checkpointdome9

Dome9 integration allows to easily manage the security and compliance of the public cloud.

Network Security · Check Point Dome9 (CloudGuard)

Details

IDcheckpointdome9
ProviderCheckPoint Software Technologies
CategoryNetwork Security
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Dome9 integration allows to easily manage the security and compliance of the public cloud.
This integration was integrated and tested with version 2 of checkpointdome9

Configure Check Point Dome9 (CloudGuard) in Cortex

Parameter Description Required
Server URL   True
API key ID   True
API key secret   True
Use system proxy settings   False
Trust any certificate (not secure)   False
Maximum incidents for one fetch. Maximum number of incidents per fetch. Default is 50. The maximum is 100. False
Fetch incidents   False
Alert region (AWS) to fetch as incidents.   False
Alert severity to fetch as incidents.   False
First fetch time First alert created date to fetch. e.g., “1 min ago”,”2 weeks ago”,”3 months ago” False
Incident type   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

dome9-access-lease-list


Get a list of all active Access Leases.

Base Command

dome9-access-lease-list

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.AccessLease.cloudAccountId String The AWS Access Leases cloud account ID.
CheckPointDome9.AccessLease.region String The AWS Access Leases region.
CheckPointDome9.AccessLease.securityGroupId String The AWS Access Leases security group ID.
CheckPointDome9.AccessLease.created String The AWS Access Leases created date.
CheckPointDome9.AccessLease.user String The AWS Access Leases user.
CheckPointDome9.AccessLease.length String The AWS Access Leases length.
CheckPointDome9.AccessLease.protocol String The AWS Access Leases protocol.
CheckPointDome9.AccessLease.id String The AWS Access Leases ID.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "AccessLease": [
            {
                "accountId": "accountId",
                "cloudAccountId": "cloudAccountId",
                "created": "created",
                "id": "id",
                "ip": "ip",
                "length": "length",
                "name": "name",
                "note": null,
                "portFrom": 0,
                "portTo": 0,
                "protocol": "protocol",
                "region": "region",
                "securityGroupId": "securityGroupId",
                "srl": "srl",
                "user": "user"
            }
        ]
    }
}

Human Readable Output

Access Lease

Showing 1 rows out of 1.

Id Name Ip User Region Length Created
id name ip userMail region length created

dome9-access-lease-delete


Terminate an Access Lease.

Base Command

dome9-access-lease-delete

Input

Argument Name Description Required
lease_id The Access Lease ID. Required

Context Output

There is no context output for this command.

Command example

!dome9-access-lease-delete lease_id=id

Context Example

{
    "CheckPointDome9": {
        "AccessLease": ""
    }
}

Human Readable Output

Access Lease Deleted successfully

dome9-access-lease-invitation-list


Get a lease invitation.

Base Command

dome9-access-lease-invitation-list

Input

Argument Name Description Required
invitation_id The Access Lease invitation ID. Optional

Context Output

Path Type Description
CheckPointDome9.AccessLease.Invitation.length String The Access Lease invitation length.
CheckPointDome9.AccessLease.Invitation.id String The Access Lease invitation ID.
CheckPointDome9.AccessLease.Invitation.created String The Access Lease invitation created time.
CheckPointDome9.AccessLease.Invitation.recipientName String The Access Lease invitation recipient name.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "AccessLease": {
            "Invitation": {
                "body": null,
                "created": "created",
                "expirationTime": "expirationTime",
                "id": "id",
                "issuerName": "userMail",
                "length": "length",
                "notifyEmail": null,
                "pivotEntity": "pivotEntity",
                "recipientName": "userMail",
                "serviceName": "name",
                "targetSrl": "targetSrl"
            }
        }
    }
}

Human Readable Output

Access Lease invitation

Showing 1 rows out of 1.

Id Issuername Recipientname Length Created
id userMail userMail length created

dome9-access-lease-invitation-delete


Delete an Access Lease invitation.

Base Command

dome9-access-lease-invitation-delete

Input

Argument Name Description Required
invitation_id Access Lease invitation. Required

Context Output

There is no context output for this command.

Command example

!dome9-access-lease-invitation-delete invitation_id=invitation_id

Context Example

{
    "CheckPointDome9": {
        "AccessLease": {
            "Invitation": ""
        }
    }
}

Human Readable Output

Access Lease Invitation Deleted successfully

dome9-findings-search


Search for findings in CloudGuard.

Base Command

dome9-findings-search

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional
severity The findings severities. Possible values are: High, Medium, Low. Optional
region The findings regions. Possible values are: N. Virginia, Global, Canada Central, Frankfurt, Ireland, London, Mumbai, N. California, Ohio, Oregon, Osaka, Paris, Seoul, Singapore, Stockholm, Sydney, São Paulo, Tokyo. Optional

Context Output

Path Type Description
CheckPointDome9.Findings.id String The findings ID.
CheckPointDome9.Findings.severity String The severity of the findings.
CheckPointDome9.Findings.region String The findings region.
CheckPointDome9.Findings.status Number The status of the findings.
CheckPointDome9.Findings.action String The action of the findings.
CheckPointDome9.Findings.alertType Number The alert type of the findings.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "Findings": [
            {
                "acknowledged": false,
                "action": "action",
                "additionalFields": [],
                "alertType": "alertType",
                "bundleId": "bundleId",
                "bundleName": "bundleName",
                "category": "",
                "cloudAccountExternalId": "cloudAccountExternalId",
                "cloudAccountId": "cloudAccountId",
                "cloudAccountType": "cloudAccountType",
                "comments": [],
                "createdTime": "createdTime",
                "description": "description",
                "entityDome9Id": "entityDome9Id",
                "entityExternalId": "entityExternalId",
                "entityName": "entityName",
                "entityNetwork": null,
                "entityTags": [],
                "entityType": "entityType",
                "entityTypeByEnvironmentType": "entityTypeByEnvironmentType",
                "findingKey": "findingKey",
                "id": "id",
                "isExcluded": false,
                "labels": [],
                "lastSeenTime": "lastSeenTime",
                "magellan": null,
                "occurrences": [],
                "organizationalUnitId": "organizationalUnitId",
                "organizationalUnitPath": "",
                "origin": "origin",
                "ownerUserName": null,
                "region": "region",
                "remediation": "remediation",
                "remediationActions": [],
                "ruleId": "ruleId",
                "ruleLogic": "ruleLogic",
                "ruleName": "ruleName",
                "scanId": null,
                "severity": "severity",
                "status": "status",
                "tag": "tag",
                "updatedTime": "updatedTime",
                "webhookResponses": null
            }
        ]
    }
}

Human Readable Output

Findings

Showing 1 rows out of 48.

Id Alerttype Severity Region Status Action Cloudaccountid Description
id alertType severity region status action Cloudaccountid Description

dome9-ip-list-create


Add a new IP list.

Base Command

dome9-ip-list-create

Input

Argument Name Description Required
name The IP list name. Required
description The IP list description. Required
ip Comma-separated list of IP addresses. Optional
comment Comma-separated list of comments for the IP addresses. One comment per IP address. Optional

Context Output

Path Type Description
CheckPointDome9.IpList.id String The IP list ID.
CheckPointDome9.IpList.name String The IP list name.
CheckPointDome9.IpList.description String The IP list description.
CheckPointDome9.IpList.items String The IP list items (IP addresses).

Command example

!dome9-ip-list-create description=description2022 name=name31072022

Context Example

{
    "CheckPointDome9": {
        "IpList": {
            "description": "description2022",
            "id": "id",
            "items": [],
            "name": "name31072022"
        }
    }
}

Human Readable Output

IP list created successfully

dome9-ip-list-update


Update an IP list. This will override the existing IP list.

Base Command

dome9-ip-list-update

Input

Argument Name Description Required
list_id The IP list ID. Required
description The IP list description. Optional
ip Comma-separated list of IP addresses. Optional
comment Comma-separated list of comments for the IP addresses. One comment per IP address. Optional
update_mode The command mode. Default mode is add_new_items. Possible values are: add_new_items, replace_old_items. Optional

Context Output

There is no context output for this command.

Command example

!dome9-ip-list-update list_id=id description=NEW

Context Example

{
    "CheckPointDome9": {
        "IpList": ""
    }
}

Human Readable Output

IP list updated successfully

dome9-ip-list-get


Get an IP List by ID.

Base Command

dome9-ip-list-get

Input

Argument Name Description Required
list_id The IP list ID to fetch. Optional

Context Output

Path Type Description
CheckPointDome9.IpList.id String The IP list ID.
CheckPointDome9.IpList.name String The IP list name.
CheckPointDome9.IpList.description String The IP list description.
CheckPointDome9.IpList.items String The IP list items (IP addresses).

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "IpList": [
            {
                "description": "description",
                "id": "id",
                "items": [
                    {
                        "comment": "new comment",
                        "ip": "ip"
                    }
                ],
                "name": "NewList-2"
            }
        ]
    }
}

Human Readable Output

IP list

Id Name Items Description
id NewList-2 ip description

dome9-ip-list-delete


Delete an IP List by ID.

Base Command

dome9-ip-list-delete

Input

Argument Name Description Required
list_id The ID of the IP list to delete. Required

Context Output

There is no context output for this command.

Command example

!dome9-ip-list-delete list_id=id

Context Example

{
    "CheckPointDome9": {
        "IpList": ""
    }
}

Human Readable Output

IP list deleted successfully

dome9-ip-list-metadata-list


Get all IP addresses metadata.

Base Command

dome9-ip-list-metadata-list

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.IpList.Metadata.id String The IP address internal ID.
CheckPointDome9.IpList.Metadata.cidr string The IP address CIDR.
CheckPointDome9.IpList.Metadata.name String The IP address name.
CheckPointDome9.IpList.Metadata.classification String The IP address classification.

Command example

Human Readable Output

IP List metadata

Showing 8 rows out of 8.

Id Name Cidr Classification
id name cidr classification

Command example

Human Readable Output

IP List metadata

Showing 8 rows out of 8.

Id Name Cidr Classification
id name cidr classification

dome9-ip-list-metadata-create


Add metadata for a new IP address. An IP address metadata must contain the CIDR, name, and classification. Classification can be External, Unsafe, Dmz, InternalVpc, InternalDc, or NoClassification.

Base Command

dome9-ip-list-metadata-create

Input

Argument Name Description Required
cidr The IP address CIDR. Required
name The IP address name. Required
classification The IP address classification. Possible values are: External, Unsafe, Dmz, InternalVpc, InternalDc, NoClassification.. Required

Context Output

Path Type Description
CheckPointDome9.IpList.Metadata.id String The IP address internal ID.
CheckPointDome9.IpList.Metadata.cidr string The IP address CIDR.
CheckPointDome9.IpList.Metadata.name String The IP address name.
CheckPointDome9.IpList.Metadata.classification String The IP address classification.

Command example

!dome9-ip-list-metadata-create cidr=cidr classification=classification name=metadata

Context Example

{
    "CheckPointDome9": {
        "IpList": {
            "Metadata": {
                "cidr": "cidr",
                "classificaiton": "classification",
                "classification": "classification",
                "id": "id",
                "name": "metadata"
            }
        }
    }
}

Human Readable Output

IP List metadata created successfully

Cidr Classificaiton Classification Id Name
cidr classification classification id metadata

dome9-ip-list-metadata-update


Update an existing IP address metadata. Classification can only be External, Unsafe, Dmz, InternalVpc, InternalDc, or NoClassification.

Base Command

dome9-ip-list-metadata-update

Input

Argument Name Description Required
list_metadata_id The IP address internal ID. Required
name The IP address nName. Optional
classification The IP address classification. Possible values are: External, Unsafe, Dmz, InternalVpc, InternalDc, NoClassification.. Required

Context Output

Path Type Description
CheckPointDome9.IpList.Metadata.id String The IP address internal ID.
CheckPointDome9.IpList.Metadata.cidr string The IP address CIDR.
CheckPointDome9.IpList.Metadata.name String The IP address Name.
CheckPointDome9.IpList.Metadata.classification String The IP address classification.

Command example

!dome9-ip-list-metadata-update classification=classification list_metadata_id=list_metadata_id name=NewName

Context Example

{
    "CheckPointDome9": {
        "IpList": {
            "Metadata": {
                "cidr": "cidr",
                "classificaiton": "classification",
                "classification": "classification",
                "id": "list_metadata_id",
                "name": "NewName"
            }
        }
    }
}

Human Readable Output

IP List metadata updated successfully

Cidr Classificaiton Classification Id Name
cidr classification classification list_metadata_id NewName

dome9-ip-list-metadata-delete


Delete an IP address metadata with a specific CIDR.

Base Command

dome9-ip-list-metadata-delete

Input

Argument Name Description Required
account_id The account ID. Required
address The IP address to delete. Required
mask The subnet mask. Required

Context Output

There is no context output for this command.

Command example

!dome9-ip-list-metadata-delete account_id=account_id address=ip mask=32

Context Example

{
    "CheckPointDome9": {
        "IpList": {
            "Metadata": ""
        }
    }
}

Human Readable Output

IP List metadata deleted successfully

dome9-compliance-remediation-get


Get a list of remediations for the account.

Base Command

dome9-compliance-remediation-get

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
CheckPointDome9.ComplianceRemediation.id String Remediation ID.
CheckPointDome9.ComplianceRemediation.ruleLogicHash String Hash for the rule logic.
CheckPointDome9.ComplianceRemediation.ruleName String Rule name.
CheckPointDome9.ComplianceRemediation.ruleId String Rule ID.
CheckPointDome9.ComplianceRemediation.logic String The GSL logic of the exclusion.
CheckPointDome9.ComplianceRemediation.rulesetId Number Ruleset ID.
CheckPointDome9.ComplianceRemediation.platform String Remediation platform.
CheckPointDome9.ComplianceRemediation.cloudBots String Cloud bots execution expressions.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "ComplianceRemediation": [
            {
                "cloudAccountId": null,
                "cloudBots": [
                    "cloudBots"
                ],
                "comment": "comment",
                "id": "id",
                "logic": null,
                "platform": "platform",
                "ruleId": null,
                "ruleLogicHash": "ruleLogicHash",
                "ruleName": null,
                "rulesetId": -51
            }
        ]
    }
}

Human Readable Output

Compliance remediation

Id Rulelogichash Rulesetid Platform Comment Cloudbots
id ruleLogicHash ruleset_id platform comment cloudbots

dome9-compliance-remediation-create


Add a new remediation.

Base Command

dome9-compliance-remediation-create

Input

Argument Name Description Required
ruleset_id Ruleset ID to apply remediation on. Use the dome9-compliance-ruleset-list command to get the Ruleset ID list. Required
comment Comment text. Required
cloudbots Cloud bots execution expressions. Possible values are: ami_set_to_private, acm_delete_certificate, cloudtrail_enable, cloudtrail_enable_log_file_validation, cloudtrail_send_to_cloudwatch, cloudwatch_create_metric_filter, config_enable, ec2_attach_sg, ec2_attach_instance_role, ec2_create_snapshot, ec2_release_eips, ec2_quarantine_instance, ec2_stop_instance, ec2_terminate_instance, ec2_update_instance_role, ec2_service_role_detach_inline_group, iam_detach_policy, iam_group_delete_inline_group, iam_generate_credential_report, iam_role_attach_policy, iam_user_attach_policy, iam_user_deactivate_unused_access_key, iam_user_delete_inline_policies, iam_user_disable_console_password, iam_user_force_password_change, iam_quarantine_role, iam_quarantine_user, iam_role_clone_with_non_enumerable_name, iam_turn_on_password_policy, igw_delete, kms_cmk_enable_key, kms_enable_rotation, lambda_detach_blanket_permissions, lambda_tag, lambda_enable_active_tracing, load_balancer_enable_access_logs, mark_for_stop_ec2_resource. Required
rule_logic_hash Hash for the rule logic. Use the compliance-ruleset-rule-list command to fetch logic hash. Required

Context Output

There is no context output for this command.

Command example

!dome9-compliance-remediation-create cloudbots=cloudbots comment=COMMENT rule_logic_hash=rule_logic_hash/k4lIw ruleset_id=rule_id

Context Example

{
    "CheckPointDome9": {
        "ComplianceRemediation": {
            "cloudAccountId": null,
            "cloudBots": [
                "cloudbots"
            ],
            "comment": "COMMENT",
            "id": "id",
            "logic": null,
            "platform": "platform",
            "ruleId": null,
            "ruleLogicHash": "ruleLogicHash",
            "ruleName": null,
            "rulesetId": "rulesetId"
        }
    }
}

Human Readable Output

Remediation created successfully

Cloudbots Id Rulelogichash Rulesetid Platform Comment
cloudbots id ruleLogicHash ruleset_id platform COMMENT

dome9-compliance-remediation-update


Update a remediation.

Base Command

dome9-compliance-remediation-update

Input

Argument Name Description Required
remediation_id Remediation ID. Required
ruleset_id Ruleset ID. Required
comment Comment text. Required
cloudbots Cloud bots execution expressions. Possible values are: ami_set_to_private, acm_delete_certificate, cloudtrail_enable, cloudtrail_enable_log_file_validation, cloudtrail_send_to_cloudwatch, cloudwatch_create_metric_filter, config_enable, ec2_attach_sg, ec2_attach_instance_role, ec2_create_snapshot, ec2_release_eips, ec2_quarantine_instance, ec2_stop_instance, ec2_terminate_instance, ec2_update_instance_role, ec2_service_role_detach_inline_group, iam_detach_policy, iam_group_delete_inline_group, iam_generate_credential_report, iam_role_attach_policy, iam_user_attach_policy, iam_user_deactivate_unused_access_key, iam_user_delete_inline_policies, iam_user_disable_console_password, iam_user_force_password_change, iam_quarantine_role, iam_quarantine_user, iam_role_clone_with_non_enumerable_name, iam_turn_on_password_policy, igw_delete, kms_cmk_enable_key, kms_enable_rotation, lambda_detach_blanket_permissions, lambda_tag, lambda_enable_active_tracing, load_balancer_enable_access_logs, mark_for_stop_ec2_resource. Required
rule_logic_hash Hash for the rule logic. Use the compliance-ruleset-rule-list command to fetch logic hash. Required

Context Output

There is no context output for this command.

Command example

!dome9-compliance-remediation-update remediation_id=r_id cloudbots=cloudbots comment=COMMENT rule_logic_hash=ruleLogicHash ruleset_id=ruleset_id

Context Example

{
    "CheckPointDome9": {
        "ComplianceRemediation": {
            "cloudAccountId": null,
            "cloudBots": [
                "cloudbots"
            ],
            "comment": "COMMENT",
            "id": "r_id",
            "logic": null,
            "platform": "platform",
            "ruleId": null,
            "ruleLogicHash": "ruleLogicHash",
            "ruleName": null,
            "rulesetId": "ruleset_id"
        }
    }
}

Human Readable Output

Remediation updated successfully

Cloudbots Id Rulelogichash Rulesetid Platform Comment
cloudbots r_id ruleLogicHash ruleset_id platform COMMENT

dome9-compliance-remediation-delete


Delete a remediation.

Base Command

dome9-compliance-remediation-delete

Input

Argument Name Description Required
remediation_id Remediation ID. Required

Context Output

There is no context output for this command.

Command example

!dome9-compliance-remediation-delete remediation_id=remediation_id

Context Example

{
    "CheckPointDome9": {
        "ComplianceRemediation": ""
    }
}

Human Readable Output

Remediation deleted successfully

dome9-compliance-ruleset-list


Get all Rulesets for the account.

Base Command

dome9-compliance-ruleset-list

Input

Argument Name Description Required
ruleset_id The Ruleset ID. Optional
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.ComplianceRuleset.accountId String The account ID.
CheckPointDome9.ComplianceRuleset.id Number The Ruleset ID.
CheckPointDome9.ComplianceRuleset.name String The Ruleset name.
CheckPointDome9.ComplianceRuleset.description String The Ruleset description.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "ComplianceRuleset": [
            {
                "accountId": "account_id",
                "cloudVendor": "cloudVendor",
                "common": false,
                "createdTime": "createdTime",
                "default": false,
                "description": "description",
                "hideInCompliance": false,
                "icon": "",
                "id": "id",
                "isTemplate": true,
                "language": "language",
                "minFeatureTier": "minFeatureTier",
                "name": "name",
                "rulesCount": 1,
                "section": 2,
                "showBundle": true,
                "systemBundle": false,
                "tooltipText": "tooltipText",
                "updatedTime": "updatedTime",
                "version": 32
            }
        ]
    }
}

Human Readable Output

Compliance Ruleset

Showing 50 rows out of 136.

Accountid Id Name Description
account_id id name description

dome9-compliance-ruleset-rule-list


Get rule details. Get the rule logic hash to create a new remediation.

Base Command

dome9-compliance-ruleset-rule-list

Input

Argument Name Description Required
rule_id The Ruleset ID. Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.ComplianceRuleset.Rule.name String The rule name.
CheckPointDome9.ComplianceRuleset.Rule.severity String The rule severity.
CheckPointDome9.ComplianceRuleset.Rule.logic Number The rule logic.
CheckPointDome9.ComplianceRuleset.Rule.logicHash String The rule logic hash.
CheckPointDome9.ComplianceRuleset.Rule.description String The rule description.

Command example

!dome9-compliance-ruleset-rule-list rule_id=-41

Context Example

{
    "CheckPointDome9": {
        "ComplianceRuleset": {
            "Rule": [
                {
                    "category": "",
                    "cloudbots": null,
                    "complianceTag": "complianceTag",
                    "controlTitle": "",
                    "description": "description",
                    "domain": "",
                    "isDefault": false,
                    "labels": [],
                    "logic": "logic",
                    "logicHash": "logicHash",
                    "name": "name",
                    "priority": "",
                    "remediation": "remediation",
                    "ruleId": "ruleId",
                    "severity": "severity"
                }
            ]
        }
    }
}

Human Readable Output

Compliance Ruleset Rules

Showing 10 rows out of 10.

Name Severity Description Logic Logichash
name severity description logic logicHash

dome9-security-group-instance-attach


Attach the security group to an AWS EC2 instance.

Base Command

dome9-security-group-instance-attach

Input

Argument Name Description Required
instance_id AWS instance ID. Required
sg_id AWS security group internal ID. Required
nic_name The instance NIC name. Use the dome9-instance-list command to get this argument. Required

Context Output

There is no context output for this command.

Command example

!dome9-security-group-instance-attach instance_id=i-instance_id nic_name=nic_name sg_id=sg_id

Context Example

{
    "CheckPointDome9": {
        "Instance": {
            "amiLaunchIndex": 0,
            "architecture": "architecture",
            "blockDeviceMappings": [
                {
                    "deviceName": "deviceName",
                    "ebs": {
                        "attachTime": "attachTime",
                        "deleteOnTermination": true,
                        "status": "status",
                        "volumeId": "volumeId"
                    }
                }
            ],
            "clientToken": null,
            "ebsOptimized": false,
            "enaSupport": true,
            "externalId": "externalId",
            "hypervisor": "hypervisor",
            "iamInstanceProfile": null,
            "imageId": "imageId",
            "imageName": null,
            "instanceId": "instanceId",
            "instanceLifecycle": null,
            "instanceType": "instanceType",
            "isMicro": true,
            "isRunning": true,
            "kernelId": null,
            "keyName": "keyName",
            "launchTime": "launchTime",
            "monitoring": {
                "state": "state"
            },
            "networkInterfaces": [
                {
                    "association": {
                        "ipOwnerId": "ipOwnerId",
                        "publicDnsName": "publicDnsName",
                        "publicIp": "publicIp"
                    },
                    "attachment": {
                        "attachTime": "attachTime",
                        "attachmentId": "attachmentId",
                        "deleteOnTermination": true,
                        "deviceIndex": 0,
                        "status": "status"
                    },
                    "description": null,
                    "groups": [
                        {
                            "groupId": "groupId",
                            "groupName": "groupName"
                        }
                    ],
                    "ipv6Addresses": [],
                    "macAddress": "macAddress",
                    "networkInterfaceId": "networkInterfaceId",
                    "ownerId": "ownerId",
                    "privateDnsName": "privateDnsName",
                    "privateIpAddress": "privateIpAddress",
                    "privateIpAddresses": [
                        {
                            "association": {
                                "ipOwnerId": "ipOwnerId",
                                "publicDnsName": "publicDnsName",
                                "publicIp": "publicIp"
                            },
                            "primary": true,
                            "privateDnsName": "privateDnsName",
                            "privateIpAddress": "privateIpAddress"
                        }
                    ],
                    "sourceDestCheck": true,
                    "status": "status",
                    "subnetId": "subnetId",
                    "vpcId": "vpcId"
                }
            ],
            "niCs": [
                {

                }
            ],
            "osType": "osType",
            "placement": {
                "affinity": null,
                "availabilityZone": "availabilityZone",
                "groupName": null,
                "hostId": null,
                "tenancy": "tenancy"
            },
            "platform": null,
            "privateDnsName": "privateDnsName",
            "privateIpAddress": "privateIpAddress",
            "productCodes": [],
            "profileArn": null,
            "publicDnsName": "publicDnsName",
            "publicIpAddress": "publicIpAddress",
            "ramdiskId": null,
            "rootDeviceName": "rootDeviceName",
            "rootDeviceType": "rootDeviceType",
            "securityGroups": [

            ],
            "sourceDestCheck": true,
            "spotInstanceRequestId": null,
            "sriovNetSupport": null,
            "state": {

            },
            "stateReason": null,
            "stateTransitionReason": null,
            "subnetId": "subnetId",
            "tags": [
                {
                    "key": "Name",
                    "value": "value"
                }
            ],
            "virtualizationType": "virtualizationType",
            "vpcId": "vpcId"
        }
    }
}

Human Readable Output

Security group attach successfully

dome9-security-group-service-delete


Delete a service from an AWS security group.

Base Command

dome9-security-group-service-delete

Input

Argument Name Description Required
sg_id Security group ID. Required
service_id Service ID. Required

Context Output

There is no context output for this command.

Command example

!dome9-security-group-service-delete service_id=6-56 sg_id=sg_id

Context Example

{
    "CheckPointDome9": {
        "SecurityGroup": {
            "Service": ""
        }
    }
}

Human Readable Output

Service deleted successfully

dome9-security-group-tags-update


Update the list of tags for an AWS security group.

Base Command

dome9-security-group-tags-update

Input

Argument Name Description Required
sg_id Security group ID. Required
key The key name. Required
value The value name. Required

Context Output

There is no context output for this command.

Command example

!dome9-security-group-tags-update key=KEYkey value=VALUEvalue sg_id=sg_id

Context Example

{
    "CheckPointDome9": {
        "SecurityGroup": {
            "Tag": {
                "keYkey": "VALUEvalue"
            }
        }
    }
}

Human Readable Output

Tag updated successfully

dome9-security-group-service-create


Create a new service (rule) for the security group.

Base Command

dome9-security-group-service-create

Input

Argument Name Description Required
sg_id Security group ID. Required
policy_type The service type. Possible values are: Inbound, Outbound. Required
name The service name. Required
protocol_type Service protocol type. Possible values are: ALL, HOPOPT, ICMP, IGMP, GGP, IPV4, ST, TCP, CBT, EGP, IGP, BBN_RCC_MON, NVP2, PUP, ARGUS, EMCON, XNET, CHAOS, UDP, MUX, DCN_MEAS, HMP, PRM, XNS_IDP, TRUNK1, TRUNK2, LEAF1, LEAF2, RDP, IRTP, ISO_TP4, NETBLT, MFE_NSP, MERIT_INP, DCCP, ThreePC, IDPR, XTP, DDP, IDPR_CMTP, TPplusplus, IL, IPV6, SDRP, IPV6_ROUTE, IPV6_FRAG, IDRP, RSVP, GRE, DSR, BNA, ESP, AH, I_NLSP, SWIPE, NARP, MOBILE, TLSP, SKIP, ICMPV6, IPV6_NONXT, IPV6_OPTS, CFTP, SAT_EXPAK, KRYPTOLAN, RVD, IPPC, SAT_MON, VISA, IPCV, CPNX, CPHB, WSN, PVP, BR_SAT_MON, SUN_ND, WB_MON, WB_EXPAK, ISO_IP, VMTP, SECURE_VMTP, VINES, TTP, NSFNET_IGP, DGP, TCF, EIGRP, OSPFIGP, SPRITE_RPC, LARP, MTP, AX25, IPIP, MICP, SCC_SP, ETHERIP, ENCAP, GMTP, IFMP, PNNI, PIM, ARIS, SCPS, QNX, AN, IPCOMP, SNP, COMPAQ_PEER, IPX_IN_IP, VRRP, PGM, L2TP, DDX, IATP, STP, SRP, UTI, SMP, SM, PTP, ISIS, FIRE, CRTP, CRUDP, SSCOPMCE, IPLT, SPS, PIPE, SCTP, FC, RSVP_E2E_IGNORE, MOBILITY_HEADER, UDPLITE, MPLS_IN_IP, MANET, HIP, SHIM6, WESP, ROHC. Required
port The service port (indicates a port range). Required
open_for_all Indicates if the service is open to all ports. Possible values are: True, False. Optional
description Service description. Optional
data_id IP list ID to attach. Optional
data_name IP list name to attach. Optional
scope_type Scope type to attach. Possible values are: CIDR, IPList. Optional
is_valid Whether the service is valid. Possible values are: True, False. Optional
inbound Whether the service is inbound. Possible values are: True, False. Optional
icmptype ICMP type (when protocol is ICMP). Possible values are: All, EchoReply, DestinationUnreachable, SourceQuench, Redirect, AlternateHostAddress, Echo, RouterAdvertisement, RouterSelection, TimeExceeded, ParameterProblem, Timestamp, TimestampReply, InformationRequest, InformationReply, AddressMaskRequest, AddressMaskReply, Traceroute, DatagramConversionError, MobileHostRedirect, IPv6WhereAreYou, IPv6IAmHere, MobileRegistrationRequest, MobileRegistrationReply, DomainNameRequest, DomainNameReply, SKIP, Photuris. Optional
icmpv6type ICMP V6 type (when protocol is ICMPV6). Optional

Context Output

Path Type Description
CheckPointDome9.SecurityGroup.Service.id String The security group service ID.
CheckPointDome9.SecurityGroup.Service.name string The security group service name.
CheckPointDome9.SecurityGroup.Service.protocolType String The service protocol type.
CheckPointDome9.SecurityGroup.Service.port string The service port.
CheckPointDome9.SecurityGroup.Service.scope String The service scope type.
CheckPointDome9.SecurityGroup.Service.description string The service description.

Command example

!dome9-security-group-service-create name=NewService0107 policy_type=Inbound port=port protocol_type=protocol sg_id=sg_id

Context Example

{
    "CheckPointDome9": {
        "SecurityGroup": {
            "Service": {
                "description": null,
                "icmpType": null,
                "icmpv6Type": null,
                "id": "id",
                "inbound": true,
                "name": "NewService0107",
                "openForAll": false,
                "port": "port",
                "protocolType": "protocol",
                "scope": []
            }
        }
    }
}

Human Readable Output

Security group service created successfully

Description Id Name Port Protocoltype
  id NewService0107 port protocol

dome9-security-group-service-update


Update a service (rule) for an AWS security group. Can update only the port and name.

Base Command

dome9-security-group-service-update

Input

Argument Name Description Required
sg_id Security group ID. Required
policy_type The service type. Possible values are: Inbound, Outbound. Required
service_name Service name. Required
protocol_type The service protocol type. Possible values are: ALL, HOPOPT, ICMP, IGMP, GGP, IPV4, ST, TCP, CBT, EGP, IGP, BBN_RCC_MON, NVP2, PUP, ARGUS, EMCON, XNET, CHAOS, UDP, MUX, DCN_MEAS, HMP, PRM, XNS_IDP, TRUNK1, TRUNK2, LEAF1, LEAF2, RDP, IRTP, ISO_TP4, NETBLT, MFE_NSP, MERIT_INP, DCCP, ThreePC, IDPR, XTP, DDP, IDPR_CMTP, TPplusplus, IL, IPV6, SDRP, IPV6_ROUTE, IPV6_FRAG, IDRP, RSVP, GRE, DSR, BNA, ESP, AH, I_NLSP, SWIPE, NARP, MOBILE, TLSP, SKIP, ICMPV6, IPV6_NONXT, IPV6_OPTS, CFTP, SAT_EXPAK, KRYPTOLAN, RVD, IPPC, SAT_MON, VISA, IPCV, CPNX, CPHB, WSN, PVP, BR_SAT_MON, SUN_ND, WB_MON, WB_EXPAK, ISO_IP, VMTP, SECURE_VMTP, VINES, TTP, NSFNET_IGP, DGP, TCF, EIGRP, OSPFIGP, SPRITE_RPC, LARP, MTP, AX25, IPIP, MICP, SCC_SP, ETHERIP, ENCAP, GMTP, IFMP, PNNI, PIM, ARIS, SCPS, QNX, AN, IPCOMP, SNP, COMPAQ_PEER, IPX_IN_IP, VRRP, PGM, L2TP, DDX, IATP, STP, SRP, UTI, SMP, SM, PTP, ISIS, FIRE, CRTP, CRUDP, SSCOPMCE, IPLT, SPS, PIPE, SCTP, FC, RSVP_E2E_IGNORE, MOBILITY_HEADER, UDPLITE, MPLS_IN_IP, MANET, HIP, SHIM6, WESP, ROHC. Required
port Service port (indicates a port range). Required
open_for_all Whether the service is open to all ports. Possible values are: True, False. Optional
description Service description. Optional
data_id IP list ID. Optional
data_name IP list name. Optional
scope_type Scope type. Possible values are: CIDR, IPList. Optional
is_valid Whether the service is valid. Possible values are: True, False. Optional
inbound Whether the service is inbound. Possible values are: True, False. Optional
icmptype ICMP type (when protocol is ICMP). Possible values are: All, EchoReply, DestinationUnreachable, SourceQuench, Redirect, AlternateHostAddress, Echo, RouterAdvertisement, RouterSelection, TimeExceeded, ParameterProblem, Timestamp, TimestampReply, InformationRequest, InformationReply, AddressMaskRequest, AddressMaskReply, Traceroute, DatagramConversionError, MobileHostRedirect, IPv6WhereAreYou, IPv6IAmHere, MobileRegistrationRequest, MobileRegistrationReply, DomainNameRequest, DomainNameReply, SKIP, Photuris. Optional
icmpv6type ICMP V6 type (when protocol is ICMPV6). Optional

Context Output

Path Type Description
CheckPointDome9.SecurityGroup.Service.id String The security group service ID.
CheckPointDome9.SecurityGroup.Service.name string The security group service name.
CheckPointDome9.SecurityGroup.Service.protocolType String The service protocol type.
CheckPointDome9.SecurityGroup.Service.port string The service port.
CheckPointDome9.SecurityGroup.Service.scopeType String The service scope type.
CheckPointDome9.SecurityGroup.Service.description string The service description.

Command example

!dome9-security-group-service-update service_name=name policy_type=Inbound port=port protocol_type=protocol sg_id=sg_id

Context Example

{
    "CheckPointDome9": {
        "SecurityGroup": {
            "Service": {
                "description": null,
                "icmpType": null,
                "icmpv6Type": null,
                "id": "id",
                "inbound": true,
                "name": "name",
                "openForAll": false,
                "port": "port",
                "protocolType": "protocol",
                "scope": []
            }
        }
    }
}

Human Readable Output

Security group service updated successfully

Description Id Name Port Protocoltype
  id name port protocol

dome9-security-group-instance-detach


Detach the security group from an AWS EC2 Instance.

Base Command

dome9-security-group-instance-detach

Input

Argument Name Description Required
instance_id AWS instance ID. Required
sg_id AWS security group internal ID. Required
nic_name The instance NIC name. Use the dome9-instance-list command to get this argument. Required

Context Output

There is no context output for this command.

Command example

!dome9-security-group-instance-detach instance_id=i-instanceID nic_name=eth0 sg_id=sg_id

Context Example

{
    "CheckPointDome9": {
        "Instance": {
            "amiLaunchIndex": 0,
            "architecture": "architecture",
            "blockDeviceMappings": [
                {
                    "deviceName": "deviceName",
                    "ebs": {
                        "attachTime": "attachTime",
                        "deleteOnTermination": true,
                        "status": "status",
                        "volumeId": "volumeId"
                    }
                }
            ],
            "clientToken": null,
            "ebsOptimized": false,
            "enaSupport": true,
            "externalId": "externalId",
            "hypervisor": "hypervisor",
            "iamInstanceProfile": null,
            "imageId": "imageId",
            "imageName": null,
            "instanceId": "instanceId",
            "instanceLifecycle": null,
            "instanceType": "instanceType",
            "isMicro": true,
            "isRunning": true,
            "kernelId": null,
            "keyName": "keyName",
            "launchTime": "launchTime",
            "monitoring": {
                "state": "state"
            },
            "networkInterfaces": [
                {
                    "association": {
                        "ipOwnerId": "ipOwnerId",
                        "publicDnsName": "publicDnsName",
                        "publicIp": "publicIp"
                    },
                    "attachment": {
                        "attachTime": "attachTime",
                        "attachmentId": "attachmentId",
                        "deleteOnTermination": true,
                        "deviceIndex": 0,
                        "status": "status"
                    },
                    "description": null,
                    "groups": [
                        {
                            "groupId": "groupId",
                            "groupName": "groupName"
                        }
                    ],
                    "ipv6Addresses": [],
                    "macAddress": "macAddress",
                    "networkInterfaceId": "networkInterfaceId",
                    "ownerId": "ownerId",
                    "privateDnsName": "privateDnsName",
                    "privateIpAddress": "privateIpAddress",
                    "privateIpAddresses": [
                        {
                            "association": {
                                "ipOwnerId": "ipOwnerId",
                                "publicDnsName": "publicDnsName",
                                "publicIp": "publicIp"
                            },
                            "primary": true,
                            "privateDnsName": "privateDnsName",
                            "privateIpAddress": "privateIpAddress"
                        }
                    ],
                    "sourceDestCheck": true,
                    "status": "status",
                    "subnetId": "subnetId",
                    "vpcId": "vpcId"
                }
            ],
            "niCs": [
                {

                }
            ],
            "osType": "osType",
            "placement": {
                "affinity": null,
                "availabilityZone": "availabilityZone",
                "groupName": null,
                "hostId": null,
                "tenancy": "tenancy"
            },
            "platform": null,
            "privateDnsName": "privateDnsName",
            "privateIpAddress": "privateIpAddress",
            "productCodes": [],
            "profileArn": null,
            "publicDnsName": "publicDnsName",
            "publicIpAddress": "publicIpAddress",
            "ramdiskId": null,
            "rootDeviceName": "rootDeviceName",
            "rootDeviceType": "rootDeviceType",
            "securityGroups": [

            ],
            "sourceDestCheck": true,
            "spotInstanceRequestId": null,
            "sriovNetSupport": null,
            "state": {

            },
            "stateReason": null,
            "stateTransitionReason": null,
            "subnetId": "subnetId",
            "tags": [
                {
                    "key": "Name",
                    "value": "value"
                }
            ],
            "virtualizationType": "virtualizationType",
            "vpcId": "vpcId"
        }
    }
}

Human Readable Output

Security group detach successfully

dome9-instance-list


Fetch an AWS EC2 instance.

Base Command

dome9-instance-list

Input

Argument Name Description Required
instance_id AWS instance ID. Optional

Context Output

Path Type Description
CheckPointDome9.Instance.externalId String The instance external ID.
CheckPointDome9.Instance.region string The instance region.
CheckPointDome9.Instance.nics String The instance NIC names.
CheckPointDome9.Instance.name string The instance name.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "Instance": [
            {
                "accountId": "account_id",
                "cloudAccountId": "cloudAccountId",
                "externalId": "i-externalId",
                "image": "ami-image",
                "instanceType": "instanceType",
                "isBillable": true,
                "isRunning": true,
                "kernelId": null,
                "launchTime": "launchTime",
                "name": "name",
                "nics": [
                    {
                        "name": "name"
                    }
                ],
                "platform": "platform",
                "profileArn": "profileArn",
                "publicDnsName": "publicDnsName",
                "region": "region",
                "roleArns": [
                    "roleArns"
                ],
                "ssmAgentInstanceInformation": null,
                "tags": {
                    "Name": "Name"
                },
                "vpc": "vpc"
            }
        ]
    }
}

Human Readable Output

AWS instances

Showing 5 rows out of 5.

Accountid Cloudaccountid Externalid Image Instancetype Isbillable Isrunning Kernelid Launchtime Name Nics Platform Profilearn Publicdnsname Region Rolearns Ssmagentinstanceinformation Tags Vpc
account_id cloudAccountId i-Externalid ami Instancetype true true   someDate name Nics       region arn   Name vpc

dome9-security-group-protection-mode-update


Change the protection mode for an AWS security group (FullManage or ReadOnly).

Base Command

dome9-security-group-protection-mode-update

Input

Argument Name Description Required
protection_mode The protection mode to update. Possible values are: FullManage, ReadOnly. Required
sg_id Security group ID. Required

Context Output

There is no context output for this command.

Command example

!dome9-security-group-protection-mode-update protection_mode=FullManage sg_id=sg_id

Context Example

{
    "CheckPointDome9": {
        "SecurityGroup": {
            "cloud_account_id": "cloudAccountId",
            "cloud_account_name": "cloud_account_name",
            "description": "description",
            "isProtected": true,
            "region_id": "region",
            "security_group_external_id": "sg_id",
            "security_group_id": "sg_id",
            "security_group_name": "security_group_name",
            "vpc_id": "vpc"
        }
    }
}

Human Readable Output

protection mode updated for security group

Cloud Account Id Cloud Account Name Description Isprotected Region Id Security Group External Id Security Group Id Security Group Name Vpc Id
cloudAccountId name description true region sg_id sg_id sg_name vpc

dome9-cloud-accounts-list


Get the cloud account list.

Base Command

dome9-cloud-accounts-list

Input

Argument Name Description Required
account_id account ID. Optional
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional
cloud_account_od The cloud account ID. Optional

Context Output

There is no context output for this command.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "CloudAccount": {
            "allowReadOnly": false,
            "creationDate": "creationDate",
            "credentials": {
                "apikey": null,
                "arn": "arn",
                "iamUser": null,
                "isReadOnly": true,
                "secret": null,
                "type": "type"
            },
            "error": null,
            "externalAccountNumber": "externalAccountNumber",
            "fullProtection": false,
            "iamSafe": {

            },
            "id": "cloudAccountId",
            "isFetchingSuspended": false,
            "lambdaScanner": false,
            "magellan": true,
            "name": "name",
            "netSec": {
                "regions": [

                ]
            },
            "onboardingMode": "onboardingMode",
            "organizationalUnitId": null,
            "organizationalUnitName": "organizationalUnitName",
            "organizationalUnitPath": "",
            "serverless": {

            },
            "vendor": "vendor"
        }
    }
}

Human Readable Output

Cloud accounts

Showing 1 rows out of 1.

Id Vendor Externalaccountnumber Creationdate Organizationalunitname
cloudAccountId vendor number date name

dome9-security-group-ip-list-details-get


Get AWS cloud accounts for a specific security group and region and check if there is an IP list to attach to a security group.

Base Command

dome9-security-group-ip-list-details-get

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional
sg_id Security group ID. Optional

Context Output

Path Type Description
CheckPointDome9.SecurityGroup.security_group_id String The security group ID.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "SecurityGroup": [
            {
                "cloud_account_id": "cloudAccountId",
                "cloud_account_name": "cloud_account_name",
                "description": "description",
                "isProtected": true,
                "region_id": "region",
                "security_group_external_id": "sg_id",
                "security_group_id": "sg_id",
                "security_group_name": "security_group_name",
                "vpc_id": "vpc"
            }
        ]
    }
}

Human Readable Output

Security Groups

Showing 1 rows out of 24.

Cloud Account Id Cloud Account Name Description Isprotected Region Id Security Group External Id Security Group Id Security Group Name Vpc Id
cloudAccountId name description true region sg_id sg_id sg_name vpc

dome9-security-group-list


Get all security group entities.

Base Command

dome9-security-group-list

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.SecurityGroup.security_group_id String The security group ID.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "SecurityGroup": [
            {
                "cloudAccountId": "cloudAccountId",
                "cloudAccountName": "cloudAccountName",
                "externalId": "sg",
                "regionId": "region",
                "securityGroupName": "securityGroupName",
                "vpcId": "vpc"
            }
        ]
    }
}

Human Readable Output

Security Groups

Showing 1 rows out of 107.

Cloud Account Id Region Id Security Group Id Security Group Name Vpc Id
cloudAccountId region sg name vpc

dome9-global-search-get


Get top results for each service.

Base Command

dome9-global-search-get

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.GlobalSearch.Alert.id String The global search alert ID.
CheckPointDome9.GlobalSearch.Alert.type String The global search alert type.
CheckPointDome9.GlobalSearch.Alert.severity String The global search alert severity.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "GlobalSearch": {
            "Alert": [
                {
                    "alertType": "alertType",
                    "bundleId": "bundleId",
                    "cloudAccountExternalId": "cloudAccountExternalId",
                    "cloudAccountId": "cloudAccountId",
                    "createdTime": "createdTime",
                    "description": "description",
                    "entityName": "entityName",
                    "id": "id",
                    "remediation": "remediation",
                    "ruleName": "ruleName",
                    "severity": "severity",
                    "updatedTime": "updatedTime"
                },
                {
                    "alertType": "alertType",
                    "bundleId": "bundleId",
                    "cloudAccountExternalId": "cloudAccountExternalId",
                    "cloudAccountId": "cloudAccountId",
                    "createdTime": "createdTime",
                    "description": "description",
                    "entityName": "entityName",
                    "id": "id",
                    "remediation": "remediation",
                    "ruleName": "ruleName",
                    "severity": "severity",
                    "updatedTime": "updatedTime"
                }
            ]
        }
    }
}

Human Readable Output

Global Search

Alerttype Bundleid Cloudaccountexternalid Cloudaccountid Createdtime Description Entityname Id Remediation Rulename Severity Updatedtime
Alerttype Bundleid Cloudaccountexternalid Cloudaccountid date Description Entityname id Remediation rule name Severity Updatedtime
Alerttype Bundleid Cloudaccountexternalid Cloudaccountid date Description Entityname id remediation rule name Severity Updatedtime

dome9-cloud-trail-get


Get CloudTrail events for a Dome9 user.

Base Command

dome9-cloud-trail-get

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.CloudTrail.id String The CloudTrail ID.
CheckPointDome9.CloudTrail.name String The CloudTrail name.
CheckPointDome9.CloudTrail.trailArn String The CloudTrail ARN.
CheckPointDome9.CloudTrail.accountId String The CloudTrail account ID.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "CloudTrail": {
            "accountId": "account_id",
            "cloudAccountId": "cloudAccountId",
            "cloudTrailStatus": {

            },
            "cloudWatchLogsLogGroupArn": null,
            "cloudWatchLogsRoleArn": null,
            "externalId": "arn",
            "homeRegion": "homeRegion",
            "id": "id",
            "includeGlobalServiceEvents": true,
            "isMultiRegionTrail": true,
            "kmsKeyId": null,
            "logFileValidationEnabled": true,
            "name": "name",
            "region": "region",
            "s3BucketName": "s3BucketName",
            "s3KeyPrefix": null,
            "snsTopicArn": null,
            "snsTopicName": null,
            "trailArn": "arn"
        }
    }
}

Human Readable Output

Cloud Trail

Showing 1 rows out of 1.

Accountid Cloudaccountid Cloudtrailstatus Cloudwatchlogsloggrouparn Cloudwatchlogsrolearn Externalid Homeregion Id Includeglobalserviceevents Ismultiregiontrail Kmskeyid Logfilevalidationenabled Name Region S3bucketname S3keyprefix Snstopicarn Snstopicname Trailarn
account_id cloudAccountId status     arn us-east-1 id true true   true name region name       arn

dome9-organizational-unit-view-get


Get organizational unit view entities.

Base Command

dome9-organizational-unit-view-get

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.OrganizationalUnitView.id String The organizational unit ID.
CheckPointDome9.OrganizationalUnitView.name String The organizational unit name.
CheckPointDome9.OrganizationalUnitView.path String The organizational unit path.
CheckPointDome9.OrganizationalUnitView.children String The organizational unit children.

Command example


#### Context Example

```json
{
    "CheckPointDome9": {
        "OrganizationalUnitView": {
            "children": [],
            "id": "id",
            "name": "name",
            "path": "path"
        }
    }
}

Human Readable Output

Organizational Unit View

Children Id Name Path
  id name name

dome9-organizational-unit-flat-get


Get flat organizational units.

Base Command

dome9-organizational-unit-flat-get

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional

Context Output

Path Type Description
CheckPointDome9.OrganizationalUnitFlat.id String The organizational unit ID.
CheckPointDome9.OrganizationalUnitFlat.name String The organizational unit name.
CheckPointDome9.OrganizationalUnitFlat.path String The organizational unit path.
CheckPointDome9.OrganizationalUnitFlat.parentId String The organizational unit parent ID.

Command example


#### Human Readable Output

>### Organizational Unit Flat
>
>Showing 0 rows out of 0.
>**No entries.**
>
### dome9-organizational-unit-get

***
Get an organizational unit by its ID.

#### Base Command

`dome9-organizational-unit-get`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| page | Page number of paginated results. Minimum value: 1. | Optional |
| page_size | Number of items per page. | Optional |
| limit | The maximum number of records to retrieve. Default is 50. | Optional |
| unit_id | The organizational unit ID. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CheckPointDome9.OrganizationalUnit.id | String | The organizational unit ID. |
| CheckPointDome9.OrganizationalUnit.name | String | The organizational unit name. |
| CheckPointDome9.OrganizationalUnit.path | String | The organizational unit path. |
| CheckPointDome9.OrganizationalUnit.parentId | String | The organizational unit parent ID. |

#### Command example

```!dome9-organizational-unit-get```

#### Context Example

```json
{
    "CheckPointDome9": {
        "OrganizationalUnit": {
            "accountId": 0,
            "alibabaAggregateCloudAccountsCount": 0,
            "alibabaCloudAccountsCount": 0,
            "awsAggregatedCloudAcountsCount": 1,
            "awsCloudAcountsCount": 1,
            "azureAggregateCloudAccountsCount": 0,
            "azureCloudAccountsCount": 0,
            "containerRegistryAccountsCount": 0,
            "containerRegistryAggregateCloudAccountsCount": 0,
            "created": "created",
            "googleAggregateCloudAccountsCount": 0,
            "googleCloudAccountsCount": 0,
            "id": "id",
            "isParentRoot": true,
            "isRoot": true,
            "k8sAggregateCloudAccountsCount": 0,
            "k8sCloudAccountsCount": 0,
            "name": "name",
            "parentId": null,
            "path": null,
            "pathStr": null,
            "shiftLeftAggregateCloudAccountsCount": 0,
            "shiftLeftCloudAccountsCount": 0,
            "subOrganizationalUnitsCount": 0,
            "updated": "updated"
        }
    }
}

Human Readable Output

Organizational Unit

Accountid Alibabaaggregatecloudaccountscount Alibabacloudaccountscount Awsaggregatedcloudacountscount Awscloudacountscount Azureaggregatecloudaccountscount Azurecloudaccountscount Containerregistryaccountscount Containerregistryaggregatecloudaccountscount Created Googleaggregatecloudaccountscount Googlecloudaccountscount Id Isparentroot Isroot K8saggregatecloudaccountscount K8scloudaccountscount Name Parentid Path Pathstr Shiftleftaggregatecloudaccountscount Shiftleftcloudaccountscount Suborganizationalunitscount Updated
0 0 0 1 1 0 0 0 0 date 0 0 id true true 0 0 name       0 0 0 date

dome9-findings-get


Get a findings by its ID.

Base Command

dome9-findings-get

Input

Argument Name Description Required
finding_id The findings ID. Required

Context Output

Path Type Description
CheckPointDome9.Finding.id String The findings ID.
CheckPointDome9.Finding.bundleId String The findings bundle ID.
CheckPointDome9.Finding.severity String The findings severity.
CheckPointDome9.Finding.description String The findings description.
CheckPointDome9.Finding.remediation String The findings remediation.
CheckPointDome9.Finding.region String The findings region.
CheckPointDome9.Finding.cloudAccountId String The findings cloud account ID.

Command example

!dome9-findings-get finding_id=finding_id

Context Example

{
    "CheckPointDome9": {
        "Finding": {
            "acknowledged": false,
            "action": "action",
            "additionalFields": [],
            "alertType": "alertType",
            "bundleId": "bundleId",
            "bundleName": "bundleName",
            "category": "",
            "cloudAccountExternalId": "id",
            "cloudAccountId": "cloudAccountId",
            "cloudAccountType": "cloudAccountType",
            "comments": [],
            "createdTime": "createdTime",
            "description": "description",
            "entityDome9Id": "entityDome9Id",
            "entityExternalId": "entityExternalId",
            "entityName": "entityName",
            "entityNetwork": null,
            "entityObject": {
            },
            "entityTags": [],
            "bundleId": "bundleId",
            "entityTypeByEnvironmentType": "",
            "findingKey": "",
            "id": "finding_id",
            "isExcluded": false,
            "labels": [],
            "lastSeenTime": "lastSeenTime",
            "magellan": null,
            "occurrences": [],
            "organizationalUnitId": "id",
            "organizationalUnitPath": "",
            "origin": "origin",
            "ownerUserName": null,
            "region": "Region",
            "remediation": "remediation",
            "remediationActions": [],
            "ruleId": "ruleId",
            "ruleLogic": "ruleLogic",
            "ruleName": "ruleName",
            "scanId": null,
            "severity": "severity",
            "status": "status",
            "tag": "tag",
            "updatedTime": "updatedTime",
            "webhookResponses": null
        }
    }
}

Human Readable Output

Finding

dome9-findings-bundle-get


Get the findings for a specific rule in a bundle, for all of the user’s accounts.

Base Command

dome9-findings-bundle-get

Input

Argument Name Description Required
page Page number of paginated results. Minimum value: 1. Optional
page_size Number of items per page. Optional
limit The maximum number of records to retrieve. Default is 50. Optional
bundle_id The bundle ID. Use the dome9-compliance-ruleset-list command to get the bundle ID list. Required
rule_logic_hash MD5 hash of the rule GSL string. Use the compliance-ruleset-rule-list command to fetch the logic hash. Required

Context Output

Path Type Description
CheckPointDome9.FindingsBundle.id String The CloudTrail ID.
CheckPointDome9.FindingsBundle.severity String The CloudTrail name.
CheckPointDome9.FindingsBundle.remediation String The Cloud Trail ARN.
CheckPointDome9.FindingsBundle.accountId String The CloudTrail account ID.
CheckPointDome9.FindingsBundle.description String The CloudTrail ARN.
CheckPointDome9.FindingsBundle.region String The CloudTrail account ID.

Command example

!dome9-findings-bundle-get bundle_id=bundle_id rule_logic_hash=ruleLogicHash

Human Readable Output

Findings Bundle

No entries.

Configuration parameters

  • base_url — Server URL (required)
  • api_key_id — API key ID
  • api_key_secret — API key secret
  • api_key_id_cred
  • api_key_secret_cred
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • max_fetch — Maximum incidents for one fetch.
  • isFetch — Fetch incidents
  • alert_region — Alert region (AWS) to fetch as incidents.
  • alert_severity — Alert severity to fetch as incidents.
  • first_fetch — First fetch time
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (37)

  • dome9-access-lease-delete

    Terminate an Access Lease.

  • dome9-access-lease-invitation-delete

    Delete an Access Lease invitation.

  • dome9-access-lease-invitation-list

    Get a lease invitation.

  • dome9-access-lease-list

    Get a list of all active Access Leases.

  • dome9-cloud-accounts-list

    Get the cloud account list.

  • dome9-cloud-trail-get

    Get CloudTrail events for a Dome9 user.

  • dome9-compliance-remediation-create

    Add a new remediation.

  • dome9-compliance-remediation-delete

    Delete a remediation.

  • dome9-compliance-remediation-get

    Get a list of remediations for the account.

  • dome9-compliance-remediation-update

    Update a remediation.

  • dome9-compliance-ruleset-list

    Get all Rulesets for the account.

  • dome9-compliance-ruleset-rule-list

    Get rule details. Get the rule logic hash to create a new remediation.

  • dome9-findings-bundle-get

    Get the findings for a specific rule in a bundle, for all of the user's accounts.

  • dome9-findings-get

    Get a findings by its ID.

  • dome9-findings-search

    Search for findings in CloudGuard.

  • dome9-global-search-get

    Get top results for each service.

  • dome9-instance-list

    Fetch an AWS EC2 instance.

  • dome9-ip-list-create

    Add a new IP list.

  • dome9-ip-list-delete

    Delete an IP List by ID.

  • dome9-ip-list-get

    Get an IP List by ID.

  • dome9-ip-list-metadata-create

    Add metadata for a new IP address. An IP address metadata must contain the CIDR, name, and classification. Classification can be External, Unsafe, Dmz, InternalVpc, InternalDc, or NoClassification.

  • dome9-ip-list-metadata-delete

    Delete an IP address metadata with a specific CIDR.

  • dome9-ip-list-metadata-list

    Get all IP addresses metadata.

  • dome9-ip-list-metadata-update

    Update an existing IP address metadata. Classification can only be External, Unsafe, Dmz, InternalVpc, InternalDc, or NoClassification.

  • dome9-ip-list-update

    Update an IP list. This will override the existing IP list.

  • dome9-organizational-unit-flat-get

    Get flat organizational units.

  • dome9-organizational-unit-get

    Get an organizational unit by its ID.

  • dome9-organizational-unit-view-get

    Get organizational unit view entities.

  • dome9-security-group-instance-attach

    Attach the security group to an AWS EC2 instance.

  • dome9-security-group-instance-detach

    Detach the security group from an AWS EC2 Instance.

  • dome9-security-group-ip-list-details-get

    Get AWS cloud accounts for a specific security group and region and check if there is an IP list to attach to a security group.

  • dome9-security-group-list

    Get all security group entities.

  • dome9-security-group-protection-mode-update

    Change the protection mode for an AWS security group (FullManage or ReadOnly).

  • dome9-security-group-service-create

    Create a new service (rule) for the security group.

  • dome9-security-group-service-delete

    Delete a service from an AWS security group.

  • dome9-security-group-service-update

    Update a service (rule) for an AWS security group. Can update only the port and name.

  • dome9-security-group-tags-update

    Update the list of tags for an AWS security group.

import json
import os

import pytest
from CheckPointDome9 import Client

"""MOCK PARAMETERS """
KEY_SECRET = "key_secret"
KEY_ID = "key_id"
"""CONSTANTS"""
BASE_URL = "https://api.dome9.com/v2/"


def load_mock_response(file_name: str) -> str:
    """
    Load mock file that simulates an API response.
    Args:
        file_name (str): Name of the mock response JSON file to return.
    Returns:
        str: Mock file content.
    """

    with open(os.path.join("test_data", file_name), encoding="utf-8") as mock_file:
        return json.loads(mock_file.read())


@pytest.fixture(autouse=True)
def mock_client():
    return Client(base_url=BASE_URL, key_id=KEY_ID, key_secret=KEY_SECRET, proxy=False, verify=True)


def test_access_lease_list_command(requests_mock, mock_client):
    """
    Scenario: Get all access lease.
    Given:
     - User has provided valid credentials.
    When:
     - dome9-access-lease-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import access_lease_list_command

    mock_response = load_mock_response("access_lease_list.json")
    url = f"{BASE_URL}AccessLease"

    requests_mock.get(url=url, json=mock_response)

    result = access_lease_list_command(mock_client, {})

    assert result.outputs_prefix == "CheckPointDome9.AccessLease"
    assert len(result.outputs[0]) == 15
    assert result.outputs[0]["id"] == "id"


def test_access_lease_delete_command(requests_mock, mock_client):
    """
    Scenario: Delete an access lease.
    Given:
    - User has provided valid credentials.
    - Access lease ID.
    When:
    - dome9-access-lease-delete called.
    Then:
    - Ensure number of items is correct.
    - Ensure outputs prefix is correct.
    - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import access_lease_delete_command

    mock_response = ""
    lease_id = "lease_id"
    url = f"{BASE_URL}AccessLease/{lease_id}"
    requests_mock.delete(url=url, json=mock_response)

    result = access_lease_delete_command(mock_client, {"lease_id": lease_id})

    assert result.outputs_prefix == "CheckPointDome9.AccessLease"


def test_access_lease_invitation_list_command(requests_mock, mock_client):
    """
    Scenario: Get all an access lease invitations.
    Given:
     - User has provided valid credentials.
    When:
     - dome9-access-lease-invitation-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import access_lease_invitation_list_command

    mock_response = load_mock_response("access_lease_invitation_list.json")
    invitation_id = "invitation_id"
    url = f"{BASE_URL}AccessLeaseInvitation/{invitation_id}"

    requests_mock.get(url=url, json=mock_response)

    result = access_lease_invitation_list_command(mock_client, {"invitation_id": invitation_id})

    assert result.outputs_prefix == "CheckPointDome9.AccessLease.Invitation"
    assert len(result.outputs[0]) == 11
    assert result.outputs[0]["id"] == "id"


def test_access_lease_invitation_delete_command(requests_mock, mock_client):
    """
    Scenario: Delete an access lease invitation.
    Given:
    - User has provided valid credentials.
    - access lease invitation ID.
    When:
    - dome9-access-lease-invitation-delete called.
    Then:
    - Ensure number of items is correct.
    - Ensure outputs prefix is correct.
    - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import access_lease_invitation_delete_command

    mock_response = ""
    invitation_id = "invitation_id"
    url = f"{BASE_URL}AccessLeaseInvitation/{invitation_id}"
    requests_mock.delete(url=url, json=mock_response)

    result = access_lease_invitation_delete_command(mock_client, {"invitation_id": invitation_id})

    assert result.outputs_prefix == "CheckPointDome9.AccessLease.Invitation"


def test_ip_list_create_command(requests_mock, mock_client):
    """
    Scenario: Create IP list.
    Given:
     - User has provided valid credentials.
     - IP list name, description and items (IPs and comments).
    When:
     - dome9-ip-list-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import ip_list_create_command

    mock_response = load_mock_response("ip_list_create.json")
    url = f"{BASE_URL}IpList"

    requests_mock.post(url=url, json=mock_response)
    args = {"name": "name", "description": "description", "ip": "ip", "comment": "comment"}
    result = ip_list_create_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.IpList"
    assert len(result.outputs) == 4
    assert result.outputs["id"] == "id"


def test_ip_list_update_command(requests_mock, mock_client):
    """
    Scenario: Update IP list.
    Given:
     - User has provided valid credentials.
     - IP list ID, description, update mode and items (IPs and comments).
    When:
     - dome9-ip-list-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import ip_list_update_command

    mock_response = ""
    list_id = "list_id"
    url = f"{BASE_URL}IpList/{list_id}"

    requests_mock.put(url=url, json=mock_response)
    args = {"list_id": list_id, "description": "description", "ip": "ip", "comment": "comment", "update_mode": "replace"}
    result = ip_list_update_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.IpList"


def test_ip_list_get_command(requests_mock, mock_client):
    """
    Scenario: Get IP list.
    Given:
     - User has provided valid credentials.
     - IP list ID.
    When:
     - dome9-ip-list-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import ip_list_get_command

    mock_response = load_mock_response("ip_list_get.json")
    list_id = "list_id"
    url = f"{BASE_URL}IpList/{list_id}"

    requests_mock.get(url=url, json=mock_response)
    args = {"list_id": list_id}
    result = ip_list_get_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.IpList"
    assert len(result.outputs[0]) == 4
    assert result.outputs[0]["id"] == "id"


def test_ip_list_delete_command(requests_mock, mock_client):
    """
    Scenario: Delete an IP list.
    Given:
     - User has provided valid credentials.
     - IP list ID.
    When:
     - dome9-ip-list-delete called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import ip_list_delete_command

    mock_response = ""
    list_id = "list_id"
    url = f"{BASE_URL}IpList/{list_id}"

    requests_mock.delete(url=url, json=mock_response)
    args = {"list_id": list_id}
    result = ip_list_delete_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.IpList"


def test_ip_list_metadata_create_command(requests_mock, mock_client):
    """
    Scenario: Create IP list metadata.
    Given:
     - User has provided valid credentials.
     - IP list metadata name, description, cidr and classification.
    When:
     - dome9-ip-list-metadata-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import ip_list_metadata_create_command

    mock_response = load_mock_response("ip_list_metadata_create_update.json")
    url = f"{BASE_URL}IpAddressMetadata"

    requests_mock.post(url=url, json=mock_response)
    args = {"name": "name", "cidr": "cidr", "classification": "classification"}
    result = ip_list_metadata_create_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.IpList.Metadata"
    assert len(result.outputs) == 5
    assert result.outputs["id"] == "id"


def test_ip_list_metadata_update_command(requests_mock, mock_client):
    """
    Scenario: Update IP list metadata.
    Given:
     - User has provided valid credentials.
     - IP list metadata ID, name and classification.
    When:
     - dome9-ip-list-metadata-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import ip_list_metadata_update_command

    mock_response = load_mock_response("ip_list_metadata_create_update.json")
    url = f"{BASE_URL}IpAddressMetadata"

    requests_mock.put(url=url, json=mock_response)
    args = {"list_metadata_id": "list_metadata_id", "classification": "classification", "name": "name"}
    result = ip_list_metadata_update_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.IpList.Metadata"
    assert len(result.outputs) == 5
    assert result.outputs["id"] == "id"


def test_ip_list_metadata_list_command(requests_mock, mock_client):
    """
    Scenario: Get IP list metadata.
    Given:
     - User has provided valid credentials.
    When:
     - dome9-ip-list-metadata-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import ip_list_metadata_list_command

    mock_response = load_mock_response("ip_list_metadata_list.json")
    url = f"{BASE_URL}IpAddressMetadata"

    requests_mock.get(url=url, json=mock_response)
    result = ip_list_metadata_list_command(mock_client, {})

    assert result.outputs_prefix == "CheckPointDome9.IpList.Metadata"
    assert len(result.outputs) == 2
    assert result.outputs[0]["id"] == "id"


def test_ip_list_metadata_delete_command(requests_mock, mock_client):
    """
    Scenario: DElete IP list metadata.
    Given:
     - User has provided valid credentials.
     - IP list metadata ID, address and mask.
    When:
     - dome9-ip-list-metadata-delete called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import ip_list_metadata_delete_command

    mock_response = ""
    url = f"{BASE_URL}IpAddressMetadata"

    requests_mock.delete(url=url, json=mock_response)
    args = {"account_id": "account_id", "address": "address", "mask": "mask"}
    result = ip_list_metadata_delete_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.IpList.Metadata"


def test_compliance_remediation_create_command(requests_mock, mock_client):
    """
    Scenario: Create compliance remediation.
    Given:
     - User has provided valid credentials.
     - Ruleset ID, Rule logic hash, comment and cloudbots.
    When:
     - dome9-compliance-remediation-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import compliance_remediation_create_command

    mock_response = load_mock_response("compliance_remediation_create_update.json")
    url = f"{BASE_URL}ComplianceRemediation"

    requests_mock.post(url=url, json=mock_response)
    args = {"ruleset_id": "1", "rule_logic_hash": "rule_logic_hash", "comment": "comment", "cloudbots": "cloudbots"}

    result = compliance_remediation_create_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.ComplianceRemediation"
    assert len(result.outputs) == 10
    assert result.outputs["id"] == "id"


def test_compliance_remediation_update_command(requests_mock, mock_client):
    """
    Scenario: Update compliance remediation.
    Given:
     - User has provided valid credentials.
     - Remediation ID, Ruleset ID, Rule logic hash, comment and cloudbots.
    When:
     - dome9-compliance-remediation-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import compliance_remediation_update_command

    mock_response = load_mock_response("compliance_remediation_create_update.json")
    url = f"{BASE_URL}ComplianceRemediation"

    requests_mock.put(url=url, json=mock_response)
    args = {
        "remediation_id": "remediation_id",
        "ruleset_id": "1",
        "rule_logic_hash": "rule_logic_hash",
        "comment": "comment",
        "cloudbots": "cloudbots",
    }
    result = compliance_remediation_update_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.ComplianceRemediation"
    assert len(result.outputs) == 10
    assert result.outputs["id"] == "id"


def test_compliance_remediation_get_command(requests_mock, mock_client):
    """
    Scenario: Get compliance remediation.
    Given:
     - User has provided valid credentials.
    When:
     - dome9-compliance-remediation-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import compliance_remediation_get_command

    mock_response = load_mock_response("compliance_remediation_get.json")
    url = f"{BASE_URL}ComplianceRemediation"

    requests_mock.get(url=url, json=mock_response)
    result = compliance_remediation_get_command(mock_client, {})

    assert result.outputs_prefix == "CheckPointDome9.ComplianceRemediation"
    assert len(result.outputs) == 2
    assert result.outputs[0]["id"] == "id"


def test_compliance_remediation_delete_command(requests_mock, mock_client):
    """
    Scenario: Delete compliance remediation.
    Given:
     - User has provided valid credentials.
     - Remediation ID.
    When:
     - dome9-compliance-remediation-delete called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import compliance_remediation_delete_command

    mock_response = ""
    remediation_id = "remediation_id"
    url = f"{BASE_URL}ComplianceRemediation/{remediation_id}"

    requests_mock.delete(url=url, json=mock_response)
    args = {"remediation_id": remediation_id}
    result = compliance_remediation_delete_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.ComplianceRemediation"


def test_compliance_ruleset_list_command(requests_mock, mock_client):
    """
    Scenario: Get compliance ruleset list.
    Given:
     - User has provided valid credentials.
    When:
     - dome9-compliance-ruleset-list-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import compliance_ruleset_list_command

    mock_response = load_mock_response("compliance_ruleset_list.json")
    url = f"{BASE_URL}Compliance/Ruleset/view"

    requests_mock.get(url=url, json=mock_response)
    result = compliance_ruleset_list_command(mock_client, {})

    assert result.outputs_prefix == "CheckPointDome9.ComplianceRuleset"
    assert len(result.outputs) == 2
    assert result.outputs[0]["id"] == "id"


def test_compliance_ruleset_rule_list_command(requests_mock, mock_client):
    """
    Scenario: Get compliance ruleset rule list.
    Given:
     - User has provided valid credentials.
     - Rule ID.
    When:
     - dome9-compliance-ruleset-rule-list-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import compliance_ruleset_rule_list_command

    mock_response = load_mock_response("compliance_ruleset_rule_list.json")
    rule_id = "rule_id"
    url = f"{BASE_URL}Compliance/Ruleset/{rule_id}"

    requests_mock.get(url=url, json=mock_response)
    result = compliance_ruleset_rule_list_command(mock_client, {"rule_id": rule_id})

    assert result.outputs_prefix == "CheckPointDome9.ComplianceRuleset.Rule"
    assert len(result.outputs) == 2
    assert result.outputs_key_field == "name"


def test_global_search_get_command(requests_mock, mock_client):
    """
    Scenario: Get global search list.
    Given:
     - User has provided valid credentials.
    When:
     - dome9-global-search-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import global_search_get_command

    mock_response = load_mock_response("global_search_get.json")
    url = f"{BASE_URL}GlobalSearch"

    requests_mock.get(url=url, json=mock_response)
    result = global_search_get_command(mock_client, {})

    assert result.outputs_prefix == "CheckPointDome9.GlobalSearch.Alert"
    assert len(result.outputs) == 0
    assert result.outputs_key_field == "id"


def test_cloud_accounts_list_command(requests_mock, mock_client):
    """
    Scenario: Get cloud accounts list.
    Given:
     - User has provided valid credentials.
     - Account ID.
    When:
     - dome9-cloud-accounts-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import cloud_accounts_list_command

    mock_response = load_mock_response("cloud_accounts_list.json")
    account_id = "account_id"
    url = f"{BASE_URL}CloudAccounts/{account_id}"

    requests_mock.get(url=url, json=mock_response)
    result = cloud_accounts_list_command(mock_client, {"account_id": account_id})

    assert result.outputs_prefix == "CheckPointDome9.CloudAccount"
    assert len(result.outputs) == 1
    assert result.outputs_key_field == "cloud_account_id"


def test_instance_list_command(requests_mock, mock_client):
    """
    Scenario: Get instance list.
    Given:
     - User has provided valid credentials.
     - Instance ID.
    When:
     - dome9-instance-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import instance_list_command

    mock_response = load_mock_response("instance_list.json")
    instance_id = "instance_id"
    url = f"{BASE_URL}cloudinstance/{instance_id}"

    requests_mock.get(url=url, json=mock_response)
    args = {"instance_id": instance_id, "page": "1", "page_size": "5"}

    result = instance_list_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.Instance"
    assert len(result.outputs) == 1
    assert result.outputs_key_field == "instance_id"


def test_organizational_unit_view_get_command(requests_mock, mock_client):
    """
    Scenario: Get organizational unit view.
    Given:
     - User has provided valid credentials.
     - Instance ID.
    When:
     - dome9-organizational-unit-view-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import organizational_unit_view_get_command

    mock_response = load_mock_response("organizational_unit_view_get.json")
    url = f"{BASE_URL}organizationalunit/view"

    requests_mock.get(url=url, json=mock_response)
    args = {}

    result = organizational_unit_view_get_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.OrganizationalUnitView"
    assert len(result.outputs) == 4
    assert result.outputs_key_field == "id"


def test_check_ip_list_security_group_attach_command(requests_mock, mock_client):
    """
    Scenario: Get AWS cloud accounts for a specific security group and region
            and check if there is an IP-list that attach to a security group.
    Given:
     - User has provided valid credentials.
     - Security group ID.
    When:
     - dome9-security-group-ip-list-details-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import check_ip_list_security_group_attach_command

    mock_response = load_mock_response("check_ip_list_security_group_attach.json")
    sg_id = "sg_id"
    url = f"{BASE_URL}CloudSecurityGroup/{sg_id}"

    requests_mock.get(url=url, json=mock_response)
    args = {"sg_id": sg_id}

    result = check_ip_list_security_group_attach_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.SecurityGroup"
    assert len(result.outputs) == 1
    assert result.outputs_key_field == "security_group_id"


def test_finding_get_command(requests_mock, mock_client):
    """
    Scenario: Get finding by ID.
    Given:
     - User has provided valid credentials.
     - Finding ID.
    When:
     - dome9-finding-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import finding_get_command

    mock_response = load_mock_response("finding_get.json")
    finding_id = "finding_id"
    url = f"{BASE_URL}Compliance/Finding/{finding_id}"

    requests_mock.get(url=url, json=mock_response)
    args = {"finding_id": finding_id}

    result = finding_get_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.Finding"
    assert len(result.outputs) == 44
    assert result.outputs_key_field == "id"


def test_findings_search_command(requests_mock, mock_client):
    """
    Scenario: Search findings by severity and region.
    Given:
     - User has provided valid credentials.
     - Findings severity and region.
    When:
     - dome9-findings-search called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import findings_search_command

    mock_response = load_mock_response("findings_search.json")
    url = f"{BASE_URL}Compliance/Finding/search"

    requests_mock.post(url=url, json=mock_response)
    args = {"severity": "severity", "region": "region"}

    result = findings_search_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.Finding"
    assert len(result.outputs) == 2
    assert result.outputs_key_field == "id"


def test_security_group_list_command(requests_mock, mock_client):
    """
    Scenario: Get security group list.
    Given:
     - User has provided valid credentials.
    When:
     - dome9-security-group-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import security_group_list_command

    mock_response = load_mock_response("security_group_list.json")
    url = f"{BASE_URL}AwsSecurityGroup"

    requests_mock.get(url=url, json=mock_response)
    args = {}

    result = security_group_list_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.SecurityGroup"
    assert len(result.outputs) == 2
    assert result.outputs_key_field == "security_group_id"


def test_security_group_protection_mode_update_command(requests_mock, mock_client):
    """
    Scenario: Change the protection mode for an AWS security group (FullManage or ReadOnly).
    Given:
     - User has provided valid credentials.
     - Security group ID and protection mode.
    When:
     - dome9-security-group-protection-mode-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import security_group_protection_mode_update_command

    mock_response = load_mock_response("security_group_protection_mode_update.json")
    sg_id = "sg_id"
    url = f"{BASE_URL}cloudsecuritygroup/{sg_id}/protection-mode"

    requests_mock.post(url=url, json=mock_response)
    args = {"protection_mode": "protection_mode", "sg_id": sg_id}

    result = security_group_protection_mode_update_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.SecurityGroup"
    assert len(result.outputs) == 1
    assert result.outputs_key_field == "security_group_id"


def test_security_group_service_update_command(requests_mock, mock_client):
    """
    Scenario: Update security group service.
    Given:
     - User has provided valid credentials.
     - Security group ID, policy type, port, protocol type and service name.
    When:
     - dome9-security-group-service-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import security_group_service_update_command

    mock_response = load_mock_response("security_group_service_create_update.json")
    sg_id = "sg_id"
    policy_type = "policy_type"
    url = f"{BASE_URL}cloudsecuritygroup/{sg_id}/services/{policy_type}"

    requests_mock.put(url=url, json=mock_response)
    args = {
        "sg_id": sg_id,
        "policy_type": "policy_type",
        "port": "5",
        "protocol_type": "protocol_type",
        "service_name": "service_name",
    }

    result = security_group_service_update_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.SecurityGroup.Service"
    assert len(result.outputs) == 10
    assert result.outputs_key_field == "id"


def test_security_group_service_create_command(requests_mock, mock_client):
    """
    Scenario: Create security group service.
    Given:
     - User has provided valid credentials.
     - Security group ID, policy type, port, protocol type and service name.
    When:
     - dome9-security-group-service-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import security_group_service_create_command

    mock_response = load_mock_response("security_group_service_create_update.json")
    sg_id = "sg_id"
    policy_type = "policy_type"
    url = f"{BASE_URL}cloudsecuritygroup/{sg_id}/services/{policy_type}"

    requests_mock.post(url=url, json=mock_response)
    args = {
        "sg_id": sg_id,
        "policy_type": "policy_type",
        "port": "5",
        "protocol_type": "protocol_type",
        "service_name": "service_name",
    }

    result = security_group_service_create_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.SecurityGroup.Service"
    assert len(result.outputs) == 10
    assert result.outputs_key_field == "id"


def test_security_group_service_delete_command(requests_mock, mock_client):
    """
    Scenario: Delete security group service.
    Given:
     - User has provided valid credentials.
     - Security group ID and service ID.
    When:
     - dome9-security-group-service-delete called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import security_group_service_delete_command

    mock_response = ""
    sg_id = "sg_id"
    service_id = "service_id"
    url = f"{BASE_URL}cloudsecuritygroup/{sg_id}/services/Inbound/{service_id}"

    requests_mock.delete(url=url, json=mock_response)
    args = {"sg_id": sg_id, "service_id": service_id}

    result = security_group_service_delete_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.SecurityGroup.Service"
    assert result.outputs_key_field == "id"


def test_security_group_tags_update_command(requests_mock, mock_client):
    """
    Scenario: Create and update security group tags.
    Given:
     - User has provided valid credentials.
     - Security group ID, key and value.
    When:
     - dome9-security-group-tags-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import security_group_tags_update_command

    mock_response = load_mock_response("security_group_tags.json")
    sg_id = "sg_id"
    url = f"{BASE_URL}cloudsecuritygroup/{sg_id}/tags"

    requests_mock.post(url=url, json=mock_response)
    args = {"sg_id": sg_id, "key": "key", "value": "value"}

    result = security_group_tags_update_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.SecurityGroup.Tag"
    assert len(result.outputs) == 2
    assert result.outputs_key_field == "key"


def test_security_group_instance_attach_command(requests_mock, mock_client):
    """
    Scenario: Attach security Group to an AWS EC2 Instance.
    Given:
     - User has provided valid credentials.
     - Instance ID, security group ID and nic name.
    When:
     - dome9-security-group-instance-attach called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import security_group_instance_attach_command

    mock_response = load_mock_response("security_group_attach_detach.json")
    instance_id = "instance_id"
    url = f"{BASE_URL}cloudinstance/{instance_id}/sec-groups"

    requests_mock.post(url=url, json=mock_response)
    args = {"sg_id": "sg_id", "instance_id": instance_id, "nic_name": "nic_name"}

    result = security_group_instance_attach_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.Instance"
    assert result.outputs_key_field == "id"


def test_security_group_instance_detach_command(requests_mock, mock_client):
    """
    Scenario: Detach security Group to an AWS EC2 Instance.
    Given:
     - User has provided valid credentials.
     - Instance ID, security group ID and nic name.
    When:
     - dome9-security-group-instance-detach called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """

    from CheckPointDome9 import security_group_instance_detach_command

    mock_response = load_mock_response("security_group_attach_detach.json")
    instance_id = "instance_id"
    url = f"{BASE_URL}cloudinstance/{instance_id}/sec-groups"

    requests_mock.delete(url=url, json=mock_response)
    args = {"sg_id": "sg_id", "instance_id": instance_id, "nic_name": "nic_name"}

    result = security_group_instance_detach_command(mock_client, args)

    assert result.outputs_prefix == "CheckPointDome9.Instance"
    assert result.outputs_key_field == "id"


@pytest.mark.parametrize("page_size, page, limit", [(-1, 0, 10), (5, -1, 5), (5, 5, -1)])
def test_validate_pagination_arguments(page_size, page, limit):
    """
    Given:
     - invalid values of page_size, page and limit

    When:
     - executing validate_pagination_arguments function

    Then:
     - Ensure that ValueError is raised
    """

    from CheckPointDome9 import validate_pagination_arguments

    with pytest.raises(ValueError):
        validate_pagination_arguments(page=page, page_size=page_size, limit=limit)


def test_attach_comment_to_ip_no_description():
    """
    Given:
     - no ip list and no description

    When:
     - executing attach_comment_to_ip function

    Then:
     - Ensure that ValueError is raised
    """
    from CheckPointDome9 import attach_comment_to_ip

    with pytest.raises(ValueError):
        attach_comment_to_ip(ip_list=[], comment_list=[])