Integrations
APIs for managing indicators
Get all integrations.
Responses
200
OK
application/json
idstringOptional
namestringOptional
displaystringOptional
categorystringOptional
descriptionstringOptional
detailedDescriptionstringOptional
feedbooleanOptional
get/xsoar/public/v1/settings/integration-commands
GET /xsoar/public/v1/settings/integration-commands HTTP/1.1
Host: api-yourfqdn
Accept: */*
200
OK
[
{
"id": "abuse.ch SSL Blacklist Feed",
"name": "abuse.ch SSL Blacklist Feed",
"display": "abuse.ch SSL Blacklist Feed",
"category": "Data Enrichment & Threat Intelligence",
"description": "The SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has seen in the past 30 days and identified as being associated with a malicious SSL certificate.",
"detailedDescription": "sslipblacklist.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past 30 days being associated with a malicious SSL certificate.\n\nsslipblacklist_aggressive.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past being associated with a malicious SSL certificate. Warning - High FP Rate!\n\nsslblacklist.csv:\nThe SSL IP Blacklist contains SHA1 Fingerprint of all SSL certificates blacklisted on SSLBL. \nThe SSL Certificate Blacklist (CSV) gets generated every 5 minutes. Please do not fetch it more often than every 5 minutes.\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/abusech-ssl-blacklist-feed)",
"feed": true,
"commands": [
{
"name": "sslbl-get-indicators",
"deprecated": false,
"arguments": [
{
"name": "limit",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The maximum number of results to return. The default value is 50.",
"defaultValue": "50",
"type": ""
},
{
"name": "indicator_type",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The indicator type.",
"type": ""
}
],
"outputs": null,
"important": null,
"description": "Gets the feed indicators.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
}
]
},
{
"id": "ACTI Indicator Feed",
"name": "ACTI Indicator Feed",
"display": "ACTI Indicator Feed (Partner Contribution)",
"category": "Data Enrichment & Threat Intelligence",
"description": "Fetches indicators from a ACTI feed. You can filter returned indicators by indicator type, indicator severity, threat type, confidence, and malware family (each of these are an integration parameter).",
"detailedDescription": "### Partner Contributed Integration\n#### Integration Author: Accenture\nSupport and maintenance for this integration are provided by the author. Please use the following contact details:\n- **Email**: [CTI.AcctManagement@accenture.com](mailto:CTI.AcctManagement@accenture.com)\n- **URL**: [https://www.accenture.com/us-en/services/security/cyber-defense](https://www.accenture.com/us-en/services/security/cyber-defense)\n***\nFetch indicators from a Accenture CTI feed. You can apply filters to the feed to focus which indicators you want to ingest, for example, indicator severity, confidence, threat type and malware family. By default, the feed fetches three indicator types: IP, Domain and URL. \n\n## Get Your API Key\n This feed requires that you have an ACTI API key. To get your API key refer to the **Obtain API token** section in the [Accenture CTI documentation](https://intelgraph.idefense.com/#/docs/view#page-section-2-0).\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/acti-indicator-feed)",
"feed": true,
"commands": [
{
"name": "acti-get-indicators",
"deprecated": false,
"arguments": [
{
"name": "limit",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The maximum number of results to return. The default value is 50.",
"defaultValue": "50",
"type": ""
}
],
"outputs": null,
"important": null,
"description": "Gets the feed indicators.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
}
]
}
]Search for integration instances by instance ID.
Note: This endpoint is supported in XSOAR 8.8 and later.
Query parameters
idstringOptional
Integration instance ID
Responses
200
OK
application/json
post/xsoar/public/v1/settings/integration/search?id=instanceID
POST /xsoar/public/v1/settings/integration/search?id=instanceID HTTP/1.1
Host: api-yourfqdn
Accept: */*
200
OK
{
"instances": [
{
"id": "e227fc24-5e1d-4165-87b8-949f71030b22",
"version": 74,
"cacheVersn": 0,
"sequenceNumber": 39320671,
"primaryTerm": 12,
"modified": "2024-02-05T14:05:11.127323408Z",
"sizeInBytes": 1314,
"sortValues": [
"92689"
],
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "",
"prevName": "",
"password": "",
"enabled": "true",
"name": "AutoFocusTagsFeed_default_instance",
"configvalues": {
"create_relationships": true,
"feed": true,
"feedBypassExclusionList": true,
"feedFetchInterval": "10",
"feedIncremental": true,
"feedReliability": "A - Completely reliable",
"url": "https://autofocus.paloaltonetworks.com/api/v1.0/"
},
"configtypes": {
"create_relationships": 8,
"feed": 8,
"feedBypassExclusionList": 8,
"feedFetchInterval": 19,
"feedIncremental": 8,
"feedReliability": 15,
"url": 0
},
"brand": "AutoFocusTagsFeed",
"category": "",
"path": "",
"executable": "",
"cmdline": "",
"engine": "",
"engineGroup": "",
"hidden": false,
"isIntegrationScript": true,
"islongRunning": false,
"mappingId": "",
"outgoingMapperId": "",
"incomingMapperId": "",
"remoteSync": false,
"isSystemIntegration": true,
"canSample": false,
"defaultIgnore": false,
"integrationLogLevel": "",
"commandsPermissions": null,
"longRunningId": "",
"incidentFetchInterval": 0,
"eventFetchInterval": 0,
"assetsFetchInterval": 0,
"servicesID": "main",
"isBuiltin": false,
"configuration": {
"id": "",
"version": 0,
"cacheVersn": 0,
"modified": "0001-01-01T00:00:00Z",
"sizeInBytes": 0,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "",
"prevName": "",
"display": "",
"brand": "",
"category": "",
"icon": "",
"description": "",
"configuration": null,
"integrationScript": null,
"hidden": false,
"canGetSamples": false
},
"data": [
{
"display": "Bypass exclusion list",
"displayPassword": "",
"name": "feedBypassExclusionList",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.",
"hasvalue": true,
"value": true
},
{
"display": "Feed Fetch Interval",
"displayPassword": "",
"name": "feedFetchInterval",
"defaultValue": "10",
"type": 19,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": "10"
},
{
"display": "Incremental Feed",
"displayPassword": "",
"name": "feedIncremental",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": true,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.",
"hasvalue": true,
"value": true
},
{
"display": "Source Reliability",
"displayPassword": "",
"name": "feedReliability",
"defaultValue": "A - Completely reliable",
"type": 15,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"A - Completely reliable",
"B - Usually reliable",
"C - Fairly reliable",
"D - Not usually reliable",
"E - Unreliable",
"F - Reliability cannot be judged"
],
"info": "Reliability of the source providing the intelligence data.",
"hasvalue": true,
"value": "A - Completely reliable"
},
{
"display": "AutoFocus Endpoint URL",
"displayPassword": "",
"name": "url",
"defaultValue": "https://autofocus.paloaltonetworks.com/api/v1.0/",
"type": 0,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": "https://autofocus.paloaltonetworks.com/api/v1.0/"
},
{
"display": "Create relationships",
"displayPassword": "",
"name": "create_relationships",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": true
},
{
"display": "Fetch indicators",
"displayPassword": "",
"name": "feed",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": true
}
],
"displayPassword": "",
"passwordProtected": false,
"mappable": false,
"remoteSyncableIn": false,
"remoteSyncableOut": false,
"isFetchSamples": false,
"debugMode": false
}
],
"configurations": [
{
"id": "Inventa",
"version": 67,
"cacheVersn": 0,
"sequenceNumber": 37466148,
"primaryTerm": 12,
"modified": "2024-01-16T21:29:08.065365818Z",
"sizeInBytes": 0,
"sortValues": [
"moduleconfiguration_Inventa"
],
"packID": "Inventa",
"packName": "Inventa",
"itemVersion": "1.1.11",
"fromServerVersion": "5.5.0",
"toServerVersion": "",
"propagationLabels": [],
"packPropagationLabels": [
"all"
],
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Inventa",
"prevName": "Inventa",
"display": "1Touch.io's Inventa Connector (Partner Contribution)",
"brand": "",
"category": "Data Enrichment & Threat Intelligence",
"icon": "",
"image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABbJSURBVHhe7ZwHvF1VlYfP6y8vFQgQogHEUCIBQgcdOooDGorEwaFJm4hDhuIISC/SlCIiRSxIB5GRohAQAZESIENxaCIlBZDQSXv93fm+fc++Ofe8e19eMmQo5v9+67f3XrutvdbuZ9+XLMVSLMVSLMVHFTXHPTYn9faBmpqk0NOTJIVuA8ngEUOTyccckjx53UXJoBU/XUzTTxQKhaS7uzupq6sLlIfxHR0dSW1tbVJfXx/SZlGDLMaZTn9XV1fS1tYW/PIss6mpKfgrpddtb28PfqmhoSGkW0RMIO/PcFFK0ga1UO6VuJOgxUKP+k2hXMK2xHbkYbtFY2Nj8Jvfdsa8YubMmUlt6v+HhkqJilRJUVF9UCNJh0LLQCul/mHQYqGaET8IVDPwoUkh+Ql0CnQSElyCe4jNL9DR6pvoXU0DGNVLTrAPAxpPZUsLMXJ7miWLjtStCss1f/RnaUmhkoHPwJg/wv136HjoRMITSXpwoVDbNOTTQ5Pnbrsreeamy5KBw1c0/ScOLgsLUfpizXxL0pDVkBf0HIx5dOrPoTCrrr6upmPuvOTl+yYn899+O4ziTyo+KGPEUf9hIWtgjXtE6q+EQvOQAYWZD01NHrvy3GTYyqsyRXevA38baFPoC9Dm0ECoDB9Gz/2o4MM0rogGPmshxg3QTrXsOhtbBhloRvirobtTuge6g7Vr3bhRieRuuJj/42noxZUbfaS+Dw8a+KcY98hisD8obQxstbtH0QJ53hhMo2ptWCSh+3E1rkjbm4Y+XqjlaPtO6u8XguEYlbTYg1j+EN2KIjqiQtyseEbTjcb+R8BHqTM4gr/HceebuAVNkJphHlQuJULXcfprHjY86Wxt08iZ5GUIvGjkTxKylxGVYCc2jfRR6dBxDb6c8+0ePcjUk3RfXih0n1xmO7w1WHfOa28n9//oKAxHA+pqHcHl10zBroV5NvCTZlyR6bQVrWfcwjrB/zeKBkZcxP51d9K9Je6BLKOvFblFeE3ZNLAp6ero6n7ujpuShpbmzWF9jai4Bkc00Eh31VtA/wKtJzOHZmhH6DzoVtLfD02B7iF8FeQx7XNQNWwCfR3aCdod2iosGxnKwPZtCU2ATL8btCu0LFQJQyDL9hryLmR6GHoQ/43QidBGhC2zlxVjvRjY+1fruwF6gPSPQLfiZ9BU1Ec1LA99puhdfNQc+yjLaI09sybpruvGQmHH+5+Y9YchBdDALcOH3N0xd852vxo/rr5z/pwH6ptaNiamUk92VKsAN10X07hvyxQ0fm921UegjHWgOuLSmF5oJe01pDkd/0veNbsTb2hoqCfPdfDtXNbjhu6/cTV6KMwyM+W6+budNHY4ZdI47hG+jHuv6YgLRH374x6HfEGpmTKyaIe/L7K8TvqQPwL/KfB+QBnX19XV7Ui4km68tz6TOI1dAvnK6qOMLSnjCrzDiTsNOhtep3Gm8/7cvY3+hd9Fp2H5dSFgRV5I5gCn0IUgPd09rNkotvI0BezB8QZfg+gOouKrFRp3HOG+jCsGIOwB0FTS7yGjs7PTBpkpfqHQVYYG0hRsWKQcYrpS+tTNKvVc6voFeT8jr5ps8Jtw1sR1j1JCWudYyriRNu5EfC8hUni0PAn3eI0SSfhhIaUGyI6yCuUNxD2FTep6blQjKV9a50KhoVLFUEmYfarAdHU1SS21cxBq7tM8KSh3LsKo0KsQ9l+L3EXCMlR3LXm/6hcgGtdDmUWNLEA+nEc+3pGAWCVDngodrmdhUE/IUsNocSSX9h+WQ9xu0A5pmVVhPGUcS1vWtU2SPI1r+RKYHcshPJv070G9Rmh/UGbRvkRzTHe2ddXMf/Pv3T3d3c+xi54Ou6wnA4t4GnoQQV5EEVMR6kBoZ6eQHFT8b6FDoAOgM6FnoRJspPmampouGzRo0KcoB1bfCuwv0nLGU+ZxgdEbd0PfhfaHDoWUtYd8rt9+bMhvMAOIt/3/RvtdBiZCLiF5NDHNj3d69dOmiNMs1EkZh0F3438W9yDSvmAHkJyeNTL8kG9h6GPILoDn3o55nUl3Z1fTsqPH9vR0tO0F2w2DRs6ijcptlBut9fC7QTm5gjCvEbcDrmvphdAvoe9BG5L2B7glmBcjLEfjDiKPqKjYRUSPykJxh1eQbT5k+5TvbOgy6MfQ10i7G3QffjeXvXSHbE/gfBFyk3YHdCnpnbIfwV+CdWKocRi3VgNrNNpYIvAMZDnrQ/9lemlx0C8Di+6OtmTIyBVqtjvukqSrs6OdrvY+7N5rNQqioR30Pkf3zvjdDWYxF96OkCMkL3Ur/KOgS9NwgI2D51rs91frXWykinKzM4oyP28gC3iHQ1fjzU/tZryZOHfUI6Hi/WsKyvVzoVP93wNjAWaRxw5cBtIvCzU4apUpa2CJPOq20mfJEsg3HGcVaKRlVEK/DUyN4UFHF4ZuaGqxcBtYKb9HpeDBraTAa6EnKwkEPxA4C3pTjzAtjV6TOBvyXspeLFAGRRTmo9h/wvXDfQnEPUE9l1nfQlApwbOsqw+l/hLS9rwE5TtMaTFN02Th6PWFyJXEnYA7IJsG2Q9CzpuZhe5B1vAtgNloMlF+TyjO+Sn6b+AIGu9FR19QGKgOWjVlRbiGTbbXxp4bkW0AUCFPFb1FmBZaWW+Rs9jopq5WFGTPL4PKQq5wHKmEnIxloLxZKLyAG9Jl2wZcVirNCNWggV0mpEmUOTjV10D818O7lDrcP4yFtxr+NfHvQP3n4HcJWQMKWHQD9x+W7Tk0C+QpuLMuKSDvZpQ4O3WzsHfmtdyXokQ+3rAK7/UxGyXO9jgWNzxRpghly8iXh8ewavrsK64S3AdEOMV3Kg+4BPp6Roa3ITd170SdEuedgGfo8IRoSRrYkfBW0VsEldchqOfIoKjopnFBqT64w/WbcqkXZmCD8gYr23RFo1gepFbyI9IKXV7KpnpHHnnHzJ07N5k9e3YwsrwIy5XnObQKqlp+MVCaImkDVXa7b9maEbpXbB/4E7xtccfiboesf5SZ6nRT6GDDS9LAwt1gHt9ACA/zwQgRCqby5s+f76XGLgicN/A80s/A9aqzBPI5fQ2wc6SXIcEwlsUZU20sV0xZBPGNlDOINM+nrBLgbd/c3Lza4MGDo8HTmCIsX0J2ivjg7Kns+boi4PcgSydrrNesMd2b8Dy+/SXlPYFMuyDTC4YFPK9kl5yBVRB0ZxoMUDgE2RxhT640ElQacWtybDiDtE5rJRC+n/iZlJnX7BooaFvLVlERjjZoM+pbN2UFUIYVN1L/n3FLnzvNS9xyLS0tP+PoUrapiYDnTVQT5I65skX6CctH5hpnrFhXKkPwZ+CeQf6qtlG94j5FR3sp116XPo+lAaR3v7LER/BkKn0s9Wfhmdez4lqQF/yurSMQagIKvpVGjLIxWcC7El439ErKCiBPPXHfx+vzoRI0LKPxbNKXHWfAHPJ4lPG26PYiawHgbYvivL/ejKBHPGUbAn8sne/axsbGSShzFuH/k4FBLeV02NGpazThURqsQsd3269cYUkhrc4IZqfSTBZFIW6tjFguZ0vOwKlQ7Sj/OwTLdpDGIcyBkFOM2/tboD+T9tfwVs8IGfF7+DeoAOg2wqXzYZp2HPFTMOpVuKfBuwJjTIX8+hPSZTAFJc4knZ3GS/93i+wiUtm2Is4jz72Qsk0m/CTl7YJfxVZdiPsL6vG6s47Zyo8xj1HnQ4zKPVyiaEd2GNfTZvcuYTZUB8gyho7mh5jSMQ/+CZS3ie0S+P06t8RHsFBJpS9KOXhP7UO9L0H24miwLB5GaK8y47tjd43fjw3JoAXF7An/GPx7Q6XzeARxb0JHky6OhGdwTbtgrgOZfH62VDZl9J5UnsY1fS9BFxGvsBRsiKEupFz3EZ+iA12MwZ0xsrtoRKwZSBovWMLRUTnI54XMXQR/jPt73OwXqvfgXaynmoHLNjIpBqOSbHr9+e+qHj3KLg9SOB1/A3ojhPoHR/0VNMYrw1kyNIxED3ZKDg3IwoZLlUCDX4R2hTRqyg1wdnBDkr+BqgY7pUYu2yMAry979boU6iSvFzeGTY7ICAw80Ptppu7ssjIU+by79uy+D/6ZMtN8fgb15zLeDBq2/W2QL3QcCAk7lop/b0CvQjOg6UV/Mq3ASSajPhvpRfrfoL9C7kr/QuHhS0ikCAS4DmczeOfgPgfNlZ+DZbrGqnQfBewLla4mbURsCPg2ZdlpnCHCelMBdpKXSOd3aUfhA4GbA3G3UO7muN45vwiVjegUjqqnSXc/rp37ZUhlex+vzNOgaqPa9VOFqyN1pc7epawncb0WFcp6PuTyo25eTcm0YaMFHoc06jWQdWbl9ObPjagPG24OHFBz4uPZ2aAEz6Heczot9tQmNU0dhZ62umVa3nx1ygOFWybukDQPXVZl2yvtbRomSICSQh79gl6X+opIe57fcN3EfBZyA+OH+3m4HuptRFgjCQeyDMOSiHzLSvnrEd6IqBWgwVAHvLfhaQRfVajMMlnMH6Hf+LQ8R6LnS5eM+HsjlacxfBpsGmc4N2A2RsOoh1aodE63rEwdts+pV4Z51JnHH0dbLWn3IH4O/lstH/4g4uPxzvt56yd6wcCB50Z0A/im7SLs9P10Jj6ZMWNGUnP6C9U63QK45Lfar9jvvvrQI8lN+2+TNA9bLhSSh4WLbFzWnxq4jBcFim6Mi2mjYYx3l+k0ZpwU08d6I7K8WG4sJyuDFMuJbl+IefqC8cqZlalSHuUxTaw3L6fIlhXTR36l8uXFcoKBN9zOEd035r01K1n/gKOSz+2+Q/LCHVOS2w/bLWkaskyp0DzylSugwrl+6hfZvKY13oZK0YhZYY1nbQoXDRx/0pxF5OsTWV4sI/KkqETPocrFGhfqzabLQrlEzBfdLMynjH7EV/7YplhmTBPLNl5/XwY2LsooiZgui3z55vPJTs0KQx3hfaOroz0ZOHwERh2UdHdggPbWoAwrjIXpz1YqP8JGG6/g0dhZIc0vbEgsVyOaJqaLeTVw/EhuvqiMbFnmifyYP8bHMmN8a2tr+B4rRQNn88T0kaKSo8yxY8Q4/R51BgwYEOLSm69QlnHWaziWJ9+yYl0i+uWbR1DWEPJ6MUPUAt1Znn7bYX3qRn2bN7zJGsBUW4FaoNHQ6tLA5VdKesg07423ko657xcfvleHkSOg/IeGXogNUiCVEhUF7HWuL/FtV0XYsGio2GDLiMrvD2K+CMMaJT6liTIK/GNw3NX7C47AizJny8mXKeSZ1nJjJzFfNG412D5oC9J4VnZ3LPwuXnaCsSzlzpcVznYVaHfobuhx6Emy3M+JfNc6ekdtPTonTSWked0c+DHfX8GHCuVXg3H2PHu8o1aX6c1voPeRd7/YQ/sq44OG9cVREAHvGOScgteLmYehf5a/qLDs/sK06obZpQ09/A8sN47yT8Hvs9yFotpQXB0aBU2ksPGQi54H7e2hCHuTO97ToH0gD9qegycihD39AvJ9RyGB9fi4zWvLgyAvPrzhCpGmSXuqNIIe7vMcD/d7OfWobPjWfRF8e684Fzqs6A2j3bN2jPsW5K7S3zcrm++9rMuLizMgnwqdRflekwqfGalALwzWlpHKHVzIt9enkd6z9xr4Eaf2FKi4VhSfL/0BmgpN0AgZjIcehX4HxZs1B4FHsq8aAI7GCyAvVYS/FTuEtOpoAvU8iv9hZgB38d6t+47Nnb6fBW2zv+c+EIrwQ8RFeqoZOH5i86GZD8C3hqZR0akonzpqfAjmWyUv5b8M73JcK3Bajl20izzDEKqGtMYfR9jnsL46uJCwh/N6KCR2tKQ0nnSN0EnErUzYn6Wq5CbqOZjRvSllrkL84ZQVb292Y3o6kLRtpJlEj9cQzoNebFyOO4G4RshfrB8Nz94/lo4zB9kOJ88JlPkc/GWg20k3Lk6nKYKQ8P243oY7hvq2wPVI+HnkuBO+SaZR1oXUH27ukHEfyv8tcX7B2gj/o6TdjiiPSd+C98U0nwb36ja+gPGp0wWUdSx+B40PJ44kr/HxSObivBI8nx+tT9nn4VdGB8ap5A8/Hqhm4Dg3hfdUZPB7pGvAOAoYSeOdIu4lvBa0ITSVNL599kB/Pq7ZHLHHG0/Fvkzw8d0Ywlvj90bLRL3mXdI6mm4m7cmkbWfaNuz69Qd4/lBuI/hr2xjCvv3yrDqG8CWELe8M4n3OYl0bwHIk207ri+06j7idUMqypDsX/wuQ76Z+TvpRGOi7LhfEx07nZcpEOpejZwZpr0Qe9xm+4JhE2PP3L8n7C6iLZeZ4yh2G319D+MsNR/hoeOdTRjt5fS+uTufZDlzl9nJDwxm2Xe9DX8J/Ba4G1tD+PxBnCR/0eWfgy49WyruCsgdBo+h42mMk5OxV1cDBQiTyQjwwgAdrb6qsaATunTbeeMibJ6c7nJq4ufL9sHHhQRj0JwRxI6BgvjIMP3tJ48wojYacbj8Lb39oRZS8JTyXCEeLX6f8EOA3ZW+AXBO9ZF8bo9xK2g7iBrIbn+KHe/iW6ZrpxY1tCucr+Nensg03DaSxnPb2xH8LinpCA8fdOmgm/aXI7qhwb7E1hnqQdF6qDCKPDwy9dfOZ7VTS/gZ3GOlWMwy5zGjAw+BpcOPsOG2eHIjztin7QcYZzOUv5E3hiHVW1K+Og9/lC/dawq8ij0Z1JnW5CZ8Oqxk4bPMQwh5j438KbUJBZ6NAp2qfhx5JeCRC2qv1v2eFIAqxNq5GfJz0NsAPBMMxsve+X4G8ggwdKYL4PVPvUPI4PflCcxXyfAXluvv0a9H2kC8bfkK8Nz++ZBzKWv0Isvgw3o/ek0jr99ANCLskxF9LxvYun8poZ3sHep3wIdTzQ/wD8N9rZ6S42PHWQZ7phI8gTuNNgbcSaXxKY2e1A/mLBWebOfCeJ523cV7l2qaVCTs1K5trtNePPtXYCQOtQHgv0qrn8EGF/N49D6QNUT/KHe75SatBFd4BtzppvRVUv78i7N5lb1w7fThfVTNw+IRGZu9dnyeTn8lc727Ab09Tae40XoHcfPnaQrI3e13nurcf4Z8j5Ex4/4F/HP43GBWnE9a4xQPeAiiovc+NmNeOG5PO90W+td7X3yehEKdKO9L78Hwk/xR+DfBHFBKeByHzoYxmqmnyjvhG4l02XKecnqPCvNpzOTDum+TxGexThJ0V6jQmFAxs+ZAj4hnKdbNGsOD662+slM39hBssN2ga9AuEXyK/98du9qz7Zdp+J/nqacNfcf191JnIvB4zxXTiDpJHujCKyefjRL99l+SF3BepI8Pq1ytMf9qzrjzqc9MmvL9WnoCalVcOH/7zkBn/34Yj0qeZ4UO7DRfw1oB2hvzu+C58d86uk+1WiGuvdHTcht/wJqTZBtcO0Yzrhqf0jgg47exEGu9Tw1Mf+YS3QimDod+hEBvvSLAn+7He1xU+VXkcel6DpHAztAdplMdPhN5VewHvo4It8fuZ7Z1MW3wj7W5b5fhUNXQ+p78IeMriLndj6vEI+ZC8lJzx9oOWg38tNMOyjSPtCriO4vfwX0Nc0E+K7Uk3Gp477DWhGfj/RrwnBg3uUREncT13vXW2CD82IOzS5R7oN/h9dLci/tchO5zLTTJt2rSqBi4DmYOwIqOUEoks37TRjX7JNDF9dEXWn09jGOMGSg1cihOxDilj4LJ6oz/LF3mZI6K/goGD33pinkgR8iXTyjdtjM/mi8i2V+Tjoz+bRmTTpX5H9d64fiTx2XEyffr0qlP0UnxMkBref6Xo0uBj+WDcpViKpViKpfiII0n+F/Qd1xJP/Ig/AAAAAElFTkSuQmCC",
"description": "Use the Inventa integration to generate DSAR reports within Inventa instance and retrieve DSAR data for the XSOAR.",
"detailedDescription": "### Partner Contributed Integration\n#### Integration Author: 1Touch.io\nSupport and maintenance for this integration are provided by the author. Please use the following contact details:\n- **URL**: [1Touch.io](1Touch.io)\n***\n## Inventa Integration Help\n\nIn order to connect to Inventa instance you need:\n* Inventa instance's IP\n* Inventa instance's API key\n\nBoth should be provided to Integration during setup in order to enable API calls to Inventa instance.\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/inventa)",
"configuration": [
{
"display": "Your Inventa server URL",
"displayPassword": "",
"name": "url",
"defaultValue": "https://",
"type": 0,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "API Key",
"displayPassword": "",
"name": "apikey",
"defaultValue": "",
"type": 4,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "The API Key to use for connection"
},
{
"display": "Trust any certificate (not secure)",
"displayPassword": "",
"name": "insecure",
"defaultValue": "",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Use system proxy settings",
"displayPassword": "",
"name": "proxy",
"defaultValue": "",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
}
],
"integrationScript": {
"script": "register_module_line('Inventa', 'start', __line__())\n### pack version: 1.1.11\n\n\n\n\n\"\"\"IMPORTS\"\"\"\n\n\nimport traceback\nfrom typing import Any, Dict\nimport urllib3\n\n# Disable insecure warnings\nurllib3.disable_warnings() # pylint: disable=no-member\n\n\n''' CONSTANTS '''\n\nDATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ' # ISO8601 format with UTC, default in XSOAR\nempty_file = {\n \"id\": \"\",\n \"timestamp\": \"\",\n \"name\": \"\",\n \"size\": \"\",\n \"path\": \"\",\n \"url\": \"\",\n \"entityTypes\": \"\"\n}\nempty_transaction: Dict = {\n}\nempty_dataasset: Dict = {\n \"id\": \"\",\n \"name\": \"\",\n \"piis\": \"\",\n \"reasonsOfProcessing\": \"\"\n}\nempty_database: Dict = {\n \"id\": \"\",\n \"name\": \"\",\n \"database\": \"\",\n \"entityTypes\": \"\"\n}\nempty_pii: Dict = {\n \"entities\": []\n}\n\n\n''' CLIENT CLASS '''\n\n\nclass Client(BaseClient):\n \"\"\"Client class to interact with the service API\n\n This Client implements API calls, and does not contain any XSOAR logic.\n Should only do requests and return data.\n It inherits from BaseClient defined in CommonServer Python.\n Most calls use _http_request() that handles proxy, SSL verification, etc.\n For this implementation, no special attributes defined\n \"\"\"\n\n def get_entities(self):\n pii_entities = self._http_request(\n method=\"GET\",\n url_suffix=\"/pii/api/configuration/categories\",\n return_empty_response=True\n )\n return pii_entities\n\n def get_datasubject(self, **kwargs):\n pii_entities = format_pii_entities(self.get_entities())[\"entities\"]\n\n # payload = generate_datasubject_payload(pii_entities, **kwargs)\n\n query = \"?\"\n for entity in pii_entities:\n if kwargs.get(entity.lower(), None):\n query = f\"{query}{entity}={kwargs[entity.lower()]}&\"\n query = query[0:len(query) - 1]\n\n found_piis = self._http_request(\n method=\"GET\",\n url_suffix=f\"/pii/api/piis{query}\",\n return_empty_response=True,\n retries=5)\n\n return found_piis\n\n def prepare_ticket(self, datasubject_id: Any, reason: str) -> Any:\n payload = {\n \"askToErasure\": None,\n \"changeConsent\": None,\n \"dataPortability\": None,\n \"disputeRequest\": None,\n \"dataSubjectId\": datasubject_id,\n \"id\": None,\n \"reason\": reason,\n \"updateDataSubjectDetails\": None\n }\n demisto.debug(f\"{payload}\")\n if datasubject_id:\n # create ticket id\n ticket_id = self._http_request(\n method=\"POST\",\n json_data={\"dataSubjectId\": datasubject_id},\n url_suffix=\"/dsr/api/dsar-management/tickets\",\n return_empty_response=True,\n retries=5\n )\n return ticket_id\n else:\n return None\n\n def create_ticket(self, datasubject_id: Any, reason: str) -> Dict[str, Any]:\n # new payload for ticket creation\n payload = {\n \"askToErasure\": None,\n \"changeConsent\": None,\n \"dataPortability\": None,\n \"disputeRequest\": None,\n \"dataSubjectId\": datasubject_id,\n \"id\": None,\n \"reason\": reason,\n \"updateDataSubjectDetails\": None\n }\n ticket_id = self.prepare_ticket(datasubject_id, reason)\n if ticket_id:\n demisto.debug(f\"{ticket_id}\")\n payload[\"id\"] = str(ticket_id)\n demisto.debug(f\"{payload}\")\n # create actual ticket\n ticket_id = self._http_request(\n method=\"POST\",\n json_data=payload,\n url_suffix=\"/dsr/api/dsar-management/tickets\",\n return_empty_response=True,\n retries=5\n )\n return ticket_id\n\n def get_ticket(self, ticket_id: Any) -> Dict:\n result = self._http_request(\n method=\"GET\",\n url_suffix=f\"/dsr/api/dsar-management/tickets/{ticket_id}\",\n return_empty_response=True,\n retries=5\n )\n return result\n\n def get_dsar(self, ticket_id: Any) -> Dict:\n ticket_details = self.get_ticket(ticket_id)\n demisto.debug(f\"{ticket_details}\")\n datasubject_id = ticket_details.get(\"piiId\", \"\")\n demisto.debug(f\"{datasubject_id}\")\n\n return self._http_request(\n method=\"GET\",\n url_suffix=f\"/dsr/api/dsar-management/personal-data-usage/ticket/{ticket_id}\",\n # url_suffix=f\"/pii/api/piis/{datasubject_id}/sources\",\n return_empty_response=True,\n retries=5\n )\n\n def get_sources(self, datasubject_id: Any) -> Dict:\n return self._http_request(\n method=\"GET\",\n url_suffix=f\"/pii/api/piis/{datasubject_id}/sources/details\",\n return_empty_response=True,\n retries=5\n )\n\n\n''' HELPER FUNCTIONS '''\n\n\ndef format_pii_entities(pii_entities):\n entities_listed = [[subitem for subitem in pii_entities[item]] for item in pii_entities]\n # return entities_listed\n result = list()\n for item in entities_listed:\n result.extend(item)\n result = {\"entities\": [item[\"entityName\"] for item in result]}\n return result\n\n\ndef generate_datasubject_payload(pii_entities, **kwargs):\n payload = []\n # fill initial payload\n for item in kwargs:\n if item.upper() in pii_entities:\n subpayload = {}\n subpayload[\"piiEntityType\"] = item.upper()\n subpayload[\"piiEntityValue\"] = kwargs[item]\n payload.append(subpayload)\n return payload\n\n\n''' COMMAND FUNCTIONS '''\n\n\ndef get_entities_command(client: Client) -> CommandResults:\n\n pii_entities = client.get_entities()\n\n result = format_pii_entities(pii_entities)\n return CommandResults(\n outputs_prefix=\"Inventa.Entities\",\n outputs_key_field=\"entity\",\n outputs=result\n )\n\n\ndef get_datasubjects_command(client: Client, **kwargs) -> CommandResults:\n results = client.get_datasubject(**kwargs)\n for result in results:\n result[\"personalInfo\"] = list(result[\"personalInfo\"].keys())\n result[\"personalInfo\"].sort()\n return CommandResults(outputs=result,\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"id\")\n\n\ndef get_datasubject_id_command(client: Client, **kwargs) -> CommandResults:\n found_piis = client.get_datasubject(**kwargs)\n # datasubs = found_piis.get(\"dataSubjects\", [])\n datasubs = found_piis\n if datasubs:\n datasubject_id = datasubs[0].get(\"id\", \"\")\n return CommandResults(outputs={\"datasubject_id\": datasubject_id},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n else:\n return CommandResults(outputs={\"datasubject_id\": 0},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n\n\ndef get_sources_command(client: Client, datasubject_id: str) -> CommandResults:\n if not datasubject_id:\n raise ValueError(\"No such datasubject_id found\")\n import json\n import copy\n result = []\n sources = client.get_sources(datasubject_id)\n sources = copy.deepcopy(sources)\n\n for source in sources:\n source_id = source[\"id\"]\n source_appliance_name = source[\"applianceName\"]\n source_ts = int(source[\"timestamp\"])\n source_key_type = source[\"key\"][\"keyType\"]\n source_path = source[\"key\"][\"path\"]\n source_url = source[\"key\"][\"repository\"][\"url\"]\n source_hostname = source[\"key\"][\"repository\"][\"hostName\"]\n source_db_name = source[\"key\"][\"repository\"][\"dbName\"]\n source_vendor = source[\"key\"][\"repository\"][\"vendor\"]\n source_type = source[\"key\"][\"repository\"][\"type\"]\n source_content = source[\"content\"]\n source_entity_types = source_content.pop(\"entityTypes\", None)\n source_content = json.dumps(source_content)\n\n result.append({\n \"id\": source_id,\n \"applianceName\": source_appliance_name,\n \"timestamp\": datetime.utcfromtimestamp(\n float(f\"{str(source_ts)[:10]}.{str(source_ts)[10:]}\")).strftime(\"%d %b %Y %H:%M:%S\"),\n \"keyType\": source_key_type,\n \"path\": source_path,\n \"url\": source_url,\n \"hostName\": source_hostname,\n \"dbName\": source_db_name,\n \"vendor\": source_vendor,\n \"type\": source_type,\n \"content\": source_content,\n \"entityTypes\": \", \".join(source_entity_types),\n })\n return CommandResults(outputs=result, outputs_prefix=\"Inventa.Sources.sources\", outputs_key_field=\"id\")\n\n\ndef get_sources_piis_command(client: Client, datasubject_id: str) -> CommandResults:\n sources = client.get_sources(datasubject_id)\n piis = []\n for item in sources:\n piis.extend(item[\"content\"][\"entityTypes\"])\n piis = list(set(piis))\n piis.sort()\n return CommandResults(outputs={\"piis\": piis}, outputs_prefix=\"Inventa.Sources\", outputs_key_field=\"piis\")\n\n\ndef create_ticket_command(client: Client, reason: str, datasubject_id: int) -> CommandResults:\n ticket_id = client.create_ticket(datasubject_id, reason)\n return CommandResults(outputs={\"ticket_id\": f\"{ticket_id}\"},\n outputs_prefix=\"Inventa.DataSubjects.Ticket\",\n outputs_key_field=\"ticket_id\")\n\n\ndef get_datasubjectid_from_ticket_command(client: Client, ticket_id: int) -> CommandResults:\n ticket_details = client.get_ticket(ticket_id)\n datasubject_id = ticket_details.get(\"piiId\", \"\")\n return CommandResults(outputs={\"datasubject_id\": datasubject_id},\n outputs_prefix=\"Inventa.DataSubjects\",\n outputs_key_field=\"datasubject_id\")\n\n\ndef get_datasubject_details_command(client: Client, ticket_id: int) -> CommandResults:\n ticket_details = client.get_ticket(ticket_id)\n datasubject_name = ticket_details.get(\"name\", \"\")\n datasubject_email = ticket_details.get(\"email\", \"\")\n return CommandResults(outputs={\"name\": datasubject_name, \"email\": datasubject_email},\n outputs_prefix=\"Inventa.DataSubject\",\n outputs_key_field=\"name\")\n\n\ndef get_dsar_piis_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n piis = dsar.get(\"piis\", [])\n pii_list = list()\n for pii in piis:\n pii_list.append(pii.get(\"piiEntityType\", \"\"))\n\n demisto.debug(f\"{piis}\")\n demisto.debug(f\"{pii_list}\")\n\n return CommandResults(outputs={\"piis\": list(set(pii_list))},\n outputs_prefix=\"Inventa.Dsar.Piis\")\n\n\ndef get_dsar_transactions_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n transactions = dsar.get(\"copiesUsageData\", {}).get(\"transactions\", [])\n if \"entityTypes\" in transactions:\n transactions[\"entityTypes\"] = [transactions[\"entityTypes\"][\"type\"]\n for item in transactions[\"entityTypes\"] if item == \"type\"]\n\n for transaction in transactions:\n demisto.debug(f\"file: {transaction}\")\n if \"entityTypes\" in transaction:\n entityTypes = transaction[\"entityTypes\"]\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n demisto.debug(f\"stripped: {stripped}\")\n transaction[\"entityTypes\"] = stripped\n if transactions:\n return CommandResults(outputs={\"transactions\": transactions},\n outputs_prefix=\"Inventa.Dsar.Transactions\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"transactions\": [empty_transaction]},\n outputs_prefix=\"Inventa.Dsar.Transactions\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_files_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n demisto.debug(f\"{dsar}\")\n files = dsar.get(\"copiesUsageData\", {}).get(\"files\", [])\n demisto.debug(f\"{files}\")\n for file in files:\n # file.pop(\"path\")\n # file.pop(\"url\")\n demisto.debug(f\"file: {file}\")\n if \"entityTypes\" in file:\n entityTypes = file[\"entityTypes\"]\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n file[\"entityTypes\"] = \", \".join(stripped)\n if \"timestamp\" in file:\n ts = file.get(\"timestamp\", 0)\n if type(ts) is int:\n file[\"timestamp\"] = datetime.utcfromtimestamp(\n float(f\"{str(ts)[:10]}.{str(ts)[10:]}\")).strftime(\"%d %b %Y %H:%M:%S\")\n # file[\"entityTypes\"] = stripped\n if files:\n return CommandResults(outputs={\"files\": files},\n outputs_prefix=\"Inventa.Dsar.Files\",\n outputs_key_field=\"id\")\n\n else:\n return CommandResults(outputs={\"files\": [empty_file]},\n outputs_prefix=\"Inventa.Dsar.Files\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_databases_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n databases = dsar.get(\"copiesUsageData\", {}).get(\"databases\", [])\n tables = []\n for db in databases:\n demisto.debug(f\"db: {db}\")\n database_name = db.get(\"name\", \"\")\n if \"tables\" in db:\n for table in db[\"tables\"]:\n table[\"database\"] = database_name\n\n if \"entityTypes\" in table:\n entityTypes = table[\"entityTypes\"]\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n table[\"entityTypes\"] = \", \".join(stripped)\n # table[\"entityTypes\"] = stripped\n\n tables.append(table)\n\n if databases:\n return CommandResults(outputs={\"databases\": tables},\n outputs_prefix=\"Inventa.Dsar.Databases\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"databases\": [empty_database]},\n outputs_prefix=\"Inventa.Dsar.Databases\",\n outputs_key_field=\"id\")\n\n\ndef get_dsar_dataassets_command(client: Client, ticket_id: int) -> CommandResults:\n dsar = client.get_dsar(ticket_id)\n dataAssets = dsar.get(\"copiesUsageData\", {}).get(\"dataAssets\", [])\n for da in dataAssets:\n demisto.debug(f\"file: {da}\")\n if \"piis\" in da:\n entityTypes = da[\"piis\"]\n if entityTypes:\n demisto.debug(f\"types: {entityTypes}\")\n stripped = [item[\"type\"] for item in entityTypes]\n stripped = list(set(stripped))\n demisto.debug(f\"types: {stripped}\")\n da[\"piis\"] = \", \".join(stripped)\n else:\n da[\"piis\"] = \"None\"\n\n if \"reasonsOfProcessing\" in da:\n reasons = da[\"reasonsOfProcessing\"]\n if reasons:\n da[\"reasonsOfProcessing\"] = ', '.join(reasons)\n else:\n da[\"reasonsOfProcessing\"] = \"None\"\n\n if dataAssets:\n demisto.debug(f\"{dataAssets}\")\n return CommandResults(outputs={\"dataAssets\": dataAssets},\n outputs_prefix=\"Inventa.Dsar.DataAssets\",\n outputs_key_field=\"id\")\n else:\n return CommandResults(outputs={\"dataAssets\": [empty_dataasset]},\n outputs_prefix=\"Inventa.Dsar.DataAssets\",\n outputs_key_field=\"id\")\n\n\ndef validate_incident_inputs_command(**kwargs):\n # ticket_id = kwargs.get(\"ticket_id\", \"\")\n datasubject_id = kwargs.get(\"datasubject_id\", \"\")\n national_id = kwargs.get(\"national_id\", \"\")\n passport_number = kwargs.get(\"passport_number\", \"\")\n driver_license = kwargs.get(\"driver_license\", \"\")\n tax_id = kwargs.get(\"tax_id\", \"\")\n cc_number = kwargs.get(\"cc_number\", \"\")\n given_name = kwargs.get(\"given_name\", \"\")\n surname = kwargs.get(\"surname\", \"\")\n full_name = kwargs.get(\"full_name\", \"\")\n vehicle_number = kwargs.get(\"vehicle_number\", \"\")\n phone_number = kwargs.get(\"phone_number\", \"\")\n birthday = kwargs.get(\"birthday\", \"\")\n city = kwargs.get(\"city\", \"\")\n street_address = kwargs.get(\"street_address\", \"\")\n\n demisto.debug(f\"{datasubject_id}\")\n\n constraints = [\n national_id,\n passport_number,\n driver_license,\n tax_id,\n cc_number,\n (given_name and vehicle_number),\n (given_name and phone_number),\n (given_name and surname and birthday),\n (given_name and surname and city and street_address),\n (full_name and birthday),\n (full_name and city and street_address)\n ]\n\n constraints_validated = False\n for constraint in constraints:\n if constraint:\n demisto.debug(f\"{constraint}\")\n constraints_validated = True\n break\n\n datasubject_id_validated = False\n if datasubject_id:\n datasubject_id_validated = True\n\n demisto.debug(\"CONSTRAINTS\")\n if constraints_validated:\n return CommandResults(outputs={\"validated\": True},\n outputs_prefix=\"Inventa.Incident\",\n outputs_key_field=\"validated\")\n elif datasubject_id_validated:\n return CommandResults(outputs={\"validated\": True},\n outputs_prefix=\"Inventa.Incident\",\n outputs_key_field=\"validated\")\n else:\n raise Exception(\"Validation failed: constraints missing. Check incident's inputs.\")\n\n\ndef test_module(client: Client) -> str:\n \"\"\"Tests API connectivity and authentication'\n\n Returning 'ok' indicates that the integration works like it is supposed to.\n Connection to the service is successful.\n Raises exceptions if something goes wrong.\n\n :type client: ``Client``\n :param Client: client to use\n\n :return: 'ok' if test passed, anything else will fail the test.\n :rtype: ``str``\n \"\"\"\n\n message: str = ''\n try:\n # TODO: ADD HERE some code to test connectivity and authentication to your service.\n # This should validate all the inputs given in the integration configuration panel,\n # either manually or by using an API that uses them.\n client.get_entities()\n message = 'ok'\n except DemistoException as e:\n if 'Forbidden' in str(e) or 'Authorization' in str(e): # TODO: make sure you capture authentication errors\n message = 'Authorization Error: make sure API Key is correctly set'\n else:\n raise e\n return message\n\n\n'''FETCH INCIDENTS'''\n\n\n''' MAIN FUNCTION '''\n\n\ndef main() -> None:\n \"\"\"main function, parses params and runs command functions\n\n :return:\n :rtype:\n \"\"\"\n\n try:\n # authentication\n api_key = demisto.params().get('apikey', \"\")\n\n # get the service API url\n base_url = demisto.params().get(\"url\", '')\n\n # if your Client class inherits from BaseClient, SSL verification is\n # handled out of the box by it, just pass ``verify_certificate`` to\n # the Client constructor\n verify_certificate = not demisto.params().get('insecure', False)\n\n # if your Client class inherits from BaseClient, system proxy is handled\n # out of the box by it, just pass ``proxy`` to the Client constructor\n proxy = demisto.params().get('proxy', False)\n\n demisto.debug(f'Command being called is {demisto.command()}')\n\n # TODO: Make sure you add the proper headers for authentication\n # (i.e. \"Authorization\": {api key})\n headers: Dict = {\n 'Authorization': f\"Bearer {api_key}\"\n }\n\n client = Client(\n base_url=base_url,\n verify=verify_certificate,\n headers=headers,\n proxy=proxy)\n\n if demisto.command() == 'test-module':\n # This is the call made when pressing the integration Test button.\n result = test_module(client)\n return_results(result)\n\n elif demisto.command() == 'inventa-get-datasubjects':\n return_results(get_datasubjects_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-get-datasubject-id':\n return_results(get_datasubject_id_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-create-ticket':\n return_results(create_ticket_command(client, **demisto.args()))\n\n elif demisto.command() == 'inventa-get-datasubject-details':\n return_results(get_datasubject_details_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-piis':\n return_results(get_dsar_piis_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-transactions':\n return_results(get_dsar_transactions_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-files':\n return_results(get_dsar_files_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-databases':\n return_results(get_dsar_databases_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-dsar-dataassets':\n return_results(get_dsar_dataassets_command(client, demisto.args().get(\"ticket_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-datasubject-id-from-ticket':\n return_results(get_datasubjectid_from_ticket_command(client, demisto.args().get(\"ticket_id\", 0)))\n\n elif demisto.command() == \"inventa-get-sources\":\n return_results(get_sources_command(client, demisto.args().get(\"datasubject_id\", \"\")))\n\n elif demisto.command() == \"inventa-get-sources-piis\":\n return_results(get_sources_piis_command(client, demisto.args().get(\"datasubject_id\", \"\")))\n\n elif demisto.command() == 'inventa-get-entities':\n return_results(get_entities_command(client))\n\n elif demisto.command() == 'inventa-validate-incident-inputs':\n return_results(validate_incident_inputs_command(**demisto.args()))\n\n # Log exceptions and return errors\n except Exception as e:\n demisto.error(traceback.format_exc()) # print the traceback\n return_error(f'Failed to execute {demisto.command()} command.\\nError:\\n{str(e)}')\n\n\n''' ENTRY POINT '''\n\n\nif __name__ in ('__main__', '__builtin__', 'builtins'):\n main()\n\nregister_module_line('Inventa', 'end', __line__())\n",
"type": "python",
"commands": [
{
"name": "inventa-get-sources-piis",
"deprecated": false,
"arguments": [
{
"name": "datasubject_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a datasubject.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.Sources.piis",
"description": "List of piis containing info about data subject.",
"type": "String"
}
],
"important": null,
"description": "Get PII details from daatasubjest.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-sources",
"deprecated": false,
"arguments": [
{
"name": "datasubject_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a datasubject.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.id",
"description": "Id of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.applianceName",
"description": "Appliance name of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.timestamp",
"description": "Timestamp of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.keyType",
"description": "KeyType of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.path",
"description": "Path of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.url",
"description": "URL of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.hostname",
"description": "Hostname of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.dbName",
"description": "DB name of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.vendor",
"description": "Vendor of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.type",
"description": "Type of a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.context",
"description": "Additional info on a source containing info about data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.Sources.sources.entityTypes",
"description": "Types of sensitive data stored in a source containing info about data subject.",
"type": "String"
}
],
"important": null,
"description": "Get sources details.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-datasubjects",
"deprecated": false,
"arguments": [
{
"name": "national_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "National ID of a PII.",
"type": ""
},
{
"name": "passport_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Passport Number of a PII.",
"type": ""
},
{
"name": "driver_license",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Driver's License of a PII.",
"type": ""
},
{
"name": "tax_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Tax ID of a PII.",
"type": ""
},
{
"name": "cc_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Credit Card Number of a PII.",
"type": ""
},
{
"name": "given_name",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Given Name of a PII.",
"type": ""
},
{
"name": "surname",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Surname of a PII.",
"type": ""
},
{
"name": "full_name",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Full Name of a PII.",
"type": ""
},
{
"name": "vehicle_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Vehicle Number of a PII.",
"type": ""
},
{
"name": "phone_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Phone Number of a PII.",
"type": ""
},
{
"name": "birthday",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Birthday of a PII.",
"type": ""
},
{
"name": "city",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "City of Resdence of a PII.",
"type": ""
},
{
"name": "street_address",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Street Address of a PII.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.dataSubjects.id",
"description": "ID of a Data Subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.dataSubjects.piis.id",
"description": "ID of an Entity Type for the PII.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityType",
"description": "Entity Type name for the PII.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityValue",
"description": "Value of an Entity Type for the PII.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.dataSubjects.piis.piiEntityValueNew",
"description": "New Value of an Entity Type for the PII.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.dataSubjects.piis.action",
"description": "Action of an Entity Type for the PII.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.total",
"description": "Total number of PII Entities found for the PII.",
"type": "String"
}
],
"important": null,
"description": "Get Data Subject full details.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-dsar-transactions",
"deprecated": false,
"arguments": [
{
"name": "ticket_id",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a DSAR ticket within Inventa.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DSAR.Transactions.transactions",
"description": "List of data transactions.",
"type": "String"
}
],
"important": null,
"description": "Retrieves data transactions' details containing info about data subject.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-dsar-files",
"deprecated": false,
"arguments": [
{
"name": "ticket_id",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a DSAR ticket within Inventa.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DSAR.Files.files",
"description": "List of files containing info about data subject.",
"type": "String"
}
],
"important": null,
"description": "Retrieves details of files contatining info about data subject.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-dsar-databases",
"deprecated": false,
"arguments": [
{
"name": "ticket_id",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a DSAR ticket within Inventa.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DSAR.DataBases.databases",
"description": "List of datatables containing info about data subject.",
"type": "String"
}
],
"important": null,
"description": "Retrieves list of databases and tables containing info about data subject.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-datasubject-details",
"deprecated": false,
"arguments": [
{
"name": "ticket_id",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a DSAR ticket within Inventa.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DataSubject.name",
"description": "Name of a data subject.",
"type": "String"
},
{
"contentPath": "",
"contextPath": "Inventa.DataSubject.email",
"description": "Email address of a data subject.",
"type": "String"
}
],
"important": null,
"description": "Get datasubject name and email.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-dsar-dataassets",
"deprecated": false,
"arguments": [
{
"name": "ticket_id",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a DSAR ticket within Inventa.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DSAR.DataAssets.dataAssets",
"description": "List of data assets containing info about data subject.",
"type": "String"
}
],
"important": null,
"description": "Retrieves list of data assets containing info about data subject.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-dsar-piis",
"deprecated": false,
"arguments": [
{
"name": "ticket_id",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a DSAR ticket within Inventa.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DSAR.piis",
"description": "List of PII categories related to data subject.",
"type": "String"
}
],
"important": null,
"description": "Get list of PII categories related to the data subject.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-entities",
"deprecated": false,
"arguments": [],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.Entities.entity",
"description": "List of PII entities described in Inventa.",
"type": "String"
}
],
"important": null,
"description": "Retrieves list of PII entities described in Inventa.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-datasubject-id-from-ticket",
"deprecated": false,
"arguments": [
{
"name": "ticket_id",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a DSAR ticket within Inventa.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.datasubject_id",
"description": "ID of a data subject within Inventa.",
"type": "String"
}
],
"important": null,
"description": "Retrieves ID of a data subject from Inventa's DSAR ticket.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-get-datasubject-id",
"deprecated": false,
"arguments": [
{
"name": "national_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "National ID of a PII.",
"type": ""
},
{
"name": "passport_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Passport Number of a PII.",
"type": ""
},
{
"name": "driver_license",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Driver's License of a PII.",
"type": ""
},
{
"name": "tax_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Tax ID of a PII.",
"type": ""
},
{
"name": "cc_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Credit Card Number of a PII.",
"type": ""
},
{
"name": "given_name",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Given Name of a PII.",
"type": ""
},
{
"name": "surname",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Surname of a PII.",
"type": ""
},
{
"name": "full_name",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Full Name of a PII.",
"type": ""
},
{
"name": "vehicle_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Vehicle Number of a PII.",
"type": ""
},
{
"name": "phone_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Phone Number of a PII.",
"type": ""
},
{
"name": "birthday",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Birthday of a PII.",
"type": ""
},
{
"name": "city",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "City of Resdence of a PII.",
"type": ""
},
{
"name": "street_address",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Street Address of a PII.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.datasubject_id",
"description": "ID of a data subject within Inventa.",
"type": "String"
}
],
"important": null,
"description": "Retrieves ID of a data subject from passed constraints.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-validate-incident-inputs",
"deprecated": false,
"arguments": [
{
"name": "national_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "National ID of a PII.",
"type": ""
},
{
"name": "passport_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Passport Number of a PII.",
"type": ""
},
{
"name": "driver_license",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Driver's License of a PII.",
"type": ""
},
{
"name": "tax_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Tax ID of a PII.",
"type": ""
},
{
"name": "cc_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Credit Card Number of a PII.",
"type": ""
},
{
"name": "given_name",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Given Name of a PII.",
"type": ""
},
{
"name": "surname",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Surname of a PII.",
"type": ""
},
{
"name": "full_name",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Full Name of a PII.",
"type": ""
},
{
"name": "vehicle_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Vehicle Number of a PII.",
"type": ""
},
{
"name": "phone_number",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Phone Number of a PII.",
"type": ""
},
{
"name": "birthday",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Birthday of a PII.",
"type": ""
},
{
"name": "city",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "City of Resdence of a PII.",
"type": ""
},
{
"name": "street_address",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Street Address of a PII.",
"type": ""
},
{
"name": "ticket_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Inventa's ticket ID.",
"type": ""
},
{
"name": "datasubject_id",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Inventa's Datasubject ID.",
"type": ""
},
{
"name": "reason",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Report reason.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.Incident.validated",
"description": "Whether incident inputs are validated.",
"type": "Boolean"
}
],
"important": null,
"description": "Validates incident's inputs.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
},
{
"name": "inventa-create-ticket",
"deprecated": false,
"arguments": [
{
"name": "reason",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "Reason for DSAR reporty.",
"type": ""
},
{
"name": "datasubject_id",
"required": true,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "ID of a data subject within Inventa.",
"type": ""
}
],
"outputs": [
{
"contentPath": "",
"contextPath": "Inventa.DataSubjects.Ticket.ticket_id",
"description": "ID of a DSAR ticket, created within Inventa.",
"type": "String"
}
],
"important": null,
"description": "Creates Inventa ticket.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
}
],
"dockerImage": "demisto/python3:3.10.13.84405",
"isFetch": false,
"isFetchEvents": false,
"isFetchAssets": false,
"feed": false,
"isFetchCredentials": false,
"runOnce": false,
"longRunning": false,
"longRunningPortMapping": false,
"subtype": "python3",
"isMappable": false,
"isRemoteSyncIn": false,
"isRemoteSyncOut": false,
"isFetchSamples": false,
"resetContext": false
},
"system": true,
"hidden": false,
"canGetSamples": true
}
],
"engines": {
"engines": [
{
"id": "b9a6e9ec-dbf9-4238-a79d-2af71083c781",
"version": 1585,
"cacheVersn": 0,
"sequenceNumber": 41993325,
"primaryTerm": 12,
"modified": "2024-02-25T09:21:51.901644445Z",
"sizeInBytes": 1729,
"sortValues": [
"110759"
],
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"definitionId": "",
"prevName": "",
"name": "lemon_373065a9b3cbb94f10933e40c56ef345",
"allowOnTenant": false,
"locked": false,
"lastSeen": "2024-02-25T09:21:51.893916129Z",
"firstSeen": "0001-01-01T00:00:00Z",
"lastConnectedApp": "",
"lastDisconnect": "2024-02-25T09:21:51.484460675Z",
"serviceName": "d1_lemon_373065a9b3cbb94f10933e40c56ef345",
"host": "hostname-ngdev-syhansef",
"user": "user@company.com",
"pkgType": "shell",
"pkgName": "/var/lib/demisto/downloads/d1-lemon_373065a9b3cbb94f10933e40c56ef345-8.6-847672.sh",
"config": "{\"engine.handshake.max.retries.slow\": \"7200\", \"engine.connection.retry.timeoout\": \"7200\"}",
"baseUrl": "10.180.194.141:8443,172.17.0.1:8443",
"engineGroup": "",
"protocolVersion": "2.5.1",
"os": "linux",
"demistoVersion": "8.5.0",
"buildVersion": "28536e48e3d9264bccec3e9cd8fc980c0edf4434",
"md5": "9493667ed12b1278abaf3b947fd5e27b",
"underUpgrade": false,
"tenantNames": null,
"workers": 16,
"isDefault": false,
"isLegacy": false,
"packageFileHash": "53719508543c1fd5844fd877c7171c97a0198ca60f69c2a06ade2c553e2f0064",
"pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}iqDnqBcLScr8prMRpaozWqGkP2LF/q7ehux9h23+9EjWFOPQ6bMKc6tciKgNA/FDlpvYguAUaIqDUqWvG69pSFZ4xiQ8FCTFeJkR89Xcmxm8WcFUU1+WPFOisWG1QzABg03IZkgXDxr6sJEol4t2mu9Z4hh122MdXFK+UhNI5VENpJZsuYunwcMocTHyetTeFJf8UnA9i6Fa+jZGr5jCLzNc56J8q/5WIFvETKtPfNeAEhUru+lDdhiLlMiP5gGClKOMR7xC0lw5jY0XphWy6aMcQ3VaPYiPXZjhdturGo4=",
"pyramidAPIEncryptedAuthenticationHeaderTenants": null,
"connected": true,
"modules": null
}
],
"total": 1,
"pkgTypes": [
"shell"
],
"requestedLogs": {},
"engineGroups": []
},
"health": {
"AutoFocusTagsFeed_default_instance": {
"id": "AutoFocusTagsFeed.AutoFocusTagsFeed_default_instance",
"version": 45631,
"cacheVersn": 0,
"sequenceNumber": 42030715,
"primaryTerm": 12,
"modified": "2024-02-25T15:46:27.125445318Z",
"sizeInBytes": 932,
"sortValues": [
"112961"
],
"brand": "AutoFocusTagsFeed",
"instance": "AutoFocusTagsFeed_default_instance",
"incidentsPulled": 0,
"indicatorsPulled": 0,
"eventsPulled": 0,
"assetsPulled": 0,
"type": 0,
"incidentsDropped": 0,
"lastPullTime": "2024-02-25T15:46:25.140760055Z",
"lastError": "Script failed to run: \nError: [Traceback (most recent call last):\n \n File \"<string>\", line 614, in <module>\n File \"<string>\", line 610, in main\n File \"<string>\", line 7617, in return_error\n Exception: Failed to execute fetch-indicators command.\nError:\nError in API call [401] - Unauthorized\n{\"message\": \"API key not found\"}\n] (2604) (2603)",
"lastIngestionDuration": 0,
"fetchDuration": 0,
"creation_time": "2023-02-07T08:48:08.429755153Z",
"sum_hour": 0,
"sum_day": 0,
"sum_week": 0
}
}
}Delete an integration instance identified by its ID.
Path parameters
instance_idstringRequiredExample:
Instance ID
5cd9f014-e3e8-41a8-accb-e6d37482ded5Header parameters
authorizationstringRequiredExample:
api_key
DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmrx-xdr-auth-idstringRequiredExample:
api_key_id
2841Responses
200
OK
application/json
objectOptional
delete/xsoar/public/v1/settings/integration/{instance_id}
DELETE /xsoar/public/v1/settings/integration/{instance_id} HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Accept: */*
200
OK
{}Get details on all of the integrations, integration instances, engines, and health.
The response is likely to be very large.
Header parameters
authorizationstringRequiredExample:
api_key
DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmrx-xdr-auth-idstringRequiredExample:
api_key_id
2841Body
objectOptional
Responses
200
OK
application/json
post/xsoar/public/v1/settings/integration/search
POST /xsoar/public/v1/settings/integration/search HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 2
{}200
OK
{
"configurations": [
{
"id": "abuse.ch SSL Blacklist Feed",
"version": 11,
"cacheVersn": 0,
"sequenceNumber": 41346907,
"primaryTerm": 12,
"modified": "2024-02-20T19:52:27.504394267Z",
"sizeInBytes": 36219,
"sortValues": [
"moduleconfiguration_abuse.ch SSL Blacklist Feed"
],
"packID": "Feedsslabusech",
"packName": "Abuse.ch SSL Blacklist Feed",
"itemVersion": "1.1.26",
"fromServerVersion": "5.5.0",
"toServerVersion": "",
"propagationLabels": [],
"packPropagationLabels": [
"all"
],
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "abuse.ch SSL Blacklist Feed",
"prevName": "abuse.ch SSL Blacklist Feed",
"display": "abuse.ch SSL Blacklist Feed",
"brand": "",
"category": "Data Enrichment & Threat Intelligence",
"icon": "",
"image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAA5fSURBVHgB7VsLWBzV9T9nZnYX2BkWEv6SKCAmhAWSJlH8V/NSqqk2KU8t1vroF9t+bW3t10f8avu1VfqwfmlrG236tb76iFpbMSbBRDTVim1tJCkhYiQQFhKJIYmBBNhlnzP39txdIAvskqVNLLbz47vM3Dv3nLkz53HvOXcWwIQJEyZMmDBhwsRZB8ZurpG0gqbVnEt3UIdFHHgGAsocQKf6EHDoIcpGxuD3Qx1bXxpPrRVUzkQOtzBkn6RjHnBUATmdYoD+DdJ5B916p86N9b4D246M0NkXlGdiEOsRuFXUdcO/yte54zCY+JehxGq0O99YC0y6DxFkUcdhPaD/Fjqk0UkaHYskic+g4xgBp8+pdoRY6GkS4lUkUxghHOaSRP+S6Pw8alimgNxOx0dHaLmhSIhGEV23hQcnW+1g4t/CBAGT9S0Bxr4Pw8IltAtrJas9zsOWhVkkqHyyZmcs89etobuQ86vCFc7JaHE3StjEGXMTrYP4ZBHtQrLSrLgOxMRZQwwL5mvpvdsip9DKmbXE46o9MbZPtZxSaCyycJYR3erIuSndYJ5PIQ4LTuLr3W11Xxt/h7TcyjSWzJeRDh0FE+cUEwXMofh0RVo/UbgCtYZ3P+wZ38qSPUXkiDNH6rZevMc9kRj6D23pp8N2OEdIcpZdJEvS3KHMgQZoaNDj9VMXVp3H/OzSFOR/7W2vc8NZQoazXPNyXOFwGw1Hj27zxutnLyi9RtGVzgHXlk44R5BitKmnT41UmAIYl5Ki6+6ZcD78B6AAXisx+GPG0dTkyfoZfp4rI2z3oZ4LZxF+A7MFX49DXjxZP/JgGw2Z3zhStxdUfEDLqygTi1w4S4jF6NjpEeD3U51VH4G8VTZIACiHjoPwAcOwAD6i5lUUQXW1DCbOCBLGbVyGX0DR00pCBCUlSvLciuzMzGvsk/AcB+QPRtWSObB6Vba6NGfFI/b8ylu1gtX58TTMkznURtL98ygrgBUowZtqS6BJc5avE9ppv6g8E0zEBEUQvwSD3QqtN+iJ9E912VIVBbq8abaV8fpMEJTbY3uCVr/bxtwYgFa88BkJ+UbglnbVuXePWlB2/QRB03wnhZTbae38ThSxRPPyIjr5Oq3L6yQr9pCyPKPNqcyH9wpFRVaYKgQNWcgZ+wnvVFxsgbOAwf3bOjyu516l98rGXqF4M+JFY4UdCnAprkufeOGdWp/7QF2ZAewzxPg1crjB8V0oxFmEXHpGLWi+Z8IguzZ1IBgXE90PqbSIWCnGPa8HhbeqzvIPwTmEj+FlWkHFq6ox7xAdX9cKK6rOREPz4E1aPtHo+Z3aUYfwXBvt81ZPmEvtudWzaPw/01oC+1VP1kHVWfGCOq+qMC5jEhD1eUB1Vv4KFsZ2qWph+Y1aftVPo5owxVn+KQpdd5EXFfdoUfMr7hZKReP6MbMnPTzcby21PyUKjFOCuJL3tj/3mLu9brlbM9JJSMtJS74ZEXiUwDjcGUtI7gPbet0Htn6LyiKuy7NIIVZR5PQLIug6PXSgdQg+kptbkgTnBg5ZoiQKg3rKnn2RxnqAzp8l4X1jMiIJ+IVkL3+l8a2luH8dTVmXS5LlpZS88otH+qQVVOZKtuB+ck3XcY5P0H3W0vM1o6zPjcVTyy/NSJVtdZT4KaV+P4WWHUOx+qEBC2npVzFSV51lYvHyEOUVdhPd5+g5HqBeF0BXl5Bbr8S5L0IIbpT4oChk/WMEfGYX1LTNS/HDaxAp60iLrieBPUZcU4lTCr2MK6n9lXjkns7N79LhBVHySIuPoW0dDeTLw5fn9lnVXDq2wdmHJ6TDCl/n1pFU52bNWamRkt2lzq369fC4JoDi9vui60kXrX7eYrE0SjLSlATNos1gcD8dgjRRLvEe2Noz3PWPsfiJkCkAWM+AZcnIlw60PXcQEgTNbh+hQ+Ng+9YvRDWHM39uaFqXmnXtDLAn3ULK+zAZ4+bI5boxPKa6HOee9q3PEMO9oy0MZiZK7HLVB5jiWzemEaWE6acIw67w/ugGnev3iTQrl/kHJqHDlMLrZouMnqOw9BJrst1N6bhj5Lkc4qJI0tBDV9Gbe9LbXtczCR/gTMoJcNxJTs8Chm3hQHviwo0wwFMiY+gorFg5I2/VlELWEUw93hILCsQZI1WyRs8UqAGZ7f+i64xJQ/BewYhkzhDZjHhdSLD3Ssxwcc7+YjB5JzOCPYh8/igLqz4LRKqO831wBtB9RFZwPhr4hdgJo8kRQssG8pLtjPEdIcV2UMsv36LNKV0+FR4xctHla0N+aZP/0Ja3ISqmFcjIIHfjke8msSwYbqIoyrJr5Lq9qHIxhnAOevmr7iNb+sbztjnLnRKHn48sA4h5rzqodcSTMJdRnjSGrq1l48c4GWQrS6VNFMqgxlZKtaDqSjI7MUd/x6PO+hE0nWIz5gbPDynw/CgPSfEbtAyhqSnlTPcjNfg2Z/BdrkCtbW75lYHOOhdMAf722oN+gOW00DrfYsASQ5Jq0IJ16UWli0+1butOhEeMVCX+xGLl6yz55QdJUbsYiskcxF+mH/kCBDZr9AE4vJw8YN8xkuNDnTvJov9AubBBmu/IHXFRPLTittJmIYVafBE9ddQKEh88fvzxuBaMTGpQ3wj64153ltW4aTEIiYLhFeJ/MGRpjX0/fRmNz2vouBGaHg6JtpOdcJhWp6NxaX/b4m7N2fwuMhCLyw2T3Y40z+1mwSs1xbrPKuMLKXNWFp/qemkApojhqWCTWljWRgq6j8YnPEqUgOPbQGwXLXaSEPNogNeQEG+i482ksStp1XtauLT8khXj03EElBoWJkAl9byFhHsDnS+l84hwedgEfuv5xOJ7YXJkkBVkxS1cmmxeSiPN+HokfqyR7M5y2sFCCt3wcf/BZ9+ORcARxT61nSx9SfjmtECiKOF2ctGLTveqYdTvB/R+qkTIMnt2qbBkdOR8ND2l8NrZE5jSuiNJCq0Q/lq3pGxPyy1JgwSRVnjdhcP8AUS0YaBQKp3brOG5fDApPL3RcIyVYU8XI+M4QcAipCGaejrtHX+NxCK0mkIIvkYODV093k1Q/PsylS+LzXxSiolJdg5i0bOJM/4h94Ett0HN+IBeeAWyeg6diRRSun6IBw5d5HmKyXoosbKng0KU12mA7TyJEi5x4Jk9uJmU8VWykscpzjxEq1/hUj9Gwtk1pp8eeJhL+CAp+T2eVJksuuIgS1Y6ZG77Uiy+J1qfPybZjGvp6eYb1tT1CSVQCDpjP/JoMs29FR2qzUEhJq6nsOwH7jc3RaIOUh6qb6B3fbv2RuCIKtlcyXnXZUXzmHRDVmgl2GzpXAnKBjL3UOv242HHnBBqpJTClkwFgioy1MHK+gfe3H4K3gOEPzpwgNXTXNubnFd2mSzLOTQXHhjq2LJ3TEeyCi0pLcd942LXqLLRy1ePpC4loc6ml9c+dPPilhlPtJwfTOFBT8vY0MpBu1YMpQW0KEuhqb3bPcuzO7x7lXmrXUt3XzDT39996FDD6BQj0rSSTXKMtDvyKufKEDhx0lU/KK6LeFlnRpLPVR/JBBaXpqhD+P+kcLPIAfiZBV8f2ld3fOzT1kjJeXsvky08R9JlT5ZF/lNra20QTJgwYcKECRMmTJgwYcKEiX8DRUXV8H7EWft6778d3aFg0fi2kpKaGB+sTC+YAk4QKMFl49t29bx1AeavTuiL0/8UEvs8c5oia0k1+PoAe9uf5uFfU9TUQMZTe8LpV85twNOt/GTjk5C2uBJQtsCpptrRPnd84hLe0ADwZs9byJMMkHUZSuYD333CDoMnB1EKRDaQ0owQd7nqR+9ZXV0NL74FGOh8hZK2/itssm2n4cjpDg10M5iGmLYWPLu49Ix93H2+q4MYbLlozprId11P7dECAM1+wKYABpv1/qGvCBdqeNk3dU8gssnw6FvJfo5ND2z8m6PxcHM20e8NBfQ2nxF8eUebN32g59QKqrsED1GOSPIHo+/5/P5AJmfB+63Zl18u6laDlydnXvIATFNMSwHXkJV5hqAst2RNZJ6DifOdqFOi/046Vfpsg5Hvgo2Q+InqeZLs/zAl6G+iXck74dJLxSetGh/ZhzZ84meO53GmoiLDzbR71sJTbAX2gdQysRnCmJFMG3D7M1lwaSYLLfV11+6OHhsPYTa5iBdnZmXsFPWgjHW0Zz5tv/WelgLe8FSzBkye39czsLyxtzm7uPiz0Nj9jxyYd3q+e+PtXRfSzJhLAvoq5+wO0WcEnCX/BCS2gdz230u0slA079EfxolzxhoY4BXgCzzpc7irhEKF6RGK30XLg1TuhctXjdlN97ZfvIcZkNt3dHCZzOGgrDAfbXHugGmKaTkHezkrsKKyn7Yol1t0zN4XeHe3xYqroK3+5+EOZMl6UcXHwYBnBz38L6qGD+0bOCw+WQ1/94QQvI/2ZpMNYDsa32nJkiUpyIHbhNv39clWHbmieLiRNC/pdfZ2WqE39cQHDeC/6js20Ck0ngS2V+eh7wleJVCiN0BD1OhqmKcDHho35EdhmmJaWjD50KIg8neQM78ctLxmkeCHIUMe/S4KF9xgJf+8Jsj8v4Ge57zUstEqWz8/fJk8s7JcB76CGB236Sc9sgR/p83/j3mG5DJm5V+VGO/q7d3qdveFrnZrxz9sIE8nOoOHwB3eIpcgW0bLclEau5ty4H2MaSlgewhekBlko5X9zmcbIoPiOwMdp39imer22mmyfSTgejH8EZuC/sdIPPvBqtL6id9PG/VZKDGbjFjef6ihf8B++BVkeDfxuYoh10PAwlkL2qQXyrGMaJeRv77L07l5H6DeyRk+Te35okhKWPgmzgW0gqtnOpyVN+TmrjlXv35IfCzOitvAxH8v3q8CNjNZCcJiBDeBCRMmTJgwYcKECRMm/gfwT1ET1leeYmK5AAAAAElFTkSuQmCC",
"description": "The SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has seen in the past 30 days and identified as being associated with a malicious SSL certificate.",
"detailedDescription": "sslipblacklist.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past 30 days being associated with a malicious SSL certificate.\n\nsslipblacklist_aggressive.csv: \nThe SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has\nseen in the past being associated with a malicious SSL certificate. Warning - High FP Rate!\n\nsslblacklist.csv:\nThe SSL IP Blacklist contains SHA1 Fingerprint of all SSL certificates blacklisted on SSLBL. \nThe SSL Certificate Blacklist (CSV) gets generated every 5 minutes. Please do not fetch it more often than every 5 minutes.\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/abusech-ssl-blacklist-feed)",
"configuration": [
{
"display": "Services",
"displayPassword": "",
"name": "url",
"defaultValue": "",
"type": 16,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"https://sslbl.abuse.ch/blacklist/sslipblacklist.csv",
"https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv",
"https://sslbl.abuse.ch/blacklist/sslblacklist.csv"
],
"info": ""
},
{
"display": "Fetch indicators",
"displayPassword": "",
"name": "feed",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Indicator Reputation",
"displayPassword": "",
"name": "feedReputation",
"defaultValue": "Bad",
"type": 18,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"None",
"Good",
"Suspicious",
"Bad"
],
"info": "Indicators from this integration instance will be marked with this reputation."
},
{
"display": "Source Reliability",
"displayPassword": "",
"name": "feedReliability",
"defaultValue": "B - Usually reliable",
"type": 15,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"A - Completely reliable",
"B - Usually reliable",
"C - Fairly reliable",
"D - Not usually reliable",
"E - Unreliable",
"F - Reliability cannot be judged"
],
"info": "Reliability of the source providing the intelligence data"
},
{
"display": "Traffic Light Protocol Color",
"displayPassword": "",
"name": "tlp_color",
"defaultValue": "",
"type": 15,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"RED",
"AMBER",
"GREEN",
"WHITE"
],
"info": "The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed"
},
{
"display": "",
"displayPassword": "",
"name": "feedExpirationPolicy",
"defaultValue": "indicatorType",
"type": 17,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"never",
"interval",
"indicatorType",
"suddenDeath"
],
"info": ""
},
{
"display": "",
"displayPassword": "",
"name": "feedExpirationInterval",
"defaultValue": "20160",
"type": 1,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Feed Fetch Interval",
"displayPassword": "",
"name": "feedFetchInterval",
"defaultValue": "60",
"type": 19,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Bypass exclusion list",
"displayPassword": "",
"name": "feedBypassExclusionList",
"defaultValue": "",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system."
},
{
"display": "Request Timeout",
"displayPassword": "",
"name": "polling_timeout",
"defaultValue": "20",
"type": 0,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "Time in seconds before http requests timeout."
},
{
"display": "Trust any certificate (not secure)",
"displayPassword": "",
"name": "insecure",
"defaultValue": "",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Use system proxy settings",
"displayPassword": "",
"name": "proxy",
"defaultValue": "",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": ""
},
{
"display": "Tags",
"displayPassword": "",
"name": "feedTags",
"defaultValue": "",
"type": 0,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "Supports CSV values."
}
],
"integrationScript": {
"script": "register_module_line('abuse.ch SSL Blacklist Feed', 'start', __line__())\n### pack version: 1.1.26\n\n\n\ndef main():\n feed_url_to_config = {\n 'https://sslbl.abuse.ch/blacklist/sslipblacklist.csv': {\n 'fieldnames': ['firstseenbysource', 'value', 'port'],\n 'indicator_type': FeedIndicatorType.IP,\n 'mapping': {\n 'firstseenbysource': 'firstseenbysource',\n 'port': 'port'\n }\n },\n 'https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv': {\n 'fieldnames': ['firstseenbysource', 'value', 'port'],\n 'indicator_type': FeedIndicatorType.IP,\n 'mapping': {\n 'firstseenbysource': 'firstseenbysource',\n 'port': 'port'\n }\n },\n 'https://sslbl.abuse.ch/blacklist/sslblacklist.csv': {\n 'fieldnames': ['Listingdate', 'value', 'Listingreason'],\n 'indicator_type': 'Certificate',\n 'mapping': {\n 'firstseenbysource': 'Listingdate',\n 'relationship_entity_b': 'Listingreason',\n 'Tags': 'Listingreason',\n },\n 'relationship_entity_b_type': FeedIndicatorType.Malware,\n 'relationship_name': EntityRelationship.Relationships.INDICATOR_OF,\n 'auto_detect_type': False,\n\n }\n }\n\n params = {k: v for k, v in demisto.params().items() if v is not None}\n params['feed_url_to_config'] = feed_url_to_config\n params['ignore_regex'] = r'^#'\n params['delimiter'] = ','\n params['create_relationships'] = True\n\n # Main execution of the CSV API Module.\n # This function allows to add to or override this execution.\n feed_main('SSL Blacklist Feed', params, 'sslbl')\n\n\n\n### GENERATED CODE ###: from CSVFeedApiModule import * # noqa: E402\n# This code was inserted in place of an API module.\nregister_module_line('CSVFeedApiModule', 'start', __line__(), wrapper=-3)\n\n\n\n\n''' IMPORTS '''\nimport csv\nimport gzip\nimport urllib3\nfrom typing import Optional, Pattern, Dict, Any, Tuple, Union, List\n\n# disable insecure warnings\nurllib3.disable_warnings()\n\n# Globals\nDATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ'\nTHRESHOLD_IN_SECONDS = 43200 # 12 hours in seconds\n\n\nclass Client(BaseClient):\n def __init__(self, url: str, feed_url_to_config: Optional[Dict[str, dict]] = None, fieldnames: str = '',\n insecure: bool = False, credentials: dict = None, ignore_regex: str = None, encoding: str = 'latin-1',\n delimiter: str = ',', doublequote: bool = True, escapechar: str = '',\n quotechar: str = '\"', skipinitialspace: bool = False, polling_timeout: int = 20, proxy: bool = False,\n feedTags: Optional[str] = None, tlp_color: Optional[str] = None, value_field: str = 'value', **kwargs):\n \"\"\"\n :param url: URL of the feed.\n :param feed_url_to_config: for each URL, a configuration of the feed that contains\n If *null* the values in the first row of the file are used as names. Default: *null*\n Example:\n feed_url_to_config = {\n 'https://ipstack.com':\n {\n 'fieldnames': ['value'],\n 'indicator_type': 'IP',\n 'mapping': {\n 'Date': 'date' / 'Date': ('date', r'(regex_string)', 'The date is {}')\n }\n }\n }\n For the mapping you can use either:\n 1. 'indicator_field': 'value_from_feed'\n 2. 'indicator_field': ('value_from_feed', regex_string_extractor, string_formatter)\n * regex_string_extractor will extract the first match from the value_from_feed,\n Use None to get the full value of the field.\n * string_formatter will format the data in your preferred way, Use None to get the extracted field.\n 3. 'indicator_field': ('value_from_feed', 'field_mapper_function')\n * field_mapper_function will accept as an argument 'value_from_feed' and return the data\n in your preferred way.\n :param fieldnames: list of field names in the file. If *null* the values in the first row of the file are\n used as names. Default: *null*\n :param insecure: boolean, if *false* feed HTTPS server certificate is verified. Default: *false*\n :param credentials: username and password used for basic authentication.\n Can be also used as API key header and value by specifying _header in the username field.\n :param ignore_regex: python regular expression for lines that should be ignored. Default: *null*\n :param encoding: Encoding of the feed, latin-1 by default.\n :param delimiter: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default: ,\n :param doublequote: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default: true\n :param escapechar: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default null\n :param quotechar: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default \"\n :param skipinitialspace: see `csv Python module\n <https://docs.python.org/2/library/csv.html#dialects-and-formatting-parameters>`. Default False\n :param polling_timeout: timeout of the polling request in seconds. Default: 20\n :param proxy: Sets whether use proxy when sending requests\n :param tlp_color: Traffic Light Protocol color.\n \"\"\"\n self.tags: List[str] = argToList(feedTags)\n self.tlp_color = tlp_color\n self.value_field = value_field\n if not credentials:\n credentials = {}\n\n auth: Optional[tuple] = None\n self.headers = {}\n\n username = credentials.get('identifier', '')\n if username.startswith('_header:'):\n header_name = username.split(':')[1]\n header_value = credentials.get('password', '')\n self.headers[header_name] = header_value\n else:\n password = credentials.get('password', '')\n auth = None\n if username and password:\n auth = (username, password)\n\n super().__init__(base_url=url, proxy=proxy, verify=not insecure, auth=auth)\n\n try:\n self.polling_timeout = int(polling_timeout)\n except (ValueError, TypeError):\n return_error('Please provide an integer value for \"Request Timeout\"')\n self.encoding = encoding\n self.ignore_regex: Optional[Pattern] = None\n if ignore_regex is not None:\n self.ignore_regex = re.compile(ignore_regex)\n self.feed_url_to_config: Optional[Dict[str, dict]] = feed_url_to_config\n self.fieldnames = argToList(fieldnames)\n self.dialect: Dict[str, Any] = {\n 'delimiter': delimiter,\n 'doublequote': doublequote,\n 'escapechar': escapechar,\n 'quotechar': quotechar,\n 'skipinitialspace': skipinitialspace\n }\n\n def _build_request(self, url):\n r = requests.Request(\n 'GET',\n url,\n auth=self._auth\n )\n\n return r.prepare()\n\n def build_iterator(self, **kwargs):\n results = []\n urls = self._base_url\n if not isinstance(urls, list):\n urls = [urls]\n for url in urls:\n _session = requests.Session()\n\n prepreq = self._build_request(url)\n\n # this is to honour the proxy environment variables\n kwargs.update(_session.merge_environment_settings(\n prepreq.url,\n {}, None, None, None # defaults\n ))\n kwargs['stream'] = True\n kwargs['verify'] = self._verify\n kwargs['timeout'] = self.polling_timeout\n\n if is_demisto_version_ge('6.5.0'):\n # Set the If-None-Match and If-Modified-Since headers if we have etag or\n # last_modified values in the context.\n last_run = demisto.getLastRun()\n etag = last_run.get(url, {}).get('etag')\n last_modified = last_run.get(url, {}).get('last_modified')\n last_updated = last_run.get(url, {}).get('last_updated')\n # To avoid issues with indicators expiring, if 'last_updated' is over X hours old,\n # we'll refresh the indicators to ensure their expiration time is updated.\n # For further details, refer to : https://confluence-dc.paloaltonetworks.com/display/DemistoContent/Json+Api+Module # noqa: E501\n if last_updated and has_passed_time_threshold(timestamp_str=last_updated, seconds_threshold=THRESHOLD_IN_SECONDS):\n last_modified = None\n etag = None\n demisto.debug(\"Since it's been a long time with no update, to make sure we are keeping the indicators alive, \\\n we will refetch them from scratch\")\n\n if etag:\n self.headers['If-None-Match'] = etag\n\n if last_modified:\n self.headers['If-Modified-Since'] = last_modified\n\n # set request headers\n if 'headers' in kwargs:\n self.headers.update(kwargs['headers'])\n del kwargs['headers']\n\n if self.headers:\n prepreq.headers.update(self.headers)\n\n try:\n r = _session.send(prepreq, **kwargs)\n except requests.exceptions.ConnectTimeout as exception:\n err_msg = 'Connection Timeout Error - potential reasons might be that the Server URL parameter' \\\n ' is incorrect or that the Server is not accessible from your host.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.SSLError as exception:\n # in case the \"Trust any certificate\" is already checked\n if not self._verify:\n raise\n err_msg = 'SSL Certificate Verification Failed - try selecting \\'Trust any certificate\\' checkbox in' \\\n ' the integration configuration.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.ProxyError as exception:\n err_msg = 'Proxy Error - if the \\'Use system proxy\\' checkbox in the integration configuration is' \\\n ' selected, try clearing the checkbox.'\n raise DemistoException(err_msg, exception)\n except requests.exceptions.ConnectionError as exception:\n # Get originating Exception in Exception chain\n error_class = str(exception.__class__)\n err_type = '<' + error_class[error_class.find('\\'') + 1: error_class.rfind('\\'')] + '>'\n err_msg = 'Verify that the server URL parameter' \\\n ' is correct and that you have access to the server from your host.' \\\n '\nError Type: {}\nError Number: [{}]\nMessage: {}\n' \\\n .format(err_type, exception.errno, exception.strerror)\n raise DemistoException(err_msg, exception)\n try:\n r.raise_for_status()\n except Exception:\n return_error(f'Exception in request: {r.status_code} {r.content.decode(\"utf-8\")}')\n raise\n\n response = self.get_feed_content_divided_to_lines(url, r)\n if self.feed_url_to_config:\n fieldnames = self.feed_url_to_config.get(url, {}).get('fieldnames', [])\n skip_first_line = self.feed_url_to_config.get(url, {}).get('skip_first_line', False)\n else:\n fieldnames = self.fieldnames\n skip_first_line = False\n if self.ignore_regex is not None:\n response = filter( # type: ignore\n lambda x: self.ignore_regex.match(x) is None, # type: ignore\n response\n )\n\n csvreader = csv.DictReader(\n response,\n fieldnames=fieldnames,\n **self.dialect\n )\n\n if skip_first_line:\n next(csvreader)\n no_update = get_no_update_value(r, url) if is_demisto_version_ge('6.5.0') else True\n results.append({url: {'result': csvreader, 'no_update': no_update}})\n\n return results\n\n def get_feed_content_divided_to_lines(self, url, raw_response):\n \"\"\"Fetch feed data and divides its content to lines\n\n Args:\n url: Current feed's url.\n raw_response: The raw response from the feed's url.\n\n Returns:\n List. List of lines from the feed content.\n \"\"\"\n if self.feed_url_to_config and self.feed_url_to_config.get(url).get('is_zipped_file'): # type: ignore\n response_content = gzip.decompress(raw_response.content)\n else:\n response_content = raw_response.content\n\n return response_content.decode(self.encoding).split('\n')\n\n\ndef get_no_update_value(response: requests.models.Response, url: str) -> bool:\n \"\"\"\n detect if the feed response has been modified according to the headers etag and last_modified.\n For more information, see this:\n https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Last-Modified\n https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag\n Args:\n response: (requests.Response) The feed response.\n url: (str) The feed URL (service).\n Returns:\n boolean with the value for noUpdate argument.\n The value should be False if the response was modified.\n \"\"\"\n if response.status_code == 304:\n demisto.debug('No new indicators fetched, createIndicators will be executed with noUpdate=True.')\n return True\n\n etag = response.headers.get('ETag')\n last_modified = response.headers.get('Last-Modified')\n current_time = datetime.utcnow()\n # Save the current time as the last updated time. This will be used to indicate the last time the feed was updated in XSOAR.\n last_updated = current_time.strftime(DATE_FORMAT)\n\n if not etag and not last_modified:\n demisto.debug('Last-Modified and Etag headers are not exists,'\n 'createIndicators will be executed with noUpdate=False.')\n return False\n\n last_run = demisto.getLastRun()\n last_run[url] = {'last_modified': last_modified, 'etag': etag, 'last_updated': last_updated}\n demisto.setLastRun(last_run)\n\n demisto.debug('New indicators fetched - the Last-Modified value has been updated,'\n ' createIndicators will be executed with noUpdate=False.')\n return False\n\n\ndef determine_indicator_type(indicator_type, default_indicator_type, auto_detect, value):\n \"\"\"\n Detect the indicator type of the given value.\n Args:\n indicator_type: (str) Indicator type given in the config.\n default_indicator_type: Indicator type which was inserted as a param of the integration by user.\n auto_detect: (bool) True whether auto detection of the indicator type is wanted.\n value: (str) The value which we'd like to get indicator type of.\n Returns:\n Str which stands for the indicator type after detection.\n \"\"\"\n if auto_detect:\n indicator_type = auto_detect_indicator_type(value)\n if not indicator_type:\n indicator_type = default_indicator_type\n return indicator_type\n\n\ndef module_test_command(client: Client, args):\n client.build_iterator()\n return 'ok', {}, {}\n\n\ndef date_format_parsing(date_string):\n \"\"\"\n formats a datestring to the ISO-8601 format which the server expects to recieve\n :param date_string: Date represented as a tring\n :return: ISO-8601 date string\n \"\"\"\n formatted_date = dateparser.parse(date_string, settings={'TIMEZONE': 'UTC'})\n assert formatted_date is not None, f\"failed parsing {date_string}\"\n return formatted_date.strftime(DATE_FORMAT)\n\n\ndef create_fields_mapping(raw_json: Dict[str, Any], mapping: Dict[str, Union[Tuple, str]]):\n fields_mapping = {} # type: dict\n\n for key, field in mapping.items():\n regex_extractor = None\n formatter_string = None\n field_mapper_function = None\n\n # case 'value_from_feed', regex_string_extractor, string_formatter\n if isinstance(field, tuple) and len(field) == 3:\n field, regex_extractor, formatter_string = field\n\n # case 'value_from_feed', 'field_mapper_function'\n elif isinstance(field, tuple) and len(field) == 2:\n field, field_mapper_function = field\n\n if not raw_json.get(field): # type: ignore\n continue\n\n if not regex_extractor:\n field_value = raw_json[field] # type: ignore\n else:\n try:\n field_value = re.match(regex_extractor, raw_json[field]).group(1) # type: ignore\n except Exception:\n field_value = raw_json[field] # type: ignore\n\n field_value = formatter_string.format(field_value) if formatter_string else field_value\n field_value = field_mapper_function(field_value) if field_mapper_function else field_value\n fields_mapping[key] = field_value\n\n if key in ['firstseenbysource', 'lastseenbysource']:\n fields_mapping[key] = date_format_parsing(fields_mapping[key])\n\n return fields_mapping\n\n\ndef fetch_indicators_command(client: Client, default_indicator_type: str, auto_detect: bool, limit: int = 0,\n create_relationships: bool = False, **kwargs):\n iterator = client.build_iterator(**kwargs)\n relationships_of_indicator = []\n indicators = []\n config = client.feed_url_to_config or {}\n\n # set noUpdate flag in createIndicators command True only when all the results from all the urls are True.\n no_update = all(next(iter(item.values())).get('no_update', False) for item in iterator)\n\n for url_to_reader in iterator:\n for url, reader in url_to_reader.items():\n mapping = config.get(url, {}).get('mapping', {})\n for item in reader.get('result', []):\n raw_json = dict(item)\n fields_mapping = create_fields_mapping(raw_json, mapping) if mapping else {}\n value = item.get(client.value_field) or fields_mapping.get('Value')\n if not value and len(item) > 1:\n value = next(iter(item.values()))\n if value:\n raw_json['value'] = value\n conf_indicator_type = config.get(url, {}).get('indicator_type')\n indicator_type = determine_indicator_type(conf_indicator_type, default_indicator_type, auto_detect,\n value)\n raw_json['type'] = indicator_type\n # if relationships param is True and also the url returns relationships\n if create_relationships and config.get(url, {}).get('relationship_name'):\n if fields_mapping.get('relationship_entity_b'):\n relationships_lst = EntityRelationship(\n name=config.get(url, {}).get('relationship_name'),\n entity_a=value,\n entity_a_type=indicator_type,\n entity_b=fields_mapping.get('relationship_entity_b'),\n entity_b_type=FeedIndicatorType.indicator_type_by_server_version(\n config.get(url, {}).get('relationship_entity_b_type')),\n )\n relationships_of_indicator = [relationships_lst.to_indicator()]\n\n indicator = {\n 'value': value,\n 'type': indicator_type,\n 'rawJSON': raw_json,\n 'fields': fields_mapping,\n 'relationships': relationships_of_indicator,\n }\n indicator['fields']['tags'] = client.tags\n\n if client.tlp_color:\n indicator['fields']['trafficlightprotocol'] = client.tlp_color\n\n indicators.append(indicator)\n # exit the loop if we have more indicators than the limit\n if limit and len(indicators) >= limit:\n return indicators, no_update\n\n return indicators, no_update\n\n\ndef get_indicators_command(client, args: dict, tags: Optional[List[str]] = None):\n if tags is None:\n tags = []\n itype = args.get('indicator_type', demisto.params().get('indicator_type'))\n try:\n limit = int(args.get('limit', 50))\n except ValueError:\n raise ValueError('The limit argument must be a number.')\n auto_detect = demisto.params().get('auto_detect_type')\n relationships = demisto.params().get('create_relationships', False)\n indicators_list, _ = fetch_indicators_command(client, itype, auto_detect, limit, relationships)\n entry_result = indicators_list[:limit]\n hr = tableToMarkdown('Indicators', entry_result, headers=['value', 'type', 'fields'])\n return hr, {}, indicators_list\n\n\ndef feed_main(feed_name, params=None, prefix=''): # pragma: no cover\n if not params:\n params = {k: v for k, v in demisto.params().items() if v is not None}\n handle_proxy()\n client = Client(**params)\n command = demisto.command()\n if command != 'fetch-indicators':\n demisto.info('Command being called is {}'.format(command))\n if prefix and not prefix.endswith('-'):\n prefix += '-'\n # Switch case\n commands: dict = {\n 'test-module': module_test_command,\n f'{prefix}get-indicators': get_indicators_command\n }\n try:\n if command == 'fetch-indicators':\n indicators, no_update = fetch_indicators_command(\n client,\n params.get('indicator_type'),\n params.get('auto_detect_type'),\n params.get('limit'),\n params.get('create_relationships')\n )\n\n # check if the version is higher than 6.5.0 so we can use noUpdate parameter\n if is_demisto_version_ge('6.5.0'):\n if not indicators:\n demisto.createIndicators(indicators, noUpdate=no_update) # type: ignore\n else:\n # we submit the indicators in batches\n for b in batch(indicators, batch_size=2000):\n demisto.createIndicators(b, noUpdate=no_update) # type: ignore\n else:\n # call createIndicators without noUpdate arg\n if not indicators:\n demisto.createIndicators(indicators) # type: ignore\n else:\n for b in batch(indicators, batch_size=2000): # type: ignore\n demisto.createIndicators(b)\n\n else:\n args = demisto.args()\n args['feed_name'] = feed_name\n readable_output, outputs, raw_response = commands[command](client, args)\n return_outputs(readable_output, outputs, raw_response)\n except Exception as e:\n err_msg = f'Error in {feed_name} Integration - Encountered an issue with createIndicators' if \\\n 'failed to create' in str(e) else f'Error in {feed_name} Integration [{e}]'\n return_error(err_msg)\n\nregister_module_line('CSVFeedApiModule', 'end', __line__(), wrapper=1)\n### END GENERATED CODE ###\n\nif __name__ == '__builtin__' or __name__ == 'builtins':\n main()\n\nregister_module_line('abuse.ch SSL Blacklist Feed', 'end', __line__())\n",
"type": "python",
"commands": [
{
"name": "sslbl-get-indicators",
"deprecated": false,
"arguments": [
{
"name": "limit",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The maximum number of results to return. The default value is 50.",
"defaultValue": "50",
"type": ""
},
{
"name": "indicator_type",
"required": false,
"deprecated": false,
"hidden": false,
"default": false,
"secret": false,
"description": "The indicator type.",
"type": ""
}
],
"outputs": null,
"important": null,
"description": "Gets the feed indicators.",
"execution": false,
"cartesian": false,
"hidden": false,
"docsHidden": false,
"sensitive": false,
"timeout": 0,
"permitted": false,
"indicatorAction": false,
"definitionId": "",
"gomAction": false,
"polling": false
}
],
"dockerImage": "demisto/python3:3.10.13.86272",
"nativeImage": [
"8.3",
"8.4"
],
"isFetch": false,
"isFetchEvents": false,
"isFetchAssets": false,
"feed": true,
"isFetchCredentials": false,
"runOnce": false,
"longRunning": false,
"longRunningPortMapping": false,
"subtype": "python3",
"isMappable": false,
"isRemoteSyncIn": false,
"isRemoteSyncOut": false,
"isFetchSamples": false,
"resetContext": false
},
"system": true,
"hidden": false,
"canGetSamples": true
}
],
"engines": {
"engines": [
{
"id": "6b1d6700-ee17-4af9-b071-d7fc642ea441",
"version": 81,
"cacheVersn": 0,
"sequenceNumber": 47683350,
"primaryTerm": 12,
"modified": "2024-04-04T16:17:45.602959424Z",
"sizeInBytes": 1530,
"sortValues": [
"120227"
],
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"definitionId": "",
"prevName": "",
"name": "create_new_engine_engine_rpm_OaOx5RSd",
"allowOnTenant": false,
"locked": false,
"lastSeen": "0001-01-01T00:00:00Z",
"firstSeen": "0001-01-01T00:00:00Z",
"lastConnectedApp": "",
"lastDisconnect": "0001-01-01T00:00:00Z",
"serviceName": "",
"host": "",
"user": "user@company.com",
"pkgType": "rpm",
"pkgName": "/var/lib/demisto/downloads/x86_64/create_new_engine_engine_rpm_OaOx5RSd-8.6_933863-1.x86_64.rpm",
"config": "",
"baseUrl": "",
"engineGroup": "",
"protocolVersion": "",
"os": "",
"demistoVersion": "",
"buildVersion": "21874e0e41eb2c5ce7653f6dcc07621d992f927c",
"md5": "3192ca98dab68bebb124f99cbf5bb994",
"underUpgrade": false,
"tenantNames": null,
"workers": 0,
"isDefault": false,
"isLegacy": false,
"packageFileHash": "76641c64c3dbbe9f8272fdc193942fb8b8647e00183d95c69b2e8b80eb43b714",
"pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}XIoRrYJ+aA1QCktuBTDQWfXmZnNB3KtbdMYTp+XgX+fVdYU3LbeIxO+oztktxJR7h2coO27MIkU9YIamIsR3LoUjydrlJVI0x9wO/JcK7fKdnyPqR3HRY/kpf5oOMYu0IQcsaSBAfb3Ky9z8z/4PyQlkJEcrDkvunHAtueOcNJmfqucQQiuMeHfj2PcMEdTqa/ZLJsRvtvoHDEC2sc1u5W/MGKKBdSGmkDXRQhgsL8bVOJVHjaayce8j22PpawKYmHUH4SeUjQnvZluiR2isS7z16TQNHW/UWNXzlqt8TTk=",
"pyramidAPIEncryptedAuthenticationHeaderTenants": null,
"connected": false,
"modules": null
},
{
"id": "b6b7b03e-632b-4c05-a087-23f68affd5d3",
"version": 7,
"cacheVersn": 0,
"sequenceNumber": 47683375,
"primaryTerm": 12,
"modified": "2024-04-04T16:18:46.830805002Z",
"sizeInBytes": 1519,
"sortValues": [
"120228"
],
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"definitionId": "",
"prevName": "",
"name": "create_new_engine_engine_shell_pzv9a3Y3",
"allowOnTenant": false,
"locked": false,
"lastSeen": "0001-01-01T00:00:00Z",
"firstSeen": "0001-01-01T00:00:00Z",
"lastConnectedApp": "",
"lastDisconnect": "0001-01-01T00:00:00Z",
"serviceName": "",
"host": "",
"user": "user@company.com",
"pkgType": "shell",
"pkgName": "/var/lib/demisto/downloads/create_new_engine_engine_shell_pzv9a3Y3-8.6-933863.sh",
"config": "",
"baseUrl": "",
"engineGroup": "",
"protocolVersion": "",
"os": "",
"demistoVersion": "",
"buildVersion": "21874e0e41eb2c5ce7653f6dcc07621d992f927c",
"md5": "8ffbd7cc23e270f792d8afd738814818",
"underUpgrade": false,
"tenantNames": null,
"workers": 0,
"isDefault": false,
"isLegacy": false,
"packageFileHash": "2afc44aac1dba5079bd963128de62b310454b4bd294bf1c9be1a6bfb9b32afa5",
"pyramidAPIEncryptedAuthenticationHeader": "{TOMMED}5w75Hmog7B4MPk6l/EkHNwILAOTnznRkUIb5dugxM2Ozw4vjPlj3B/STZundq8DYWl4NashmaYzZ7IUgy7ilbz0hT/LkFGJzM19RiRyGI4vudzkdNNSwb0qba2eZNVywS4nidmyKWUGXo+LIUJnBJYh8FyL3zDymBsMk8IHyPmejazDJ0ieVMRr8P8ztWNiD3wSEwJquX7tS9K/U8LnbBuwKGfx2VnY4nYpy1h0FiLFUaItLF+XJtgWDabFvgQhyUcF0Iz1YGM1ejTbT1pyCahHkVCVezqDASoJHda30nDA=",
"pyramidAPIEncryptedAuthenticationHeaderTenants": null,
"connected": false,
"modules": null
}
],
"total": 2,
"pkgTypes": [
"shell",
"zip",
"deb",
"rpm",
"conf"
],
"requestedLogs": {},
"engineGroups": []
},
"health": {
"id": "Rocket Incident Generator.long_running_integration_fetch_incidents_AI6tPtxq",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 1390272,
"primaryTerm": 2,
"modified": "2022-11-29T09:10:37.116147451Z",
"sizeInBytes": 0,
"sortValues": [
"2912"
],
"brand": "Rocket Incident Generator",
"instance": "long_running_integration_fetch_incidents_AI6tPtxq",
"incidentsPulled": 0,
"indicatorsPulled": 0,
"eventsPulled": 0,
"assetsPulled": 0,
"type": 0,
"incidentsDropped": 0,
"lastPullTime": "2022-11-29T09:05:26.273935902Z",
"lastError": "Script failed to run: \nTimeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)",
"lastIngestionDuration": 0,
"fetchDuration": 0,
"creation_time": "0001-01-01T00:00:00Z",
"sum_hour": 0,
"sum_day": 0,
"sum_week": 0
},
"long_running_integration_fetch_incidents_NbrfwigR": {
"id": "Rocket Incident Generator.long_running_integration_fetch_incidents_NbrfwigR",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 1680557,
"primaryTerm": 2,
"modified": "2022-12-03T15:30:44.971255467Z",
"sizeInBytes": 0,
"sortValues": [
"3035"
],
"brand": "Rocket Incident Generator",
"instance": "long_running_integration_fetch_incidents_NbrfwigR",
"incidentsPulled": 0,
"indicatorsPulled": 0,
"eventsPulled": 0,
"assetsPulled": 0,
"type": 0,
"incidentsDropped": 0,
"lastPullTime": "2022-12-03T15:25:34.220297587Z",
"lastError": "Script failed to run: \nTimeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)",
"lastIngestionDuration": 0,
"fetchDuration": 0,
"creation_time": "0001-01-01T00:00:00Z",
"sum_hour": 0,
"sum_day": 0,
"sum_week": 0
},
"instances": [
{
"id": "e227fc24-5e1d-4165-87b8-949f71030b22",
"version": 74,
"cacheVersn": 0,
"sequenceNumber": 39320671,
"primaryTerm": 12,
"modified": "2024-02-05T14:05:11.127323408Z",
"sizeInBytes": 1314,
"sortValues": [
"79580"
],
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "",
"prevName": "",
"password": "",
"enabled": "true",
"name": "AutoFocusTagsFeed_default_instance",
"configvalues": {
"create_relationships": true,
"feed": true,
"feedBypassExclusionList": true,
"feedFetchInterval": "10",
"feedIncremental": true,
"feedReliability": "A - Completely reliable",
"url": "https://autofocus.paloaltonetworks.com/api/v1.0/"
},
"configtypes": {
"create_relationships": 8,
"feed": 8,
"feedBypassExclusionList": 8,
"feedFetchInterval": 19,
"feedIncremental": 8,
"feedReliability": 15,
"url": 0
},
"brand": "AutoFocusTagsFeed",
"category": "",
"path": "",
"executable": "",
"cmdline": "",
"engine": "",
"engineGroup": "",
"hidden": false,
"isIntegrationScript": true,
"islongRunning": false,
"mappingId": "",
"outgoingMapperId": "",
"incomingMapperId": "",
"remoteSync": false,
"isSystemIntegration": true,
"canSample": false,
"defaultIgnore": false,
"integrationLogLevel": "",
"commandsPermissions": null,
"longRunningId": "",
"incidentFetchInterval": 0,
"eventFetchInterval": 0,
"assetsFetchInterval": 0,
"servicesID": "main",
"isBuiltin": false,
"hybrid": false,
"configuration": {
"id": "",
"version": 0,
"cacheVersn": 0,
"modified": "0001-01-01T00:00:00Z",
"sizeInBytes": 0,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "",
"prevName": "",
"display": "",
"brand": "",
"category": "",
"icon": "",
"description": "",
"configuration": null,
"integrationScript": null,
"hidden": false,
"canGetSamples": false
},
"data": [
{
"display": "Create relationships",
"displayPassword": "",
"name": "create_relationships",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": true
},
{
"display": "Fetch indicators",
"displayPassword": "",
"name": "feed",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": true
},
{
"display": "Bypass exclusion list",
"displayPassword": "",
"name": "feedBypassExclusionList",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.",
"hasvalue": true,
"value": true
},
{
"display": "Feed Fetch Interval",
"displayPassword": "",
"name": "feedFetchInterval",
"defaultValue": "10",
"type": 19,
"required": false,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": "10"
},
{
"display": "Incremental Feed",
"displayPassword": "",
"name": "feedIncremental",
"defaultValue": "true",
"type": 8,
"required": false,
"hidden": true,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.",
"hasvalue": true,
"value": true
},
{
"display": "Source Reliability",
"displayPassword": "",
"name": "feedReliability",
"defaultValue": "A - Completely reliable",
"type": 15,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": [
"A - Completely reliable",
"B - Usually reliable",
"C - Fairly reliable",
"D - Not usually reliable",
"E - Unreliable",
"F - Reliability cannot be judged"
],
"info": "Reliability of the source providing the intelligence data.",
"hasvalue": true,
"value": "A - Completely reliable"
},
{
"display": "AutoFocus Endpoint URL",
"displayPassword": "",
"name": "url",
"defaultValue": "https://autofocus.paloaltonetworks.com/api/v1.0/",
"type": 0,
"required": true,
"hidden": false,
"hiddenUsername": false,
"hiddenPassword": false,
"options": null,
"info": "",
"hasvalue": true,
"value": "https://autofocus.paloaltonetworks.com/api/v1.0/"
}
],
"displayPassword": "",
"passwordProtected": false,
"mappable": false,
"remoteSyncableIn": false,
"remoteSyncableOut": false,
"isFetchSamples": false,
"debugMode": false
}
]
}For integrations that fetch incidents or indicators in predefined intervals, fetch the execution history for the specified integration instance.
Note: The lastRun field in each history entry is a serialized JSON string representing internal integration state. This field has a size limitation and may be truncated for integrations with large state objects. When truncated, the value may not be valid JSON. Do not rely on parsing lastRun for production monitoring workflows.
Header parameters
authorizationstringRequiredExample:
api_key
DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmrx-xdr-auth-idstringRequiredExample:
api_key_id
2841Body
brandstringOptional
Integration name
instancestringOptional
Instance name
Responses
200
OK
application/json
totalintegerOptional
instancestringOptional
brandstringOptional
post/xsoar/public/v1/settings/integration/fetch-history
POST /xsoar/public/v1/settings/integration/fetch-history HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 91
{
"brand": "JSONSampleIncidentGenerator",
"instance": "JSONSampleIncidentGenerator_instance_1"
}200
OK
{
"total": 1,
"data": [
{
"id": "JSONSampleIncidentGenerator.JSONSampleIncidentGenerator_instance_1",
"version": -1,
"cacheVersn": 0,
"modified": "0001-01-01T00:00:00Z",
"sizeInBytes": 0,
"brand": "JSONSampleIncidentGenerator",
"instance": "JSONSampleIncidentGenerator_instance_1",
"incidentsPulled": 1,
"indicatorsPulled": 0,
"eventsPulled": 2,
"assetsPulled": 0,
"type": 0,
"incidentsDropped": 0,
"lastPullTime": "2024-04-17T09:21:38.240062103Z",
"lastError": "",
"lastIngestionDuration": 313779970,
"fetchDuration": 9090520,
"creation_time": "0001-01-01T00:00:00Z",
"sum_hour": 0,
"sum_day": 0,
"sum_week": 0,
"status": "success",
"lastRun": ""
}
],
"instance": "JSONSampleIncidentGenerator_instance_1",
"brand": "JSONSampleIncidentGenerator"
}Create a new instance of an integration.
Header parameters
authorizationstringRequiredExample:
api_key
DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmrx-xdr-auth-idstringRequiredExample:
api_key_id
2841Body
namestringOptional
Instance name
idstringOptional
enginestringOptional
engineGroupstringOptional
defaultIgnorebooleanOptional
enabledstringOptional
propagationLabelsstring[]Optional
brandstringOptional
canSamplebooleanOptional
categorystringOptional
versionintegerOptional
isIntegrationScriptbooleanOptional
isLongRunningbooleanOptional
passwordProtectedbooleanOptional
mappingIdstringOptional
incomingMapperIdstringOptional
outgoingMapperIdstringOptional
resetContextbooleanOptional
integrationLogLevelstringOptional
Responses
200
OK
application/json
assetsFetchIntervalintegerOptional
brandstringOptional
cacheVersnintegerOptional
canSamplebooleanOptional
categorystringOptional
cmdlinestringOptional
commandsPermissionsnullOptional
configtypesnullOptional
configvaluesobjectOptional
datanullOptional
debugModebooleanOptional
defaultIgnorebooleanOptional
definitionIdstringOptional
displayPasswordstringOptional
enabledstringOptional
enginestringOptional
engineGroupstringOptional
eventFetchIntervalintegerOptional
executablestringOptional
fromServerVersionstringOptional
hiddenbooleanOptional
hybridbooleanOptional
idstringOptional
incidentFetchIntervalintegerOptional
incomingMapperIdstringOptional
integrationLogLevelstringOptional
isBuiltinbooleanOptional
isFetchSamplesbooleanOptional
isIntegrationScriptbooleanOptional
isSystemIntegrationbooleanOptional
islongRunningbooleanOptional
itemVersionstringOptional
longRunningIdstringOptional
mappablebooleanOptional
mappingIdstringOptional
modifiedstringOptional
namestringOptional
outgoingMapperIdstringOptional
packIDstringOptional
packNamestringOptional
passwordProtectedbooleanOptional
pathstringOptional
prevNamestringOptional
primaryTermintegerOptional
propagationLabelsstring[]Optional
remoteSyncbooleanOptional
remoteSyncableInbooleanOptional
remoteSyncableOutbooleanOptional
sequenceNumberintegerOptional
servicesIDstringOptional
sizeInBytesintegerOptional
toServerVersionstringOptional
versionintegerOptional
put/xsoar/public/v1/settings/integration
PUT /xsoar/public/v1/settings/integration HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 13040
{
"assetsFetchInterval": 0,
"brand": "JSONSampleIncidentGenerator",
"cacheVersn": 0,
"canSample": true,
"category": "Utilities",
"cmdline": "",
"commandsPermissions": null,
"configtypes": {
"JSON": 12,
"incidentFetchInterval": 19,
"incidentType": 13,
"isFetch": 8,
"name": 0
},
"configuration": {
"brand": "",
"cacheVersn": 0,
"canGetSamples": true,
"category": "Utilities",
"commitMessage": "",
"configuration": [
{
"defaultValue": "",
"display": "Fetch incidents",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "isFetch",
"options": null,
"required": false,
"type": 8
},
{
"defaultValue": "",
"display": "Incident type",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentType",
"options": null,
"required": false,
"type": 13
},
{
"defaultValue": "1",
"display": "Incidents Fetch Interval",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentFetchInterval",
"options": null,
"required": false,
"type": 19
},
{
"defaultValue": "",
"display": "The raw JSON string to use as the sample data",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "JSON",
"options": null,
"required": true,
"type": 12
},
{
"defaultValue": "",
"display": "The incident name to give to the created incident",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "name",
"options": null,
"required": false,
"type": 0
}
],
"definitionId": "",
"description": "A utility for testing incident fetching with mock JSON data.",
"detailedDescription": "### Community Contributed Integration\n #### Integration Author: Nicholas Ericksen\n No support or maintenance is provided by the author. Customers are encouraged to engage with the user community for questions and guidance at the [Cortex XSOAR Live Discussions](https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/bd-p/Cortex_XSOAR_Discussions).\n***\n## JSON Sample Incident Generator\n- Add a string of JSON to the integration parameter denoted `The raw JSON string to use as the sample data` \n- Add a incident name to be used for the created incident (if a mapper is not used)\n- (optional) Configure a classifier and a mapper\n- Set the fetch interval and enable fetching\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/json-sample-incident-generator)",
"display": "JSON Sample Incident Generator (Community Contribution)",
"fromServerVersion": "6.0.0",
"hidden": false,
"icon": "",
"id": "JSONSampleIncidentGenerator",
"image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEQAAABACAYAAACjgtGkAAAMR2lDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnltSSWiBCEgJvYkiSJcSQosgIFWwEZJAQokxIYjYkUUF1y4iYENXRRRdCyBrxV4Wxd4fFlSUdbFgQ+VNCujq99773vm+uffPmXP+UzL33hkAdKp5UmkOqgtAriRPFhcezBqbksoiPQYIoAMt4A7ceHy5lB0bGwWg9N//Ke+uQ2soV1yUXD/P/1fREwjlfACQWIjTBXJ+LsT7AMCL+VJZHgBEb6i3nponVeLxEBvIYIIQS5U4U42LlThdjStUNglxHIh3AECm8XiyTAC0m6Celc/PhDzaNyF2lQjEEgB0yBAH8EU8AcQREA/JzZ2sxNAOOKR/x5P5D870AU4eL3MAq2tRCTlELJfm8Kb9n+3435Kbo+iPYQcHTSSLiFPWDPt2M3typBLTIO6SpEfHQKwP8QexQGUPMUoVKSIS1faoKV/OgT0DTIhdBbyQSIhNIQ6T5ERHafTpGeIwLsRwhaAF4jxugsZ3gVAeGq/hrJZNjovpxxkyDlvjW8+TqeIq7U8oshPZGv6bIiG3n/9toSghWZ0zRs0XJ0VDrA0xU54dH6m2wWwKRZzofhuZIk6Zvw3EvkJJeLCaH5uYIQuL09jLcuX99WILRGJutAZX5okSIjQ8O/g8Vf5GEDcJJezEfh6hfGxUfy0CYUiounbsklCSqKkXa5fmBcdpfF9Lc2I19jhVmBOu1FtBbCrPj9f44gF5cEGq+fFoaV5sgjpPPD2LNypWnQ9eAKIAB4QAFlDAkQ4mgywgbu1q7IK/1DNhgAdkIBMIgYtG0++RrJqRwGs8KAR/QSQE8gG/YNWsEORD/ZcBrfrqAjJUs/kqj2zwBOJcEAly4G+FyksyEC0JPIYa8U/R+TDXHDiUcz/r2FATpdEo+nlZOv2WxFBiCDGCGEZ0xE3wANwPj4LXIDjccG/cpz/bb/aEJ4Q2wkPCNUI74dYkcZHsh3pYYDRohxHCNDWnf18zbgdZPfBg3B/yQ26ciZsAF3wEjMTGA2FsD6jlaDJXVv8j9z9q+K7rGjuKKwWlDKIEURx+9NR20vYYYFH29PsOqXNNH+grZ2Dmx/ic7zotgPfIHy2xBdhe7DR2DDuLHcQaAQs7gjVhF7BDSjywih6rVlF/tDhVPtmQR/xTPJ4mprKTctc6107Xz+q5PGGB8v0IOJOl02TiTFEeiw3f/EIWV8IfOoTl5urmCoDyO6J+Tb1hqr4PCPPcN908SwD8p/X19R38pou8BMDeQwBQb3/T2XfA18E5AM6s5itk+WodrrwQABXowCfKGJgDa+AA63EDnsAPBIFQMArEgASQAibCLovgepaBqWAGmAtKQBlYClaBSrAebALbwE6wBzSCg+AYOAXOg0vgGrgDV08HeAG6wTvQiyAICaEjDMQYsUBsEWfEDfFGApBQJAqJQ1KQNCQTkSAKZAYyDylDliOVyEakFvkdOYAcQ84ibcgt5AHSibxGPqEYSkMNUDPUDh2GeqNsNBJNQCegmegUtBAtRhejFWgNugNtQI+h59FraDv6Au3BAKaFMTFLzAXzxjhYDJaKZWAybBZWipVjNVg91gz/5ytYO9aFfcSJOANn4S5wBUfgiTgfn4LPwhfhlfg2vAE/gV/BH+Dd+FcCnWBKcCb4EriEsYRMwlRCCaGcsIWwn3ASPk0dhHdEIpFJtCd6wacxhZhFnE5cRFxL3EU8SmwjPiL2kEgkY5IzyZ8UQ+KR8kglpDWkHaQjpMukDtIHshbZguxGDiOnkiXkInI5eTv5MPky+Sm5l6JLsaX4UmIoAso0yhLKZkoz5SKlg9JL1aPaU/2pCdQs6lxqBbWeepJ6l/pGS0vLSstHa4yWWGuOVoXWbq0zWg+0PtL0aU40Dm08TUFbTNtKO0q7RXtDp9Pt6EH0VHoefTG9ln6cfp/+QZuhPVSbqy3Qnq1dpd2gfVn7pQ5Fx1aHrTNRp1CnXGevzkWdLl2Krp0uR5enO0u3SveA7g3dHj2G3nC9GL1cvUV62/XO6j3TJ+nb6YfqC/SL9TfpH9d/xMAY1gwOg8+Yx9jMOMnoMCAa2BtwDbIMygx2GrQadBvqG44wTDIsMKwyPGTYzsSYdkwuM4e5hLmHeZ35aZDZIPYg4aCFg+oHXR703miwUZCR0KjUaJfRNaNPxizjUONs42XGjcb3THATJ5MxJlNN1pmcNOkabDDYbzB/cOngPYNvm6KmTqZxptNNN5leMO0xMzcLN5OarTE7btZlzjQPMs8yX2l+2LzTgmERYCG2WGlxxOI5y5DFZuWwKlgnWN2WppYRlgrLjZatlr1W9laJVkVWu6zuWVOtva0zrFdat1h321jYjLaZYVNnc9uWYuttK7JdbXva9r2dvV2y3Xy7Rrtn9kb2XPtC+zr7uw50h0CHKQ41DlcdiY7ejtmOax0vOaFOHk4ipyqni86os6ez2Hmtc9sQwhCfIZIhNUNuuNBc2C75LnUuD4Yyh0YNLRraOPTlMJthqcOWDTs97Kurh2uO62bXO8P1h48aXjS8efhrNyc3vluV21V3unuY+2z3JvdXI5xHCEesG3HTg+Ex2mO+R4vHF08vT5lnvWenl41Xmle11w1vA+9Y70XeZ3wIPsE+s30O+nz09fTN893j+7efi1+233a/ZyPtRwpHbh75yN/Kn+e/0b89gBWQFrAhoD3QMpAXWBP4MMg6SBC0Jegp25Gdxd7BfhnsGiwL3h/8nuPLmck5GoKFhIeUhrSG6ocmhlaG3g+zCssMqwvrDvcInx5+NIIQERmxLOIG14zL59Zyu0d5jZo56kQkLTI+sjLyYZRTlCyqeTQ6etToFaPvRttGS6IbY0AMN2ZFzL1Y+9gpsX+MIY6JHVM15knc8LgZcafjGfGT4rfHv0sITliScCfRIVGR2JKkkzQ+qTbpfXJI8vLk9rHDxs4cez7FJEWc0pRKSk1K3ZLaMy503KpxHeM9xpeMvz7BfkLBhLMTTSbmTDw0SWcSb9LeNEJactr2tM+8GF4Nryedm16d3s3n8FfzXwiCBCsFnUJ/4XLh0wz/jOUZzzL9M1dkdooCReWiLjFHXCl+lRWRtT7rfXZM9tbsvpzknF255Ny03AMSfUm25MRk88kFk9ukztISafsU3ymrpnTLImVb5Ih8grwpzwBu2C8oHBS/KB7kB+RX5X+YmjR1b4FegaTgwjSnaQunPS0MK/xtOj6dP71lhuWMuTMezGTP3DgLmZU+q2W29ezi2R1zwudsm0udmz33zyLXouVFb+clz2suNiueU/zol/Bf6kq0S2QlN+b7zV+/AF8gXtC60H3hmoVfSwWl58pcy8rLPi/iLzr36/BfK37tW5yxuHWJ55J1S4lLJUuvLwtctm253vLC5Y9WjF7RsJK1snTl21WTVp0tH1G+fjV1tWJ1e0VURdMamzVL13yuFFVeqwqu2lVtWr2w+v1awdrL64LW1a83W1+2/tMG8YabG8M3NtTY1ZRvIm7K3/Rkc9Lm0795/1a7xWRL2ZYvWyVb27fFbTtR61Vbu910+5I6tE5R17lj/I5LO0N2NtW71G/cxdxVthvsVux+/nva79f3RO5p2eu9t36f7b7q/Yz9pQ1Iw7SG7kZRY3tTSlPbgVEHWpr9mvf/MfSPrQctD1YdMjy05DD1cPHhviOFR3qOSo92Hcs89qhlUsud42OPXz0x5kTryciTZ06FnTp+mn36yBn/MwfP+p49cM77XON5z/MNFzwu7P/T48/9rZ6tDRe9LjZd8rnU3Day7fDlwMvHroRcOXWVe/X8tehrbdcTr9+8Mf5G+03BzWe3cm69up1/u/fOnLuEu6X3dO+V3ze9X/Mvx3/tavdsP/Qg5MGFh/EP7zziP3rxWP74c0fxE/qT8qcWT2ufuT072BnWeen5uOcdL6QvertK/tL7q/qlw8t9fwf9faF7bHfHK9mrvteL3hi/2fp2xNuWntie++9y3/W+L/1g/GHbR++Ppz8lf3raO/Uz6XPFF8cvzV8jv97ty+3rk/JkPNVWAIMDzcgA4PVWAOgpADDgHoI6Tn3OUwmiPpuqEPhPWH0WVIknAPXwptyuc44CsBsOuzmQG96VW/WEIIC6uw8Mjcgz3N3UXDR44iF86Ot7YwYAqRmAL7K+vt61fX1fNsNkbwFwdIr6fKkUIjwbbAhQomtGgjngB/k3BSOBEX9S4YsAAAAJcEhZcwAAFiUAABYlAUlSJPAAAAGbaVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA1LjQuMCI+CiAgIDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOmV4aWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vZXhpZi8xLjAvIj4KICAgICAgICAgPGV4aWY6UGl4ZWxYRGltZW5zaW9uPjY4PC9leGlmOlBpeGVsWERpbWVuc2lvbj4KICAgICAgICAgPGV4aWY6UGl4ZWxZRGltZW5zaW9uPjY0PC9leGlmOlBpeGVsWURpbWVuc2lvbj4KICAgICAgPC9yZGY6RGVzY3JpcHRpb24+CiAgIDwvcmRmOlJERj4KPC94OnhtcG1ldGE+ClzenRYAAAAcaURPVAAAAAIAAAAAAAAAIAAAACgAAAAgAAAAIAAAAng6drPEAAACRElEQVR4AeyYPe8BMRjAex9AxGIyG60kYjaZiMHiA5gsvgQTg8kmVrEYCIuISEwSL5tFREKQICRE/x7JNdeeS3ra/qc2EZ7e8/q7p706A78H0oMQMDQQwuLzQwOheSANRANhCDCi7hANhCHAiLpDNBCGACPqDtFAGAKMqDtEA2EIMKLuEA2EIcCIukP+G8jr9UKdTgcNBgO02+3Q/X5HlUoFeb1eJhW7mMvlPvo+nw+Fw2GUSqWQYRh2RZkz8D5E1XjDwOl0Gl5AUZ/1es0V0uPxUHaJRAKfTicu21+V0K+GPHb1ep0qyATzKxCwL5VKPKF/1lEKxNodsVgMd7tdvFgsMHQOz1itVng0GuFMJkPABgIBbnueGKyOUiDWlp/P52xsbnm73RIg0CX7/Z7b1q2iMiDP55Mq4vF4uM2N0g+FQsTfcrmkrskUlAG53W6kALiroiMSiRB/0+lU1J2jvXimDq4vlwspAJaO6IhGo8TfZDIRdedorwzI4XAgBcgAApuy+ZQaDoeOBYleUAZks9mQAvx+v2ieGM4gJpB+vy/sz8mBMiCw8ZkFBINBp/jc89lslvhrNpvcdm4VlQFpt9ukgHg87jYvm36hUCD+isWi7bqsCSVA4OBlXfO1Wk04XytgWILn81nY5zcH0oHAIzGfz5O7CcvmeDx+i+1q7nq9YgBhLsNkMolhc4XzjswhFUiv1yMJm4k3Gg1p+Y7HY2w9/UKMarUqzT84kgoE/quYIOC71WpJTRaczWYzKka5XJYa4w8AAP//PBb01QAAAh9JREFU7Za/rkFBEMb3thKFSqNSKBQKiVIjEREvIBGVRu0FtGoeQY9oRCQ60YiC8ABCVKIgQfzZe6Y4E2ducO7ZXdVsIieTs/PtzM93dldIjWMwGEghhOPXarW0rTCdTmU4HHbo1+t1bfogJHSq3e93ORqNZKlUchS9Wq20LBOLxVA3m83Kfr8vL5eLFm1bRCsQW/R2u8lEIoHFNxoN+5Xn53w+Rz2/3y/3+71nrXeJRoDAgt1uFxvI5XLvanD1rlqtol6tVnOV42WSMSDL5RIbiMfjXmpz5OTzedRrt9uOdzoDY0A2mw02EAqFlGuGPcPesIfDobLeKwFjQHa7HTYA37zqSKfTqDcej1XlXuYbA3I8HrEB+GdVRyqVQr3JZKIq9zJfvdIX0nAc2hbXASSZTKIe3EdMDWNAHo8HNqADSDQaRb3FYmGKh96LGa0S9g7bJSo2P51O8llru93SpbTFxhwCFT6fDJlMRoLV/9MMbMyz2UyWy2UEC1d3k8MokE6ng43YToEnHMluxrMr7PxKpeIm1fMco0Cu16ssFot/oKzXa1cFUyCRSEQeDgdXuV4n/UCiRd/osJwier2esD4BcT6fRbPZFIFA4OOahUJBWPuHCAaDwrrtCoh9Pt/HPJUJXwGiUuC3cxkIIc5AGAghQEJ2CAMhBEjIDmEghAAJ2SEMhBAgITuEgRACJGSHMBBCgITsEAZCCJCQHUKA/AJ5a/4/aFrqtgAAAABJRU5ErkJggg==",
"integrationScript": {
"commands": [
{
"arguments": [
{
"default": false,
"deprecated": false,
"description": "The key to change. Must also set value arguement. Can be comma separated to change multiple values.",
"hidden": false,
"name": "key",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "The new key value. Must also set key argument. Can be comma separated to support changing multiple values.",
"hidden": false,
"name": "value",
"required": false,
"secret": false,
"type": ""
}
],
"cartesian": false,
"definitionId": "",
"deprecated": false,
"description": "Read the provided JSON and return the results to the Context and Warroom. Can use key and value arg to change a JSON values if desired.",
"docsHidden": false,
"execution": false,
"gomAction": false,
"hidden": false,
"indicatorAction": false,
"name": "json-sample-incident-generator-command",
"outputs": null,
"permitted": false,
"polling": false,
"sensitive": false,
"timeout": 0
}
],
"dockerImage": "demisto/python3:3.11.10.116439",
"feed": false,
"isFetch": true,
"isFetchAssets": false,
"isFetchCredentials": false,
"isFetchEvents": false,
"isFetchSamples": false,
"isMappable": false,
"isRemoteSyncIn": false,
"isRemoteSyncOut": false,
"longRunning": false,
"longRunningPortMapping": false,
"nativeImage": [
"8.8",
"8.6"
],
"resetContext": false,
"runOnce": false,
"subtype": "python3",
"type": "python"
},
"isOverridable": false,
"itemVersion": "1.0.8",
"modified": "2025-04-08T14:12:54.294447021Z",
"name": "JSONSampleIncidentGenerator",
"packID": "JSONSampleIncidentGenerator",
"packName": "JSON Sample Incident Generator",
"packPropagationLabels": [
"all"
],
"prevName": "JSONSampleIncidentGenerator",
"primaryTerm": 7,
"propagationLabels": [],
"sequenceNumber": 5489516,
"shouldCommit": false,
"sizeInBytes": 13373,
"sortValues": [
"moduleconfiguration_JSONSampleIncidentGenerator"
],
"system": true,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1
},
"configvalues": {
"JSON": "test",
"incidentFetchInterval": "1",
"incidentType": null,
"isFetch": false,
"name": null
},
"data": [
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": false,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentType",
"options": null,
"required": false,
"type": 13,
"value": null
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentFetchInterval",
"options": null,
"required": false,
"type": 19,
"value": "1"
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "JSON",
"options": null,
"required": true,
"type": 12,
"value": "test"
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": false,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "name",
"options": null,
"required": false,
"type": 0,
"value": null
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "isFetch",
"options": null,
"required": false,
"type": 8,
"value": false
}
],
"debugMode": false,
"defaultIgnore": false,
"definitionId": "",
"displayPassword": "",
"enabled": "true",
"engine": "",
"engineGroup": "",
"eventFetchInterval": 0,
"executable": "",
"fromServerVersion": "",
"hidden": false,
"hybrid": false,
"id": "8a17f6e9-3182-4ac3-810d-a408c15e8d00",
"incidentFetchInterval": 0,
"incomingMapperId": "",
"integrationLogLevel": "",
"isBuiltin": false,
"isFetchSamples": false,
"isIntegrationScript": true,
"isOverridable": false,
"isSystemIntegration": true,
"islongRunning": false,
"itemVersion": "",
"longRunningId": "",
"mappable": false,
"mappingId": "",
"modified": "2025-04-27T11:33:52.289950795Z",
"name": "JSONSampleIncidentGenerator_instance_2",
"outgoingMapperId": "",
"packID": "",
"packName": "",
"passwordProtected": false,
"path": "",
"prevName": "",
"primaryTerm": 13,
"propagationLabels": [
"all"
],
"remoteSync": false,
"remoteSyncableIn": false,
"remoteSyncableOut": false,
"sequenceNumber": 5957356,
"servicesID": "main",
"sizeInBytes": 1114,
"toServerVersion": "",
"version": 2
}200
OK
{
"assetsFetchInterval": 0,
"brand": "JSONSampleIncidentGenerator",
"cacheVersn": 0,
"canSample": true,
"category": "Utilities",
"cmdline": "",
"commandsPermissions": null,
"configtypes": {
"JSON": 12,
"incidentFetchInterval": 19,
"incidentType": 13,
"isFetch": 8,
"name": 0
},
"configuration": {
"brand": "",
"cacheVersn": 0,
"canGetSamples": true,
"category": "Utilities",
"commitMessage": "",
"configuration": [
{
"defaultValue": "",
"display": "Fetch incidents",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "isFetch",
"options": null,
"required": false,
"type": 8
},
{
"defaultValue": "",
"display": "Incident type",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentType",
"options": null,
"required": false,
"type": 13
},
{
"defaultValue": "1",
"display": "Incidents Fetch Interval",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentFetchInterval",
"options": null,
"required": false,
"type": 19
},
{
"defaultValue": "",
"display": "The raw JSON string to use as the sample data",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "JSON",
"options": null,
"required": true,
"type": 12
},
{
"defaultValue": "",
"display": "The incident name to give to the created incident",
"displayPassword": "",
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "name",
"options": null,
"required": false,
"type": 0
}
],
"definitionId": "",
"description": "A utility for testing incident fetching with mock JSON data.",
"detailedDescription": "### Community Contributed Integration\n #### Integration Author: Nicholas Ericksen\n No support or maintenance is provided by the author. Customers are encouraged to engage with the user community for questions and guidance at the [Cortex XSOAR Live Discussions](https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/bd-p/Cortex_XSOAR_Discussions).\n***\n## JSON Sample Incident Generator\n- Add a string of JSON to the integration parameter denoted `The raw JSON string to use as the sample data` \n- Add a incident name to be used for the created incident (if a mapper is not used)\n- (optional) Configure a classifier and a mapper\n- Set the fetch interval and enable fetching\n\n---\n[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/json-sample-incident-generator)",
"display": "JSON Sample Incident Generator (Community Contribution)",
"fromServerVersion": "6.0.0",
"hidden": false,
"icon": "",
"id": "JSONSampleIncidentGenerator",
"image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEQAAABACAYAAACjgtGkAAAMR2lDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnltSSWiBCEgJvYkiSJcSQosgIFWwEZJAQokxIYjYkUUF1y4iYENXRRRdCyBrxV4Wxd4fFlSUdbFgQ+VNCujq99773vm+uffPmXP+UzL33hkAdKp5UmkOqgtAriRPFhcezBqbksoiPQYIoAMt4A7ceHy5lB0bGwWg9N//Ke+uQ2soV1yUXD/P/1fREwjlfACQWIjTBXJ+LsT7AMCL+VJZHgBEb6i3nponVeLxEBvIYIIQS5U4U42LlThdjStUNglxHIh3AECm8XiyTAC0m6Celc/PhDzaNyF2lQjEEgB0yBAH8EU8AcQREA/JzZ2sxNAOOKR/x5P5D870AU4eL3MAq2tRCTlELJfm8Kb9n+3435Kbo+iPYQcHTSSLiFPWDPt2M3typBLTIO6SpEfHQKwP8QexQGUPMUoVKSIS1faoKV/OgT0DTIhdBbyQSIhNIQ6T5ERHafTpGeIwLsRwhaAF4jxugsZ3gVAeGq/hrJZNjovpxxkyDlvjW8+TqeIq7U8oshPZGv6bIiG3n/9toSghWZ0zRs0XJ0VDrA0xU54dH6m2wWwKRZzofhuZIk6Zvw3EvkJJeLCaH5uYIQuL09jLcuX99WILRGJutAZX5okSIjQ8O/g8Vf5GEDcJJezEfh6hfGxUfy0CYUiounbsklCSqKkXa5fmBcdpfF9Lc2I19jhVmBOu1FtBbCrPj9f44gF5cEGq+fFoaV5sgjpPPD2LNypWnQ9eAKIAB4QAFlDAkQ4mgywgbu1q7IK/1DNhgAdkIBMIgYtG0++RrJqRwGs8KAR/QSQE8gG/YNWsEORD/ZcBrfrqAjJUs/kqj2zwBOJcEAly4G+FyksyEC0JPIYa8U/R+TDXHDiUcz/r2FATpdEo+nlZOv2WxFBiCDGCGEZ0xE3wANwPj4LXIDjccG/cpz/bb/aEJ4Q2wkPCNUI74dYkcZHsh3pYYDRohxHCNDWnf18zbgdZPfBg3B/yQ26ciZsAF3wEjMTGA2FsD6jlaDJXVv8j9z9q+K7rGjuKKwWlDKIEURx+9NR20vYYYFH29PsOqXNNH+grZ2Dmx/ic7zotgPfIHy2xBdhe7DR2DDuLHcQaAQs7gjVhF7BDSjywih6rVlF/tDhVPtmQR/xTPJ4mprKTctc6107Xz+q5PGGB8v0IOJOl02TiTFEeiw3f/EIWV8IfOoTl5urmCoDyO6J+Tb1hqr4PCPPcN908SwD8p/X19R38pou8BMDeQwBQb3/T2XfA18E5AM6s5itk+WodrrwQABXowCfKGJgDa+AA63EDnsAPBIFQMArEgASQAibCLovgepaBqWAGmAtKQBlYClaBSrAebALbwE6wBzSCg+AYOAXOg0vgGrgDV08HeAG6wTvQiyAICaEjDMQYsUBsEWfEDfFGApBQJAqJQ1KQNCQTkSAKZAYyDylDliOVyEakFvkdOYAcQ84ibcgt5AHSibxGPqEYSkMNUDPUDh2GeqNsNBJNQCegmegUtBAtRhejFWgNugNtQI+h59FraDv6Au3BAKaFMTFLzAXzxjhYDJaKZWAybBZWipVjNVg91gz/5ytYO9aFfcSJOANn4S5wBUfgiTgfn4LPwhfhlfg2vAE/gV/BH+Dd+FcCnWBKcCb4EriEsYRMwlRCCaGcsIWwn3ASPk0dhHdEIpFJtCd6wacxhZhFnE5cRFxL3EU8SmwjPiL2kEgkY5IzyZ8UQ+KR8kglpDWkHaQjpMukDtIHshbZguxGDiOnkiXkInI5eTv5MPky+Sm5l6JLsaX4UmIoAso0yhLKZkoz5SKlg9JL1aPaU/2pCdQs6lxqBbWeepJ6l/pGS0vLSstHa4yWWGuOVoXWbq0zWg+0PtL0aU40Dm08TUFbTNtKO0q7RXtDp9Pt6EH0VHoefTG9ln6cfp/+QZuhPVSbqy3Qnq1dpd2gfVn7pQ5Fx1aHrTNRp1CnXGevzkWdLl2Krp0uR5enO0u3SveA7g3dHj2G3nC9GL1cvUV62/XO6j3TJ+nb6YfqC/SL9TfpH9d/xMAY1gwOg8+Yx9jMOMnoMCAa2BtwDbIMygx2GrQadBvqG44wTDIsMKwyPGTYzsSYdkwuM4e5hLmHeZ35aZDZIPYg4aCFg+oHXR703miwUZCR0KjUaJfRNaNPxizjUONs42XGjcb3THATJ5MxJlNN1pmcNOkabDDYbzB/cOngPYNvm6KmTqZxptNNN5leMO0xMzcLN5OarTE7btZlzjQPMs8yX2l+2LzTgmERYCG2WGlxxOI5y5DFZuWwKlgnWN2WppYRlgrLjZatlr1W9laJVkVWu6zuWVOtva0zrFdat1h321jYjLaZYVNnc9uWYuttK7JdbXva9r2dvV2y3Xy7Rrtn9kb2XPtC+zr7uw50h0CHKQ41DlcdiY7ejtmOax0vOaFOHk4ipyqni86os6ez2Hmtc9sQwhCfIZIhNUNuuNBc2C75LnUuD4Yyh0YNLRraOPTlMJthqcOWDTs97Kurh2uO62bXO8P1h48aXjS8efhrNyc3vluV21V3unuY+2z3JvdXI5xHCEesG3HTg+Ex2mO+R4vHF08vT5lnvWenl41Xmle11w1vA+9Y70XeZ3wIPsE+s30O+nz09fTN893j+7efi1+233a/ZyPtRwpHbh75yN/Kn+e/0b89gBWQFrAhoD3QMpAXWBP4MMg6SBC0Jegp25Gdxd7BfhnsGiwL3h/8nuPLmck5GoKFhIeUhrSG6ocmhlaG3g+zCssMqwvrDvcInx5+NIIQERmxLOIG14zL59Zyu0d5jZo56kQkLTI+sjLyYZRTlCyqeTQ6etToFaPvRttGS6IbY0AMN2ZFzL1Y+9gpsX+MIY6JHVM15knc8LgZcafjGfGT4rfHv0sITliScCfRIVGR2JKkkzQ+qTbpfXJI8vLk9rHDxs4cez7FJEWc0pRKSk1K3ZLaMy503KpxHeM9xpeMvz7BfkLBhLMTTSbmTDw0SWcSb9LeNEJactr2tM+8GF4Nryedm16d3s3n8FfzXwiCBCsFnUJ/4XLh0wz/jOUZzzL9M1dkdooCReWiLjFHXCl+lRWRtT7rfXZM9tbsvpzknF255Ny03AMSfUm25MRk88kFk9ukztISafsU3ymrpnTLImVb5Ih8grwpzwBu2C8oHBS/KB7kB+RX5X+YmjR1b4FegaTgwjSnaQunPS0MK/xtOj6dP71lhuWMuTMezGTP3DgLmZU+q2W29ezi2R1zwudsm0udmz33zyLXouVFb+clz2suNiueU/zol/Bf6kq0S2QlN+b7zV+/AF8gXtC60H3hmoVfSwWl58pcy8rLPi/iLzr36/BfK37tW5yxuHWJ55J1S4lLJUuvLwtctm253vLC5Y9WjF7RsJK1snTl21WTVp0tH1G+fjV1tWJ1e0VURdMamzVL13yuFFVeqwqu2lVtWr2w+v1awdrL64LW1a83W1+2/tMG8YabG8M3NtTY1ZRvIm7K3/Rkc9Lm0795/1a7xWRL2ZYvWyVb27fFbTtR61Vbu910+5I6tE5R17lj/I5LO0N2NtW71G/cxdxVthvsVux+/nva79f3RO5p2eu9t36f7b7q/Yz9pQ1Iw7SG7kZRY3tTSlPbgVEHWpr9mvf/MfSPrQctD1YdMjy05DD1cPHhviOFR3qOSo92Hcs89qhlUsud42OPXz0x5kTryciTZ06FnTp+mn36yBn/MwfP+p49cM77XON5z/MNFzwu7P/T48/9rZ6tDRe9LjZd8rnU3Day7fDlwMvHroRcOXWVe/X8tehrbdcTr9+8Mf5G+03BzWe3cm69up1/u/fOnLuEu6X3dO+V3ze9X/Mvx3/tavdsP/Qg5MGFh/EP7zziP3rxWP74c0fxE/qT8qcWT2ufuT072BnWeen5uOcdL6QvertK/tL7q/qlw8t9fwf9faF7bHfHK9mrvteL3hi/2fp2xNuWntie++9y3/W+L/1g/GHbR++Ppz8lf3raO/Uz6XPFF8cvzV8jv97ty+3rk/JkPNVWAIMDzcgA4PVWAOgpADDgHoI6Tn3OUwmiPpuqEPhPWH0WVIknAPXwptyuc44CsBsOuzmQG96VW/WEIIC6uw8Mjcgz3N3UXDR44iF86Ot7YwYAqRmAL7K+vt61fX1fNsNkbwFwdIr6fKkUIjwbbAhQomtGgjngB/k3BSOBEX9S4YsAAAAJcEhZcwAAFiUAABYlAUlSJPAAAAGbaVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA1LjQuMCI+CiAgIDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOmV4aWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vZXhpZi8xLjAvIj4KICAgICAgICAgPGV4aWY6UGl4ZWxYRGltZW5zaW9uPjY4PC9leGlmOlBpeGVsWERpbWVuc2lvbj4KICAgICAgICAgPGV4aWY6UGl4ZWxZRGltZW5zaW9uPjY0PC9leGlmOlBpeGVsWURpbWVuc2lvbj4KICAgICAgPC9yZGY6RGVzY3JpcHRpb24+CiAgIDwvcmRmOlJERj4KPC94OnhtcG1ldGE+ClzenRYAAAAcaURPVAAAAAIAAAAAAAAAIAAAACgAAAAgAAAAIAAAAng6drPEAAACRElEQVR4AeyYPe8BMRjAex9AxGIyG60kYjaZiMHiA5gsvgQTg8kmVrEYCIuISEwSL5tFREKQICRE/x7JNdeeS3ra/qc2EZ7e8/q7p706A78H0oMQMDQQwuLzQwOheSANRANhCDCi7hANhCHAiLpDNBCGACPqDtFAGAKMqDtEA2EIMKLuEA2EIcCIukP+G8jr9UKdTgcNBgO02+3Q/X5HlUoFeb1eJhW7mMvlPvo+nw+Fw2GUSqWQYRh2RZkz8D5E1XjDwOl0Gl5AUZ/1es0V0uPxUHaJRAKfTicu21+V0K+GPHb1ep0qyATzKxCwL5VKPKF/1lEKxNodsVgMd7tdvFgsMHQOz1itVng0GuFMJkPABgIBbnueGKyOUiDWlp/P52xsbnm73RIg0CX7/Z7b1q2iMiDP55Mq4vF4uM2N0g+FQsTfcrmkrskUlAG53W6kALiroiMSiRB/0+lU1J2jvXimDq4vlwspAJaO6IhGo8TfZDIRdedorwzI4XAgBcgAApuy+ZQaDoeOBYleUAZks9mQAvx+v2ieGM4gJpB+vy/sz8mBMiCw8ZkFBINBp/jc89lslvhrNpvcdm4VlQFpt9ukgHg87jYvm36hUCD+isWi7bqsCSVA4OBlXfO1Wk04XytgWILn81nY5zcH0oHAIzGfz5O7CcvmeDx+i+1q7nq9YgBhLsNkMolhc4XzjswhFUiv1yMJm4k3Gg1p+Y7HY2w9/UKMarUqzT84kgoE/quYIOC71WpJTRaczWYzKka5XJYa4w8AAP//PBb01QAAAh9JREFU7Za/rkFBEMb3thKFSqNSKBQKiVIjEREvIBGVRu0FtGoeQY9oRCQ60YiC8ABCVKIgQfzZe6Y4E2ducO7ZXdVsIieTs/PtzM93dldIjWMwGEghhOPXarW0rTCdTmU4HHbo1+t1bfogJHSq3e93ORqNZKlUchS9Wq20LBOLxVA3m83Kfr8vL5eLFm1bRCsQW/R2u8lEIoHFNxoN+5Xn53w+Rz2/3y/3+71nrXeJRoDAgt1uFxvI5XLvanD1rlqtol6tVnOV42WSMSDL5RIbiMfjXmpz5OTzedRrt9uOdzoDY0A2mw02EAqFlGuGPcPesIfDobLeKwFjQHa7HTYA37zqSKfTqDcej1XlXuYbA3I8HrEB+GdVRyqVQr3JZKIq9zJfvdIX0nAc2hbXASSZTKIe3EdMDWNAHo8HNqADSDQaRb3FYmGKh96LGa0S9g7bJSo2P51O8llru93SpbTFxhwCFT6fDJlMRoLV/9MMbMyz2UyWy2UEC1d3k8MokE6ng43YToEnHMluxrMr7PxKpeIm1fMco0Cu16ssFot/oKzXa1cFUyCRSEQeDgdXuV4n/UCiRd/osJwier2esD4BcT6fRbPZFIFA4OOahUJBWPuHCAaDwrrtCoh9Pt/HPJUJXwGiUuC3cxkIIc5AGAghQEJ2CAMhBEjIDmEghAAJ2SEMhBAgITuEgRACJGSHMBBCgITsEAZCCJCQHUKA/AJ5a/4/aFrqtgAAAABJRU5ErkJggg==",
"integrationScript": {
"commands": [
{
"arguments": [
{
"default": false,
"deprecated": false,
"description": "The key to change. Must also set value arguement. Can be comma separated to change multiple values.",
"hidden": false,
"name": "key",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "The new key value. Must also set key argument. Can be comma separated to support changing multiple values.",
"hidden": false,
"name": "value",
"required": false,
"secret": false,
"type": ""
}
],
"cartesian": false,
"definitionId": "",
"deprecated": false,
"description": "Read the provided JSON and return the results to the Context and Warroom. Can use key and value arg to change a JSON values if desired.",
"docsHidden": false,
"execution": false,
"gomAction": false,
"hidden": false,
"indicatorAction": false,
"name": "json-sample-incident-generator-command",
"outputs": null,
"permitted": false,
"polling": false,
"sensitive": false,
"timeout": 0
}
],
"dockerImage": "demisto/python3:3.11.10.116439",
"feed": false,
"isFetch": true,
"isFetchAssets": false,
"isFetchCredentials": false,
"isFetchEvents": false,
"isFetchSamples": false,
"isMappable": false,
"isRemoteSyncIn": false,
"isRemoteSyncOut": false,
"longRunning": false,
"longRunningPortMapping": false,
"nativeImage": [
"8.8",
"8.6"
],
"resetContext": false,
"runOnce": false,
"subtype": "python3",
"type": "python"
},
"isOverridable": false,
"itemVersion": "1.0.8",
"modified": "2025-04-08T14:12:54.294447021Z",
"name": "JSONSampleIncidentGenerator",
"packID": "JSONSampleIncidentGenerator",
"packName": "JSON Sample Incident Generator",
"packPropagationLabels": [
"all"
],
"prevName": "JSONSampleIncidentGenerator",
"primaryTerm": 7,
"propagationLabels": [],
"sequenceNumber": 5489516,
"shouldCommit": false,
"sizeInBytes": 13373,
"sortValues": [
"moduleconfiguration_JSONSampleIncidentGenerator"
],
"system": true,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1
},
"configvalues": {
"JSON": "test",
"incidentFetchInterval": "1",
"incidentType": null,
"isFetch": false,
"name": null
},
"data": [
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": false,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentType",
"options": null,
"required": false,
"type": 13,
"value": null
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "incidentFetchInterval",
"options": null,
"required": false,
"type": 19,
"value": "1"
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "JSON",
"options": null,
"required": true,
"type": 12,
"value": "test"
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": false,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "name",
"options": null,
"required": false,
"type": 0,
"value": null
},
{
"defaultValue": "",
"display": "",
"displayPassword": "",
"hasvalue": true,
"hidden": false,
"hiddenPassword": false,
"hiddenUsername": false,
"info": "",
"name": "isFetch",
"options": null,
"required": false,
"type": 8,
"value": false
}
],
"debugMode": false,
"defaultIgnore": false,
"definitionId": "",
"displayPassword": "",
"enabled": "true",
"engine": "",
"engineGroup": "",
"eventFetchInterval": 0,
"executable": "",
"fromServerVersion": "",
"hidden": false,
"hybrid": false,
"id": "8a17f6e9-3182-4ac3-810d-a408c15e8d00",
"incidentFetchInterval": 0,
"incomingMapperId": "",
"integrationLogLevel": "",
"isBuiltin": false,
"isFetchSamples": false,
"isIntegrationScript": true,
"isOverridable": false,
"isSystemIntegration": true,
"islongRunning": false,
"itemVersion": "",
"longRunningId": "",
"mappable": false,
"mappingId": "",
"modified": "2025-04-27T11:33:52.289950795Z",
"name": "JSONSampleIncidentGenerator_instance_2",
"outgoingMapperId": "",
"packID": "",
"packName": "",
"passwordProtected": false,
"path": "",
"prevName": "",
"primaryTerm": 13,
"propagationLabels": [
"all"
],
"remoteSync": false,
"remoteSyncableIn": false,
"remoteSyncableOut": false,
"sequenceNumber": 5957356,
"servicesID": "main",
"sizeInBytes": 1114,
"toServerVersion": "",
"version": 2
}Reset the last run timestamp on the specified integration instance.
Path parameters
instance_idstringRequired
Header parameters
AuthorizationstringRequired
{api_key}
x-xdr-auth-idstringRequired
{api_key_id}
Body
objectOptional
Responses
200
OK
No content
post/xsoar/public/v1/settings/integration/reset/{instance_id}
POST /xsoar/public/v1/settings/integration/reset/{instance_id} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}200
OK
No content
Delete the integration instance credentials specified by ID.
For more information on integration instance credentials, see Manage credentials.
Header parameters
AuthorizationstringRequired
{api_key}
x-xdr-auth-idstringRequired
{api_key_id}
Body
idstringOptional
Responses
200
OK
application/json
objectOptional
post/xsoar/public/v1/settings/credentials/delete
POST /xsoar/public/v1/settings/credentials/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 15
{
"id": "jsmith"
}200
OK
{}Get all integration instance credentials and their details.
For more information on integration instance credentials, see Manage credentials.
Header parameters
AuthorizationstringRequired
{api_key}
x-xdr-auth-idstringRequired
{api_key_id}
Body
pageintegerOptional
sizeintegerOptional
querystringOptional
Responses
200
OK
application/json
totalintegerOptional
Total number of credentials returned.
post/xsoar/public/v1/settings/credentials
POST /xsoar/public/v1/settings/credentials HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 34
{
"page": 1,
"size": 1,
"query": "text"
}200
OK
{
"credentials": [
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "rocket_ZMKzPGsy",
"locked": false,
"modified": "2025-03-03T16:54:09.855226363Z",
"name": "rocket_ZMKzPGsy",
"primaryTerm": 10,
"sequenceNumber": 84731248,
"sizeInBytes": 255,
"user": "rocket_sXJgXzZ1",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
},
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "rocket_N8HdicIH",
"locked": false,
"modified": "2025-03-31T18:14:20.472931836Z",
"name": "rocket_N8HdicIH",
"primaryTerm": 10,
"sequenceNumber": 88067677,
"sizeInBytes": 255,
"user": "rocket_Tzh15pny",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
},
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "rocket_4MSK7GWn",
"locked": false,
"modified": "2025-04-15T06:57:16.491793756Z",
"name": "rocket_4MSK7GWn",
"primaryTerm": 11,
"sequenceNumber": 89289871,
"sizeInBytes": 255,
"user": "rocket_t9L8y6DI",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
},
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "rocket_FnUCAjCc",
"locked": false,
"modified": "2025-04-27T12:47:24.344273235Z",
"name": "rocket_FnUCAjCc",
"primaryTerm": 14,
"sequenceNumber": 91028639,
"sizeInBytes": 255,
"user": "rocket_2GBNYdBi",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
}
],
"total": 4
}Create integration instance credentials or update existing credentials.
For more information on integration instance credentials, see Manage credentials.
Responses
200
OK
application/json
cacheVersnintegerOptional
hasCertificatebooleanOptional
hasCertificatePassbooleanOptional
hasPasswordbooleanOptional
idstringOptional
lockedbooleanOptional
modifiedstringOptional
namestringOptional
primaryTermintegerOptional
sequenceNumberintegerOptional
sizeInBytesintegerOptional
userstringOptional
vaultInstanceIdstringOptional
versionintegerOptional
workgroupstringOptional
put/xsoar/public/v1/settings/credentials
PUT /xsoar/public/v1/settings/credentials HTTP/1.1
Host: api-yourfqdn
Accept: */*
200
OK
{
"cacheVersn": 0,
"hasCertificate": false,
"hasCertificatePass": false,
"hasPassword": false,
"id": "jsmith",
"locked": false,
"modified": "2025-04-27T12:37:21.144981996Z",
"name": "John Smith",
"primaryTerm": 14,
"sequenceNumber": 91027660,
"sizeInBytes": 255,
"user": "jsmith",
"vaultInstanceId": "",
"version": 1,
"workgroup": ""
}Last updated
Was this helpful?