ArgusManagedDefence
Rapidly detect, analyse and respond to security threats with mnemonic’s leading Managed Detection and Response (MDR) service.
Data Enrichment & Threat Intelligence · mnemonic MDR
Details
| ID | ArgusManagedDefence |
|---|---|
| Provider | mnemonic |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.0.0 |
| Docker Image | demisto/argus-toolbelt:3.0.0.2055215 |
| Supported Modules | Agentix XSIAM |
README
Rapidly detect, analyse and respond to security threats with mnemonic’s leading Managed Detection and Response (MDR) service.
This integration was integrated and tested with version 5.1.1 argus-toolbelt (PyPi).
Configure ArgusManagedDefence in Cortex
| Parameter | Description | Required |
|---|---|---|
| Fetch incidents | Defines if this integration fetches incidents. | False |
| Incident type | Should be set to Argus Case. | False |
| API URL | URL to Argus’ API Endpoint. | True |
| API Key | API Key of API user in Argus. | True |
| Minimum severity of alerts to fetch | Argus Cases with priority lower than this value will be excluded by fetch incidents. | True |
| First fetch time | How far back should the first run fetch open cases in Argus. | False |
| Maximum number of incidents per fetch | Maximum number of cases to be fetched from Argus. 0 means up to system limit (100 000) | False |
| Fetch incidents exclude tag | Excludes fetching incidents with the optional tag. May be used to exclude fetching Argus Cases created by XSOAR. Tags in Argus are of key: value pairs. You may exclude with tag key, or key: value pairs by a comma-separated string. | False |
| Incident Mirroring Direction | Which direction should the integration mirror incidents. | False |
| Mirroring tag | Names of tags used to mark incident entries to be mirrored. Comma separated. | False |
| Close Argus Case | If true, when an incident is closed in XSOAR: close the mirrored Argus Case | False |
| Close XSOAR Incident | If true, when mirrored Argus Case is closed: also close the XSOAR Incident | False |
| Trust any certificate (not secure) | Skip HTTPS certification verification. | False |
| Use system proxy settings | Use system proxy settings. | False |
Mirroring
This integration supports in- and outbound mirroring of incidents.
Case comments are added as incident notes and case attachments added as files.
Tags and events are fetched and placed in context.
Configuration
You should set the mirroring direction parameter to the appropriate mirroring direction(s). If you are mirroring out, please note that all War Room entries you want added to Argus must be attached with the same tag as configured as the integration parameter Mirroring tag.
Excluding cases / creating Argus Cases from XSOAR
If you wish to create an Argus Case from an incident you should configure the integration to exclude fetching incidents with and appropriate tag and ensure that the new Argus Case has this tag.
This will ensure that this Argus Case is not fetched back by the integration and a new incident created.
An example use case could be that you are running an XSOAR incident for a while for internal purposes before you wish to create an Argus Case.
Example
!argus-create-case subject=<...> description=<...> service=<...> type=<...> tags=<exclude_tag>
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
argus-get-attachment
Fetch specific attachment metadata
Base Command
argus-add-attachment
Add attachment to case (Max 50 MB, should be an archive)
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case. | Required |
| file_id | ID of attachment. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Attachment.responseCode | Number | API response metadata, response code of this request |
| Argus.Attachment.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Attachment.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Attachment.count | Number | API response metadata, total number of results this query has |
| Argus.Attachment.size | Number | API response metadata, the number of results returned in this request |
| Argus.Attachment.messages.message | String | Attachment Messages Message |
| Argus.Attachment.messages.messageTemplate | String | Attachment Messages Message Template |
| Argus.Attachment.messages.type | String | Attachment Messages Type |
| Argus.Attachment.messages.field | String | Attachment Messages Field |
| Argus.Attachment.messages.timestamp | Number | Attachment Messages Timestamp |
| Argus.Attachment.data.id | String | Attachment ID |
| Argus.Attachment.data.addedTimestamp | Number | Attachment Added Timestamp |
| Argus.Attachment.data.addedByUser.id | Number | Attachment Added By User ID |
| Argus.Attachment.data.addedByUser.customerID | Number | Attachment Added By User Customer ID |
| Argus.Attachment.data.addedByUser.customer.id | Number | Attachment Added By User Customer ID |
| Argus.Attachment.data.addedByUser.customer.name | String | Attachment Added By User Customer Name |
| Argus.Attachment.data.addedByUser.customer.shortName | String | Attachment Added By User Customer Short Name |
| Argus.Attachment.data.addedByUser.customer.domain.id | Number | Attachment Added By User Customer Domain ID |
| Argus.Attachment.data.addedByUser.customer.domain.name | String | Attachment Added By User Customer Domain Name |
| Argus.Attachment.data.addedByUser.domain.id | Number | Attachment Added By User Domain ID |
| Argus.Attachment.data.addedByUser.domain.name | String | Attachment Added By User Domain Name |
| Argus.Attachment.data.addedByUser.userName | String | Attachment Added By User User Name |
| Argus.Attachment.data.addedByUser.name | String | Attachment Added By User Name |
| Argus.Attachment.data.addedByUser.type | String | Attachment Added By User Type |
| Argus.Attachment.data.name | String | Attachment Name |
| Argus.Attachment.data.mimeType | String | Attachment Mime Type |
| Argus.Attachment.data.flags | String | Attachment Flags |
| Argus.Attachment.data.size | Number | API response metadata, the number of results returned in this request |
| Argus.Attachment.data.originEmailAddress | String | Attachment Origin Email Address |
| Argus.Attachment.data.addedTime | String | Attachment Added Time |
Command Example
!argus-add-attachment case_id=123 file_id=1@1
argus-add-case-tag
Adds a key, value tag to an Argus case
Base Command
argus-add-case-tag
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID to add tag to. | Required |
| key | Key of tag to add to case. | Required |
| value | Value of tag to add to case. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Tags.responseCode | Number | API response metadata, response code of this request |
| Argus.Tags.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Tags.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Tags.count | Number | API response metadata, total number of results this query has |
| Argus.Tags.size | Number | API response metadata, the number of results returned in this request |
| Argus.Tags.messages.message | String | Tag Messages Message |
| Argus.Tags.messages.messageTemplate | String | Tag Messages Message Template |
| Argus.Tags.messages.type | String | Tag Messages Type |
| Argus.Tags.messages.field | String | Tag Messages Field |
| Argus.Tags.messages.timestamp | Number | Tag Messages Timestamp |
| Argus.Tags.data.id | String | Tag ID |
| Argus.Tags.data.key | String | Tag Key |
| Argus.Tags.data.value | String | Tag Value |
| Argus.Tags.data.addedTimestamp | Number | Tag Added Timestamp |
| Argus.Tags.data.addedByUser.id | Number | Tag Added By User ID |
| Argus.Tags.data.addedByUser.customerID | Number | Tag Added By User Customer ID |
| Argus.Tags.data.addedByUser.customer.id | Number | Tag Added By User Customer ID |
| Argus.Tags.data.addedByUser.customer.name | String | Tag Added By User Customer Name |
| Argus.Tags.data.addedByUser.customer.shortName | String | Tag Added By User Customer Short Name |
| Argus.Tags.data.addedByUser.customer.domain.id | Number | Tag Added By User Customer Domain ID |
| Argus.Tags.data.addedByUser.customer.domain.name | String | Tag Added By User Customer Domain Name |
| Argus.Tags.data.addedByUser.domain.id | Number | Tag Added By User Domain ID |
| Argus.Tags.data.addedByUser.domain.name | String | Tag Added By User Domain Name |
| Argus.Tags.data.addedByUser.userName | String | Tag Added By User User Name |
| Argus.Tags.data.addedByUser.name | String | Tag Added By User Name |
| Argus.Tags.data.addedByUser.type | String | Tag Added By User Type |
| Argus.Tags.data.flags | String | Tag Flags |
| Argus.Tags.data.addedTime | String | Tag Added Time |
Command Example
!argus-add-case-tag case_id=123 key=foo value=bar
argus-list-case-tags
List tags attached to an Argus case
Base Command
argus-list-case-tags
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID . | Required |
| limit | Limit the amount of fetched tags. (Default 25). | Optional |
| offset | Skip a number of results. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Tags.responseCode | Number | API response metadata, response code of this request |
| Argus.Tags.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Tags.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Tags.count | Number | API response metadata, total number of results this query has |
| Argus.Tags.size | Number | API response metadata, the number of results returned in this request |
| Argus.Tags.messages.message | String | Tag Messages Message |
| Argus.Tags.messages.messageTemplate | String | Tag Messages Message Template |
| Argus.Tags.messages.type | String | Tag Messages Type |
| Argus.Tags.messages.field | String | Tag Messages Field |
| Argus.Tags.messages.timestamp | Number | Tag Messages Timestamp |
| Argus.Tags.data.id | String | Tag ID |
| Argus.Tags.data.key | String | Tag Key |
| Argus.Tags.data.value | String | Tag Value |
| Argus.Tags.data.addedTimestamp | Number | Tag Added Timestamp |
| Argus.Tags.data.addedByUser.id | Number | Tag Added By User ID |
| Argus.Tags.data.addedByUser.customerID | Number | Tag Added By User Customer ID |
| Argus.Tags.data.addedByUser.customer.id | Number | Tag Added By User Customer ID |
| Argus.Tags.data.addedByUser.customer.name | String | Tag Added By User Customer Name |
| Argus.Tags.data.addedByUser.customer.shortName | String | Tag Added By User Customer Short Name |
| Argus.Tags.data.addedByUser.customer.domain.id | Number | Tag Added By User Customer Domain ID |
| Argus.Tags.data.addedByUser.customer.domain.name | String | Tag Added By User Customer Domain Name |
| Argus.Tags.data.addedByUser.domain.id | Number | Tag Added By User Domain ID |
| Argus.Tags.data.addedByUser.domain.name | String | Tag Added By User Domain Name |
| Argus.Tags.data.addedByUser.userName | String | Tag Added By User User Name |
| Argus.Tags.data.addedByUser.name | String | Tag Added By User Name |
| Argus.Tags.data.addedByUser.type | String | Tag Added By User Type |
| Argus.Tags.data.flags | String | Tag Flags |
| Argus.Tags.data.addedTime | String | Tag Added Time |
Command Example
!argus-list-case-tags case_id=123
argus-add-comment
Add comment to an Argus case
Base Command
argus-add-comment
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID. | Required |
| comment | The comment to attach. | Required |
| as_reply_to | ID of comment this comment will reply to. | Optional |
| internal | Whether this comment will be shown to the customer. Possible values are: false, true. Default is false. | Optional |
| origin_email_address | Define the e-mail address this comment originates from. | Optional |
| associated_attachment_id | ID of case attachement this comment is related to. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Comment.responseCode | Number | API response metadata, response code of this request |
| Argus.Comment.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Comment.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Comment.count | Number | API response metadata, total number of results this query has |
| Argus.Comment.size | Number | API response metadata, the number of results returned in this request |
| Argus.Comment.messages.message | String | Comment Messages Message |
| Argus.Comment.messages.messageTemplate | String | Comment Messages Message Template |
| Argus.Comment.messages.type | String | Comment Messages Type |
| Argus.Comment.messages.field | String | Comment Messages Field |
| Argus.Comment.messages.timestamp | Number | Comment Messages Timestamp |
| Argus.Comment.data.id | String | Comment ID |
| Argus.Comment.data.addedTimestamp | Number | Comment Added Timestamp |
| Argus.Comment.data.addedByUser.id | Number | Comment Added By User ID |
| Argus.Comment.data.addedByUser.customerID | Number | Comment Added By User Customer ID |
| Argus.Comment.data.addedByUser.customer.id | Number | Comment Added By User Customer ID |
| Argus.Comment.data.addedByUser.customer.name | String | Comment Added By User Customer Name |
| Argus.Comment.data.addedByUser.customer.shortName | String | Comment Added By User Customer Short Name |
| Argus.Comment.data.addedByUser.customer.domain.id | Number | Comment Added By User Customer Domain ID |
| Argus.Comment.data.addedByUser.customer.domain.name | String | Comment Added By User Customer Domain Name |
| Argus.Comment.data.addedByUser.domain.id | Number | Comment Added By User Domain ID |
| Argus.Comment.data.addedByUser.domain.name | String | Comment Added By User Domain Name |
| Argus.Comment.data.addedByUser.userName | String | Comment Added By User User Name |
| Argus.Comment.data.addedByUser.name | String | Comment Added By User Name |
| Argus.Comment.data.addedByUser.type | String | Comment Added By User Type |
| Argus.Comment.data.comment | String | Comment Comment |
| Argus.Comment.data.flags | String | Comment Flags |
| Argus.Comment.data.lastUpdatedTimestamp | Number | Comment Last Updated Timestamp |
| Argus.Comment.data.status | String | Comment Status |
| Argus.Comment.data.priority | String | Comment Priority |
| Argus.Comment.data.originEmailAddress | String | Comment Origin Email Address |
| Argus.Comment.data.associatedAttachments.id | String | Comment Associated Attachments ID |
| Argus.Comment.data.associatedAttachments.name | String | Comment Associated Attachments Name |
| Argus.Comment.data.references.type | String | Comment References Type |
| Argus.Comment.data.references.commentID | String | Comment References Comment ID |
| Argus.Comment.data.lastUpdatedTime | String | Comment Last Updated Time |
| Argus.Comment.data.addedTime | String | Comment Added Time |
Command Example
!argus-add-comment case_id=123 comment="this is a comment"
argus-list-case-comments
List the comments of an Argus case
Base Command
argus-list-case-comments
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID of Argus case. | Required |
| before_comment | Limit to comments before this comment ID (in sort order). Possible values are: . | Optional |
| offset | Skip a number of results (default 0). | Optional |
| limit | Maximum number of returned results (default 25). | Optional |
| sort_by | Sort ordering. Default is ascending. Possible values are: ascending, descending. | Optional |
| after_comment | Limit to comments after this comment ID (in sort order). | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Comments.responseCode | Number | API response metadata, response code of this request |
| Argus.Comments.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Comments.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Comments.count | Number | API response metadata, total number of results this query has |
| Argus.Comments.size | Number | API response metadata, the number of results returned in this request |
| Argus.Comments.messages.message | String | Comment Messages Message |
| Argus.Comments.messages.messageTemplate | String | Comment Messages Message Template |
| Argus.Comments.messages.type | String | Comment Messages Type |
| Argus.Comments.messages.field | String | Comment Messages Field |
| Argus.Comments.messages.timestamp | Number | Comment Messages Timestamp |
| Argus.Comments.data.id | String | Comment ID |
| Argus.Comments.data.addedTimestamp | Number | Comment Added Timestamp |
| Argus.Comments.data.addedByUser.id | Number | Comment Added By User ID |
| Argus.Comments.data.addedByUser.customerID | Number | Comment Added By User Customer ID |
| Argus.Comments.data.addedByUser.customer.id | Number | Comment Added By User Customer ID |
| Argus.Comments.data.addedByUser.customer.name | String | Comment Added By User Customer Name |
| Argus.Comments.data.addedByUser.customer.shortName | String | Comment Added By User Customer Short Name |
| Argus.Comments.data.addedByUser.customer.domain.id | Number | Comment Added By User Customer Domain ID |
| Argus.Comments.data.addedByUser.customer.domain.name | String | Comment Added By User Customer Domain Name |
| Argus.Comments.data.addedByUser.domain.id | Number | Comment Added By User Domain ID |
| Argus.Comments.data.addedByUser.domain.name | String | Comment Added By User Domain Name |
| Argus.Comments.data.addedByUser.userName | String | Comment Added By User User Name |
| Argus.Comments.data.addedByUser.name | String | Comment Added By User Name |
| Argus.Comments.data.addedByUser.type | String | Comment Added By User Type |
| Argus.Comments.data.comment | String | Comment Comment |
| Argus.Comments.data.flags | String | Comment Flags |
| Argus.Comments.data.lastUpdatedTimestamp | Number | Comment Last Updated Timestamp |
| Argus.Comments.data.status | String | Comment Status |
| Argus.Comments.data.priority | String | Comment Priority |
| Argus.Comments.data.originEmailAddress | String | Comment Origin Email Address |
| Argus.Comments.data.associatedAttachments.id | String | Comment Associated Attachments ID |
| Argus.Comments.data.associatedAttachments.name | String | Comment Associated Attachments Name |
| Argus.Comments.data.references.type | String | Comment References Type |
| Argus.Comments.data.references.commentID | String | Comment References Comment ID |
| Argus.Comments.data.lastUpdatedTime | String | Comment Last Updated Time |
| Argus.Comments.data.addedTime | String | Comment Added Time |
Command Example
!argus_list_case_comments case_id=123
argus-advanced-case-search
Returns cases matching the defined case search criteria
Base Command
argus-advanced-case-search
Input
| Argument Name | Description | Required |
|---|---|---|
| start_timestamp | Start timestamp. Possible values are: . | Optional |
| end_timestamp | End timestamp. | Optional |
| limit | Set this value to set max number of results. By default, no restriction on result set size. | Optional |
| offset | Set this value to skip the first (offset) objects. By default, return result from first object. . | Optional |
| include_deleted | Set to true to include deleted objects. By default, exclude deleted objects. Possible values are: true, false. Default is false. | Optional |
| sub_criteria | Set additional criterias which are applied using a logical OR. | Optional |
| exclude | Only relevant for subcriteria. If set to true, objects matching this subcriteria object will be excluded. . Possible values are: true, false. | Optional |
| required | Only relevant for subcriteria. If set to true, objects matching this subcriteria are required (AND-ed together with parent criteria). . Possible values are: true, false. | Optional |
| customer_id | Restrict search to data belonging to specified customers. . | Optional |
| case_id | Restrict search to specific cases (by ID). . | Optional |
| customer | Restrict search to specific customers (by ID or shortname). . | Optional |
| case_type | Restrict search to entries of one of these types. | Optional |
| service | Restrict search to entries of one of these services (by service shortname or ID). . | Optional |
| category | Restrict search to entries of one of these categories (by category shortname or ID). | Optional |
| status | Restrict search to entries of one of these statuses. . | Optional |
| priority | Restrict search to entries with given priorties. | Optional |
| asset_id | Restrict search to cases associated with specified assets (hosts, services or processes). | Optional |
| tag | Restrict search to entries matching the given tag criteria. . | Optional |
| workflow | Restrict search to entries matching the given workflow criteria. . | Optional |
| field | Restrict search to entries matching the given field criteria. . | Optional |
| keywords | Search for keywords. | Optional |
| time_field_strategy | Defines which timestamps will be included in the search (default all). . | Optional |
| time_match_strategy | Defines how strict to match against different timestamps (all/any) using start and end timestamp (default any). | Optional |
| keyword_field_strategy | Defines which fields will be searched by keywords (default all supported fields). . | Optional |
| keyword_match_strategy | Defines the MatchStrategy for keywords (default match all keywords). . | Optional |
| user | Restrict search to cases associated with these users or user groups (by ID or shortname). . | Optional |
| user_field_strategy | Defines which user fields will be searched (default match all user fields). . | Optional |
| user_assigned | If set, limit search to cases where assignedUser field is set/unset. Possible values are: true, false. | Optional |
| tech_assigned | If set, limit search to cases where assignedTech field is set/unset. Possible values are: true, false. | Optional |
| include_workflows | If true, include list of workflows in result. Default is false (not present). . Possible values are: true, false. Default is false. | Optional |
| include_description | If false, omit description from response. Default is true (description is present). . Possible values are: true, false. Default is true. | Optional |
| access_mode | If set, only match cases which is set to one of these access modes. | Optional |
| explicit_access | If set, only match cases which have explicit access grants matching the specified criteria. | Optional |
| sort_by | List of properties to sort by (prefix with “-“ to sort descending). | Optional |
| include_flags | Only include objects which have includeFlags set. . | Optional |
| exclude_flags | Exclude objects which have excludeFlags set. . | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Cases.responseCode | Number | API response metadata, response code of this request |
| Argus.Cases.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Cases.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Cases.count | Number | API response metadata, total number of results this query has |
| Argus.Cases.size | Number | API response metadata, the number of results returned in this request |
| Argus.Cases.messages.message | String | Case Messages Message |
| Argus.Cases.messages.messageTemplate | String | Case Messages Message Template |
| Argus.Cases.messages.type | String | Case Messages Type |
| Argus.Cases.messages.field | String | Case Messages Field |
| Argus.Cases.messages.timestamp | Number | Case Messages Timestamp |
| Argus.Cases.data.id | Number | Case ID |
| Argus.Cases.data.customer.id | Number | Case Customer ID |
| Argus.Cases.data.customer.name | String | Case Customer Name |
| Argus.Cases.data.customer.shortName | String | Case Customer Short Name |
| Argus.Cases.data.customer.domain.id | Number | Case Customer Domain ID |
| Argus.Cases.data.customer.domain.name | String | Case Customer Domain Name |
| Argus.Cases.data.service.id | Number | Case Service ID |
| Argus.Cases.data.service.name | String | Case Service Name |
| Argus.Cases.data.service.shortName | String | Case Service Short Name |
| Argus.Cases.data.service.localizedName | String | Case Service Localized Name |
| Argus.Cases.data.category.id | Number | Case Category ID |
| Argus.Cases.data.category.name | String | Case Category Name |
| Argus.Cases.data.category.shortName | String | Case Category Short Name |
| Argus.Cases.data.category.localizedName | String | Case Category Localized Name |
| Argus.Cases.data.type | String | Case Type |
| Argus.Cases.data.initialStatus | String | Case Initial Status |
| Argus.Cases.data.status | String | Case Status |
| Argus.Cases.data.initialPriority | String | Case Initial Priority |
| Argus.Cases.data.priority | String | Case Priority |
| Argus.Cases.data.subject | String | Case Subject |
| Argus.Cases.data.description | String | Case Description |
| Argus.Cases.data.customerReference | String | Case Customer Reference |
| Argus.Cases.data.accessMode | String | Case Access Mode |
| Argus.Cases.data.reporter.id | Number | Case Reporter ID |
| Argus.Cases.data.reporter.customerID | Number | Case Reporter Customer ID |
| Argus.Cases.data.reporter.customer.id | Number | Case Reporter Customer ID |
| Argus.Cases.data.reporter.customer.name | String | Case Reporter Customer Name |
| Argus.Cases.data.reporter.customer.shortName | String | Case Reporter Customer Short Name |
| Argus.Cases.data.reporter.customer.domain.id | Number | Case Reporter Customer Domain ID |
| Argus.Cases.data.reporter.customer.domain.name | String | Case Reporter Customer Domain Name |
| Argus.Cases.data.reporter.domain.id | Number | Case Reporter Domain ID |
| Argus.Cases.data.reporter.domain.name | String | Case Reporter Domain Name |
| Argus.Cases.data.reporter.userName | String | Case Reporter User Name |
| Argus.Cases.data.reporter.name | String | Case Reporter Name |
| Argus.Cases.data.reporter.type | String | Case Reporter Type |
| Argus.Cases.data.assignedUser.id | Number | Case Assigned User ID |
| Argus.Cases.data.assignedUser.customerID | Number | Case Assigned User Customer ID |
| Argus.Cases.data.assignedUser.customer.id | Number | Case Assigned User Customer ID |
| Argus.Cases.data.assignedUser.customer.name | String | Case Assigned User Customer Name |
| Argus.Cases.data.assignedUser.customer.shortName | String | Case Assigned User Customer Short Name |
| Argus.Cases.data.assignedUser.customer.domain.id | Number | Case Assigned User Customer Domain ID |
| Argus.Cases.data.assignedUser.customer.domain.name | String | Case Assigned User Customer Domain Name |
| Argus.Cases.data.assignedUser.domain.id | Number | Case Assigned User Domain ID |
| Argus.Cases.data.assignedUser.domain.name | String | Case Assigned User Domain Name |
| Argus.Cases.data.assignedUser.userName | String | Case Assigned User User Name |
| Argus.Cases.data.assignedUser.name | String | Case Assigned User Name |
| Argus.Cases.data.assignedUser.type | String | Case Assigned User Type |
| Argus.Cases.data.assignedTech.id | Number | Case Assigned Tech ID |
| Argus.Cases.data.assignedTech.customerID | Number | Case Assigned Tech Customer ID |
| Argus.Cases.data.assignedTech.customer.id | Number | Case Assigned Tech Customer ID |
| Argus.Cases.data.assignedTech.customer.name | String | Case Assigned Tech Customer Name |
| Argus.Cases.data.assignedTech.customer.shortName | String | Case Assigned Tech Customer Short Name |
| Argus.Cases.data.assignedTech.customer.domain.id | Number | Case Assigned Tech Customer Domain ID |
| Argus.Cases.data.assignedTech.customer.domain.name | String | Case Assigned Tech Customer Domain Name |
| Argus.Cases.data.assignedTech.domain.id | Number | Case Assigned Tech Domain ID |
| Argus.Cases.data.assignedTech.domain.name | String | Case Assigned Tech Domain Name |
| Argus.Cases.data.assignedTech.userName | String | Case Assigned Tech User Name |
| Argus.Cases.data.assignedTech.name | String | Case Assigned Tech Name |
| Argus.Cases.data.assignedTech.type | String | Case Assigned Tech Type |
| Argus.Cases.data.createdTimestamp | Number | Case Created Timestamp |
| Argus.Cases.data.createdByUser.id | Number | Case Created By User ID |
| Argus.Cases.data.createdByUser.customerID | Number | Case Created By User Customer ID |
| Argus.Cases.data.createdByUser.customer.id | Number | Case Created By User Customer ID |
| Argus.Cases.data.createdByUser.customer.name | String | Case Created By User Customer Name |
| Argus.Cases.data.createdByUser.customer.shortName | String | Case Created By User Customer Short Name |
| Argus.Cases.data.createdByUser.customer.domain.id | Number | Case Created By User Customer Domain ID |
| Argus.Cases.data.createdByUser.customer.domain.name | String | Case Created By User Customer Domain Name |
| Argus.Cases.data.createdByUser.domain.id | Number | Case Created By User Domain ID |
| Argus.Cases.data.createdByUser.domain.name | String | Case Created By User Domain Name |
| Argus.Cases.data.createdByUser.userName | String | Case Created By User User Name |
| Argus.Cases.data.createdByUser.name | String | Case Created By User Name |
| Argus.Cases.data.createdByUser.type | String | Case Created By User Type |
| Argus.Cases.data.lastUpdatedTimestamp | Number | Case Last Updated Timestamp |
| Argus.Cases.data.lastUpdatedByUser.id | Number | Case Last Updated By User ID |
| Argus.Cases.data.lastUpdatedByUser.customerID | Number | Case Last Updated By User Customer ID |
| Argus.Cases.data.lastUpdatedByUser.customer.id | Number | Case Last Updated By User Customer ID |
| Argus.Cases.data.lastUpdatedByUser.customer.name | String | Case Last Updated By User Customer Name |
| Argus.Cases.data.lastUpdatedByUser.customer.shortName | String | Case Last Updated By User Customer Short Name |
| Argus.Cases.data.lastUpdatedByUser.customer.domain.id | Number | Case Last Updated By User Customer Domain ID |
| Argus.Cases.data.lastUpdatedByUser.customer.domain.name | String | Case Last Updated By User Customer Domain Name |
| Argus.Cases.data.lastUpdatedByUser.domain.id | Number | Case Last Updated By User Domain ID |
| Argus.Cases.data.lastUpdatedByUser.domain.name | String | Case Last Updated By User Domain Name |
| Argus.Cases.data.lastUpdatedByUser.userName | String | Case Last Updated By User User Name |
| Argus.Cases.data.lastUpdatedByUser.name | String | Case Last Updated By User Name |
| Argus.Cases.data.lastUpdatedByUser.type | String | Case Last Updated By User Type |
| Argus.Cases.data.closedTimestamp | Number | Case Closed Timestamp |
| Argus.Cases.data.closedByUser.id | Number | Case Closed By User ID |
| Argus.Cases.data.closedByUser.customerID | Number | Case Closed By User Customer ID |
| Argus.Cases.data.closedByUser.customer.id | Number | Case Closed By User Customer ID |
| Argus.Cases.data.closedByUser.customer.name | String | Case Closed By User Customer Name |
| Argus.Cases.data.closedByUser.customer.shortName | String | Case Closed By User Customer Short Name |
| Argus.Cases.data.closedByUser.customer.domain.id | Number | Case Closed By User Customer Domain ID |
| Argus.Cases.data.closedByUser.customer.domain.name | String | Case Closed By User Customer Domain Name |
| Argus.Cases.data.closedByUser.domain.id | Number | Case Closed By User Domain ID |
| Argus.Cases.data.closedByUser.domain.name | String | Case Closed By User Domain Name |
| Argus.Cases.data.closedByUser.userName | String | Case Closed By User User Name |
| Argus.Cases.data.closedByUser.name | String | Case Closed By User Name |
| Argus.Cases.data.closedByUser.type | String | Case Closed By User Type |
| Argus.Cases.data.publishedTimestamp | Number | Case Published Timestamp |
| Argus.Cases.data.publishedByUser.id | Number | Case Published By User ID |
| Argus.Cases.data.publishedByUser.customerID | Number | Case Published By User Customer ID |
| Argus.Cases.data.publishedByUser.customer.id | Number | Case Published By User Customer ID |
| Argus.Cases.data.publishedByUser.customer.name | String | Case Published By User Customer Name |
| Argus.Cases.data.publishedByUser.customer.shortName | String | Case Published By User Customer Short Name |
| Argus.Cases.data.publishedByUser.customer.domain.id | Number | Case Published By User Customer Domain ID |
| Argus.Cases.data.publishedByUser.customer.domain.name | String | Case Published By User Customer Domain Name |
| Argus.Cases.data.publishedByUser.domain.id | Number | Case Published By User Domain ID |
| Argus.Cases.data.publishedByUser.domain.name | String | Case Published By User Domain Name |
| Argus.Cases.data.publishedByUser.userName | String | Case Published By User User Name |
| Argus.Cases.data.publishedByUser.name | String | Case Published By User Name |
| Argus.Cases.data.publishedByUser.type | String | Case Published By User Type |
| Argus.Cases.data.flags | String | Case Flags |
| Argus.Cases.data.currentUserAccess.level | String | Case Current User Access Level |
| Argus.Cases.data.currentUserAccess.role | String | Case Current User Access Role |
| Argus.Cases.data.workflows.workflow | String | Case Workflows Workflow |
| Argus.Cases.data.workflows.state | String | Case Workflows State |
| Argus.Cases.data.originEmailAddress | String | Case Origin Email Address |
| Argus.Cases.data.createdTime | String | Case Created Time |
| Argus.Cases.data.lastUpdatedTime | String | Case Last Updated Time |
| Argus.Cases.data.closedTime | String | Case Closed Time |
| Argus.Cases.data.publishedTime | String | Case Published Time |
Command Example
!argus-advanced-case-search
argus-close-case
Close an Argus case
Base Command
argus-close-case
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID of Argus case. | Required |
| comment | Attach a closing comment. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Case.responseCode | Number | API response metadata, response code of this request |
| Argus.Case.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Case.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Case.count | Number | API response metadata, total number of results this query has |
| Argus.Case.size | Number | API response metadata, the number of results returned in this request |
| Argus.Case.messages.message | String | Case Messages Message |
| Argus.Case.messages.messageTemplate | String | Case Messages Message Template |
| Argus.Case.messages.type | String | Case Messages Type |
| Argus.Case.messages.field | String | Case Messages Field |
| Argus.Case.messages.timestamp | Number | Case Messages Timestamp |
| Argus.Case.data.id | Number | Case ID |
| Argus.Case.data.customer.id | Number | Case Customer ID |
| Argus.Case.data.customer.name | String | Case Customer Name |
| Argus.Case.data.customer.shortName | String | Case Customer Short Name |
| Argus.Case.data.customer.domain.id | Number | Case Customer Domain ID |
| Argus.Case.data.customer.domain.name | String | Case Customer Domain Name |
| Argus.Case.data.service.id | Number | Case Service ID |
| Argus.Case.data.service.name | String | Case Service Name |
| Argus.Case.data.service.shortName | String | Case Service Short Name |
| Argus.Case.data.service.localizedName | String | Case Service Localized Name |
| Argus.Case.data.category.id | Number | Case Category ID |
| Argus.Case.data.category.name | String | Case Category Name |
| Argus.Case.data.category.shortName | String | Case Category Short Name |
| Argus.Case.data.category.localizedName | String | Case Category Localized Name |
| Argus.Case.data.type | String | Case Type |
| Argus.Case.data.initialStatus | String | Case Initial Status |
| Argus.Case.data.status | String | Case Status |
| Argus.Case.data.initialPriority | String | Case Initial Priority |
| Argus.Case.data.priority | String | Case Priority |
| Argus.Case.data.subject | String | Case Subject |
| Argus.Case.data.description | String | Case Description |
| Argus.Case.data.customerReference | String | Case Customer Reference |
| Argus.Case.data.accessMode | String | Case Access Mode |
| Argus.Case.data.reporter.id | Number | Case Reporter ID |
| Argus.Case.data.reporter.customerID | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.id | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.name | String | Case Reporter Customer Name |
| Argus.Case.data.reporter.customer.shortName | String | Case Reporter Customer Short Name |
| Argus.Case.data.reporter.customer.domain.id | Number | Case Reporter Customer Domain ID |
| Argus.Case.data.reporter.customer.domain.name | String | Case Reporter Customer Domain Name |
| Argus.Case.data.reporter.domain.id | Number | Case Reporter Domain ID |
| Argus.Case.data.reporter.domain.name | String | Case Reporter Domain Name |
| Argus.Case.data.reporter.userName | String | Case Reporter User Name |
| Argus.Case.data.reporter.name | String | Case Reporter Name |
| Argus.Case.data.reporter.type | String | Case Reporter Type |
| Argus.Case.data.assignedUser.id | Number | Case Assigned User ID |
| Argus.Case.data.assignedUser.customerID | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.id | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.name | String | Case Assigned User Customer Name |
| Argus.Case.data.assignedUser.customer.shortName | String | Case Assigned User Customer Short Name |
| Argus.Case.data.assignedUser.customer.domain.id | Number | Case Assigned User Customer Domain ID |
| Argus.Case.data.assignedUser.customer.domain.name | String | Case Assigned User Customer Domain Name |
| Argus.Case.data.assignedUser.domain.id | Number | Case Assigned User Domain ID |
| Argus.Case.data.assignedUser.domain.name | String | Case Assigned User Domain Name |
| Argus.Case.data.assignedUser.userName | String | Case Assigned User User Name |
| Argus.Case.data.assignedUser.name | String | Case Assigned User Name |
| Argus.Case.data.assignedUser.type | String | Case Assigned User Type |
| Argus.Case.data.assignedTech.id | Number | Case Assigned Tech ID |
| Argus.Case.data.assignedTech.customerID | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.id | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.name | String | Case Assigned Tech Customer Name |
| Argus.Case.data.assignedTech.customer.shortName | String | Case Assigned Tech Customer Short Name |
| Argus.Case.data.assignedTech.customer.domain.id | Number | Case Assigned Tech Customer Domain ID |
| Argus.Case.data.assignedTech.customer.domain.name | String | Case Assigned Tech Customer Domain Name |
| Argus.Case.data.assignedTech.domain.id | Number | Case Assigned Tech Domain ID |
| Argus.Case.data.assignedTech.domain.name | String | Case Assigned Tech Domain Name |
| Argus.Case.data.assignedTech.userName | String | Case Assigned Tech User Name |
| Argus.Case.data.assignedTech.name | String | Case Assigned Tech Name |
| Argus.Case.data.assignedTech.type | String | Case Assigned Tech Type |
| Argus.Case.data.createdTimestamp | Number | Case Created Timestamp |
| Argus.Case.data.createdByUser.id | Number | Case Created By User ID |
| Argus.Case.data.createdByUser.customerID | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.id | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.name | String | Case Created By User Customer Name |
| Argus.Case.data.createdByUser.customer.shortName | String | Case Created By User Customer Short Name |
| Argus.Case.data.createdByUser.customer.domain.id | Number | Case Created By User Customer Domain ID |
| Argus.Case.data.createdByUser.customer.domain.name | String | Case Created By User Customer Domain Name |
| Argus.Case.data.createdByUser.domain.id | Number | Case Created By User Domain ID |
| Argus.Case.data.createdByUser.domain.name | String | Case Created By User Domain Name |
| Argus.Case.data.createdByUser.userName | String | Case Created By User User Name |
| Argus.Case.data.createdByUser.name | String | Case Created By User Name |
| Argus.Case.data.createdByUser.type | String | Case Created By User Type |
| Argus.Case.data.lastUpdatedTimestamp | Number | Case Last Updated Timestamp |
| Argus.Case.data.lastUpdatedByUser.id | Number | Case Last Updated By User ID |
| Argus.Case.data.lastUpdatedByUser.customerID | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.id | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.name | String | Case Last Updated By User Customer Name |
| Argus.Case.data.lastUpdatedByUser.customer.shortName | String | Case Last Updated By User Customer Short Name |
| Argus.Case.data.lastUpdatedByUser.customer.domain.id | Number | Case Last Updated By User Customer Domain ID |
| Argus.Case.data.lastUpdatedByUser.customer.domain.name | String | Case Last Updated By User Customer Domain Name |
| Argus.Case.data.lastUpdatedByUser.domain.id | Number | Case Last Updated By User Domain ID |
| Argus.Case.data.lastUpdatedByUser.domain.name | String | Case Last Updated By User Domain Name |
| Argus.Case.data.lastUpdatedByUser.userName | String | Case Last Updated By User User Name |
| Argus.Case.data.lastUpdatedByUser.name | String | Case Last Updated By User Name |
| Argus.Case.data.lastUpdatedByUser.type | String | Case Last Updated By User Type |
| Argus.Case.data.closedTimestamp | Number | Case Closed Timestamp |
| Argus.Case.data.closedByUser.id | Number | Case Closed By User ID |
| Argus.Case.data.closedByUser.customerID | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.id | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.name | String | Case Closed By User Customer Name |
| Argus.Case.data.closedByUser.customer.shortName | String | Case Closed By User Customer Short Name |
| Argus.Case.data.closedByUser.customer.domain.id | Number | Case Closed By User Customer Domain ID |
| Argus.Case.data.closedByUser.customer.domain.name | String | Case Closed By User Customer Domain Name |
| Argus.Case.data.closedByUser.domain.id | Number | Case Closed By User Domain ID |
| Argus.Case.data.closedByUser.domain.name | String | Case Closed By User Domain Name |
| Argus.Case.data.closedByUser.userName | String | Case Closed By User User Name |
| Argus.Case.data.closedByUser.name | String | Case Closed By User Name |
| Argus.Case.data.closedByUser.type | String | Case Closed By User Type |
| Argus.Case.data.publishedTimestamp | Number | Case Published Timestamp |
| Argus.Case.data.publishedByUser.id | Number | Case Published By User ID |
| Argus.Case.data.publishedByUser.customerID | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.id | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.name | String | Case Published By User Customer Name |
| Argus.Case.data.publishedByUser.customer.shortName | String | Case Published By User Customer Short Name |
| Argus.Case.data.publishedByUser.customer.domain.id | Number | Case Published By User Customer Domain ID |
| Argus.Case.data.publishedByUser.customer.domain.name | String | Case Published By User Customer Domain Name |
| Argus.Case.data.publishedByUser.domain.id | Number | Case Published By User Domain ID |
| Argus.Case.data.publishedByUser.domain.name | String | Case Published By User Domain Name |
| Argus.Case.data.publishedByUser.userName | String | Case Published By User User Name |
| Argus.Case.data.publishedByUser.name | String | Case Published By User Name |
| Argus.Case.data.publishedByUser.type | String | Case Published By User Type |
| Argus.Case.data.flags | String | Case Flags |
| Argus.Case.data.currentUserAccess.level | String | Case Current User Access Level |
| Argus.Case.data.currentUserAccess.role | String | Case Current User Access Role |
| Argus.Case.data.workflows.workflow | String | Case Workflows Workflow |
| Argus.Case.data.workflows.state | String | Case Workflows State |
| Argus.Case.data.originEmailAddress | String | Case Origin Email Address |
| Argus.Case.data.createdTime | String | Case Created Time |
| Argus.Case.data.lastUpdatedTime | String | Case Last Updated Time |
| Argus.Case.data.closedTime | String | Case Closed Time |
| Argus.Case.data.publishedTime | String | Case Published Time |
Command Example
!argus-close-case case_id=123
argus-create-case
Create Argus case
Base Command
argus-create-case
Input
| Argument Name | Description | Required |
|---|---|---|
| customer | ID or shortname of customer to create case for. Defaults to current users customer. | Optional |
| service | ID of service to create case for. Possible values are: ids, support, administrative, advisory, vulnscan. | Required |
| category | If set, assign given category to new case (by category shortname). . Possible values are: network-testing, unauthorized-access, dos, data-leakage, exposed-malicious, malicious-infection, poor-practice, reconnaissance, misconfigured, vpn-down, sensor-malfunctioning, not-receiving-traffic, false-positive, suspected-targeted-attack, duplicate, problem-managed, problem-customer, adware, network-connection-lost, failed-authentication, missing-log-sources, no-threat, phishing, argus-improvement, argus-bug. | Optional |
| type | Type of case to create . Possible values are: operationalIncident, change, securityIncident, informational. | Required |
| status | Status of case to create. If not set, system will select automatically. Creating a new case with status closed is not permitted. . Possible values are: pendingCustomer, pendingSoc, pendingVendor, pendingClose, workingSoc, workingCustomer. | Optional |
| tags | Tags to add on case creation. (key,value,key,value, …). | Optional |
| subject | Subject of case to create. | Required |
| description | Case description. May use HTML, which will be sanitized. . | Required |
| customer_reference | Customer reference for case. | Optional |
| priority | Priority of case to create. (default medium). Possible values are: low, medium, high, critical. Default is medium. | Optional |
| access_mode | Access mode for new case. (default roleBased). | Optional |
| origin_email_address | If case is created from an email, specify origin email address here. | Optional |
| publish | Whether to publish new case. Creating an unpublished case requires special permission. (default true). Possible values are: true, false. Default is true. | Optional |
| default_watchers | Whether to enable default watchers for this case. If set to false, default watchers will not be enabled, and will not be notified upon creation of this case. (default true). Possible values are: true, false. Default is true. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Case.responseCode | Number | API response metadata, response code of this request |
| Argus.Case.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Case.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Case.count | Number | API response metadata, total number of results this query has |
| Argus.Case.size | Number | API response metadata, the number of results returned in this request |
| Argus.Case.messages.message | String | Case Messages Message |
| Argus.Case.messages.messageTemplate | String | Case Messages Message Template |
| Argus.Case.messages.type | String | Case Messages Type |
| Argus.Case.messages.field | String | Case Messages Field |
| Argus.Case.messages.timestamp | Number | Case Messages Timestamp |
| Argus.Case.data.id | Number | Case ID |
| Argus.Case.data.customer.id | Number | Case Customer ID |
| Argus.Case.data.customer.name | String | Case Customer Name |
| Argus.Case.data.customer.shortName | String | Case Customer Short Name |
| Argus.Case.data.customer.domain.id | Number | Case Customer Domain ID |
| Argus.Case.data.customer.domain.name | String | Case Customer Domain Name |
| Argus.Case.data.service.id | Number | Case Service ID |
| Argus.Case.data.service.name | String | Case Service Name |
| Argus.Case.data.service.shortName | String | Case Service Short Name |
| Argus.Case.data.service.localizedName | String | Case Service Localized Name |
| Argus.Case.data.category.id | Number | Case Category ID |
| Argus.Case.data.category.name | String | Case Category Name |
| Argus.Case.data.category.shortName | String | Case Category Short Name |
| Argus.Case.data.category.localizedName | String | Case Category Localized Name |
| Argus.Case.data.type | String | Case Type |
| Argus.Case.data.initialStatus | String | Case Initial Status |
| Argus.Case.data.status | String | Case Status |
| Argus.Case.data.initialPriority | String | Case Initial Priority |
| Argus.Case.data.priority | String | Case Priority |
| Argus.Case.data.subject | String | Case Subject |
| Argus.Case.data.description | String | Case Description |
| Argus.Case.data.customerReference | String | Case Customer Reference |
| Argus.Case.data.accessMode | String | Case Access Mode |
| Argus.Case.data.reporter.id | Number | Case Reporter ID |
| Argus.Case.data.reporter.customerID | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.id | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.name | String | Case Reporter Customer Name |
| Argus.Case.data.reporter.customer.shortName | String | Case Reporter Customer Short Name |
| Argus.Case.data.reporter.customer.domain.id | Number | Case Reporter Customer Domain ID |
| Argus.Case.data.reporter.customer.domain.name | String | Case Reporter Customer Domain Name |
| Argus.Case.data.reporter.domain.id | Number | Case Reporter Domain ID |
| Argus.Case.data.reporter.domain.name | String | Case Reporter Domain Name |
| Argus.Case.data.reporter.userName | String | Case Reporter User Name |
| Argus.Case.data.reporter.name | String | Case Reporter Name |
| Argus.Case.data.reporter.type | String | Case Reporter Type |
| Argus.Case.data.assignedUser.id | Number | Case Assigned User ID |
| Argus.Case.data.assignedUser.customerID | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.id | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.name | String | Case Assigned User Customer Name |
| Argus.Case.data.assignedUser.customer.shortName | String | Case Assigned User Customer Short Name |
| Argus.Case.data.assignedUser.customer.domain.id | Number | Case Assigned User Customer Domain ID |
| Argus.Case.data.assignedUser.customer.domain.name | String | Case Assigned User Customer Domain Name |
| Argus.Case.data.assignedUser.domain.id | Number | Case Assigned User Domain ID |
| Argus.Case.data.assignedUser.domain.name | String | Case Assigned User Domain Name |
| Argus.Case.data.assignedUser.userName | String | Case Assigned User User Name |
| Argus.Case.data.assignedUser.name | String | Case Assigned User Name |
| Argus.Case.data.assignedUser.type | String | Case Assigned User Type |
| Argus.Case.data.assignedTech.id | Number | Case Assigned Tech ID |
| Argus.Case.data.assignedTech.customerID | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.id | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.name | String | Case Assigned Tech Customer Name |
| Argus.Case.data.assignedTech.customer.shortName | String | Case Assigned Tech Customer Short Name |
| Argus.Case.data.assignedTech.customer.domain.id | Number | Case Assigned Tech Customer Domain ID |
| Argus.Case.data.assignedTech.customer.domain.name | String | Case Assigned Tech Customer Domain Name |
| Argus.Case.data.assignedTech.domain.id | Number | Case Assigned Tech Domain ID |
| Argus.Case.data.assignedTech.domain.name | String | Case Assigned Tech Domain Name |
| Argus.Case.data.assignedTech.userName | String | Case Assigned Tech User Name |
| Argus.Case.data.assignedTech.name | String | Case Assigned Tech Name |
| Argus.Case.data.assignedTech.type | String | Case Assigned Tech Type |
| Argus.Case.data.createdTimestamp | Number | Case Created Timestamp |
| Argus.Case.data.createdByUser.id | Number | Case Created By User ID |
| Argus.Case.data.createdByUser.customerID | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.id | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.name | String | Case Created By User Customer Name |
| Argus.Case.data.createdByUser.customer.shortName | String | Case Created By User Customer Short Name |
| Argus.Case.data.createdByUser.customer.domain.id | Number | Case Created By User Customer Domain ID |
| Argus.Case.data.createdByUser.customer.domain.name | String | Case Created By User Customer Domain Name |
| Argus.Case.data.createdByUser.domain.id | Number | Case Created By User Domain ID |
| Argus.Case.data.createdByUser.domain.name | String | Case Created By User Domain Name |
| Argus.Case.data.createdByUser.userName | String | Case Created By User User Name |
| Argus.Case.data.createdByUser.name | String | Case Created By User Name |
| Argus.Case.data.createdByUser.type | String | Case Created By User Type |
| Argus.Case.data.lastUpdatedTimestamp | Number | Case Last Updated Timestamp |
| Argus.Case.data.lastUpdatedByUser.id | Number | Case Last Updated By User ID |
| Argus.Case.data.lastUpdatedByUser.customerID | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.id | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.name | String | Case Last Updated By User Customer Name |
| Argus.Case.data.lastUpdatedByUser.customer.shortName | String | Case Last Updated By User Customer Short Name |
| Argus.Case.data.lastUpdatedByUser.customer.domain.id | Number | Case Last Updated By User Customer Domain ID |
| Argus.Case.data.lastUpdatedByUser.customer.domain.name | String | Case Last Updated By User Customer Domain Name |
| Argus.Case.data.lastUpdatedByUser.domain.id | Number | Case Last Updated By User Domain ID |
| Argus.Case.data.lastUpdatedByUser.domain.name | String | Case Last Updated By User Domain Name |
| Argus.Case.data.lastUpdatedByUser.userName | String | Case Last Updated By User User Name |
| Argus.Case.data.lastUpdatedByUser.name | String | Case Last Updated By User Name |
| Argus.Case.data.lastUpdatedByUser.type | String | Case Last Updated By User Type |
| Argus.Case.data.closedTimestamp | Number | Case Closed Timestamp |
| Argus.Case.data.closedByUser.id | Number | Case Closed By User ID |
| Argus.Case.data.closedByUser.customerID | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.id | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.name | String | Case Closed By User Customer Name |
| Argus.Case.data.closedByUser.customer.shortName | String | Case Closed By User Customer Short Name |
| Argus.Case.data.closedByUser.customer.domain.id | Number | Case Closed By User Customer Domain ID |
| Argus.Case.data.closedByUser.customer.domain.name | String | Case Closed By User Customer Domain Name |
| Argus.Case.data.closedByUser.domain.id | Number | Case Closed By User Domain ID |
| Argus.Case.data.closedByUser.domain.name | String | Case Closed By User Domain Name |
| Argus.Case.data.closedByUser.userName | String | Case Closed By User User Name |
| Argus.Case.data.closedByUser.name | String | Case Closed By User Name |
| Argus.Case.data.closedByUser.type | String | Case Closed By User Type |
| Argus.Case.data.publishedTimestamp | Number | Case Published Timestamp |
| Argus.Case.data.publishedByUser.id | Number | Case Published By User ID |
| Argus.Case.data.publishedByUser.customerID | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.id | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.name | String | Case Published By User Customer Name |
| Argus.Case.data.publishedByUser.customer.shortName | String | Case Published By User Customer Short Name |
| Argus.Case.data.publishedByUser.customer.domain.id | Number | Case Published By User Customer Domain ID |
| Argus.Case.data.publishedByUser.customer.domain.name | String | Case Published By User Customer Domain Name |
| Argus.Case.data.publishedByUser.domain.id | Number | Case Published By User Domain ID |
| Argus.Case.data.publishedByUser.domain.name | String | Case Published By User Domain Name |
| Argus.Case.data.publishedByUser.userName | String | Case Published By User User Name |
| Argus.Case.data.publishedByUser.name | String | Case Published By User Name |
| Argus.Case.data.publishedByUser.type | String | Case Published By User Type |
| Argus.Case.data.flags | String | Case Flags |
| Argus.Case.data.currentUserAccess.level | String | Case Current User Access Level |
| Argus.Case.data.currentUserAccess.role | String | Case Current User Access Role |
| Argus.Case.data.workflows.workflow | String | Case Workflows Workflow |
| Argus.Case.data.workflows.state | String | Case Workflows State |
| Argus.Case.data.originEmailAddress | String | Case Origin Email Address |
| Argus.Case.data.createdTime | String | Case Created Time |
| Argus.Case.data.lastUpdatedTime | String | Case Last Updated Time |
| Argus.Case.data.closedTime | String | Case Closed Time |
| Argus.Case.data.publishedTime | String | Case Published Time |
!argus-create-case subject="test case title" description="test case details" service=administrative type=informational
argus-delete-case
Mark existing case as deleted
Base Command
argus-delete-case
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case to mark as deleted. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Case.responseCode | Number | API response metadata, response code of this request |
| Argus.Case.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Case.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Case.count | Number | API response metadata, total number of results this query has |
| Argus.Case.size | Number | API response metadata, the number of results returned in this request |
| Argus.Case.messages.message | String | Case Messages Message |
| Argus.Case.messages.messageTemplate | String | Case Messages Message Template |
| Argus.Case.messages.type | String | Case Messages Type |
| Argus.Case.messages.field | String | Case Messages Field |
| Argus.Case.messages.timestamp | Number | Case Messages Timestamp |
| Argus.Case.data.id | Number | Case ID |
| Argus.Case.data.customer.id | Number | Case Customer ID |
| Argus.Case.data.customer.name | String | Case Customer Name |
| Argus.Case.data.customer.shortName | String | Case Customer Short Name |
| Argus.Case.data.customer.domain.id | Number | Case Customer Domain ID |
| Argus.Case.data.customer.domain.name | String | Case Customer Domain Name |
| Argus.Case.data.service.id | Number | Case Service ID |
| Argus.Case.data.service.name | String | Case Service Name |
| Argus.Case.data.service.shortName | String | Case Service Short Name |
| Argus.Case.data.service.localizedName | String | Case Service Localized Name |
| Argus.Case.data.category.id | Number | Case Category ID |
| Argus.Case.data.category.name | String | Case Category Name |
| Argus.Case.data.category.shortName | String | Case Category Short Name |
| Argus.Case.data.category.localizedName | String | Case Category Localized Name |
| Argus.Case.data.type | String | Case Type |
| Argus.Case.data.initialStatus | String | Case Initial Status |
| Argus.Case.data.status | String | Case Status |
| Argus.Case.data.initialPriority | String | Case Initial Priority |
| Argus.Case.data.priority | String | Case Priority |
| Argus.Case.data.subject | String | Case Subject |
| Argus.Case.data.description | String | Case Description |
| Argus.Case.data.customerReference | String | Case Customer Reference |
| Argus.Case.data.accessMode | String | Case Access Mode |
| Argus.Case.data.reporter.id | Number | Case Reporter ID |
| Argus.Case.data.reporter.customerID | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.id | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.name | String | Case Reporter Customer Name |
| Argus.Case.data.reporter.customer.shortName | String | Case Reporter Customer Short Name |
| Argus.Case.data.reporter.customer.domain.id | Number | Case Reporter Customer Domain ID |
| Argus.Case.data.reporter.customer.domain.name | String | Case Reporter Customer Domain Name |
| Argus.Case.data.reporter.domain.id | Number | Case Reporter Domain ID |
| Argus.Case.data.reporter.domain.name | String | Case Reporter Domain Name |
| Argus.Case.data.reporter.userName | String | Case Reporter User Name |
| Argus.Case.data.reporter.name | String | Case Reporter Name |
| Argus.Case.data.reporter.type | String | Case Reporter Type |
| Argus.Case.data.assignedUser.id | Number | Case Assigned User ID |
| Argus.Case.data.assignedUser.customerID | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.id | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.name | String | Case Assigned User Customer Name |
| Argus.Case.data.assignedUser.customer.shortName | String | Case Assigned User Customer Short Name |
| Argus.Case.data.assignedUser.customer.domain.id | Number | Case Assigned User Customer Domain ID |
| Argus.Case.data.assignedUser.customer.domain.name | String | Case Assigned User Customer Domain Name |
| Argus.Case.data.assignedUser.domain.id | Number | Case Assigned User Domain ID |
| Argus.Case.data.assignedUser.domain.name | String | Case Assigned User Domain Name |
| Argus.Case.data.assignedUser.userName | String | Case Assigned User User Name |
| Argus.Case.data.assignedUser.name | String | Case Assigned User Name |
| Argus.Case.data.assignedUser.type | String | Case Assigned User Type |
| Argus.Case.data.assignedTech.id | Number | Case Assigned Tech ID |
| Argus.Case.data.assignedTech.customerID | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.id | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.name | String | Case Assigned Tech Customer Name |
| Argus.Case.data.assignedTech.customer.shortName | String | Case Assigned Tech Customer Short Name |
| Argus.Case.data.assignedTech.customer.domain.id | Number | Case Assigned Tech Customer Domain ID |
| Argus.Case.data.assignedTech.customer.domain.name | String | Case Assigned Tech Customer Domain Name |
| Argus.Case.data.assignedTech.domain.id | Number | Case Assigned Tech Domain ID |
| Argus.Case.data.assignedTech.domain.name | String | Case Assigned Tech Domain Name |
| Argus.Case.data.assignedTech.userName | String | Case Assigned Tech User Name |
| Argus.Case.data.assignedTech.name | String | Case Assigned Tech Name |
| Argus.Case.data.assignedTech.type | String | Case Assigned Tech Type |
| Argus.Case.data.createdTimestamp | Number | Case Created Timestamp |
| Argus.Case.data.createdByUser.id | Number | Case Created By User ID |
| Argus.Case.data.createdByUser.customerID | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.id | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.name | String | Case Created By User Customer Name |
| Argus.Case.data.createdByUser.customer.shortName | String | Case Created By User Customer Short Name |
| Argus.Case.data.createdByUser.customer.domain.id | Number | Case Created By User Customer Domain ID |
| Argus.Case.data.createdByUser.customer.domain.name | String | Case Created By User Customer Domain Name |
| Argus.Case.data.createdByUser.domain.id | Number | Case Created By User Domain ID |
| Argus.Case.data.createdByUser.domain.name | String | Case Created By User Domain Name |
| Argus.Case.data.createdByUser.userName | String | Case Created By User User Name |
| Argus.Case.data.createdByUser.name | String | Case Created By User Name |
| Argus.Case.data.createdByUser.type | String | Case Created By User Type |
| Argus.Case.data.lastUpdatedTimestamp | Number | Case Last Updated Timestamp |
| Argus.Case.data.lastUpdatedByUser.id | Number | Case Last Updated By User ID |
| Argus.Case.data.lastUpdatedByUser.customerID | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.id | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.name | String | Case Last Updated By User Customer Name |
| Argus.Case.data.lastUpdatedByUser.customer.shortName | String | Case Last Updated By User Customer Short Name |
| Argus.Case.data.lastUpdatedByUser.customer.domain.id | Number | Case Last Updated By User Customer Domain ID |
| Argus.Case.data.lastUpdatedByUser.customer.domain.name | String | Case Last Updated By User Customer Domain Name |
| Argus.Case.data.lastUpdatedByUser.domain.id | Number | Case Last Updated By User Domain ID |
| Argus.Case.data.lastUpdatedByUser.domain.name | String | Case Last Updated By User Domain Name |
| Argus.Case.data.lastUpdatedByUser.userName | String | Case Last Updated By User User Name |
| Argus.Case.data.lastUpdatedByUser.name | String | Case Last Updated By User Name |
| Argus.Case.data.lastUpdatedByUser.type | String | Case Last Updated By User Type |
| Argus.Case.data.closedTimestamp | Number | Case Closed Timestamp |
| Argus.Case.data.closedByUser.id | Number | Case Closed By User ID |
| Argus.Case.data.closedByUser.customerID | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.id | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.name | String | Case Closed By User Customer Name |
| Argus.Case.data.closedByUser.customer.shortName | String | Case Closed By User Customer Short Name |
| Argus.Case.data.closedByUser.customer.domain.id | Number | Case Closed By User Customer Domain ID |
| Argus.Case.data.closedByUser.customer.domain.name | String | Case Closed By User Customer Domain Name |
| Argus.Case.data.closedByUser.domain.id | Number | Case Closed By User Domain ID |
| Argus.Case.data.closedByUser.domain.name | String | Case Closed By User Domain Name |
| Argus.Case.data.closedByUser.userName | String | Case Closed By User User Name |
| Argus.Case.data.closedByUser.name | String | Case Closed By User Name |
| Argus.Case.data.closedByUser.type | String | Case Closed By User Type |
| Argus.Case.data.publishedTimestamp | Number | Case Published Timestamp |
| Argus.Case.data.publishedByUser.id | Number | Case Published By User ID |
| Argus.Case.data.publishedByUser.customerID | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.id | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.name | String | Case Published By User Customer Name |
| Argus.Case.data.publishedByUser.customer.shortName | String | Case Published By User Customer Short Name |
| Argus.Case.data.publishedByUser.customer.domain.id | Number | Case Published By User Customer Domain ID |
| Argus.Case.data.publishedByUser.customer.domain.name | String | Case Published By User Customer Domain Name |
| Argus.Case.data.publishedByUser.domain.id | Number | Case Published By User Domain ID |
| Argus.Case.data.publishedByUser.domain.name | String | Case Published By User Domain Name |
| Argus.Case.data.publishedByUser.userName | String | Case Published By User User Name |
| Argus.Case.data.publishedByUser.name | String | Case Published By User Name |
| Argus.Case.data.publishedByUser.type | String | Case Published By User Type |
| Argus.Case.data.flags | String | Case Flags |
| Argus.Case.data.currentUserAccess.level | String | Case Current User Access Level |
| Argus.Case.data.currentUserAccess.role | String | Case Current User Access Role |
| Argus.Case.data.workflows.workflow | String | Case Workflows Workflow |
| Argus.Case.data.workflows.state | String | Case Workflows State |
| Argus.Case.data.originEmailAddress | String | Case Origin Email Address |
| Argus.Case.data.createdTime | String | Case Created Time |
| Argus.Case.data.lastUpdatedTime | String | Case Last Updated Time |
| Argus.Case.data.closedTime | String | Case Closed Time |
| Argus.Case.data.publishedTime | String | Case Published Time |
Command Example
!argus-delete-case case_id=123
argus-delete-comment
Mark existing comment as deleted
Base Command
argus-delete-comment
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case where comment exists. | Required |
| comment_id | ID of comment to mark as deleted. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Comment.responseCode | Number | API response metadata, response code of this request |
| Argus.Comment.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Comment.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Comment.count | Number | API response metadata, total number of results this query has |
| Argus.Comment.size | Number | API response metadata, the number of results returned in this request |
| Argus.Comment.messages.message | String | Comment Messages Message |
| Argus.Comment.messages.messageTemplate | String | Comment Messages Message Template |
| Argus.Comment.messages.type | String | Comment Messages Type |
| Argus.Comment.messages.field | String | Comment Messages Field |
| Argus.Comment.messages.timestamp | Number | Comment Messages Timestamp |
| Argus.Comment.data.id | String | Comment ID |
| Argus.Comment.data.addedTimestamp | Number | Comment Added Timestamp |
| Argus.Comment.data.addedByUser.id | Number | Comment Added By User ID |
| Argus.Comment.data.addedByUser.customerID | Number | Comment Added By User Customer ID |
| Argus.Comment.data.addedByUser.customer.id | Number | Comment Added By User Customer ID |
| Argus.Comment.data.addedByUser.customer.name | String | Comment Added By User Customer Name |
| Argus.Comment.data.addedByUser.customer.shortName | String | Comment Added By User Customer Short Name |
| Argus.Comment.data.addedByUser.customer.domain.id | Number | Comment Added By User Customer Domain ID |
| Argus.Comment.data.addedByUser.customer.domain.name | String | Comment Added By User Customer Domain Name |
| Argus.Comment.data.addedByUser.domain.id | Number | Comment Added By User Domain ID |
| Argus.Comment.data.addedByUser.domain.name | String | Comment Added By User Domain Name |
| Argus.Comment.data.addedByUser.userName | String | Comment Added By User User Name |
| Argus.Comment.data.addedByUser.name | String | Comment Added By User Name |
| Argus.Comment.data.addedByUser.type | String | Comment Added By User Type |
| Argus.Comment.data.comment | String | Comment Comment |
| Argus.Comment.data.flags | String | Comment Flags |
| Argus.Comment.data.lastUpdatedTimestamp | Number | Comment Last Updated Timestamp |
| Argus.Comment.data.status | String | Comment Status |
| Argus.Comment.data.priority | String | Comment Priority |
| Argus.Comment.data.originEmailAddress | String | Comment Origin Email Address |
| Argus.Comment.data.associatedAttachments.id | String | Comment Associated Attachments ID |
| Argus.Comment.data.associatedAttachments.name | String | Comment Associated Attachments Name |
| Argus.Comment.data.references.type | String | Comment References Type |
| Argus.Comment.data.references.commentID | String | Comment References Comment ID |
| Argus.Comment.data.lastUpdatedTime | String | Comment Last Updated Time |
| Argus.Comment.data.addedTime | String | Comment Added Time |
Command Example
!argus-delete-comment case_id=123 comment_id=123456
argus-edit-comment
Edit existing comment
Base Command
argus-edit-comment
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case where comment exists. | Required |
| comment_id | ID of comment to edit. | Required |
| comment | Comment text which will replace the current text. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Comment.responseCode | Number | API response metadata, response code of this request |
| Argus.Comment.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Comment.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Comment.count | Number | API response metadata, total number of results this query has |
| Argus.Comment.size | Number | API response metadata, the number of results returned in this request |
| Argus.Comment.messages.message | String | Comment Messages Message |
| Argus.Comment.messages.messageTemplate | String | Comment Messages Message Template |
| Argus.Comment.messages.type | String | Comment Messages Type |
| Argus.Comment.messages.field | String | Comment Messages Field |
| Argus.Comment.messages.timestamp | Number | Comment Messages Timestamp |
| Argus.Comment.data.id | String | Comment ID |
| Argus.Comment.data.addedTimestamp | Number | Comment Added Timestamp |
| Argus.Comment.data.addedByUser.id | Number | Comment Added By User ID |
| Argus.Comment.data.addedByUser.customerID | Number | Comment Added By User Customer ID |
| Argus.Comment.data.addedByUser.customer.id | Number | Comment Added By User Customer ID |
| Argus.Comment.data.addedByUser.customer.name | String | Comment Added By User Customer Name |
| Argus.Comment.data.addedByUser.customer.shortName | String | Comment Added By User Customer Short Name |
| Argus.Comment.data.addedByUser.customer.domain.id | Number | Comment Added By User Customer Domain ID |
| Argus.Comment.data.addedByUser.customer.domain.name | String | Comment Added By User Customer Domain Name |
| Argus.Comment.data.addedByUser.domain.id | Number | Comment Added By User Domain ID |
| Argus.Comment.data.addedByUser.domain.name | String | Comment Added By User Domain Name |
| Argus.Comment.data.addedByUser.userName | String | Comment Added By User User Name |
| Argus.Comment.data.addedByUser.name | String | Comment Added By User Name |
| Argus.Comment.data.addedByUser.type | String | Comment Added By User Type |
| Argus.Comment.data.comment | String | Comment Comment |
| Argus.Comment.data.flags | String | Comment Flags |
| Argus.Comment.data.lastUpdatedTimestamp | Number | Comment Last Updated Timestamp |
| Argus.Comment.data.status | String | Comment Status |
| Argus.Comment.data.priority | String | Comment Priority |
| Argus.Comment.data.originEmailAddress | String | Comment Origin Email Address |
| Argus.Comment.data.associatedAttachments.id | String | Comment Associated Attachments ID |
| Argus.Comment.data.associatedAttachments.name | String | Comment Associated Attachments Name |
| Argus.Comment.data.references.type | String | Comment References Type |
| Argus.Comment.data.references.commentID | String | Comment References Comment ID |
| Argus.Comment.data.lastUpdatedTime | String | Comment Last Updated Time |
| Argus.Comment.data.addedTime | String | Comment Added Time |
Command Example
!argus-edit-comment case_id=123 comment_id=123456 comment="comment content"
argus-get-case-metadata-by-id
Returns the basic case descriptor for the case identified by ID
Base Command
argus-get-case-metadata-by-id
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case. | Required |
| skip_redirect | If true, skip automatic redirect (for merged cases). Possible values are: true, false. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Case.responseCode | Number | API response metadata, response code of this request |
| Argus.Case.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Case.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Case.count | Number | API response metadata, total number of results this query has |
| Argus.Case.size | Number | API response metadata, the number of results returned in this request |
| Argus.Case.messages.message | String | Case Messages Message |
| Argus.Case.messages.messageTemplate | String | Case Messages Message Template |
| Argus.Case.messages.type | String | Case Messages Type |
| Argus.Case.messages.field | String | Case Messages Field |
| Argus.Case.messages.timestamp | Number | Case Messages Timestamp |
| Argus.Case.data.id | Number | Case ID |
| Argus.Case.data.customer.id | Number | Case Customer ID |
| Argus.Case.data.customer.name | String | Case Customer Name |
| Argus.Case.data.customer.shortName | String | Case Customer Short Name |
| Argus.Case.data.customer.domain.id | Number | Case Customer Domain ID |
| Argus.Case.data.customer.domain.name | String | Case Customer Domain Name |
| Argus.Case.data.service.id | Number | Case Service ID |
| Argus.Case.data.service.name | String | Case Service Name |
| Argus.Case.data.service.shortName | String | Case Service Short Name |
| Argus.Case.data.service.localizedName | String | Case Service Localized Name |
| Argus.Case.data.category.id | Number | Case Category ID |
| Argus.Case.data.category.name | String | Case Category Name |
| Argus.Case.data.category.shortName | String | Case Category Short Name |
| Argus.Case.data.category.localizedName | String | Case Category Localized Name |
| Argus.Case.data.type | String | Case Type |
| Argus.Case.data.initialStatus | String | Case Initial Status |
| Argus.Case.data.status | String | Case Status |
| Argus.Case.data.initialPriority | String | Case Initial Priority |
| Argus.Case.data.priority | String | Case Priority |
| Argus.Case.data.subject | String | Case Subject |
| Argus.Case.data.description | String | Case Description |
| Argus.Case.data.customerReference | String | Case Customer Reference |
| Argus.Case.data.accessMode | String | Case Access Mode |
| Argus.Case.data.reporter.id | Number | Case Reporter ID |
| Argus.Case.data.reporter.customerID | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.id | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.name | String | Case Reporter Customer Name |
| Argus.Case.data.reporter.customer.shortName | String | Case Reporter Customer Short Name |
| Argus.Case.data.reporter.customer.domain.id | Number | Case Reporter Customer Domain ID |
| Argus.Case.data.reporter.customer.domain.name | String | Case Reporter Customer Domain Name |
| Argus.Case.data.reporter.domain.id | Number | Case Reporter Domain ID |
| Argus.Case.data.reporter.domain.name | String | Case Reporter Domain Name |
| Argus.Case.data.reporter.userName | String | Case Reporter User Name |
| Argus.Case.data.reporter.name | String | Case Reporter Name |
| Argus.Case.data.reporter.type | String | Case Reporter Type |
| Argus.Case.data.assignedUser.id | Number | Case Assigned User ID |
| Argus.Case.data.assignedUser.customerID | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.id | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.name | String | Case Assigned User Customer Name |
| Argus.Case.data.assignedUser.customer.shortName | String | Case Assigned User Customer Short Name |
| Argus.Case.data.assignedUser.customer.domain.id | Number | Case Assigned User Customer Domain ID |
| Argus.Case.data.assignedUser.customer.domain.name | String | Case Assigned User Customer Domain Name |
| Argus.Case.data.assignedUser.domain.id | Number | Case Assigned User Domain ID |
| Argus.Case.data.assignedUser.domain.name | String | Case Assigned User Domain Name |
| Argus.Case.data.assignedUser.userName | String | Case Assigned User User Name |
| Argus.Case.data.assignedUser.name | String | Case Assigned User Name |
| Argus.Case.data.assignedUser.type | String | Case Assigned User Type |
| Argus.Case.data.assignedTech.id | Number | Case Assigned Tech ID |
| Argus.Case.data.assignedTech.customerID | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.id | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.name | String | Case Assigned Tech Customer Name |
| Argus.Case.data.assignedTech.customer.shortName | String | Case Assigned Tech Customer Short Name |
| Argus.Case.data.assignedTech.customer.domain.id | Number | Case Assigned Tech Customer Domain ID |
| Argus.Case.data.assignedTech.customer.domain.name | String | Case Assigned Tech Customer Domain Name |
| Argus.Case.data.assignedTech.domain.id | Number | Case Assigned Tech Domain ID |
| Argus.Case.data.assignedTech.domain.name | String | Case Assigned Tech Domain Name |
| Argus.Case.data.assignedTech.userName | String | Case Assigned Tech User Name |
| Argus.Case.data.assignedTech.name | String | Case Assigned Tech Name |
| Argus.Case.data.assignedTech.type | String | Case Assigned Tech Type |
| Argus.Case.data.createdTimestamp | Number | Case Created Timestamp |
| Argus.Case.data.createdByUser.id | Number | Case Created By User ID |
| Argus.Case.data.createdByUser.customerID | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.id | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.name | String | Case Created By User Customer Name |
| Argus.Case.data.createdByUser.customer.shortName | String | Case Created By User Customer Short Name |
| Argus.Case.data.createdByUser.customer.domain.id | Number | Case Created By User Customer Domain ID |
| Argus.Case.data.createdByUser.customer.domain.name | String | Case Created By User Customer Domain Name |
| Argus.Case.data.createdByUser.domain.id | Number | Case Created By User Domain ID |
| Argus.Case.data.createdByUser.domain.name | String | Case Created By User Domain Name |
| Argus.Case.data.createdByUser.userName | String | Case Created By User User Name |
| Argus.Case.data.createdByUser.name | String | Case Created By User Name |
| Argus.Case.data.createdByUser.type | String | Case Created By User Type |
| Argus.Case.data.lastUpdatedTimestamp | Number | Case Last Updated Timestamp |
| Argus.Case.data.lastUpdatedByUser.id | Number | Case Last Updated By User ID |
| Argus.Case.data.lastUpdatedByUser.customerID | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.id | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.name | String | Case Last Updated By User Customer Name |
| Argus.Case.data.lastUpdatedByUser.customer.shortName | String | Case Last Updated By User Customer Short Name |
| Argus.Case.data.lastUpdatedByUser.customer.domain.id | Number | Case Last Updated By User Customer Domain ID |
| Argus.Case.data.lastUpdatedByUser.customer.domain.name | String | Case Last Updated By User Customer Domain Name |
| Argus.Case.data.lastUpdatedByUser.domain.id | Number | Case Last Updated By User Domain ID |
| Argus.Case.data.lastUpdatedByUser.domain.name | String | Case Last Updated By User Domain Name |
| Argus.Case.data.lastUpdatedByUser.userName | String | Case Last Updated By User User Name |
| Argus.Case.data.lastUpdatedByUser.name | String | Case Last Updated By User Name |
| Argus.Case.data.lastUpdatedByUser.type | String | Case Last Updated By User Type |
| Argus.Case.data.closedTimestamp | Number | Case Closed Timestamp |
| Argus.Case.data.closedByUser.id | Number | Case Closed By User ID |
| Argus.Case.data.closedByUser.customerID | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.id | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.name | String | Case Closed By User Customer Name |
| Argus.Case.data.closedByUser.customer.shortName | String | Case Closed By User Customer Short Name |
| Argus.Case.data.closedByUser.customer.domain.id | Number | Case Closed By User Customer Domain ID |
| Argus.Case.data.closedByUser.customer.domain.name | String | Case Closed By User Customer Domain Name |
| Argus.Case.data.closedByUser.domain.id | Number | Case Closed By User Domain ID |
| Argus.Case.data.closedByUser.domain.name | String | Case Closed By User Domain Name |
| Argus.Case.data.closedByUser.userName | String | Case Closed By User User Name |
| Argus.Case.data.closedByUser.name | String | Case Closed By User Name |
| Argus.Case.data.closedByUser.type | String | Case Closed By User Type |
| Argus.Case.data.publishedTimestamp | Number | Case Published Timestamp |
| Argus.Case.data.publishedByUser.id | Number | Case Published By User ID |
| Argus.Case.data.publishedByUser.customerID | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.id | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.name | String | Case Published By User Customer Name |
| Argus.Case.data.publishedByUser.customer.shortName | String | Case Published By User Customer Short Name |
| Argus.Case.data.publishedByUser.customer.domain.id | Number | Case Published By User Customer Domain ID |
| Argus.Case.data.publishedByUser.customer.domain.name | String | Case Published By User Customer Domain Name |
| Argus.Case.data.publishedByUser.domain.id | Number | Case Published By User Domain ID |
| Argus.Case.data.publishedByUser.domain.name | String | Case Published By User Domain Name |
| Argus.Case.data.publishedByUser.userName | String | Case Published By User User Name |
| Argus.Case.data.publishedByUser.name | String | Case Published By User Name |
| Argus.Case.data.publishedByUser.type | String | Case Published By User Type |
| Argus.Case.data.flags | String | Case Flags |
| Argus.Case.data.currentUserAccess.level | String | Case Current User Access Level |
| Argus.Case.data.currentUserAccess.role | String | Case Current User Access Role |
| Argus.Case.data.workflows.workflow | String | Case Workflows Workflow |
| Argus.Case.data.workflows.state | String | Case Workflows State |
| Argus.Case.data.originEmailAddress | String | Case Origin Email Address |
| Argus.Case.data.createdTime | String | Case Created Time |
| Argus.Case.data.lastUpdatedTime | String | Case Last Updated Time |
| Argus.Case.data.closedTime | String | Case Closed Time |
| Argus.Case.data.publishedTime | String | Case Published Time |
Command Example
!argus-get-case_metadata_by_id case_id=123
argus-list-case-attachments
List attachments for an existing case
Base Command
argus-list-case-attachments
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case. | Required |
| limit | Maximum number of returned results. | Optional |
| offset | Skip a number of results. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Attachments.responseCode | Number | API response metadata, response code of this request |
| Argus.Attachments.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Attachments.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Attachments.count | Number | API response metadata, total number of results this query has |
| Argus.Attachments.size | Number | API response metadata, the number of results returned in this request |
| Argus.Attachments.messages.message | String | Attachment Messages Message |
| Argus.Attachments.messages.messageTemplate | String | Attachment Messages Message Template |
| Argus.Attachments.messages.type | String | Attachment Messages Type |
| Argus.Attachments.messages.field | String | Attachment Messages Field |
| Argus.Attachments.messages.timestamp | Number | Attachment Messages Timestamp |
| Argus.Attachments.data.id | String | Attachment ID |
| Argus.Attachments.data.addedTimestamp | Number | Attachment Added Timestamp |
| Argus.Attachments.data.addedByUser.id | Number | Attachment Added By User ID |
| Argus.Attachments.data.addedByUser.customerID | Number | Attachment Added By User Customer ID |
| Argus.Attachments.data.addedByUser.customer.id | Number | Attachment Added By User Customer ID |
| Argus.Attachments.data.addedByUser.customer.name | String | Attachment Added By User Customer Name |
| Argus.Attachments.data.addedByUser.customer.shortName | String | Attachment Added By User Customer Short Name |
| Argus.Attachments.data.addedByUser.customer.domain.id | Number | Attachment Added By User Customer Domain ID |
| Argus.Attachments.data.addedByUser.customer.domain.name | String | Attachment Added By User Customer Domain Name |
| Argus.Attachments.data.addedByUser.domain.id | Number | Attachment Added By User Domain ID |
| Argus.Attachments.data.addedByUser.domain.name | String | Attachment Added By User Domain Name |
| Argus.Attachments.data.addedByUser.userName | String | Attachment Added By User User Name |
| Argus.Attachments.data.addedByUser.name | String | Attachment Added By User Name |
| Argus.Attachments.data.addedByUser.type | String | Attachment Added By User Type |
| Argus.Attachments.data.name | String | Attachment Name |
| Argus.Attachments.data.mimeType | String | Attachment Mime Type |
| Argus.Attachments.data.flags | String | Attachment Flags |
| Argus.Attachments.data.size | Number | API response metadata, the number of results returned in this request |
| Argus.Attachments.data.originEmailAddress | String | Attachment Origin Email Address |
| Argus.Attachments.data.addedTime | String | Attachment Added Time |
Command Example
!argus-list-case-attachments case_id=123
argus-remove-case-tag-by-id
Remove existing tag by tag ID
Base Command
argus-remove-case-tag-by-id
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case. | Required |
| tag_id | ID of tag to remove. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Tags.responseCode | Number | API response metadata, response code of this request |
| Argus.Tags.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Tags.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Tags.count | Number | API response metadata, total number of results this query has |
| Argus.Tags.size | Number | API response metadata, the number of results returned in this request |
| Argus.Tags.messages.message | String | Tag Messages Message |
| Argus.Tags.messages.messageTemplate | String | Tag Messages Message Template |
| Argus.Tags.messages.type | String | Tag Messages Type |
| Argus.Tags.messages.field | String | Tag Messages Field |
| Argus.Tags.messages.timestamp | Number | Tag Messages Timestamp |
| Argus.Tags.data.id | String | Tag ID |
| Argus.Tags.data.key | String | Tag Key |
| Argus.Tags.data.value | String | Tag Value |
| Argus.Tags.data.addedTimestamp | Number | Tag Added Timestamp |
| Argus.Tags.data.addedByUser.id | Number | Tag Added By User ID |
| Argus.Tags.data.addedByUser.customerID | Number | Tag Added By User Customer ID |
| Argus.Tags.data.addedByUser.customer.id | Number | Tag Added By User Customer ID |
| Argus.Tags.data.addedByUser.customer.name | String | Tag Added By User Customer Name |
| Argus.Tags.data.addedByUser.customer.shortName | String | Tag Added By User Customer Short Name |
| Argus.Tags.data.addedByUser.customer.domain.id | Number | Tag Added By User Customer Domain ID |
| Argus.Tags.data.addedByUser.customer.domain.name | String | Tag Added By User Customer Domain Name |
| Argus.Tags.data.addedByUser.domain.id | Number | Tag Added By User Domain ID |
| Argus.Tags.data.addedByUser.domain.name | String | Tag Added By User Domain Name |
| Argus.Tags.data.addedByUser.userName | String | Tag Added By User User Name |
| Argus.Tags.data.addedByUser.name | String | Tag Added By User Name |
| Argus.Tags.data.addedByUser.type | String | Tag Added By User Type |
| Argus.Tags.data.flags | String | Tag Flags |
| Argus.Tags.data.addedTime | String | Tag Added Time |
Command Example
!argus-remove-case-tag-by-id case_id=123 tag_id=123456
argus-remove-case-tag-by-key-value
Remove existing tag with key, value matching
Base Command
argus-remove-case-tag-by-key-value
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case. | Required |
| key | Key of tag to remove. | Required |
| value | Value of tag to remove. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Tags.responseCode | Number | API response metadata, response code of this request |
| Argus.Tags.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Tags.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Tags.count | Number | API response metadata, total number of results this query has |
| Argus.Tags.size | Number | API response metadata, the number of results returned in this request |
| Argus.Tags.messages.message | String | Tag Messages Message |
| Argus.Tags.messages.messageTemplate | String | Tag Messages Message Template |
| Argus.Tags.messages.type | String | Tag Messages Type |
| Argus.Tags.messages.field | String | Tag Messages Field |
| Argus.Tags.messages.timestamp | Number | Tag Messages Timestamp |
| Argus.Tags.data.id | String | Tag ID |
| Argus.Tags.data.key | String | Tag Key |
| Argus.Tags.data.value | String | Tag Value |
| Argus.Tags.data.addedTimestamp | Number | Tag Added Timestamp |
| Argus.Tags.data.addedByUser.id | Number | Tag Added By User ID |
| Argus.Tags.data.addedByUser.customerID | Number | Tag Added By User Customer ID |
| Argus.Tags.data.addedByUser.customer.id | Number | Tag Added By User Customer ID |
| Argus.Tags.data.addedByUser.customer.name | String | Tag Added By User Customer Name |
| Argus.Tags.data.addedByUser.customer.shortName | String | Tag Added By User Customer Short Name |
| Argus.Tags.data.addedByUser.customer.domain.id | Number | Tag Added By User Customer Domain ID |
| Argus.Tags.data.addedByUser.customer.domain.name | String | Tag Added By User Customer Domain Name |
| Argus.Tags.data.addedByUser.domain.id | Number | Tag Added By User Domain ID |
| Argus.Tags.data.addedByUser.domain.name | String | Tag Added By User Domain Name |
| Argus.Tags.data.addedByUser.userName | String | Tag Added By User User Name |
| Argus.Tags.data.addedByUser.name | String | Tag Added By User Name |
| Argus.Tags.data.addedByUser.type | String | Tag Added By User Type |
| Argus.Tags.data.flags | String | Tag Flags |
| Argus.Tags.data.addedTime | String | Tag Added Time |
Command Example
!argus-remove-case-tag-by-key-value case_id=123 key=foo value=bar
argus-update-case
Request changes to basic fields of an existing case.
Base Command
argus-update-case
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case to update. | Required |
| subject | If set, change subject of case. | Optional |
| description | If set, change description of case. May use HTML, will be sanitized. . | Optional |
| status | If set, change status of case . Possible values are: pendingCustomer, pendingSoc, pendingVendor, pendingClose, workingSoc, workingCustomer. | Optional |
| priority | If set, change priority of case. . Possible values are: low, medium, high, critical. | Optional |
| category | If set, assign given category to specified category (by category shortname). Set value to empty string to unset category. . Possible values are: network-testing, unauthorized-access, dos, data-leakage, exposed-malicious, malicious-infection, poor-practice, reconnaissance, misconfigured, vpn-down, sensor-malfunctioning, not-receiving-traffic, false-positive, suspected-targeted-attack, duplicate, problem-managed, problem-customer, adware, network-connection-lost, failed-authentication, missing-log-sources, no-threat, phishing, argus-improvement, argus-bug. | Optional |
| reporter | If set, set given user as reporter for case (by ID or shortname). Shortname will be resolved in the current users domain. . | Optional |
| assigned_user | If set, assign given user to case (by ID or shortname). Shortname will be resolved in the current users domain. If blank, this will unset assignedUser. . | Optional |
| assigned_tech | If set, assign given technical user (solution engineer) to case (by ID or shortname). Shortname will be resolved in the current users domain. If blank, this will unset assignedTech. | Optional |
| customer_reference | If set, change customer reference for case. . | Optional |
| comment | If set, add comment to case. May use HTML, will be sanitized. . | Optional |
| origin_email_address | If update is made from an email, specify origin email address here. | Optional |
| has_events | f set, update the hasEvents flag for this case, signalling that this case may have events associated to it. . Possible values are: true, false. | Optional |
| internal_comment | If true, add comment as internal. (default false). Possible values are: true, false. Default is false. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Case.responseCode | Number | API response metadata, response code of this request |
| Argus.Case.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Case.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Case.count | Number | API response metadata, total number of results this query has |
| Argus.Case.size | Number | API response metadata, the number of results returned in this request |
| Argus.Case.messages.message | String | Case Messages Message |
| Argus.Case.messages.messageTemplate | String | Case Messages Message Template |
| Argus.Case.messages.type | String | Case Messages Type |
| Argus.Case.messages.field | String | Case Messages Field |
| Argus.Case.messages.timestamp | Number | Case Messages Timestamp |
| Argus.Case.data.id | Number | Case ID |
| Argus.Case.data.customer.id | Number | Case Customer ID |
| Argus.Case.data.customer.name | String | Case Customer Name |
| Argus.Case.data.customer.shortName | String | Case Customer Short Name |
| Argus.Case.data.customer.domain.id | Number | Case Customer Domain ID |
| Argus.Case.data.customer.domain.name | String | Case Customer Domain Name |
| Argus.Case.data.service.id | Number | Case Service ID |
| Argus.Case.data.service.name | String | Case Service Name |
| Argus.Case.data.service.shortName | String | Case Service Short Name |
| Argus.Case.data.service.localizedName | String | Case Service Localized Name |
| Argus.Case.data.category.id | Number | Case Category ID |
| Argus.Case.data.category.name | String | Case Category Name |
| Argus.Case.data.category.shortName | String | Case Category Short Name |
| Argus.Case.data.category.localizedName | String | Case Category Localized Name |
| Argus.Case.data.type | String | Case Type |
| Argus.Case.data.initialStatus | String | Case Initial Status |
| Argus.Case.data.status | String | Case Status |
| Argus.Case.data.initialPriority | String | Case Initial Priority |
| Argus.Case.data.priority | String | Case Priority |
| Argus.Case.data.subject | String | Case Subject |
| Argus.Case.data.description | String | Case Description |
| Argus.Case.data.customerReference | String | Case Customer Reference |
| Argus.Case.data.accessMode | String | Case Access Mode |
| Argus.Case.data.reporter.id | Number | Case Reporter ID |
| Argus.Case.data.reporter.customerID | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.id | Number | Case Reporter Customer ID |
| Argus.Case.data.reporter.customer.name | String | Case Reporter Customer Name |
| Argus.Case.data.reporter.customer.shortName | String | Case Reporter Customer Short Name |
| Argus.Case.data.reporter.customer.domain.id | Number | Case Reporter Customer Domain ID |
| Argus.Case.data.reporter.customer.domain.name | String | Case Reporter Customer Domain Name |
| Argus.Case.data.reporter.domain.id | Number | Case Reporter Domain ID |
| Argus.Case.data.reporter.domain.name | String | Case Reporter Domain Name |
| Argus.Case.data.reporter.userName | String | Case Reporter User Name |
| Argus.Case.data.reporter.name | String | Case Reporter Name |
| Argus.Case.data.reporter.type | String | Case Reporter Type |
| Argus.Case.data.assignedUser.id | Number | Case Assigned User ID |
| Argus.Case.data.assignedUser.customerID | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.id | Number | Case Assigned User Customer ID |
| Argus.Case.data.assignedUser.customer.name | String | Case Assigned User Customer Name |
| Argus.Case.data.assignedUser.customer.shortName | String | Case Assigned User Customer Short Name |
| Argus.Case.data.assignedUser.customer.domain.id | Number | Case Assigned User Customer Domain ID |
| Argus.Case.data.assignedUser.customer.domain.name | String | Case Assigned User Customer Domain Name |
| Argus.Case.data.assignedUser.domain.id | Number | Case Assigned User Domain ID |
| Argus.Case.data.assignedUser.domain.name | String | Case Assigned User Domain Name |
| Argus.Case.data.assignedUser.userName | String | Case Assigned User User Name |
| Argus.Case.data.assignedUser.name | String | Case Assigned User Name |
| Argus.Case.data.assignedUser.type | String | Case Assigned User Type |
| Argus.Case.data.assignedTech.id | Number | Case Assigned Tech ID |
| Argus.Case.data.assignedTech.customerID | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.id | Number | Case Assigned Tech Customer ID |
| Argus.Case.data.assignedTech.customer.name | String | Case Assigned Tech Customer Name |
| Argus.Case.data.assignedTech.customer.shortName | String | Case Assigned Tech Customer Short Name |
| Argus.Case.data.assignedTech.customer.domain.id | Number | Case Assigned Tech Customer Domain ID |
| Argus.Case.data.assignedTech.customer.domain.name | String | Case Assigned Tech Customer Domain Name |
| Argus.Case.data.assignedTech.domain.id | Number | Case Assigned Tech Domain ID |
| Argus.Case.data.assignedTech.domain.name | String | Case Assigned Tech Domain Name |
| Argus.Case.data.assignedTech.userName | String | Case Assigned Tech User Name |
| Argus.Case.data.assignedTech.name | String | Case Assigned Tech Name |
| Argus.Case.data.assignedTech.type | String | Case Assigned Tech Type |
| Argus.Case.data.createdTimestamp | Number | Case Created Timestamp |
| Argus.Case.data.createdByUser.id | Number | Case Created By User ID |
| Argus.Case.data.createdByUser.customerID | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.id | Number | Case Created By User Customer ID |
| Argus.Case.data.createdByUser.customer.name | String | Case Created By User Customer Name |
| Argus.Case.data.createdByUser.customer.shortName | String | Case Created By User Customer Short Name |
| Argus.Case.data.createdByUser.customer.domain.id | Number | Case Created By User Customer Domain ID |
| Argus.Case.data.createdByUser.customer.domain.name | String | Case Created By User Customer Domain Name |
| Argus.Case.data.createdByUser.domain.id | Number | Case Created By User Domain ID |
| Argus.Case.data.createdByUser.domain.name | String | Case Created By User Domain Name |
| Argus.Case.data.createdByUser.userName | String | Case Created By User User Name |
| Argus.Case.data.createdByUser.name | String | Case Created By User Name |
| Argus.Case.data.createdByUser.type | String | Case Created By User Type |
| Argus.Case.data.lastUpdatedTimestamp | Number | Case Last Updated Timestamp |
| Argus.Case.data.lastUpdatedByUser.id | Number | Case Last Updated By User ID |
| Argus.Case.data.lastUpdatedByUser.customerID | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.id | Number | Case Last Updated By User Customer ID |
| Argus.Case.data.lastUpdatedByUser.customer.name | String | Case Last Updated By User Customer Name |
| Argus.Case.data.lastUpdatedByUser.customer.shortName | String | Case Last Updated By User Customer Short Name |
| Argus.Case.data.lastUpdatedByUser.customer.domain.id | Number | Case Last Updated By User Customer Domain ID |
| Argus.Case.data.lastUpdatedByUser.customer.domain.name | String | Case Last Updated By User Customer Domain Name |
| Argus.Case.data.lastUpdatedByUser.domain.id | Number | Case Last Updated By User Domain ID |
| Argus.Case.data.lastUpdatedByUser.domain.name | String | Case Last Updated By User Domain Name |
| Argus.Case.data.lastUpdatedByUser.userName | String | Case Last Updated By User User Name |
| Argus.Case.data.lastUpdatedByUser.name | String | Case Last Updated By User Name |
| Argus.Case.data.lastUpdatedByUser.type | String | Case Last Updated By User Type |
| Argus.Case.data.closedTimestamp | Number | Case Closed Timestamp |
| Argus.Case.data.closedByUser.id | Number | Case Closed By User ID |
| Argus.Case.data.closedByUser.customerID | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.id | Number | Case Closed By User Customer ID |
| Argus.Case.data.closedByUser.customer.name | String | Case Closed By User Customer Name |
| Argus.Case.data.closedByUser.customer.shortName | String | Case Closed By User Customer Short Name |
| Argus.Case.data.closedByUser.customer.domain.id | Number | Case Closed By User Customer Domain ID |
| Argus.Case.data.closedByUser.customer.domain.name | String | Case Closed By User Customer Domain Name |
| Argus.Case.data.closedByUser.domain.id | Number | Case Closed By User Domain ID |
| Argus.Case.data.closedByUser.domain.name | String | Case Closed By User Domain Name |
| Argus.Case.data.closedByUser.userName | String | Case Closed By User User Name |
| Argus.Case.data.closedByUser.name | String | Case Closed By User Name |
| Argus.Case.data.closedByUser.type | String | Case Closed By User Type |
| Argus.Case.data.publishedTimestamp | Number | Case Published Timestamp |
| Argus.Case.data.publishedByUser.id | Number | Case Published By User ID |
| Argus.Case.data.publishedByUser.customerID | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.id | Number | Case Published By User Customer ID |
| Argus.Case.data.publishedByUser.customer.name | String | Case Published By User Customer Name |
| Argus.Case.data.publishedByUser.customer.shortName | String | Case Published By User Customer Short Name |
| Argus.Case.data.publishedByUser.customer.domain.id | Number | Case Published By User Customer Domain ID |
| Argus.Case.data.publishedByUser.customer.domain.name | String | Case Published By User Customer Domain Name |
| Argus.Case.data.publishedByUser.domain.id | Number | Case Published By User Domain ID |
| Argus.Case.data.publishedByUser.domain.name | String | Case Published By User Domain Name |
| Argus.Case.data.publishedByUser.userName | String | Case Published By User User Name |
| Argus.Case.data.publishedByUser.name | String | Case Published By User Name |
| Argus.Case.data.publishedByUser.type | String | Case Published By User Type |
| Argus.Case.data.flags | String | Case Flags |
| Argus.Case.data.currentUserAccess.level | String | Case Current User Access Level |
| Argus.Case.data.currentUserAccess.role | String | Case Current User Access Role |
| Argus.Case.data.workflows.workflow | String | Case Workflows Workflow |
| Argus.Case.data.workflows.state | String | Case Workflows State |
| Argus.Case.data.originEmailAddress | String | Case Origin Email Address |
| Argus.Case.data.createdTime | String | Case Created Time |
| Argus.Case.data.lastUpdatedTime | String | Case Last Updated Time |
| Argus.Case.data.closedTime | String | Case Closed Time |
| Argus.Case.data.publishedTime | String | Case Published Time |
Command Example
!argus-update-case case_id=123
argus-get-attachment
Fetch specific attachment metadata
Base Command
argus-get-attachment
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case. | Required |
| attachment_id | ID of attachement. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Attachment.responseCode | Number | API response metadata, response code of this request |
| Argus.Attachment.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Attachment.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Attachment.count | Number | API response metadata, total number of results this query has |
| Argus.Attachment.size | Number | API response metadata, the number of results returned in this request |
| Argus.Attachment.messages.message | String | Attachment Messages Message |
| Argus.Attachment.messages.messageTemplate | String | Attachment Messages Message Template |
| Argus.Attachment.messages.type | String | Attachment Messages Type |
| Argus.Attachment.messages.field | String | Attachment Messages Field |
| Argus.Attachment.messages.timestamp | Number | Attachment Messages Timestamp |
| Argus.Attachment.data.id | String | Attachment ID |
| Argus.Attachment.data.addedTimestamp | Number | Attachment Added Timestamp |
| Argus.Attachment.data.addedByUser.id | Number | Attachment Added By User ID |
| Argus.Attachment.data.addedByUser.customerID | Number | Attachment Added By User Customer ID |
| Argus.Attachment.data.addedByUser.customer.id | Number | Attachment Added By User Customer ID |
| Argus.Attachment.data.addedByUser.customer.name | String | Attachment Added By User Customer Name |
| Argus.Attachment.data.addedByUser.customer.shortName | String | Attachment Added By User Customer Short Name |
| Argus.Attachment.data.addedByUser.customer.domain.id | Number | Attachment Added By User Customer Domain ID |
| Argus.Attachment.data.addedByUser.customer.domain.name | String | Attachment Added By User Customer Domain Name |
| Argus.Attachment.data.addedByUser.domain.id | Number | Attachment Added By User Domain ID |
| Argus.Attachment.data.addedByUser.domain.name | String | Attachment Added By User Domain Name |
| Argus.Attachment.data.addedByUser.userName | String | Attachment Added By User User Name |
| Argus.Attachment.data.addedByUser.name | String | Attachment Added By User Name |
| Argus.Attachment.data.addedByUser.type | String | Attachment Added By User Type |
| Argus.Attachment.data.name | String | Attachment Name |
| Argus.Attachment.data.mimeType | String | Attachment Mime Type |
| Argus.Attachment.data.flags | String | Attachment Flags |
| Argus.Attachment.data.size | Number | API response metadata, the number of results returned in this request |
| Argus.Attachment.data.originEmailAddress | String | Attachment Origin Email Address |
| Argus.Attachment.data.addedTime | String | Attachment Added Time |
Command Example
!argus-get-attachment case_id=123 attachment_id=123456
argus-download-attachment
Download specific attachment contents.
Base Command
argus-download-attachment
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case. | Required |
| attachment_id | ID of attachment to download. . | Required |
| file_name | Filename of attachment, will otherwise be the ID. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| File.Size | Number | The size of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The name of the file. |
| File.SSDeep | String | The SSDeep hash of the file. |
| File.EntryID | String | The entry ID of the file. |
| File.Info | String | File information. |
| File.Type | String | The file type. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Extension | String | The file extension. |
Command Example
!argus-download-attachment case_id=123 attachment_id=123456
argus-get-events-for-case
Fetch events associated with specified case.
Base Command
argus-get-events-for-case
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | ID of Argus case. | Required |
| limit | Maximum number of returned results (default 25). | Optional |
| offset | Skip a number of results. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Events.responseCode | Number | API response metadata, response code of this request |
| Argus.Events.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Events.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Events.count | Number | API response metadata, total number of results this query has |
| Argus.Events.size | Number | API response metadata, the number of results returned in this request |
| Argus.Events.messages.message | String | Event Messages Message |
| Argus.Events.messages.messageTemplate | String | Event Messages Message Template |
| Argus.Events.messages.type | String | Event Messages Type |
| Argus.Events.messages.field | String | Event Messages Field |
| Argus.Events.messages.timestamp | Number | Event Messages Timestamp |
| Argus.Events.data.customerInfo.id | Number | Event Customer Info ID |
| Argus.Events.data.customerInfo.name | String | Event Customer Info Name |
| Argus.Events.data.customerInfo.shortName | String | Event Customer Info Short Name |
| Argus.Events.data.customerInfo.domain.id | Number | Event Customer Info Domain ID |
| Argus.Events.data.customerInfo.domain.name | String | Event Customer Info Domain Name |
| Argus.Events.data.properties.additionalProp1 | String | Event Properties Additional Prop 1 |
| Argus.Events.data.properties.additionalProp2 | String | Event Properties Additional Prop 2 |
| Argus.Events.data.properties.additionalProp3 | String | Event Properties Additional Prop 3 |
| Argus.Events.data.comments.timestamp | Number | Event Comments Timestamp |
| Argus.Events.data.comments.user.id | Number | Event Comments User ID |
| Argus.Events.data.comments.user.customerID | Number | Event Comments User Customer ID |
| Argus.Events.data.comments.user.customer.id | Number | Event Comments User Customer ID |
| Argus.Events.data.comments.user.customer.name | String | Event Comments User Customer Name |
| Argus.Events.data.comments.user.customer.shortName | String | Event Comments User Customer Short Name |
| Argus.Events.data.comments.user.customer.domain.id | Number | Event Comments User Customer Domain ID |
| Argus.Events.data.comments.user.customer.domain.name | String | Event Comments User Customer Domain Name |
| Argus.Events.data.comments.user.domain.id | Number | Event Comments User Domain ID |
| Argus.Events.data.comments.user.domain.name | String | Event Comments User Domain Name |
| Argus.Events.data.comments.user.userName | String | Event Comments User User Name |
| Argus.Events.data.comments.user.name | String | Event Comments User Name |
| Argus.Events.data.comments.user.type | String | Event Comments User Type |
| Argus.Events.data.comments.comment | String | Event Comments Comment |
| Argus.Events.data.associatedCase.id | Number | Event Associated Case ID |
| Argus.Events.data.associatedCase.subject | String | Event Associated Case Subject |
| Argus.Events.data.associatedCase.categoryID | Number | Event Associated Case Category ID |
| Argus.Events.data.associatedCase.categoryName | String | Event Associated Case Category Name |
| Argus.Events.data.associatedCase.service | String | Event Associated Case Service |
| Argus.Events.data.associatedCase.status | String | Event Associated Case Status |
| Argus.Events.data.associatedCase.priority | String | Event Associated Case Priority |
| Argus.Events.data.location.shortName | String | Event Location Short Name |
| Argus.Events.data.location.name | String | Event Location Name |
| Argus.Events.data.location.timeZone | String | Event Location Time Zone |
| Argus.Events.data.location.id | Number | Event Location ID |
| Argus.Events.data.attackInfo.alarmID | Number | Event Attack Info Alarm ID |
| Argus.Events.data.attackInfo.alarmDescription | String | Event Attack Info Alarm Description |
| Argus.Events.data.attackInfo.attackCategoryID | Number | Event Attack Info Attack Category ID |
| Argus.Events.data.attackInfo.attackCategoryName | String | Event Attack Info Attack Category Name |
| Argus.Events.data.attackInfo.signature | String | Event Attack Info Signature |
| Argus.Events.data.domain.fqdn | String | Event Domain Fqdn |
| Argus.Events.data.uri | String | Event Uri |
| Argus.Events.data.count | Number | API response metadata, total number of results this query has |
| Argus.Events.data.source.port | Number | Event Source Port |
| Argus.Events.data.source.geoLocation.countryCode | String | Event Source Geo Location Country Code |
| Argus.Events.data.source.geoLocation.countryName | String | Event Source Geo Location Country Name |
| Argus.Events.data.source.geoLocation.locationName | String | Event Source Geo Location Location Name |
| Argus.Events.data.source.geoLocation.latitude | Number | Event Source Geo Location Latitude |
| Argus.Events.data.source.geoLocation.longitude | Number | Event Source Geo Location Longitude |
| Argus.Events.data.source.networkAddress.ipv6 | Boolean | Event Source Network Address Ipv 6 |
| Argus.Events.data.source.networkAddress.public | Boolean | Event Source Network Address Public |
| Argus.Events.data.source.networkAddress.maskBits | Number | Event Source Network Address Mask Bits |
| Argus.Events.data.source.networkAddress.multicast | Boolean | Event Source Network Address Multicast |
| Argus.Events.data.source.networkAddress.host | Boolean | Event Source Network Address Host |
| Argus.Events.data.source.networkAddress.address | String | Event Source Network Address Address |
| Argus.Events.data.destination.port | Number | Event Destination Port |
| Argus.Events.data.destination.geoLocation.countryCode | String | Event Destination Geo Location Country Code |
| Argus.Events.data.destination.geoLocation.countryName | String | Event Destination Geo Location Country Name |
| Argus.Events.data.destination.geoLocation.locationName | String | Event Destination Geo Location Location Name |
| Argus.Events.data.destination.geoLocation.latitude | Number | Event Destination Geo Location Latitude |
| Argus.Events.data.destination.geoLocation.longitude | Number | Event Destination Geo Location Longitude |
| Argus.Events.data.destination.networkAddress.ipv6 | Boolean | Event Destination Network Address Ipv 6 |
| Argus.Events.data.destination.networkAddress.public | Boolean | Event Destination Network Address Public |
| Argus.Events.data.destination.networkAddress.maskBits | Number | Event Destination Network Address Mask Bits |
| Argus.Events.data.destination.networkAddress.multicast | Boolean | Event Destination Network Address Multicast |
| Argus.Events.data.destination.networkAddress.host | Boolean | Event Destination Network Address Host |
| Argus.Events.data.destination.networkAddress.address | String | Event Destination Network Address Address |
| Argus.Events.data.protocol | String | Event Protocol |
| Argus.Events.data.timestamp | Number | Event Timestamp |
| Argus.Events.data.startTimestamp | Number | Event Start Timestamp |
| Argus.Events.data.endTimestamp | Number | Event End Timestamp |
| Argus.Events.data.lastUpdatedTimestamp | Number | Event Last Updated Timestamp |
| Argus.Events.data.flags | String | Event Flags |
| Argus.Events.data.detailedEventIDS | String | Event Detailed Event IDS |
| Argus.Events.data.severity | String | Event Severity |
| Argus.Events.data.id | String | Event ID |
Command Example
!argus_get_events_for_case case_id=123
argus-list-aggregated-events
List aggregated events
Base Command
argus-list-aggregated-events
Input
| Argument Name | Description | Required |
|---|---|---|
| customer_id | Limit to customerID. | Optional |
| signature | Limit to signature. | Optional |
| ip | Limit to ip/network. | Optional |
| start_timestamp | Limit to events after this timestamp (default is last 24 hours). | Optional |
| end_timestamp | Limit to events before this timestamp. Defaults to now. | Optional |
| limit | Limit results (default 25). | Optional |
| offset | Skip a number of results. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Events.responseCode | Number | API response metadata, response code of this request |
| Argus.Events.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Events.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Events.count | Number | API response metadata, total number of results this query has |
| Argus.Events.size | Number | API response metadata, the number of results returned in this request |
| Argus.Events.messages.message | String | Event Messages Message |
| Argus.Events.messages.messageTemplate | String | Event Messages Message Template |
| Argus.Events.messages.type | String | Event Messages Type |
| Argus.Events.messages.field | String | Event Messages Field |
| Argus.Events.messages.timestamp | Number | Event Messages Timestamp |
| Argus.Events.data.customerInfo.id | Number | Event Customer Info ID |
| Argus.Events.data.customerInfo.name | String | Event Customer Info Name |
| Argus.Events.data.customerInfo.shortName | String | Event Customer Info Short Name |
| Argus.Events.data.customerInfo.domain.id | Number | Event Customer Info Domain ID |
| Argus.Events.data.customerInfo.domain.name | String | Event Customer Info Domain Name |
| Argus.Events.data.properties.additionalProp1 | String | Event Properties Additional Prop 1 |
| Argus.Events.data.properties.additionalProp2 | String | Event Properties Additional Prop 2 |
| Argus.Events.data.properties.additionalProp3 | String | Event Properties Additional Prop 3 |
| Argus.Events.data.comments.timestamp | Number | Event Comments Timestamp |
| Argus.Events.data.comments.user.id | Number | Event Comments User ID |
| Argus.Events.data.comments.user.customerID | Number | Event Comments User Customer ID |
| Argus.Events.data.comments.user.customer.id | Number | Event Comments User Customer ID |
| Argus.Events.data.comments.user.customer.name | String | Event Comments User Customer Name |
| Argus.Events.data.comments.user.customer.shortName | String | Event Comments User Customer Short Name |
| Argus.Events.data.comments.user.customer.domain.id | Number | Event Comments User Customer Domain ID |
| Argus.Events.data.comments.user.customer.domain.name | String | Event Comments User Customer Domain Name |
| Argus.Events.data.comments.user.domain.id | Number | Event Comments User Domain ID |
| Argus.Events.data.comments.user.domain.name | String | Event Comments User Domain Name |
| Argus.Events.data.comments.user.userName | String | Event Comments User User Name |
| Argus.Events.data.comments.user.name | String | Event Comments User Name |
| Argus.Events.data.comments.user.type | String | Event Comments User Type |
| Argus.Events.data.comments.comment | String | Event Comments Comment |
| Argus.Events.data.associatedCase.id | Number | Event Associated Case ID |
| Argus.Events.data.associatedCase.subject | String | Event Associated Case Subject |
| Argus.Events.data.associatedCase.categoryID | Number | Event Associated Case Category ID |
| Argus.Events.data.associatedCase.categoryName | String | Event Associated Case Category Name |
| Argus.Events.data.associatedCase.service | String | Event Associated Case Service |
| Argus.Events.data.associatedCase.status | String | Event Associated Case Status |
| Argus.Events.data.associatedCase.priority | String | Event Associated Case Priority |
| Argus.Events.data.location.shortName | String | Event Location Short Name |
| Argus.Events.data.location.name | String | Event Location Name |
| Argus.Events.data.location.timeZone | String | Event Location Time Zone |
| Argus.Events.data.location.id | Number | Event Location ID |
| Argus.Events.data.attackInfo.alarmID | Number | Event Attack Info Alarm ID |
| Argus.Events.data.attackInfo.alarmDescription | String | Event Attack Info Alarm Description |
| Argus.Events.data.attackInfo.attackCategoryID | Number | Event Attack Info Attack Category ID |
| Argus.Events.data.attackInfo.attackCategoryName | String | Event Attack Info Attack Category Name |
| Argus.Events.data.attackInfo.signature | String | Event Attack Info Signature |
| Argus.Events.data.domain.fqdn | String | Event Domain Fqdn |
| Argus.Events.data.uri | String | Event Uri |
| Argus.Events.data.count | Number | API response metadata, total number of results this query has |
| Argus.Events.data.source.port | Number | Event Source Port |
| Argus.Events.data.source.geoLocation.countryCode | String | Event Source Geo Location Country Code |
| Argus.Events.data.source.geoLocation.countryName | String | Event Source Geo Location Country Name |
| Argus.Events.data.source.geoLocation.locationName | String | Event Source Geo Location Location Name |
| Argus.Events.data.source.geoLocation.latitude | Number | Event Source Geo Location Latitude |
| Argus.Events.data.source.geoLocation.longitude | Number | Event Source Geo Location Longitude |
| Argus.Events.data.source.networkAddress.ipv6 | Boolean | Event Source Network Address Ipv 6 |
| Argus.Events.data.source.networkAddress.public | Boolean | Event Source Network Address Public |
| Argus.Events.data.source.networkAddress.maskBits | Number | Event Source Network Address Mask Bits |
| Argus.Events.data.source.networkAddress.multicast | Boolean | Event Source Network Address Multicast |
| Argus.Events.data.source.networkAddress.host | Boolean | Event Source Network Address Host |
| Argus.Events.data.source.networkAddress.address | String | Event Source Network Address Address |
| Argus.Events.data.destination.port | Number | Event Destination Port |
| Argus.Events.data.destination.geoLocation.countryCode | String | Event Destination Geo Location Country Code |
| Argus.Events.data.destination.geoLocation.countryName | String | Event Destination Geo Location Country Name |
| Argus.Events.data.destination.geoLocation.locationName | String | Event Destination Geo Location Location Name |
| Argus.Events.data.destination.geoLocation.latitude | Number | Event Destination Geo Location Latitude |
| Argus.Events.data.destination.geoLocation.longitude | Number | Event Destination Geo Location Longitude |
| Argus.Events.data.destination.networkAddress.ipv6 | Boolean | Event Destination Network Address Ipv 6 |
| Argus.Events.data.destination.networkAddress.public | Boolean | Event Destination Network Address Public |
| Argus.Events.data.destination.networkAddress.maskBits | Number | Event Destination Network Address Mask Bits |
| Argus.Events.data.destination.networkAddress.multicast | Boolean | Event Destination Network Address Multicast |
| Argus.Events.data.destination.networkAddress.host | Boolean | Event Destination Network Address Host |
| Argus.Events.data.destination.networkAddress.address | String | Event Destination Network Address Address |
| Argus.Events.data.protocol | String | Event Protocol |
| Argus.Events.data.timestamp | Number | Event Timestamp |
| Argus.Events.data.startTimestamp | Number | Event Start Timestamp |
| Argus.Events.data.endTimestamp | Number | Event End Timestamp |
| Argus.Events.data.lastUpdatedTimestamp | Number | Event Last Updated Timestamp |
| Argus.Events.data.flags | String | Event Flags |
| Argus.Events.data.detailedEventIDS | String | Event Detailed Event IDS |
| Argus.Events.data.severity | String | Event Severity |
| Argus.Events.data.id | String | Event ID |
Command Example
!argus_list_aggregated_events
argus-find-aggregated-events
Search for aggregated events (OSB! advanced method: look in API doc)
Base Command
argus-find-aggregated-events
Input
| Argument Name | Description | Required |
|---|---|---|
| skip_future_events | Skip future events. Possible values are: true, false. | Optional |
| exclude | Exclude parameter. Possible values are: true, false. | Optional |
| event_identifier | (as list). | Optional |
| location_id | (as list). | Optional |
| severity | (as list). | Optional |
| customer | (as list). | Optional |
| alarm_id | (as list). | Optional |
| attack_category_id | (as list). | Optional |
| source_geo_country | (as list). | Optional |
| destination_geo_country | (as list). | Optional |
| geo_country | (as list). | Optional |
| properties | (as dict: key,value). | Optional |
| exact_match_properties | Exact matching flag. Possible values are: true, false. | Optional |
| sub_criteria | (as list). | Optional |
| signature | (as list). | Optional |
| last_updated_timestamp | Last updated timestamp. | Optional |
| index_start_time | Index start time. | Optional |
| index_end_time | Index end time. | Optional |
| destination_ip | (as list). | Optional |
| source_ip | (as list). | Optional |
| ip | (as list). | Optional |
| destination_port | (as list). | Optional |
| source_port | (as list). | Optional |
| port | (as lst). | Optional |
| min_severity | Minimum severity. | Optional |
| max_severity | Maximum severity. | Optional |
| limit | Limit results (default 25). | Optional |
| offset | Skip number of results. | Optional |
| include_deleted | Include deleted events. Possible values are: true, false. | Optional |
| min_count | Minimum count. | Optional |
| associated_case_id | (as list). | Optional |
| source_ip_min_bits | Source IP minimum bits. | Optional |
| destination_ip_min_bits | Destination IP minimum bits. | Optional |
| start_timestamp | Start timestamp. | Optional |
| end_timestamp | End timestamp. | Optional |
| sort_by | Order results by these properties (prefix with - to sort descending) (as list). | Optional |
| include_flags | Search objects with these flags set (as list). | Optional |
| exclude_flags | Exclude objects with these flags set (as list). | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Events.responseCode | Number | API response metadata, response code of this request |
| Argus.Events.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Events.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Events.count | Number | API response metadata, total number of results this query has |
| Argus.Events.size | Number | API response metadata, the number of results returned in this request |
| Argus.Events.messages.message | String | Event Messages Message |
| Argus.Events.messages.messageTemplate | String | Event Messages Message Template |
| Argus.Events.messages.type | String | Event Messages Type |
| Argus.Events.messages.field | String | Event Messages Field |
| Argus.Events.messages.timestamp | Number | Event Messages Timestamp |
| Argus.Events.data.customerInfo.id | Number | Event Customer Info ID |
| Argus.Events.data.customerInfo.name | String | Event Customer Info Name |
| Argus.Events.data.customerInfo.shortName | String | Event Customer Info Short Name |
| Argus.Events.data.customerInfo.domain.id | Number | Event Customer Info Domain ID |
| Argus.Events.data.customerInfo.domain.name | String | Event Customer Info Domain Name |
| Argus.Events.data.properties.additionalProp1 | String | Event Properties Additional Prop 1 |
| Argus.Events.data.properties.additionalProp2 | String | Event Properties Additional Prop 2 |
| Argus.Events.data.properties.additionalProp3 | String | Event Properties Additional Prop 3 |
| Argus.Events.data.comments.timestamp | Number | Event Comments Timestamp |
| Argus.Events.data.comments.user.id | Number | Event Comments User ID |
| Argus.Events.data.comments.user.customerID | Number | Event Comments User Customer ID |
| Argus.Events.data.comments.user.customer.id | Number | Event Comments User Customer ID |
| Argus.Events.data.comments.user.customer.name | String | Event Comments User Customer Name |
| Argus.Events.data.comments.user.customer.shortName | String | Event Comments User Customer Short Name |
| Argus.Events.data.comments.user.customer.domain.id | Number | Event Comments User Customer Domain ID |
| Argus.Events.data.comments.user.customer.domain.name | String | Event Comments User Customer Domain Name |
| Argus.Events.data.comments.user.domain.id | Number | Event Comments User Domain ID |
| Argus.Events.data.comments.user.domain.name | String | Event Comments User Domain Name |
| Argus.Events.data.comments.user.userName | String | Event Comments User User Name |
| Argus.Events.data.comments.user.name | String | Event Comments User Name |
| Argus.Events.data.comments.user.type | String | Event Comments User Type |
| Argus.Events.data.comments.comment | String | Event Comments Comment |
| Argus.Events.data.associatedCase.id | Number | Event Associated Case ID |
| Argus.Events.data.associatedCase.subject | String | Event Associated Case Subject |
| Argus.Events.data.associatedCase.categoryID | Number | Event Associated Case Category ID |
| Argus.Events.data.associatedCase.categoryName | String | Event Associated Case Category Name |
| Argus.Events.data.associatedCase.service | String | Event Associated Case Service |
| Argus.Events.data.associatedCase.status | String | Event Associated Case Status |
| Argus.Events.data.associatedCase.priority | String | Event Associated Case Priority |
| Argus.Events.data.location.shortName | String | Event Location Short Name |
| Argus.Events.data.location.name | String | Event Location Name |
| Argus.Events.data.location.timeZone | String | Event Location Time Zone |
| Argus.Events.data.location.id | Number | Event Location ID |
| Argus.Events.data.attackInfo.alarmID | Number | Event Attack Info Alarm ID |
| Argus.Events.data.attackInfo.alarmDescription | String | Event Attack Info Alarm Description |
| Argus.Events.data.attackInfo.attackCategoryID | Number | Event Attack Info Attack Category ID |
| Argus.Events.data.attackInfo.attackCategoryName | String | Event Attack Info Attack Category Name |
| Argus.Events.data.attackInfo.signature | String | Event Attack Info Signature |
| Argus.Events.data.domain.fqdn | String | Event Domain Fqdn |
| Argus.Events.data.uri | String | Event Uri |
| Argus.Events.data.count | Number | API response metadata, total number of results this query has |
| Argus.Events.data.source.port | Number | Event Source Port |
| Argus.Events.data.source.geoLocation.countryCode | String | Event Source Geo Location Country Code |
| Argus.Events.data.source.geoLocation.countryName | String | Event Source Geo Location Country Name |
| Argus.Events.data.source.geoLocation.locationName | String | Event Source Geo Location Location Name |
| Argus.Events.data.source.geoLocation.latitude | Number | Event Source Geo Location Latitude |
| Argus.Events.data.source.geoLocation.longitude | Number | Event Source Geo Location Longitude |
| Argus.Events.data.source.networkAddress.ipv6 | Boolean | Event Source Network Address Ipv 6 |
| Argus.Events.data.source.networkAddress.public | Boolean | Event Source Network Address Public |
| Argus.Events.data.source.networkAddress.maskBits | Number | Event Source Network Address Mask Bits |
| Argus.Events.data.source.networkAddress.multicast | Boolean | Event Source Network Address Multicast |
| Argus.Events.data.source.networkAddress.host | Boolean | Event Source Network Address Host |
| Argus.Events.data.source.networkAddress.address | String | Event Source Network Address Address |
| Argus.Events.data.destination.port | Number | Event Destination Port |
| Argus.Events.data.destination.geoLocation.countryCode | String | Event Destination Geo Location Country Code |
| Argus.Events.data.destination.geoLocation.countryName | String | Event Destination Geo Location Country Name |
| Argus.Events.data.destination.geoLocation.locationName | String | Event Destination Geo Location Location Name |
| Argus.Events.data.destination.geoLocation.latitude | Number | Event Destination Geo Location Latitude |
| Argus.Events.data.destination.geoLocation.longitude | Number | Event Destination Geo Location Longitude |
| Argus.Events.data.destination.networkAddress.ipv6 | Boolean | Event Destination Network Address Ipv 6 |
| Argus.Events.data.destination.networkAddress.public | Boolean | Event Destination Network Address Public |
| Argus.Events.data.destination.networkAddress.maskBits | Number | Event Destination Network Address Mask Bits |
| Argus.Events.data.destination.networkAddress.multicast | Boolean | Event Destination Network Address Multicast |
| Argus.Events.data.destination.networkAddress.host | Boolean | Event Destination Network Address Host |
| Argus.Events.data.destination.networkAddress.address | String | Event Destination Network Address Address |
| Argus.Events.data.protocol | String | Event Protocol |
| Argus.Events.data.timestamp | Number | Event Timestamp |
| Argus.Events.data.startTimestamp | Number | Event Start Timestamp |
| Argus.Events.data.endTimestamp | Number | Event End Timestamp |
| Argus.Events.data.lastUpdatedTimestamp | Number | Event Last Updated Timestamp |
| Argus.Events.data.flags | String | Event Flags |
| Argus.Events.data.detailedEventIDS | String | Event Detailed Event IDS |
| Argus.Events.data.severity | String | Event Severity |
| Argus.Events.data.id | String | Event ID |
Command Example
!argus-find-aggregated-events
argus-get-payload
Fetch specified event payload
Base Command
argus-get-payload
Input
| Argument Name | Description | Required |
|---|---|---|
| type | Event type. Possible values are: NIDS, AGGR, AGGRATTACK. | Required |
| timestamp | Timestamp of event. | Required |
| customer_id | ID of customer. | Required |
| event_id | ID of related event. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Payload.responseCode | Number | API response metadata, response code of this request |
| Argus.Payload.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Payload.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Payload.count | Number | API response metadata, total number of results this query has |
| Argus.Payload.size | Number | API response metadata, the number of results returned in this request |
| Argus.Payload.messages.message | String | Payload Messages Message |
| Argus.Payload.messages.messageTemplate | String | Payload Messages Message Template |
| Argus.Payload.messages.type | String | Payload Messages Type |
| Argus.Payload.messages.field | String | Payload Messages Field |
| Argus.Payload.messages.timestamp | Number | Payload Messages Timestamp |
| Argus.Payload.data.id | String | Payload ID |
| Argus.Payload.data.type | String | Payload Type |
| Argus.Payload.data.payload | String | Payload Payload |
Command Example
!argus-get-payload customer_id=123 event_id=123456 timestamp=123456789 type=NIDS
argus-get-pcap
Fetch specified event payload as PCAP.
Base Command
argus-get-pcap
Input
| Argument Name | Description | Required |
|---|---|---|
| type | Event type. Possible values are: NIDS, AGGR, AGGRATTACK. | Required |
| timestamp | Timestamp of event. | Required |
| customer_id | ID of customer. | Required |
| event_id | ID of related event. | Required |
Context Output
There is no context output for this command.
Command Example
!argus-get-pcap customer_id=123 event_id=123456 timestamp=123456789 type=NIDS
argus-get-event
Fetch specified event.
Base Command
argus-get-event
Input
| Argument Name | Description | Required |
|---|---|---|
| type | Type of event. Possible values are: NIDS, AGGR, AGGRATTACK. | Required |
| timestamp | Timestamp of event. | Required |
| customer_id | Customer ID related to event. | Required |
| event_id | ID of event. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.Event.responseCode | Number | API response metadata, response code of this request |
| Argus.Event.limit | Number | API response metadata, limit of results this request ran with |
| Argus.Event.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.Event.count | Number | API response metadata, total number of results this query has |
| Argus.Event.size | Number | API response metadata, the number of results returned in this request |
| Argus.Event.messages.message | String | Event Messages Message |
| Argus.Event.messages.messageTemplate | String | Event Messages Message Template |
| Argus.Event.messages.type | String | Event Messages Type |
| Argus.Event.messages.field | String | Event Messages Field |
| Argus.Event.messages.timestamp | Number | Event Messages Timestamp |
| Argus.Event.data.timestamp | Number | Event Timestamp |
| Argus.Event.data.flags | Number | Event Flags |
| Argus.Event.data.customerID | Number | Event Customer ID |
| Argus.Event.data.aggregationKey | String | Event Aggregation Key |
| Argus.Event.data.sourceType | String | Event Source Type |
| Argus.Event.data.customerInfo.id | Number | Event Customer Info ID |
| Argus.Event.data.customerInfo.name | String | Event Customer Info Name |
| Argus.Event.data.customerInfo.shortName | String | Event Customer Info Short Name |
| Argus.Event.data.customerInfo.domain.id | Number | Event Customer Info Domain ID |
| Argus.Event.data.customerInfo.domain.name | String | Event Customer Info Domain Name |
| Argus.Event.data.update | Boolean | Event Update |
| Argus.Event.data.aggregated | Boolean | Event Aggregated |
| Argus.Event.data.encodedFlags | String | Event Encoded Flags |
Command Example
!argus-get-event customer_id=123 event_id=123456 timestamp=123456789 type=NIDS
argus-list-nids-events
Simple search for NIDS events.
Base Command
argus-list-nids-events
Input
| Argument Name | Description | Required |
|---|---|---|
| customer_id | Limit to customerID. | Optional |
| signature | Limit to signature. | Optional |
| ip | Limit to ip/network. | Optional |
| start_timestamp | Limit to events after this timestamp (default is last 24 hours). | Optional |
| end_timestamp | Limit to events before this timestamp (default: now). | Optional |
| limit | Limit results (default: 25). | Optional |
| offset | Skip a number of results. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.NIDS.responseCode | Number | API response metadata, response code of this request |
| Argus.NIDS.limit | Number | API response metadata, limit of results this request ran with |
| Argus.NIDS.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.NIDS.count | Number | API response metadata, total number of results this query has |
| Argus.NIDS.size | Number | API response metadata, the number of results returned in this request |
| Argus.NIDS.messages.message | String | NIDS Messages Message |
| Argus.NIDS.messages.messageTemplate | String | NIDS Messages Message Template |
| Argus.NIDS.messages.type | String | NIDS Messages Type |
| Argus.NIDS.messages.field | String | NIDS Messages Field |
| Argus.NIDS.messages.timestamp | Number | NIDS Messages Timestamp |
| Argus.NIDS.data.customerInfo.id | Number | NIDS Customer Info ID |
| Argus.NIDS.data.customerInfo.name | String | NIDS Customer Info Name |
| Argus.NIDS.data.customerInfo.shortName | String | NIDS Customer Info Short Name |
| Argus.NIDS.data.customerInfo.domain.id | Number | NIDS Customer Info Domain ID |
| Argus.NIDS.data.customerInfo.domain.name | String | NIDS Customer Info Domain Name |
| Argus.NIDS.data.properties.additionalProp1 | String | NIDS Properties Additional Prop 1 |
| Argus.NIDS.data.properties.additionalProp2 | String | NIDS Properties Additional Prop 2 |
| Argus.NIDS.data.properties.additionalProp3 | String | NIDS Properties Additional Prop 3 |
| Argus.NIDS.data.comments.timestamp | Number | NIDS Comments Timestamp |
| Argus.NIDS.data.comments.user.id | Number | NIDS Comments User ID |
| Argus.NIDS.data.comments.user.customerID | Number | NIDS Comments User Customer ID |
| Argus.NIDS.data.comments.user.customer.id | Number | NIDS Comments User Customer ID |
| Argus.NIDS.data.comments.user.customer.name | String | NIDS Comments User Customer Name |
| Argus.NIDS.data.comments.user.customer.shortName | String | NIDS Comments User Customer Short Name |
| Argus.NIDS.data.comments.user.customer.domain.id | Number | NIDS Comments User Customer Domain ID |
| Argus.NIDS.data.comments.user.customer.domain.name | String | NIDS Comments User Customer Domain Name |
| Argus.NIDS.data.comments.user.domain.id | Number | NIDS Comments User Domain ID |
| Argus.NIDS.data.comments.user.domain.name | String | NIDS Comments User Domain Name |
| Argus.NIDS.data.comments.user.userName | String | NIDS Comments User User Name |
| Argus.NIDS.data.comments.user.name | String | NIDS Comments User Name |
| Argus.NIDS.data.comments.user.type | String | NIDS Comments User Type |
| Argus.NIDS.data.comments.comment | String | NIDS Comments Comment |
| Argus.NIDS.data.sensor.sensorID | Number | NIDS Sensor Sensor ID |
| Argus.NIDS.data.sensor.hostName | String | NIDS Sensor Host Name |
| Argus.NIDS.data.sensor.hostIpAddress.host | Boolean | NIDS Sensor Host Ip Address Host |
| Argus.NIDS.data.sensor.hostIpAddress.ipv6 | Boolean | NIDS Sensor Host Ip Address Ipv 6 |
| Argus.NIDS.data.sensor.hostIpAddress.public | Boolean | NIDS Sensor Host Ip Address Public |
| Argus.NIDS.data.sensor.hostIpAddress.maskBits | Number | NIDS Sensor Host Ip Address Mask Bits |
| Argus.NIDS.data.sensor.hostIpAddress.multicast | Boolean | NIDS Sensor Host Ip Address Multicast |
| Argus.NIDS.data.sensor.hostIpAddress.address | String | NIDS Sensor Host Ip Address Address |
| Argus.NIDS.data.sensor.hostIpString | String | NIDS Sensor Host Ip String |
| Argus.NIDS.data.location.shortName | String | NIDS Location Short Name |
| Argus.NIDS.data.location.name | String | NIDS Location Name |
| Argus.NIDS.data.location.timeZone | String | NIDS Location Time Zone |
| Argus.NIDS.data.location.id | Number | NIDS Location ID |
| Argus.NIDS.data.attackInfo.alarmID | Number | NIDS Attack Info Alarm ID |
| Argus.NIDS.data.attackInfo.alarmDescription | String | NIDS Attack Info Alarm Description |
| Argus.NIDS.data.attackInfo.attackCategoryID | Number | NIDS Attack Info Attack Category ID |
| Argus.NIDS.data.attackInfo.attackCategoryName | String | NIDS Attack Info Attack Category Name |
| Argus.NIDS.data.attackInfo.signature | String | NIDS Attack Info Signature |
| Argus.NIDS.data.count | Number | API response metadata, total number of results this query has |
| Argus.NIDS.data.engineTimestamp | Number | NIDS Engine Timestamp |
| Argus.NIDS.data.protocolID | Number | NIDS Protocol ID |
| Argus.NIDS.data.domain.fqdn | String | NIDS Domain Fqdn |
| Argus.NIDS.data.uri | String | NIDS Uri |
| Argus.NIDS.data.source.port | Number | NIDS Source Port |
| Argus.NIDS.data.source.geoLocation.countryCode | String | NIDS Source Geo Location Country Code |
| Argus.NIDS.data.source.geoLocation.countryName | String | NIDS Source Geo Location Country Name |
| Argus.NIDS.data.source.geoLocation.locationName | String | NIDS Source Geo Location Location Name |
| Argus.NIDS.data.source.geoLocation.latitude | Number | NIDS Source Geo Location Latitude |
| Argus.NIDS.data.source.geoLocation.longitude | Number | NIDS Source Geo Location Longitude |
| Argus.NIDS.data.source.networkAddress.ipv6 | Boolean | NIDS Source Network Address Ipv 6 |
| Argus.NIDS.data.source.networkAddress.public | Boolean | NIDS Source Network Address Public |
| Argus.NIDS.data.source.networkAddress.maskBits | Number | NIDS Source Network Address Mask Bits |
| Argus.NIDS.data.source.networkAddress.multicast | Boolean | NIDS Source Network Address Multicast |
| Argus.NIDS.data.source.networkAddress.host | Boolean | NIDS Source Network Address Host |
| Argus.NIDS.data.source.networkAddress.address | String | NIDS Source Network Address Address |
| Argus.NIDS.data.destination.port | Number | NIDS Destination Port |
| Argus.NIDS.data.destination.geoLocation.countryCode | String | NIDS Destination Geo Location Country Code |
| Argus.NIDS.data.destination.geoLocation.countryName | String | NIDS Destination Geo Location Country Name |
| Argus.NIDS.data.destination.geoLocation.locationName | String | NIDS Destination Geo Location Location Name |
| Argus.NIDS.data.destination.geoLocation.latitude | Number | NIDS Destination Geo Location Latitude |
| Argus.NIDS.data.destination.geoLocation.longitude | Number | NIDS Destination Geo Location Longitude |
| Argus.NIDS.data.destination.networkAddress.ipv6 | Boolean | NIDS Destination Network Address Ipv 6 |
| Argus.NIDS.data.destination.networkAddress.public | Boolean | NIDS Destination Network Address Public |
| Argus.NIDS.data.destination.networkAddress.maskBits | Number | NIDS Destination Network Address Mask Bits |
| Argus.NIDS.data.destination.networkAddress.multicast | Boolean | NIDS Destination Network Address Multicast |
| Argus.NIDS.data.destination.networkAddress.host | Boolean | NIDS Destination Network Address Host |
| Argus.NIDS.data.destination.networkAddress.address | String | NIDS Destination Network Address Address |
| Argus.NIDS.data.timestamp | Number | NIDS Timestamp |
| Argus.NIDS.data.severity | String | NIDS Severity |
| Argus.NIDS.data.flags | String | NIDS Flags |
| Argus.NIDS.data.id | String | NIDS ID |
Command Example
!argus-list-nids-events
argus-find-nids-events
Search for NIDS events.
Base Command
argus-find-nids-events
Input
| Argument Name | Description | Required |
|---|---|---|
| skip_future_events | Skip future evnts. Possible values are: true, false. | Optional |
| exclude | Exclude. Possible values are: true, false. | Optional |
| event_identifier | (as comma-separated list). | Optional |
| location_id | (as comma-separated list). | Optional |
| severity | (as comma-separated list). | Optional |
| customer | (as comma-separated list). | Optional |
| alarm_id | (as comma-separated list). | Optional |
| attack_category_id | (as comma-separated list). | Optional |
| source_geo_country | (as comma-separated list). | Optional |
| destination_geo_country | (as comma-separated list). | Optional |
| geo_country | (as comma-separated list). | Optional |
| properties | As [key,value,key,value, …] l. | Optional |
| exact_match_properties | Use exact matching. Possible values are: true, false. | Optional |
| sensor_id | (as comma-separated list). | Optional |
| sub_criteria | (as comma-separated list). | Optional |
| signature | (as comma-separated list). | Optional |
| last_updated_timestamp | Last updated timestamp. | Optional |
| index_start_time | Index start time. | Optional |
| index_end_time | Index end time. | Optional |
| destination_ip | (as comma-separated list). | Optional |
| source_ip | (as comma-separated list). | Optional |
| ip | (as comma-separated list). | Optional |
| destination_port | (as comma-separated list). | Optional |
| source_port | (as comma-separated list). | Optional |
| port | source_port. | Optional |
| min_severity | Minimum severity. | Optional |
| max_severity | Maximum severity. | Optional |
| limit | Limit number of results (default 25). | Optional |
| offset | Skip a number of results. | Optional |
| include_deleted | Inclide deleted events. Possible values are: true, false. | Optional |
| start_timestamp | Search objects from this timestamp (default: -24hours). | Optional |
| end_timestamp | Search objects until this timestamp (default: now). | Optional |
| sort_by | Order results by these properties (prefix with - to sort descending) (as comma-separated list). | Optional |
| include_flags | (as comma-separated list). | Optional |
| exclude_flags | (as comma-separated list). | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.NIDS.responseCode | Number | API response metadata, response code of this request |
| Argus.NIDS.limit | Number | API response metadata, limit of results this request ran with |
| Argus.NIDS.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.NIDS.count | Number | API response metadata, total number of results this query has |
| Argus.NIDS.size | Number | API response metadata, the number of results returned in this request |
| Argus.NIDS.messages.message | String | NIDS Messages Message |
| Argus.NIDS.messages.messageTemplate | String | NIDS Messages Message Template |
| Argus.NIDS.messages.type | String | NIDS Messages Type |
| Argus.NIDS.messages.field | String | NIDS Messages Field |
| Argus.NIDS.messages.timestamp | Number | NIDS Messages Timestamp |
| Argus.NIDS.data.customerInfo.id | Number | NIDS Customer Info ID |
| Argus.NIDS.data.customerInfo.name | String | NIDS Customer Info Name |
| Argus.NIDS.data.customerInfo.shortName | String | NIDS Customer Info Short Name |
| Argus.NIDS.data.customerInfo.domain.id | Number | NIDS Customer Info Domain ID |
| Argus.NIDS.data.customerInfo.domain.name | String | NIDS Customer Info Domain Name |
| Argus.NIDS.data.properties.additionalProp1 | String | NIDS Properties Additional Prop 1 |
| Argus.NIDS.data.properties.additionalProp2 | String | NIDS Properties Additional Prop 2 |
| Argus.NIDS.data.properties.additionalProp3 | String | NIDS Properties Additional Prop 3 |
| Argus.NIDS.data.comments.timestamp | Number | NIDS Comments Timestamp |
| Argus.NIDS.data.comments.user.id | Number | NIDS Comments User ID |
| Argus.NIDS.data.comments.user.customerID | Number | NIDS Comments User Customer ID |
| Argus.NIDS.data.comments.user.customer.id | Number | NIDS Comments User Customer ID |
| Argus.NIDS.data.comments.user.customer.name | String | NIDS Comments User Customer Name |
| Argus.NIDS.data.comments.user.customer.shortName | String | NIDS Comments User Customer Short Name |
| Argus.NIDS.data.comments.user.customer.domain.id | Number | NIDS Comments User Customer Domain ID |
| Argus.NIDS.data.comments.user.customer.domain.name | String | NIDS Comments User Customer Domain Name |
| Argus.NIDS.data.comments.user.domain.id | Number | NIDS Comments User Domain ID |
| Argus.NIDS.data.comments.user.domain.name | String | NIDS Comments User Domain Name |
| Argus.NIDS.data.comments.user.userName | String | NIDS Comments User User Name |
| Argus.NIDS.data.comments.user.name | String | NIDS Comments User Name |
| Argus.NIDS.data.comments.user.type | String | NIDS Comments User Type |
| Argus.NIDS.data.comments.comment | String | NIDS Comments Comment |
| Argus.NIDS.data.sensor.sensorID | Number | NIDS Sensor Sensor ID |
| Argus.NIDS.data.sensor.hostName | String | NIDS Sensor Host Name |
| Argus.NIDS.data.sensor.hostIpAddress.host | Boolean | NIDS Sensor Host Ip Address Host |
| Argus.NIDS.data.sensor.hostIpAddress.ipv6 | Boolean | NIDS Sensor Host Ip Address Ipv 6 |
| Argus.NIDS.data.sensor.hostIpAddress.public | Boolean | NIDS Sensor Host Ip Address Public |
| Argus.NIDS.data.sensor.hostIpAddress.maskBits | Number | NIDS Sensor Host Ip Address Mask Bits |
| Argus.NIDS.data.sensor.hostIpAddress.multicast | Boolean | NIDS Sensor Host Ip Address Multicast |
| Argus.NIDS.data.sensor.hostIpAddress.address | String | NIDS Sensor Host Ip Address Address |
| Argus.NIDS.data.sensor.hostIpString | String | NIDS Sensor Host Ip String |
| Argus.NIDS.data.location.shortName | String | NIDS Location Short Name |
| Argus.NIDS.data.location.name | String | NIDS Location Name |
| Argus.NIDS.data.location.timeZone | String | NIDS Location Time Zone |
| Argus.NIDS.data.location.id | Number | NIDS Location ID |
| Argus.NIDS.data.attackInfo.alarmID | Number | NIDS Attack Info Alarm ID |
| Argus.NIDS.data.attackInfo.alarmDescription | String | NIDS Attack Info Alarm Description |
| Argus.NIDS.data.attackInfo.attackCategoryID | Number | NIDS Attack Info Attack Category ID |
| Argus.NIDS.data.attackInfo.attackCategoryName | String | NIDS Attack Info Attack Category Name |
| Argus.NIDS.data.attackInfo.signature | String | NIDS Attack Info Signature |
| Argus.NIDS.data.count | Number | API response metadata, total number of results this query has |
| Argus.NIDS.data.engineTimestamp | Number | NIDS Engine Timestamp |
| Argus.NIDS.data.protocolID | Number | NIDS Protocol ID |
| Argus.NIDS.data.domain.fqdn | String | NIDS Domain Fqdn |
| Argus.NIDS.data.uri | String | NIDS Uri |
| Argus.NIDS.data.source.port | Number | NIDS Source Port |
| Argus.NIDS.data.source.geoLocation.countryCode | String | NIDS Source Geo Location Country Code |
| Argus.NIDS.data.source.geoLocation.countryName | String | NIDS Source Geo Location Country Name |
| Argus.NIDS.data.source.geoLocation.locationName | String | NIDS Source Geo Location Location Name |
| Argus.NIDS.data.source.geoLocation.latitude | Number | NIDS Source Geo Location Latitude |
| Argus.NIDS.data.source.geoLocation.longitude | Number | NIDS Source Geo Location Longitude |
| Argus.NIDS.data.source.networkAddress.ipv6 | Boolean | NIDS Source Network Address Ipv 6 |
| Argus.NIDS.data.source.networkAddress.public | Boolean | NIDS Source Network Address Public |
| Argus.NIDS.data.source.networkAddress.maskBits | Number | NIDS Source Network Address Mask Bits |
| Argus.NIDS.data.source.networkAddress.multicast | Boolean | NIDS Source Network Address Multicast |
| Argus.NIDS.data.source.networkAddress.host | Boolean | NIDS Source Network Address Host |
| Argus.NIDS.data.source.networkAddress.address | String | NIDS Source Network Address Address |
| Argus.NIDS.data.destination.port | Number | NIDS Destination Port |
| Argus.NIDS.data.destination.geoLocation.countryCode | String | NIDS Destination Geo Location Country Code |
| Argus.NIDS.data.destination.geoLocation.countryName | String | NIDS Destination Geo Location Country Name |
| Argus.NIDS.data.destination.geoLocation.locationName | String | NIDS Destination Geo Location Location Name |
| Argus.NIDS.data.destination.geoLocation.latitude | Number | NIDS Destination Geo Location Latitude |
| Argus.NIDS.data.destination.geoLocation.longitude | Number | NIDS Destination Geo Location Longitude |
| Argus.NIDS.data.destination.networkAddress.ipv6 | Boolean | NIDS Destination Network Address Ipv 6 |
| Argus.NIDS.data.destination.networkAddress.public | Boolean | NIDS Destination Network Address Public |
| Argus.NIDS.data.destination.networkAddress.maskBits | Number | NIDS Destination Network Address Mask Bits |
| Argus.NIDS.data.destination.networkAddress.multicast | Boolean | NIDS Destination Network Address Multicast |
| Argus.NIDS.data.destination.networkAddress.host | Boolean | NIDS Destination Network Address Host |
| Argus.NIDS.data.destination.networkAddress.address | String | NIDS Destination Network Address Address |
| Argus.NIDS.data.timestamp | Number | NIDS Timestamp |
| Argus.NIDS.data.severity | String | NIDS Severity |
| Argus.NIDS.data.flags | String | NIDS Flags |
| Argus.NIDS.data.id | String | NIDS ID |
Command Example
!argus-find-nids-events
argus-pdns-search-records
Search against PassiveDNS with criteria and return matching records.
Base Command
argus-pdns-search-records
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Lookup query. | Required |
| aggregate_result | Whether aggregate results (default true) . Possible values are: true, false. | Optional |
| include_anonymous_results | Whether include anonymous results (default true) . Possible values are: true, false. | Optional |
| rr_class | Lookup with specified record classes (as comma-separated list). | Optional |
| rr_type | Lookup with specified record types (as comma-separated list). | Optional |
| customer_id | Lookup for specified customer IDs (as comma-separated list). | Optional |
| tlp | Lookup with specified TLPs, public usage only TLP white allowed (as comma-separated list). Possible values are: white, green, amber, red. | Optional |
| limit | Max number of results to be returned, default unset means default limit 25 will be used, 0 means unlimited. | Optional |
| offset | Number of results to be skipped first (default 0). | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.PDNS.responseCode | Number | API response metadata, response code of this request |
| Argus.PDNS.limit | Number | API response metadata, limit of results this request ran with |
| Argus.PDNS.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.PDNS.count | Number | API response metadata, total number of results this query has |
| Argus.PDNS.size | Number | API response metadata, the number of results returned in this request |
| Argus.PDNS.messages.message | String | PDNS Messages Message |
| Argus.PDNS.messages.messageTemplate | String | PDNS Messages Message Template |
| Argus.PDNS.messages.type | String | PDNS Messages Type |
| Argus.PDNS.messages.field | String | PDNS Messages Field |
| Argus.PDNS.messages.timestamp | Number | PDNS Messages Timestamp |
| Argus.PDNS.data.createdTimestamp | Number | PDNS Created Timestamp |
| Argus.PDNS.data.lastUpdatedTimestamp | Number | PDNS Last Updated Timestamp |
| Argus.PDNS.data.times | Number | PDNS Times |
| Argus.PDNS.data.tlp | String | PDNS Tlp |
| Argus.PDNS.data.query | String | PDNS Query |
| Argus.PDNS.data.answer | String | PDNS Answer |
| Argus.PDNS.data.minTtl | Number | PDNS Min Ttl |
| Argus.PDNS.data.maxTtl | Number | PDNS Max Ttl |
| Argus.PDNS.data.customer.id | Number | PDNS Customer ID |
| Argus.PDNS.data.customer.name | String | PDNS Customer Name |
| Argus.PDNS.data.customer.shortName | String | PDNS Customer Short Name |
| Argus.PDNS.data.customer.domain.id | Number | PDNS Customer Domain ID |
| Argus.PDNS.data.customer.domain.name | String | PDNS Customer Domain Name |
| Argus.PDNS.data.lastSeenTimestamp | Number | PDNS Last Seen Timestamp |
| Argus.PDNS.data.firstSeenTimestamp | Number | PDNS First Seen Timestamp |
| Argus.PDNS.data.rrclass | String | PDNS Rrclass |
| Argus.PDNS.data.rrtype | String | PDNS Rrtype |
Command Example
!argus-pdns-search-records query=mnemonic.no
argus-fetch-observations-for-domain
Look up reputation observations for the given domain
Base Command
argus-fetch-observations-for-domain
Input
| Argument Name | Description | Required |
|---|---|---|
| fqdn | Domain to fetch observations for. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.ObservationsDomain.responseCode | Number | API response metadata, response code of this request |
| Argus.ObservationsDomain.limit | Number | API response metadata, limit of results this request ran with |
| Argus.ObservationsDomain.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.ObservationsDomain.count | Number | API response metadata, total number of results this query has |
| Argus.ObservationsDomain.size | Number | API response metadata, the number of results returned in this request |
| Argus.ObservationsDomain.messages.message | String | Observations Domain Messages Message |
| Argus.ObservationsDomain.messages.messageTemplate | String | Observations Domain Messages Message Template |
| Argus.ObservationsDomain.messages.type | String | Observations Domain Messages Type |
| Argus.ObservationsDomain.messages.field | String | Observations Domain Messages Field |
| Argus.ObservationsDomain.messages.timestamp | Number | Observations Domain Messages Timestamp |
| Argus.ObservationsDomain.data.domainName.fqdn | String | Observations Domain Domain Name Fqdn |
| Argus.ObservationsDomain.data.reason | String | Observations Domain Reason |
| Argus.ObservationsDomain.data.override | Boolean | Observations Domain Override |
| Argus.ObservationsDomain.data.value | Number | Observations Domain Value |
Command Example
!argus-fetch-observations-for-domain fqdn=mnemonic.no
argus-fetch-observations-for-ip
Look up reputation observations for the given IP
Base Command
argus-fetch-observations-for-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | IP address to fetch observations for. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Argus.ObservationsIP.responseCode | Number | API response metadata, response code of this request |
| Argus.ObservationsIP.limit | Number | API response metadata, limit of results this request ran with |
| Argus.ObservationsIP.offset | Number | API response metadata, the offset into the result-set of this query |
| Argus.ObservationsIP.count | Number | API response metadata, total number of results this query has |
| Argus.ObservationsIP.size | Number | API response metadata, the number of results returned in this request |
| Argus.ObservationsIP.messages.message | String | Observations IP Messages Message |
| Argus.ObservationsIP.messages.messageTemplate | String | Observations IP Messages Message Template |
| Argus.ObservationsIP.messages.type | String | Observations IP Messages Type |
| Argus.ObservationsIP.messages.field | String | Observations IP Messages Field |
| Argus.ObservationsIP.messages.timestamp | Number | Observations IP Messages Timestamp |
| Argus.ObservationsIP.data.id | Number | Observations IP ID |
| Argus.ObservationsIP.data.lastModified | Number | Observations IP Last Modified |
| Argus.ObservationsIP.data.source.id | Number | Observations IP Source ID |
| Argus.ObservationsIP.data.source.alias | String | Observations IP Source Alias |
| Argus.ObservationsIP.data.source.name | String | Observations IP Source Name |
| Argus.ObservationsIP.data.role.id | Number | Observations IP Role ID |
| Argus.ObservationsIP.data.role.alias | String | Observations IP Role Alias |
| Argus.ObservationsIP.data.role.name | String | Observations IP Role Name |
| Argus.ObservationsIP.data.firstSeen | Number | Observations IP First Seen |
| Argus.ObservationsIP.data.lastSeen | Number | Observations IP Last Seen |
| Argus.ObservationsIP.data.numObservations | Number | Observations IP Num Observations |
| Argus.ObservationsIP.data.state | Number | Observations IP State |
| Argus.ObservationsIP.data.comment | String | Observations IP Comment |
| Argus.ObservationsIP.data.address.host | Boolean | Observations IP Address Host |
| Argus.ObservationsIP.data.address.ipv6 | Boolean | Observations IP Address Ipv 6 |
| Argus.ObservationsIP.data.address.maskBits | Number | Observations IP Address Mask Bits |
| Argus.ObservationsIP.data.address.multicast | Boolean | Observations IP Address Multicast |
| Argus.ObservationsIP.data.address.public | Boolean | Observations IP Address Public |
| Argus.ObservationsIP.data.address.address | String | Observations IP Address Address |
Command Example
!argus-fetch-observations-for-ip ip=94.127.56.170
get-remote-data
Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
Base Command
get-remote-data
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Argus Case ID. | Optional |
| lastUpdate | Time or timestamp case was last updated. | Optional |
Context Output
There is no context output for this command.
Command Example
!get-remote-data case_id=123
update-remote-system
Updates the remote system with incident changes.
Base Command
update-remote-system
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
There is no context output for this command.
Command Example
!update-remote-system
argus-download-attachment-by-filename
Downloads case attachment by best-effort search of filename.
Base Command
argus-download-attachment-by-filename
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID. | Required |
| file_name | Filename. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.Size | Number | The size of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The name of the file. |
| File.SSDeep | String | The SSDeep hash of the file. |
| File.EntryID | String | The entry ID of the file. |
| File.Info | String | File information. |
| File.Type | String | The file type. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Extension | String | The file extension. |
Command Example
!argus-download-attachment-by-filename case_id=123 file_name=file.name
argus-print-case-comments
Print case comments as notes
Base Command
argus-print-case-comments
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID. | Required |
Context Output
There is no context output for this command.
Command Example
!argus_print_case_comments case_id=123
argus-print-case-metadata-by-id
Print case metadata as HTML. Does not add to context.
Base Command
argus-print-case-metadata-by-id
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID. | Required |
| skip_redirect | If true, skip automatic redirect (for merged cases). | Optional |
Context Output
There is no context output for this command.
Command Example
!argus-print-case_metadata_by_id case_id=123
argus-download-case-attachments
Download all attachments related to Argus Case.
Base Command
argus-download-case-attachments
Input
| Argument Name | Description | Required |
|---|---|---|
| case_id | Case ID. | Required |
Context Output
There is no context output for this command.
Command Example
!argus-download-case-attachments case_id=123
Configuration parameters
isFetch— Fetch incidentsincidentType— Incident typeincidentFetchInterval— Incidents Fetch Intervalapi_url— API URL (required)api_key— API Key (required)min_severity— Minimum severity of alerts to fetch (required)first_fetch— First fetch timemax_fetch— Maximum number of incidents per fetchexclude_tag— Fetch incidents exclude tagmirror_direction— Incident Mirroring Directionmirror_tag— Mirroring tagclose_argus_case— Close Argus Caseclose_incident— Close XSOAR Incidentinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (35)
-
argus-add-attachmentAdd attachment to case (Max 50 MB, should be an archive).
-
argus-add-case-tagAdds a key, value tag to an Argus case.
-
argus-add-commentAdd comment to an Argus case.
-
argus-advanced-case-searchReturns cases matching the defined case search criteria.
-
argus-close-caseClose an Argus case.
-
argus-create-caseCreate Argus case.
-
argus-delete-caseMark existing case as deleted.
-
argus-delete-commentMark existing comment as deleted.
-
argus-download-attachmentDownload specific attachment contents.
-
argus-download-attachment-by-filenameDownloads case attachment by best-effort search of filename.
-
argus-download-case-attachmentsDownload all attachments related to Argus Case.
-
argus-edit-commentEdit existing comment.
-
argus-fetch-observations-for-domainLook up reputation observations for the given domain.
-
argus-fetch-observations-for-ipLook up reputation observations for the given IP.
-
argus-find-aggregated-eventsSearch for aggregated events (OSB! advanced method: look in API doc).
-
argus-find-nids-eventsSearch for NIDS events.
-
argus-get-attachmentFetch specific attachment metadata.
-
argus-get-case-metadata-by-idReturns the basic case descriptor for the case identified by ID.
-
argus-get-eventFetch specified event.
-
argus-get-events-for-caseFetch events associated with specified case.
-
argus-get-payloadFetch specified event payload.
-
argus-get-pcapFetch specified event payload as PCAP.
-
argus-list-aggregated-eventsList aggregated events.
-
argus-list-case-attachmentsList attachments for an existing case.
-
argus-list-case-commentsList the comments of an Argus case.
-
argus-list-case-tagsList tags attached to an Argus case.
-
argus-list-nids-eventsSimple search for NIDS events.
-
argus-pdns-search-recordsSearch against PassiveDNS with criteria and return matching records.
-
argus-print-case-commentsPrint case comments as notes.
-
argus-print-case-metadata-by-idPrint case metadata as HTML. Does not add to context.
-
argus-remove-case-tag-by-idRemove existing tag by tag ID.
-
argus-remove-case-tag-by-key-valueRemove existing tag with key, value matching.
-
argus-update-caseRequest changes to basic fields of an existing case.
-
get-remote-dataGet remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
-
update-remote-systemUpdates the remote system with incident changes.
import demistomock as demisto from CommonServerPython import * """ IMPORTS """ import html import json import logging import mimetypes import traceback from typing import Any import dateparser import urllib3 from argus_api import session as argus_session from argus_api.exceptions.http import AccessDeniedException from argus_api.lib.cases.v2.case import ( add_attachment, add_case_tag, add_comment, advanced_case_search, close_case, create_case, delete_case, delete_comment, download_attachment, edit_comment, get_attachment, get_case_metadata_by_id, list_case_attachments, list_case_comments, list_case_tags, remove_case_tag_by_id, remove_case_tag_by_key_value, update_case, ) from argus_api.lib.currentuser.v1.user import get_current_user from argus_api.lib.events.v1 import get_event_by_path from argus_api.lib.events.v1.aggregated import ( find_aggregated_events, list_aggregated_events, ) from argus_api.lib.events.v1.case.case import get_events_for_case from argus_api.lib.events.v1.nids import find_n_i_d_s_events, list_n_i_d_s_events from argus_api.lib.events.v1.payload import get_payload from argus_api.lib.events.v1.pcap import get_pcap from argus_api.lib.pdns.v3.search import search_records from argus_api.lib.reputation.v1.observation import ( fetch_observations_for_domain, fetch_observations_for_i_p, ) # Disable insecure warnings urllib3.disable_warnings() """ CONSTANTS """ DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ" PRETTY_DATE_FORMAT = "%b %d, %Y, %H:%M:%S" FETCH_TAG = demisto.params().get("fetch_tag") ATTACHMENT_SUBSTRING = "_xsoar-upload" MIRROR_DIRECTION = { "None": None, "Incoming": "In", "Outgoing": "Out", "Incoming And Outgoing": "Both", } ARGUS_STATUS_MAPPING = { "pendingCustomer": 0, "pendingSoc": 0, "pendingVendor": 0, "pendingClose": 0, "workingSoc": 1, "workingCustomer": 1, "closed": 2, } ARGUS_PRIORITY_MAPPING = {"low": 1, "medium": 2, "high": 3, "critical": 4} """ HELPER FUNCTIONS """ def set_argus_settings(api_key: str, base_url: str = None, proxies: dict = None, verify: bool = None): argus_session.api_key = api_key argus_session.base_url = base_url argus_session.proxies = proxies argus_session.verify = verify def argus_priority_to_demisto_severity(priority: str) -> int: return ARGUS_PRIORITY_MAPPING.get(priority, 0) def argus_status_to_demisto_status(status: str) -> int: return ARGUS_STATUS_MAPPING.get(status, 0) def build_argus_priority_from_min_severity(min_severity: str) -> list[str]: severities = ["low", "medium", "high", "critical"] min_severity_list = [] for severity in severities: if argus_priority_to_demisto_severity(min_severity.lower()) <= argus_priority_to_demisto_severity(severity): min_severity_list.append(severity) return min_severity_list def parse_first_fetch(first_fetch: Any) -> Any: if isinstance(first_fetch, str) and first_fetch[0] != "-": first_fetch = f"-{first_fetch}" return first_fetch def build_tags_from_list(lst: list) -> list[dict]: if not lst: return [] if len(lst) % 2 != 0: return [] tags = [] for i in range(0, len(lst), 2): tags.append({"key": lst[i], "value": lst[i + 1]}) return tags def str_to_dict(string: str) -> dict: if not string: return {} lst = argToList(string) if len(lst) % 2 != 0: return {} return {lst[i]: lst[i + 1] for i in range(0, len(lst), 2)} def date_time_to_epoch_milliseconds(date_time: datetime | str = None) -> int: # type: ignore[assignment] if isinstance(date_time, datetime): return int(date_time.timestamp() * 1000) if isinstance(date_time, str): return date_time_to_epoch_milliseconds(dateparser.parse(date_time)) # type: ignore[arg-type] return int(datetime.now().timestamp() * 1000) def pretty_print_date(date_time: datetime | str = None) -> str: # type: ignore[assignment] if isinstance(date_time, datetime): return date_time.strftime(PRETTY_DATE_FORMAT) if isinstance(date_time, str): return pretty_print_date(dateparser.parse(date_time)) # type: ignore[arg-type] return datetime.now().strftime(PRETTY_DATE_FORMAT) def pretty_print_case_metadata(result: dict, title: str = None) -> str: data = result["data"] string = title if title else f"# #{data['id']}: {data['subject']}\n" string += "_Priority: {}, status: {}, last updated: {}_\n".format( data["priority"], data["status"], pretty_print_date(data["lastUpdatedTime"]) ) string += "Reported by {} at {}\n\n".format(data["publishedByUser"]["name"], pretty_print_date(data["publishedTime"])) string += data["description"] return string def pretty_print_case_metadata_html(case: dict, title: str = None) -> str: string = title if title else f"<h2>#{case['id']}: {html.escape(str(case['subject']))}</h2>" string += "<em>Priority: {}, status: {}, last updated: {}</em><br>".format( html.escape(str(case["priority"])), html.escape(str(case["status"])), pretty_print_date(case["lastUpdatedTime"]) ) string += "Reported by {} at {}<br><br>".format( html.escape(str(case["publishedByUser"]["name"])), pretty_print_date(case["publishedTime"]) ) string += html.escape(str(case["description"])) return string def pretty_print_comment(comment: dict, title: str = None) -> str: string = title if title else "" string += f"#### *{comment['addedByUser']['userName']} - {pretty_print_date(comment['addedTime'])}*\n" string += f"_Last updated {pretty_print_date(comment['lastUpdatedTime'])}_\n" if comment["lastUpdatedTime"] else "" string += f"{comment['comment']}\n\n" string += f"_id: {comment['id']}_\n" string += f"_Flags: {comment['flags']!s}_\n" if comment["flags"] else "" string += "* * *\n" return string def pretty_print_comment_html(comment: dict, title: str = None) -> str: escaped_username = html.escape(str(comment["addedByUser"]["userName"])) escaped_comment_text = html.escape(str(comment["comment"])) string = f"<h2>{title}</h2>" if title else "" string += "<small>" string += f"<em>Added by {escaped_username} at " string += f"{pretty_print_date(comment['addedTime'])}</em><br>" string += f"<em>Last updated {pretty_print_date(comment['lastUpdatedTime'])}</em><br>" if comment["lastUpdatedTime"] else "" if comment["associatedAttachments"]: string += "<em>Associated attachment(s): " for attachment in comment["associatedAttachments"]: string += f"{html.escape(str(attachment.get('name', '')))} " string += "</em><br>" string += "</small>" string += escaped_comment_text return string def pretty_print_comments(comments: list, title: str = None) -> str: string = title if title else "" for comment in comments: string += pretty_print_comment(comment) return string def pretty_print_comments_html(comments: list, title: str = None) -> str: string = title if title else "" for comment in comments: string += pretty_print_comment_html(comment) string += "<hr>" return string def pretty_print_events(result: dict, title: str = None) -> str: string = title if title else "" string += "_Count: {}, showing {} events, from {} to {}_\n".format( result["count"], result["size"], result["offset"], result["limit"] ) string += tableToMarkdown("Events", result["data"]) return string def pretty_print_attachment_metadata(result: dict, title: str = None) -> str: string = title if title else "" string += f"#### *{result['data']['addedByUser']['userName']} - {result['data']['addedTime']}*\n" string += f"{result['data']['name']} ({result['data']['mimeType']}, {result['data']['size']} bytes)\n\n" string += f"_id: {result['data']['id']}_\n" return string def add_attachment_helper(case_id: int, file_id: str) -> dict: path_res = demisto.getFilePath(file_id) full_file_name = path_res.get("name") file_name, file_extension = os.path.splitext(full_file_name) file_name = f"{file_name}{ATTACHMENT_SUBSTRING}{file_extension}" mime_type = mimetypes.guess_type(full_file_name) if not mime_type[0]: error = f"File {full_file_name} mimetype unknown, not sending. Consider zipping file." demisto.error(error) return {"error": error} with open(path_res.get("path"), "rb") as file_to_send: # noinspection PyTypeChecker return add_attachment( caseID=case_id, name=file_name, mimeType=mime_type[0], data=b64_encode(file_to_send.read()), ) """ COMMAND FUNCTIONS """ def test_module_command() -> str: response = get_current_user() if response["responseCode"] == 200: return "ok" return f"Unable to communicate with Argus API {response['responseCode']}, {response}" def fetch_incidents( last_run: dict, first_fetch_period: str, limit: int = 25, min_severity: str = "low", integration_instance: str = "", mirror_direction: str = "None", mirror_tags: str = "argus_mirror", exclude_tag: str = "", ): start_timestamp = last_run.get("start_time") if last_run else None # Exclude closed cases sub_criteria = [{"exclude": True, "status": ["closed"]}] # Exclude cases with {key} or {key: value} tags if exclude_tag: tag_list = exclude_tag.strip().split(",") if len(tag_list) == 1: sub_criteria.append({"exclude": True, "tag": {"key": tag_list[0]}}) elif len(tag_list) == 2: sub_criteria.append({"exclude": True, "tag": {"key": tag_list[0], "values": tag_list[1]}}) # noinspection PyTypeChecker result = advanced_case_search( startTimestamp=start_timestamp if start_timestamp else first_fetch_period, endTimestamp="now", limit=limit, sortBy=["createdTimestamp"], priority=build_argus_priority_from_min_severity(min_severity), subCriteria=sub_criteria, timeFieldStrategy=["createdTimestamp"], ) incidents = [] for case in result.get("data", []): case["xsoar_mirroring"] = { "dbotMirrorId": str(case["id"]), "dbotMirrorInstance": integration_instance, "dbotMirrorDirection": MIRROR_DIRECTION[mirror_direction], "dbotMirrorTags": argToList(mirror_tags), } case["url"] = f"https://portal.mnemonic.no/spa/case/view/{case['id']}" incident = { "name": f"#{case['id']}: {case['subject']}", "occurred": case["createdTime"], "severity": argus_priority_to_demisto_severity(case["priority"]), "status": argus_status_to_demisto_status(case["status"]), "details": json.dumps(case), "rawJSON": json.dumps(case), } incidents.append(incident) if result.get("data", []): last_run["start_time"] = str(result.get("data")[-1]["createdTimestamp"] + 1) return last_run, incidents def get_remote_data_command( args: dict[str, Any], integration_instance: str = "", mirror_direction: str = "None", mirror_tags: str = "argus_mirror", ) -> GetRemoteDataResponse: remote_args = GetRemoteDataArgs(args) case_id = remote_args.remote_incident_id if not case_id: case_id = args.get("id", "") if not case_id: raise ValueError("case id not found") demisto.debug(f"Getting update for remote [{case_id}]") last_mirror_update = dateparser.parse(remote_args.last_update) if not last_mirror_update: last_mirror_update = dateparser.parse(args.get("lastUpdate", "")) if not last_mirror_update: raise ValueError("last update not found") demisto.debug(f"Getting update with last update [{last_mirror_update}]") case = get_case_metadata_by_id(id=int(case_id)).get("data", {}) # There are no updates to case, return empty if last_mirror_update > dateparser.parse(case.get("lastUpdatedTime", "")): # type: ignore return GetRemoteDataResponse({}, []) entries = [] last_update_timestamp = date_time_to_epoch_milliseconds(last_mirror_update) # Update status and severity (updates whether there are changes or not) entries.append({"severity": argus_priority_to_demisto_severity(case.get("priority"))}) entries.append({"arguscasestatus": case.get("status")}) entries.append({"status": argus_status_to_demisto_status(case.get("status"))}) # Add new attachments case_attachments = list_case_attachments(caseID=int(case_id)).get("data", []) for attachment in case_attachments: if ATTACHMENT_SUBSTRING in attachment["name"]: # file already uploaded by xsoar demisto.debug(f"Ignoring file {attachment['name']} since it contains {ATTACHMENT_SUBSTRING}") elif last_update_timestamp < attachment.get("addedTimestamp", 0): entries.append( fileResult( attachment["name"], download_attachment(caseID=int(case_id), attachmentID=attachment["id"]).content, ) ) # Attach comments as notes case_comments = list_case_comments(caseID=int(case_id)).get("data", []) for comment in case_comments: # New comment if last_update_timestamp < comment.get("addedTimestamp", 0): entries.append( { "Note": True, "Type": entryTypes["note"], "ContentsFormat": formats["html"], # type: ignore "Contents": pretty_print_comment_html(comment), # type: ignore } ) # Existing comment has been updated elif comment.get("addedTimestamp", 0) < last_update_timestamp < comment.get("lastUpdatedTimestamp", ""): entries.append( { "Note": True, "Type": entryTypes["note"], "ContentsFormat": formats["html"], # type: ignore "Contents": (pretty_print_comment_html(comment, "Comment updated")), # type: ignore } ) # Re-attach xsoar mirroring tags, otherwise mirroring breaks case["xsoar_mirroring"] = { "dbotMirrorId": str(case["id"]), "dbotMirrorInstance": integration_instance, "dbotMirrorDirection": MIRROR_DIRECTION[mirror_direction], "dbotMirrorTags": argToList(mirror_tags), } # Close case? close_incident = demisto.params().get("close_incident", True) if case.get("status", "") == "closed" and close_incident: entries.append( { "Type": EntryType.NOTE, "ContentsFormat": EntryFormat.JSON, # type: ignore "Contents": { # type: ignore "dbotIncidentClose": True, "closeReason": "Argus Case closed", "closeNotes": "Argus Case was marked as closed remotely, incident closed.", }, } ) return GetRemoteDataResponse(case, entries) def update_remote_system_command(args: dict[str, Any]) -> CommandResults: parsed_args = UpdateRemoteSystemArgs(args) if parsed_args.delta: demisto.debug(f"Got the following delta keys {list(parsed_args.delta.keys())!s}") demisto.debug(f"Sending incident with remote ID [{parsed_args.remote_incident_id}] to remote system\n") if parsed_args.incident_changed and parsed_args.delta: demisto.debug(f"Incident {parsed_args.remote_incident_id} changed, updating") to_update = {} for key, value in parsed_args.delta.items(): # Allow changing status of case from XSOAR layout if key == "arguscasestatus": if value in ARGUS_STATUS_MAPPING: to_update["status"] = value # Allow changing argus priority based upon XSOAR severity elif key == "severity": for priority, severity in ARGUS_PRIORITY_MAPPING.items(): if severity == value: to_update["priority"] = priority break if to_update: updates = "<b>Following keys have been updated by XSOAR</b><br>" for key, value in to_update.items(): updates += f"{key}: {value}<br>" to_update["comment"] = updates to_update["internal_comment"] = True update_case( id=parsed_args.remote_incident_id, status=to_update.get("status"), priority=to_update.get("priority"), comment=to_update.get("comment"), internalComment=to_update.get("internal_comment"), ) else: demisto.debug( f"Skipping updating remote incident fields [{parsed_args.remote_incident_id}] as it is not new nor changed." ) # Send over comments and new files if parsed_args.entries: for entry in parsed_args.entries: demisto.debug(f'Sending entry {entry.get("id")}') append_demisto_entry_to_argus_case(int(parsed_args.remote_incident_id), entry) # Close incident if relevant close_argus_case = demisto.params().get("close_argus_case", True) if parsed_args.inc_status == IncidentStatus.DONE and close_argus_case: demisto.debug(f"Closing remote incident {parsed_args.remote_incident_id}") close_case( caseID=parsed_args.remote_incident_id, comment=( f"<h3>Case closed by XSOAR</h3>" f"<b>Reason:</b> {parsed_args.data.get('closeReason')}<br>" f"<b>Closing notes:</b><br>{parsed_args.data.get('closeNotes')}" ), ) return parsed_args.remote_incident_id def append_demisto_entry_to_argus_case(case_id: int, entry: dict[str, Any]) -> None: demisto.debug(f"Appending entry to case {case_id}: {entry!s}") if entry.get("type") == 1: # type note / chat comment = "<h3>Note mirrored from XSOAR</h3>" comment += ( f"<i>Added by {entry.get('user')} at" # type: ignore[arg-type] f" {pretty_print_date(entry.get('created'))}</i><br><br>" # type: ignore[arg-type] ) # type: ignore[arg-type] comment += str(entry.get("contents")) add_comment(caseID=case_id, comment=comment) elif entry.get("type") == 3: # type file add_attachment_helper(case_id, str(entry.get("id"))) def add_attachment_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") file_id = args.get("file_id") if not case_id: raise ValueError("case_id not specified") if not file_id: raise ValueError("file_id not specified") result = add_attachment_helper(case_id, file_id) if "error" in result: raise Exception(result["error"]) readable_output = pretty_print_attachment_metadata(result, f"# #{case_id}: attachment metadata\n") return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Attachments", outputs=result, raw_response=result, ) def add_case_tag_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") key = args.get("key") value = args.get("value") if not case_id: raise ValueError("case_id not specified") if not key: raise ValueError("key not specified") if not value: raise ValueError("value not specified") tag = {"key": key, "value": value} result = add_case_tag(caseID=case_id, tags=tag) headers = ["key", "value", "addedTime"] readable_output = tableToMarkdown(f"#{case_id}: Tags", result["data"], headers=headers) return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Tags", outputs=result, raw_response=result, ) def add_comment_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") comment = args.get("comment") if not case_id: raise ValueError("case_id not specified") if not comment: raise ValueError("comment not specified") result = add_comment( caseID=case_id, comment=comment, asReplyTo=args.get("as_reply_to"), internal=args.get("internal"), originEmailAddress=args.get("origin_email_address"), associatedAttachmentID=args.get("associated_attachment_id"), ) return CommandResults( readable_output=pretty_print_comment(result["data"], f"# #{case_id}: Added comment\n"), outputs_prefix="Argus.Comment", outputs=result, raw_response=result, ) def advanced_case_search_command(args: dict[str, Any]) -> CommandResults: # noinspection PyTypeChecker result = advanced_case_search( startTimestamp=args.get("start_timestamp"), endTimestamp=args.get("end_timestamp"), limit=args.get("limit"), offset=args.get("offset"), includeDeleted=args.get("include_deleted"), subCriteria=argToList(args.get("sub_criteria")), exclude=args.get("exclude"), required=args.get("required"), customerID=argToList(args.get("customer_id")), caseID=argToList(args.get("case_id")), customer=argToList(args.get("customer")), type=argToList(args.get("case_type")), service=argToList(args.get("service")), category=argToList(args.get("category")), status=argToList(args.get("status")), priority=argToList(args.get("priority")), assetID=argToList(args.get("asset_id")), tag=argToList(args.get("tag")), workflow=argToList(args.get("workflow")), field=argToList(args.get("field")), keywords=argToList(args.get("keywords")), timeFieldStrategy=argToList(args.get("time_field_strategy")), timeMatchStrategy=args.get("time_match_strategy"), keywordFieldStrategy=argToList(args.get("keyword_field_strategy")), keywordMatchStrategy=args.get("keyword_match_strategy"), user=argToList(args.get("user")), userFieldStrategy=argToList(args.get("user_field_strategy")), userAssigned=args.get("user_assigned"), techAssigned=args.get("tech_assigned"), includeWorkflows=args.get("include_workflows"), includeDescription=args.get("include_description"), accessMode=argToList(args.get("access_mode")), explicitAccess=argToList(args.get("explicit_access")), sortBy=argToList(args.get("sort_by")), includeFlags=argToList(args.get("include_flags")), excludeFlags=argToList(args.get("exclude_flags")), ) readable_output = f"Advanced Case Search: {result['count']} result(s)\n" readable_output += tableToMarkdown("Output not suitable for playground", result["data"]) return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Cases", outputs=result, raw_response=result, ) def close_case_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") if not case_id: raise ValueError("case_id not specified") result = close_case( caseID=case_id, comment=args.get("comment"), ) readable_output = f"# #{case_id}: close case\n" readable_output += f"_Status: {result['data']['status']}, at: {result['data']['closedTime']}_" return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Case", outputs=result, raw_response=result, ) def create_case_command(args: dict[str, Any]) -> CommandResults: subject = args.get("subject") description = args.get("description") service = args.get("service") case_type = args.get("type") tags = args.get("tags") if not subject: raise ValueError("subject not specified") if not description: raise ValueError("description not specified") if not service: raise ValueError("service not specified") if not case_type: raise ValueError("case_type not specified") if tags: tags = str(tags).split(",") if len(tags) % 2 != 0: raise ValueError("tags list must be of even number", tags) tags = build_tags_from_list(tags) result = create_case( customer=args.get("customer"), service=service, category=args.get("category"), type=case_type, status=args.get("status"), tags=tags, subject=subject, description=description, customerReference=args.get("customer_reference"), priority=args.get("priority"), accessMode=args.get("access_mode"), originEmailAddress=args.get("origin_email_address"), publish=args.get("publish"), defaultWatchers=args.get("default_watchers"), ) return CommandResults( readable_output=pretty_print_case_metadata(result), outputs_prefix="Argus.Case", outputs=result, raw_response=result, ) def delete_case_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") if not case_id: raise ValueError("case id not specified") result = delete_case(caseID=case_id) return CommandResults( readable_output=pretty_print_case_metadata(result, "Case deleted"), outputs_prefix="Argus.Case", outputs=result, raw_response=result, ) def delete_comment_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") comment_id = args.get("comment_id") if not case_id: raise ValueError("case id not specified") if not comment_id: raise ValueError("comment id not specified") result = delete_comment(caseID=case_id, commentID=comment_id) return CommandResults( readable_output=pretty_print_comment(result["data"], f"# #{case_id}: Deleted comment\n"), outputs_prefix="Argus.Comment", outputs=result, raw_response=result, ) def download_attachment_by_filename_command(args: dict[str, Any]) -> dict: case_id = args.get("case_id") file_name = args.get("file_name") if case_id is None: raise ValueError("case id not specified") if not file_name: raise ValueError("file name not given") attachment_id = "" case_attachments = list_case_attachments(caseID=case_id).get("data", []) for attachment in case_attachments: if file_name in attachment.get("name", ""): attachment_id = attachment.get("id", "") file_name = attachment.get("name", "") break if not attachment_id: raise ValueError("file name not found in case") result = download_attachment(caseID=case_id, attachmentID=attachment_id) return fileResult(file_name, result.content) def download_attachment_command(args: dict[str, Any]) -> dict: case_id = args.get("case_id") attachment_id = args.get("attachment_id") file_name = args.get("file_name", attachment_id) if case_id is None: raise ValueError("case id not specified") if not attachment_id: raise ValueError("attachment id not given") result = download_attachment(caseID=case_id, attachmentID=attachment_id) return fileResult(file_name, result.content) def download_case_attachments_command(args: dict[str, Any]) -> list[dict]: case_id = args.get("case_id") if case_id is None: raise ValueError("case id not specified") case_attachments = list_case_attachments(caseID=int(case_id)).get("data", []) incident_files = [] for attachment in case_attachments: incident_files.append( fileResult( attachment["name"], download_attachment(caseID=int(case_id), attachmentID=attachment["id"]).content, ) ) return incident_files def edit_comment_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") comment_id = args.get("comment_id") comment = args.get("comment") if not case_id: raise ValueError("case id not specified") if not comment_id: raise ValueError("comment id not specified") if not comment: raise ValueError("comment not specified") result = edit_comment(caseID=case_id, commentID=comment_id, comment=comment) return CommandResults( readable_output=pretty_print_comment(result["data"], f"# #{case_id}: Updated comment\n"), outputs_prefix="Argus.Comment", outputs=result, raw_response=result, ) def get_attachment_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") attachment_id = args.get("attachment_id") if not case_id: raise ValueError("case id not specified") if not attachment_id: raise ValueError("attachment id not specified") result = get_attachment(caseID=case_id, attachmentID=attachment_id) return CommandResults( readable_output=pretty_print_attachment_metadata(result, f"# #{case_id}: attachment metadata\n"), outputs_prefix="Argus.Attachments", outputs=result, raw_response=result, ) def get_case_metadata_by_id_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") if not case_id: raise ValueError("case id not specified") result = get_case_metadata_by_id(id=case_id, skipRedirect=args.get("skip_redirect")) return CommandResults( readable_output=pretty_print_case_metadata(result), outputs_prefix="Argus.Case", outputs=result, raw_response=result, ) def print_case_metadata_by_id_command(args: dict[str, Any]) -> dict: case_id = args.get("case_id") if not case_id: raise ValueError("case id not specified") result = get_case_metadata_by_id(id=case_id, skipRedirect=args.get("skip_redirect")) return { "ContentsFormat": formats["html"], "Type": EntryType.NOTE, "Contents": pretty_print_case_metadata_html(result.get("data")), # "Note": True, } def list_case_attachments_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") if not case_id: raise ValueError("case_id not specified") result = list_case_attachments(caseID=case_id, limit=args.get("limit"), offset=args.get("offset")) readable_output = f"# #{case_id}: Case attachments\n" for attachment in result["data"]: readable_output += f"#### *{attachment['addedByUser']['userName']} - {attachment['addedTime']}*\n" readable_output += f"{attachment['name']} ({attachment['mimeType']}, {attachment['size']} kb)\n\n" readable_output += f"_id: {attachment['id']}_\n" readable_output += "* * *\n" return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Attachments", outputs=result, raw_response=result, ) def list_case_tags_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") if not case_id: raise ValueError("case_id not specified") result = list_case_tags(caseID=case_id, limit=args.get("limit"), offset=args.get("offset")) headers = ["key", "value", "addedTime", "id"] readable_output = tableToMarkdown(f"#{case_id}: Tags", result["data"], headers=headers) return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Tags", outputs=result, raw_response=result, ) def print_case_comments_command(args: dict[str, Any]) -> list[dict]: case_id = args.get("case_id") sort_by = args.get("sort_by") if not case_id: raise ValueError("case_id not specified") if sort_by: sort_by = ["addedTimestamp"] if sort_by == "ascending" else ["-addedTimestamp"] result = list_case_comments( caseID=case_id, beforeComment=args.get("before_comment"), afterComment=args.get("after_comment"), offset=args.get("offset"), limit=args.get("limit"), sortBy=sort_by, ) notes = [] for comment in result.get("data", []): notes.append( { "ContentsFormat": formats["html"], "Type": entryTypes["note"], "Contents": pretty_print_comment_html(comment), "Note": True, } ) return notes def list_case_comments_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") sort_by = args.get("sort_by") if not case_id: raise ValueError("case_id not specified") if sort_by: sort_by = ["addedTimestamp"] if sort_by == "ascending" else ["-addedTimestamp"] result = list_case_comments( caseID=case_id, beforeComment=args.get("before_comment"), afterComment=args.get("after_comment"), offset=args.get("offset"), limit=args.get("limit"), sortBy=sort_by, ) return CommandResults( readable_output=pretty_print_comments(result["data"], f"# #{case_id}: Comments\n"), outputs_prefix="Argus.Comments", outputs=result, raw_response=result, ) def remove_case_tag_by_id_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") tag_id = args.get("tag_id") if not case_id: raise ValueError("case id not specified") if not tag_id: raise ValueError("tag id not specified") result = remove_case_tag_by_id(caseID=case_id, tagID=tag_id) headers = ["key", "value", "addedTime", "id", "flags"] readable_output = tableToMarkdown(f"#{case_id}: Delete tags", result["data"], headers=headers) return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Tags", outputs=result, raw_response=result, ) def remove_case_tag_by_key_value_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") key = args.get("key") value = args.get("value") if not case_id: raise ValueError("case id not specified") if not key: raise ValueError("key not specified") if not value: raise ValueError("value not specified") result = remove_case_tag_by_key_value(caseID=case_id, tagKey=key, tagValue=value) headers = ["key", "value", "addedTime", "id", "flags"] readable_output = tableToMarkdown(f"#{case_id}: Delete tags", result["data"], headers=headers) return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Tags", outputs=result, raw_response=result, ) def update_case_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") if not case_id: raise ValueError("case id not specified") result = update_case( id=case_id, subject=args.get("subject"), description=args.get("description"), status=args.get("status"), priority=args.get("priority"), category=args.get("category"), reporter=args.get("reporter"), assignedUser=args.get("assigned_user"), assignedTech=args.get("assigned_tech"), customerReference=args.get("customer_reference"), comment=args.get("comment"), originEmailAddress=args.get("origin_email_address"), hasEvents=args.get("has_events"), internalComment=args.get("internal_comment"), ) return CommandResults( readable_output=pretty_print_case_metadata(result), outputs_prefix="Argus.Case", outputs=result, raw_response=result, ) def get_event_command(args: dict[str, Any]) -> CommandResults: event_type = args.get("type") timestamp = args.get("timestamp") customer_id = args.get("customer_id") event_id = args.get("event_id") if not event_type: raise ValueError("event type not specified") if not timestamp: raise ValueError("timestamp not specified") if not customer_id: raise ValueError("customer id not specified") if not event_id: raise ValueError("event id not specified") result = get_event_by_path(type=event_type, timestamp=timestamp, customerID=customer_id, eventID=event_id) return CommandResults( readable_output=tableToMarkdown(f"Event: {event_id}", result["data"]), outputs_prefix="Argus.Event", outputs=result, raw_response=result, ) def get_events_for_case_command(args: dict[str, Any]) -> CommandResults: case_id = args.get("case_id") if not case_id: raise ValueError("case id not specified") result = get_events_for_case(caseID=case_id, limit=args.get("limit"), offset=args.get("offset")) return CommandResults( readable_output=pretty_print_events(dict(result), f"# #{case_id}: Associated Events\n"), outputs_prefix="Argus.Events", outputs=result, raw_response=result, ) def find_aggregated_events_command(args: dict[str, Any]) -> CommandResults: # noinspection PyTypeChecker result = find_aggregated_events( skipFutureEvents=args.get("skip_future_events"), exclude=args.get("exclude"), locationID=argToList(args.get("location_id")), severity=argToList(args.get("severity")), customer=argToList(args.get("customer")), alarmID=argToList(args.get("alarm_id")), attackCategoryID=argToList(args.get("attack_category_id")), sourceGeoCountry=argToList(args.get("source_geo_country")), destinationGeoCountry=argToList(args.get("destination_geo_country")), geoCountry=argToList(args.get("geo_country")), properties=str_to_dict(args.get("properties", "")), exactMatchProperties=args.get("exact_match_properties"), subCriteria=argToList(args.get("sub_criteria")), signature=argToList(args.get("signature")), lastUpdatedTimestamp=args.get("last_updated_timestamp"), indexStartTime=args.get("index_start_time"), indexEndTime=args.get("index_end_time"), destinationIP=argToList(args.get("destination_ip")), sourceIP=argToList(args.get("source_ip")), ip=argToList(args.get("ip")), destinationPort=argToList(args.get("destination_port")), sourcePort=argToList(args.get("source_port")), port=argToList(args.get("port")), minSeverity=args.get("min_severity"), maxSeverity=args.get("max_severity"), limit=args.get("limit", 25), offset=args.get("offset"), includeDeleted=args.get("include_deleted"), minCount=args.get("min_count"), associatedCaseID=argToList(args.get("associated_case_id")), sourceIPMinBits=args.get("source_ip_min_bits"), destinationIPMinBits=args.get("destination_ip_min_bits"), startTimestamp=args.get("start_timestamp", "-24hours"), endTimestamp=args.get("end_timestamp", "now"), sortBy=argToList(args.get("sort_by")), includeFlags=argToList(args.get("include_flags")), excludeFlags=argToList(args.get("exclude_flags")), ) return CommandResults( readable_output=pretty_print_events(dict(result), "# Find events\n"), outputs_prefix="Argus.Events", outputs=result, raw_response=result, ) def list_aggregated_events_command(args: dict[str, Any]) -> CommandResults: result = list_aggregated_events( customerID=args.get("customer_id"), signature=args.get("signature"), ip=args.get("ip"), startTimestamp=args.get("start_timestamp"), endTimestamp=args.get("end_timestamp"), limit=args.get("limit"), offset=args.get("offset"), ) return CommandResults( readable_output=pretty_print_events(dict(result), "# List Events\n"), outputs_prefix="Argus.Events", outputs=result, raw_response=result, ) def get_payload_command(args: dict[str, Any]) -> CommandResults: event_type = args.get("type") timestamp = args.get("timestamp") customer_id = args.get("customer_id") event_id = args.get("event_id") if not event_type: raise ValueError("event type not specified") if not timestamp: raise ValueError("timestamp not specified") if not customer_id: raise ValueError("customer id not specified") if not event_id: raise ValueError("event id not specified") result = get_payload(type=event_type, timestamp=timestamp, customerID=customer_id, eventID=event_id) readable_output = "# Event payload\n" readable_output += f"Event: {event_id}, type: {result['data']['type']}\n" readable_output += result["data"]["payload"] return CommandResults( readable_output=readable_output, outputs_prefix="Argus.Payload", outputs=result, raw_response=result, ) def get_pcap_command(args: dict[str, Any]) -> Any: event_type = args.get("type") timestamp = args.get("timestamp") customer_id = args.get("customer_id") event_id = args.get("event_id") if not event_type: raise ValueError("event type not specified") if not timestamp: raise ValueError("timestamp not specified") if not customer_id: raise ValueError("customer id not specified") if not event_id: raise ValueError("event id not specified") result = get_pcap(type=event_type, timestamp=timestamp, customerID=customer_id, eventID=event_id) return fileResult(f"{event_id}_pcap", result.content) def find_nids_events_command(args: dict[str, Any]) -> CommandResults: # noinspection PyTypeChecker result = find_n_i_d_s_events( skipFutureEvents=args.get("skip_future_events"), exclude=args.get("exclude"), eventIdentifier=argToList(args.get("event_identifier")), locationID=argToList(args.get("location_id")), severity=argToList(args.get("severity")), customer=argToList(args.get("customer")), alarmID=argToList(args.get("alarm_id")), attackCategoryID=argToList(args.get("attack_category_id")), sourceGeoCountry=argToList(args.get("source_geo_country")), destinationGeoCountry=argToList(args.get("destination_geo_country")), geoCountry=argToList(args.get("geo_country")), properties=str_to_dict(args.get("properties", "")), exactMatchProperties=args.get("exact_match_properties"), sensorID=argToList(args.get("sensor_id")), subCriteria=argToList(args.get("sub_criteria")), signature=argToList(args.get("signature")), lastUpdatedTimestamp=args.get("last_updated_timestamp"), indexStartTime=args.get("index_start_time"), indexEndTime=args.get("index_end_time"), destinationIP=argToList(args.get("destination_ip")), sourceIP=argToList(args.get("source_ip")), ip=argToList(args.get("ip")), destinationPort=argToList(args.get("destination_port")), sourcePort=argToList(args.get("source_port")), port=argToList(args.get("port")), minSeverity=args.get("min_severity"), maxSeverity=args.get("max_severity"), limit=args.get("limit", 25), offset=args.get("offset"), includeDeleted=args.get("include_deleted"), startTimestamp=args.get("start_timestamp", "-24hours"), endTimestamp=args.get("end_timestamp", "now"), sortBy=argToList(args.get("sort_by")), includeFlags=argToList(args.get("include_flags")), excludeFlags=argToList(args.get("exclude_flags")), ) return CommandResults( readable_output=pretty_print_events(dict(result), "# Find NIDS Events\n"), outputs_prefix="Argus.NIDS", outputs=result, raw_response=result, ) def list_nids_events_command(args: dict[str, Any]) -> CommandResults: result = list_n_i_d_s_events( customerID=args.get("customer_id"), signature=args.get("signature"), ip=args.get("ip"), startTimestamp=args.get("start_timestamp"), endTimestamp=args.get("end_timestamp"), limit=args.get("limit"), offset=args.get("offset"), ) return CommandResults( readable_output=pretty_print_events(dict(result), "# List NIDS Events\n"), outputs_prefix="Argus.NIDS", outputs=result, raw_response=result, ) def search_records_command(args: dict[str, Any]) -> CommandResults: query = args.get("query") if not query: raise ValueError("query not specified") # noinspection PyTypeChecker result = search_records( query=query, aggregateResult=args.get("aggregate_result"), includeAnonymousResults=args.get("include_anonymous_results"), rrClass=argToList(args.get("rr_class")), rrType=argToList(args.get("rr_type")), customerID=argToList(args.get("customer_id")), tlp=argToList(args.get("tlp")), limit=args.get("limit", 25), offset=args.get("offset"), ) return CommandResults( readable_output=tableToMarkdown("PDNS records", result["data"]), outputs_prefix="Argus.PDNS", outputs=result, raw_response=result, ) def fetch_observations_for_domain_command(args: dict[str, Any]) -> CommandResults: fqdn = args.get("fqdn") if not fqdn: raise ValueError("fqdn not specified") result = fetch_observations_for_domain(fqdn=fqdn) return CommandResults( readable_output=tableToMarkdown(f'Domain observations for "{fqdn}"', result["data"]), outputs_prefix="Argus.ObservationsDomain", outputs=result, raw_response=result, ) def fetch_observations_for_i_p_command(args: dict[str, Any]) -> CommandResults: ip = args.get("ip") if not ip: raise ValueError("ip not specified") result = fetch_observations_for_i_p(ip=ip) return CommandResults( readable_output=tableToMarkdown(f'IP observations for "{ip}"', result["data"]), outputs_prefix="Argus.ObservationsIP", outputs=result, raw_response=result, ) """ MAIN FUNCTION """ def main() -> None: logging.getLogger("argus_cli").setLevel("WARNING") first_fetch_period = parse_first_fetch(demisto.params().get("first_fetch", "-1 day")) set_argus_settings( demisto.params().get("api_key"), demisto.params().get("api_url"), handle_proxy(), demisto.params().get("insecure"), ) demisto.debug(f"Command being called is {demisto.command()}") try: if demisto.command() == "test-module": # This is the call made when pressing the integration Test button. return_results(test_module_command()) elif demisto.command() == "fetch-incidents": # Set and define the fetch incidents command to run after activated via integration settings. next_run, incidents = fetch_incidents( last_run=demisto.getLastRun(), first_fetch_period=first_fetch_period, limit=demisto.params().get("max_fetch", 25), min_severity=demisto.params().get("min_severity", "low").lower(), integration_instance=demisto.integrationInstance(), mirror_direction=demisto.params().get("mirror_direction", "None"), mirror_tags=demisto.params().get("mirror_tag"), exclude_tag=demisto.params().get("exclude_tag"), ) demisto.setLastRun(next_run) demisto.incidents(incidents) elif demisto.command() == "get-remote-data": return_results( get_remote_data_command( demisto.args(), integration_instance=demisto.integrationInstance(), mirror_direction=demisto.params().get("mirror_direction", "None"), mirror_tags=demisto.params().get("mirror_tag"), ) ) if demisto.command() == "get-modified-remote-data": # Hotfix for mirroring issues. raise NotImplementedError('The "get-modified-remote-data" command is not implemented') elif demisto.command() == "argus-add-attachment": return_results(add_attachment_command(demisto.args())) elif demisto.command() == "update-remote-system": return_results(update_remote_system_command(demisto.args())) elif demisto.command() == "argus-add-case-tag": return_results(add_case_tag_command(demisto.args())) elif demisto.command() == "argus-add-comment": return_results(add_comment_command(demisto.args())) elif demisto.command() == "argus-advanced-case-search": return_results(advanced_case_search_command(demisto.args())) elif demisto.command() == "argus-close-case": return_results(close_case_command(demisto.args())) elif demisto.command() == "argus-create-case": return_results(create_case_command(demisto.args())) elif demisto.command() == "argus-delete-case": return_results(delete_case_command(demisto.args())) elif demisto.command() == "argus-delete-comment": return_results(delete_comment_command(demisto.args())) elif demisto.command() == "argus-download-attachment": return_results(download_attachment_command(demisto.args())) elif demisto.command() == "argus-download-attachment-by-filename": return_results(download_attachment_by_filename_command(demisto.args())) elif demisto.command() == "argus-edit-comment": return_results(edit_comment_command(demisto.args())) elif demisto.command() == "argus-get-attachment": return_results(get_attachment_command(demisto.args())) elif demisto.command() == "argus-get-case-metadata-by-id": return_results(get_case_metadata_by_id_command(demisto.args())) elif demisto.command() == "argus-list-case-attachments": return_results(list_case_attachments_command(demisto.args())) elif demisto.command() == "argus-list-case-tags": return_results(list_case_tags_command(demisto.args())) elif demisto.command() == "argus-list-case-comments": return_results(list_case_comments_command(demisto.args())) elif demisto.command() == "argus-remove-case-tag-by-id": return_results(remove_case_tag_by_id_command(demisto.args())) elif demisto.command() == "argus-remove-case-tag-by-key-value": return_results(remove_case_tag_by_key_value_command(demisto.args())) elif demisto.command() == "argus-update-case": return_results(update_case_command(demisto.args())) elif demisto.command() == "argus-get-event": return_results(get_event_command(demisto.args())) elif demisto.command() == "argus-get-events-for-case": return_results(get_events_for_case_command(demisto.args())) elif demisto.command() == "argus-find-aggregated-events": return_results(find_aggregated_events_command(demisto.args())) elif demisto.command() == "argus-list-aggregated-events": return_results(list_aggregated_events_command(demisto.args())) elif demisto.command() == "argus-get-payload": return_results(get_payload_command(demisto.args())) elif demisto.command() == "argus-get-pcap": return_results(get_pcap_command(demisto.args())) elif demisto.command() == "argus-find-nids-events": return_results(find_nids_events_command(demisto.args())) elif demisto.command() == "argus-list-nids-events": return_results(list_nids_events_command(demisto.args())) elif demisto.command() == "argus-pdns-search-records": return_results(search_records_command(demisto.args())) elif demisto.command() == "argus-fetch-observations-for-domain": return_results(fetch_observations_for_domain_command(demisto.args())) elif demisto.command() == "argus-fetch-observations-for-ip": return_results(fetch_observations_for_i_p_command(demisto.args())) elif demisto.command() == "argus-print-case-comments": return_results(print_case_comments_command(demisto.args())) elif demisto.command() == "argus-print-case-metadata-by-id": return_results(print_case_metadata_by_id_command(demisto.args())) elif demisto.command() == "argus-download-case-attachments": return_results(download_case_attachments_command(demisto.args())) # Log exceptions and return errors except AccessDeniedException as denied: demisto.info(denied.message) return_warning(denied.message) except Exception as e: demisto.error(traceback.format_exc()) # print the traceback return_error(f"Failed to execute {demisto.command()} command.\nError:\n{e!s}") """ ENTRY POINT """ if __name__ in ("__main__", "__builtin__", "builtins"): main()