CyberArkEPMSOCResponse

Details

ID	`CyberArkEPMSOCResponse`
Provider	CyberArk
Category	Endpoint
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR

README

Use the CyberArk EPM integration to activate and deactivate CyberArk EPM risk plans for specific endpoints.
This integration was integrated and tested with the CyberArk EPM API.

Configure CyberArk EPM SOC Response in Cortex

Parameter	Description	Required
EPM Region-based tenant URL	The tenant URL for EPM region (e.g., https://api-na.epm.cyberark.cloud).	True
Identity URL	The CyberArk Identity FQDN for OAuth2 authentication (e.g., https://abc1234.id.cyberark.cloud).	True
Web App ID	The Application ID of the OAuth2 Server web app configured in Identity Administration.	True
Client ID	Service username (configured as OAuth confidential client).	True
Client Secret	Service user password for OAuth2 authentication.	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberarkepm-activate-risk-plan

Activates a CyberArk EPM risk plan for a specified endpoint.

Base Command

cyberarkepm-activate-risk-plan

Input

Argument Name	Description	Required
risk_plan	The name of the risk plan to activate.	Required
endpoint_name	The name of the endpoint to target.	Required
logged_in_user	The logged-in username of the endpoint.	Optional
external_ip	(Deprecated) The external IP address of the endpoint. This argument is deprecated and no longer used.	Optional

Context Output

Path	Type	Description
CyberArkEPMSOCResponse.SetID	String	The ID of the EPM set in which the endpoints were found.
CyberArkEPMSOCResponse.EndpointIDs	String	The IDs of the endpoints added to the risk plan.
CyberArkEPMSOCResponse.RiskPlan	String	The name of activated risk plan.
CyberArkEPMSOCResponse.Action	String	The action performed on the risk plan (add/remove).
CyberArkEPMSOCResponse.GroupActionPerformed	Boolean	Whether the endpoint was successfully added to the risk plan group in this set.

cyberarkepm-deactivate-risk-plan

Deactivates a CyberArk EPM risk plan for a specified endpoint.

Base Command

cyberarkepm-deactivate-risk-plan

Input

Argument Name	Description	Required
risk_plan	The name of the risk plan to deactivate.	Required
endpoint_name	The name of the endpoint to target.	Required
logged_in_user	The logged-in username of the endpoint.	Optional
external_ip	(Deprecated) The external IP address of the endpoint. This argument is deprecated and no longer used.	Optional

Context Output

Path	Type	Description
CyberArkEPMSOCResponse.SetID	String	The ID of the EPM set in which the endpoints were found.
CyberArkEPMSOCResponse.EndpointIDs	String	The IDs of the endpoints removed from the risk plan.
CyberArkEPMSOCResponse.RiskPlan	String	The name of the deactivated risk plan.
CyberArkEPMSOCResponse.Action	String	The action performed on the risk plan (add/remove).
CyberArkEPMSOCResponse.GroupActionPerformed	Boolean	Whether the endpoint was successfully removed from the risk plan group in this set.

Configuration parameters

url — EPM Region-based tenant URL (required)
identity_url — Identity URL (required)
web_app_id — Web App ID (required)
client_id — Client ID (required)
credentials — Client Secret (Service User Password) (required)
application_id — Application ID

Commands (2)

cyberarkepm-activate-risk-plan
Activates a CyberArk EPM risk plan for a specified endpoint.
cyberarkepm-deactivate-risk-plan
Deactivates a CyberArk EPM risk plan for a specified endpoint.

Source

CyberArkEPMSOCResponse.py CyberArkEPMSOCResponse_test.py CyberArkEPMSOCResponse.yml CyberArkEPMSOCResponse_description.md command_examples.txt

Download History Raw

category: Endpoint
provider: CyberArk
sectionorder:
- Connect
commonfields:
  id: CyberArkEPMSOCResponse
  version: -1
configuration:
- name: url
  display: EPM Region-based tenant URL
  required: true
  type: 0
  section: Connect
  additionalinfo: The tenant URL for EPM region (e.g., https://api-na.epm.cyberark.cloud).
- name: identity_url
  display: Identity URL
  required: true
  type: 0
  section: Connect
  defaultvalue: "identity_url"
  additionalinfo: The CyberArk Identity FQDN for OAuth2 authentication (e.g., https://abc1234.id.cyberark.cloud).
- name: web_app_id
  display: Web App ID
  required: true
  type: 0
  section: Connect
  defaultvalue: "my_web_app"
  additionalinfo: The Application ID of the OAuth2 Server web app configured in Identity Administration.
- name: client_id
  display: Client ID
  required: true
  type: 0
  section: Connect
  defaultvalue: "client_id"
  additionalinfo: Service username (configured as OAuth confidential client).
- name: credentials
  display: Client Secret (Service User Password)
  displaypassword: Client Secret
  required: true
  type: 9
  section: Connect
  hiddenusername: true
  additionalinfo: Service user password for OAuth2 authentication.
- name: application_id
  display: Application ID
  required: false
  type: 0
  section: Connect
  additionalinfo: (Deprecated) Required for local(EPM) authentication only. This parameter is deprecated and no longer used.
  advanced: true
description: Use the CyberArk EPM integration to activate and deactivate CyberArk EPM risk plans for specific endpoints.
display: CyberArk EPM SOC Response
name: CyberArkEPMSOCResponse
script:
  commands:
  - arguments:
    - description: The name of the risk plan to activate.
      name: risk_plan
      required: true
    - description: The name of the endpoint to target.
      name: endpoint_name
      required: true
    - description: Logged in user name.
      name: logged_in_user
      required: false
    - description: (Deprecated) The external IP address of the endpoint. This argument is deprecated and no longer used.
      name: external_ip
      required: false
      deprecated: true
    description: Activates a CyberArk EPM risk plan for a specified endpoint.
    name: cyberarkepm-activate-risk-plan
    outputs:
    - contextPath: CyberArkEPMSOCResponse.SetID
      description: The ID of the EPM set in which the endpoints were found.
      type: String
    - contextPath: CyberArkEPMSOCResponse.EndpointIDs
      description: The IDs of the endpoints added to the risk plan.
      type: String
    - contextPath: CyberArkEPMSOCResponse.RiskPlan
      description: The name of activated risk plan.
      type: String
    - contextPath: CyberArkEPMSOCResponse.Action
      description: The action performed on the risk plan (add/remove).
      type: String
    - contextPath: CyberArkEPMSOCResponse.GroupActionPerformed
      description: Whether the endpoint was successfully added to the risk plan group in this set.
      type: Boolean
  - arguments:
    - description: The name of the risk plan to deactivate.
      name: risk_plan
      required: true
    - description: The name of the endpoint to target.
      name: endpoint_name
      required: true
    - description: Logged in user name.
      name: logged_in_user
      required: false
    - description: (Deprecated) The external IP address of the endpoint. This argument is deprecated and no longer used.
      name: external_ip
      required: false
      deprecated: true
    description: Deactivates a CyberArk EPM risk plan for a specified endpoint.
    name: cyberarkepm-deactivate-risk-plan
    outputs:
    - contextPath: CyberArkEPMSOCResponse.SetID
      description: The ID of the EPM set in which the endpoints were found.
      type: String
    - contextPath: CyberArkEPMSOCResponse.EndpointIDs
      description: The IDs of the endpoints removed from the risk plan.
      type: String
    - contextPath: CyberArkEPMSOCResponse.RiskPlan
      description: The name of the deactivated risk plan.
      type: String
    - contextPath: CyberArkEPMSOCResponse.Action
      description: The action performed on the risk plan (add/remove).
      type: String
    - contextPath: CyberArkEPMSOCResponse.GroupActionPerformed
      description: Whether the endpoint was successfully removed from the risk plan group in this set.
      type: Boolean
  isfetch: false
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
- xsoar
fromversion: 6.10.0
tests:
- No tests (auto formatted)