcBrfrqAjJUs/kqj2zwBOJcEAly4G+FyksyEC0JPIYa8U/R+TDXHDiUcz/r2FATpdEo+nlZOv2WxFBiCDGCGEZ0xE3wANwPj4LXIDjccG/cpz/bb/aEJ4Q2wkPCNUI74dYkcZHsh3pYYDRohxHCNDWnf18zbgdZPfBg3B/yQ26ciZsAF3wEjMTGA2FsD6jlaDJXVv8j9z9q+K7rGjuKKwWlDKIEURx+9NR20vYYYFH29PsOqXNNH+grZ2Dmx/ic7zotgPfIHy2xBdhe7DR2DDuLHcQaAQs7gjVhF7BDSjywih6rVlF/tDhVPtmQR/xTPJ4mprKTctc6107Xz+q5PGGB8v0IOJOl02TiTFEeiw3f/EIWV8IfOoTl5urmCoDyO6J+Tb1hqr4PCPPcN908SwD8p/X19R38pou8BMDeQwBQb3/T2XfA18E5AM6s5itk+WodrrwQABXowCfKGJgDa+AA63EDnsAPBIFQMArEgASQAibCLovgepaBqWAGmAtKQBlYClaBSrAebALbwE6wBzSCg+AYOAXOg0vgGrgDV08HeAG6wTvQiyAICaEjDMQYsUBsEWfEDfFGApBQJAqJQ1KQNCQTkSAKZAYyDylDliOVyEakFvkdOYAcQ84ibcgt5AHSibxGPqEYSkMNUDPUDh2GeqNsNBJNQCegmegUtBAtRhejFWgNugNtQI+h59FraDv6Au3BAKaFMTFLzAXzxjhYDJaKZWAybBZWipVjNVg91gz/5ytYO9aFfcSJOANn4S5wBUfgiTgfn4LPwhfhlfg2vAE/gV/BH+Dd+FcCnWBKcCb4EriEsYRMwlRCCaGcsIWwn3ASPk0dhHdEIpFJtCd6wacxhZhFnE5cRFxL3EU8SmwjPiL2kEgkY5IzyZ8UQ+KR8kglpDWkHaQjpMukDtIHshbZguxGDiOnkiXkInI5eTv5MPky+Sm5l6JLsaX4UmIoAso0yhLKZkoz5SKlg9JL1aPaU/2pCdQs6lxqBbWeepJ6l/pGS0vLSstHa4yWWGuOVoXWbq0zWg+0PtL0aU40Dm08TUFbTNtKO0q7RXtDp9Pt6EH0VHoefTG9ln6cfp/+QZuhPVSbqy3Qnq1dpd2gfVn7pQ5Fx1aHrTNRp1CnXGevzkWdLl2Krp0uR5enO0u3SveA7g3dHj2G3nC9GL1cvUV62/XO6j3TJ+nb6YfqC/SL9TfpH9d/xMAY1gwOg8+Yx9jMOMnoMCAa2BtwDbIMygx2GrQadBvqG44wTDIsMKwyPGTYzsSYdkwuM4e5hLmHeZ35aZDZIPYg4aCFg+oHXR703miwUZCR0KjUaJfRNaNPxizjUONs42XGjcb3THATJ5MxJlNN1pmcNOkabDDYbzB/cOngPYNvm6KmTqZxptNNN5leMO0xMzcLN5OarTE7btZlzjQPMs8yX2l+2LzTgmERYCG2WGlxxOI5y5DFZuWwKlgnWN2WppYRlgrLjZatlr1W9laJVkVWu6zuWVOtva0zrFdat1h321jYjLaZYVNnc9uWYuttK7JdbXva9r2dvV2y3Xy7Rrtn9kb2XPtC+zr7uw50h0CHKQ41DlcdiY7ejtmOax0vOaFOHk4ipyqni86os6ez2Hmtc9sQwhCfIZIhNUNuuNBc2C75LnUuD4Yyh0YNLRraOPTlMJthqcOWDTs97Kurh2uO62bXO8P1h48aXjS8efhrNyc3vluV21V3unuY+2z3JvdXI5xHCEesG3HTg+Ex2mO+R4vHF08vT5lnvWenl41Xmle11w1vA+9Y70XeZ3wIPsE+s30O+nz09fTN893j+7efi1+233a/ZyPtRwpHbh75yN/Kn+e/0b89gBWQFrAhoD3QMpAXWBP4MMg6SBC0Jegp25Gdxd7BfhnsGiwL3h/8nuPLmck5GoKFhIeUhrSG6ocmhlaG3g+zCssMqwvrDvcInx5+NIIQERmxLOIG14zL59Zyu0d5jZo56kQkLTI+sjLyYZRTlCyqeTQ6etToFaPvRttGS6IbY0AMN2ZFzL1Y+9gpsX+MIY6JHVM15knc8LgZcafjGfGT4rfHv0sITliScCfRIVGR2JKkkzQ+qTbpfXJI8vLk9rHDxs4cez7FJEWc0pRKSk1K3ZLaMy503KpxHeM9xpeMvz7BfkLBhLMTTSbmTDw0SWcSb9LeNEJactr2tM+8GF4Nryedm16d3s3n8FfzXwiCBCsFnUJ/4XLh0wz/jOUZzzL9M1dkdooCReWiLjFHXCl+lRWRtT7rfXZM9tbsvpzknF255Ny03AMSfUm25MRk88kFk9ukztISafsU3ymrpnTLImVb5Ih8grwpzwBu2C8oHBS/KB7kB+RX5X+YmjR1b4FegaTgwjSnaQunPS0MK/xtOj6dP71lhuWMuTMezGTP3DgLmZU+q2W29ezi2R1zwudsm0udmz33zyLXouVFb+clz2suNiueU/zol/Bf6kq0S2QlN+b7zV+/AF8gXtC60H3hmoVfSwWl58pcy8rLPi/iLzr36/BfK37tW5yxuHWJ55J1S4lLJUuvLwtctm253vLC5Y9WjF7RsJK1snTl21WTVp0tH1G+fjV1tWJ1e0VURdMamzVL13yuFFVeqwqu2lVtWr2w+v1awdrL64LW1a83W1+2/tMG8YabG8M3NtTY1ZRvIm7K3/Rkc9Lm0795/1a7xWRL2ZYvWyVb27fFbTtR61Vbu910+5I6tE5R17lj/I5LO0N2NtW71G/cxdxVthvsVux+/nva79f3RO5p2eu9t36f7b7q/Yz9pQ1Iw7SG7kZRY3tTSlPbgVEHWpr9mvf/MfSPrQctD1YdMjy05DD1cPHhviOFR3qOSo92Hcs89qhlUsud42OPXz0x5kTryciTZ06FnTp+mn36yBn/MwfP+p49cM77XON5z/MNFzwu7P/T48/9rZ6tDRe9LjZd8rnU3Day7fDlwMvHroRcOXWVe/X8tehrbdcTr9+8Mf5G+03BzWe3cm69up1/u/fOnLuEu6X3dO+V3ze9X/Mvx3/tavdsP/Qg5MGFh/EP7zziP3rxWP74c0fxE/qT8qcWT2ufuT072BnWeen5uOcdL6QvertK/tL7q/qlw8t9fwf9faF7bHfHK9mrvteL3hi/2fp2xNuWntie++9y3/W+L/1g/GHbR++Ppz8lf3raO/Uz6XPFF8cvzV8jv97ty+3rk/JkPNVWAIMDzcgA4PVWAOgpADDgHoI6Tn3OUwmiPpuqEPhPWH0WVIknAPXwptyuc44CsBsOuzmQG96VW/WEIIC6uw8Mjcgz3N3UXDR44iF86Ot7YwYAqRmAL7K+vt61fX1fNsNkbwFwdIr6fKkUIjwbbAhQomtGgjngB/k3BSOBEX9S4YsAAAAJcEhZcwAAFiUAABYlAUlSJPAAAAGbaVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA1LjQuMCI+CiAgIDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOmV4aWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vZXhpZi8xLjAvIj4KICAgICAgICAgPGV4aWY6UGl4ZWxYRGltZW5zaW9uPjY4PC9leGlmOlBpeGVsWERpbWVuc2lvbj4KICAgICAgICAgPGV4aWY6UGl4ZWxZRGltZW5zaW9uPjY0PC9leGlmOlBpeGVsWURpbWVuc2lvbj4KICAgICAgPC9yZGY6RGVzY3JpcHRpb24+CiAgIDwvcmRmOlJERj4KPC94OnhtcG1ldGE+ClzenRYAAAAcaURPVAAAAAIAAAAAAAAAIAAAACgAAAAgAAAAIAAAAng6drPEAAACRElEQVR4AeyYPe8BMRjAex9AxGIyG60kYjaZiMHiA5gsvgQTg8kmVrEYCIuISEwSL5tFREKQICRE/x7JNdeeS3ra/qc2EZ7e8/q7p706A78H0oMQMDQQwuLzQwOheSANRANhCDCi7hANhCHAiLpDNBCGACPqDtFAGAKMqDtEA2EIMKLuEA2EIcCIukP+G8jr9UKdTgcNBgO02+3Q/X5HlUoFeb1eJhW7mMvlPvo+nw+Fw2GUSqWQYRh2RZkz8D5E1XjDwOl0Gl5AUZ/1es0V0uPxUHaJRAKfTicu21+V0K+GPHb1ep0qyATzKxCwL5VKPKF/1lEKxNodsVgMd7tdvFgsMHQOz1itVng0GuFMJkPABgIBbnueGKyOUiDWlp/P52xsbnm73RIg0CX7/Z7b1q2iMiDP55Mq4vF4uM2N0g+FQsTfcrmkrskUlAG53W6kALiroiMSiRB/0+lU1J2jvXimDq4vlwspAJaO6IhGo8TfZDIRdedorwzI4XAgBcgAApuy+ZQaDoeOBYleUAZks9mQAvx+v2ieGM4gJpB+vy/sz8mBMiCw8ZkFBINBp/jc89lslvhrNpvcdm4VlQFpt9ukgHg87jYvm36hUCD+isWi7bqsCSVA4OBlXfO1Wk04XytgWILn81nY5zcH0oHAIzGfz5O7CcvmeDx+i+1q7nq9YgBhLsNkMolhc4XzjswhFUiv1yMJm4k3Gg1p+Y7HY2w9/UKMarUqzT84kgoE/quYIOC71WpJTRaczWYzKka5XJYa4w8AAP//PBb01QAAAh9JREFU7Za/rkFBEMb3thKFSqNSKBQKiVIjEREvIBGVRu0FtGoeQY9oRCQ60YiC8ABCVKIgQfzZe6Y4E2ducO7ZXdVsIieTs/PtzM93dldIjWMwGEghhOPXarW0rTCdTmU4HHbo1+t1bfogJHSq3e93ORqNZKlUchS9Wq20LBOLxVA3m83Kfr8vL5eLFm1bRCsQW/R2u8lEIoHFNxoN+5Xn53w+Rz2/3y/3+71nrXeJRoDAgt1uFxvI5XLvanD1rlqtol6tVnOV42WSMSDL5RIbiMfjXmpz5OTzedRrt9uOdzoDY0A2mw02EAqFlGuGPcPesIfDobLeKwFjQHa7HTYA37zqSKfTqDcej1XlXuYbA3I8HrEB+GdVRyqVQr3JZKIq9zJfvdIX0nAc2hbXASSZTKIe3EdMDWNAHo8HNqADSDQaRb3FYmGKh96LGa0S9g7bJSo2P51O8llru93SpbTFxhwCFT6fDJlMRoLV/9MMbMyz2UyWy2UEC1d3k8MokE6ng43YToEnHMluxrMr7PxKpeIm1fMco0Cu16ssFot/oKzXa1cFUyCRSEQeDgdXuV4n/UCiRd/osJwier2esD4BcT6fRbPZFIFA4OOahUJBWPuHCAaDwrrtCoh9Pt/HPJUJXwGiUuC3cxkIIc5AGAghQEJ2CAMhBEjIDmEghAAJ2SEMhBAgITuEgRACJGSHMBBCgITsEAZCCJCQHUKA/AJ5a/4/aFrqtgAAAABJRU5ErkJggg==",
"integrationScript": {
"commands": [
{
"arguments": [
{
"default": false,
"deprecated": false,
"description": "The key to change. Must also set value arguement. Can be comma separated to change multiple values.",
"hidden": false,
"name": "key",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "The new key value. Must also set key argument. Can be comma separated to support changing multiple values.",
"hidden": false,
"name": "value",
"required": false,
"secret": false,
"type": ""
}
],
"cartesian": false,
"definitionId": "",
"deprecated": false,
"description": "Read the provided JSON and return the results to the Context and Warroom. Can use key and value arg to change a JSON values if desired.",
"docsHidden": false,
"execution": false,
"gomAction": false,
"hidden": false,
"indicatorAction": false,
"name": "json-sample-incident-generator-command",
"outputs": null,
"permitted": false,
"polling": false,
"sensitive": false,
"timeout": 0
}
],
"dockerImage": "demisto/python3:3.11.10.116439",
"feed": false,
"isFetch": true,
"isFetchAssets": false,
"isFetchCredentials": false,
"isFetchEvents": false,
"isFetchSamples": false,
"isMappable": false,
"isRemoteSyncIn": false,
"isRemoteSyncOut": false,
"longRunning": false,
"longRunningPortMapping": false,
"nativeImage": [
"8.8",
"8.6"
],
"resetContext": false,
"runOnce": false,
"subtype": "python3",
"type": "python"
},
"isOverridable": false,
"itemVersion": "1.0.8",
"modified": "2025-04-08T14:12:54.294447021Z",
"name": "JSONSampleIncidentGenerator",
"packID": "JSONSampleIncidentGenerator",
"packName": "JSON Sample Incident Generator",
"packPropagationLabels": [
"all"
],
"prevName": "JSONSampleIncidentGenerator",
"primaryTerm": 7,
"propagationLabels": [],
"sequenceNumber": 5489516,
"shouldCommit": false,
"sizeInBytes": 13373,
"sortValues": [
"moduleconfiguration_JSONSampleIncidentGenerator"
],
"system": true,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1
},
"configvalues": {
"JSON": "test",
"incidentFetchInterval": "1",
"incidentType": null,
"isFetch": false,
"name": null
},
"data": [
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": false,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentType",
"options": null,
"required": false,
"type": 13,
"value": null
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentFetchInterval",
"options": null,
"required": false,
"type": 19,
"value": "1"
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "JSON",
"options": null,
"required": true,
"type": 12,
"value": "test"
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": false,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "name",
"options": null,
"required": false,
"type": 0,
"value": null
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "isFetch",
"options": null,
"required": false,
"type": 8,
"value": false
}
],
"debugMode": false,
"defaultIgnore": false,
"definitionId": "",
"displayPassword": "",
"enabled": "true",
"engine": "",
"engineGroup": "",
"eventFetchInterval": 0,
"executable": "",
"fromServerVersion": "",
"hidden": false,
"hybrid": false,
"id": "8a17f6e9-3182-4ac3-810d-a408c15e8d00",
"incidentFetchInterval": 0,
"incomingMapperId": "",
"integrationLogLevel": "",
"isBuiltin": false,
"isFetchSamples": false,
"isIntegrationScript": true,
"isOverridable": false,
"isSystemIntegration": true,
"islongRunning": false,
"itemVersion": "",
"longRunningId": "",
"mappable": false,
"mappingId": "",
"modified": "2025-04-27T11:33:52.289950795Z",
"name": "JSONSampleIncidentGenerator_instance_2",
"outgoingMapperId": "",
"packID": "",
"packName": "",
"passwordProtected": false,
"path": "",
"prevName": "",
"primaryTerm": 13,
"propagationLabels": [
"all"
],
"remoteSync": false,
"remoteSyncableIn": false,
"remoteSyncableOut": false,
"sequenceNumber": 5957356,
"servicesID": "main",
"sizeInBytes": 1114,
"toServerVersion": "",
"version": 2
}200
OK
{
"assetsFetchInterval": 0,
"brand": "JSONSampleIncidentGenerator",
"cacheVersn": 0,
"canSample": true,
"category": "Utilities",
"cmdline": "",
"commandsPermissions": null,
"configtypes": {
"JSON": 12,
"incidentFetchInterval": 19,
"incidentType": 13,
"isFetch": 8,
"name": 0
},
"configuration": {
"brand": "",
"cacheVersn": 0,
"canGetSamples": true,
"category": "Utilities",
"commitMessage": "",
"configuration": [
{
"defaultValue": "",
"display": "Fetch incidents",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "isFetch",
"options": null,
"required": false,
"type": 8
},
{
"defaultValue": "",
"display": "Incident type",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentType",
"options": null,
"required": false,
"type": 13
},
{
"defaultValue": "1",
"display": "Incidents Fetch Interval",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentFetchInterval",
"options": null,
"required": false,
"type": 19
},
{
"defaultValue": "",
"display": "The raw JSON string to use as the sample data",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "JSON",
"options": null,
"required": true,
"type": 12
},
{
"defaultValue": "",
"display": "The incident name to give to the created incident",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "name",
"options": null,
"required": false,
"type": 0
}
],
"definitionId": "",
"description": "A utility for testing incident fetching with mock JSON data.",
"detailedDescription": "### Community Contributed Integration\n #### Integration Author: Nicholas Ericksen\n No support or maintenance is provided by the author. Customers are encouraged to engage with the user community for questions and guidance at the [Cortex XSOAR Live Discussions](https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/bd-p/Cortex_XSOAR_Discussions).\n***\n## JSON Sample Incident Generator\n- Add a string of JSON to the integration parameter denoted `The raw JSON string to use as the sample data` \n- Add a incident name to be used for the created incident (if a mapper is not used)\n- (optional) Configure a classifier and a mapper\n- Set the fetch interval and enable fetching\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/json-sample-incident-generator)",
"display": "JSON Sample Incident Generator (Community Contribution)",
"fromServerVersion": "6.0.0",
"hidden": false,
"icon": "",
"id": "JSONSampleIncidentGenerator",
"image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEQAAABACAYAAACjgtGkAAAMR2lDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnltSSWiBCEgJvYkiSJcSQosgIFWwEZJAQokxIYjYkUUF1y4iYENXRRRdCyBrxV4Wxd4fFlSUdbFgQ+VNCujq99773vm+uffPmXP+UzL33hkAdKp5UmkOqgtAriRPFhcezBqbksoiPQYIoAMt4A7ceHy5lB0bGwWg9N//Ke+uQ2soV1yUXD/P/1fREwjlfACQWIjTBXJ+LsT7AMCL+VJZHgBEb6i3nponVeLxEBvIYIIQS5U4U42LlThdjStUNglxHIh3AECm8XiyTAC0m6Celc/PhDzaNyF2lQjEEgB0yBAH8EU8AcQREA/JzZ2sxNAOOKR/x5P5D870AU4eL3MAq2tRCTlELJfm8Kb9n+3435Kbo+iPYQcHTSSLiFPWDPt2M3typBLTIO6SpEfHQKwP8QexQGUPMUoVKSIS1faoKV/OgT0DTIhdBbyQSIhNIQ6T5ERHafTpGeIwLsRwhaAF4jxugsZ3gVAeGq/hrJZNjovpxxkyDlvjW8+TqeIq7U8oshPZGv6bIiG3n/9toSghWZ0zRs0XJ0VDrA0xU54dH6m2wWwKRZzofhuZIk6Zvw3EvkJJeLCaH5uYIQuL09jLcuX99WILRGJutAZX5okSIjQ8O/g8Vf5GEDcJJezEfh6hfGxUfy0CYUiounbsklCSqKkXa5fmBcdpfF9Lc2I19jhVmBOu1FtBbCrPj9f44gF5cEGq+fFoaV5sgjpPPD2LNypWnQ9eAKIAB4QAFlDAkQ4mgywgbu1q7IK/1DNhgAdkIBMIgYtG0++RrJqRwGs8KAR/QSQE8gG/YNWsEORD/ZcBrfrqAjJUs/kqj2zwBOJcEAly4G+FyksyEC0JPIYa8U/R+TDXHDiUcz/r2FATpdEo+nlZOv2WxFBiCDGCGEZ0xE3wANwPj4LXIDjccG/cpz/bb/aEJ4Q2wkPCNUI74dYkcZHsh3pYYDRohxHCNDWnf18zbgdZPfBg3B/yQ26ciZsAF3wEjMTGA2FsD6jlaDJXVv8j9z9q+K7rGjuKKwWlDKIEURx+9NR20vYYYFH29PsOqXNNH+grZ2Dmx/ic7zotgPfIHy2xBdhe7DR2DDuLHcQaAQs7gjVhF7BDSjywih6rVlF/tDhVPtmQR/xTPJ4mprKTctc6107Xz+q5PGGB8v0IOJOl02TiTFEeiw3f/EIWV8IfOoTl5urmCoDyO6J+Tb1hqr4PCPPcN908SwD8p/X19R38pou8BMDeQwBQb3/T2XfA18E5AM6s5itk+WodrrwQABXowCfKGJgDa+AA63EDnsAPBIFQMArEgASQAibCLovgepaBqWAGmAtKQBlYClaBSrAebALbwE6wBzSCg+AYOAXOg0vgGrgDV08HeAG6wTvQiyAICaEjDMQYsUBsEWfEDfFGApBQJAqJQ1KQNCQTkSAKZAYyDylDliOVyEakFvkdOYAcQ84ibcgt5AHSibxGPqEYSkMNUDPUDh2GeqNsNBJNQCegmegUtBAtRhejFWgNugNtQI+h59FraDv6Au3BAKaFMTFLzAXzxjhYDJaKZWAybBZWipVjNVg91gz/5ytYO9aFfcSJOANn4S5wBUfgiTgfn4LPwhfhlfg2vAE/gV/BH+Dd+FcCnWBKcCb4EriEsYRMwlRCCaGcsIWwn3ASPk0dhHdEIpFJtCd6wacxhZhFnE5cRFxL3EU8SmwjPiL2kEgkY5IzyZ8UQ+KR8kglpDWkHaQjpMukDtIHshbZguxGDiOnkiXkInI5eTv5MPky+Sm5l6JLsaX4UmIoAso0yhLKZkoz5SKlg9JL1aPaU/2pCdQs6lxqBbWeepJ6l/pGS0vLSstHa4yWWGuOVoXWbq0zWg+0PtL0aU40Dm08TUFbTNtKO0q7RXtDp9Pt6EH0VHoefTG9ln6cfp/+QZuhPVSbqy3Qnq1dpd2gfVn7pQ5Fx1aHrTNRp1CnXGevzkWdLl2Krp0uR5enO0u3SveA7g3dHj2G3nC9GL1cvUV62/XO6j3TJ+nb6YfqC/SL9TfpH9d/xMAY1gwOg8+Yx9jMOMnoMCAa2BtwDbIMygx2GrQadBvqG44wTDIsMKwyPGTYzsSYdkwuM4e5hLmHeZ35aZDZIPYg4aCFg+oHXR703miwUZCR0KjUaJfRNaNPxizjUONs42XGjcb3THATJ5MxJlNN1pmcNOkabDDYbzB/cOngPYNvm6KmTqZxptNNN5leMO0xMzcLN5OarTE7btZlzjQPMs8yX2l+2LzTgmERYCG2WGlxxOI5y5DFZuWwKlgnWN2WppYRlgrLjZatlr1W9laJVkVWu6zuWVOtva0zrFdat1h321jYjLaZYVNnc9uWYuttK7JdbXva9r2dvV2y3Xy7Rrtn9kb2XPtC+zr7uw50h0CHKQ41DlcdiY7ejtmOax0vOaFOHk4ipyqni86os6ez2Hmtc9sQwhCfIZIhNUNuuNBc2C75LnUuD4Yyh0YNLRraOPTlMJthqcOWDTs97Kurh2uO62bXO8P1h48aXjS8efhrNyc3vluV21V3unuY+2z3JvdXI5xHCEesG3HTg+Ex2mO+R4vHF08vT5lnvWenl41Xmle11w1vA+9Y70XeZ3wIPsE+s30O+nz09fTN893j+7efi1+233a/ZyPtRwpHbh75yN/Kn+e/0b89gBWQFrAhoD3QMpAXWBP4MMg6SBC0Jegp25Gdxd7BfhnsGiwL3h/8nuPLmck5GoKFhIeUhrSG6ocmhlaG3g+zCssMqwvrDvcInx5+NIIQERmxLOIG14zL59Zyu0d5jZo56kQkLTI+sjLyYZRTlCyqeTQ6etToFaPvRttGS6IbY0AMN2ZFzL1Y+9gpsX+MIY6JHVM15knc8LgZcafjGfGT4rfHv0sITliScCfRIVGR2JKkkzQ+qTbpfXJI8vLk9rHDxs4cez7FJEWc0pRKSk1K3ZLaMy503KpxHeM9xpeMvz7BfkLBhLMTTSbmTDw0SWcSb9LeNEJactr2tM+8GF4Nryedm16d3s3n8FfzXwiCBCsFnUJ/4XLh0wz/jOUZzzL9M1dkdooCReWiLjFHXCl+lRWRtT7rfXZM9tbsvpzknF255Ny03AMSfUm25MRk88kFk9ukztISafsU3ymrpnTLImVb5Ih8grwpzwBu2C8oHBS/KB7kB+RX5X+YmjR1b4FegaTgwjSnaQunPS0MK/xtOj6dP71lhuWMuTMezGTP3DgLmZU+q2W29ezi2R1zwudsm0udmz33zyLXouVFb+clz2suNiueU/zol/Bf6kq0S2QlN+b7zV+/AF8gXtC60H3hmoVfSwWl58pcy8rLPi/iLzr36/BfK37tW5yxuHWJ55J1S4lLJUuvLwtctm253vLC5Y9WjF7RsJK1snTl21WTVp0tH1G+fjV1tWJ1e0VURdMamzVL13yuFFVeqwqu2lVtWr2w+v1awdrL64LW1a83W1+2/tMG8YabG8M3NtTY1ZRvIm7K3/Rkc9Lm0795/1a7xWRL2ZYvWyVb27fFbTtR61Vbu910+5I6tE5R17lj/I5LO0N2NtW71G/cxdxVthvsVux+/nva79f3RO5p2eu9t36f7b7q/Yz9pQ1Iw7SG7kZRY3tTSlPbgVEHWpr9mvf/MfSPrQctD1YdMjy05DD1cPHhviOFR3qOSo92Hcs89qhlUsud42OPXz0x5kTryciTZ06FnTp+mn36yBn/MwfP+p49cM77XON5z/MNFzwu7P/T48/9rZ6tDRe9LjZd8rnU3Day7fDlwMvHroRcOXWVe/X8tehrbdcTr9+8Mf5G+03BzWe3cm69up1/u/fOnLuEu6X3dO+V3ze9X/Mvx3/tavdsP/Qg5MGFh/EP7zziP3rxWP74c0fxE/qT8qcWT2ufuT072BnWeen5uOcdL6QvertK/tL7q/qlw8t9fwf9faF7bHfHK9mrvteL3hi/2fp2xNuWntie++9y3/W+L/1g/GHbR++Ppz8lf3raO/Uz6XPFF8cvzV8jv97ty+3rk/JkPNVWAIMDzcgA4PVWAOgpADDgHoI6Tn3OUwmiPpuqEPhPWH0WVIknAPXwptyuc44CsBsOuzmQG96VW/WEIIC6uw8Mjcgz3N3UXDR44iF86Ot7YwYAqRmAL7K+vt61fX1fNsNkbwFwdIr6fKkUIjwbbAhQomtGgjngB/k3BSOBEX9S4YsAAAAJcEhZcwAAFiUAABYlAUlSJPAAAAGbaVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA1LjQuMCI+CiAgIDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOmV4aWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vZXhpZi8xLjAvIj4KICAgICAgICAgPGV4aWY6UGl4ZWxYRGltZW5zaW9uPjY4PC9leGlmOlBpeGVsWERpbWVuc2lvbj4KICAgICAgICAgPGV4aWY6UGl4ZWxZRGltZW5zaW9uPjY0PC9leGlmOlBpeGVsWURpbWVuc2lvbj4KICAgICAgPC9yZGY6RGVzY3JpcHRpb24+CiAgIDwvcmRmOlJERj4KPC94OnhtcG1ldGE+ClzenRYAAAAcaURPVAAAAAIAAAAAAAAAIAAAACgAAAAgAAAAIAAAAng6drPEAAACRElEQVR4AeyYPe8BMRjAex9AxGIyG60kYjaZiMHiA5gsvgQTg8kmVrEYCIuISEwSL5tFREKQICRE/x7JNdeeS3ra/qc2EZ7e8/q7p706A78H0oMQMDQQwuLzQwOheSANRANhCDCi7hANhCHAiLpDNBCGACPqDtFAGAKMqDtEA2EIMKLuEA2EIcCIukP+G8jr9UKdTgcNBgO02+3Q/X5HlUoFeb1eJhW7mMvlPvo+nw+Fw2GUSqWQYRh2RZkz8D5E1XjDwOl0Gl5AUZ/1es0V0uPxUHaJRAKfTicu21+V0K+GPHb1ep0qyATzKxCwL5VKPKF/1lEKxNodsVgMd7tdvFgsMHQOz1itVng0GuFMJkPABgIBbnueGKyOUiDWlp/P52xsbnm73RIg0CX7/Z7b1q2iMiDP55Mq4vF4uM2N0g+FQsTfcrmkrskUlAG53W6kALiroiMSiRB/0+lU1J2jvXimDq4vlwspAJaO6IhGo8TfZDIRdedorwzI4XAgBcgAApuy+ZQaDoeOBYleUAZks9mQAvx+v2ieGM4gJpB+vy/sz8mBMiCw8ZkFBINBp/jc89lslvhrNpvcdm4VlQFpt9ukgHg87jYvm36hUCD+isWi7bqsCSVA4OBlXfO1Wk04XytgWILn81nY5zcH0oHAIzGfz5O7CcvmeDx+i+1q7nq9YgBhLsNkMolhc4XzjswhFUiv1yMJm4k3Gg1p+Y7HY2w9/UKMarUqzT84kgoE/quYIOC71WpJTRaczWYzKka5XJYa4w8AAP//PBb01QAAAh9JREFU7Za/rkFBEMb3thKFSqNSKBQKiVIjEREvIBGVRu0FtGoeQY9oRCQ60YiC8ABCVKIgQfzZe6Y4E2ducO7ZXdVsIieTs/PtzM93dldIjWMwGEghhOPXarW0rTCdTmU4HHbo1+t1bfogJHSq3e93ORqNZKlUchS9Wq20LBOLxVA3m83Kfr8vL5eLFm1bRCsQW/R2u8lEIoHFNxoN+5Xn53w+Rz2/3y/3+71nrXeJRoDAgt1uFxvI5XLvanD1rlqtol6tVnOV42WSMSDL5RIbiMfjXmpz5OTzedRrt9uOdzoDY0A2mw02EAqFlGuGPcPesIfDobLeKwFjQHa7HTYA37zqSKfTqDcej1XlXuYbA3I8HrEB+GdVRyqVQr3JZKIq9zJfvdIX0nAc2hbXASSZTKIe3EdMDWNAHo8HNqADSDQaRb3FYmGKh96LGa0S9g7bJSo2P51O8llru93SpbTFxhwCFT6fDJlMRoLV/9MMbMyz2UyWy2UEC1d3k8MokE6ng43YToEnHMluxrMr7PxKpeIm1fMco0Cu16ssFot/oKzXa1cFUyCRSEQeDgdXuV4n/UCiRd/osJwier2esD4BcT6fRbPZFIFA4OOahUJBWPuHCAaDwrrtCoh9Pt/HPJUJXwGiUuC3cxkIIc5AGAghQEJ2CAMhBEjIDmEghAAJ2SEMhBAgITuEgRACJGSHMBBCgITsEAZCCJCQHUKA/AJ5a/4/aFrqtgAAAABJRU5ErkJggg==",
"integrationScript": {
"commands": [
{
"arguments": [
{
"default": false,
"deprecated": false,
"description": "The key to change. Must also set value arguement. Can be comma separated to change multiple values.",
"hidden": false,
"name": "key",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "The new key value. Must also set key argument. Can be comma separated to support changing multiple values.",
"hidden": false,
"name": "value",
"required": false,
"secret": false,
"type": ""
}
],
"cartesian": false,
"definitionId": "",
"deprecated": false,
"description": "Read the provided JSON and return the results to the Context and Warroom. Can use key and value arg to change a JSON values if desired.",
"docsHidden": false,
"execution": false,
"gomAction": false,
"hidden": false,
"indicatorAction": false,
"name": "json-sample-incident-generator-command",
"outputs": null,
"permitted": false,
"polling": false,
"sensitive": false,
"timeout": 0
}
],
"dockerImage": "demisto/python3:3.11.10.116439",
"feed": false,
"isFetch": true,
"isFetchAssets": false,
"isFetchCredentials": false,
"isFetchEvents": false,
"isFetchSamples": false,
"isMappable": false,
"isRemoteSyncIn": false,
"isRemoteSyncOut": false,
"longRunning": false,
"longRunningPortMapping": false,
"nativeImage": [
"8.8",
"8.6"
],
"resetContext": false,
"runOnce": false,
"subtype": "python3",
"type": "python"
},
"isOverridable": false,
"itemVersion": "1.0.8",
"modified": "2025-04-08T14:12:54.294447021Z",
"name": "JSONSampleIncidentGenerator",
"packID": "JSONSampleIncidentGenerator",
"packName": "JSON Sample Incident Generator",
"packPropagationLabels": [
"all"
],
"prevName": "JSONSampleIncidentGenerator",
"primaryTerm": 7,
"propagationLabels": [],
"sequenceNumber": 5489516,
"shouldCommit": false,
"sizeInBytes": 13373,
"sortValues": [
"moduleconfiguration_JSONSampleIncidentGenerator"
],
"system": true,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1
},
"configvalues": {
"JSON": "test",
"incidentFetchInterval": "1",
"incidentType": null,
"isFetch": false,
"name": null
},
"data": [
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": false,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentType",
"options": null,
"required": false,
"type": 13,
"value": null
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentFetchInterval",
"options": null,
"required": false,
"type": 19,
"value": "1"
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "JSON",
"options": null,
"required": true,
"type": 12,
"value": "test"
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": false,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "name",
"options": null,
"required": false,
"type": 0,
"value": null
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "isFetch",
"options": null,
"required": false,
"type": 8,
"value": false
}
],
"debugMode": false,
"defaultIgnore": false,
"definitionId": "",
"displayPassword": "",
"enabled": "true",
"engine": "",
"engineGroup": "",
"eventFetchInterval": 0,
"executable": "",
"fromServerVersion": "",
"hidden": false,
"hybrid": false,
"id": "8a17f6e9-3182-4ac3-810d-a408c15e8d00",
"incidentFetchInterval": 0,
"incomingMapperId": "",
"integrationLogLevel": "",
"isBuiltin": false,
"isFetchSamples": false,
"isIntegrationScript": true,
"isOverridable": false,
"isSystemIntegration": true,
"islongRunning": false,
"itemVersion": "",
"longRunningId": "",
"mappable": false,
"mappingId": "",
"modified": "2025-04-27T11:33:52.289950795Z",
"name": "JSONSampleIncidentGenerator_instance_2",
"outgoingMapperId": "",
"packID": "",
"packName": "",
"passwordProtected": false,
"path": "",
"prevName": "",
"primaryTerm": 13,
"propagationLabels": [
"all"
],
"remoteSync": false,
"remoteSyncableIn": false,
"remoteSyncableOut": false,
"sequenceNumber": 5957356,
"servicesID": "main",
"sizeInBytes": 1114,
"toServerVersion": "",
"version": 2
}Reset the last run timestamp on the specified integration instance.
Path parameters
instance_idstringRequired
Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Body
objectOptional
Responses
200
OK
No content
post/xsoar/public/v1/settings/integration/reset/{instance_id}
POST /xsoar/public/v1/settings/integration/reset/{instance_id} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}200
OK
No content
Delete the integration instance credentials specified by ID.
For more information on integration instance credentials, see Manage credentials.
Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Body
idstringOptional
Responses
200
OK
application/json
objectOptional
post/xsoar/public/v1/settings/credentials/delete
POST /xsoar/public/v1/settings/credentials/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 15
{
"id": "jsmith"
}200
OK
{}Get all integration instance credentials and their details.
For more information on integration instance credentials, see Manage credentials.
Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Body
pageintegerOptional
sizeintegerOptional
querystringOptional
Responses
200
OK
application/json
totalintegerOptional
Total number of credentials returned.
post/xsoar/public/v1/settings/credentials
POST /xsoar/public/v1/settings/credentials HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 34
{
"page": 1,
"size": 1,
"query": "text"
}200
OK
{
"credentials": [
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "rocket_ZMKzPGsy",
"locked": false,
"modified": "2025-03-03T16:54:09.855226363Z",
"name": "rocket_ZMKzPGsy",
"primaryTerm": 10,
"sequenceNumber": 84731248,
"sizeInBytes": 255,
"user": "rocket_sXJgXzZ1",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
},
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "rocket_N8HdicIH",
"locked": false,
"modified": "2025-03-31T18:14:20.472931836Z",
"name": "rocket_N8HdicIH",
"primaryTerm": 10,
"sequenceNumber": 88067677,
"sizeInBytes": 255,
"user": "rocket_Tzh15pny",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
},
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "rocket_4MSK7GWn",
"locked": false,
"modified": "2025-04-15T06:57:16.491793756Z",
"name": "rocket_4MSK7GWn",
"primaryTerm": 11,
"sequenceNumber": 89289871,
"sizeInBytes": 255,
"user": "rocket_t9L8y6DI",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
},
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "rocket_FnUCAjCc",
"locked": false,
"modified": "2025-04-27T12:47:24.344273235Z",
"name": "rocket_FnUCAjCc",
"primaryTerm": 14,
"sequenceNumber": 91028639,
"sizeInBytes": 255,
"user": "rocket_2GBNYdBi",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
}
],
"total": 4
}Create integration instance credentials or update existing credentials.
For more information on integration instance credentials, see Manage credentials.
Header parameters
AuthorizationstringRequired
api_key
x-xdr-auth-idstringRequired
api_key_id
Body
objectOptional
Responses
200
OK
application/json
cacheVersnintegerOptional
hasCertificatebooleanOptional
hasCertificatePassbooleanOptional
hasPasswordbooleanOptional
idstringOptional
lockedbooleanOptional
modifiedstringOptional
namestringOptional
primaryTermintegerOptional
sequenceNumberintegerOptional
sizeInBytesintegerOptional
userstringOptional
vaultInstanceIdstringOptional
versionintegerOptional
workgroupstringOptional
put/xsoar/public/v1/settings/credentials
PUT /xsoar/public/v1/settings/credentials HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}200
OK
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "jsmith",
"locked": false,
"modified": "2025-04-27T12:37:21.144981996Z",
"name": "John Smith",
"primaryTerm": 14,
"sequenceNumber": 91027660,
"sizeInBytes": 255,
"user": "jsmith",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
}Last updated
Was this helpful?