DeepInstinct v3

Details

ID	`DeepInstinct v3`
Provider	Deep Instinct
Category	Endpoint
From Version	6.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Deep Instinct is a prevention-first approach to stopping ransomware and other malware using the world’s first purpose-built, deep learning cybersecurity framework.
This integration was integrated and tested with version 3.3.x of DeepInstinct v3

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure DeepInstinct v3 in Cortex

Parameter	Required
Base server URL	True
API Key	True
First event ID to fetch from	False
Fetch incidents	False
Incidents Fetch Interval	False
Incident type	False
Trust any certificate (not secure)	False
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

deepinstinctv3-get-device

Get device information from its ID

Base Command

deepinstinctv3-get-device

Input

Argument Name	Description	Required
device_id	Get device information from its ID.	Required

Context Output

Path	Type	Description
deepinstinctv3.devices.ID	number	Device ID
deepinstinctv3.devices.os	string	Device OS
deepinstinctv3.devices.osv	string	Device OS version
deepinstinctv3.devices.ip_address	string	Device IP address
deepinstinctv3.devices.email	sting	Device email ip_address
deepinstinctv3.devices.mac_address	string	Device mac address
deepinstinctv3.devices.hostname	string	Device hostname
deepinstinctv3.devices.domain	string	Device domain
deepinstinctv3.devices.scanned_files	number	Num of device scanned files
deepinstinctv3.devices.comment	string	Device comment
deepinstinctv3.devices.tag	string	Device tag
deepinstinctv3.devices.connectivity_status	string	Device connectivity status
deepinstinctv3.devices.deployment_status	string	Device deployment status
deepinstinctv3.devices.deployment_status_last_update	string	Device last client version update
deepinstinctv3.devices.license_status	string	Device license status
deepinstinctv3.devices.last_registration	string	Device last registration datetime
deepinstinctv3.devices.last_contact	string	Device last contact datetime
deepinstinctv3.devices.distinguished_name	string	Device distinguished name
deepinstinctv3.devices.group_name	string	Device group name
deepinstinctv3.devices.group_id	number	Device group ID
deepinstinctv3.devices.policy_name	string	Device policy name
deepinstinctv3.devices.policy_id	number	Device policy ID
deepinstinctv3.devices.log_status	string	Device log status
deepinstinctv3.devices.agent_version	string	Device agent version
deepinstinctv3.devices.brain_version	string	Device brain version
deepinstinctv3.devices.logged_in_users	string	Device logged in user(s)
deepinstinctv3.devices.msp_name	string	Device msp name
deepinstinctv3.devices.msp_id	number	Device msp ID
deepinstinctv3.devices.tenant_name	string	Device tenant name
deepinstinctv3.devices.tenant_id	number	Device tenant ID

deepinstinctv3-get-events

Get all events after given event ID

Base Command

deepinstinctv3-get-events

Input

Argument Name	Description	Required
first_event_id	Get all events. Max events in response is 50, use first_event_id parameter to define first event id to get. Default is 0.	Required

Context Output

Path	Type	Description
deepinstinctv3.Events.events.id	number	event ID
deepinstinctv3.Events.events.device_id	number	event device ID
deepinstinctv3.Events.events.timestamp	string	event timestamp from device
deepinstinctv3.Events.events.insertion_timestamp	string	event timestamp from console
deepinstinctv3.Events.events.close_timestamp	string	event closed timestamp
deepinstinctv3.Events.events.last_action	string	event last last_action
deepinstinctv3.Events.events.status	string	event status
deepinstinctv3.Events.events.comment	string	event comment
deepinstinctv3.Events.events.recorded_device_info	unknown	event device information
deepinstinctv3.Events.events.msp_name	string	event msp name
deepinstinctv3.Events.events.msp_id	number	event msp id
deepinstinctv3.Events.events.tenant_name	string	event tenant name
deepinstinctv3.Events.events.tenant_id	number	event tenant id
deepinstinctv3.Events.events.mitre_classifications	unknown	event MITRE classification
deepinstinctv3.Events.events.type	string	event type
deepinstinctv3.Events.events.trigger	string	event trigger
deepinstinctv3.Events.events.action	string	event action
deepinstinctv3.Events.events.close_trigger	string	event close trigger
deepinstinctv3.Events.events.reoccurrence_count	number	event reoccurrence_count
deepinstinctv3.Events.events.file_type	string	event file type
deepinstinctv3.Events.events.file_hash	string	event file hash
deepinstinctv3.Events.events.file_archive_hash	string	event file archive hash
deepinstinctv3.Events.events.path	unknown	event file path
deepinstinctv3.Events.events.file_size	number	event file size
deepinstinctv3.Events.events.threat_severity	string	event threat severity
deepinstinctv3.Events.events.certificate_thumbprint	string	event certificate certificate thumbprint
deepinstinctv3.Events.events.certificate_vendor_name	string	event certificate certificate vendor name
deepinstinctv3.Events.events.deep_classification	string	Deep Instinct classification
deepinstinctv3.Events.events.file_status	string	event file status
deepinstinctv3.Events.events.sandbox_status	string	event sandbox status

deepinstinctv3-get-suspicious-events

Get all suspicious events after given event ID

Base Command

deepinstinctv3-get-suspicious-events

Input

Argument Name	Description	Required
first_event_id	Get all suspicious events. Max events in response is 50, use first_event_id parameter to define first event id to get. Default is 0.	Required

Context Output

Path	Type	Description
deepinstinctv3.Suspicious-Events.events.ID	number	event ID
deepinstinctv3.Suspicious-Events.events.device_id	number	event device ID
deepinstinctv3.Suspicious-Events.events.timestamp	string	event timestamp from device
deepinstinctv3.Suspicious-Events.events.insertion_timestamp	string	event timestamp from console
deepinstinctv3.Suspicious-Events.events.status	string	event status
deepinstinctv3.Suspicious-Events.events.recorded_device_info	unkown	event device info
deepinstinctv3.Suspicious-Events.events.msp_name	string	event msp name
deepinstinctv3.Suspicious-Events.events.msp_id	number	event msp id
deepinstinctv3.Suspicious-Events.events.tenant_name	string	event tenant name
deepinstinctv3.Suspicious-Events.events.tenant_id	number	event tenant id
deepinstinctv3.Suspicious-Events.events.mitre_classifications	unknown	event MITRE classification
deepinstinctv3.Suspicious-Events.events.type	string	event type
deepinstinctv3.Suspicious-Events.events.trigger	string	event trigger
deepinstinctv3.Suspicious-Events.events.action	string	event action
deepinstinctv3.Suspicious-Events.events.close_trigger	string	event close trigger
deepinstinctv3.Suspicious-Events.events.file_type	string	event file type
deepinstinctv3.Suspicious-Events.events.rule_trigger	string	event rule trigger
deepinstinctv3.Suspicious-Events.events.file_archive_hash	string	event file archive hash
deepinstinctv3.Suspicious-Events.events.remediation	unknown	event remediation
deepinstinctv3.Suspicious-Events.events.path	unknown	event file path

deepinstinctv3-get-all-groups

Get all groups

Base Command

deepinstinctv3-get-all-groups

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
deepinstinctv3.Groups.ID	number	group id
deepinstinctv3.Groups.is_default_group	boolean	True if group is a default group, false otherwise
deepinstinctv3.Groups.msp_id	number	msp ID
deepinstinctv3.Groups.name	string	group name
deepinstinctv3.Groups.os	string	group operation system
deepinstinctv3.Groups.policy_id	number	group policy ID

deepinstinctv3-get-all-policies

Get list of all policies

Base Command

deepinstinctv3-get-all-policies

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
deepinstinctv3.Policies.ID	number	policy ID
deepinstinctv3.Policies.name	string	policy name
deepinstinctv3.Policies.os	string	policy operating system
deepinstinctv3.Policies.is_default_policy	boolean	True if policy is a default policy, False otherwise
deepinstinctv3.Policies.msp_id	number	msp ID
deepinstinctv3.Policies.msp_name	string	msp name

deepinstinctv3-add-hash-to-deny-list

Add file hash to Deny List

Base Command

deepinstinctv3-add-hash-to-deny-list

Input

Argument Name	Description	Required
policy_id	Policy ID.	Required
file_hash	file hash.	Required
comment	comment to hash field.	Optional

Context Output

There is no context output for this command.

deepinstinctv3-add-hash-to-allow-list

Add file hash to Allow List

Base Command

deepinstinctv3-add-hash-to-allow-list

Input

Argument Name	Description	Required
policy_id	Policy ID.	Required
file_hash	file hash.	Required
comment	comment to hash field.	Optional

Context Output

There is no context output for this command.

deepinstinctv3-remove-hash-from-deny-list

Remove hash from Deny List

Base Command

deepinstinctv3-remove-hash-from-deny-list

Input

Argument Name	Description	Required
policy_id	Policy ID.	Required
file_hash	file hash.	Required

Context Output

There is no context output for this command.

deepinstinctv3-remove-hash-from-allow-list

Remove hash from Allow List

Base Command

deepinstinctv3-remove-hash-from-allow-list

Input

Argument Name	Description	Required
policy_id	Policy ID.	Required
file_hash	file hash.	Required

Context Output

There is no context output for this command.

deepinstinctv3-add-devices-to-group

Add multiple devices to a group

Base Command

deepinstinctv3-add-devices-to-group

Input

Argument Name	Description	Required
group_id	group ID.	Required
device_ids	comma seperated list of device ids to address.	Required

Context Output

There is no context output for this command.

deepinstinctv3-remove-devices-from-group

Remove list of devices from groups

Base Command

deepinstinctv3-remove-devices-from-group

Input

Argument Name	Description	Required
group_id	Group ID to remove from.	Required
device_ids	Comma seperated list of device ids to remove.	Required

Context Output

There is no context output for this command.

deepinstinctv3-delete-files-remotely

Delete multiple files remotely

Base Command

deepinstinctv3-delete-files-remotely

Input

Argument Name	Description	Required
event_ids	comma separated list of event ids.	Required

Context Output

There is no context output for this command.

deepinstinctv3-terminate-processes

Terminate list of processes

Base Command

deepinstinctv3-terminate-processes

Input

Argument Name	Description	Required
event_ids	comma separated list of event ids.	Required

Context Output

There is no context output for this command.

deepinstinctv3-close-events

Close list of events

Base Command

deepinstinctv3-close-events

Input

Argument Name	Description	Required
event_ids	comma separated list of event ids.	Required

Context Output

There is no context output for this command.

deepinstinctv3-disable-device

Disable device at next check-in

Base Command

deepinstinctv3-disable-device

Input

Argument Name	Description	Required
device_id	single device id.	Required

Context Output

There is no context output for this command.

deepinstinctv3-enable-device

Enable device at next check-in

Base Command

deepinstinctv3-enable-device

Input

Argument Name	Description	Required
device_id	single device id.	Required

Context Output

There is no context output for this command.

deepinstinctv3-isolate-from-network

Isolate device(s) from Network

Base Command

deepinstinctv3-isolate-from-network

Input

Argument Name	Description	Required
device_ids	comma separated list of device ids.	Required

Context Output

There is no context output for this command.

deepinstinctv3-release-from-isolation

Release device(s) from isolation

Base Command

deepinstinctv3-release-from-isolation

Input

Argument Name	Description	Required
device_ids	comma separated list of device ids.	Required

Context Output

There is no context output for this command.

deepinstinctv3-remote-file-upload

Upload file associated with given event id at next check-in

Base Command

deepinstinctv3-remote-file-upload

Input

Argument Name	Description	Required
event_id	the event id.	Required

Context Output

There is no context output for this command.

deepinstinctv3-upload-logs

Upload device logs from given device at next check-in

Base Command

deepinstinctv3-upload-logs

Input

Argument Name	Description	Required
device_id	single device id.	Required

Context Output

There is no context output for this command.

deepinstinctv3-remove-device

Remove agent from device at next check-in

Base Command

deepinstinctv3-remove-device

Input

Argument Name	Description	Required
device_id	single device id.	Required

Context Output

There is no context output for this command.

Configuration parameters

base_url — Base server URL (required)
apikey — API Key (required)
first_fetch — First event ID to fetch from
max_fetch — Maximum number of indicators per fetch, max is 1000.
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (21)

deepinstinctv3-add-devices-to-group
Add multiple devices to a group.
deepinstinctv3-add-hash-to-allow-list
Add file hash to Allow List.
deepinstinctv3-add-hash-to-deny-list
Add file hash to Deny List.
deepinstinctv3-close-events
Close list of events.
deepinstinctv3-delete-files-remotely
Delete multiple files remotely.
deepinstinctv3-disable-device
Disable device at next check-in.
deepinstinctv3-enable-device
Enable device at next check-in.
deepinstinctv3-get-all-groups
Get all groups.
deepinstinctv3-get-all-policies
Get list of all policies.
deepinstinctv3-get-device
Get device information from its ID.
deepinstinctv3-get-events
Get all events after given event ID.
deepinstinctv3-get-suspicious-events
Get all suspicious events after given event ID.
deepinstinctv3-isolate-from-network
Isolate device(s) from Network.
deepinstinctv3-release-from-isolation
Release device(s) from isolation.
deepinstinctv3-remote-file-upload
Upload file associated with given event id at next check-in.
deepinstinctv3-remove-device
Remove agent from device at next check-in.
deepinstinctv3-remove-devices-from-group
Remove list of devices from groups.
deepinstinctv3-remove-hash-from-allow-list
Remove hash from Allow List.
deepinstinctv3-remove-hash-from-deny-list
Remove hash from Deny List.
deepinstinctv3-terminate-processes
Terminate list of processes.
deepinstinctv3-upload-logs
Upload device logs from given device at next check-in.

Source

DeepInstinct3x.py DeepInstinct3x_test.py DeepInstinct3x.yml DeepInstinct3x_description.md

Download History Raw

category: Endpoint
provider: Deep Instinct
commonfields:
  id: DeepInstinct v3
  version: -1
configuration:
- display: Base server URL
  name: base_url
  defaultvalue: https://my-deep-instinct-path.deepinstinctweb.com
  type: 0
  required: true
- display: API Key
  name: apikey
  type: 4
  required: true
- display: First event ID to fetch from
  name: first_fetch
  defaultvalue: '0'
  type: 0
  required: false
- name: max_fetch
  display: Maximum number of indicators per fetch, max is 1000.
  type: 0
  defaultvalue: '50'
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  type: 19
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deep Instinct is a prevention-first approach to stopping ransomware and other malware using the world's first purpose-built, deep learning cybersecurity framework.
display: DeepInstinct v3
name: DeepInstinct v3
script:
  commands:
  - arguments:
    - description: Get device information from its ID.
      name: device_id
      required: true
    description: Get device information from its ID.
    name: deepinstinctv3-get-device
    outputs:
    - contextPath: deepinstinctv3.devices.ID
      description: Device ID.
      type: number
    - contextPath: deepinstinctv3.devices.os
      description: Device OS.
      type: string
    - contextPath: deepinstinctv3.devices.osv
      description: Device OS version.
      type: string
    - contextPath: deepinstinctv3.devices.ip_address
      description: Device IP address.
      type: string
    - contextPath: deepinstinctv3.devices.email
      description: Device email ip_address.
      type: sting
    - contextPath: deepinstinctv3.devices.mac_address
      description: Device mac address.
      type: string
    - contextPath: deepinstinctv3.devices.hostname
      description: Device hostname.
      type: string
    - contextPath: deepinstinctv3.devices.domain
      description: Device domain.
      type: string
    - contextPath: deepinstinctv3.devices.scanned_files
      description: Num of device scanned files.
      type: number
    - contextPath: deepinstinctv3.devices.comment
      description: Device comment.
      type: string
    - contextPath: deepinstinctv3.devices.tag
      description: Device tag.
      type: string
    - contextPath: deepinstinctv3.devices.connectivity_status
      description: Device connectivity status.
      type: string
    - contextPath: deepinstinctv3.devices.deployment_status
      description: Device deployment status.
      type: string
    - contextPath: deepinstinctv3.devices.deployment_status_last_update
      description: Device last client version update.
      type: string
    - contextPath: deepinstinctv3.devices.license_status
      description: Device license status.
      type: string
    - contextPath: deepinstinctv3.devices.last_registration
      description: Device last registration datetime.
      type: string
    - contextPath: deepinstinctv3.devices.last_contact
      description: Device last contact datetime.
      type: string
    - contextPath: deepinstinctv3.devices.distinguished_name
      description: Device distinguished name.
      type: string
    - contextPath: deepinstinctv3.devices.group_name
      description: Device group name.
      type: string
    - contextPath: deepinstinctv3.devices.group_id
      description: Device group ID.
      type: number
    - contextPath: deepinstinctv3.devices.policy_name
      description: Device policy name.
      type: string
    - contextPath: deepinstinctv3.devices.policy_id
      description: Device policy ID.
      type: number
    - contextPath: deepinstinctv3.devices.log_status
      description: Device log status.
      type: string
    - contextPath: deepinstinctv3.devices.agent_version
      description: Device agent version.
      type: string
    - contextPath: deepinstinctv3.devices.brain_version
      description: Device brain version.
      type: string
    - contextPath: deepinstinctv3.devices.logged_in_users
      description: Device logged in user(s).
      type: string
    - contextPath: deepinstinctv3.devices.msp_name
      description: Device msp name.
      type: string
    - contextPath: deepinstinctv3.devices.msp_id
      description: Device msp ID.
      type: number
    - contextPath: deepinstinctv3.devices.tenant_name
      description: Device tenant name.
      type: string
    - contextPath: deepinstinctv3.devices.tenant_id
      description: Device tenant ID.
      type: number
  - arguments:
    - description: Get all events. Max events in response is 50, use first_event_id parameter to define first event id to get.
      name: first_event_id
      required: true
      defaultValue: '0'
    description: Get all events after given event ID.
    name: deepinstinctv3-get-events
    outputs:
    - contextPath: deepinstinctv3.Events.events.id
      description: event ID.
      type: number
    - contextPath: deepinstinctv3.Events.events.device_id
      description: event device ID.
      type: number
    - contextPath: deepinstinctv3.Events.events.timestamp
      description: event timestamp from device.
      type: string
    - contextPath: deepinstinctv3.Events.events.insertion_timestamp
      description: event timestamp from console.
      type: string
    - contextPath: deepinstinctv3.Events.events.close_timestamp
      description: event closed timestamp.
      type: string
    - contextPath: deepinstinctv3.Events.events.last_action
      description: event last last_action.
      type: string
    - contextPath: deepinstinctv3.Events.events.status
      description: event status.
      type: string
    - contextPath: deepinstinctv3.Events.events.comment
      description: event comment.
      type: string
    - contextPath: deepinstinctv3.Events.events.recorded_device_info
      description: event device information.
      type: unknown
    - contextPath: deepinstinctv3.Events.events.msp_name
      description: event msp name.
      type: string
    - contextPath: deepinstinctv3.Events.events.msp_id
      description: event msp id.
      type: number
    - contextPath: deepinstinctv3.Events.events.tenant_name
      description: event tenant name.
      type: string
    - contextPath: deepinstinctv3.Events.events.tenant_id
      description: event tenant id.
      type: number
    - contextPath: deepinstinctv3.Events.events.mitre_classifications
      description: event MITRE classification.
      type: unknown
    - contextPath: deepinstinctv3.Events.events.type
      description: event type.
      type: string
    - contextPath: deepinstinctv3.Events.events.trigger
      description: event trigger.
      type: string
    - contextPath: deepinstinctv3.Events.events.action
      description: event action.
      type: string
    - contextPath: deepinstinctv3.Events.events.close_trigger
      description: event close trigger.
      type: string
    - contextPath: deepinstinctv3.Events.events.reoccurrence_count
      description: event reoccurrence_count.
      type: number
    - contextPath: deepinstinctv3.Events.events.file_type
      description: event file type.
      type: string
    - contextPath: deepinstinctv3.Events.events.file_hash
      description: event file hash.
      type: string
    - contextPath: deepinstinctv3.Events.events.file_archive_hash
      description: event file archive hash.
      type: string
    - contextPath: deepinstinctv3.Events.events.path
      description: event file path.
    - contextPath: deepinstinctv3.Events.events.file_size
      description: event file size.
      type: number
    - contextPath: deepinstinctv3.Events.events.threat_severity
      description: event threat severity.
      type: string
    - contextPath: deepinstinctv3.Events.events.certificate_thumbprint
      description: event certificate certificate thumbprint.
      type: string
    - contextPath: deepinstinctv3.Events.events.certificate_vendor_name
      description: event certificate certificate vendor name.
      type: string
    - contextPath: deepinstinctv3.Events.events.deep_classification
      description: Deep Instinct classification.
      type: string
    - contextPath: deepinstinctv3.Events.events.file_status
      description: event file status.
      type: string
    - contextPath: deepinstinctv3.Events.events.sandbox_status
      description: event sandbox status.
      type: string
  - arguments:
    - description: Get all suspicious events. Max events in response is 50, use first_event_id parameter to define first event id to get.
      name: first_event_id
      required: true
      defaultValue: '0'
    description: Get all suspicious events after given event ID.
    name: deepinstinctv3-get-suspicious-events
    outputs:
    - contextPath: deepinstinctv3.Suspicious-Events.events.ID
      description: event ID.
      type: number
    - contextPath: deepinstinctv3.Suspicious-Events.events.device_id
      description: event device ID.
      type: number
    - contextPath: deepinstinctv3.Suspicious-Events.events.timestamp
      description: event timestamp from device.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.insertion_timestamp
      description: event timestamp from console.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.status
      description: event status.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.recorded_device_info
      description: event device info.
      type: unkown
    - contextPath: deepinstinctv3.Suspicious-Events.events.msp_name
      description: event msp name.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.msp_id
      description: event msp id.
      type: number
    - contextPath: deepinstinctv3.Suspicious-Events.events.tenant_name
      description: event tenant name.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.tenant_id
      description: event tenant id.
      type: number
    - contextPath: deepinstinctv3.Suspicious-Events.events.mitre_classifications
      description: event MITRE classification.
      type: unknown
    - contextPath: deepinstinctv3.Suspicious-Events.events.type
      description: event type.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.trigger
      description: event trigger.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.action
      description: event action.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.close_trigger
      description: event close trigger.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.file_type
      description: event file type.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.rule_trigger
      description: event rule trigger.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.file_archive_hash
      description: event file archive hash.
      type: string
    - contextPath: deepinstinctv3.Suspicious-Events.events.remediation
      description: event remediation.
      type: unknown
    - contextPath: deepinstinctv3.Suspicious-Events.events.path
      description: event file path.
      type: unknown
  - name: deepinstinctv3-get-all-groups
    outputs:
    - contextPath: deepinstinctv3.Groups.ID
      description: group id.
      type: number
    - contextPath: deepinstinctv3.Groups.is_default_group
      description: True if group is a default group, false otherwise.
      type: boolean
    - contextPath: deepinstinctv3.Groups.msp_id
      description: msp ID.
      type: number
    - contextPath: deepinstinctv3.Groups.name
      description: group name.
      type: string
    - contextPath: deepinstinctv3.Groups.os
      description: group operation system.
      type: string
    - contextPath: deepinstinctv3.Groups.policy_id
      description: group policy ID.
      type: number
    description: Get all groups.
  - name: deepinstinctv3-get-all-policies
    outputs:
    - contextPath: deepinstinctv3.Policies.ID
      description: policy ID.
      type: number
    - contextPath: deepinstinctv3.Policies.name
      description: policy name.
      type: string
    - contextPath: deepinstinctv3.Policies.os
      description: policy operating system.
      type: string
    - contextPath: deepinstinctv3.Policies.is_default_policy
      description: True if policy is a default policy, False otherwise.
      type: boolean
    - contextPath: deepinstinctv3.Policies.msp_id
      description: msp ID.
      type: number
    - contextPath: deepinstinctv3.Policies.msp_name
      description: msp name.
      type: string
    description: Get list of all policies.
  - arguments:
    - description: Policy ID.
      name: policy_id
      required: true
    - description: file hash.
      name: file_hash
      required: true
    - name: comment
      description: comment to hash field.
    description: Add file hash to Deny List.
    name: deepinstinctv3-add-hash-to-deny-list
  - arguments:
    - description: Policy ID.
      name: policy_id
      required: true
    - description: file hash.
      name: file_hash
      required: true
    - name: comment
      description: comment to hash field.
    description: Add file hash to Allow List.
    name: deepinstinctv3-add-hash-to-allow-list
  - arguments:
    - description: Policy ID.
      name: policy_id
      required: true
    - description: file hash.
      name: file_hash
      required: true
    description: Remove hash from Deny List.
    name: deepinstinctv3-remove-hash-from-deny-list
  - arguments:
    - description: Policy ID.
      name: policy_id
      required: true
    - description: file hash.
      name: file_hash
      required: true
    description: Remove hash from Allow List.
    name: deepinstinctv3-remove-hash-from-allow-list
  - arguments:
    - description: group ID.
      name: group_id
      required: true
    - description: comma seperated list of device ids to address.
      name: device_ids
      required: true
    description: Add multiple devices to a group.
    name: deepinstinctv3-add-devices-to-group
  - arguments:
    - description: Group ID to remove from.
      name: group_id
      required: true
    - description: Comma seperated list of device ids to remove.
      name: device_ids
      required: true
    description: Remove list of devices from groups.
    name: deepinstinctv3-remove-devices-from-group
  - arguments:
    - description: comma separated list of event ids.
      name: event_ids
      required: true
    description: Delete multiple files remotely.
    name: deepinstinctv3-delete-files-remotely
  - arguments:
    - description: comma separated list of event ids.
      name: event_ids
      required: true
    description: Terminate list of processes.
    name: deepinstinctv3-terminate-processes
  - arguments:
    - description: comma separated list of event ids.
      name: event_ids
      required: true
    description: Close list of events.
    name: deepinstinctv3-close-events
  - arguments:
    - description: single device id.
      name: device_id
      required: true
    description: Disable device at next check-in.
    name: deepinstinctv3-disable-device
  - arguments:
    - description: single device id.
      name: device_id
      required: true
    description: Enable device at next check-in.
    name: deepinstinctv3-enable-device
  - arguments:
    - description: comma separated list of device ids.
      name: device_ids
      required: true
    description: Isolate device(s) from Network.
    name: deepinstinctv3-isolate-from-network
  - arguments:
    - description: comma separated list of device ids.
      name: device_ids
      required: true
    description: Release device(s) from isolation.
    name: deepinstinctv3-release-from-isolation
  - arguments:
    - name: event_id
      required: true
      description: the event id.
    description: Upload file associated with given event id at next check-in.
    name: deepinstinctv3-remote-file-upload
  - arguments:
    - description: single device id.
      name: device_id
      required: true
    description: Upload device logs from given device at next check-in.
    name: deepinstinctv3-upload-logs
  - arguments:
    - description: single device id.
      name: device_id
      required: true
    description: Remove agent from device at next check-in.
    name: deepinstinctv3-remove-device
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: '-'
  type: python
  subtype: python3
fromversion: 6.2.0
tests:
- No tests (auto formatted)