Gurucul-GRA

Gurucul Risk Analytics (GRA) is a Unified Security and Risk Analytics platform.

Data Enrichment & Threat Intelligence · Gurucul Risk Analytics

Details

IDGurucul-GRA
ProviderGurucul
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.7444307
Supported ModulesAgentix XSIAM

README

Gurucul Risk Analytics (GRA) is a data science backed cloud native platform that predicts, detects and prevents breaches. It ingests and analyzes massive amounts of data from the network, IT systems, cloud platforms, EDR, applications, IoT, HR and much more to give you a comprehensive contextual view of user and entity behaviors This Integration facilitates retrieval of High Risk Entities identified by GRA by creating a case for each entity within GRA. These high risk entities are fetched in Cortex XSOAR and a corresponding incident is created for each entity in Cortex XSOAR. As a part of this integration, workflows can be configured at Cortex XSOAR based on different commands provided by GRA. These will define the actions to be taken on a particular high risk entity based on the Risk Score.

Please make sure you look at the integration source code and comments.

Configure Gurucul in Cortex

Parameter Description Required
url Server URL (e.g. https://soar.monstersofhack.com) True
apikey API Key True
isFetch Fetch incidents False
Classifier Classifier for incident False
IncidentType Incident type False
Mapper Mapping incoming data False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
first_fetch First fetch time False
max_fetch Maximum number of incidents per fetch False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gra-fetch-users

Retrieve List of All Users (Identities)

Base Command

gra-fetch-users

Input

Argument Name Description Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Users.firstName String First Name.
Gra.Users.middleName String Middle Name.
Gra.Users.lastName String Last Name.
Gra.Users.employeeId String Employee Name.
Gra.Users.riskScore String Risk Name.
Gra.Users.department String Department.
Gra.Users.email String Users email.
Gra.Users.phone String Users Phone no.
Gra.Users.location String Location.
Gra.Users.manager String Users Manager.
Gra.Users.title String Users title.
Gra.Users.joiningDate String Joining Date.
Gra.Users.exitDate String Exit Date.
Gra.Users.userRisk String User Risk.

Command Example

!gra-fetch-users page=1 max=25

Context Example

[{
  "firstName":"Evan",
  "middleName":null,
  "lastName":"Todd",
  "employeeId":"Galvin.Chavez",
  "riskScore":0,
  "userRisk":0,
  "department":"Legal Department",
  "email":"non.magna@gurucul.corp",
  "phone":"(598) 457-3271",
  "location":"AK",
  "manager":"Asher.Byers",
  "title":"QA",
  "joiningDate":"11/05/2018 05:27:51",
  "exitDate":"08/25/2018 14:58:25",
  "profilePicturePath":null
}]

Base Command

gra-fetch-accounts
***
Retrieve all Accounts Information

Input

Argument Name Description Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Accounts.id Number Account Id.
Gra.Accounts.name String Account Name.
Gra.Accounts.type String Account type.
Gra.Accounts.created_on Date Created On.
Gra.Accounts.department String Department.
Gra.Accounts.description String Description.
Gra.Accounts.resource String Resource Name.
Gra.Accounts.domain String Domain.
Gra.Accounts.high_risk String High Risk.
Gra.Accounts.is_orphan String Is Orphan.
Gra.Accounts.is_reassigned String Is Reassigned.
Gra.Accounts.risk_score Number Risk Score.
Gra.Accounts.updated_on Date Updated on.

Command Example

!gra-fetch-accounts page=1 max=25

Context Example

[
    {
      "id":93,
      "name":"Asher.Guthrie",
      "type":null,
      "created_on":"05/16/2019 06:49:18",
      "department":null,
      "description":null,
      "resource":"Windows Security",
      "domain":"in",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":0,
      "updated_on":null
    }
]

Human Readable Output

Results

gra-fetch-active-resource-accounts

Retrieve List of All Active Accounts for a Given Resource.

Base Command

!gra-fetch-active-resource-accounts

Input

Argument Name Description Required
resource_name Resource Name. Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Active.Resource.Accounts.id Number Account Id.
Gra.Active.Resource.Accounts.name String Account Name.
Gra.Active.Resource.Accounts.type String Account type.
Gra.Active.Resource.Accounts.created_on Date Created On.
Gra.Active.Resource.Accounts.department String Department.
Gra.Active.Resource.Accounts.description String Description.
Gra.Active.Resource.Accounts.resource String Resource Name.
Gra.Active.Resource.Accounts.domain String Domain.
Gra.Active.Resource.Accounts.high_risk String High Risk.
Gra.Active.Resource.Accounts.is_orphan String Is Orphan.
Gra.Active.Resource.Accounts.is_reassigned String Is Reassigned.
Gra.Active.Resource.Accounts.risk_score Number Risk Score.
Gra.Active.Resource.Accounts.updated_on Date Updated on.

Command Example

!gra-fetch-active-resource-accounts resource_name="Linux" page=1 max=25

Context Example

[
    {
      "id":93,
      "name":"Asher.Guthrie",
      "type":null,
      "created_on":"05/16/2019 06:49:18",
      "department":null,
      "description":null,
      "resource":"Windows Security",
      "domain":"in",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":0,
      "updated_on":null
    }
]

Human Readable Output

gra-fetch-user-accounts

Retrieve List of All Active Accounts and Details for a Given User.

Base Command

gra-fetch-user-accounts

Input

Argument Name Description Required
employee_id Employee ID. Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.User.Accounts.id Number User Account Relation Id .
Gra.User.Accounts.name String Account Name.
Gra.User.Accounts.type String Account Type.
Gra.User.Accounts.created_on Date Created On.
Gra.User.Accounts.department String Department.
Gra.User.Accounts.description String Description.
Gra.User.Accounts.resource String Resource Name.
Gra.User.Accounts.domain String Domain Name.
Gra.User.Accounts.high_risk String High Risk.
Gra.User.Accounts.is_orphan String Is Account Orphan.
Gra.User.Accounts.is_reassigned String Is account Reassigned.
Gra.User.Accounts.risk_score String Account Risk Score.
Gra.User.Accounts.updated_on Date Updated On.

Command Example

!gra-fetch-user-accounts employee_id="Alec.Holland01_NN" page=1 max=25

Context Example

[{
      "id":35,
      "name":"Alec.Holland01_NN",
      "type":null,
      "created_on":"02/09/2018 10:00:00",
      "department":null,
      "description":null,
      "resource":"IPS",
      "domain":"com",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":69,
      "updated_on":null
   }]

Human Readable Output

gra-fetch-resource-highrisk-accounts

Retrieve High Risk Accounts for a Given Resource

Base Command

gra-fetch-resource-highrisk-accounts

Input

Argument Name Description Required
resource_name Resource Name. Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Resource.Highrisk.Accounts.id Number User Account Relation Id .
Gra.Resource.Highrisk.Accounts.name String Account Name.
Gra.Resource.Highrisk.Accounts.type String Account Type.
Gra.Resource.Highrisk.Accounts.created_on Date Created On.
Gra.Resource.Highrisk.Accounts.department String Department.
Gra.Resource.Highrisk.Accounts.description String Description.
Gra.Resource.Highrisk.Accounts.resource String Resource Name.
Gra.Resource.Highrisk.Accounts.domain String Domain Name.
Gra.Resource.Highrisk.Accounts.high_risk String High Risk.
Gra.Resource.Highrisk.Accounts.is_orphan String Is Account Orphan.
Gra.Resource.Highrisk.Accounts.is_reassigned String Is account Reassigned.
Gra.Resource.Highrisk.Accounts.risk_score String Account Risk Score.
Gra.Resource.Highrisk.Accounts.updated_on Date Updated On.

Command Example

!gra-fetch-resource-highrisk-accounts resource_name="Windows Security" page=1 max=25

Context Example

[{
      "id":35,
      "name":"Alec.Holland01_NN",
      "type":null,
      "created_on":"02/09/2018 10:00:00",
      "department":null,
      "description":null,
      "resource":"Windows Security",
      "domain":"com",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":69,
      "updated_on":null
   }]

Human Readable Output

###

gra-fetch-hpa

Retrieve List of All High Risk Privileged Accounts.

Base Command

!gra-fetch-hpa

Input

Argument Name Description Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Hpa.id Number User Account Relation Id .
Gra.Hpa.name String Account Name.
Gra.Hpa.type String Account Type.
Gra.Hpa.created_on Date Created On.
Gra.Hpa.department String Department.
Gra.Hpa.description String Description.
Gra.Hpa.resource String Resource Name.
Gra.Hpa.domain String Domain Name.
Gra.Hpa.high_risk String High Risk.
Gra.Hpa.is_orphan String Is Account Orphan.
Gra.Hpa.is_reassigned String Is account Reassigned.
Gra.Hpa.risk_score String Account Risk Score.
Gra.Hpa.updated_on Date Updated On.

Command Example

!gra-fetch-hpa page=1 max=25

Context Example

{
      "id":35,
      "name":"Alec.Holland01_NN",
      "type":null,
      "created_on":"02/09/2018 10:00:00",
      "department":null,
      "description":null,
      "resource":"IPS",
      "domain":"com",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":69,
      "updated_on":null
   }

Human Readable Output

###

gra-fetch-resource-hpa

Retrieve all High Privileged Accounts for a Given Resource.

Base Command

gra-fetch-resource-hpa

Input

Argument Name Description Required
resource_name Resource Name. Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Resource.Hpa.id Number User Account Relation Id .
Gra.Resource.Hpa.name String Account Name.
Gra.Resource.Hpa.type String Account Type.
Gra.Resource.Hpa.created_on Date Created On.
Gra.Resource.Hpa.department String Department.
Gra.Resource.Hpa.description String Description.
Gra.Resource.Hpa.resource String Resource Name.
Gra.Resource.Hpa.domain String Domain Name.
Gra.Resource.Hpa.high_risk String High Risk.
Gra.Resource.Hpa.is_orphan String Is Account Orphan.
Gra.Resource.Hpa.is_reassigned String Is account Reassigned.
Gra.Resource.Hpa.risk_score String Account Risk Score.
Gra.Resource.Hpa.updated_on Date Updated On.

Command Example

!gra-fetch-resource-hpa resource_name="Linux" page=1 max=25

Context Example

[{
      "id":2,
      "name":"user1",
      "type":null,
      "created_on":"02/09/2017 10:00:00",
      "department":null,
      "description":null,
      "resource":"Linux",
      "domain":"com",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":0,
      "updated_on":null
   }]

Human Readable Output

gra-fetch-orphan-accounts

Retrieve List of All Orphan / Rogue Accounts.

Base Command

gra-fetch-orphan-accounts

Input

Argument Name Description Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Orphan.Accounts.id Number User Account Relation Id .
Gra.Orphan.Accounts.name String Account Name.
Gra.Orphan.Accounts.type String Account Type.
Gra.Orphan.Accounts.created_on Date Created On.
Gra.Orphan.Accounts.department String Department.
Gra.Orphan.Accounts.description String Description.
Gra.Orphan.Accounts.resource String Resource Name.
Gra.Orphan.Accounts.domain String Domain Name.
Gra.Orphan.Accounts.high_risk String High Risk.
Gra.Orphan.Accounts.is_orphan String Is Account Orphan.
Gra.Orphan.Accounts.is_reassigned String Is account Reassigned.
Gra.Orphan.Accounts.risk_score String Account Risk Score.
Gra.Orphan.Accounts.updated_on Date Updated On.

Command Example

!gra-fetch-orphan-accounts page=1 max=25

Context Example

[{
      "id":2,
      "name":"user1",
      "type":null,
      "created_on":"02/09/2017 10:00:00",
      "department":null,
      "description":null,
      "resource":"Linux",
      "domain":"com",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":0,
      "updated_on":null
   }]

Human Readable Output

gra-fetch-resource-orphan-accounts

Retrieve All Orphan / Rogue Accounts for a Given Resource.

Base Command

gra-fetch-resource-orphan-accounts

Input

Argument Name Description Required
resource_name Resource Name. Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Resource.Orphan.Accounts.id Number User Account Relation Id .
Gra.Resource.Orphan.Accounts.name String Account Name.
Gra.Resource.Orphan.Accounts.type String Account Type.
Gra.Resource.Orphan.Accounts.created_on Date Created On.
Gra.Resource.Orphan.Accounts.department String Department.
Gra.Resource.Orphan.Accounts.description String Description.
Gra.Resource.Orphan.Accounts.resource String Resource Name.
Gra.Resource.Orphan.Accounts.domain String Domain Name.
Gra.Resource.Orphan.Accounts.high_risk String High Risk.
Gra.Resource.Orphan.Accounts.is_orphan String Is Account Orphan.
Gra.Resource.Orphan.Accounts.is_reassigned String Is account Reassigned.
Gra.Resource.Orphan.Accounts.risk_score String Account Risk Score.
Gra.Resource.Orphan.Accounts.updated_on Date Updated On.

Command Example

!gra-fetch-resource-orphan-accounts resource_name="Windows Security" page=1 max=25

Context Example

[{
      "id":2,
      "name":"user1",
      "type":null,
      "created_on":"02/09/2017 10:00:00",
      "department":null,
      "description":null,
      "resource":"Windows Security",
      "domain":"com",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":0,
      "updated_on":null
   }]

Human Readable Output

###

gra-fetch-orphan-accounts

Retrieve List of All Orphan / Rogue Accounts.

Base Command

gra-user-activities

Input

Argument Name Description Required
employee_id Employee Id. Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.User.Activity.employee_id String Employee Id .
Gra.User.Activity.account_name String Account Name .
Gra.User.Activity.resource_name String Resource Name .
Gra.User.Activity.event_desc String Event Description .
Gra.User.Activity.event_date String Event Date .
Gra.User.Activity.risk_score Number Risk Score .

Command Example

!gra-user-activities employee_id="aa17600" page=1 max=25

Context Example

{
"employee_id":"aa17600",
"account_name":null,
"resource_name":"Print",
"event_desc":"Print",
"event_date":"09/02/2019 11:51:14",
"risk_score":0.0
}

Human Readable Output

gra-fetch-users-details

get details of the user.

Base Command

gra-fetch-users-details

Input

Argument Name Description Required
employee_id Employee Id. Required

Context Output

Path Type Description
Gra.User.firstName String First Name.
Gra.User.middleName String Middle Name.
Gra.User.lastName String Last Name.
Gra.User.employeeId String Employee Id.
Gra.User.riskScore String Risk Score.
Gra.User.userRisk String User Risk.
Gra.User.department String Department.
Gra.User.email String Email.
Gra.User.phone String Phone.
Gra.User.location String Location .
Gra.User.manager String Manager.
Gra.User.title String Title.
Gra.User.joiningDate String Joining Date.
Gra.User.profilePicturePath String Profile Picture Path.
Gra.User.exitDate Date Exit Date.

Command Example

!gra-user-activities employee_id="aa17600" page=1 max=25

Context Example

[
  {
    "firstName":"Jonathan",
    "middleName":null,
    "lastName":"Osterman01_NN",
    "employeeId":"user1",
    "riskScore":88,
    "userRisk":88,
    "department":"IT",
    "email":"Jonathan.Osterman@abc.com",
    "phone":"(91)-123-4567-890",
    "location":"USA",
    "manager":"Thor.Odinson01_NN",
    "title":"Sr.Developer",
    "joiningDate":"01/01/2017 12:47:00",
    "exitDate":"12/31/2019 23:47:00",
    "profilePicturePath":null
  }
]

Human Readable Output

gra-fetch-users-details

get details of the user.

Base Command

gra-highRisk-users

Input

Argument Name Description Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Highrisk.Users.id Number User Id .
Gra.Highrisk.Users.name String User Name.
Gra.Highrisk.Users.type String Type.
Gra.Highrisk.Users.created_on Date Created On .
Gra.Highrisk.Users.department String Department.
Gra.Highrisk.Users.description String Description.
Gra.Highrisk.Users.resource String Resource Name.
Gra.Highrisk.Users.domain String Domain.
Gra.Highrisk.Users.high_risk String High Risk.
Gra.Highrisk.Users.is_orphan String Is Orphan Account .
Gra.Highrisk.Users.is_reassigned String Is Reassigned .
Gra.Highrisk.Users.updated_on Date Updated On .
Gra.Highrisk.Users.exitDate Date Exit Date .
Gra.Highrisk.Users.created_on Date Created On .
Gra.Highrisk.Users.joiningDate Date Joining Date .
Gra.Highrisk.Users.manager String Manager .
Gra.Highrisk.Users.employeeId String Employee Id .
Gra.Highrisk.Users.firstName String First Name .
Gra.Highrisk.Users.middleName String Middle Name .
Gra.Highrisk.Users.lastName String Last Name .
Gra.Highrisk.Users.location String Location .
Gra.Highrisk.Users.title String Title .
Gra.Highrisk.Users.userRisk Number User Risk .
Gra.Highrisk.Users.riskScore Number Risk Score .
Gra.Highrisk.Users.description String Description .
Gra.Highrisk.Users.is_orphan String Is Orphan .
Gra.Highrisk.Users.phone String Phone .
Gra.Highrisk.Users.email String Email .

Command Example

!gra-highRisk-users page=1 max=25

Context Example

[
  {
      "id":188,
      "name":"Vitoria Inger",
      "type":null,
      "created_on":"02/02/2020 10:00:00",
      "department":null,
      "description":"Mozilla/5.0 (Windows NT) AppleWebKit/534.20 (KHTML, like Gecko) Chrome/11.0.672.2 Safari/534.20",
      "resource":"AIX",
      "domain":"163.com",
      "high_risk":null,
      "is_orphan":"No",
      "is_reassigned":null,
      "risk_score":88,
      "updated_on":null
   }
]

Human Readable Output

gra-cases

get details of the user.

Base Command

gra-cases

Input

Argument Name Description Required
status Case Status. Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.Cases.entityId Number Entity Id .
Gra.Cases.entityTypeId Number Entity Type Id.
Gra.Cases.entity String Entity Name.
Gra.Cases.caseId Number Case Id .
Gra.Cases.openDate Date Case Open Date.
Gra.Cases.ownerId Number Owner Id.
Gra.Cases.ownerType String Owner Type.
Gra.Cases.ownerName String Owner Name.
Gra.Cases.riskDate Date Risk Risk.
Gra.Cases.status String Case Status .
Gra.Cases.anomalies String Anomalies .

Command Example

!gra-cases status="OPEN" page=1 max=25

Context Example

[
 {
      "entityId":366,
      "entityTypeId":2,
      "entity":"Ulises Ellerby",
      "caseId":58,
      "openDate":"10/13/2020 18:44:06",
      "ownerId":1,
      "ownerType":"User",
      "ownerName":"graadmin",
      "riskDate":"10/12/2020 00:00:00",
      "status":"Open"
   }
]

Human Readable Output

gra-user-anomalies

get details of the user.

Base Command

gra-user-anomalies

Input

Argument Name Description Required
employee_id Employee Id. Required
page Page no. Optional
max Per page record count Optional

Context Output

Path Type Description
Gra.User.Anomalies.anomaly_name String Anomaly Name .

Command Example

!gra-user-anomalies employeeId="AB1234" page=1 max=25

Context Example

[
   {
      "anomaly_name":"SOD_role_13oct"
   }
]

Human Readable Output

gra-case-action

Closing a case and updating the anomaly status as Closed / Risk Managed / Model Reviewed.

Base Command

gra-case-action

Input

Argument Name Description Required
action Action Required
caseId Case ID Required
subOption Sub Option Required
caseComment Case Comment Required
riskAcceptDate Risk Accept Date (applicable only in case of closing a case as Risk Managed) Optional

Context Output

Path Type Description
Gra.Case.Action.Message String Message

Command Example

!gra-case-action action=modelReviewCase caseId=5 subOption="Tuning Required" caseComment="This is Completed"

Context Example

[
  {
    "Message": "1 Anomalies in this case closed successfully."
  }
]

Human Readable Output

gra-case-action-anomaly

Closing an anomaly or anomalies within a case and updating the anomaly status as Closed / Risk Managed / Model Reviewed.

Base Command

gra-case-action-anomaly

Input

Argument Name Description Required
action Action Required
caseId Case ID Required
anomalyNames Anomaly Names Required
subOption Sub Option Required
caseComment Case Comment Required
riskAcceptDate Risk Accept Date (applicable only in case of closing a case as Risk Managed) Optional

Context Output

Path Type Description
Gra.Case.Action.Anomaly.Message String Message
Gra.Case.Action.Anomaly.anomalyName String Anomaly Name

Command Example

!gra-case-action-anomaly action=modelReviewCaseAnomaly caseId=5 anomalyNames=anomalyName1 subOption="Tuning Required" caseComment="This is Completed"

Context Example

[
  {
    "Message": {
      "anomalyName1": "Anomaly risk accepted successfully."
    }
  }
]

Human Readable Output

gra-investigate-anomaly-summary

Retrieve detailed anomaly summary of specified anomaly name.

Base Command

gra-investigate-anomaly-summary

Input

Argument Name Description Required
modelName Model Name Required
fromDate From Date ( yyyy-MM-dd ) Optional
toDate To Date ( yyyy-MM-dd ) Optional

Context Output

Path Type Description
Gra.Investigate.Anomaly.Summary.analyticalFeatures String Analytical Features
Gra.Investigate.Anomaly.Summary.entityCount String Entity Count
Gra.Investigate.Anomaly.Summary.resourceCount String Resource Count
Gra.Investigate.Anomaly.Summary.records String Records
Gra.Investigate.Anomaly.Summary.anomalyBaseline String Anomaly Baseline
Gra.Investigate.Anomaly.Summary.anomalyLastCatch String Anomaly Last Catch
Gra.Investigate.Anomaly.Summary.executionDays String Execution Days
Gra.Investigate.Anomaly.Summary.chainDetails String Chain Details
Gra.Investigate.Anomaly.Summary.resourceName String resourceName
Gra.Investigate.Anomaly.Summary.type String type
Gra.Investigate.Anomaly.Summary.value String value
Gra.Investigate.Anomaly.Summary.anomalousActivity Number anomalousActivity
Gra.Investigate.Anomaly.Summary.anomalyName String anomalyName
Gra.Investigate.Anomaly.Summary.classifier String classifier
Gra.Investigate.Anomaly.Summary.anomalyFirstCatch String anomalyFirstCatch
Gra.Investigate.Anomaly.Summary.anomalyDescription String anomalyDescription
Gra.Investigate.Anomaly.Summary.similarTemplateAnomalies String Similar Template Anomalies
Gra.Investigate.Anomaly.Summary.entitiesFlagged Number Entities Flagged

Command Example

!gra-investigate-anomaly-summary modelName=ModelName

Context Example

{
  "analyticalFeatures": {
    "eventdesc": 8
  },
  "entityCount": "466",
  "resourceCount": "4",
  "records": {
    "anomalyBaseline": "Baseline period is not configured.",
    "anomalyLastCatch": "2020-12-06 10:00:59",
    "executionDays": "null",
    "chainDetails": [
      {
        "resourceName": "resourceName",
        "type": "model",
        "value": "modelName"
      }
    ],
    "anomalousActivity": 0,
    "anomalyName": "modelName",
    "classifier": "Categories -> Categories Name, Categories -> Default, Resources -> resourceName",
    "anomalyFirstCatch": "2020-11-08 12:15:00",
    "anomalyDescription": "This template can be used to create models using the saved search query."
  },
  "similarTemplateAnomalies": {
    "anomaly1": 442,
    "anomaly2": 4,
    "anomaly3": 4,
    "anomaly4": 21,
    "anomaly5": 8,
    "anomaly6": 1
  },
  "entitiesFlagged": 0
}

Human Readable Output

gra-analytical-features-entity-value

Retrieve analytical features for specified entity value and model name.

Base Command

gra-analytical-features-entity-value

Input

Argument Name Description Required
entityValue Entity Value Required
modelName Model Name Required
fromDate From Date ( yyyy-MM-dd ) Optional
toDate To Date ( yyyy-MM-dd ) Optional
entityTypeId Entity Type Id (defaulted to 1) Optional

Context Output

Path Type Description
Gra.Analytical.Features.Entity.Value.analyticalFeatures String Analytical Features
Gra.Analytical.Features.Entity.Value.analyticalFeatureValues String Analytical Feature Values

Command Example

!gra-analytical-features-entity-value entityValue=EntityValue

Context Example

{
    "analyticalFeatures": {
        "analyticalFeature1": 7,
        "analyticalFeature2": 1,
        "analyticalFeature3": 0
    },
    "analyticalFeatureValues": {
        "analyticalFeature1": {
            "analyticalFeature1a": 2,
            "analyticalFeature1b": 1,
            "analyticalFeature1c": 1
        },
        "analyticalFeature2": {
            "analyticalFeature2a": 6
        },
        "analyticalFeature3": {
            "analyticalFeature3a": 13,
            "analyticalFeature3b": 6
        }
    }
}

Human Readable Output

gra-cases-anomaly

Retrieve anomalies for specified case id from GRA and update in XSOAR.

Base Command

gra-cases-anomaly

Input

Argument Name Description Required
caseId GRA Case Id Required

Context Output

Path Type Description
Gra.Cases.anomalies.anomalyName String Cases Anomaly name
Gra.Cases.anomalies.riskAcceptedDate date Risk accepted date of anomaly
Gra.Cases.anomalies.resourceName String Resource Name
Gra.Cases.anomalies.riskScore String Risk score for anomaly
Gra.Cases.anomalies.assignee String Assignee name
Gra.Cases.anomalies.assigneeType String Assignee type (User/Role)
Gra.Cases.anomalies.status String Current status of anomaly

Command Example

!gra-cases-anomaly caseId=10

Context Example

[
    {
        "anomalyName": "Anomaly Name 1",
        "riskAcceptedDate": "2023-02-01T18:30:00Z",
        "resourceName": "Resource Name 1",
        "riskScore": 0,
        "assignee": "Assignee 1",
        "assigneeType": "User",
        "status": "Open"
    },
    {
        "anomalyName": "Anomaly Name 2",
        "riskAcceptedDate": null,
        "resourceName": "Resource Name 2",
        "riskScore": 0,
        "assignee": "Assignee 2",
        "assigneeType": "User",
        "status": "Closed"
    }
]

Human Readable Output

gra-validate-api

Verifies the Gurucul platform’s operational status by assessing system health, reviewing logs, and checking key performance indicators for any errors.

Base Command

gra-validate-api

Command Example


#### Context Example

ok
```

Human Readable Output

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • apikey — Authorization Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch time
  • max_fetch — Maximum number of incidents per fetch

Commands (20)

  • gra-analytical-features-entity-value

    Retrieve analytical features for specified entity value, model name and dates.

  • gra-case-action

    Close a case and update the anomaly status as Closed / Risk Managed / Model Reviewed.

  • gra-case-action-anomaly

    Close an anomaly or anomalies within a case and update the anomaly status as Closed / Risk Managed / Model Reviewed.

  • gra-cases

    Retrieve list of all cases for specified status.

  • gra-cases-anomaly

    Retrieve anomalies for specified case id.

  • gra-fetch-accounts

    Retrieve list of all accounts.

  • gra-fetch-active-resource-accounts

    Retrieve list of all active accounts for specified resource.

  • gra-fetch-hpa

    Retrieve list of all high risk privileged accounts.

  • gra-fetch-orphan-accounts

    Retrieve list of all orphan / rogue accounts.

  • gra-fetch-resource-highrisk-accounts

    Retrieve high risk accounts for specified resource.

  • gra-fetch-resource-hpa

    Retrieve all high privileged accounts for specified resource.

  • gra-fetch-resource-orphan-accounts

    Retrieve all orphan / rogue accounts for specified resource.

  • gra-fetch-user-accounts

    Retrieve list of all active accounts and details for specified user identity.

  • gra-fetch-users

    Retrieve list of all users (identities).

  • gra-fetch-users-details

    Retrieve details for specified user.

  • gra-highRisk-users

    Retrieve list of all high risk users.

  • gra-investigate-anomaly-summary

    Retrieve detailed anomaly summary of specified anomaly name.

  • gra-user-activities

    Retrieve activity for specified user.

  • gra-user-anomalies

    Retrieve list of anomalies for specified user.

  • gra-validate-api

    Verifies the Gurucul platform's operational status by assessing system health, reviewing logs, and checking key performance indicators for any errors.

Source

GuruculGRA.py GuruculGRA_test.py GuruculGRA.yml GuruculGRA_description.md command_examples.txt
Download History Raw 
commonfields:
  id: Gurucul-GRA
  version: -1
name: Gurucul-GRA
display: Gurucul-GRA
sectionorder:
- Connect
- Collect
category: Data Enrichment & Threat Intelligence
provider: Gurucul
description: Gurucul Risk Analytics (GRA) is a Unified Security and Risk Analytics platform.
configuration:
- display: Server URL (e.g. https://example.net)
  name: url
  defaultvalue: https://example.net
  type: 0
  section: Connect
  required: true
- display: Authorization Key
  name: apikey
  type: 4
  section: Connect
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: First fetch time
  name: first_fetch
  defaultvalue: 3 days
  type: 0
  section: Collect
  required: false
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: "25"
  type: 0
  section: Collect
  required: false
script:
  script: ''
  type: python
  commands:
  - name: gra-fetch-users
    arguments:
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Users.firstName
      description: First Name.
      type: string
    - contextPath: Gra.Users.middleName
      description: Middle Name.
      type: string
    - contextPath: Gra.Users.lastName
      description: Last Name.
      type: string
    - contextPath: Gra.Users.employeeId
      description: Employee Id.
      type: string
    - contextPath: Gra.Users.riskScore
      description: Risk Score.
      type: string
    - contextPath: Gra.Users.userRisk
      description: User Risk.
      type: number
    - contextPath: Gra.Users.department
      description: Department.
      type: string
    - contextPath: Gra.Users.email
      description: Email.
      type: string
    - contextPath: Gra.Users.phone
      description: Phone.
      type: string
    - contextPath: Gra.Users.location
      description: Location.
      type: string
    - contextPath: Gra.Users.manager
      description: Manager.
      type: string
    - contextPath: Gra.Users.title
      description: Title.
      type: string
    - contextPath: Gra.Users.joiningDate
      description: Joining Date.
      type: date
    - contextPath: Gra.Users.exitDate
      description: Exit Date.
      type: date
    description: Retrieve list of all users (identities).
  - name: gra-fetch-accounts
    arguments:
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Accounts.id
      description: Id.
      type: number
    - contextPath: Gra.Accounts.name
      description: Name.
      type: string
    - contextPath: Gra.Accounts.type
      description: Type.
      type: string
    - contextPath: Gra.Accounts.created_on
      description: Created On.
      type: date
    - contextPath: Gra.Accounts.department
      description: Department.
      type: string
    - contextPath: Gra.Accounts.description
      description: Description.
      type: string
    - contextPath: Gra.Accounts.resource
      description: Resource.
      type: string
    - contextPath: Gra.Accounts.domain
      description: Domain.
      type: string
    - contextPath: Gra.Accounts.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.Accounts.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.Accounts.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.Accounts.risk_score
      description: Risk Score.
      type: number
    - contextPath: Gra.Accounts.updated_on
      description: Updated On.
      type: date
    description: Retrieve list of all accounts.
  - name: gra-fetch-active-resource-accounts
    arguments:
    - name: resource_name
      required: true
      description: 'Resource Name.'
      defaultValue: Windows Security
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Active.Resource.Accounts.id
      description: ID.
      type: number
    - contextPath: Gra.Active.Resource.Accounts.name
      description: Name.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.type
      description: Type.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.created_on
      description: Created On.
      type: date
    - contextPath: Gra.Active.Resource.Accounts.department
      description: Department.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.description
      description: Description.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.resource
      description: Resource.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.domain
      description: Domain.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.Active.Resource.Accounts.risk_score
      description: Risk Score.
      type: number
    - contextPath: Gra.Active.Resource.Accounts.updated_on
      description: Updated On.
      type: date
    description: Retrieve list of all active accounts for specified resource.
  - name: gra-fetch-user-accounts
    arguments:
    - name: employee_id
      required: true
      description: Employee ID.
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.User.Accounts.id
      description: Id.
      type: number
    - contextPath: Gra.User.Accounts.name
      description: Name.
      type: string
    - contextPath: Gra.User.Accounts.type
      description: Type.
      type: string
    - contextPath: Gra.User.Accounts.created_on
      description: Created On.
      type: date
    - contextPath: Gra.User.Accounts.department
      description: Department.
      type: string
    - contextPath: Gra.User.Accounts.description
      description: Description.
      type: string
    - contextPath: Gra.User.Accounts.resource
      description: Resource.
      type: string
    - contextPath: Gra.User.Accounts.domain
      description: Domain.
      type: string
    - contextPath: Gra.User.Accounts.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.User.Accounts.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.User.Accounts.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.User.Accounts.risk_score
      description: Risk Score.
      type: number
    - contextPath: Gra.User.Accounts.updated_on
      description: Updated On.
      type: date
    description: Retrieve list of all active accounts and details for specified user identity.
  - name: gra-fetch-resource-highrisk-accounts
    arguments:
    - name: resource_name
      required: true
      description: Resource Name.
      defaultValue: Windows Security
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Resource.Highrisk.Accounts.id
      description: Id.
      type: number
    - contextPath: Gra.Resource.Highrisk.Accounts.name
      description: Name.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.type
      description: Type.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.created_on
      description: Created On.
      type: date
    - contextPath: Gra.Resource.Highrisk.Accounts.department
      description: Department.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.description
      description: Description.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.resource
      description: Resource.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.domain
      description: Domain.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.Resource.Highrisk.Accounts.risk_score
      description: Risk Score.
      type: number
    - contextPath: Gra.Resource.Highrisk.Accounts.updated_on
      description: Updated On.
      type: date
    description: Retrieve high risk accounts for specified resource.
  - name: gra-fetch-hpa
    arguments:
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Hpa.id
      description: Id.
      type: number
    - contextPath: Gra.Hpa.name
      description: Name.
      type: string
    - contextPath: Gra.Hpa.type
      description: Type.
      type: string
    - contextPath: Gra.Hpa.created_on
      description: Created On.
      type: date
    - contextPath: Gra.Hpa.department
      description: Department.
      type: string
    - contextPath: Gra.Hpa.description
      description: Description.
      type: string
    - contextPath: Gra.Hpa.resource
      description: Resource.
      type: string
    - contextPath: Gra.Hpa.domain
      description: Domain.
      type: string
    - contextPath: Gra.Hpa.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.Hpa.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.Hpa.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.Hpa.risk_score
      description: Risk Score.
      type: number
    - contextPath: Gra.Hpa.updated_on
      description: Updated On.
      type: date
    description: Retrieve list of all high risk privileged accounts.
  - name: gra-fetch-resource-hpa
    arguments:
    - name: resource_name
      required: true
      description: Resource Name.
      defaultValue: Windows Security
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Resource.Hpa.id
      description: Id.
      type: number
    - contextPath: Gra.Resource.Hpa.name
      description: Name.
      type: string
    - contextPath: Gra.Resource.Hpa.type
      description: Type.
      type: string
    - contextPath: Gra.Resource.Hpa.created_on
      description: Created On.
      type: date
    - contextPath: Gra.Resource.Hpa.department
      description: Department.
      type: string
    - contextPath: Gra.Resource.Hpa.description
      description: Description.
      type: string
    - contextPath: Gra.Resource.Hpa.resource
      description: Resource.
      type: string
    - contextPath: Gra.Resource.Hpa.domain
      description: Domain.
      type: string
    - contextPath: Gra.Resource.Hpa.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.Resource.Hpa.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.Resource.Hpa.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.Resource.Hpa.risk_score
      description: Risk Score.
      type: number
    - contextPath: Gra.Resource.Hpa.updated_on
      description: Updated On.
      type: date
    description: Retrieve all high privileged accounts for specified resource.
  - name: gra-fetch-orphan-accounts
    arguments:
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Orphan.Accounts.id
      description: Id.
      type: number
    - contextPath: Gra.Orphan.Accounts.name
      description: Name.
      type: string
    - contextPath: Gra.Orphan.Accounts.type
      description: Type.
      type: string
    - contextPath: Gra.Orphan.Accounts.created_on
      description: Created_on.
      type: date
    - contextPath: Gra.Orphan.Accounts.department
      description: Department.
      type: string
    - contextPath: Gra.Orphan.Accounts.description
      description: Description.
      type: string
    - contextPath: Gra.Orphan.Accounts.resource
      description: Resource.
      type: string
    - contextPath: Gra.Orphan.Accounts.domain
      description: Domain.
      type: string
    - contextPath: Gra.Orphan.Accounts.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.Orphan.Accounts.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.Orphan.Accounts.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.Orphan.Accounts.risk_score
      description: Risk Score.
      type: number
    - contextPath: Gra.Orphan.Accounts.updated_on
      description: Updated On.
      type: date
    description: Retrieve list of all orphan / rogue accounts.
  - name: gra-fetch-resource-orphan-accounts
    arguments:
    - name: resource_name
      required: true
      description: Resource Name.
      defaultValue: Windows Security
    - name: page
      required: true
      default: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Resource.Orphan.Accounts.id
      description: Id.
      type: number
    - contextPath: Gra.Resource.Orphan.Accounts.name
      description: Name.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.type
      description: Type.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.created_on
      description: Created On.
      type: date
    - contextPath: Gra.Resource.Orphan.Accounts.department
      description: Department.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.description
      description: Description.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.resource
      description: Resource.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.domain
      description: Domain.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.Resource.Orphan.Accounts.risk_score
      description: Risk Score.
      type: number
    - contextPath: Gra.Resource.Orphan.Accounts.updated_on
      description: Updated On.
      type: date
    description: Retrieve all orphan / rogue accounts for specified resource.
  - name: gra-user-activities
    arguments:
    - name: employee_id
      required: true
      description: EMployee ID.
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.User.Activity.employee_id
      description: Employee Id.
      type: string
    - contextPath: Gra.User.Activity.account_name
      description: Account Name.
      type: string
    - contextPath: Gra.User.Activity.resource_name
      description: Resource Name.
      type: string
    - contextPath: Gra.User.Activity.event_desc
      description: Event Desc.
      type: string
    - contextPath: Gra.User.Activity.event_date
      description: Event Date.
      type: date
    - contextPath: Gra.User.Activity.risk_score
      description: Risk Score.
      type: number
    description: Retrieve activity for specified user.
  - name: gra-fetch-users-details
    arguments:
    - name: employee_id
      required: true
      description: Employee ID.
    outputs:
    - contextPath: Gra.User.firstName
      description: First Name.
      type: string
    - contextPath: Gra.User.middleName
      description: Middle Name.
      type: string
    - contextPath: Gra.User.lastName
      description: Last Name.
      type: string
    - contextPath: Gra.User.employeeId
      description: Employee Id.
      type: string
    - contextPath: Gra.User.riskScore
      description: Risk Score.
      type: number
    - contextPath: Gra.User.userRisk
      description: User Risk.
      type: number
    - contextPath: Gra.User.department
      description: Department.
      type: string
    - contextPath: Gra.User.email
      description: Email.
      type: string
    - contextPath: Gra.User.phone
      description: Phone.
      type: string
    - contextPath: Gra.User.location
      description: Location.
      type: string
    - contextPath: Gra.User.manager
      description: Manager.
      type: string
    - contextPath: Gra.User.title
      description: Title.
      type: string
    - contextPath: Gra.User.joiningDate
      description: Joining Date.
      type: date
    - contextPath: Gra.User.exitDate
      description: Exit Date.
      type: date
    - contextPath: Gra.User.profilePicturePath
      description: Profile Picture Path.
      type: string
    description: Retrieve details for specified user.
  - name: gra-highRisk-users
    arguments:
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      default: true
      description: params.
      defaultValue: Per page record count
    outputs:
    - contextPath: Gra.Highrisk.Users.firstName
      description: First Name.
      type: string
    - contextPath: Gra.Highrisk.Users.middleName
      description: Middle Name.
      type: string
    - contextPath: Gra.Highrisk.Users.lastName
      description: Last Name.
      type: string
    - contextPath: Gra.Highrisk.Users.employeeId
      description: Employee Id.
      type: string
    - contextPath: Gra.Highrisk.Users.riskScore
      description: Risk Score.
      type: number
    - contextPath: Gra.Highrisk.Users.userRisk
      description: User Risk.
      type: string
    - contextPath: Gra.Highrisk.Users.department
      description: Department.
      type: string
    - contextPath: Gra.Highrisk.Users.email
      description: Email.
      type: string
    - contextPath: Gra.Highrisk.Users.phone
      description: Phone.
      type: string
    - contextPath: Gra.Highrisk.Users.location
      description: Location.
      type: string
    - contextPath: Gra.Highrisk.Users.manager
      description: Manager.
      type: string
    - contextPath: Gra.Highrisk.Users.title
      description: Title.
      type: string
    - contextPath: Gra.Highrisk.Users.joiningDate
      description: Joining Date.
      type: date
    - contextPath: Gra.Highrisk.Users.exitDate
      description: Exit Date.
      type: date
    - contextPath: Gra.Highrisk.Users.updated_on
      description: Updated On.
      type: date
    - contextPath: Gra.Highrisk.Users.created_on
      description: Created On.
      type: date
    - contextPath: Gra.Highrisk.Users.resource
      description: Resource.
      type: string
    - contextPath: Gra.Highrisk.Users.name
      description: Name.
      type: string
    - contextPath: Gra.Highrisk.Users.id
      description: Id.
      type: string
    - contextPath: Gra.Highrisk.Users.type
      description: Type.
      type: string
    - contextPath: Gra.Highrisk.Users.description
      description: Description.
      type: string
    - contextPath: Gra.Highrisk.Users.is_reassigned
      description: Is Reassigned.
      type: string
    - contextPath: Gra.Highrisk.Users.high_risk
      description: High Risk.
      type: string
    - contextPath: Gra.Highrisk.Users.is_orphan
      description: Is Orphan.
      type: string
    - contextPath: Gra.Highrisk.Users.domain
      description: Domain.
      type: string
    description: Retrieve list of all high risk users.
  - name: gra-cases
    arguments:
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - CLOSED
      - RISK ACCEPTED
      - REOPENED
      - ALL
      description: Status.
      defaultValue: OPEN
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.Cases.entityId
      description: EntityId.
      type: number
    - contextPath: Gra.Cases.entityTypeId
      description: Entity Type Id.
      type: number
    - contextPath: Gra.Cases.entity
      description: Entity.
      type: string
    - contextPath: Gra.Cases.caseId
      description: Case Id.
      type: number
    - contextPath: Gra.Cases.openDate
      description: Open Date.
      type: date
    - contextPath: Gra.Cases.ownerId
      description: Owner Id.
      type: number
    - contextPath: Gra.Cases.ownerType
      description: Owner Type.
      type: string
    - contextPath: Gra.Cases.ownerName
      description: Owner Name.
      type: string
    - contextPath: Gra.Cases.riskDate
      description: Risk Date.
      type: date
    - contextPath: Gra.Cases.status
      description: satus.
      type: string
    - contextPath: Gra.Cases.anomalies
      description: Anomalies.
      type: string
    description: Retrieve list of all cases for specified status.
  - name: gra-user-anomalies
    arguments:
    - name: employee_id
      required: true
      description: employee Id.
    - name: page
      required: true
      description: Page No.
      defaultValue: "1"
    - name: max
      required: true
      description: Per page record count.
      defaultValue: "25"
    outputs:
    - contextPath: Gra.User.Anomalies.anomaly_name
      description: Anomaly Name.
      type: string
    description: Retrieve list of anomalies for specified user.
  - name: gra-case-action
    arguments:
    - name: action
      required: true
      default: true
      auto: PREDEFINED
      predefined:
      - closeCase
      - modelReviewCase
      - riskManageCase
      description: Action.
      defaultValue: closeCase
    - name: caseId
      required: true
      description: Case Id.
    - name: subOption
      required: true
      auto: PREDEFINED
      predefined:
      - True Incident
      - Correct Detection
      - Tuning Required
      - Others
      description: Sub Option.
      defaultValue: True Incident
    - name: caseComment
      required: true
      description: Case Comment.
    - name: riskAcceptDate
      description: Risk Accept Date in ‘yyyy-MM-dd’ format. (applicable only in case of closing a case as Risk Managed).
    outputs:
    - contextPath: Gra.Case.Action.Message
      description: Message.
      type: string
    description: Close a case and update the anomaly status as Closed / Risk Managed / Model Reviewed.
  - name: gra-case-action-anomaly
    arguments:
    - name: action
      required: true
      default: true
      auto: PREDEFINED
      predefined:
      - closeCaseAnomaly
      - modelReviewCaseAnomaly
      - riskAcceptCaseAnomaly
      description: Action.
      defaultValue: closeCaseAnomaly
    - name: caseId
      required: true
      description: Case ID.
    - name: anomalyNames
      required: true
      description: Anomaly Names.
    - name: subOption
      required: true
      auto: PREDEFINED
      predefined:
      - True Incident
      - Correct Detection
      - Tuning Required
      - Others
      description: Sub Option.
      defaultValue: True Incident
    - name: caseComment
      required: true
      description: Case Comment.
    - name: riskAcceptDate
      description: "Risk Accept Date in ‘yyyy-MM-dd’ format. (applicable only in case of closing anomalies as Risk Accepted)."
    outputs:
    - contextPath: Gra.Case.Action.Anomaly.Message
      description: Message.
      type: string
    - contextPath: Gra.Case.Action.Anomaly.anomalyName
      description: Anomaly Name.
      type: string
    description: Close an anomaly or anomalies within a case and update the anomaly status as Closed / Risk Managed / Model Reviewed.
  - name: gra-investigate-anomaly-summary
    arguments:
    - name: modelName
      required: true
      description: Model Name.
    - name: fromDate
      description: From Date ( yyyy-MM-dd ).
    - name: toDate
      description: To Date ( yyyy-MM-dd ).
    outputs:
    - contextPath: Gra.Investigate.Anomaly.Summary.analyticalFeatures
      description: Analytical Features.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.entityCount
      description: Entity Count.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.resourceCount
      description: Resource Count.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.records
      description: Records.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.anomalyBaseline
      description: Anomaly Baseline.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.anomalyLastCatch
      description: Anomaly Last Catch.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.executionDays
      description: Execution Days.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.chainDetails
      description: Chain Details.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.resourceName
      description: Resource Name.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.type
      description: Type.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.value
      description: Value.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.anomalousActivity
      description: Anomalous Activity.
      type: number
    - contextPath: Gra.Investigate.Anomaly.Summary.anomalyName
      description: Anomaly Name.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.classifier
      description: Classifier.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.anomalyFirstCatch
      description: Anomaly First Catch.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.anomalyDescription
      description: Anomaly Description.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.similarTemplateAnomalies
      description: Similar Template Anomalies.
      type: string
    - contextPath: Gra.Investigate.Anomaly.Summary.entitiesFlagged
      description: Entities Flagged.
      type: number
    description: Retrieve detailed anomaly summary of specified anomaly name.
  - name: gra-analytical-features-entity-value
    arguments:
    - name: entityValue
      required: true
      description: Entity Value.
    - name: modelName
      required: true
      description: Model Name.
    - name: fromDate
      required: true
      description: From Date ( yyyy-MM-dd ).
    - name: toDate
      required: true
      description: To Date ( yyyy-MM-dd ).
    - name: entityTypeId
      description: Entity Type Id.
    outputs:
    - contextPath: Gra.Analytical.Features.Entity.Value.analyticalFeatures
      description: Analytical Features.
      type: string
    - contextPath: Gra.Analytical.Features.Entity.Value.analyticalFeatureValues
      description: Analytical Feature Values.
      type: string
    description: Retrieve analytical features for specified entity value, model name and dates.
  - name: gra-cases-anomaly
    arguments:
    - name: caseId
      description: GRA Case Id.
      required: true
    outputs:
    - contextPath: Gra.Cases.anomalies.anomalyName
      description: Cases Anomaly name.
      type: String
    - contextPath: Gra.Cases.anomalies.riskAcceptedDate
      description: Risk accepted date of anomaly.
      type: date
    - contextPath: Gra.Cases.anomalies.resourceName
      description: Resource Name.
      type: String
    - contextPath: Gra.Cases.anomalies.riskScore
      description: Risk score for anomaly.
      type: String
    - contextPath: Gra.Cases.anomalies.assignee
      description: Assignee name.
      type: String
    - contextPath: Gra.Cases.anomalies.assigneeType
      description: Assignee type (User/Role).
      type: String
    - contextPath: Gra.Cases.anomalies.status
      description: Current status of anomaly.
      type: String
    description: Retrieve anomalies for specified case id.
  - name: gra-validate-api
    description: Verifies the Gurucul platform's operational status by assessing system health, reviewing logs, and checking key performance indicators for any errors.
  dockerimage: demisto/python3:3.12.13.7444307
  isfetch: true
  subtype: python3
fromversion: 5.0.0
tests:
- No tests (auto formatted)