AdminByRequest

Details

ID	`AdminByRequest`
Provider	Admin By Request
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

AdminByRequest is a Privileged Access Management (PAM) solution that enables secure, temporary elevation to local admin rights.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Admin By Request in Cortex

Parameter	Description	Required
Server URL		True
API Key	The API Key allows you to interact with the AdminByRequest API service.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch events		False
Event types to fetch	Which records the integration should fetch from the AdminByRequest API. Available for Auditlogs, Events, and Requests.	True
Maximum number of Auditlog per fetch	Maximum number of audit log entries to retrieve per fetch cycle. Applies only if the “Auditlog” event type is enabled for fetching.	False
Maximum number of Events per fetch	Maximum number of event entries to retrieve per fetch cycle. Applies only if the “Events” event type is enabled for fetching.	False
Maximum number of Requests per fetch	Maximum number of request entries to retrieve per fetch cycle. Applies only if the “Requests” event type is enabled for fetching.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

adminbyrequest-get-events

Retrieves a list of entries logs events from the AdminByRequest instance.

Base Command

adminbyrequest-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to ‘true’ in order to create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
event_type	The type of event to fetch. Default is Auditlog.	Optional
limit	Returns no more than the specified number of events (for entries of type ‘Requests’ the default value is 5000).	Optional
first_fetch	The UTC date or relative timestamp from when to start fetching incidents. Notice that for event type ‘Requests’ there is the option to set a start date. Supported formats: N days, N weeks, N months, N years, yyyy-mm-dd.	Optional

Context Output

There is no context output for this command.

API Limitations

Please DO NOT consistently use a high “limit” number or flood the API. The account will be automatically throttled.
Daily quota: 100,000 API calls (approximately 60 calls per minute maximum).

adminbyrequest-list-requests

Lists requests from AdminByRequest.

Base Command

adminbyrequest-list-requests

Input

Argument Name	Description	Required
request_id	The ID of a specific request to retrieve.	Optional
status	Filters requests by status. Possible values are: Pending, Open, Approved, Denied, Quarantined.	Optional
want_scan_details	Set to true to include scan details in the response. Possible values are: true, false.	Optional
limit	The maximum number of requests to return. Default is 50.	Optional
all_results	Set to true to fetch all available results, overriding the limit. Possible values are: true, false.	Optional

Context Output

Path	Type	Description
AdminByRequest.Request.id	Number	The ID of the request.
AdminByRequest.Request.type	String	The type of the request.
AdminByRequest.Request.settingsName	String	The name of the settings.
AdminByRequest.Request.application.name	String	The name of the application.
AdminByRequest.Request.application.scanResult	String	The scan result of the application.
AdminByRequest.Request.user	Unknown	The user associated with the request.
AdminByRequest.Request.computer.name	String	The name of the computer.
AdminByRequest.Request.status	String	The status of the request.
AdminByRequest.Request.reason	String	The reason for the request.
AdminByRequest.Request.approvedBy	String	The user who approved the request.
AdminByRequest.Request.approvedByEmail	String	The email of the user who approved the request.
AdminByRequest.Request.deniedReason	String	The reason for denying the request.
AdminByRequest.Request.deniedBy	String	The user who denied the request.
AdminByRequest.Request.deniedByEmail	String	The email of the user who denied the request.
AdminByRequest.Request.requestTime	Date	The time the request was made.
AdminByRequest.Request.startTime	Date	The start time of the request.
AdminByRequest.Request.eventText	String	The text of the request.
AdminByRequest.Request.eventTime	Date	The time the request occurred.

adminbyrequest-request-deny

Denies a request in AdminByRequest.

Base Command

adminbyrequest-request-deny

Input

Argument Name	Description	Required
request_id	The ID of the request to deny.	Required
denied_by	The user who denied the request.	Optional
reason	The reason for denying the request.	Optional

Context Output

There is no context output for this command.

adminbyrequest-request-approve

Approves a request in AdminByRequest.

Base Command

adminbyrequest-request-approve

Input

Argument Name	Description	Required
request_id	The ID of the request to approve.	Required
approved_by	The user who approved the request.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch events
event_types_to_fetch — Event types to fetch (required)
max_auditlog_per_fetch — Maximum number of Auditlog per fetch
max_events_per_fetch — Maximum number of Events per fetch
max_requests_per_fetch — Maximum number of Requests per fetch

Commands (4)

adminbyrequest-get-events
Retrieves a list of entry log events from the AdminByRequest instance.
adminbyrequest-list-requests
Lists requests from AdminByRequest.
adminbyrequest-request-approve
Approves a request in AdminByRequest.
adminbyrequest-request-deny
Denies a request in AdminByRequest.

Source

AdminByRequestEventCollector.py AdminByRequestEventCollector_test.py AdminByRequestEventCollector.yml AdminByRequestEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Admin By Request
sectionorder:
- Connect
- Collect
commonfields:
  id: AdminByRequest
  version: -1
configuration:
- defaultvalue: https://dc2api.adminbyrequest.com/
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  additionalinfo: The API Key allows you to interacts with the AdminByRequest API service.
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  hidden:
  - xsoar
  defaultvalue: "true"
- display: Event types to fetch
  name: event_types_to_fetch
  section: Collect
  required: true
  type: 16
  additionalinfo: Which records the integration should fetch from the AdminByRequest API. Available for Auditlogs, Events, and Requests.
  defaultvalue: Auditlog,Events,Requests
  options:
  - Auditlog
  - Events
  - Requests
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- additionalinfo: 'Maximum number of audit log entries to retrieve per fetch cycle. Applies only if the "Auditlog" event type is enabled for fetching.'
  defaultvalue: "50000"
  display: Maximum number of Auditlog per fetch
  name: max_auditlog_per_fetch
  required: false
  type: 0
  section: Collect
  advanced: true
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- additionalinfo: 'Maximum number of event entries to retrieve per fetch cycle. Applies only if the "Events" event type is enabled for fetching.'
  defaultvalue: "50000"
  display: Maximum number of Events per fetch
  name: max_events_per_fetch
  required: false
  type: 0
  section: Collect
  advanced: true
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- additionalinfo: 'Maximum number of request entries to retrieve per fetch cycle. Applies only if the "Requests" event type is enabled for fetching.'
  defaultvalue: "5000"
  display: Maximum number of Requests per fetch
  name: max_requests_per_fetch
  required: false
  type: 0
  supportedModules:
  - xsiam
  section: Collect
  advanced: true
  hidden:
  - xsoar
description: 'AdminByRequest is a Privileged Access Management (PAM) solution that enables secure, temporary elevation to local admin rights.'
display: Admin By Request
name: AdminByRequest
supportlevelheader: xsoar
script:
  commands:
  - name: adminbyrequest-get-events
    description: Retrieves a list of entry log events from the AdminByRequest instance.
    arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to true to create events, otherwise it only displays them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      defaultValue: 'Auditlog'
      description: The type of event to fetch.
      name: event_type
      predefined:
      - 'Auditlog'
      - 'Events'
      - 'Requests'
      required: false
    - description: Returns no more than the specified number of events (for entries of type 'Requests' the default value is 5000).
      name: limit
      required: false
    - description: "The UTC date or relative timestamp from which to start fetching events. **Note**: For event type 'Requests', you can set a start date. Supported formats: N days, N weeks, N months, N years, yyyy-mm-dd."
      name: first_fetch
      required: false
  - name: adminbyrequest-list-requests
    description: Lists requests from AdminByRequest.
    arguments:
    - name: request_id
      description: The ID of a specific request to retrieve.
      required: false
    - name: status
      description: Filters requests by status.
      required: false
      auto: PREDEFINED
      predefined:
      - "Pending"
      - "Open"
      - "Approved"
      - "Denied"
      - "Quarantined"
    - name: want_scan_details
      description: Set to true to include scan details in the response.
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: limit
      description: The maximum number of requests to return. Default is 50.
      required: false
    - name: all_results
      description: Set to true to fetch all available results, up to 100,000, overriding the limit.
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: AdminByRequest.Request.id
      description: The ID of the request.
      type: Number
    - contextPath: AdminByRequest.Request.type
      description: The type of the request.
      type: String
    - contextPath: AdminByRequest.Request.settingsName
      description: The name of the settings.
      type: String
    - contextPath: AdminByRequest.Request.application.name
      description: The name of the application.
      type: String
    - contextPath: AdminByRequest.Request.application.scanResult
      description: The scan result of the application.
      type: String
    - contextPath: AdminByRequest.Request.user
      description: The user associated with the request.
      type: Unknown
    - contextPath: AdminByRequest.Request.computer.name
      description: The name of the computer.
      type: String
    - contextPath: AdminByRequest.Request.status
      description: The status of the request.
      type: String
    - contextPath: AdminByRequest.Request.reason
      description: The reason for the request.
      type: String
    - contextPath: AdminByRequest.Request.approvedBy
      description: The user who approved the request.
      type: String
    - contextPath: AdminByRequest.Request.approvedByEmail
      description: The email of the user who approved the request.
      type: String
    - contextPath: AdminByRequest.Request.deniedReason
      description: The reason for denying the request.
      type: String
    - contextPath: AdminByRequest.Request.deniedBy
      description: The user who denied the request.
      type: String
    - contextPath: AdminByRequest.Request.deniedByEmail
      description: The email of the user who denied the request.
      type: String
    - contextPath: AdminByRequest.Request.requestTime
      description: The time the request was made.
      type: Date
    - contextPath: AdminByRequest.Request.startTime
      description: The start time of the request.
      type: Date
    - contextPath: AdminByRequest.Request.eventText
      description: The text of the request.
      type: String
    - contextPath: AdminByRequest.Request.eventTime
      description: The time the request occurred.
      type: Date
  - name: adminbyrequest-request-approve
    description: Approves a request in AdminByRequest.
    arguments:
    - name: request_id
      description: The ID of the request to approve.
      required: true
    - name: approved_by
      description: Has to be an email address that matches a portal user, otherwise it will be ignored.
      required: false
  - name: adminbyrequest-request-deny
    description: Denies a request in AdminByRequest.
    arguments:
    - name: request_id
      description: The ID of the request to deny.
      required: true
    - name: denied_by
      description: Has to be an email address that matches a portal user, otherwise it will be ignored.
      required: false
    - name: reason
      description: The reason for denying the request.
      required: false
  isfetch: false
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  isfetchevents:xsoar: false
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
marketplaces:
- marketplacev2
- platform
- xsoar
tests:
- No tests (auto formatted)