GCenter 103

category: Network Security
provider: Gatewatcher
sectionorder:
- Connect
- Collect
commonfields:
  id: GCenter 103
  version: -1
configuration:
- display: GCenter IP address or FQDN
  name: ip
  required: true
  type: 0
  section: Connect
  additionalinfo: The IP address or the Fully Qualified Domain Name of the GCenter from where the events will be fetched.
- displaypassword: GCenter API token
  name: token
  required: false
  hiddenusername: true
  type: 9
  section: Connect
- display: "GCenter account"
  name: credentials
  required: false
  type: 9
  section: Connect
- display: GCenter Version
  name: version
  required: false
  type: 0
  section: Connect
  defaultvalue: 2.5.3.103
- display: Check the TLS certificate
  name: check_cert
  required: false
  type: 8
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- name: fetch_type
  display: Fetch incidents from type
  defaultvalue: Alerts
  type: 15
  options:
  - Alerts
  - Metadata
  - Both
  required: false
  section: Collect
- name: engine_selection
  display: Engine alerts selection
  type: 16
  options:
  - malcore
  - malcore_retroanalyzer
  - shellcode_detect
  - malicious_powershell_detect
  - sigflow_alert
  - dga_detect
  - active_cti
  - retrohunt
  - ransomware_detect
  - beacon_detect
  required: false
  section: Collect
- display: First fetch
  name: first_fetch
  type: 0
  additionalinfo: This value represents how far the first fetch will grab the events stored in the GCenter e.g. 2 days
  section: Collect
  required: false
- defaultvalue: 200
  display: Fetch limit
  name: max_fetch
  type: 0
  additionalinfo: This value represents the maximum events fetched by instruction, this integration can handle up to 10000. The default value is 200 and is the optimum for Cortex XSOAR.
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
description: This integration fetch events generated by the GCenter appliance.
display: GCenter 103
name: GCenter 103
script:
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  commands:
  - arguments:
    - description: Starting date filter. ISO-8601 date format.
      name: date_from
    - description: Ending data filter. ISO-8601 date format.
      name: date_to
    - auto: PREDEFINED
      description: Not compatible with date_from and date_to parameters.
      name: since
      predefined:
      - 15d
      - yesterday
    - description: A comma-separated list of alert IDs.
      name: ids
      isArray: true
    - description: A comma-separated list of alert IDs to exclude.
      name: excluded_ids
      isArray: true
    - auto: PREDEFINED
      description: Whether to filter on the acknowledgement status.
      name: acknowledged
      predefined:
      - "true"
      - "false"
    - description: Comma-separated list of GCap IDs. First GCap has ID 1.
      name: gcap_id
      isArray: true
    - description: Comma-separated list of IP addresses of the alerts.
      name: ip
      isArray: true
    - description: Comma-separated list of source IP addresses of the alerts.
      name: src_ip
      isArray: true
    - description: Comma-separated list of destination IP addresses of the alerts.
      name: dest_ip
      isArray: true
    - description: Minimal risk value.
      name: risk_min
    - description: Maximal risk value.
      name: risk_max
    - description: Filter on alert signature. Comma-separated list of signatures.
      name: name
      isArray: true
    - description: Filter alerts on their description.
      name: description
    - description: Filter on alerts containing tags. Comma-separated list of tag names.
      name: tag
      isArray: true
    - auto: PREDEFINED
      description: Whether to include users with no tags.
      name: no_tag
      predefined:
      - "true"
      - "false"
    - description: Filter out alerts containing tags. Comma-separated list of tags. Logical OR between the tags.
      name: excluded_tags
      isArray: true
    - auto: PREDEFINED
      description: The filter by which to sort the results.
      name: sort_by
      predefined:
      - date
      - -date
      - risk
      - -risk
      - name
      - -name
    - auto: PREDEFINED
      description: The type by which to filter alerts on engines.
      name: type
      predefined:
      - active_cti
      - beacon_detect
      - dga_detect
      - malcore
      - malcore_retroanalyzer
      - malicious_powershell_detect
      - ransomware_detect
      - retrohunt
      - shellcode_detect
      - sigflow_alert
    - auto: PREDEFINED
      description: Filter alert by MITRE tactic name.
      name: mitre_tactic_name
      predefined:
      - Collection
      - Collection (ICS)
      - Collection (Mobile)
      - Command and Control
      - Command and Control (ICS)
      - Command and Control (Mobile)
      - Credential Access
      - Credential Access (Mobile)
      - Defense Evasion
      - Defense Evasion (Mobile)
      - Discovery, Discovery (ICS)
      - Discovery (Mobile)
      - Evasion
      - Execution
      - Execution (ICS)
      - Execution (Mobile)
      - Exfiltration
      - Exfiltration (Mobile)
      - Impact
      - Impact (ICS)
      - Impact (Mobile)
      - Impair Process Control
      - Inhibit Response Function
      - Initial Access
      - Initial Access (ICS)
      - Initial Access (Mobile)
      - Lateral Movement
      - Lateral Movement (ICS)
      - Lateral Movement (Mobile)
      - Persistence
      - Persistence (ICS)
      - Persistence (Mobile)
      - Privilege Escalation
      - Privilege Escalation (ICS)
      - Privilege Escalation (Mobile)
      - Reconnaissance
      - Resource Development
    - description: Comma-separated list of hostnames.
      name: hostname
      isArray: true
    - description: Comma-separated list of source hostnames.
      name: src_hostname
      isArray: true
    - description: Comma-separated list of destination hostnames.
      name: dest_hostname
      isArray: true
    - description: Comma-separated list of usernames.
      name: username
      isArray: true
    - description: User note content.
      name: note
    - auto: PREDEFINED
      description: Filter alerts on their state.
      name: state
      predefined:
      - closed
      - mute
      - open
    - description: A search term.
      name: search
    - description: A page to select in the results set.
      name: page
    - description: Number of results per page.
      name: page_size
    name: gcenter103-alerts-list
    description: List all alerts.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Alerts.List.uuid
      description: Alert UUIDs.
      type: string
  - arguments:
    - description: UUID or GCenter ID of the alert.
      name: uuid
      required: true
    name: gcenter103-alerts-get
    description: Get an alert with its UUID (corresponds to event.id field) or the GCenter ID of the alert.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Alerts.Get.uuid
      description: The UUID of the alert fetched.
      type: string
  - arguments:
    - description: The note to set on the alert.
      name: note
      required: true
    - description: The UUID of the alert to set the note on (corresponds to event.id field).
      name: uuid
      required: true
    - auto: PREDEFINED
      description: Whether to overwrite the note.
      name: overwrite
      required: true
      predefined:
      - "true"
      - "false"
    name: gcenter103-alerts-note-add
    description: Add or update a note to an alert.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Alerts.Note.Add.note
      description: The note added to the alert.
      type: string
  - arguments:
    - description: The UUID of the alert to delete the note on (corresponds to event.id field).
      name: uuid
      required: true
    name: gcenter103-alerts-note-remove
    description: Delete the note of an alert.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Alerts.Note.Remove.uuid
      description: The UUID of the alert whose note was removed.
      type: string
  - arguments:
    - description: The UUID of the alert to get tags (corresponds to event.id field).
      name: uuid
      required: true
    name: gcenter103-alerts-tags-get
    description: Get the tags of an alert.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Alerts.Tags.Get.tags
      description: The tags of the alert.
      type: string
    - contextPath: Gatewatcher.Alerts.Tags.Get.uuid
      description: The UUID of the alert having these tags.
      type: string
  - arguments:
    - description: The UUID of the alert to add tags (corresponds to event.id field).
      name: uuid
      required: true
    - description: A comma-separated list of tag names to add to the alert.
      name: tags
      required: true
      isArray: true
    name: gcenter103-alerts-tags-add
    description: Add or update tags of an alert.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Alerts.Tags.Add.tags
      description: The tags added to the alert.
      type: string
    - contextPath: Gatewatcher.Alerts.Tags.Add.uuid
      description: The UUID of the alert where the tags were added.
      type: string
  - arguments:
    - description: The UUID of the alert from which to remove tags (corresponds to event.id field).
      name: uuid
      required: true
    - description: A comma-separated list of tag names to remove to the alert.
      name: tags
      required: true
      isArray: true
    name: gcenter103-alerts-tags-remove
    description: Remove tags from an alert.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Alerts.Tags.Remove
      description: The tags present in the alert.
      type: string
  - arguments:
    - description: A note to add/update.
      name: note_u
    - description: Tags to add/update.
      name: tag_u
      isArray: true
    - description: Starting date filter. ISO-8601 date format.
      name: date_from
    - description: Ending data filter. ISO-8601 date format.
      name: date_to
    - auto: PREDEFINED
      description: Not compatible with date_from and date_to parameters.
      name: since
      predefined:
      - 15d
      - yesterday
    - description: UUID of the alert to perform action (corresponds to event.id field).
      name: uuid
      required: true
    - auto: PREDEFINED
      description: Whether to filter on the acknowledgement status.
      name: acknowledged
      predefined:
      - "true"
      - "false"
    - description: Comma-separated list of GCap IDs. First GCap has ID 1.
      name: gcap_id
      isArray: true
    - description: Comma-separated list of IP addresses of the alerts.
      name: ip
      isArray: true
    - description: Comma-separated list of source IP addresses of the alerts.
      name: src_ip
      isArray: true
    - description: Comma-separated list of destination IP addresses of the alerts.
      name: dest_ip
      isArray: true
    - description: Minimal risk value.
      name: risk_min
    - description: Maximal risk value.
      name: risk_max
    - description: Filter on alert signature. Comma-separated list of signatures.
      name: name
      isArray: true
    - description: Filter alerts on their description.
      name: description
    - description: Filter on alerts containing tags. Comma-separated list of tag names.
      name: tag
      isArray: true
    - auto: PREDEFINED
      description: Whether to include users with no tags.
      name: no_tag
      predefined:
      - "true"
      - "false"
    - description: Filter out alerts containing tags. Comma-separated list of tags. Logical OR between the tags.
      name: excluded_tags
      isArray: true
    - auto: PREDEFINED
      description: The filter by which to sort the results.
      name: sort_by
      predefined:
      - date
      - -date
      - risk
      - -risk
      - name
      - -name
    - auto: PREDEFINED
      description: The type by which to filter alerts on engines.
      name: type
      predefined:
      - active_cti
      - beacon_detect
      - dga_detect
      - malcore
      - malcore_retroanalyzer
      - malicious_powershell_detect
      - ransomware_detect
      - retrohunt
      - shellcode_detect
      - sigflow_alert
    - auto: PREDEFINED
      description: Filter alert by MITRE tactic name.
      name: mitre_tactic_name
      predefined:
      - Collection
      - Collection (ICS)
      - Collection (Mobile)
      - Command and Control
      - Command and Control (ICS)
      - Command and Control (Mobile)
      - Credential Access
      - Credential Access (Mobile)
      - Defense Evasion
      - Defense Evasion (Mobile)
      - Discovery, Discovery (ICS)
      - Discovery (Mobile)
      - Evasion
      - Execution
      - Execution (ICS)
      - Execution (Mobile)
      - Exfiltration
      - Exfiltration (Mobile)
      - Impact
      - Impact (ICS)
      - Impact (Mobile)
      - Impair Process Control
      - Inhibit Response Function
      - Initial Access
      - Initial Access (ICS)
      - Initial Access (Mobile)
      - Lateral Movement
      - Lateral Movement (ICS)
      - Lateral Movement (Mobile)
      - Persistence
      - Persistence (ICS)
      - Persistence (Mobile)
      - Privilege Escalation
      - Privilege Escalation (ICS)
      - Privilege Escalation (Mobile)
      - Reconnaissance
      - Resource Development
    - description: Comma-separated list of hostnames.
      name: hostname
      isArray: true
    - description: Comma-separated list of source hostnames.
      name: src_hostname
      isArray: true
    - description: Comma-separated list of destination hostnames.
      name: dest_hostname
      isArray: true
    - description: Comma-separated list of usernames.
      name: username
      isArray: true
    - description: User note content.
      name: note
    - auto: PREDEFINED
      description: Filter alerts on their state.
      name: state
      predefined:
      - closed
      - mute
      - open
    - description: A search term.
      name: search
    - auto: PREDEFINED
      description: The action to perform on the alerts.
      name: action
      predefined:
      - acknowledge
      - open
      - tag
      - untag
      - note
      - open_related
      - close_related
      - mute_signature
      - unmute_signature
      required: true
    name: gcenter103-alerts-status-update
    description: Update status of an alert.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Alerts.Status.Update
      description: The updated status of the alerts.
      type: string
  - arguments:
    - description: UUID of the alert to fetch (corresponds to event.id field).
      name: uuid
      required: true
    name: gcenter103-raw-alerts-get
    description: Get a raw alert with its UUID.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Raw.Alerts.Get
      description: The alert content.
      type: string
  - arguments:
    - description: UUID of the alert to fetch (corresponds to event.id field).
      name: uuid
      required: true
    name: gcenter103-raw-alerts-file-get
    description: Get a file attached to an alert with its UUID.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Raw.Alerts.File.Get
      description: The zip file.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: Engine that will scan the file.
      name: engine
      required: true
      predefined:
      - malcore
      - powershell
      - shellcode
    - description: Entry ID of the file to scan.
      name: entryID
      required: true
    name: gcenter103-file-scan
    description: Scan a file on a selected engine. You must upload the file to scan before execution.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.File.Scan
      description: Results of the scan.
      type: string
  - arguments:
    - description: ID of a previous file scan.
      name: id
      required: true
    name: gcenter103-file-scan-result-get
    description: Retrieve previous scan by its ID.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.File.Scan.Result.Get
      description: Result of the file scan.
      type: string
  - arguments:
    - description: Starting date filter. ISO-8601 date format.
      name: date_from
    - description: Ending data filter. ISO-8601 date format.
      name: date_to
    - auto: PREDEFINED
      description: Not compatible with date_from and date_to parameters.
      name: since
      predefined:
      - 15d
      - yesterday
    - description: Comma-separated list of GCap IDs. First GCap has ID 1.
      name: gcap_id
      isArray: true
    - description: Comma-separated list of IP addresses of the alerts.
      name: ip
      isArray: true
    - description: Minimal risk value.
      name: risk_min
    - description: Maximal risk value.
      name: risk_max
    - description: Comma-separated list of hostnames of the asset.
      name: name
      isArray: true
    - description: Filter on assets containing tags. Comma-separated list of tag names.
      name: tag
      isArray: true
    - auto: PREDEFINED
      description: Whether to include users with no tags.
      name: no_tag
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      description: The filter by which to sort the results.
      name: sort_by
      predefined:
      - risk
      - -risk
      - name
      - -name
    - auto: PREDEFINED
      description: Asset type.
      name: type
      predefined:
      - Smartphone
      - IoT
      - Laptop
      - Videogame
      - TV
      - Other
      - Firewall
      - Hypervisor
      - IPBX
      - Printer
      - Proxy
      - Router
      - Server
      - Storage
      - Virtual Machine
      - WAF
      - WiFi
      - unknown
    - description: Asset note content.
      name: note
    - description: A search term.
      name: search
    - description: A page to select in the results set.
      name: page
    - description: Number of results per page.
      name: page_size
    - auto: PREDEFINED
      description: The fast mode uses cached data to present faster results. Disabled by default.
      name: fast
      predefined:
      - "true"
      - "false"
    - description: OS/Firwmare of the asset.
      name: os_firmware
    - description: Asset MAC addresses.
      name: mac_address
    name: gcenter103-assets-list
    description: List all assets.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Assets.List
      description: List of assets.
      type: string
  - arguments:
    - description: Starting date filter. ISO-8601 date format.
      name: date_from
    - description: Ending data filter. ISO-8601 date format.
      name: date_to
    - auto: PREDEFINED
      description: Not compatible with date_from and date_to parameters.
      name: since
      predefined:
      - 15d
      - yesterday
    - description: A comma-separated list of alert IDs.
      name: ids
      isArray: true
    - description: A comma-separated list of alert IDs to exclude.
      name: excluded_ids
      isArray: true
    - auto: PREDEFINED
      description: Whether to filter on the acknowledgement status.
      name: acknowledged
      predefined:
      - "true"
      - "false"
    - description: Comma-separated list of GCap IDs. First GCap has ID 1.
      name: gcap_id
      isArray: true
    - description: Comma-separated list of IP addresses of the alerts.
      name: ip
      isArray: true
    - description: Comma-separated list of source IP addresses of the alerts.
      name: src_ip
      isArray: true
    - description: Comma-separated list of destination IP addresses of the alerts.
      name: dest_ip
      isArray: true
    - description: Minimal risk value.
      name: risk_min
    - description: Maximal risk value.
      name: risk_max
    - description: Filter on alert signature. Comma-separated list of signatures.
      name: name
      isArray: true
    - description: Filter alerts on their description.
      name: description
    - description: Filter on alerts containing tags. Comma-separated list of tag names.
      name: tag
      isArray: true
    - auto: PREDEFINED
      description: Whether to include users with no tags.
      name: no_tag
      predefined:
      - "true"
      - "false"
    - description: Filter out alerts containing tags. Comma-separated list of tags. Logical OR between the tags.
      name: excluded_tags
      isArray: true
    - auto: PREDEFINED
      description: The filter by which to sort the results.
      name: sort_by
      predefined:
      - date
      - -date
      - risk
      - -risk
      - name
      - -name
    - auto: PREDEFINED
      description: The type by which to filter alerts on engines.
      name: type
      predefined:
      - active_cti
      - beacon_detect
      - dga_detect
      - malcore
      - malcore_retroanalyzer
      - malicious_powershell_detect
      - ransomware_detect
      - retrohunt
      - shellcode_detect
      - sigflow_alert
    - auto: PREDEFINED
      description: Filter alert by MITRE tactic name.
      name: mitre_tactic_name
      predefined:
      - Collection
      - Collection (ICS)
      - Collection (Mobile)
      - Command and Control
      - Command and Control (ICS)
      - Command and Control (Mobile)
      - Credential Access
      - Credential Access (Mobile)
      - Defense Evasion
      - Defense Evasion (Mobile)
      - Discovery, Discovery (ICS)
      - Discovery (Mobile)
      - Evasion
      - Execution
      - Execution (ICS)
      - Execution (Mobile)
      - Exfiltration
      - Exfiltration (Mobile)
      - Impact
      - Impact (ICS)
      - Impact (Mobile)
      - Impair Process Control
      - Inhibit Response Function
      - Initial Access
      - Initial Access (ICS)
      - Initial Access (Mobile)
      - Lateral Movement
      - Lateral Movement (ICS)
      - Lateral Movement (Mobile)
      - Persistence
      - Persistence (ICS)
      - Persistence (Mobile)
      - Privilege Escalation
      - Privilege Escalation (ICS)
      - Privilege Escalation (Mobile)
      - Reconnaissance
      - Resource Development
    - description: Comma-separated list of hostnames.
      name: hostname
      isArray: true
    - description: Comma-separated list of source hostnames.
      name: src_hostname
      isArray: true
    - description: Comma-separated list of destination hostnames.
      name: dest_hostname
      isArray: true
    - description: Comma-separated list of usernames.
      name: username
      isArray: true
    - description: User note content.
      name: note
    - auto: PREDEFINED
      description: Filter alerts on their state.
      name: state
      predefined:
      - closed
      - mute
      - open
    - description: A page number within the results pages.
      name: page
    - description: Number of results per page.
      name: page_size
    - description: Name of the asset.
      name: asset_name
      required: true
    name: gcenter103-assets-alerts-get
    description: Retrieve alerts of a given asset.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Assets.Alerts.Get
      description: Get alerts for an asset.
      type: string
  - arguments:
    - description: Starting date filter. ISO-8601 date format.
      name: date_from
    - description: Ending data filter. ISO-8601 date format.
      name: date_to
    - auto: PREDEFINED
      description: Not compatible with date_from and date_to parameters.
      name: since
      predefined:
      - 15d
      - yesterday
    - auto: PREDEFINED
      description: The fast mode uses cached data to present faster results. Disabled by default.
      name: fast
      predefined:
      - "true"
      - "false"
    - description: Asset name.
      name: asset_name
      required: true
    name: gcenter103-assets-get
    description: Retrieve specific asset data.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Assets.Get
      description: Asset data.
      type: string
  - arguments:
    - description: Asset name.
      name: asset_name
      required: true
    - description: Note to update.
      name: note
      required: true
    - auto: PREDEFINED
      description: Whether to overwrite the note.
      name: overwrite
      required: true
      predefined:
      - "true"
      - "false"
    name: gcenter103-assets-note-add
    description: Add or update a note to an asset.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Assets.Note.Add
      description: The note added or updated.
      type: string
  - arguments:
    - description: Asset name.
      name: asset_name
      required: true
    name: gcenter103-assets-note-remove
    description: Remove a note from an asset.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Assets.Note.Remove
      description: The request response code.
      type: string
  - arguments:
    - description: Asset name.
      name: asset_name
      required: true
    name: gcenter103-assets-tags-get
    description: Get the tags of an asset.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Assets.Tags.Get
      description: The tags of the asset.
      type: string
  - arguments:
    - description: Asset name.
      name: asset_name
      required: true
    - description: A comma-separated list of tag names to add to the asset.
      name: tags
      isArray: true
      required: true
    name: gcenter103-assets-tags-add
    description: Add or update the tags of an asset.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Assets.Tags.Add
      description: Added or updated tags of the asset.
      type: string
  - arguments:
    - description: Asset name.
      name: asset_name
      required: true
    - description: A comma-separated list of tag names to remove to the asset.
      name: tags
      isArray: true
      required: true
    name: gcenter103-assets-tags-remove
    description: Remove tags of an asset.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Assets.Tags.Remove
      description: Removed tags of the asset.
      type: string
  - arguments:
    - description: A search term.
      name: search
    - description: A page to select in the results set.
      name: page
    - description: Number of results per page.
      name: page_size
    - description: Starting date filter. ISO-8601 date format.
      name: date_from
    - description: Ending data filter. ISO-8601 date format.
      name: date_to
    - auto: PREDEFINED
      description: Not compatible with date_from and date_to parameters.
      name: since
      predefined:
      - 15d
      - yesterday
    - auto: PREDEFINED
      description: The fast mode uses cached data to present faster results. Disabled by default.
      name: fast
      predefined:
      - "true"
      - "false"
    - description: Comma-separated list of GCap IDs. First GCap has ID 1.
      name: gcap_id
    - auto: PREDEFINED
      description: The filter by which to sort the results.
      name: sort_by
      predefined:
      - risk
      - -risk
      - name
      - -name
    - description: Minimal risk value.
      name: risk_min
    - description: Maximal risk value.
      name: risk_max
    - description: Comma-separated list of usernames.
      name: username
      isArray: true
    - description: Comma-separated list of IP addresses of the alerts.
      name: ip
      isArray: true
    - description: Comma-separated list of hostnames.
      name: hostname
      isArray: true
    - description: Filter on users containing tags. Comma-separated list of tag names.
      name: tag
      isArray: true
    - description: User note content.
      name: note
    - auto: PREDEFINED
      description: Whether to include users with no tags.
      name: no_tag
      predefined:
      - "true"
      - "false"
    name: gcenter103-users-list
    description: Retrieves a list of Kerberos users.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Users.List
      description: The list of Kerberos users.
      type: string
  - arguments:
    - description: Starting date filter. ISO-8601 date format.
      name: date_from
    - description: Ending data filter. ISO-8601 date format.
      name: date_to
    - auto: PREDEFINED
      description: Not compatible with date_from and date_to parameters.
      name: since
      predefined:
      - 15d
      - yesterday
    - description: A comma-separated list of alert IDs.
      name: ids
      isArray: true
    - description: A comma-separated list of alert IDs to exclude.
      name: excluded_ids
      isArray: true
    - auto: PREDEFINED
      description: Whether to filter on the acknowledgement status.
      name: acknowledged
      predefined:
      - "true"
      - "false"
    - description: Comma-separated list of GCap IDs. First GCap has ID 1.
      name: gcap_id
      isArray: true
    - description: Comma-separated list of IP addresses of the alerts.
      name: ip
      isArray: true
    - description: Comma-separated list of source IP addresses of the alerts.
      name: src_ip
      isArray: true
    - description: Comma-separated list of destination IP addresses of the alerts.
      name: dest_ip
      isArray: true
    - description: Minimal risk value.
      name: risk_min
    - description: Maximal risk value.
      name: risk_max
    - description: Filter on alert signature. Comma-separated list of signatures.
      name: name
      isArray: true
    - description: Filter alerts on their description.
      name: description
    - description: Filter on users containing tags. Comma-separated list of tag names.
      name: tag
      isArray: true
    - auto: PREDEFINED
      description: Whether to include users with no tags.
      name: no_tag
      predefined:
      - "true"
      - "false"
    - description: Filter out alerts containing tags. Comma-separated list of tags. Logical OR between the tags.
      name: excluded_tags
      isArray: true
    - auto: PREDEFINED
      description: The filter by which to sort the results.
      name: sort_by
      predefined:
      - date
      - -date
      - risk
      - -risk
      - name
      - -name
    - auto: PREDEFINED
      description: The type by which to filter alerts on engines.
      name: type
      predefined:
      - active_cti
      - beacon_detect
      - dga_detect
      - malcore
      - malcore_retroanalyzer
      - malicious_powershell_detect
      - ransomware_detect
      - retrohunt
      - shellcode_detect
      - sigflow_alert
    - auto: PREDEFINED
      description: Filter alert by MITRE tactic name.
      name: mitre_tactic_name
      predefined:
      - Collection
      - Collection (ICS)
      - Collection (Mobile)
      - Command and Control
      - Command and Control (ICS)
      - Command and Control (Mobile)
      - Credential Access
      - Credential Access (Mobile)
      - Defense Evasion
      - Defense Evasion (Mobile)
      - Discovery, Discovery (ICS)
      - Discovery (Mobile)
      - Evasion
      - Execution
      - Execution (ICS)
      - Execution (Mobile)
      - Exfiltration
      - Exfiltration (Mobile)
      - Impact
      - Impact (ICS)
      - Impact (Mobile)
      - Impair Process Control
      - Inhibit Response Function
      - Initial Access
      - Initial Access (ICS)
      - Initial Access (Mobile)
      - Lateral Movement
      - Lateral Movement (ICS)
      - Lateral Movement (Mobile)
      - Persistence
      - Persistence (ICS)
      - Persistence (Mobile)
      - Privilege Escalation
      - Privilege Escalation (ICS)
      - Privilege Escalation (Mobile)
      - Reconnaissance
      - Resource Development
    - description: Comma-separated list of hostnames.
      name: hostname
      isArray: true
    - description: Comma-separated list of source hostnames.
      name: src_hostname
      isArray: true
    - description: Comma-separated list of destination hostnames.
      name: dest_hostname
      isArray: true
    - description: Comma-separated list of usernames.
      name: username
      isArray: true
    - description: User note content.
      name: note
    - auto: PREDEFINED
      description: Filter alerts on their state.
      name: state
      predefined:
      - closed
      - mute
      - open
    - description: A page number within the results pages.
      name: page
    - description: Number of results per page.
      name: page_size
    - description: Alerts of this Kerberos user name.
      name: kuser_name
      required: true
    name: gcenter103-users-alerts-get
    description: Retrieves a list of the alerts of a Kerberos user.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Users.Alerts.Get
      description: The list of alerts of a Kerberos user.
      type: string
  - arguments:
    - description: Starting date filter. ISO-8601 date format.
      name: date_from
    - description: Ending data filter. ISO-8601 date format.
      name: date_to
    - auto: PREDEFINED
      description: Not compatible with date_from and date_to parameters.
      name: since
      predefined:
      - 15d
      - yesterday
    - auto: PREDEFINED
      description: The fast mode uses cached data to present faster results. Disabled by default.
      name: fast
      predefined:
      - "true"
      - "false"
    - description: Alerts of this Kerberos user name.
      name: kuser_name
      required: true
    name: gcenter103-users-get
    description: Retrieves Kerberos user data.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Users.Get
      description: Get information of a Kerberos user.
      type: string
  - arguments:
    - description: Note content to add/update.
      name: note
      required: true
    - description: Kerberos user name.
      name: kuser_name
      required: true
    - auto: PREDEFINED
      description: Whether to overwrite the note.
      name: overwrite
      required: true
      predefined:
      - "true"
      - "false"
    name: gcenter103-users-note-add
    description: Add or update the note of a Kerberos user.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Users.Note.Add
      description: Added/updated note.
      type: string
  - arguments:
    - description: Kerberos user name.
      name: kuser_name
      required: true
    name: gcenter103-users-note-remove
    description: Remove the note of a Kerberos user.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Users.Note.Remove
      description: Request response code.
      type: string
  - arguments:
    - description: Kerberos user name to get tags of.
      name: kuser_name
      required: true
    name: gcenter103-users-tags-get
    description: Get the tags of a Kerberos user.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Users.Tags.Get
      description: The tags associated to the Kerberos user.
      type: string
  - arguments:
    - description: A comma-separated list of tags to add to the Kerberos user.
      name: tags
      required: true
      isArray: true
    - description: Kerberos user name to add tags of.
      name: kuser_name
      required: true
    name: gcenter103-users-tags-add
    description: Add or update the tags of a Kerberos user.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Users.Tags.Add
      description: Added/updated tags associated to the Kerberos user.
      type: string
  - arguments:
    - description: A comma-separated list of tag names to remove to the Kerberos user.
      name: tags
      required: true
      isArray: true
    - description: Kerberos user name to remove tags from.
      name: kuser_name
      required: true
    name: gcenter103-users-tags-remove
    description: Remove tags of a Kerberos user.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Users.Tags.Remove
      description: Tags of the Kerberos user.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: Export state.
      name: export
      predefined:
      - "true"
      - "false"
    name: gcenter103-yara-rules-get
    description: Get YARA settings.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Yara.Rules.Get
      description: The YARA settings.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: Set if YARA is enabled or not.
      name: enabled
      required: true
      predefined:
      - "true"
      - "false"
    - description: Name of the YARA ruleset.
      name: name
      required: true
    - description: EntryID of the YARA file.
      name: entryID
      required: true
    name: gcenter103-yara-rules-add
    description: Add YARA rules to Malcore. You must upload the YARA file before execution.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Yara.Rules.Add
      description: The updated YARA settings.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The order by which the results should be sorted.
      name: ordering
      predefined:
      - created
      - sha256
      - user
      - -created
      - -sha256
      - -user
    - description: A page to select in the results set.
      name: page
    - auto: PREDEFINED
      description: The type of list given.
      name: list_type
      predefined:
      - white
      - black
      required: true
    name: gcenter103-malcore-fingerprints-get
    description: Get fingerprints of the white or black list of Malcore.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Malcore.Fingerprints.Get
      description: Hash list informations.
      type: string
  - arguments:
    - description: The SHA256 to add.
      name: sha256
      required: true
    - description: An attached comment (200 chars max).
      name: comment
      required: true
    - description: Name of the threat for reference (100 chars max).
      name: threat
      required: true
    - auto: PREDEFINED
      description: The type of list given.
      name: list_type
      required: true
      predefined:
      - white
      - black
    name: gcenter103-malcore-fingerprints-add
    description: Add fingerprints to white or black list to Malcore.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Malcore.Fingerprints.Add
      description: Hash list informations.
      type: string
  - arguments:
    - description: The SHA256 to remove.
      name: sha256
      required: true
    - auto: PREDEFINED
      description: The type of list to remove from.
      name: list_type
      predefined:
      - white
      - black
      required: true
    name: gcenter103-malcore-fingerprints-remove
    description: Remove fingerprints to white or black list to Malcore.
    deprecated: false
    outputs:
    - contextPath: Gatewatcher.Malcore.Fingerprints.Remove
      description: Hash list informations.
      type: string
fromversion: 6.5.0
defaultclassifier: Gatewatcher Incidents Classifier
defaultmapperin: Gatewatcher Mapper Incoming
tests:
- No tests