Code42

Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.

Endpoint · Code42

Details

IDCode42
ProviderPermira
CategoryEndpoint
From Version5.0.0
Docker Imagedemisto/py42:1.0.0.10758190
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.

Configure Code42 in Cortex

Parameter Required
Code42 Console URL for your Code42 environment True
API Client ID True
API Client Secret True
Fetch incidents False
Incident type False
Alert severities to fetch when fetching incidents False
First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes) False
Alerts to fetch per run; note that increasing this value may result in slow performance if too many results are returned at once False
Include the list of files in returned incidents. False
Incidents Fetch Interval False
Use v2 file events False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

code42-file-events-search

Search for Code42 Incydr File Events

Base Command

code42-file-events-search

Input

Argument Name Description Required
add-to-context Add results to context at ‘Code42.FileEvents’. If ‘false’, the search will only display results as a markdown table. Optional
json Raw JSON file event query to be used for search. Optional
results The number of file events to return. Defaults to 50. Default is 50. Optional
min_risk_score Filter results by minimum risk score. Default is 1. Optional
hash MD5 or SHA256 hash of the file to search for. Optional
username Username to search for. Optional
hostname Hostname to search for. Optional

Context Output

Path Type Description
Code42.FileEvents.timestamp date The timestamp when the event occurred.
Code42.FileEvents.event unknown Summary information about the event, including date observed, event type, and event source.
Code42.FileEvents.user unknown Details about the user associated with the event (if any).
Code42.FileEvents.destination unknown Details about the destination target of the event (if any).
Code42.FileEvents.process unknown Details about the CPU process involved in the event (if any).
Code42.FileEvents.risk unknown Details overall risk severity for the event and lists all associated risk indicators.
Code42.FileEvents.git unknown Details about git repository involved in event (if any).
Code42.FileEvents.report unknown Details about Salesforce reports involved in the event (if any).
Code42.FileEvents.file unknown Details about file metadata for file involved in the event (if any).
Code42.FileEvents.source unknown Info about the origin of a file involved in the event (if any).

code42-alert-get

Retrieve alert details by alert ID

Base Command

code42-alert-get

Input

Argument Name Description Required
id The alert ID to retrieve. Alert IDs are associated with alerts that are fetched via fetch-incidents. Required

Context Output

Path Type Description
Code42.SecurityAlert.Username string The username associated with the alert.
Code42.SecurityAlert.Occurred date The timestamp when the alert occurred.
Code42.SecurityAlert.Description string The description of the alert.
Code42.SecurityAlert.ID string The alert ID.
Code42.SecurityAlert.Name string The alert rule name that generated the alert.
Code42.SecurityAlert.State string The alert state.
Code42.SecurityAlert.Severity string The severity of the alert.

code42-alert-update

Updates a Code42 Alert Session

Base Command

code42-alert-update

Input

Argument Name Description Required
id The alert ID to update. Alert IDs are associated with alerts that are fetched via fetch-incidents. Required
state The state to which the session will be updated. Permissible values are OPEN, CLOSED_TP, or CLOSED_FP Required

Context Output

Path Type Description
Code42.SecurityAlert.ID string The alert ID of the resolved alert.

code42-alert-resolve

DEPRECATED. Use code42-alert-update instead.

Base Command

code42-alert-resolve

Input

Argument Name Description Required
id The alert ID to resolve. Alert IDs are associated with alerts that are fetched via fetch-incidents. Required

Context Output

Path Type Description
Code42.SecurityAlert.ID string The alert ID of the resolved alert.

code42-user-create

Creates a Code42 user.

Base Command

code42-user-create

Input

Argument Name Description Required
orgname The name of the Code42 organization from which to add the user. Required
username The username to give to the user. Required
email The email of the user to create. Default is The email to give to the user.. Required

Context Output

Path Type Description
Code42.User.Username String A username for a Code42 user.
Code42.User.Email String An email for a Code42 user.
Code42.User.UserID String An ID for a Code42 user.

code42-user-block

Blocks a user in Code42. A blocked user is not allowed to log in or restore files. Backups will continue if the user is still active.

Base Command

code42-user-block

Input

Argument Name Description Required
username The username of the user to block. Required

Context Output

Path Type Description
Code42.User.UserID String An ID for a Code42 user.

code42-user-deactivate

Deactivate a user in Code42; signing them out of their devices. Backups discontinue for a deactivated user, and their archives go to cold storage.

Base Command

code42-user-deactivate

Input

Argument Name Description Required
username The username of the user to deactivate. Required

Context Output

Path Type Description
Code42.User.UserID String The ID of a Code42 User.

code42-user-unblock

Removes a block, if one exists, on the user with the given user ID. Unblocked users are allowed to log in and restore.

Base Command

code42-user-unblock

Input

Argument Name Description Required
username The username of the user to unblock. Required

Context Output

Path Type Description
Code42.User.UserID String An ID for a Code42 user.

code42-user-reactivate

Reactivates the user with the given username.

Base Command

code42-user-reactivate

Input

Argument Name Description Required
username The username of the user to reactivate. Required

Context Output

Path Type Description
Code42.User.UserID String The ID of a Code42 User.

code42-legalhold-add-user

Adds a Code42 user to a legal hold matter.

Base Command

code42-legalhold-add-user

Input

Argument Name Description Required
username The username of the user to add to the given legal hold matter. Required
mattername The name of the legal hold matter to which the user will be added. Required

Context Output

Path Type Description
Code42.LegalHold.UserID Unknown The ID of a Code42 user.
Code42.LegalHold.MatterID String The ID of a Code42 legal hold matter.
Code42.LegalHold.Username String A username for a Code42 user.
Code42.LegalHold.MatterName String A name for a Code42 legal hold matter.

code42-legalhold-remove-user

Removes a Code42 user from a legal hold matter.

Base Command

code42-legalhold-remove-user

Input

Argument Name Description Required
username The username of the user to release from the given legal hold matter. Required
mattername The name of the legal hold matter from which the user will be released. Required

Context Output

Path Type Description
Code42.LegalHold.UserID Unknown The ID of a Code42 user.
Code42.LegalHold.MatterID String The ID of a Code42 legal hold matter.
Code42.LegalHold.Username String A username for a Code42 user.
Code42.LegalHold.MatterName String A name for a Code42 legal hold matter.

code42-download-file

Downloads a file from Code42.

Base Command

code42-download-file

Input

Argument Name Description Required
hash Either the SHA256 or MD5 hash of the file. Required
filename The filename to save the file as. Optional

Context Output

Path Type Description
File.Size Number The size of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Name String The name of the file.
File.SSDeep String The SSDeep hash of the file.
File.EntryID String The entry ID of the file.
File.Info String File information.
File.Type String The file type.
File.MD5 String The MD5 hash of the file.
File.Extension String The file extension.

code42-download-file-by-xfc-id

Downloads a file from Incydr using the XFC ID.

Base Command

code42-download-file-by-xfc-id

Input

Argument Name Description Required
xfc_id The XFC Event ID of the file to download. Required
filename The filename to save the file as. Optional

Context Output

Path Type Description
File.Size Number The size of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Name String The name of the file.
File.SSDeep String The SSDeep hash of the file.
File.EntryID String The entry ID of the file.
File.Info String File information.
File.Type String The file type.
File.MD5 String The MD5 hash of the file.
File.Extension String The file extension.

code42-watchlists-list

List all existing watchlists in your environment.

Base Command

code42-watchlists-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
Code42.Watchlists.ListType string The Type of Watchlist.
Code42.Watchlists.Id string The ID of the Watchlist.
Code42.Watchlists.IncludedUserCount integer The count of included users on the Watchlist.

code42-watchlists-add-user

Add a user to a watchlist.

Base Command

code42-watchlists-add-user

Input

Argument Name Description Required
username Email id of the user to add to Watchlist. Required
watchlist WatchlistID or WatchlistType to add user to. Required

Context Output

Path Type Description
Code42.UsersAddedToWatchlists.Watchlist string The ID/Type of the watchlist user was added to.
Code42.UsersAddedToWatchlists.Username string The username added to watchlist.
Code42.UsersAddedToWatchlists.Success boolean If the user was added successfully.

code42-watchlists-remove-user

Remove a user from a watchlist.

Base Command

code42-watchlists-remove-user

Input

Argument Name Description Required
username Email id of the user to add to Watchlist. Required
watchlist WatchlistID or WatchlistType to remove user from. Required

Context Output

Path Type Description
Code42.UsersRemovedFromWatchlists.Watchlist string The ID/Type of the watchlist user was removed from.
Code42.UsersRemovedFromWatchlists.Username string The username removed from watchlist.
Code42.UsersRemovedFromWatchlists.Success boolean If the user was removed successfully.

code42-watchlists-list-included-users

List all users who have been explicitly added to a given watchlist.

Base Command

code42-watchlists-list-included-users

Input

Argument Name Description Required
watchlist The WatchlistID or WatchlistType to get a list of included users for. Required

Context Output

Path Type Description
Code42.WatchlistUsers.WatchlistID string The ID of the Watchlist.
Code42.WatchlistUsers.Username string The username on the watchlist.
Code42.WatchlistUsers.AddedTime datetime The datetime the user was added to the watchlist.

code42-get-user-risk-profile

Get the risk profile details for a given user.

Base Command

code42-user-get-risk-profile

Input

Argument Name Description Required
username The user to get risk profile for. Required

Context Output

Path Type Description
Code42.UserRiskProfiles.Username string The username.
Code42.UserRiskProfiles.StartDate date The startDate value of the UserRiskProfile.
Code42.UserRiskProfiles.EndDate date The startDate value of the UserRiskProfile.
Code42.UserRiskProfiles.Notes string The notes value of the UserRiskProfile.

code42-user-update-risk-profile

Update a user’s risk profile.

Base Command

code42-user-update-risk-profile

Input

Argument Name Description Required
username The user to update. Required
start_date The user’s start date (useful for New Employee Watchlist). Optional
end_date The user’s end date (useful for Departing Employee Watchlist). Optional
notes Risk profile notes. Optional

Context Output

Path Type Description
Code42.UpdatedUserRiskProfiles.Username string The user that was updated.
Code42.UpdatedUserRiskProfiles.StartDate date The startDate value of the UserRiskProfile after the update.
Code42.UpdatedUserRiskProfiles.EndDate date The startDate value of the UserRiskProfile after the update.
Code42.UpdatedUserRiskProfiles.Notes string The notes value of the UserRiskProfile after the update.
Code42.UpdatedUserRiskProfiles.Success boolean If the risk profile update was successful.

code42-file-events-table

Render Code42 file events from the context as a markdown table

Base Command

code42-file-events-table

Input

Argument Name Description Required
include Select which events to include in the table.
- ‘incident’ only displays the events that originally triggered the Code42 Alert.
- ‘searches’ only displays events that have been added to the context from ‘code42-file-events-search’ commands.
- ‘all’ will include all events in the table.
. Possible values are: all, incident, searches. Default is all.		 Optional

Context Output

There is no context output for this command.

Configuration parameters

  • console_url — Code42 Console URL for your Code42 environment
  • api_url — API Gateway URL for your Code42 environment (required)
  • credentials — API Client ID (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • alert_severity — Alert severities to fetch when fetching incidents
  • fetch_time — First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
  • fetch_limit — Alerts to fetch per run; note that increasing this value may result in slow performance if too many results are returned at once
  • include_files — Include the list of files in returned incidents.
  • incidentFetchInterval — Incidents Fetch Interval

Commands (20)

  • code42-alert-get

    Retrieve alert details by alert ID.

  • code42-alert-resolve Deprecated

    DEPRECATED. Use code42-alert-update instead.

  • code42-alert-update

    Changes the state of an Incydr alert session.

  • code42-download-file

    Downloads a file from Code42.

  • code42-download-file-by-xfc-id

    Downloads a file from Incydr using the XFC Event ID.

  • code42-file-events-search

    Search for Code42 Incydr File Events.

  • code42-file-events-table

    Render Code42 file events from the context as a markdown table.

  • code42-legalhold-add-user

    Adds a Code42 user to a legal hold matter.

  • code42-legalhold-remove-user

    Removes a Code42 user from a legal hold matter.

  • code42-user-block Deprecated

    DEPRECATED. Use the Incydr console to block users.

  • code42-user-create Deprecated

    DEPRECATED. Use the Incydr console to create users.

  • code42-user-deactivate

    Deactivate a user in Code42; signing them out of their devices. Backups discontinue for a deactivated user, and their archives go to cold storage.

  • code42-user-get-risk-profile

    Get the risk profile details for a given user.

  • code42-user-reactivate

    Reactivates the user with the given username.

  • code42-user-unblock Deprecated

    DEPRECATED. Use the Incydr console to unblock users.

  • code42-user-update-risk-profile

    Update a user's risk profile.

  • code42-watchlists-add-user

    Add a user to a watchlist.

  • code42-watchlists-list

    List all existing watchlists in your environment.

  • code42-watchlists-list-included-users

    List all users who have been explicitly added to a given watchlist.

  • code42-watchlists-remove-user

    Remove a user from a watchlist.

Source

Code42.py Code42_test.py Code42.yml Code42_description.md command_examples.txt
Download History Raw 
category: Endpoint
provider: Permira
commonfields:
  id: Code42
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: console.us.code42.com
  display: Code42 Console URL for your Code42 environment
  name: console_url
  required: false
  type: 0
  section: Connect
  hidden: true
- defaultvalue: api.us.code42.com
  display: API Gateway URL for your Code42 environment
  name: api_url
  required: true
  type: 0
  section: Connect
- display: API Client ID
  name: credentials
  required: true
  type: 9
  displaypassword: API Client Secret
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Alert severities to fetch when fetching incidents
  name: alert_severity
  options:
  - Critical
  - High
  - Moderate
  - Low
  type: 16
  required: false
  section: Collect
- defaultvalue: 24 hours
  display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
  name: fetch_time
  type: 0
  required: false
  section: Collect
- defaultvalue: '5'
  display: Alerts to fetch per run; note that increasing this value may result in slow performance if too many results are returned at once
  name: fetch_limit
  type: 0
  required: false
  section: Collect
- defaultvalue: 'false'
  display: Include the list of files in returned incidents.
  name: include_files
  type: 8
  required: false
  section: Collect
- name: incidentFetchInterval
  display: Incidents Fetch Interval
  defaultvalue: '3'
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
description: Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.
display: Code42
name: Code42
script:
  commands:
  - arguments:
    - description: Add results to context at 'Code42.FileEvents'. If 'false', the search will only display results as a markdown table.
      name: add-to-context
      defaultValue: false
    - description: Raw JSON file event query to be used for search.
      name: json
    - description: The number of file events to return. Defaults to 50.
      name: results
      defaultValue: 50
    - defaultValue: "1"
      description: Filter results by minimum risk score.
      name: min_risk_score
    - description: MD5 or SHA256 hash of the file to search for.
      name: hash
    - description: Username to search for.
      name: username
    - description: Hostname to search for.
      name: hostname
    description: Search for Code42 Incydr File Events.
    name: code42-file-events-search
    outputs:
    - contextPath: Code42.FileEvents.timestamp
      description: The timestamp when the event occurred.
      type: date
    - contextPath: Code42.FileEvents.event
      description: Summary information about the event, including date observed, event type, and event source.
    - contextPath: Code42.FileEvents.user
      description: Details about the user associated with the event (if any).
    - contextPath: Code42.FileEvents.destination
      description: Details about the destination target of the event (if any).
    - contextPath: Code42.FileEvents.process
      description: Details about the CPU process involved in the event (if any).
    - contextPath: Code42.FileEvents.risk
      description: Details overall risk severity for the event and lists all associated risk indicators.
    - contextPath: Code42.FileEvents.git
      description: Details about git repository involved in event (if any).
    - contextPath: Code42.FileEvents.report
      description: Details about Salesforce reports involved in the event (if any).
    - contextPath: Code42.FileEvents.file
      description: Details about file metadata for file involved in the event (if any).
    - contextPath: Code42.FileEvents.source
      description: Info about the origin of a file involved in the event (if any).
  - arguments:
    - description: The alert session ID to retrieve. Alert IDs are associated with alerts that are fetched via fetch-incidents.
      name: id
      required: true
    description: Retrieve alert details by alert ID.
    name: code42-alert-get
    outputs:
    - contextPath: Code42.SecurityAlert.Username
      description: The username associated with the alert.
      type: string
    - contextPath: Code42.SecurityAlert.Occurred
      description: The timestamp when the session began.
      type: date
    - contextPath: Code42.SecurityAlert.Description
      description: The rule names of the alerts included in the session.
      type: string
    - contextPath: Code42.SecurityAlert.ID
      description: The alert session ID.
      type: string
    - contextPath: Code42.SecurityAlert.Name
      description: The description of the events that comprise the session.
      type: string
    - contextPath: Code42.SecurityAlert.State
      description: The alert session state.
      type: string
    - contextPath: Code42.SecurityAlert.Severity
      description: The severity of the alerts in the session.
      type: string
  - arguments:
    - description: The alert session ID to resolve. Alert session IDs are associated with alerts that are fetched via fetch-incidents.
      name: id
      required: true
    - description: The desired state for the alert session. Possible states are OPEN, CLOSED_TP (true positive), CLOSED_FP (false positive), and CLOSED_TP_BENIGN (benign).
      name: state
      auto: PREDEFINED
      predefined:
      - OPEN
      - CLOSED_TP
      - CLOSED_FP
      - CLOSED_TP_BENIGN
      required: true
    description: Changes the state of an Incydr alert session.
    name: code42-alert-update
    outputs:
    - contextPath: Code42.SecurityAlert.ID
      description: The alert ID of the resolved alert.
      type: string
  - arguments:
    - description: The alert session ID to resolve. Alert session IDs are associated with alerts that are fetched via fetch-incidents.
      name: id
      required: true
    description: DEPRECATED. Use code42-alert-update instead.
    deprecated: true
    name: code42-alert-resolve
    outputs:
    - contextPath: Code42.SecurityAlert.ID
      description: The alert ID of the resolved alert.
      type: string
  - arguments:
    - description: The name of the Code42 organization from which to add the user.
      name: orgname
      required: true
    - description: The username to give to the user.
      name: username
      required: true
    - defaultValue: The email to give to the user.
      description: The email of the user to create.
      name: email
      required: true
    deprecated: true
    description: DEPRECATED. Use the Incydr console to create users.
    name: code42-user-create
    outputs:
    - contextPath: Code42.User.Username
      description: A username for a Code42 user.
      type: String
    - contextPath: Code42.User.Email
      description: An email for a Code42 user.
      type: String
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - description: The username of the user to block.
      name: username
      required: true
    deprecated: true
    description: DEPRECATED. Use the Incydr console to block users.
    name: code42-user-block
    outputs:
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - description: The username of the user to deactivate.
      name: username
      required: true
    description: Deactivate a user in Code42; signing them out of their devices. Backups discontinue for a deactivated user, and their archives go to cold storage.
    name: code42-user-deactivate
    outputs:
    - contextPath: Code42.User.UserID
      description: The ID of a Code42 User.
      type: String
  - arguments:
    - description: The username of the user to unblock.
      name: username
      required: true
    deprecated: true
    description: DEPRECATED. Use the Incydr console to unblock users.
    name: code42-user-unblock
    outputs:
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - description: The username of the user to reactivate.
      name: username
      required: true
    description: Reactivates the user with the given username.
    name: code42-user-reactivate
    outputs:
    - contextPath: Code42.User.UserID
      description: The ID of a Code42 User.
      type: String
  - arguments:
    - description: The username of the user to add to the given legal hold matter.
      name: username
      required: true
    - description: The name of the legal hold matter to which the user will be added.
      name: mattername
      required: true
    description: Adds a Code42 user to a legal hold matter.
    name: code42-legalhold-add-user
    outputs:
    - contextPath: Code42.LegalHold.UserID
      description: The ID of a Code42 user.
      type: Unknown
    - contextPath: Code42.LegalHold.MatterID
      description: The ID of a Code42 legal hold matter.
      type: String
    - contextPath: Code42.LegalHold.Username
      description: A username for a Code42 user.
      type: String
    - contextPath: Code42.LegalHold.MatterName
      description: A name for a Code42 legal hold matter.
      type: String
  - arguments:
    - description: The username of the user to release from the given legal hold matter.
      name: username
      required: true
    - description: The name of the legal hold matter from which the user will be released.
      name: mattername
      required: true
    description: Removes a Code42 user from a legal hold matter.
    name: code42-legalhold-remove-user
    outputs:
    - contextPath: Code42.LegalHold.UserID
      description: The ID of a Code42 user.
      type: Unknown
    - contextPath: Code42.LegalHold.MatterID
      description: The ID of a Code42 legal hold matter.
      type: String
    - contextPath: Code42.LegalHold.Username
      description: A username for a Code42 user.
      type: String
    - contextPath: Code42.LegalHold.MatterName
      description: A name for a Code42 legal hold matter.
      type: String
  - arguments:
    - description: Either the SHA256 or MD5 hash of the file.
      name: hash
      required: true
    - description: The filename to save the file as.
      name: filename
    description: Downloads a file from Code42.
    name: code42-download-file
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  - name: code42-download-file-by-xfc-id
    description: Downloads a file from Incydr using the XFC Event ID.
    arguments:
    - description: The XFC Event ID of the file to download.
      name: xfc_id
      required: true
    - description: The filename to save the file as.
      name: filename
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  - name: code42-watchlists-list
    description: List all existing watchlists in your environment.
    outputs:
    - contextPath: Code42.Watchlists.ListType
      description: The Type of Watchlist.
      type: string
    - contextPath: Code42.Watchlists.Id
      description: The ID of the Watchlist.
      type: string
    - contextPath: Code42.Watchlists.IncludedUserCount
      description: The count of included users on the Watchlist.
      type: integer
  - name: code42-watchlists-add-user
    description: Add a user to a watchlist.
    arguments:
    - name: username
      required: true
      description: Email id of the user to add to Watchlist.
    - name: watchlist
      required: true
      description: WatchlistID or WatchlistType to add user to.
    outputs:
    - contextPath: Code42.UsersAddedToWatchlists.Watchlist
      description: The ID/Type of the watchlist user was added to.
      type: string
    - contextPath: Code42.UsersAddedToWatchlists.Username
      description: The username added to watchlist.
      type: string
    - contextPath: Code42.UsersAddedToWatchlists.Success
      description: If the user was added successfully.
      type: boolean
    compliantpolicies:
    - User Soft Remediation
  - name: code42-watchlists-remove-user
    description: Remove a user from a watchlist.
    arguments:
    - name: username
      description: Email id of the user to add to Watchlist.
      required: true
    - name: watchlist
      required: true
      description: WatchlistID or WatchlistType to remove user from.
    outputs:
    - contextPath: Code42.UsersRemovedFromWatchlists.Watchlist
      description: The ID/Type of the watchlist user was removed from.
      type: string
    - contextPath: Code42.UsersRemovedFromWatchlists.Username
      description: The username removed from watchlist.
      type: string
    - contextPath: Code42.UsersRemovedFromWatchlists.Success
      description: If the user was removed successfully.
      type: boolean
  - name: code42-watchlists-list-included-users
    description: List all users who have been explicitly added to a given watchlist.
    arguments:
    - name: watchlist
      description: The WatchlistID or WatchlistType to get a list of included users for.
      required: true
    outputs:
    - contextPath: Code42.WatchlistUsers.WatchlistID
      description: The ID of the Watchlist.
      type: string
    - contextPath: Code42.WatchlistUsers.Username
      description: The username on the watchlist.
      type: string
    - contextPath: Code42.WatchlistUsers.AddedTime
      description: The datetime the user was added to the watchlist.
      type: datetime
  - name: code42-user-get-risk-profile
    description: Get the risk profile details for a given user.
    arguments:
    - name: username
      description: The user to get risk profile for.
      required: true
    outputs:
    - contextPath: Code42.UserRiskProfiles.Username
      description: The username.
      type: string
    - contextPath: Code42.UserRiskProfiles.StartDate
      description: The startDate value of the UserRiskProfile.
      type: date
    - contextPath: Code42.UserRiskProfiles.EndDate
      description: The startDate value of the UserRiskProfile.
      type: date
    - contextPath: Code42.UserRiskProfiles.Notes
      description: The notes value of the UserRiskProfile.
      type: string
  - name: code42-user-update-risk-profile
    description: Update a user's risk profile.
    arguments:
    - name: username
      description: The user to update.
      required: true
    - name: start_date
      description: The user's start date (useful for New Employee Watchlist).
    - name: end_date
      description: The user's end date (useful for Departing Employee Watchlist).
    - name: notes
      description: Risk profile notes.
    outputs:
    - contextPath: Code42.UpdatedUserRiskProfiles.Username
      description: The user that was updated.
      type: string
    - contextPath: Code42.UpdatedUserRiskProfiles.StartDate
      description: The startDate value of the UserRiskProfile after the update.
      type: date
    - contextPath: Code42.UpdatedUserRiskProfiles.EndDate
      description: The startDate value of the UserRiskProfile after the update.
      type: date
    - contextPath: Code42.UpdatedUserRiskProfiles.Notes
      description: The notes value of the UserRiskProfile after the update.
      type: string
    - contextPath: Code42.UpdatedUserRiskProfiles.Success
      description: If the risk profile update was successful.
      type: boolean
    compliantpolicies:
    - User Soft Remediation
  - name: code42-file-events-table
    description: Render Code42 file events from the context as a markdown table.
    arguments:
    - name: include
      description: |
        Select which events to include in the table.
        - 'incident' only displays the events that originally triggered the Code42 Alert.
        - 'searches' only displays events that have been added to the context from 'code42-file-events-search' commands.
        - 'all' will include all events in the table.
      defaultValue: all
      predefined:
      - all
      - incident
      - searches
  dockerimage: demisto/py42:1.0.0.10758190
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
defaultclassifier: Code42 - Classifier
defaultmapperin: Code42 - Mapping
tests:
- No tests (auto formatted)