CyberArkPAS

Use the CyberArk Privileged Access Management (PAM) solution to manage users, safes, vaults, and accounts from Cortex XSOAR.

Authentication & Identity Management · CyberArk

Details

IDCyberArkPAS
ProviderCyberArk
CategoryAuthentication & Identity Management
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Use the CyberArk Privileged Access Management (PAM) solution to manage users, safes, vaults, and accounts from Cortex XSOAR.

Configure CyberArkPAM in Cortex

Parameter Description Required
url Server URL (e.g., https://example.net) True
credentials Username True
isFetch Fetch incidents False
max_fetch Max fetch False
fetch_time First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year) False
score CyberArk PAM score (0.0-100.0) False
incidentType Incident type False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberark-pas-user-add

Add a new user to the vault.

To run this command, you must have the following permissions:

  • Add Users
  • Update Users

Base Command

cyberark-pas-user-add

Input

Argument Name Description Required
username The name of the user. Required
user_type The user type according to the license. Optional
non_authorized_interfaces The CyberArkPAM interfaces that this user is not authorized to use, e.g., - “PSM”, “PSMP” Optional
location The location in the vault where the user will be created. Must begin with “\”. If just “\”, the vault is in the root. Optional
expiry_date The date when the user credentials expire. Must be in the following timestamp format: (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year). Optional
password The password that the user will use to log in for the first time. Required
change_password_on_the_next_logon Whether or not the user must change the user password from the second log in onward. Can be ‘true’ or ‘false’. Default is ‘true’. Optional
password_never_expires Whether the user’s password will not expire unless they decide to change it. Can be ‘true’ or ‘false’. Default is ‘false’. Optional
vault_authorization A comma-separated list of user permissions. Valid values are: AuditUsers, AddUpdateUsers, ResetUsersPasswords, ActivateUsers, AddNetworkAreas, ManageDirectoryMapping, ManageServerFileCategories, BackupAllSafes, RestoreAllSafes e.g., AddSafes,AuditUsers Optional
description Notes and comments. Optional
email The email address of the user. Optional
first_name The first name of the user. Optional
last_name The last name of the user. Optional
enable_user Whether the user will be enabled upon creation. Can be ‘true’ or ‘false’. Default is ‘true’. Optional
distinguished_name The distinguished name of the user. The usage is for PKI authentication. This will match the certificate subject name or domain name. Optional
profession The profession of the user. Optional

Context Output

Path Type Description
CyberArkPAS.Users.id Number The unique ID of the user.
CyberArkPAS.Users.authenticationMethod String The authentication method of the user.
CyberArkPAS.Users.changePassOnNextLogon Boolean Whether or not the user must change the user password.
CyberArkPAS.Users.description String Description of the user.
CyberArkPAS.Users.enableUser Boolean Whether or not the user is enabled.
CyberArkPAS.Users.expiryDate Number The expiry date of the user credentials.
CyberArkPAS.Users.internet.businessEmail String The email address of the user.
CyberArkPAS.Users.lastSuccessfulLoginDate Number The last successful login date of the user.
CyberArkPAS.Users.location String The location in the vault where the user will be created.
CyberArkPAS.Users.personalDetails.profession String The profession of the user.
CyberArkPAS.Users.suspended Boolean Whether or not the user is suspended.
CyberArkPAS.Users.userType String The type of the user.
CyberArkPAS.Users.username String The name of the user.
CyberArkPAS.Users.vaultAuthorization String The permissions of the user.

Command Example

!cyberark-pas-user-add username="TestUser" password="12345Aa" change_password_on_the_next_logon=true description="new user for test" email="usertest@test.com" enable_user=true first_name="user" last_name="test" profession="testing integrations"

Context Example

{
    "CyberArkPAS": {
        "Users": {
            "authenticationMethod": [
                "AuthTypePass"
            ],
            "businessAddress": {
                "workCity": "",
                "workCountry": "",
                "workState": "",
                "workStreet": "",
                "workZip": ""
            },
            "changePassOnNextLogon": true,
            "componentUser": false,
            "description": "new user for test",
            "distinguishedName": "",
            "enableUser": true,
            "expiryDate": -62135578800,
            "groupsMembership": [],
            "id": 150,
            "internet": {
                "businessEmail": "usertest@test.com",
                "homeEmail": "",
                "homePage": "",
                "otherEmail": ""
            },
            "lastSuccessfulLoginDate": 1597830302,
            "location": "\\",
            "passwordNeverExpires": false,
            "personalDetails": {
                "city": "",
                "country": "",
                "department": "",
                "firstName": "user",
                "lastName": "test",
                "middleName": "",
                "organization": "",
                "profession": "testing integrations",
                "state": "",
                "street": "",
                "title": "",
                "zip": ""
            },
            "phones": {
                "businessNumber": "",
                "cellularNumber": "",
                "faxNumber": "",
                "homeNumber": "",
                "pagerNumber": ""
            },
            "source": "CyberArk",
            "suspended": false,
            "unAuthorizedInterfaces": [],
            "userType": "EPVUser",
            "username": "TestUser",
            "vaultAuthorization": []
        }
    }
}

Human Readable Output

Results

authenticationMethod businessAddress changePassOnNextLogon componentUser description distinguishedName enableUser expiryDate groupsMembership id internet lastSuccessfulLoginDate location passwordNeverExpires personalDetails phones source suspended unAuthorizedInterfaces userType username vaultAuthorization
AuthTypePass workStreet:
workCity:
workState:
workZip:
workCountry:		 true false new user for test   true -62135578800   150 homePage:
homeEmail:
businessEmail: usertest@test.com
otherEmail:		 1597830302 \ false street:
city:
state:
zip:
country:
title:
organization:
department:
profession: testing integrations
firstName: user
middleName:
lastName: test		 homeNumber:
businessNumber:
cellularNumber:
faxNumber:
pagerNumber:		 CyberArk false   EPVUser TestUser  

cyberark-pas-user-update

Update an existing vault user.

To run this command, you must have the following permissions:

  • Add Users or Update Users
  • In order to edit change_password_on_the_next_logon, you must have the Reset Password authorization

Base Command

cyberark-pas-user-update

Input

Argument Name Description Required
username The name of the user. Optional
user_type User type according to the license. Optional
non_authorized_interfaces The CyberArkPAM interfaces that this user is not authorized to use, e.g., “PSM”, “PSMP” Optional
location The location in the vault where the user will be created. Must begin with “\”. If just “\”, the vault is in the root. Optional
expiry_date The date when the user expires. Must be in the following timestamp format: (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year). Optional
change_password_on_the_next_logon Whether or not the user must change their password from the second log on onward. Can be ‘true’ or ‘false’. Default is ‘true’. Optional
password_never_expires Whether the user’s password will not expire unless they decide to change it. Can be ‘true’ or ‘false’. Default is ‘false’. Optional
vault_authorization A comma-separated list of user permissions. Valid values are: AddSafes, AuditUsers, AddUpdateUsers, ResetUsersPasswords, ActivateUsers, AddNetworkAreas, ManageDirectoryMapping, ManageServerFileCategories, BackupAllSafes, RestoreAllSafes e.g., AddSafes,AuditUsers Optional
description Notes and comments. Optional
email The email addresses of the user. Optional
first_name The first name of the user. Optional
last_name The last name of the user. Optional
enable_user Whether the user will be enabled upon creation. Can be ‘true’ or ‘false’. Default is ‘true’. Optional
distinguished_name The distinguished name of the user. The usage is for PKI authentication. This will match the certificate subject name or domain name. Optional
profession The profession of the user. Optional
user_id The ID of the user to update. Required

Context Output

Path Type Description
CyberArkPAS.Users.id Number The unique ID of the user.
CyberArkPAS.Users.authenticationMethod String The authentication method for the user.
CyberArkPAS.Users.changePassOnNextLogon Boolean Whether or not the user must change the user password.
CyberArkPAS.Users.description String Description of the user.
CyberArkPAS.Users.enableUser Boolean Whether or not the user is enabled.
CyberArkPAS.Users.expiryDate Number The expiry date of the user.
CyberArkPAS.Users.internet.businessEmail String The email address of the user.
CyberArkPAS.Users.lastSuccessfulLoginDate Number The last successful login date of the user.
CyberArkPAS.Users.location String The location in the vault where the user will be created.
CyberArkPAS.Users.personalDetails.profession String The profession of the user.
CyberArkPAS.Users.suspended Boolean Whether or not the user is suspended.
CyberArkPAS.Users.userType String The type of the user.
CyberArkPAS.Users.username String The name of the user.
CyberArkPAS.Users.vaultAuthorization String The permissions of the user.

Command Example

!cyberark-pas-user-update user_id=150 change_password_on_the_next_logon=true description="updated description" email="update@test.com" first_name="test1" last_name="updated-name" username="TestUser1" profession="test1"

Context Example

{
    "CyberArkPAS": {
        "Users": {
            "authenticationMethod": [
                "AuthTypePass"
            ],
            "businessAddress": {
                "workCity": "",
                "workCountry": "",
                "workState": "",
                "workStreet": "",
                "workZip": ""
            },
            "changePassOnNextLogon": true,
            "componentUser": false,
            "description": "updated description",
            "distinguishedName": "",
            "enableUser": true,
            "expiryDate": -62135578800,
            "groupsMembership": [],
            "id": 150,
            "internet": {
                "businessEmail": "update@test.com",
                "homeEmail": "",
                "homePage": "",
                "otherEmail": ""
            },
            "lastSuccessfulLoginDate": 1597830302,
            "location": "\\",
            "passwordNeverExpires": false,
            "personalDetails": {
                "city": "",
                "country": "",
                "department": "",
                "firstName": "test1",
                "lastName": "updated-name",
                "middleName": "",
                "organization": "",
                "profession": "test1",
                "state": "",
                "street": "",
                "title": "",
                "zip": ""
            },
            "phones": {
                "businessNumber": "",
                "cellularNumber": "",
                "faxNumber": "",
                "homeNumber": "",
                "pagerNumber": ""
            },
            "source": "CyberArk",
            "suspended": false,
            "unAuthorizedInterfaces": [],
            "userType": "EPVUser",
            "username": "TestUser1",
            "vaultAuthorization": []
        }
    }
}

Human Readable Output

Results

authenticationMethod businessAddress changePassOnNextLogon componentUser description distinguishedName enableUser expiryDate groupsMembership id internet lastSuccessfulLoginDate location passwordNeverExpires personalDetails phones source suspended unAuthorizedInterfaces userType username vaultAuthorization
AuthTypePass workStreet:
workCity:
workState:
workZip:
workCountry:		 true false updated description   true -62135578800   150 homePage:
homeEmail:
businessEmail: update@test.com
otherEmail:		 1597830302 \ false street:
city:
state:
zip:
country:
title:
organization:
department:
profession: test1
firstName: test1
middleName:
lastName: updated-name		 homeNumber:
businessNumber:
cellularNumber:
faxNumber:
pagerNumber:		 CyberArk false   EPVUser TestUser1  

cyberark-pas-user-delete

Delete a specific user in the vault.

To run this command, you must have Add Users or Update Users permissions.

Base Command

cyberark-pas-user-delete

Input

Argument Name Description Required
user_id The ID of the user to delete. Required

Context Output

Path Type Description
CyberArkPAS.Users.Deleted Boolean Whether the user was deleted.

Command Example

!cyberark-pas-user-delete user_id=150

Context Example

{
    "CyberArkPAS": {
        "Users": {
            "Deleted": true,
            "id": "150"
        }
    }
}

Human Readable Output

User 150 was deleted

cyberark-pas-users-list

Return a list of all existing users in the vault that meet the filter and search criteria.

Base Command

cyberark-pas-users-list

Input

Argument Name Description Required
filter Retrieve users using filters. Valid values: userType, componentUser. Optional
search Search by the following values: username, first name, last name. Optional

Context Output

Path Type Description
CyberArkPAS.Users.id Number The unique IDs of the users.
CyberArkPAS.Users.username String The names of the users.
CyberArkPAS.Users.source String The sources of the users.
CyberArkPAS.Users.userType String The types of the users.
CyberArkPAS.Users.componentUser Boolean Whether the users are component users.
CyberArkPAS.Users.location String The locations in the vault where the users were created.
CyberArkPAS.Users.personalDetails.firstName String The first name of the users.
CyberArkPAS.Users.personalDetails.middleName String The middle name of the users.
CyberArkPAS.Users.personalDetails.lastName String The last name of the users.
CyberArkPAS.Users.vaultAuthorization String The permissions of the users.

Command Example


#### Context Example

{
“CyberArkPAS”: {
“Users”: [
{
“componentUser”: false,
“id”: 2,
“location”: “\”,
“personalDetails”: {
“firstName”: “”,
“lastName”: “”,
“middleName”: “”
},
“source”: “CyberArk”,
“userType”: “Built-InAdmins”,
“username”: “Administrator”,
“enableUser”: true,
“suspended”: false,
“vaultAuthorization”: [
“AddUpdateUsers”,
“AddSafes”,
“AddNetworkAreas”,
“ManageDirectoryMapping”,
“ManageServerFileCategories”,
“AuditUsers”,
“BackupAllSafes”,
“RestoreAllSafes”,
“ResetUsersPasswords”,
“ActivateUsers”
]
},
{
“componentUser”: false,
“id”: 3,
“location”: “\”,
“personalDetails”: {
“firstName”: “”,
“lastName”: “”,
“middleName”: “”
},
“source”: “CyberArk”,
“userType”: “Built-InAdmins”,
“username”: “Auditor”,
“enableUser”: true,
“suspended”: false,
“vaultAuthorization”: [
“AuditUsers”
]
}
}


#### Human Readable Output

>### There are 2 users
>
>|componentUser|id|location|personalDetails|source|userType|username|vaultAuthorization|
>|---|---|---|---|---|---|---|---|
>| false | 2 | \ | firstName: <br/>middleName: <br/>lastName:  | CyberArk | Built-InAdmins | Administrator | AddUpdateUsers,<br/>AddSafes,<br/>AddNetworkAreas,<br/>ManageDirectoryMapping,<br/>ManageServerFileCategories,<br/>AuditUsers,<br/>BackupAllSafes,<br/>RestoreAllSafes,<br/>ResetUsersPasswords,<br/>ActivateUsers |
>| false | 3 | \ | firstName: <br/>middleName: <br/>lastName:  | CyberArk | Built-InAdmins | Auditor | AuditUsers |

### cyberark-pas-user-activate

***
Activate an existing vault user who was suspended after entering incorrect credentials multiple times.
Uses the V1 of the API and may change in the future.

#### Base Command

`cyberark-pas-user-activate`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| user_id | The ID of the user to activate. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!cyberark-pas-user-activate user_id=150```

#### Human Readable Output

>User 150 was activated

### cyberark-pas-safes-list

***
Return information about all of the user’s safes in the vault.

To run this command, you must be a member of the Safes in the Vault that are returned in the list.

#### Base Command

`cyberark-pas-safes-list`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.SafeName | String | The names of the safes. |
| CyberArkPAS.Safes.Description | String | The descriptions of the safes. |
| CyberArkPAS.Safes.Location | String | The locations of the safes. |
| CyberArkPAS.Safes.ManagingCPM | String | The name of the Central Policy Manager \(CPM\) user who will manage the safes. |
| CyberArkPAS.Safes.NumberOfDaysRetention | Number | The number of retained versions of every password that is stored in the safes. |
| CyberArkPAS.Safes.NumberOfVersionsRetention | Number | The number of days for which password versions are saved in the safes. |
| CyberArkPAS.Safes.OLACEnabled | Boolean | Whether or not to enable Object Level Access Control \(OLAC\) for the safes. |

#### Command Example

```!cyberark-pas-safes-list```

#### Context Example

{
“CyberArkPAS”: {
“Safes”: [
{
“Description”: “”,
“Location”: “\”,
“SafeName”: “Internal”,
“SafeUrlId”: “Internal”
},
{
“Description”: “”,
“Location”: “\”,
“SafeName”: “Notification”,
“SafeUrlId”: “Notification”
},
{
“Description”: “”,
“Location”: “\”,
“SafeName”: “Reports”,
“SafeUrlId”: “Reports”
}
]
}
}


#### Human Readable Output

>### There are 3 safes
>
>|Description|Location|SafeName|SafeUrlId|
>|---|---|---|---|
>|  | \ | Internal | Internal |
>|  | \ | Notification | Notification |
>|  | \ | Reports | Reports |

### cyberark-pas-safe-get-by-name

***
Return information about a specific safe in the vault.

#### Base Command

`cyberark-pas-safe-get-by-name`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| safe_name | The name of the safe about which information is returned. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.SafeName | String | The name of the safe. |
| CyberArkPAS.Safes.Description | String | The description of the safe. |
| CyberArkPAS.Safes.Location | String | The location of the safe. |
| CyberArkPAS.Safes.ManagingCPM | String | The name of the Central Policy Manager \(CPM\) user who will manage the safe. |
| CyberArkPAS.Safes.NumberOfDaysRetention | Number | The number of retained versions of every password that is stored in the safe. |
| CyberArkPAS.Safes.NumberOfVersionsRetention | Number | The number of days for which password versions are saved in the safe. |
| CyberArkPAS.Safes.OLACEnabled | Boolean | Whether or not to enable Object Level Access Control \(OLAC\) for the safe. |

#### Command Example

```!cyberark-pas-safe-get-by-name safe_name=UpdatedName1```

#### Context Example

{
“CyberArkPAS”: {
“Safes”: {
“AutoPurgeEnabled”: false,
“Description”: “UpdatedSafe”,
“Location”: “\”,
“ManagingCPM”: “”,
“NumberOfDaysRetention”: 150,
“NumberOfVersionsRetention”: null,
“OLACEnabled”: true,
“SafeName”: “UpdatedName1”
}
}
}


#### Human Readable Output

>### Results
>
>|AutoPurgeEnabled|Description|Location|ManagingCPM|NumberOfDaysRetention|NumberOfVersionsRetention|OLACEnabled|SafeName|
>|---|---|---|---|---|---|---|---|
>| false | UpdatedSafe | \ |  | 150 |  | true | UpdatedName1 |

### cyberark-pas-safe-add

***
Add a new safe to the vault.

To run this command, you must have *Add Safes* permission in the Vault.

#### Base Command

`cyberark-pas-safe-add`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| safe_name | Name of a safe to create. | Required |
| description | Description of the new safe. | Optional |
| OLAC_enabled | Whether or not to enable Object Level Access Control (OLAC) for the new<br/>safe. Valid values are: 'true' or 'false'. Default is 'true'. | Optional |
| managing_cpm | The name of the Central Policy Manager (CPM) user who will manage the new safe. | Optional |
| number_of_versions_retention | The number of retained versions of every password that is stored in the safe. | Optional |
| number_of_days_retention | The number of days for which password versions are saved in the safe. | Optional |
| location | The location of the new safe. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.SafeName | String | The name of the safe. |
| CyberArkPAS.Safes.Description | String | The description of the safe. |
| CyberArkPAS.Safes.Location | String | The location of the safe. |
| CyberArkPAS.Safes.ManagingCPM | String | The name of the Central Policy Manager \(CPM\) user who will manage the safe. |
| CyberArkPAS.Safes.NumberOfDaysRetention | Number | The number of retained versions of every password that is stored in the safe. |
| CyberArkPAS.Safes.NumberOfVersionsRetention | Number | The number of days for which password versions are saved in the safe. |
| CyberArkPAS.Safes.OLACEnabled | Boolean | Whether or not to enable Object Level Access Control \(OLAC\) for the safe. |

#### Command Example

```!cyberark-pas-safe-add safe_name="TestSafe1" description="safe for tests" number_of_days_retention=100```

#### Context Example

{
“CyberArkPAS”: {
“Safes”: {
“AutoPurgeEnabled”: false,
“Description”: “safe for tests”,
“Location”: “\”,
“ManagingCPM”: “”,
“NumberOfDaysRetention”: 100,
“NumberOfVersionsRetention”: null,
“OLACEnabled”: true,
“SafeName”: “TestSafe1”
}
}
}


#### Human Readable Output

>### Results
>
>|AutoPurgeEnabled|Description|Location|ManagingCPM|NumberOfDaysRetention|NumberOfVersionsRetention|OLACEnabled|SafeName|
>|---|---|---|---|---|---|---|---|
>| false | safe for tests | \ |  | 100 |  | true | TestSafe1 |

### cyberark-pas-safe-update

***
Update a single safe in the vault.

To run this command, you must have *Manage Safes* permission in the Vault.

#### Base Command

`cyberark-pas-safe-update`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| safe_name | The name of the safe that will be updated. | Required |
| description | The description of the updated safe. | Optional |
| OLAC_enabled | Whether or not to enable Object Level Access Control (OLAC) for the updated<br/>safe. Valid values are: 'true' or 'false'. Default is 'true'. | Optional |
| managing_cpm | The name of the Central Policy Manager (CPM) user who will manage the updated safe. | Optional |
| number_of_versions_retention | The number of retained versions of every password that is stored in the updated safe. | Optional |
| number_of_days_retention | The number of days for which password versions are saved in the updated safe. | Optional |
| safe_new_name | The new name of the safe. | Optional |
| location | The location of the updated safe. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.SafeName | String | The name of the updated safe. |
| CyberArkPAS.Safes.Description | String | The description of the updated safe. |
| CyberArkPAS.Safes.Location | String | The location of the updated safe. |
| CyberArkPAS.Safes.ManagingCPM | String | The name of the Central Policy Manager \(CPM\) user who will manage the safe. |
| CyberArkPAS.Safes.NumberOfDaysRetention | Number | The number of retained versions of every password that is stored in the updated safe. |
| CyberArkPAS.Safes.NumberOfVersionsRetention | Number | The number of days for which password versions are saved in the updated safe. |
| CyberArkPAS.Safes.OLACEnabled | Boolean | Whether or not to enable Object Level Access Control \(OLAC\) for the updated safe. |

#### Command Example

```!cyberark-pas-safe-update safe_name=TestSafe1 safe_new_name=UpdatedName1 description=UpdatedSafe number_of_days_retention=150```

#### Context Example

{
“CyberArkPAS”: {
“Safes”: {
“AutoPurgeEnabled”: false,
“Description”: “UpdatedSafe”,
“Location”: “\”,
“ManagingCPM”: “”,
“NumberOfDaysRetention”: 150,
“NumberOfVersionsRetention”: null,
“OLACEnabled”: true,
“SafeName”: “UpdatedName1”
}
}
}


#### Human Readable Output

>### Results
>
>|AutoPurgeEnabled|Description|Location|ManagingCPM|NumberOfDaysRetention|NumberOfVersionsRetention|OLACEnabled|SafeName|
>|---|---|---|---|---|---|---|---|
>| false | UpdatedSafe | \ |  | 150 |  | true | UpdatedName1 |

### cyberark-pas-safe-delete

***
Delete a safe from the vault.

To run this command, you must have *Manage Safes* permission in the Safe.

#### Base Command

`cyberark-pas-safe-delete`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| safe_name | The name of the safe that will be deleted. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.Deleted | Boolean | Whether the safe was deleted. |

#### Command Example

```!cyberark-pas-safe-delete safe_name=UpdatedName1```

#### Context Example

{
“CyberArkPAS”: {
“Safes”: {
“Deleted”: true,
“SafeName”: “UpdatedName1”
}
}
}


#### Human Readable Output

>Safe UpdatedName1 was deleted

### cyberark-pas-safe-members-list

***
Return a list of the members of the safe.

To run this command, you must have *View Safe Members* permission in the Safe.

#### Base Command

`cyberark-pas-safe-members-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| safe_name | The name of the safe whose safe members will be listed. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.Members.MemberName | String | The names of the safe members. |
| CyberArkPAS.Safes.Members.MembershipExpirationDate | Number | The expiration dates of the safe members. |
| CyberArkPAS.Safes.Members.Permissions | Unknown | The permissions of the safe members. |
| CyberArkPAS.Safes.Members.SearchIn | String | The vault or domain where the users or groups was found. |

#### Command Example

```!cyberark-pas-safe-members-list safe_name=UpdatedName1```

#### Context Example

{
“CyberArkPAS”: {
“Safes”: {
“Members”: [
{
“IsExpiredMembershipEnable”: false,
“IsPredefinedUser”: true,
“MemberName”: “Administrator”,
“MemberType”: “User”,
“MembershipExpirationDate”: null,
“Permissions”: {
“AccessWithoutConfirmation”: true,
“AddAccounts”: true,
“BackupSafe”: true,
“CreateFolders”: true,
“DeleteAccounts”: true,
“DeleteFolders”: true,
“InitiateCPMAccountManagementOperations”: true,
“ListAccounts”: true,
“ManageSafe”: true,
“ManageSafeMembers”: true,
“MoveAccountsAndFolders”: true,
“RenameAccounts”: true,
“RequestsAuthorizationLevel1”: true,
“RequestsAuthorizationLevel2”: false,
“RetrieveAccounts”: true,
“SpecifyNextAccountContent”: true,
“UnlockAccounts”: true,
“UpdateAccountContent”: true,
“UpdateAccountProperties”: true,
“UseAccounts”: true,
“ViewAuditLog”: true,
“ViewSafeMembers”: true
}
},
{
“IsExpiredMembershipEnable”: false,
“IsPredefinedUser”: false,
“MemberName”: “TestUser1”,
“MemberType”: “User”,
“MembershipExpirationDate”: null,
“Permissions”: {
“AccessWithoutConfirmation”: false,
“AddAccounts”: false,
“BackupSafe”: false,
“CreateFolders”: false,
“DeleteAccounts”: false,
“DeleteFolders”: false,
“InitiateCPMAccountManagementOperations”: false,
“ListAccounts”: false,
“ManageSafe”: false,
“ManageSafeMembers”: false,
“MoveAccountsAndFolders”: false,
“RenameAccounts”: false,
“RequestsAuthorizationLevel1”: false,
“RequestsAuthorizationLevel2”: false,
“RetrieveAccounts”: false,
“SpecifyNextAccountContent”: false,
“UnlockAccounts”: false,
“UpdateAccountContent”: false,
“UpdateAccountProperties”: false,
“UseAccounts”: true,
“ViewAuditLog”: false,
“ViewSafeMembers”: false
}
}
]
}
}
}


#### Human Readable Output

>### There are 2 safe members for UpdatedName1
>
>|IsExpiredMembershipEnable|IsPredefinedUser|MemberName|MemberType|MembershipExpirationDate|Permissions|
>|---|---|---|---|---|---|
>| false | true | Administrator | User |  | UseAccounts: true<br/>RetrieveAccounts: true<br/>ListAccounts: true<br/>AddAccounts: true<br/>UpdateAccountContent: true<br/>UpdateAccountProperties: true<br/>InitiateCPMAccountManagementOperations: true<br/>SpecifyNextAccountContent: true<br/>RenameAccounts: true<br/>DeleteAccounts: true<br/>UnlockAccounts: true<br/>ManageSafe: true<br/>ManageSafeMembers: true<br/>BackupSafe: true<br/>ViewAuditLog: true<br/>ViewSafeMembers: true<br/>AccessWithoutConfirmation: true<br/>CreateFolders: true<br/>DeleteFolders: true<br/>MoveAccountsAndFolders: true<br/>RequestsAuthorizationLevel1: true<br/>RequestsAuthorizationLevel2: false |
>| false | false | TestUser1 | User |  | UseAccounts: true<br/>RetrieveAccounts: false<br/>ListAccounts: false<br/>AddAccounts: false<br/>UpdateAccountContent: false<br/>UpdateAccountProperties: false<br/>InitiateCPMAccountManagementOperations: false<br/>SpecifyNextAccountContent: false<br/>RenameAccounts: false<br/>DeleteAccounts: false<br/>UnlockAccounts: false<br/>ManageSafe: false<br/>ManageSafeMembers: false<br/>BackupSafe: false<br/>ViewAuditLog: false<br/>ViewSafeMembers: false<br/>AccessWithoutConfirmation: false<br/>CreateFolders: false<br/>DeleteFolders: false<br/>MoveAccountsAndFolders: false<br/>RequestsAuthorizationLevel1: false<br/>RequestsAuthorizationLevel2: false |

### cyberark-pas-safe-member-add

***
Add an existing user as a safe member.

#### Base Command

`cyberark-pas-safe-member-add`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| member_name | The name of the user to add as a safe member. | Required |
| search_in | Search for the member in the vault or domain. | Optional |
| membership_expiration_date | The membership expiration date in the format MM\DD\YY. Leave empty if there is no expiration date. | Optional |
| permissions | The user’s permissions in the safe.<br/>Valid values: UseAccounts, RetrieveAccounts, ListAccounts, AddAccounts, UpdateAccountContent, UpdateAccountProperties, InitiateCPMAccountManagementOperations, InitiateCPMAccountManagementOperations, SpecifyNextAccountContent, RenameAccounts, DeleteAccounts, UnlockAccounts, ManageSafe, ManageSafeMembers, BackupSafe, ViewAuditLog, ViewAuditLog, ViewSafeMembers, AccessWithoutConfirmation, CreateFolders, DeleteFolders, MoveAccountsAndFolders<br/>e.g., UseAccounts,RetrieveAccounts. | Optional |
| safe_name | The URL encoded name of the safe to add a member to. | Required |
| requests_authorization_level | The request authorization levels.<br/>0 – cannot authorize<br/>1 – authorization level 1<br/>2 – authorization level 2<br/>Default is '0'. Possible values are: 0, 1, 2. Default is 0. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.Members.MemberName | String | The name of the safe member. |
| CyberArkPAS.Safes.Members.MembershipExpirationDate | Number | The expiration date of the safe member. |
| CyberArkPAS.Safes.Members.Permissions | Unknown | The permissions of the safe member. |
| CyberArkPAS.Safes.Members.SearchIn | String | The vault or domain where the user or group was found. |

### cyberark-pas-safe-member-update

***
Update an existing safe member.
Uses the V1 of the API and may change in the future.

To run this command, you must have *Manage Safe Members* permission in the Vault.

#### Base Command

`cyberark-pas-safe-member-update`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| member_name | The member name that will be updated. | Required |
| membership_expiration_date | The membership expiration date in the format MM\DD\YY. Leave empty if there is no expiration date. | Optional |
| permissions | The user’s permissions in the safe.<br/>Valid values are:<br/>UseAccounts, RetrieveAccounts, ListAccounts, AddAccounts, UpdateAccountContent, UpdateAccountProperties, InitiateCPMAccountManagementOperations, InitiateCPMAccountManagementOperations, SpecifyNextAccountContent, RenameAccounts, DeleteAccounts, UnlockAccounts, ManageSafe, ManageSafeMembers, BackupSafe, ViewAuditLog, ViewAuditLog, ViewSafeMembers, RequestsAuthorizationLevel, AccessWithoutConfirmation, CreateFolders, DeleteFolders, MoveAccountsAndFolders<br/>e.g., UseAccounts,RetrieveAccounts | Optional |
| safe_name | The name of the safe to which the safe member belongs. | Required |
| requests_authorization_level | Request authorization levels.<br/>0 – cannot authorize<br/>1 – authorization level 1<br/>2 – authorization level 2<br/>Default is: '0'. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.Members.MemberName | String | The name of the safe member. |
| CyberArkPAS.Safes.Members.MembershipExpirationDate | Number | The expiration date of the safe member. |
| CyberArkPAS.Safes.Members.Permissions | Unknown | The permissions of the safe member. |
| CyberArkPAS.Safes.Members.SearchIn | String | The vault or domain where the user or group was found. |

#### Command Example

```!cyberark-pas-safe-member-update member_name="TestUser1" safe_name="UpdatedName1" permissions=UseAccounts```

#### Context Example

{
“CyberArkPAS”: {
“Safes”: {
“Members”: {
“MembershipExpirationDate”: “”,
“Permissions”: [
{
“Key”: “UseAccounts”,
“Value”: true
},
{
“Key”: “RetrieveAccounts”,
“Value”: false
},
{
“Key”: “ListAccounts”,
“Value”: false
},
{
“Key”: “AddAccounts”,
“Value”: false
},
{
“Key”: “UpdateAccountContent”,
“Value”: false
},
{
“Key”: “UpdateAccountProperties”,
“Value”: false
},
{
“Key”: “InitiateCPMAccountManagementOperations”,
“Value”: false
},
{
“Key”: “SpecifyNextAccountContent”,
“Value”: false
},
{
“Key”: “RenameAccounts”,
“Value”: false
},
{
“Key”: “DeleteAccounts”,
“Value”: false
},
{
“Key”: “UnlockAccounts”,
“Value”: false
},
{
“Key”: “ManageSafe”,
“Value”: false
},
{
“Key”: “ManageSafeMembers”,
“Value”: false
},
{
“Key”: “BackupSafe”,
“Value”: false
},
{
“Key”: “ViewAuditLog”,
“Value”: false
},
{
“Key”: “ViewSafeMembers”,
“Value”: false
},
{
“Key”: “AccessWithoutConfirmation”,
“Value”: false
},
{
“Key”: “CreateFolders”,
“Value”: false
},
{

cyberark-pas-safe-member-update

Update an existing safe member.

Base Command

cyberark-pas-safe-member-update

Input

Argument Name Description Required
member_name The member name that will be updated. Required
membership_expiration_date The membership expiration date in the format MM\DD\YY. Leave empty if there is no expiration date. Optional
permissions The user’s permissions in the safe.
Valid values are:
UseAccounts, RetrieveAccounts, ListAccounts, AddAccounts, UpdateAccountContent, UpdateAccountProperties, InitiateCPMAccountManagementOperations, InitiateCPMAccountManagementOperations, SpecifyNextAccountContent, RenameAccounts, DeleteAccounts, UnlockAccounts, ManageSafe, ManageSafeMembers, BackupSafe, ViewAuditLog, ViewAuditLog, ViewSafeMembers, RequestsAuthorizationLevel, AccessWithoutConfirmation, CreateFolders, DeleteFolders, MoveAccountsAndFolders
e.g., UseAccounts,RetrieveAccounts.		 Optional
safe_name The URL encoded name of the safe to which the safe member belongs. Required
requests_authorization_level Request authorization levels.
0 – cannot authorize
1 – authorization level 1
2 – authorization level 2
Default is: ‘0’. Possible values are: 0, 1, 2. Default is 0.		 Optional

Context Output

Path Type Description
CyberArkPAS.Safes.Members.MemberName String The name of the safe member.
CyberArkPAS.Safes.Members.MembershipExpirationDate Number The expiration date of the safe member.
CyberArkPAS.Safes.Members.Permissions Unknown The permissions of the safe member.
CyberArkPAS.Safes.Members.SearchIn String The vault or domain where the user or group was found. 
    }
} } ```

Human Readable Output

Results

address categoryModificationTime createdTime id name platformId safeName secretManagement secretType userName
/ 1597863168 1597863168 89_3 TestAccount1 WinServerLocal TestSafe1 automaticManagementEnabled: true
lastModifiedTime: 1597848768		 password TestUser

cyberark-pas-account-add

Add a new privileged account or SSH key to the vault.

To run this command, you must have the following permissions in the Safe:

  • For updating account properties: Update Password Properties.
  • For renaming accounts: Rename Accounts.
  • For moving accounts to a different folder: Move Accounts or Move Folders.

Base Command

cyberark-pas-account-add

Input

Argument Name Description Required
account_id The unique ID of the account to add. Required

Context Output

Path Type Description
CyberArkPAS.Accounts.id String The unique ID of the account.
CyberArkPAS.Accounts.categoryModificationTime Number The last modified date of the account.
CyberArkPAS.Accounts.createdTime Number The date the account was created.
CyberArkPAS.Accounts.name String The name of the account.
CyberArkPAS.Accounts.platformId String The platform assigned to this account.
CyberArkPAS.Accounts.safeName String The safe where the account was created.
CyberArkPAS.Accounts.secretManagement String Whether the account secret is automatically managed by the CPM.
CyberArkPAS.Accounts.secretType String The type of password.
CyberArkPAS.Accounts.userName String The user name of the account.
CyberArkPAS.Accounts.address String The name or address of the machine where the account will be used.

Command Example

!cyberark-pas-account-add safe_name=TestSafe account_name=TestAccount1 address=/ password=12345Aa platform_id=WinServerLocal username=TestUser

Context Example

{
    "CyberArkPAS": {
        "Accounts": {
            "address": "/",
            "categoryModificationTime": 1597863168,
            "createdTime": 1597863168,
            "id": "89_3",cyberark-pas-safe-member-add
            "name": "NewName",
            "platformId": "WinServerLocal",
            "safeName": "TestSafe1",
            "secretManagement": {
### cyberark-pas-safe-member-delete

***
Remove a specific member from a safe.

#### Base Command

`cyberark-pas-safe-member-delete`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| safe_name | The URL encoded name of the safe to delete a member from. | Required | 
| member_name | The name of the safe member to delete from the safe’s list of members. | Required | 

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.Members.Deleted | Boolean | Whether the safe member was deleted. | 

#### Command Example

```!cyberark-pas-accounts-list limit=2```

#### Context Example

{
“CyberArkPAS”: {
“Accounts”: [
{
“address”: “string”,
“categoryModificationTime”: 1594569595,
“createdTime”: 1594573679,
“id”: “2_6”,
“name”: “account1”,
“platformAccountProperties”: {},
“platformId”: “Oracle”,
“safeName”: “VaultInternal”,
“secretManagement”: {
“automaticManagementEnabled”: true,
“lastModifiedTime”: 159459279
},
“secretType”: “password”,
“userName”: “string”
},
{
“address”: “string”,
“categoryModificationTime”: 1583345933,
“createdTime”: 157312750,
“id”: “2_3”,
“name”: “cybr”,
“platformAccountProperties”: {},
“platformId”: “WinDomain”,
“safeName”: “VaultInternal”,
“secretManagement”: {
“automaticManagementEnabled”: false,
“lastModifiedTime”: 157319750,
“manualManagementReason”: “NoReason”
},
“secretType”: “password”,
“userName”: “vault”
}
]
}
}


#### Human Readable Output

>### There are 2 accounts
>
>|address|categoryModificationTime|createdTime|id|name|platformAccountProperties|platformId|safeName|secretManagement|secretType|userName|
>|---|---|---|---|---|---|---|---|---|---|---|
>| string | 1594569595 | 1594573679 | 2_6 | account1 |  | Oracle | VaultInternal | automaticManagementEnabled: true<br/>lastModifiedTime: 1594559279 | password | string |
>| string | 1583345933 | 1573127750 | 2_3 | cybr|  | WinDomain | VaultInternal | automaticManagementEnabled: false<br/>manualManagementReason: NoReason<br/>lastModifiedTime: 1573109750 | password | vault |

### cyberark-pas-account-get-list-activity

***
Returns the activities of a specific account that is identified by its account ID.

#### Base Command

`cyberark-pas-account-get-list-activity`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| account_id | The ID of the account whose activities will be retrieved. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Activities.Action | String | The activity that was performed. |
| CyberArkPAS.Activities.ActionID | Number | The code identification of the specific activity. |
| CyberArkPAS.Activities.Alert | Boolean | Whether or not the activity caused an alert. |
| CyberArkPAS.Activities.ClientID | String | The name of the account. |
| CyberArkPAS.Activities.Date | Number | The date the account was created. |
| CyberArkPAS.Activities.MoreInfo | String | More information about the activity. |
| CyberArkPAS.Activities.Reason | String | The reason given by the user for the activity. |
| CyberArkPAS.Activities.User | String | The user who performed the activity. |

#### Command Example

```!cyberark-pas-account-get-list-activity account_id= 89_3```

#### Context Example

{
“CyberArkPAS”: {
“Activities”: [
{
“Action”: “Rename File”,
“ActionID”: 124,
“Alert”: false,
“ClientID”: “1”,
“Date”: 1597863265,
“MoreInfo”: “NewName”,

cyberark-pas-account-update

Update the details of an existing account.

To run this command, you must have the following permissions in the Safe:

  • For updating account properties: Update Password Properties.
  • For renaming accounts: Rename Accounts.
  • For moving accounts to a different folder: Move Accounts or Move Folders.

Base Command

cyberark-pas-account-update

Input

Argument Name Description Required
account_id The unique ID of the account to update. Required
account_name The name of the account to update. Optional
address The name or address of the machine where the account will be used. Optional
platform_id The platform assigned to this account. Optional
username The user name of the account. Optional

Context Output

Path Type Description
CyberArkPAS.Accounts.id String The unique ID of the account.
CyberArkPAS.Accounts.categoryModificationTime Number The last modified date of the account.
CyberArkPAS.Accounts.createdTime Number The date the account was created.
CyberArkPAS.Accounts.name String The name of the account.
CyberArkPAS.Accounts.platformId String The platform assigned to this account.
CyberArkPAS.Accounts.safeName String The safe where the account was created.
CyberArkPAS.Accounts.secretManagement String Whether the account secret is automatically managed by the CPM.
CyberArkPAS.Accounts.secretType String The type of password.
CyberArkPAS.Accounts.userName String The user name of the account.
CyberArkPAS.Accounts.address String The name or address of the machine where the account will be used.

Command Example

!cyberark-pas-account-update account_id= 89_3 account_name=NewName

Context Example

{
    "CyberArkPAS": {
        "Accounts": {
            "address": "/",
            "categoryModificationTime": 1597863168,
            "createdTime": 1597863168,
            "id": "89_3",
            "name": "NewName",
            "platformId": "WinServerLocal",
            "safeName": "TestSafe1",
            "secretManagement": {
### cyberark-pas-safe-member-delete

***
Remove a specific member from a safe.

#### Base Command

`cyberark-pas-safe-member-delete`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| safe_name | The URL encoded name of the safe to delete a member from. | Required | 
| member_name | The name of the safe member to delete from the safe’s list of members. | Required | 

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Safes.Members.Deleted | Boolean | Whether the safe member was deleted. | 

#### Command Example

```!cyberark-pas-accounts-list limit=2```

#### Context Example

{
“CyberArkPAS”: {
“Accounts”: [
{
“address”: “string”,
“categoryModificationTime”: 1594569595,
“createdTime”: 1594573679,
“id”: “2_6”,
“name”: “account1”,
“platformAccountProperties”: {},
“platformId”: “Oracle”,
“safeName”: “VaultInternal”,
“secretManagement”: {
“automaticManagementEnabled”: true,
“lastModifiedTime”: 159459279
},
“secretType”: “password”,
“userName”: “string”
},
{
“address”: “string”,
“categoryModificationTime”: 1583345933,
“createdTime”: 157312750,
“id”: “2_3”,
“name”: “cybr”,
“platformAccountProperties”: {},
“platformId”: “WinDomain”,
“safeName”: “VaultInternal”,
“secretManagement”: {
“automaticManagementEnabled”: false,
“lastModifiedTime”: 157319750,
“manualManagementReason”: “NoReason”
},
“secretType”: “password”,
“userName”: “vault”
}
]
}
}


#### Human Readable Output

>### There are 2 accounts
>
>|address|categoryModificationTime|createdTime|id|name|platformAccountProperties|platformId|safeName|secretManagement|secretType|userName|
>|---|---|---|---|---|---|---|---|---|---|---|
>| string | 1594569595 | 1594573679 | 2_6 | account1 |  | Oracle | VaultInternal | automaticManagementEnabled: true<br/>lastModifiedTime: 1594559279 | password | string |
>| string | 1583345933 | 1573127750 | 2_3 | cybr|  | WinDomain | VaultInternal | automaticManagementEnabled: false<br/>manualManagementReason: NoReason<br/>lastModifiedTime: 1573109750 | password | vault |

### cyberark-pas-account-get-list-activity

***
Returns the activities of a specific account that is identified by its account ID.

#### Base Command

`cyberark-pas-account-get-list-activity`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| account_id | The ID of the account whose activities will be retrieved. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CyberArkPAS.Activities.Action | String | The activity that was performed. |
| CyberArkPAS.Activities.ActionID | Number | The code identification of the specific activity. |
| CyberArkPAS.Activities.Alert | Boolean | Whether or not the activity caused an alert. |
| CyberArkPAS.Activities.ClientID | String | The name of the account. |
| CyberArkPAS.Activities.Date | Number | The date the account was created. |
| CyberArkPAS.Activities.MoreInfo | String | More information about the activity. |
| CyberArkPAS.Activities.Reason | String | The reason given by the user for the activity. |
| CyberArkPAS.Activities.User | String | The user who performed the activity. |

#### Command Example

```!cyberark-pas-account-get-list-activity account_id= 89_3```

#### Context Example

{
“CyberArkPAS”: {
“Activities”: [
{
“Action”: “Rename File”,
“ActionID”: 124,
“Alert”: false,
“ClientID”: “1”,
“Date”: 1597863265,
“MoreInfo”: “NewName”,

cyberark-pas-account-delete

Delete a specific account in the vault.

Base Command

cyberark-pas-account-delete

Input

Argument Name Description Required
account_id The unique ID of the account to delete. Required

Context Output

Path Type Description
CyberArkPAS.Accounts.id String The unique ID of the account.
CyberArkPAS.Accounts.secretManagement String Whether the account secret is automatically managed by the CPM.
CyberArkPAS.Accounts.address String The name or address of the machine where the account will be used.
CyberArkPAS.Accounts.secretType String The type of password.
CyberArkPAS.Accounts.safeName String The safe where the account was created.
CyberArkPAS.Accounts.userName String The user name of the account.
CyberArkPAS.Accounts.Deleted Boolean Whether the account was deleted.

Context Output

Path Type Description
CyberArkPAS.Accounts.id String The unique ID of the account.
CyberArkPAS.Accounts.categoryModificationTime Number The date the account was last modified.
CyberArkPAS.Accounts.createdTime Number The date the account was created.
CyberArkPAS.Accounts.name String The name of the account.
CyberArkPAS.Accounts.platformId String The platform assigned to this account.
CyberArkPAS.Accounts.safeName String The safe where the account is created.
CyberArkPAS.Accounts.secretManagement String Whether the account secret is automatically managed by the CPM.
CyberArkPAS.Accounts.secretType String The type of password.
CyberArkPAS.Accounts.userName String The name of the account user.
CyberArkPAS.Accounts.address String The name or address of the machine where the account will be used.

Command Example

!cyberark-pas-account-get-details account_id=46_7

Context Example

{
    "CyberArkPAS": {
        "Accounts": {
            "address": "address.com",
            "categoryModificationTime": 1597581174,
            "createdTime": 1595431869,
            "id": "46_7",
            "name": "Operating System-UnixSSH",
            "platformAccountProperties": {
                "Tags": "SSH",
                "UseSudoOnReconcile": "No"
            },
            "platformId": "UnixSSH",
            "safeName": "Linux Accounts",
            "secretManagement": {
                "automaticManagementEnabled": true,
                "lastModifiedTime": 1595417469,
                "lastReconciledTime": 1576120341,
                "status": "success"
            },
            "secretType": "password",
            "userName": "user1"
        }
    }
}

Human Readable Output

Results

address categoryModificationTime createdTime id name platformAccountProperties platformId safeName secretManagement secretType userName
address 1597581174 1595431869 46_7 Operating System-UnixSSH UseSudoOnReconcile: No
Tags: SSH		 UnixSSH Linux Accounts automaticManagementEnabled: true
status: success
lastModifiedTime: 1595417469
lastReconciledTime: 1576120341		 password user1

cyberark-pas-credentials-change-in-vault-only

Enable users to set account credentials and change them in the vault.

To run this command, you must have Update Password Value credentials in the Safe where the privileged account is stored.

Base Command

cyberark-pas-credentials-change-in-vault-only

Input

Argument Name Description Required
account_id The unique ID of the account. Required
new_credentials The new account credentials that will be allocated to the account in the vault. Required

Context Output

There is no context output for this command.

Command Example

!cyberark-pas-credentials-change-in-vault-only account_id=89_4 new_credentials=1234Asw

Human Readable Output

The password in the account 89_4 was changed

cyberark-pas-credentials-verify

Mark an account for verification by the Central Policy Manager (CPM).

To run this command, you must have Initiate CPM password management operations permission in the Safe where the privileged account is stored.

Base Command

cyberark-pas-credentials-verify

Input

Argument Name Description Required
account_id The unique ID of the account. Required

Context Output

There is no context output for this command.

Command Example

!cyberark-pas-credentials-verify account_id=89_4

Human Readable Output

The account 89_4 was marked for verification by the CPM

cyberark-pas-credentials-reconcile

Mark an account for automatic reconciliation by the Central Policy Manager (CPM).

To run this command, you must have Initiate CPM password management operations permission in the Safe where the privileged account is stored.

Base Command

cyberark-pas-credentials-reconcile

Input

Argument Name Description Required
account_id The unique ID of the account. Required

Context Output

There is no context output for this command.

Command Example

!cyberark-pas-credentials-reconcile account_id=89_4

Human Readable Output

The account 89_4 was marked for automatic reconciliation by the CPM.

cyberark-pas-credentials-change-random-password

Mark an account for an immediate credentials change by the CPM to a new random value.

To run this command, you must have the following permissions in the Safe where the privileged account is stored:

  • Initiate CPM password management operations
  • Specify next password value

Base Command

cyberark-pas-credentials-change-random-password

Input

Argument Name Description Required
account_id The unique ID of the account. Required

Context Output

There is no context output for this command.

Command Example

!cyberark-pas-credentials-change-random-password account_id=89_4

Human Readable Output

The password in the account 89_4 was changed

cyberark-pas-credentials-change-set-new-password

Enable users to set the account’s credentials to use for the next Central Policy Manager (CPM) change.

To run this command, you must have Update Password Value credentials in the Safe where the privileged account is stored.

Base Command

cyberark-pas-credentials-change-set-new-password

Input

Argument Name Description Required
account_id The unique ID of the account. Required
new_credentials The new account credentials that will be allocated to the account in the vault. Required

Context Output

There is no context output for this command.

Command Example

!cyberark-pas-credentials-change-set-new-password account_id=89_4

Human Readable Output

The password in the account 89_4 was changed

cyberark-pas-security-events-get

Return all Privileged Threat Analytics (PTA) security events.

Base Command

cyberark-pas-security-events-get

Input

Argument Name Description Required
start_time The starting date to get the security events from. Must be in the following timestamp format:
(<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year).		 Required
limit The number of events that will be shown, from newest to oldest. Default is ‘50’. Optional

Context Output

Path Type Description
CyberArkPAS.SecurityEvents.id Number The unique ID of the security events.
CyberArkPAS.SecurityEvents.additionalData String Additional data about the security events.
CyberArkPAS.SecurityEvents.audits.createTime Number The time the security events were created.
CyberArkPAS.SecurityEvents.lastUpdateTime Number The last update time of the security events.
CyberArkPAS.SecurityEvents.mStatus String The status of the security events.
CyberArkPAS.SecurityEvents.score Number The score of the security events.
CyberArkPAS.SecurityEvents.type String The type of the security events.

Command Example

!cyberark-pas-security-events-get start_time="3 days" limit=2

Context Example

{
    "CyberArkPAS": {
        "SecurityEvents": [
            {
                "additionalData": {
                    "reason": "ip",
                    "station": "1.1.1.1",
                    "vault_user": "administrator"                
                },
                "audits": [
                    {
                        "action": "Logon",
                        "cloudData": {},
                        "createTime": 1597864497000,
                        "id": "1a2b3c4d",
                        "sensorType": "VAULT",
                        "source": {
                            "mOriginalAddress": "1.1.1.1",
                            "mResolvedAddress": {
                                "mAddress": "1.1.1.1",
                                "mFqdn": "1-2-3-4",
                                "mHostName": "1-2-3-4",
                                "mOriginalAddress": "1.1.1.1",
                            }
                        },
                        "type": "VAULT_LOGON",
                        "vaultUser": "Administrator"
                    }
                ],
                "createTime": 1597864497000,
                "id": "1",
                "lastUpdateTime": 1597864497000,
                "mStatus": "OPEN",
                "score": 25.751749103263528,
                "type": "VaultViaIrregularIp"
            },
            {
                "additionalData": {
                    "reason": "ip",
                    "station": "1.1.1.1",
                    "vault_user": "administrator"
                },
                "audits": [
                    {
                        "action": "Logon",
                        "cloudData": {},
                        "createTime": 1597864209000,
                        "id": "5f3d7911e4b0b8d4ac363b1b",
                        "sensorType": "VAULT",
                        "source": {
                            "mOriginalAddress": "1.1.1.1",
                            "mResolvedAddress": {
                                "mAddress": "1.1.1.1",
                                "mFqdn": "1-2-3-4",
                                "mHostName": "1-2-3-4",
                                "mOriginalAddress": "1.1.1.1",
                            }
                        },
                        "type": "VAULT_LOGON",
                        "vaultUser": "Administrator"
                    }
                ],
                "createTime": 1597864209000,
                "id": "2",
                "lastUpdateTime": 1597864209000,
                "mStatus": "OPEN",
                "score": 25.751749103263528,
                "type": "VaultViaIrregularIp"
            }
        ]
    }
}

Human Readable Output

Results

additionalData audits createTime id lastUpdateTime mStatus score type
station: 1.1.1.1
reason: ip
vault_user: administrator		 {‘id’: ‘1’, ‘type’: ‘VAULT_LOGON’, ‘sensorType’: ‘VAULT’, ‘action’: ‘Logon’, ‘createTime’: 1597864497000, ‘vaultUser’: ‘Administrator’, ‘source’: {‘mOriginalAddress’: ‘1.1.1.1’, ‘mResolvedAddress’: {‘mOriginalAddress’: ‘1.1.1.1’, ‘mAddress’: ‘1.1.1.1’, ‘mHostName’: ‘1-2-3-4’, ‘mFqdn’: ‘1-2-3-4’}}, ‘cloudData’: {}} 1597864497000 1 1597864497000 OPEN 25.751749103263528 VaultViaIrregularIp
station: 1.1.1.1
reason: ip
vault_user: administrator		 {‘id’: ‘2’, ‘type’: ‘VAULT_LOGON’, ‘sensorType’: ‘VAULT’, ‘action’: ‘Logon’, ‘createTime’: 1597864209000, ‘vaultUser’: ‘Administrator’, ‘source’: {‘mOriginalAddress’: ‘1.1.1.1’, ‘mResolvedAddress’: {‘mOriginalAddress’: ‘1.1.1.1’, ‘mAddress’: ‘1.1.1.1’, ‘mHostName’: ‘1-2-3-4’, ‘mFqdn’: ‘1-2-3-4’}}, ‘cloudData’: {}} 1597864209000 2 1597864209000 OPEN 25.751749103263528 VaultViaIrregularIp

cyberark-pas-account-add

Add a new privileged account or SSH key to the vault.

Base Command

cyberark-pas-account-add

Input

Argument Name Description Required
account_name The name of the account. Required
address The name or address of the machine where the account will be used. Required
platform_id The platform assigned to this account. Required
safe_name The name of the safe where the account will be created. Required
secret_type The type of password. Valid values are: ‘password’, ‘key’. Default is ‘password’. Possible values are: password, key. Default is password. Optional
username The The user name of the account. Required
password The password that the user will use to log on for the first time. Required
properties Object containing key-value pairs to associate with the account, as defined by the account platform.
e.g., {“Location”: “IT”, “OwnerName”: “MSSPAdmin”}.		 Optional
automatic_management_enabled Whether the account secret is automatically managed by the Central Policy Manager (CPM). Can be ‘true’ or ‘false’. Default is ‘true’. Possible values are: true, false. Default is true. Optional
manual_management_reason The reason for disabling automatic secret management. Optional
remote_machines List of remote machines, separated by semicolons.
e.g., server1.cyberark.com;server2.cyberark.com.		 Optional
access_restricted_to_remote_machines Whether or not to restrict access to specified remote machines only. Can be ‘true’ or ‘false’. Default is: ‘true’. Possible values are: true, false. Default is true. Optional

Context Output

Path Type Description
CyberArkPAS.Accounts.id String The unique ID of the account.
CyberArkPAS.Accounts.categoryModificationTime Number The last modified date of the account.
CyberArkPAS.Accounts.createdTime Number The date the account was created.
CyberArkPAS.Accounts.name String The name of the account.
CyberArkPAS.Accounts.platformId String The platform assigned to this account.
CyberArkPAS.Accounts.safeName String The safe where the account is created.
CyberArkPAS.Accounts.secretManagement String Whether the account secret is automatically managed by the CPM.
CyberArkPAS.Accounts.secretType String The type of password.
CyberArkPAS.Accounts.userName String The name of the account user.
CyberArkPAS.Accounts.address String The name or address of the machine where the account will be used.

Configuration parameters

  • url — Server URL (e.g., https://example.net) (required)
  • credentials — Username (required)
  • isFetch — Fetch incidents
  • max_fetch — Max fetch
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • score — CyberArk PAM score (0.0-100.0)
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (26)

  • cyberark-pas-account-add

    Add a new privileged account or SSH key to the vault.

  • cyberark-pas-account-delete

    Delete a specific account in the vault.

  • cyberark-pas-account-get-details

    Returns information for the specified account, identified by the account ID.

  • cyberark-pas-account-get-list-activity

    Returns the activities of a specific account that is identified by its account ID.

  • cyberark-pas-account-update

    Update the details of an existing account.

  • cyberark-pas-accounts-list

    Return a list of all the accounts in the vault.

  • cyberark-pas-credentials-change-in-vault-only

    Enable users to set account credentials and change them in the vault.

  • cyberark-pas-credentials-change-random-password

    Mark an account for an immediate credentials change by the CPM to a new random value.

  • cyberark-pas-credentials-change-set-new-password

    Enable users to set the account's credentials to use for the next Central Policy Manager (CPM) change.

  • cyberark-pas-credentials-reconcile

    Mark an account for automatic reconciliation by the Central Policy Manager (CPM).

  • cyberark-pas-credentials-verify

    Mark an account for verification by the Central Policy Manager (CPM).

  • cyberark-pas-safe-add

    Add a new safe to the vault.

  • cyberark-pas-safe-delete

    Delete a safe from the vault.

  • cyberark-pas-safe-get-by-name

    Return information about a specific safe in the vault.

  • cyberark-pas-safe-member-add

    Add an existing user as a safe member.

  • cyberark-pas-safe-member-delete

    Remove a specific member from a safe.

  • cyberark-pas-safe-member-update

    Update an existing safe member.

  • cyberark-pas-safe-members-list

    Return a list of the members of the safe.

  • cyberark-pas-safe-update

    Update a single safe in the vault.

  • cyberark-pas-safes-list

    Return information about all of the user’s safes in the vault.

  • cyberark-pas-security-events-get

    Return all Privileged Threat Analytics (PTA) security events.

  • cyberark-pas-user-activate

    Activate an existing vault user who was suspended after entering incorrect credentials multiple times.

  • cyberark-pas-user-add

    Add a new user to the vault.

  • cyberark-pas-user-delete

    Delete a specific user in the vault.

  • cyberark-pas-user-update

    Update an existing vault user.

  • cyberark-pas-users-list

    Return a list of all existing users in the vault that meet the filter and search criteria.

Source

CyberArkPAS.py CyberArkPAS_test.py CyberArkPAS.yml CyberArkPAS_description.md command_examples.txt
Download History Raw 
import pytest

from CyberArkPAS import (
    Client,
    add_user_command,
    get_users_command,
    update_user_command,
    add_safe_command,
    update_safe_command,
    get_list_safes_command,
    get_safe_by_name_command,
    add_safe_member_command,
    update_safe_member_command,
    list_safe_members_command,
    add_account_command,
    update_account_command,
    get_list_accounts_command,
    get_list_account_activity_command,
    fetch_incidents,
    get_account_details_command,
    order_properties_to_dict,
)
from test_data.context import (
    ADD_USER_CONTEXT,
    GET_USERS_CONTEXT,
    UPDATE_USER_CONTEXT,
    UPDATE_SAFE_CONTEXT,
    GET_LIST_SAFES_CONTEXT,
    GET_SAFE_BY_NAME_CONTEXT,
    ADD_SAFE_CONTEXT,
    ADD_SAFE_MEMBER_CONTEXT,
    UPDATE_SAFE_MEMBER_CONTEXT,
    LIST_SAFE_MEMBER_CONTEXT,
    ADD_ACCOUNT_CONTEXT,
    UPDATE_ACCOUNT_CONTEXT,
    GET_LIST_ACCOUNT_CONTEXT,
    GET_LIST_ACCOUNT_ACTIVITIES_CONTEXT,
    INCIDENTS,
    INCIDENTS_AFTER_FETCH,
    INCIDENTS_LIMITED_BY_MAX_SIZE,
    INCIDENTS_FILTERED_BY_SCORE,
    GET_ACCOUNT_CONTEXT,
)
from test_data.http_resonses import (
    ADD_USER_RAW_RESPONSE,
    UPDATE_USER_RAW_RESPONSE,
    GET_USERS_RAW_RESPONSE,
    ADD_SAFE_RAW_RESPONSE,
    UPDATE_SAFE_RAW_RESPONSE,
    GET_LIST_SAFES_RAW_RESPONSE,
    GET_SAFE_BY_NAME_RAW_RESPONSE,
    ADD_SAFE_MEMBER_RAW_RESPONSE,
    UPDATE_SAFE_MEMBER_RAW_RESPONSE,
    LIST_SAFE_MEMBER_RAW_RESPONSE,
    ADD_ACCOUNT_RAW_RESPONSE,
    UPDATE_ACCOUNT_RAW_RESPONSE,
    GET_LIST_ACCOUNT_RAW_RESPONSE,
    GET_LIST_ACCOUNT_ACTIVITIES_RAW_RESPONSE,
    GET_SECURITY_EVENTS_RAW_RESPONSE,
    GET_SECURITY_EVENTS_WITH_UNNECESSARY_INCIDENT_RAW_RESPONSE,
    GET_SECURITY_EVENTS_WITH_15_INCIDENT_RAW_RESPONSE,
    GET_ACCOUNT_RAW_RESPONSE,
)

ADD_USER_ARGS = {
    "change_password_on_the_next_logon": "true",
    "description": "new user for test",
    "email": "usertest@test.com",
    "enable_user": "true",
    "first_name": "user",
    "last_name": "test",
    "password": "12345Aa",
    "password_never_expires": "false",
    "profession": "testing integrations",
    "username": "TestUser",
}

UPDATE_USER_ARGS = {
    "change_password_on_the_next_logon": "true",
    "description": "updated description",
    "email": "update@test.com",
    "enable_user": "true",
    "first_name": "test1",
    "last_name": "updated-name",
    "password_never_expires": "false",
    "profession": "test1",
    "user_id": "123",
    "username": "TestUser1",
}

GET_USER_ARGS = {"filter": "filteroption", "search": "searchoption"}

ADD_SAFE_ARGS = {"description": "safe for tests", "number_of_days_retention": "100", "safe_name": "TestSafe"}

UPDATE_SAFE_ARGS = {
    "description": "UpdatedSafe",
    "number_of_days_retention": "150",
    "safe_name": "TestSafe",
    "safe_new_name": "UpdatedName",
}

GET_SAFE_BY_NAME_ARGS = {"safe_name": "TestSafe"}

ADD_SAFE_MEMBER_ARGS = {
    "member_name": "TestUser",
    "requests_authorization_level": "0",
    "safe_name": "TestSafe",
    "permissions": ["ManageSafeMembers"],
}

UPDATE_SAFE_MEMBER_ARGS = {
    "member_name": "TestUser",
    "permissions": "UseAccounts",
    "requests_authorization_level": "0",
    "safe_name": "TestSafe",
}

LIST_SAFE_MEMBER_ARGS = {"safe_name": "TestSafe"}

ADD_ACCOUNT_ARGS = {
    "account_name": "TestAccount1",
    "address": "/",
    "automatic_management_enabled": "true",
    "password": "12345Aa",
    "platform_id": "WinServerLocal",
    "safe_name": "TestSafe",
    "secret_type": "password",
    "username": "TestUser",
}

UPDATE_ACCOUNT_ARGS = {"account_id": "77_4", "account_name": "NewName"}

GET_ACCOUNT_ARGS = {
    "account_id": "11_1",
}

GET_LIST_ACCOUNT_ARGS = {"limit": "2", "offset": "0"}

GET_LIST_ACCOUNT_ACTIVITIES_ARGS = {"account_id": "77_4"}


@pytest.mark.parametrize(
    "command, args, http_response, context",
    [
        (add_user_command, ADD_USER_ARGS, ADD_USER_RAW_RESPONSE, ADD_USER_CONTEXT),
        (update_user_command, UPDATE_USER_ARGS, UPDATE_USER_RAW_RESPONSE, UPDATE_USER_CONTEXT),
        (get_users_command, {}, GET_USERS_RAW_RESPONSE, GET_USERS_CONTEXT),
        (add_safe_command, ADD_SAFE_ARGS, ADD_SAFE_RAW_RESPONSE, ADD_SAFE_CONTEXT),
        (update_safe_command, UPDATE_SAFE_ARGS, UPDATE_SAFE_RAW_RESPONSE, UPDATE_SAFE_CONTEXT),
        (get_list_safes_command, {}, GET_LIST_SAFES_RAW_RESPONSE, GET_LIST_SAFES_CONTEXT),
        (get_safe_by_name_command, GET_SAFE_BY_NAME_ARGS, GET_SAFE_BY_NAME_RAW_RESPONSE, GET_SAFE_BY_NAME_CONTEXT),
        (add_safe_member_command, ADD_SAFE_MEMBER_ARGS, ADD_SAFE_MEMBER_RAW_RESPONSE, ADD_SAFE_MEMBER_CONTEXT),
        (update_safe_member_command, UPDATE_SAFE_MEMBER_ARGS, UPDATE_SAFE_MEMBER_RAW_RESPONSE, UPDATE_SAFE_MEMBER_CONTEXT),
        (list_safe_members_command, LIST_SAFE_MEMBER_ARGS, LIST_SAFE_MEMBER_RAW_RESPONSE, LIST_SAFE_MEMBER_CONTEXT),
        (add_account_command, ADD_ACCOUNT_ARGS, ADD_ACCOUNT_RAW_RESPONSE, ADD_ACCOUNT_CONTEXT),
        (update_account_command, UPDATE_ACCOUNT_ARGS, UPDATE_ACCOUNT_RAW_RESPONSE, UPDATE_ACCOUNT_CONTEXT),
        (get_account_details_command, GET_ACCOUNT_ARGS, GET_ACCOUNT_RAW_RESPONSE, GET_ACCOUNT_CONTEXT),
        (get_list_accounts_command, GET_LIST_ACCOUNT_ARGS, GET_LIST_ACCOUNT_RAW_RESPONSE, GET_LIST_ACCOUNT_CONTEXT),
        (
            get_list_account_activity_command,
            GET_LIST_ACCOUNT_ACTIVITIES_ARGS,
            GET_LIST_ACCOUNT_ACTIVITIES_RAW_RESPONSE,
            GET_LIST_ACCOUNT_ACTIVITIES_CONTEXT,
        ),
    ],
)
def test_cyberark_pas_commands(command, args, http_response, context, mocker):
    """Unit test
    Given
    - demisto args
    - raw response of the http request
    When
    - mock the http request result
    Then
    - create the context
    - validate the expected_result and the created context
    """
    mocker.patch.object(Client, "_generate_token")
    client = Client(
        server_url="https://api.cyberark.com/", username="user1", password="12345", use_ssl=False, proxy=False, max_fetch=50
    )

    mocker.patch.object(Client, "_http_request", return_value=http_response)

    outputs = command(client, **args)
    results = outputs.to_context()

    assert results.get("EntryContext") == context


def test_fetch_incidents(mocker):
    """Unit test
    Given
    - raw response of the http request
    When
    - mock the http request result as 5 results that are sorted from the newest to the oldest
    Then
    - as defined in the demisto params - show only 2, those should be the oldest 2 available
    - validate the incidents values
    """
    mocker.patch.object(Client, "_generate_token")
    client = Client(
        server_url="https://api.cyberark.com/", username="user1", password="12345", use_ssl=False, proxy=False, max_fetch=50
    )

    mocker.patch.object(Client, "_http_request", return_value=GET_SECURITY_EVENTS_RAW_RESPONSE)

    _, incidents = fetch_incidents(client, {}, "3 days", "0", "2")
    assert incidents == INCIDENTS


def test_fetch_incidents_with_an_incident_that_was_shown_before(mocker):
    """Unit test
    Given
    - demisto params
    - raw response of the http request
    When
    - mock the http request result while one of the incidents was shown in the previous run
    Then
    - validate the incidents values, make sure the event that was shown before is not in
    the incidents again
    """
    mocker.patch.object(Client, "_generate_token")
    client = Client(
        server_url="https://api.cyberark.com/", username="user1", password="12345", use_ssl=False, proxy=False, max_fetch=50
    )

    mocker.patch.object(Client, "_http_request", return_value=GET_SECURITY_EVENTS_WITH_UNNECESSARY_INCIDENT_RAW_RESPONSE)
    # the last run dict is the same we would have got if we run the prev test before
    last_run = {"time": 1594573600000, "last_event_ids": '["5f0b3064e4b0ba4baf5c1113", "5f0b4320e4b0ba4baf5c2b05"]'}
    _, incidents = fetch_incidents(client, last_run, "3 days", "0", "1")
    assert incidents == INCIDENTS_AFTER_FETCH


def test_fetch_incidents_with_more_incidents_than_max_size(mocker):
    """Unit test
    Given
    - demisto params
    - raw response of the http request
    When
    - mock the http request result while the result is 15 incidents and we only wish to see 5
    Then
    - validate the incidents values, make sure make sure that there are only 5 incidents and that there
     are the oldest
    """
    mocker.patch.object(Client, "_generate_token")
    client = Client(
        server_url="https://api.cyberark.com/", username="user1", password="12345", use_ssl=False, proxy=False, max_fetch=5
    )

    mocker.patch.object(Client, "_http_request", return_value=GET_SECURITY_EVENTS_WITH_15_INCIDENT_RAW_RESPONSE)
    _, incidents = fetch_incidents(client, {}, "3 days", "0", max_fetch="5")
    assert len(incidents) == 5
    assert incidents == INCIDENTS_LIMITED_BY_MAX_SIZE


def test_fetch_incidents_with_specific_score(mocker):
    """Unit test
    Given
    - demisto params
    - raw response of the http request
    When
    - mock the http request result while the result is 15 incidents and we only wish to see 5
    Then
    - validate the incidents values, make sure make sure that there are only 5 incidents and that there
     are the oldest
    """
    mocker.patch.object(Client, "_generate_token")
    client = Client(
        server_url="https://api.cyberark.com/", username="user1", password="12345", use_ssl=False, proxy=False, max_fetch=10
    )

    mocker.patch.object(Client, "_http_request", return_value=GET_SECURITY_EVENTS_WITH_15_INCIDENT_RAW_RESPONSE)
    _, incidents = fetch_incidents(client, {}, "3 days", score="50", max_fetch="10")
    assert len(incidents) == 3
    assert incidents == INCIDENTS_FILTERED_BY_SCORE


@pytest.mark.parametrize("permission_exist", [True, False])
def test_add_safe_member_permissions_validate(mocker, permission_exist):
    """
    Given
    - Permissions.
    When
    - calling *add_safe_member* method.
    Then
    - Validate ManageSafeMembers was set in http body permission list.
    """
    args = ADD_SAFE_MEMBER_ARGS
    mocker.patch.object(Client, "_generate_token")
    client = Client(
        server_url="https://api.cyberark.com/", username="user1", password="12345", use_ssl=False, proxy=False, max_fetch=50
    )
    mock = mocker.patch.object(Client, "_http_request")
    if not permission_exist:
        args.get("permissions").remove("ManageSafeMembers")
    add_safe_member_command(client, **args)
    permissions = mock.call_args[1].get("json_data").get("member").get("Permissions")
    for permission in permissions:
        if "ManageSafeMembers" in permission.get("Key"):
            assert permission.get("Value") == permission_exist


V11_RESPONSE_SAFES_1 = {
    "Safes": [
        {
            "safeUrlId": "Test",
            "safeName": "Test",
            "safeNumber": 2,
            "description": "",
            "location": "\\",
            "creator": {"memberId": "2", "memberName": "Administrator"},
            "olacEnabled": False,
            "managingCPM": "",
            "numberOfVersionsRetention": None,
            "numberOfDaysRetention": 30,
            "autoPurgeEnabled": False,
            "creationTime": 00000,
            "lastModificationTime": 000000,
            "isExpiredMember": False,
        },
    ],
    "Total": 1769,
    "nextLink": "example.com",
}
V12_RESPONSE_SAFES_1 = {
    "value": [
        {
            "safeUrlId": "Test",
            "safeName": "Test",
            "safeNumber": 2,
            "description": "",
            "location": "\\",
            "creator": {"memberId": "2", "memberName": "Administrator"},
            "olacEnabled": False,
            "managingCPM": "",
            "numberOfVersionsRetention": None,
            "numberOfDaysRetention": 30,
            "autoPurgeEnabled": False,
            "creationTime": 00000,
            "lastModificationTime": 000000,
            "isExpiredMember": False,
        },
    ],
    "count": 1769,
    "nextLink": "example.com",
}
COUNT_1 = "1769"
OUTPUT_1 = [
    {
        "safeUrlId": "Test",
        "safeName": "Test",
        "safeNumber": 2,
        "description": "",
        "location": "\\",
        "creator": {"memberId": "2", "memberName": "Administrator"},
        "olacEnabled": False,
        "managingCPM": "",
        "numberOfVersionsRetention": None,
        "numberOfDaysRetention": 30,
        "autoPurgeEnabled": False,
        "creationTime": 0,
        "lastModificationTime": 0,
        "isExpiredMember": False,
    }
]


@pytest.mark.parametrize(
    "response, count_or_total, expected_output",
    [(V11_RESPONSE_SAFES_1, COUNT_1, OUTPUT_1), (V12_RESPONSE_SAFES_1, COUNT_1, OUTPUT_1)],
)
def test_pas_safes_list(mocker, response: dict, count_or_total: str, expected_output: list[dict]):
    """
    Given:
        - Response to cyberark-pas-safes-list command (in either the API <=v11 version, or the >=v12 format)
        - Expected count/ total value
        - Expected output
    When:
        - cyberark-pas-safes-list is executed
    Then:
        - Ensure the readable_output contains the correct total/count and not None according to the response's structure
        - Ensure the output matches what is expected
    """
    mocker.patch.object(Client, "_generate_token")
    client = Client(
        server_url="https://api.cyberark.com/", username="user1", password="12345", use_ssl=False, proxy=False, max_fetch=50
    )
    mocker.patch.object(client, "get_list_safes", return_value=response)
    results = get_list_safes_command(client=client)
    assert count_or_total in results.readable_output
    assert results.outputs == expected_output


V11_RESPONSE_SAFES_2 = {
    "SafeMembers": [
        {
            "safeUrlId": "",
            "safeName": "Test",
            "safeNumber": 1,
            "memberId": 1,
            "memberName": "Example",
            "memberType": "Example",
            "membershipExpirationDate": None,
            "isExpiredMembershipEnable": False,
            "isPredefinedUser": True,
            "permissions": {
                "useAccounts": True,
                "retrieveAccounts": True,
                "listAccounts": True,
                "addAccounts": True,
                "updateAccountContent": True,
                "updateAccountProperties": True,
                "initiateCPMAccountManagementOperations": True,
                "specifyNextAccountContent": True,
                "renameAccounts": True,
                "deleteAccounts": True,
                "unlockAccounts": True,
                "manageSafe": True,
                "manageSafeMembers": True,
                "backupSafe": True,
                "viewAuditLog": True,
                "viewSafeMembers": True,
                "accessWithoutConfirmation": True,
                "createFolders": True,
                "deleteFolders": True,
                "moveAccountsAndFolders": True,
                "requestsAuthorizationLevel1": False,
                "requestsAuthorizationLevel2": False,
            },
        }
    ],
    "Total": 8,
}
V12_RESPONSE_SAFES_2 = {
    "value": [
        {
            "safeUrlId": "",
            "safeName": "Test",
            "safeNumber": 1,
            "memberId": 1,
            "memberName": "Example",
            "memberType": "Example",
            "membershipExpirationDate": None,
            "isExpiredMembershipEnable": False,
            "isPredefinedUser": True,
            "permissions": {
                "useAccounts": True,
                "retrieveAccounts": True,
                "listAccounts": True,
                "addAccounts": True,
                "updateAccountContent": True,
                "updateAccountProperties": True,
                "initiateCPMAccountManagementOperations": True,
                "specifyNextAccountContent": True,
                "renameAccounts": True,
                "deleteAccounts": True,
                "unlockAccounts": True,
                "manageSafe": True,
                "manageSafeMembers": True,
                "backupSafe": True,
                "viewAuditLog": True,
                "viewSafeMembers": True,
                "accessWithoutConfirmation": True,
                "createFolders": True,
                "deleteFolders": True,
                "moveAccountsAndFolders": True,
                "requestsAuthorizationLevel1": False,
                "requestsAuthorizationLevel2": False,
            },
        }
    ],
    "count": 8,
}
COUNT_2 = "8"
OUTPUT_2 = [
    {
        "safeUrlId": "",
        "safeName": "Test",
        "safeNumber": 1,
        "memberId": 1,
        "memberName": "Example",
        "memberType": "Example",
        "membershipExpirationDate": None,
        "isExpiredMembershipEnable": False,
        "isPredefinedUser": True,
        "permissions": {
            "useAccounts": True,
            "retrieveAccounts": True,
            "listAccounts": True,
            "addAccounts": True,
            "updateAccountContent": True,
            "updateAccountProperties": True,
            "initiateCPMAccountManagementOperations": True,
            "specifyNextAccountContent": True,
            "renameAccounts": True,
            "deleteAccounts": True,
            "unlockAccounts": True,
            "manageSafe": True,
            "manageSafeMembers": True,
            "backupSafe": True,
            "viewAuditLog": True,
            "viewSafeMembers": True,
            "accessWithoutConfirmation": True,
            "createFolders": True,
            "deleteFolders": True,
            "moveAccountsAndFolders": True,
            "requestsAuthorizationLevel1": False,
            "requestsAuthorizationLevel2": False,
        },
    }
]


@pytest.mark.parametrize(
    "response, count_or_total, expected_output",
    [(V11_RESPONSE_SAFES_2, COUNT_2, OUTPUT_2), (V12_RESPONSE_SAFES_2, COUNT_2, OUTPUT_2)],
)
def test_pas_safe_members_list(mocker, response: dict, count_or_total: str, expected_output: list[dict]):
    """
    Given:
        - Response to cyberark-pas-safe-members-list command (in either the <=V11 version, or the >=V12 format)
        - Expected count/ total value
        - Expected output
    When:
        - cyberark-pas-safe-members-list is executed
    Then:
        - Ensure the readable_output contains the correct total/count and not None according to the response's structure
        - Ensure the output matches what is expected
    """
    mocker.patch.object(Client, "_generate_token")
    client = Client(
        server_url="https://api.cyberark.com/", username="user1", password="12345", use_ssl=False, proxy=False, max_fetch=50
    )
    mocker.patch.object(client, "list_safe_members", return_value=response)
    results = list_safe_members_command(client=client, safe_name="Test")
    assert count_or_total in results.readable_output
    assert results.outputs == expected_output


@pytest.mark.parametrize(
    "properties,expected",
    [({}, {}), ({"a": 1}, {"a": 1}), ({"a": 1}, {"a": 1}), ("{'a': 1}", {"a": 1}), ('{"a": 1}', {"a": 1}), ("", {})],
)
def test_order_properties_to_dict(properties, expected):
    """
    Given:
        - properties as input
    When:
        - order_properties_to_dict is called on properties
    Then:
        - it returns the expected output
    """
    assert order_properties_to_dict(properties) == expected


@pytest.mark.parametrize(
    "properties,expected",
    [
        ("not json", ValueError),
    ],
)
def test_order_properties_to_dict_failure(properties, expected):
    """
    Given:
        - Invalid properties as input
    When:
        - order_properties_to_dict is called on properties
    Then:
        - An error is raised
    """
    with pytest.raises(expected):
        order_properties_to_dict(properties)