Digital Shadows

commonfields:
  id: Digital Shadows
  version: -1
name: Digital Shadows
display: Digital Shadows
category: Data Enrichment & Threat Intelligence
sectionorder:
- Connect
- Collect
provider: ReliaQuest
description: Digital Shadows monitors and manages an organization's digital risk across the widest range of data sources within the open, deep, and dark web.
configuration:
- display: Server URL
  name: server
  defaultvalue: https://portal-digitalshadows.com
  type: 0
  required: true
  section: Connect
- display: API Key
  name: apikey
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: Secret
  name: secret
  defaultvalue: ""
  type: 4
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Fetch Limit
  name: fetchLimit
  defaultvalue: "50"
  type: 0
  additionalinfo: Limit on the number of incidents retrieved in a single fetch.  Must be an integer between 1 and 200 inclusive.
  required: false
  section: Collect
- display: Initial Fetch (Minutes)
  name: initialFetch
  defaultvalue: "1"
  type: 0
  additionalinfo: The time period in minutes for which to fetch historic incidents. This is used the first time incidents are fetched and if the last run details are reset. Must be an integer greater than or equal to 1.
  required: false
  section: Collect
script:
  script: ''
  type: javascript
  commands:
  - name: ds-get-breach-reviews
    arguments:
    - name: breach_id
      required: true
      default: true
      description: Unique id of the data breach record to retrieve the status history for.
    outputs:
    - contextPath: DigitalShadows.BreachReviews.Note
      description: The note at this version (max length 500 characters).
    - contextPath: DigitalShadows.BreachReviews.Version
      description: Starts counting at 1 and increments for each review of a given data breach credential. Will initially be 0 until a review is performed (when returned as part of a credential).
    - contextPath: DigitalShadows.BreachReviews.Status
      description: Review status.
    - contextPath: DigitalShadows.BreachReviews.UserID
      description: ID of user that changed the status/set the note.
    - contextPath: DigitalShadows.BreachReviews.UserRole
      description: Role of user that changed the status/set the note.
    - contextPath: DigitalShadows.BreachReviews.UserPermissions
      description: Permissins of user that changed the status/set the note.
    - contextPath: DigitalShadows.BreachReviews.UserEmail
      description: Email address of user that changed the status/set the note.
    - contextPath: DigitalShadows.BreachReviews.CreatedAt
      description: The moment in time the review was created.
    description: Retrieve all review updates for a given data breach record.
  - name: ds-snapshot-breach-status
    arguments:
    - name: note
      description: The note at this version (max length 500 characters).
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - CLOSED
      - IGNORED
      description: Review status.
    - name: version
      description: When submitting, this value can be optionally set to the version of the most recently read review.
    - name: breach_id
      required: true
      default: true
      description: Unique id of the data breach record to submit a status update for.
    description: Snapshot the review status of a data breach record.
  - name: ds-find-breach-records
    arguments:
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - username
      - password
      - reviewStatus
      - published
      - breachCount
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: filter_distinction
      auto: PREDEFINED
      predefined:
      - NEW_USERNAME
      - EXISTING_USERNAME
      - DIFFERENT_PASSWORD
      - SAME_PASSWORD
      - DUPLICATED_ROW
      description: Narrow down to records based on how unique their username and/or password are.
    - name: filter_domainNames
      description: Only records that are related to these domain names.
      isArray: true
    - name: filter_password
      description: Records that match this password, use '' for wildcard matching, '\' to find an actual asterisk.
    - name: filter_published
      description: Narrow down to records based on when they were published.
    - name: filter_reviewStatuses
      description: List of statuses to include. Possible values are OPEN CLOSED IGNORED.
      isArray: true
    - name: filter_username
      description: Records that match this username, use '*' for wildcard matching.
    outputs:
    - contextPath: DigitalShadows.BreachRecords.Content
      description: The row content of this data breach record (a line from a csv file, for example).
    - contextPath: DigitalShadows.BreachRecords.Id
      description: Identifier for this data breach record.
    - contextPath: DigitalShadows.BreachRecords.Password
      description: The password found in the breach record, if any could be found.
    - contextPath: DigitalShadows.BreachRecords.DomainNames
      description: The domain names identified within the breach row.
    - contextPath: DigitalShadows.BreachRecords.PriorRowTextBreachCount
      description: The number of breaches the entire text of the breach row has appeared in prior to the current breach.
    - contextPath: DigitalShadows.BreachRecords.PriorUsernameBreachCount
      description: The number of breaches this username appeared in prior to the current breach.
    - contextPath: DigitalShadows.BreachRecords.PriorUsernamePasswordBreachCount
      description: The number of breaches this username/password combination have appeared in prior to the current breach.
    - contextPath: DigitalShadows.BreachRecords.Published
      description: When did this record become available.
    - contextPath: DigitalShadows.BreachRecords.Review.Created
      description: The moment in time the review was created.
    - contextPath: DigitalShadows.BreachRecords.Review.Status
      description: Review status.
    - contextPath: DigitalShadows.BreachRecords.Review.User.id
      description: Unique id of user.
    - contextPath: DigitalShadows.BreachRecords.Review.User.fullName
      description: Full name of the user.
    - contextPath: DigitalShadows.BreachRecords.Review.User.emailAddress
      description: Email address of the user.
    - contextPath: DigitalShadows.BreachRecords.Username
      description: A best effort to identify a username within the content of the breach record.
    - contextPath: DigitalShadows.BreachRecords.DataBreachId
      description: The data breach this record belongs to.
    description: Find data breach records.
  - name: ds-get-breach-summary
    arguments: []
    description: Summary of all data breaches for the current client.
  - name: ds-find-breach-usernames
    arguments:
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - username
      - password
      - reviewStatus
      - published
      - breachCount
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: filter_domainNames
      description: Only records that are related to these domain names.
    - name: filter_published
      description: Narrow down to records based on when they were published.
    - name: filter_reviewStatuses
      description: List of statuses to include. Possible values are OPEN CLOSED IGNORED.
    - name: filter_username
      description: Records that match this username, use '*' for wildcard matching.
    outputs:
    - contextPath: DigitalShadows.Users.BreachCount
      description: The number of data breaches this username has appeared on.
    - contextPath: DigitalShadows.Users.DistinctPasswordCount
      description: The number of distict passwords encountered for this user.
    - contextPath: DigitalShadows.Users.Username
      description: The username that this summary is for.
    description: Find unique usernames found across all data breaches.
  - name: ds-get-breach
    arguments:
    - name: breach_id
      required: true
      default: true
      description: Id of the data breach to retrieve.
    outputs:
    - contextPath: DigitalShadows.Breaches.DomainCount
      description: Number of unique domains contained in the breach.
    - contextPath: DigitalShadows.Breaches.DomainName
      description: The domain the data breach occurred against.
    - contextPath: DigitalShadows.Breaches.DataClasses
      description: Data types contained within the breach.
    - contextPath: DigitalShadows.Breaches.Id
      description: Unique identifier for a breach.
    - contextPath: DigitalShadows.Breaches.IncidentId
      description: The ID of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.IncidentScope
      description: The scope of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.IncidentSeverity
      description: The severity of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.IncidentTitle
      description: The title of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.IncidentType
      description: The type of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.Occurred
      description: Date the breach occurred.
    - contextPath: DigitalShadows.Breaches.RecordCount
      description: Number of records contained in the breach.
    - contextPath: DigitalShadows.Breaches.SourceUrl
      description: The url the data breach was found on.
    - contextPath: DigitalShadows.Breaches.Title
      description: The title assigned to this data breach.
    description: Retrieve a data breach by its id.
  - name: ds-get-breach-records
    arguments:
    - name: breach_id
      required: true
      default: true
      description: Unique id of the data breach to retrieve records for.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - username
      - password
      - reviewStatus
      - published
      - breachCount
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: filter_distinction
      auto: PREDEFINED
      predefined:
      - NEW_USERNAME
      - EXISTING_USERNAME
      - DIFFERENT_PASSWORD
      - SAME_PASSWORD
      - DUPLICATED_ROW
      description: Narrow down to records based on how unique their username and/or password are.
    - name: filter_domainNames
      description: Only records that are related to these domain names.
    - name: filter_password
      description: Records that match this password, use '' for wildcard matching, '\' to find an actual asterisk.
    - name: filter_published
      description: Narrow down to records based on when they were published.
    - name: filter_reviewStatuses
      description: List of statuses to include. Possible values are OPEN CLOSED IGNORED.
    - name: filter_username
      description: Records that match this username, use '*' for wildcard matching.
    outputs:
    - contextPath: DigitalShadows.BreachRecords.Id
      description: Identifier for this data breach record.
    - contextPath: DigitalShadows.BreachRecords.Password
      description: The password found in the breach record, if any could be found.
    - contextPath: DigitalShadows.BreachRecords.PriorRowTextBreachCount
      description: The number of breaches the entire text of the breach row has appeared in prior to the current breach.
    - contextPath: DigitalShadows.BreachRecords.PriorUsernameBreachCount
      description: The number of breaches this username appeared in prior to the current breach.
    - contextPath: DigitalShadows.BreachRecords.PriorUsernamePasswordBreachCount
      description: The number of breaches this username/password combination have appeared in prior to the current breach.
    - contextPath: DigitalShadows.BreachRecords.Published
      description: When did this record become available.
    - contextPath: DigitalShadows.BreachRecords.Review.Created
      description: The most recent review for this record.
    - contextPath: DigitalShadows.BreachRecords.Review.Status
      description: The status of the most recent review for this record.
    - contextPath: DigitalShadows.BreachRecords.Review.User
      description: The user who created the most recent review for this record.
    - contextPath: DigitalShadows.BreachRecords.Username
      description: A best effort to identify a username within the content of the breach record.
    description: Find data breach records.
  - name: ds-find-data-breaches
    arguments:
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - title
      - domainName
      - occurred
      - published
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: filter_alerted
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Only include data breaches with associated incidents that have been alerted.
    - name: filter_domainNamesOnRecords
      description: List of domain names to filter by. Only data breaches that have one or more records attributed to this domain name.
    - name: filter_minimumTotalRecords
      description: Only include data breaches that have at least this many total records (inclusive).
    - name: filter_published
      description: Narrow down to records based on when they were published.
    - name: filter_repostedCredentials
      description: Filter out breaches depending on whether they consist entirely of reposted credentials or not. ORIGINAL or REPOST.
    - name: filter_severities
      description: Only include data breaches with associated incidents having one of these severities, if not specified, all are considered.
    - name: filter_statuses
      description: List of statuses to filter by. Pssible values:UNREAD, READ, CLOSED.
    - name: filter_username
      description: Only show breaches that include this username.
    outputs:
    - contextPath: DigitalShadows.Breaches.DomainCount
      description: Number of unique domains contained in the breach.
    - contextPath: DigitalShadows.Breaches.DomainName
      description: The domain the data breach occurred against.
    - contextPath: DigitalShadows.Breaches.DataClasses
      description: Data types contained within the breach.
    - contextPath: DigitalShadows.Breaches.Id
      description: Unique identifier for a breach.
    - contextPath: DigitalShadows.Breaches.IncidentId
      description: The ID of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.IncidentScope
      description: The Scope of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.IncidentSeverity
      description: The severity of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.IncidentTitle
      description: The title of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.IncidentType
      description: The type of the incident raised for the breach, most specific to the client.
    - contextPath: DigitalShadows.Breaches.Occurred
      description: Date the breach occurred.
    - contextPath: DigitalShadows.Breaches.Modified
      description: When was this breach last modified.
    - contextPath: DigitalShadows.Breaches.RecordCount
      description: Number of records contained in the breach.
    - contextPath: DigitalShadows.Breaches.SourceUrl
      description: The url the data breach was found on.
    - contextPath: DigitalShadows.Breaches.Title
      description: The title assigned to this data breach.
    - contextPath: DigitalShadows.Breaches.OrganisationUsernameCount
      description: The number of distict usernames found that belong to the current organisation.
    description: Find data breaches.
  - name: ds-get-incident
    arguments:
    - name: incident_id
      description: Identifier of the incident.
      required: true
      default: true
    - name: fulltext
      description: Show full text results.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: DigitalShadows.Incidents.Alerted
      description: The moment this incident was brought to the attention of the client.
    - contextPath: DigitalShadows.Incidents.Description
      description: Plain text description of this incident.
    - contextPath: DigitalShadows.Incidents.ImpactDescription
      description: Description of what impact the incident will have.
    - contextPath: DigitalShadows.Incidents.Id
      description: Identifier for this incident, unique in combination with the scope.
    - contextPath: DigitalShadows.Incidents.Internal
      description: Will be true if domain belongs to your organization (as defined by the assets), false otherwise.
    - contextPath: DigitalShadows.Incidents.Mitigation
      description: Information about what can be done to mitigate the effect of the problem.
    - contextPath: DigitalShadows.Incidents.Occurred
      description: Best effort to establish when the incident occurre.
    - contextPath: DigitalShadows.Incidents.Modified
      description: When was this incident last modified.
    - contextPath: DigitalShadows.Incidents.Scope
      description: Identifies whether this incident applies globally (intelligence) or just to your organization.
    - contextPath: DigitalShadows.Incidents.Type
      description: The category of incident that has been raised.
    - contextPath: DigitalShadows.Incidents.Title
      description: A short but descriptive identifier for the incident.
    - contextPath: DigitalShadows.Incidents.Review.Created
      description: The moment in time the review was created.
    - contextPath: DigitalShadows.Incidents.Review.Status
      description: Review status.
    - contextPath: DigitalShadows.Incidents.Review.User
      description: The user that changed the status/set the note.
    - contextPath: DigitalShadows.Incidents.SubType
      description: The sub-category of incident that has been raised, if available.
    - contextPath: DigitalShadows.Incidents.Severity
      description: Analyst defined severity based on potential risk to the client.
    description: Retrieve an incident by its id.
  - name: ds-get-incident-reviews
    arguments:
    - name: incident_id
      required: true
      default: true
      description: Id of the incident to retrieve the review history for.
    outputs:
    - contextPath: DigitalShadows.IncidentReviews.Note
      description: The note at this version (max length 500 characters).
    - contextPath: DigitalShadows.IncidentReviews.Created
      description: The moment in time the review was created.
    - contextPath: DigitalShadows.IncidentReviews.Status
      description: Review status.
    - contextPath: DigitalShadows.IncidentReviews.User.Id
      description: The unique id of the user that changed the status/set the note.
    - contextPath: DigitalShadows.IncidentReviews.User.EmailAddress
      description: The email address of the user that changed the status/set the note.
    - contextPath: DigitalShadows.IncidentReviews.User.FullName
      description: The full name of the user that changed the status/set the note.
    - contextPath: DigitalShadows.IncidentReviews.User.Role
      description: The role of the user that changed the status/set the note.
    - contextPath: DigitalShadows.IncidentReviews.User.Status
      description: The status of the user that changed the status/set the note.
    description: Retrieve all review updates for a given incident.
  - name: ds-snapshot-incident-review
    arguments:
    - name: incident_id
      required: true
      default: true
      description: Id of the incident to apply a review update to.
    - name: note
      description: The note at this version (max length 500 characters).
    - name: status
      auto: PREDEFINED
      predefined:
      - UNREAD
      - READ
      - CLOSED
      description: Review status.
    - name: version
      description: When submitting, this value can be optionally set to the version of the most recently read review. If the version on the server does not match this value, a 409 conflict will be returned.
    description: Snapshot the review status of an incident.
  - name: ds-find-incidents-filtered
    arguments:
    - name: subscribed
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If true, the results will also include any subscribed intelligence incidents.
    - name: subscribedOnly
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If true, the only results returned will be subscribed intelligence incidents. Must not be set to true with subscribed set to false.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - sevirity
      - verified
      - occurred
      - published
      - modified
      - date
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: filter_alerted
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Only incidents that have been alerted to the client.
    - name: filter_dateRange
      description: Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_dateRangeField
      auto: PREDEFINED
      predefined:
      - verified
      - occurred
      - modified
      - published
      description: Determines which date/time field the dateRange will apply to.
    - name: filter_domainName
      description: Only incidents that have this domain, applied if domainSelection is null or CUSTOM.
    - name: filter_domainSelection
      auto: PREDEFINED
      predefined:
      - NONE
      - CUSTOM
      - INTERNAL
      - EXTERNAL
      description: Determine how domain filtering will be applied.
    - name: filter_identifier
      description: Only return the incident that has this identifier.
    - name: filter_repostedCredentials
      description: Option specific to data breach based incidents to filter out new and reposted breach credentials. ORIGINAL, REPOST.
    - name: filter_severities
      description: Only include incidents with these severities, if not specified, all are considered. VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE.
    - name: filter_statuses
      description: UNREAD, READ, CLOSED.
    - name: filter_types_type
      description: The category of incident that has been raised.
    - name: filter_types_subTypes
      description: The sub-category of incident that has been raised, if available.
    - name: filter_types_content_severity
      description: Analyst defined severity based on potential risk to the client.
    - name: filter_tagOperator
      auto: PREDEFINED
      predefined:
      - OR
      - AND
      description: Whether multiple tags should be logically applied as AND/OR with the resultset.
    - name: filter_withContentRemoved
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Include incidents for which the content of the incident has been removed form the source.
    - name: filter_withTakedown
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Include incidents on which one or more takedown requests have been generated.
    - name: filter_withoutContentRemoved
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Include incidents for which the content of the incident has not been removed form the source.
    - name: filter_withoutTakedown
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Include incidents on which a takedown request has not been generated.
    outputs:
    - contextPath: DigitalShadows.Incidents.Alerted
      description: The moment this incident was brought to the attention of the client.
    - contextPath: DigitalShadows.Incidents.Description
      description: Plain text description of this incident.
    - contextPath: DigitalShadows.Incidents.Id
      description: Identifier for this incident, unique in combination with the scope.
    - contextPath: DigitalShadows.Incidents.Internal
      description: Will be true if domain belongs to your organization (as defined by the assets), false otherwis.
    - contextPath: DigitalShadows.Incidents.Mitigation
      description: Information about what can be done to mitigate the effect of the problem.
    - contextPath: DigitalShadows.Incidents.Modified
      description: When was this incident last modified.
    - contextPath: DigitalShadows.Incidents.Occurred
      description: Best effort to establish when the incident occurred.
    - contextPath: DigitalShadows.Incidents.Published
      description: When was this incident originally published.
    - contextPath: DigitalShadows.Incidents.RestrictedContent
      description: Identifies this incident as potentially containing questionable content. If this is true images will be restricted.
    - contextPath: DigitalShadows.Incidents.Scope
      description: Identifies whether this incident applies globally (intelligence) or just to your organization.
    - contextPath: DigitalShadows.Incidents.Severity
      description: Analyst defined severity based on potential risk to the client.
    - contextPath: DigitalShadows.Incidents.SubType
      description: The sub-category of incident that has been raised, if available.
    - contextPath: DigitalShadows.Incidents.Verified
      description: The moment when the incident was verified.
    - contextPath: DigitalShadows.Incidents.Type
      description: The category of incident that has been raised.
    - contextPath: DigitalShadows.Incidents.Version
      description: Each time an update occurs, this version number is incremented.
    - contextPath: DigitalShadows.Incidents.Review.Created
      description: The date the review state for this incident was created.
    - contextPath: DigitalShadows.Incidents.Review.Status
      description: The status of the review state for this incident.
    - contextPath: DigitalShadows.Incidents.Review.User.id
      description: The user that create the review state for this incident.
    - contextPath: DigitalShadows.Incidents.Review.User.fullName
      description: The full name of the user that created review state for this incident.
    description: Find incidents with filtering options.
  - name: ds-get-incidents-summary
    arguments:
    - name: filter_domainName
      description: Only incidents that have this domain, applied if domainSelection is null or CUSTOM.
    - name: filter_dateRangeField
      auto: PREDEFINED
      predefined:
      - verified
      - occurred
      - modified
      - published
      description: Determines which date/time field the dateRange will apply to.
    - name: filter_identifier
      description: Only return the incident that has this identifier.
    - name: filter_dateRange
      description: Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: groupByKey
      auto: PREDEFINED
      predefined:
      - severity
      - domainName
      - type
      - subType
      - reviewStatus
      description: Determines which incident property will be grouped on. Mutually exclusive with groupByKeys.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - severity
      - verified
      - occurred
      - modified
      - published
      - date
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    description: Aggregated summary of incident information used to generate reports/statistics.
  - name: ds-get-apt-report
    arguments:
    - name: report_id
      required: true
      default: true
      description: The unique identifier assigned to a given APT report (UUID based).
    outputs:
    - contextPath: DigitalShadows.APTReports.Id
      description: Internal identifier for uniquely identifying this report.
    - contextPath: DigitalShadows.APTReports.Name
      description: Name assigned to this report for ease of identification.
    - contextPath: DigitalShadows.APTReports.Published
      description: The date the report became available.
    - contextPath: DigitalShadows.APTReports.Report.Id
      description: The ID of the report resource allowing it to be downloaded.
    - contextPath: DigitalShadows.APTReports.Report.Link
      description: The link of the report resource allowing it to be downloaded.
    - contextPath: DigitalShadows.APTReports.Preview.Id
      description: ID of a preview image of the frontpage of the report, if available.
    - contextPath: DigitalShadows.APTReports.Preview.Link
      description: A fully qualified link URI for preview image of the frontpage of the report, if available.
    description: Retrieve details of the specified APT report.
  - name: ds-get-intelligence-incident
    arguments:
    - name: incident_id
      required: true
      default: true
      description: The id of the intelligence incident to retrieve.
    outputs:
    - contextPath: DigitalShadows.IntelligenceIncidents.Description
      description: Plain text description of this incident.
    - contextPath: DigitalShadows.IntelligenceIncidents.Id
      description: Identifier for this incident, unique in combination with the scope.
    - contextPath: DigitalShadows.IntelligenceIncidents.IndicatorOfCompromiseCount
      description: Count of IOCs that can be retrieved via /api/incidents/{id}/iocs endpoint.
    - contextPath: DigitalShadows.IntelligenceIncidents.Internal
      description: Will be true if domain belongs to your organization (as defined by the assets), false otherwise.
    - contextPath: DigitalShadows.IntelligenceIncidents.LinkedContentIncidents
      description: Other incidents that appear to be based on the same content as this incident. Each incident record will normally only contain the id and the scope it applies to. Could also include more details depending on the context it is called in.
    - contextPath: DigitalShadows.IntelligenceIncidents.Modified
      description: When was this incident last modified.
    - contextPath: DigitalShadows.IntelligenceIncidents.Occurred
      description: Best effort to establish when the incident occurred.
    - contextPath: DigitalShadows.IntelligenceIncidents.Published
      description: When was this incident originally published.
    - contextPath: DigitalShadows.IntelligenceIncidents.RelatedIncidentId
      description: If an incident specific to your organization exists for this intelligence incident, it will be included here.
    - contextPath: DigitalShadows.IntelligenceIncidents.RestrictedContent
      description: Identifies this incident as potentially containing questionable content. If this is true images will be restricted.
    - contextPath: DigitalShadows.IntelligenceIncidents.Scope
      description: Identifies whether this incident applies globally (intelligence) or just to your organization.
    - contextPath: DigitalShadows.IntelligenceIncidents.Severity
      description: Analyst defined severity based on potential risk to the client.
    - contextPath: DigitalShadows.IntelligenceIncidents.SubType
      description: The sub-category of incident that has been raised, if available.
    - contextPath: DigitalShadows.IntelligenceIncidents.Title
      description: A short but descriptive identifier for the incident.
    - contextPath: DigitalShadows.IntelligenceIncidents.Type
      description: The category of incident that has been raised.
    - contextPath: DigitalShadows.IntelligenceIncidents.Verified
      description: The moment when the incident was verified.
    - contextPath: DigitalShadows.IntelligenceIncidents.Version
      description: Each time an update occurs, this version number is incremented.
    description: Retrieve an intelligence incident by its id.
  - name: ds-get-intelligence-incident-iocs
    arguments:
    - name: incident_id
      required: true
      default: true
      description: The intelligence incident identifier.
    - name: visible
      description: List of values to control the visibility of elements. If a value is present then the correspinding element should be displayed.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - value
      - type
      - updated
      - source
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: filter_value
      description: The filter that will narrow the results based on one or more criteria.
    - name: filter_types
      description: List of types to filter by. Possible values are IP,MD5,SHA1,SHA256,URL,CVE,EMAIL,HOST,REGISTRY,FILEPATH,FILENAME.
    outputs:
    - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.Id
      description: Internal identifier for uniquely identifying this IOC.
    - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.IntelIncident.Id
      description: If this IOC is associated with an intel incident.
    - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.IntelIncident.Scope
      description: If this IOC is associated with an intel incident.
    - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.Type
      description: Identifies the type of incidicator that also determines how it is encoded into a string.
    - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.Value
      description: The value of this indicator, encoded according to its type. For example hashes are base16 encoded.
    - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.Source
      description: A comment provided by the analysts as to where this IOC came from.
    - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.LastUpdated
      description: When this record last changed.
    - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.AptReport.Id
      description: If this IOC is associated with an APT report.
    description: Retrieve the indicatorsOfCompromise for this intel incident.
  - name: ds-find-intelligence-incidents
    arguments:
    - name: filter_dateRange
      description: Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_dateRangeField
      auto: PREDEFINED
      predefined:
      - verified
      - occurred
      - modified
      - published
      description: Determines which date/time field the dateRange will apply to.
    - name: filter_domainName
      description: Only incidents that have this domain, applied if domainSelection is null or CUSTOM.
    - name: filter_domainSelection
      auto: PREDEFINED
      predefined:
      - NONE
      - CUSTOM
      - INTERNAL
      - EXTERNAL
      description: Determine how domain filtering will be applied.
    - name: filter_identifier
      description: Only return the incident that has this identifier.
    - name: filter_severities
      description: Only include SSL/certificate infrastructure incidents with these severities. String values from VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE.
    - name: filter_tagOperator
      auto: PREDEFINED
      predefined:
      - OR
      - AND
      description: Whether multiple tags should be logically applied as AND/OR with the resultset.
    - name: filter_tags_id
      description: Limit to incidents that have these tags ids only.
    - name: filter_threatRecordIds
      description: Restrict intel incidents to those tagged with one or more of these threat records.
    - name: filter_threatTypes_type
      description: Restrict intel incidents to those associated with threats of these types:ACTOR,CAMPAIGN,EVENT,TOOL,SPECIFIC_TTP,LOCATION.
    - name: filter_threatTypes
      auto: PREDEFINED
      predefined:
      - DATA_LEAKAGE
      - CYBER_THREAT
      - PHYSICAL_SECURITY
      - SOCIAL_MEDIA_COMPLIANCE
      - BRAND_PROTECTION
      - INFRASTRUCTURE
      description: The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered.
    - name: filter_threatSubTypes
      description: List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - severity
      - verified
      - occurred
      - modified
      - published
      - date
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    outputs:
    - contextPath: DigitalShadows.IntelligenceIncidents.Description
      description: Plain text description of this incident.
    - contextPath: DigitalShadows.IntelligenceIncidents.Id
      description: Identifier for this incident, unique in combination with the scope.
    - contextPath: DigitalShadows.IntelligenceIncidents.IndicatorOfCompromiseCount
      description: Count of IOCs that can be retrieved via /api/incidents/{id}/iocs endpoint.
    - contextPath: DigitalShadows.IntelligenceIncidents.Internal
      description: Will be true if domain belongs to your organization (as defined by the assets), false otherwise.
    - contextPath: DigitalShadows.IntelligenceIncidents.LinkedContentIncidents
      description: Other incidents that appear to be based on the same content as this incident. Each incident record will normally only contain the id and the scope it applies to. Could also include more details depending on the context it is called in.
    - contextPath: DigitalShadows.IntelligenceIncidents.Modified
      description: When was this incident last modified.
    - contextPath: DigitalShadows.IntelligenceIncidents.Occurred
      description: Best effort to establish when the incident occurred.
    - contextPath: DigitalShadows.IntelligenceIncidents.Published
      description: When was this incident originally published.
    - contextPath: DigitalShadows.IntelligenceIncidents.RelatedIncidentId
      description: If an incident specific to your organization exists for this intelligence incident, it will be included here.
    - contextPath: DigitalShadows.IntelligenceIncidents.RestrictedContent
      description: Identifies this incident as potentially containing questionable content. If this is true images will be restricted.
    - contextPath: DigitalShadows.IntelligenceIncidents.Scope
      description: Identifies whether this incident applies globally (intelligence) or just to your organization.
    - contextPath: DigitalShadows.IntelligenceIncidents.Severity
      description: Analyst defined severity based on potential risk to the client.
    - contextPath: DigitalShadows.IntelligenceIncidents.SubType
      description: The sub-category of incident that has been raised, if available.
    - contextPath: DigitalShadows.IntelligenceIncidents.Title
      description: A short but descriptive identifier for the incident.
    - contextPath: DigitalShadows.IntelligenceIncidents.Type
      description: The category of incident that has been raised.
    - contextPath: DigitalShadows.IntelligenceIncidents.Verified
      description: The moment when the incident was verified.
    - contextPath: DigitalShadows.IntelligenceIncidents.Version
      description: Each time an update occurs, this version number is incremented.
    description: Find intelligence incidents.
  - name: ds-find-intelligence-incidents-regional
    arguments:
    - name: threat_id
      description: Threat ID.
    - name: countryTag_created
      description: When was this tag created.
    - name: countryTag_description
      description: Description text for this tag.
    - name: countryTag_id
      description: Unique integer identifier for this tag.
    - name: countryTag_name
      description: The name of this tag. Is unique in combination with the type.
    - name: countryTag_parent_id
      description: Parent id of the tag.
    - name: countryTag_threat_id
      description: Unique integer identifier (among threats).
    - name: countryTag_threat_type
      auto: PREDEFINED
      predefined:
      - ACTOR
      - CAMPAIGN
      - EVENT
      - TOOL
      - SPECIFIC_TTP
      - LOCATION
      description: The type of profile being represented.
    - name: countryTag_type
      auto: PREDEFINED
      predefined:
      - ACTOR
      - ACTOR_TYPE
      - BRAND_PROTECTION
      - CLIENT_ROUTING
      - CYBER_THREAT
      - DATA_BREACH
      - DATA_COLLECTION_TYPE
      - DATA_LEAKAGE
      - EVENT
      - EVENT_TYPE
      - GENERAL
      - IMPACT_EFFECTS
      - INTENDED_EFFECTS
      - KILL_CHAIN
      - LANGUAGE
      - CRIMINAL_LOCATION
      - MOTIVATION
      - OPERATION
      - CAMPAIGN
      - PHYSICAL_SECURITY
      - INFRASTRUCTURE
      - PROCEDURES
      - SEED_DATA_LABEL
      - SOCIAL_MEDIA_COMPLIANCE
      - SOURCE_GEOGRAPHY
      - SPECIFIED_TARGETS
      - TARGET_GEOGRAPHY
      - TARGET_SECTORS
      - TECHNIQUES
      - TOOLS
      - CATEGORY_TTP
      - GENERAL_TTP
      - SPECIFIC_TTP
      - CVE_NUMBER
      - APP_STORE
      description: The type of this tag. The name of tags with the same type must be unique.
    - name: filter_dateRange
      description: Determines the interval the incidents must have occurred within to be included. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_periodRelativeTo
      description: Optional timestamp that will be used as the end date for a period based dateRange. If not specified, then the end of the current day (based on the requesting user's timezone) will be used.
    - name: filter_tagType
      auto: PREDEFINED
      predefined:
      - ACTOR
      - ACTOR_TYPE
      - BRAND_PROTECTION
      - CLIENT_ROUTING
      - CYBER_THREAT
      - DATA_BREACH
      - DATA_COLLECTION_TYPE
      - DATA_LEAKAGE
      - EVENT
      - EVENT_TYPE
      - GENERAL
      - IMPACT_EFFECTS
      - INTENDED_EFFECTS
      - KILL_CHAIN
      - LANGUAGE
      - CRIMINAL_LOCATION
      - MOTIVATION
      - OPERATION
      - CAMPAIGN
      - PHYSICAL_SECURITY
      - INFRASTRUCTURE
      - PROCEDURES
      - SEED_DATA_LABEL
      - SOCIAL_MEDIA_COMPLIANCE
      - SOURCE_GEOGRAPHY
      - SPECIFIED_TARGETS
      - TARGET_GEOGRAPHY
      - TARGET_SECTORS
      - TECHNIQUES
      - TOOLS
      - CATEGORY_TTP
      - GENERAL_TTP
      - SPECIFIC_TTP
      - CVE_NUMBER
      - APP_STORE
      description: What types of tags should be considered. Should be one of SOURCE_GEOGRAPHY or TARGET_GEOGRAPHY (the default).
    - name: regionTag_created
      description: When was this tag created.
    - name: regionTag_description
      description: Description text for this tag.
    - name: regionTag_id
      description: Unique integer identifier for this tag.
    - name: regionTag_name
      description: The name of this tag. Is unique in combination with the type.
    - name: regionTag_parent_id
      description: Parent id of the tag.
    - name: regionTag_threat_id
      description: Unique integer identifier (among threats).
    - name: regionTag_threat_type
      auto: PREDEFINED
      predefined:
      - ACTOR
      - CAMPAIGN
      - EVENT
      - TOOL
      - SPECIFIC_TTP
      - LOCATION
      description: The type of profile being represented.
    - name: regionTag_type
      auto: PREDEFINED
      predefined:
      - ACTOR
      - ACTOR_TYPE
      - BRAND_PROTECTION
      - CLIENT_ROUTING
      - CYBER_THREAT
      - DATA_BREACH
      - DATA_COLLECTION_TYPE
      - DATA_LEAKAGE
      - EVENT
      - EVENT_TYPE
      - GENERAL
      - IMPACT_EFFECTS
      - INTENDED_EFFECTS
      - KILL_CHAIN
      - LANGUAGE
      - CRIMINAL_LOCATION
      - MOTIVATION
      - OPERATION
      - CAMPAIGN
      - PHYSICAL_SECURITY
      - INFRASTRUCTURE
      - PROCEDURES
      - SEED_DATA_LABEL
      - SOCIAL_MEDIA_COMPLIANCE
      - SOURCE_GEOGRAPHY
      - SPECIFIED_TARGETS
      - TARGET_GEOGRAPHY
      - TARGET_SECTORS
      - TECHNIQUES
      - TOOLS
      - CATEGORY_TTP
      - GENERAL_TTP
      - SPECIFIC_TTP
      - CVE_NUMBER
      - APP_STORE
      description: The type of this tag. The name of tags with the same type must be unique.
    outputs:
    - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Id
      description: The ID of the country these incidents are attributed to.
    - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Name
      description: The country name these incidents are attributed to.
    - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.ParentId
      description: The parent ID of the country these incidents are attributed to.
    - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.ThreatId
      description: The threat id of the country tag these incidents are attributed to.
    - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Type
      description: The country tag type these incidents are attributed to.
    - contextPath: DigitalShadows.IntelligenceIncidentsRegional.IncidentIds
      description: The list of intelligence incidents.
    description: Incidents grouped by the target country over a given time range.
  - name: ds-get-intelligence-threat
    arguments:
    - name: threat_id
      required: true
      default: true
      description: The id of the intelligence threat to retrieve.
    - name: opt
      auto: PREDEFINED
      predefined:
      - LATEST_INCIDENT
      description: Options to include additional relevant data with the request.
    outputs:
    - contextPath: DigitalShadows.IntelligenceThreats.ActivityLevel
      description: Level of activity, based on last active.
    - contextPath: DigitalShadows.IntelligenceThreats.DetailLevel
      description: Determines how detailed the record is.
    - contextPath: DigitalShadows.IntelligenceThreats.EndDate
      description: The end date of the period this was/is active.
    - contextPath: DigitalShadows.IntelligenceThreats.Id
      description: Unique integer identifier (among threats).
    - contextPath: DigitalShadows.IntelligenceThreats.ImageId
      description: The unique identifier for an image of the threat, if available. The actual image can be retrieved by requesting /api/resources/{id} (replacing {id} with the value of this property).
    - contextPath: DigitalShadows.IntelligenceThreats.ImageThumbnailId
      description: The unique identifier for a thumbnail of the image, if available. The image can be retrieved by requesting /api/thumbnails/{id} (replacing {id} with the value of this property).
    - contextPath: DigitalShadows.IntelligenceThreats.IndicatorOfCompromiseCount
      description: Count of IOCs.
    - contextPath: DigitalShadows.IntelligenceThreats.LastActive
      description: The date of last activity (last incident).
    - contextPath: DigitalShadows.IntelligenceThreats.Recurring
      description: Will this become active again in future?
    - contextPath: DigitalShadows.IntelligenceThreats.StartDate
      description: The start date of the period this was/is active.
    - contextPath: DigitalShadows.IntelligenceThreats.Type
      description: The type of profile being represented.
    - contextPath: DigitalShadows.IntelligenceThreats.Tags.ActorTypeTags
      description: Tags for the type of actor.
    - contextPath: DigitalShadows.IntelligenceThreats.AnnouncementIncidentIDs
      description: List of public declarations made (incidents).
    - contextPath: DigitalShadows.IntelligenceThreats.AptReportIDs
      description: APT reports associated with this threat. Each entry can be resolved via the /api/apt-report/{id} endpoint.
    - contextPath: DigitalShadows.IntelligenceThreats.Tags.AssociatedActorTags
      description: Actors related to this threat (if any).
    - contextPath: DigitalShadows.IntelligenceThreats.Tags.AssociatedCampaignTags
      description: Campaigns related to this threat (if any).
    - contextPath: DigitalShadows.IntelligenceThreats.AssociatedEventIDs
      description: Events associated with this threat (if any).
    - contextPath: DigitalShadows.IntelligenceThreats.AttackEvidenceIncidentIDs
      description: List of damage caused incidents.
    - contextPath: DigitalShadows.IntelligenceThreats.Tags.ImpactEffectTags
      description: What impact did it have.
    - contextPath: DigitalShadows.IntelligenceThreats.Tags.IntendedEffectTags
      description: What the threat intended to happen.
    - contextPath: DigitalShadows.IntelligenceThreats.LatestIncidentID
      description: The latest incident attributed to this threat.
    - contextPath: DigitalShadows.IntelligenceThreats.Tags.MotivationTags
      description: Tags that define what motivates the threat.
    - contextPath: DigitalShadows.IntelligenceThreats.Tags.OverviewTags
      description: Tags that will appear in the overview. Only one per primary type.
    - contextPath: DigitalShadows.IntelligenceThreats.Tags.PrimaryLanguageTags
      description: Tags that identify the primary languages used.
    - contextPath: DigitalShadows.IntelligenceThreats.ThreatLevel
      description: Information about the level of threat, for example low or high.
    description: Retrieve a specific item of intelligence by its id.
  - name: ds-get-intelligence-threat-iocs
    arguments:
    - name: threat_id
      required: true
      default: true
      description: The intelligence threat identifier.
    - name: filter_types
      description: List of types to filter by. Possible values are IP,MD5,SHA1,SHA256,URL,CVE,EMAIL,HOST,REGISTRY,FILEPATH,FILENAME.
    - name: filter_value
      description: Value to filter by.
    - name: visible
      description: List of values to control the visibility of elements. If a value is present then the correspinding element should be displayed.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - value
      - type
      - updated
      - source
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    outputs:
    - contextPath: DigitalShadows.IntelligenceThreatIOCs.AptReportId
      description: If this IOC is associated with an APT report.
    - contextPath: DigitalShadows.IntelligenceThreatIOCs.Id
      description: Internal identifier for uniquely identifying this IOC.
    - contextPath: DigitalShadows.IntelligenceThreatIOCs.IntelIncidentId
      description: If this IOC is associated with an intel incident.
    - contextPath: DigitalShadows.IntelligenceThreatIOCs.LastUpdated
      description: When this record last changed.
    - contextPath: DigitalShadows.IntelligenceThreatIOCs.Source
      description: A comment provided by the analysts as to where this IOC came from.
    - contextPath: DigitalShadows.IntelligenceThreatIOCs.Type
      description: Identifies the type of incidicator that also determines how it is encoded into a string.
    - contextPath: DigitalShadows.IntelligenceThreatIOCs.Value
      description: The value of this indicator, encoded according to its type. For example hashes are base16 encoded.
    description: Retrieve the indicatorsOfCompromise for a threat record.
  - name: ds-get-intelligence-threat-activity
    arguments:
    - name: customPrimaryTags_id
      description: Instead of most active, specify the ids of threat primary tags to retrieve activity for.
    - name: includeIncidents
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Should basic incident information be included with the activity for each tag.
    - name: maximumIncidentsPerTag
      description: Upper limit on the number of incidents to include for each threat.
    - name: mostActiveForTypes
      description: Fetch the top presetPerTypeCount most active threats for each type. Possible values:ACTOR,CAMPAIGN,EVENT,TOOL,SPECIFIC_TTP,LOCATION.
    - name: mostActiveLimit
      description: How many threats to retrieve activity for per threat type. Only applies when mostActiveForTypes is not null. If not specified, 10 is assumed.
    - name: segmentCount
      description: Number of time segments to aggregrate the incidents into.
    - name: filter_dateRange
      required: true
      description: Return activity that occurred in this date range. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    description: Threat activity based on the number of intelligence incidents over a given period of time.
  - name: ds-find-intelligence-threats
    arguments:
    - name: filter_dateRange
      description: Only return results that were last active within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_dateRangeField
      auto: PREDEFINED
      predefined:
      - lastActive
      - modified
      description: Determines which date/time field the dateRange will apply to.
    - name: filter_identifiers
      description: List of identifiers. Only return threat profiles with these identifiers.
    - name: filter_relevantTo
      auto: PREDEFINED
      predefined:
      - ANY
      - ORGANIZATION
      - INDUSTRY_SECTOR
      description: Narrow to threats that have a specific relevance to my organization.
    - name: filter_tagOperator
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether multiple tags should be logically applied as AND/OR with the resultset.
    - name: filter_tags
      description: Limit to threats related to these tags only.
    - name: filter_threatLevels
      description: Only include threats with one of these threat levels.
    outputs:
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.ActivityLevel
      description: Level of activity, based on last active.
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.Id
      description: Unique integer identifier (among threats).
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.ImageId
      description: The unique identifier for an image of the threat, if available. The actual image can be retrieved by requesting /api/resources/{id} (replacing {id} with the value of this property).
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.LastActive
      description: The date of last activity (last incident).
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.Type
      description: The type of profile being represented.
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.ThreatLevelType
      description: Information about the level of threat, for example low or high.
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.Event
      description: For an EVENT or CAMPAIGN threat this will contain a summary of when it occurred and possibly when it will re-occur.
    description: Find intelligence threat records.
  - name: ds-find-intelligence-threats-regional
    arguments:
    - name: countryTag_created
      description: When was this tag created.
    - name: countryTag_description
      description: Description text for this tag.
    - name: countryTag_id
      description: Unique integer identifier for this tag.
    - name: countryTag_name
      description: The name of this tag. Is unique in combination with the type.
    - name: countryTag_parent_id
      description: Parent id of the tag.
    - name: countryTag_threat_id
      description: Unique integer identifier (among threats).
    - name: countryTag_threat_type
      auto: PREDEFINED
      predefined:
      - ACTOR
      - CAMPAIGN
      - EVENT
      - TOOL
      - SPECIFIC_TTP
      - LOCATION
      description: The type of profile being represented.
    - name: countryTag_type
      auto: PREDEFINED
      predefined:
      - ACTOR
      - ACTOR_TYPE
      - BRAND_PROTECTION
      - CLIENT_ROUTING
      - CYBER_THREAT
      - DATA_BREACH
      - DATA_COLLECTION_TYPE
      - DATA_LEAKAGE
      - EVENT
      - EVENT_TYPE
      - GENERAL
      - IMPACT_EFFECTS
      - INTENDED_EFFECTS
      - KILL_CHAIN
      - LANGUAGE
      - CRIMINAL_LOCATION
      - MOTIVATION
      - OPERATION
      - CAMPAIGN
      - PHYSICAL_SECURITY
      - INFRASTRUCTURE
      - PROCEDURES
      - SEED_DATA_LABEL
      - SOCIAL_MEDIA_COMPLIANCE
      - SOURCE_GEOGRAPHY
      - SPECIFIED_TARGETS
      - TARGET_GEOGRAPHY
      - TARGET_SECTORS
      - TECHNIQUES
      - TOOLS
      - CATEGORY_TTP
      - GENERAL_TTP
      - SPECIFIC_TTP
      - CVE_NUMBER
      - APP_STORE
      description: The type of this tag. The name of tags with the same type must be unique.
    - name: filter_dateRange
      description: Determines the interval the incidents must have occurred within to be included. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_periodRelativeTo
      description: Optional timestamp that will be used as the end date for a period based dateRange. If not specified, then the end of the current day (based on the requesting user's timezone) will be used.
    - name: filter_tagType
      auto: PREDEFINED
      predefined:
      - ACTOR
      - ACTOR_TYPE
      - BRAND_PROTECTION
      - CLIENT_ROUTING
      - CYBER_THREAT
      - DATA_BREACH
      - DATA_COLLECTION_TYPE
      - DATA_LEAKAGE
      - EVENT
      - EVENT_TYPE
      - GENERAL
      - IMPACT_EFFECTS
      - INTENDED_EFFECTS
      - KILL_CHAIN
      - LANGUAGE
      - CRIMINAL_LOCATION
      - MOTIVATION
      - OPERATION
      - CAMPAIGN
      - PHYSICAL_SECURITY
      - INFRASTRUCTURE
      - PROCEDURES
      - SEED_DATA_LABEL
      - SOCIAL_MEDIA_COMPLIANCE
      - SOURCE_GEOGRAPHY
      - SPECIFIED_TARGETS
      - TARGET_GEOGRAPHY
      - TARGET_SECTORS
      - TECHNIQUES
      - TOOLS
      - CATEGORY_TTP
      - GENERAL_TTP
      - SPECIFIC_TTP
      - CVE_NUMBER
      - APP_STORE
      description: What types of tags should be considered. Should be one of SOURCE_GEOGRAPHY or TARGET_GEOGRAPHY (the default).
    - name: regionTag_created
      description: When was this tag created.
    - name: regionTag_description
      description: Description text for this tag.
    - name: regionTag_id
      description: Unique integer identifier for this tag.
    - name: regionTag_name
      description: The name of this tag. Is unique in combination with the type.
    - name: regionTag_parent_id
      description: Parent id of the tag.
    - name: regionTag_threat_id
      description: Unique integer identifier (among threats).
    - name: regionTag_threat_type
      auto: PREDEFINED
      predefined:
      - ACTOR
      - CAMPAIGN
      - EVENT
      - TOOL
      - SPECIFIC_TTP
      - LOCATION
      description: The type of profile being represented.
    - name: regionTag_type
      auto: PREDEFINED
      predefined:
      - ACTOR
      - ACTOR_TYPE
      - BRAND_PROTECTION
      - CLIENT_ROUTING
      - CYBER_THREAT
      - DATA_BREACH
      - DATA_COLLECTION_TYPE
      - DATA_LEAKAGE
      - EVENT
      - EVENT_TYPE
      - GENERAL
      - IMPACT_EFFECTS
      - INTENDED_EFFECTS
      - KILL_CHAIN
      - LANGUAGE
      - CRIMINAL_LOCATION
      - MOTIVATION
      - OPERATION
      - CAMPAIGN
      - PHYSICAL_SECURITY
      - INFRASTRUCTURE
      - PROCEDURES
      - SEED_DATA_LABEL
      - SOCIAL_MEDIA_COMPLIANCE
      - SOURCE_GEOGRAPHY
      - SPECIFIED_TARGETS
      - TARGET_GEOGRAPHY
      - TARGET_SECTORS
      - TECHNIQUES
      - TOOLS
      - CATEGORY_TTP
      - GENERAL_TTP
      - SPECIFIC_TTP
      - CVE_NUMBER
      - APP_STORE
      description: The type of this tag. The name of tags with the same type must be unique.
    - name: threat_id
      description: Id of the threat.
    outputs:
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.ActivityLevel
      description: Level of activity, based on last active.
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.Id
      description: Unique integer identifier (among threats).
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.ImageId
      description: The unique identifier for an image of the threat, if available. The actual image can be retrieved by requesting /api/resources/{id} (replacing {id} with the value of this property).
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.LastActive
      description: The date of last activity (last incident).
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.Type
      description: The type of profile being represented.
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.ThreatLevelType
      description: Information about the level of threat, for example low or high.
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.Event
      description: For an EVENT or CAMPAIGN threat this will contain a summary of when it occurred and possibly when it will re-occur.
    - contextPath: DigitalShadows.IntelligenceThreatsRegional.OverviewTags
      description: Tags that will appear in the overview. Only one per primary type.
    description: Threat profiles associated with incidents over a given time range.
  - name: ds-get-port-reviews
    arguments:
    - name: port
      required: true
      default: true
      description: Port inspection id.
    - name: incidentId
      description: ID of incident to query.
    outputs:
    - contextPath: DigitalShadows.IpPortReviews.Created
      description: The moment in time the review was created.
    - contextPath: DigitalShadows.IpPortReviews.Status
      description: Review status.
    - contextPath: DigitalShadows.IpPortReviews.Version
      description: Starts counting at 1 and increments for each review of a given port. Will initially be 0 until a review is performed (when returned as part of a port).
    - contextPath: DigitalShadows.IpPortReviews.Incident.Id
      description: Id of the incident the port inspection is associated with.
    - contextPath: DigitalShadows.IpPortReviews.Incident.Scope
      description: Scope of the incident the port inspection is associated with.
    - contextPath: DigitalShadows.IpPortReviews.User.Id
      description: ID of the user that changed the status/set the note.
    - contextPath: DigitalShadows.IpPortReviews.User.FullName
      description: Full name of the user that changed the status/set the note.
    description: Retrieve all review updates for a given port inspection.
  - name: ds-snapshot-port-review
    arguments:
    - name: port
      required: true
      default: true
      description: Port inspection id.
    - name: version
      description: When submitting, this value can be optionally set to the version of the most recently read review.
    - name: status
      auto: PREDEFINED
      predefined:
      - OPEN
      - CLOSED
      description: Review status.
    - name: incident_id
      description: Identifier for this incident, unique in combination with the scope.
    - name: incident_scope
      auto: PREDEFINED
      predefined:
      - GLOBAL
      - ORGANIZATION
      description: Identifies whether this incident applies globally (intelligence) or just to your organization.
    description: Snapshot the review status of a port inspection.
  - name: ds-find-ports
    arguments:
    - name: filter_alerted
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Only include SSL/certificates with associated incidents that have been alerted.
    - name: filter_detectedClosed
      description: Only return IP ports that were detected closed.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: filter_detectedOpen
      description: Only return IP ports that were detected open within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_domainName
      description: Name of domain to filter by.
    - name: filter_incidentTypes
      auto: PREDEFINED
      predefined:
      - DATA_LEAKAGE
      - CYBER_THREAT
      - PHYSICAL_SECURITY
      - SOCIAL_MEDIA_COMPLIANCE
      - BRAND_PROTECTION
      - INFRASTRUCTURE
      description: The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered.
    - name: filter_incidentSubTypes
      description: List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT.
    - name: filter_ipAddress
      description: IP address to filter by.
    - name: filter_ipRange_lowerAddress
      description: Lower address for ip range.
    - name: filter_ipRange_maskBits
      description: Int value for mask bits.
    - name: filter_ipRange_upperAddress
      description: Upper address for ip range.
    - name: filter_markedClosed
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Is incident closed.
    - name: filter_published
      description: Only return IP ports that were published within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_severities
      description: Only include SSL/certificate infrastructure incidents with these severities. String values from VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - published
      - detected
      - domain
      - grade
      - expiryDate
      - severity
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    outputs:
    - contextPath: DigitalShadows.IpPorts.DiscoveredOpen
      description: When was the port found to be open.
    - contextPath: DigitalShadows.IpPorts.Id
      description: Identifier for the port inspection.
    - contextPath: DigitalShadows.IpPorts.IpAddress
      description: The IP address this port was found on.
    - contextPath: DigitalShadows.IpPorts.PortNumber
      description: The IP port number scanned (1-65535).
    - contextPath: DigitalShadows.IpPorts.Transport
      description: IP transport protocol used.
    - contextPath: DigitalShadows.IpPorts.Incident.Id
      description: Id the most recent incident to include this port.
    - contextPath: DigitalShadows.IpPorts.Incident.Scope
      description: Scope of the most recent incident to include this port.
    - contextPath: DigitalShadows.IpPorts.Incident.Severity
      description: Severity of the most recent incident to include this port.
    - contextPath: DigitalShadows.IpPorts.Incident.SubType
      description: Subtype of the most recent incident to include this port.
    - contextPath: DigitalShadows.IpPorts.Incident.Type
      description: Type of the most recent incident to include this port.
    - contextPath: DigitalShadows.IpPorts.Incident.Title
      description: Title of the most recent incident to include this port.
    - contextPath: DigitalShadows.IpPorts.Incident.Published
      description: Published time the most recent incident to include this port.
    - contextPath: DigitalShadows.IpPorts.Review.Status
      description: Status of when the port was last reviewed.
    - contextPath: DigitalShadows.IpPorts.Review.UserId
      description: User Id of the port last review.
    - contextPath: DigitalShadows.IpPorts.Review.UserName
      description: Name of user who created last review.
    - contextPath: DigitalShadows.IpPorts.Review.Version
      description: Version of last port review.
    description: Find ports.
  - name: ds-find-secure-sockets
    arguments:
    - name: filter_alerted
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Only include SSL/certificates with associated incidents that have been alerted.
    - name: filter_detected
      description: Only include detected sockets.
    - name: filter_determinedResolved
      description: Only include determined resolved sockets.
    - name: filter_domain
      description: Filter by domain.
    - name: filter_expiry
      description: Filter by expiry date.
    - name: filter_grades
      description: List of grades (A,B,C,D,E,F,T).
    - name: filter_incidentTypes
      auto: PREDEFINED
      predefined:
      - DATA_LEAKAGE
      - CYBER_THREAT
      - PHYSICAL_SECURITY
      - SOCIAL_MEDIA_COMPLIANCE
      - BRAND_PROTECTION
      - INFRASTRUCTURE
      description: The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered.
    - name: filter_incidentSubTypes
      description: List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT.
    - name: filter_ipAddress
      description: IP address to filter by.
    - name: filter_issues
      description: List of string values from POODLE, POODLE_TLS, FREAK, DROWN, LOGJAM, RC4_AVAILABLE, SELF_SIGNED, MD5_OR_SHA1_SIGNED, REVOKED, EXPIRING_LOW, EXPIRING_MEDIUM, EXPIRING_HIGH, EXPIRED, HOSTNAME_MISMATCH, TLS_1_2_NOT_FOUND.
    - name: filter_markedClosed
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Is incident closed.
    - name: filter_published
      description: Filter by publish time.
    - name: filter_revoked
      description: Only include revoked sockets.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: filter_severities
      description: Only include SSL/certificate infrastructure incidents with these severities. String values from VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE.
    - name: filter_statuses
      description: Only include SSL/certificates with associated incidents having these statuses, (or with any status if none are supplied). UNREAD, READ, CLOSED.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - published
      - detected
      - domain
      - grade
      - expiryDate
      - severity
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    outputs:
    - contextPath: DigitalShadows.SecureSockets.Id
      description: Unique identifier for this inspection.
    - contextPath: DigitalShadows.SecureSockets.ReverseDomainName
      description: The reverse DNS name of the host.
    - contextPath: DigitalShadows.SecureSockets.CertificateCommonName
      description: The server certificate common name.
    - contextPath: DigitalShadows.SecureSockets.Discovered
      description: When were the certificate issue(s) found.
    - contextPath: DigitalShadows.SecureSockets.DomainName
      description: The domain name the secure socket was discovered on for the default port 443/TCP.
    - contextPath: DigitalShadows.SecureSockets.Grade
      description: The rating calculated for the secure socket at the time of the scan.
    - contextPath: DigitalShadows.SecureSockets.IpAddress
      description: The actual IP address the probe connected to.
    - contextPath: DigitalShadows.SecureSockets.PortNumber
      description: The port number the socket was found listening on.
    - contextPath: DigitalShadows.SecureSockets.Transport
      description: IP transport protocol used, most likely TCP.
    - contextPath: DigitalShadows.SecureSockets.Issues
      description: The set of issues detected for the secure socket.
    - contextPath: DigitalShadows.SecureSockets.Review.Status
      description: Status of most recent review of this inspection.
    - contextPath: DigitalShadows.SecureSockets.Review.UserId
      description: ID of user who created the most recent review of this inspection.
    - contextPath: DigitalShadows.SecureSockets.Review.UserName
      description: Name of user who created the most recent review of this inspection.
    - contextPath: DigitalShadows.SecureSockets.Review.Version
      description: Version of most recent review of this inspection.
    - contextPath: DigitalShadows.SecureSockets.Incident.Id
      description: Incident corresponding for this secure socket issues occurence.
    - contextPath: DigitalShadows.SecureSockets.Incident.Scope
      description: Scope of incident corresponding for this secure socket issues occurence.
    - contextPath: DigitalShadows.SecureSockets.Incident.Severity
      description: Severity of incident corresponding for this secure socket issues occurence.
    - contextPath: DigitalShadows.SecureSockets.Incident.SubType
      description: SubType of incident corresponding for this secure socket issues occurence.
    - contextPath: DigitalShadows.SecureSockets.Incident.Type
      description: Type of incident corresponding for this secure socket issues occurence.
    - contextPath: DigitalShadows.SecureSockets.Incident.Title
      description: Title of incident corresponding for this secure socket issues occurence.
    - contextPath: DigitalShadows.SecureSockets.Incident.Published
      description: Published time of incident corresponding for this secure socket issues occurence.
    description: Find secure sockets.
  - name: ds-find-vulnerabilities
    arguments:
    - name: filter_alerted
      description: Only include SSL/certificates with associated incidents that have been alerted.
    - name: filter_cveIdentifiers
      description: Filter by CVE identifiers.
    - name: filter_detected
      description: Only return vulnerabilities that were detected within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_detectedClosed
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: True or false.
    - name: filter_domainName
      description: Name of domain to filter by.
    - name: filter_incidentTypes
      auto: PREDEFINED
      predefined:
      - DATA_LEAKAGE
      - CYBER_THREAT
      - PHYSICAL_SECURITY
      - SOCIAL_MEDIA_COMPLIANCE
      - BRAND_PROTECTION
      - INFRASTRUCTURE
      description: The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered.
    - name: filter_incidentSubTypes
      description: List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT.
    - name: filter_ipAddress
      description: IP address to filter by.
    - name: filter_markedClosed
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Filter by incidents that are marked as CLOSED.
    - name: filter_published
      description: Only return vulnerabilities that were published within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_severities
      description: List of sevirity values to filter by. Can be VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - ipAddress
      - detected
      - published
      - severity
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    outputs:
    - contextPath: DigitalShadows.Vulnerabilities.CveId
      description: The CVE id.
    - contextPath: DigitalShadows.Vulnerabilities.Id
      description: Identifier for this detected vulnerability.
    - contextPath: DigitalShadows.Vulnerabilities.Discovered
      description: When was the vulnerability found.
    - contextPath: DigitalShadows.Vulnerabilities.IpAddress
      description: The IP address this port was found on.
    - contextPath: DigitalShadows.Vulnerabilities.Review.Status
      description: Status of most recent review of this vulnerability.
    - contextPath: DigitalShadows.Vulnerabilities.Review.UserId
      description: ID of user who created the most recent review of this vulnerability.
    - contextPath: DigitalShadows.Vulnerabilities.Review.UserName
      description: Name of user who created the most recent review of this vulnerability.
    - contextPath: DigitalShadows.Vulnerabilities.Review.Version
      description: Version of most recent review of this vulnerability.
    - contextPath: DigitalShadows.Vulnerabilities.Incident.Id
      description: ID of incident corresponding for this vulnerability occurence.
    - contextPath: DigitalShadows.Vulnerabilities.Incident.Scope
      description: Scope of incident corresponding for this vulnerability occurence.
    - contextPath: DigitalShadows.Vulnerabilities.Incident.Severity
      description: Severity of incident corresponding for this vulnerability occurence.
    - contextPath: DigitalShadows.Vulnerabilities.Incident.SubType
      description: SubType of incident corresponding for this vulnerability occurence.
    - contextPath: DigitalShadows.Vulnerabilities.Incident.Type
      description: Type of incident corresponding for this vulnerability occurence.
    - contextPath: DigitalShadows.Vulnerabilities.Incident.Title
      description: Title of incident corresponding for this vulnerability occurence.
    - contextPath: DigitalShadows.Vulnerabilities.Incident.Published
      description: Published of incident corresponding for this vulnerability occurence.
    description: Find vulnerabilities.
  - name: ds-search
    arguments:
    - name: filter_datePeriod
      description: Only return results that occurred during the given period prior to the current time. For absolute dates, use from and until.
    - name: filter_dateRange
      description: Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}.
    - name: filter_from
      description: Only return results that were last active after this date/time (inclusive).
    - name: filter_tags
      description: Only return results that have the following tags associated with them.
    - name: filter_types
      auto: PREDEFINED
      predefined:
      - ACTORS
      - CAMPAIGNS
      - INCIDENTS
      - EVENT
      - SPECIFIC_TTP
      - LOCATION
      - DATA_BREACH
      - CLOSED_SOURCES
      description: Restrict the result types to only those listed here. At least one value is required.
    - name: filter_until
      description: Only return results that were last active before this date/time (inclusive).
    - name: query
      description: The query text to search for.
    - name: sort_direction
      auto: PREDEFINED
      predefined:
      - ASCENDING
      - DESCENDING
      description: The direction of sorting. If not specified, ASCENDING is assumed.
    - name: sort_property
      auto: PREDEFINED
      predefined:
      - relevance
      - sortDate
      description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'.
    - name: pagination_offset
      description: Include results at this offset within the full resultset, where the first result is at position 0.
    - name: pagination_size
      description: Maximum number of results to return per page, can be initially null to be replaced by default later.
    - name: pagination_containingId
      description: Select the page containing the record with this id, if supported. Mutually exclusive with offset.
    description: Perform a textual search against the available record types.
  - name: ds-get-tags
    arguments:
    - name: ids
      description: One or more tag identifiers.
    - name: detailed
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Determines whether the tag descriptions will be included.
    description: Batch retrieve specic tags by their ids.
  isfetch: true
fromversion: 5.0.0
defaultmapperin: Digital Shadows Incident Mapper
defaultclassifier: Digital Shadows Incident Classifier
tests:
- No tests (auto formatted)