IronDefense

Details

ID	`IronDefense`
Provider	IronNet Cybersecurity
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

IronDefense gives users the ability to rate alerts, update alert statuses, add comments to alerts, and to report observed bad activity.

Configure IronDefense on XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for IronDefense.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- IronAPI Host/IP
- IronAPI Port
- Username
- Request Timeout (Sec)
Click Test to validate the new instance.

Commands

You can execute these commands from the XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Rate an alert: irondefense-rate-alert
Add a comment to an alert: irondefense-comment-alert
Set the status of an alert: irondefense-set-alert-status
Submit an observed bad endpoint to create Threat Intelligence Rules (TIR): irondefense-report-observed-bad-activity

1. Rate an alert

Rates an IronDefense alert.

Base Command

irondefense-rate-alert

Input

Argument Name	Description	Required
alert_id	The ID of the IronDefense alert.	Required
severity	The severity rating of the alert. Can be: "Undecided", "Benign", "Suspicious", "Malicious".	Required
expectation	Determines whether the rating was expected. Can be: "Unknown", "Expected", "Unexpected". Use "Unknown" if the rating is undecided.	Required
comments	Explains the rating of the alert.	Required
share_comment_with_irondome	Whether to share the comment with IronDome.	Required

Context Output

There are no context output for this command.

2. Add a comment to an alert

Adds a comment to an IronDefense alert.

Base Command

irondefense-comment-alert

Input

Argument Name	Description	Required
alert_id	The ID of the IronDefense alert.	Required
comment	Explains the rating of the alert.	Required
share_comment_with_irondome	Whether to share the comment with IronDome.	Required

Context Output

There are no context output for this command.

3. Set the status of an alert

Sets the status of an IronDefense alert.

Base Command

irondefense-set-alert-status

Input

Argument Name	Description	Required
alert_id	The ID of the IronDefense alert.	Required
status	The alert status to set. Can be: "Awaiting Review", "Under Review", "Closed".	Required
comments	Explains the status of the alert.	Required
share_comment_with_irondome	Whether to share the comment with IronDome.	Required

Context Output

There are no context output for this command.

4. Submit an observed bad endpoint to create Threat Intelligence Rules (TIR)

Submits an observed bad endpoint to IronDefense to create Threat Intelligence Rules (TIR).

Base Command

irondefense-report-observed-bad-activity

Input

Argument Name	Description	Required
name	The name of the Threat Intelligence Rule (TIR) to be created.	Required
description	A description of the observed bad endpoint.	Required
ip	The IP address of the observed bad endpoint.	Optional
domain	The domain name of the observed bad endpoint.	Optional
activity_start_time	The start time of the observed bad activity in RFC 3339 format.	Required
activity_end_time	The end time of the observed bad activity in RFC 3339 format.	Required

Context Output

There are no context output for this command.

irondefense-get-event

Retrieves an IronDefense event.

Base Command

irondefense-get-event

Input

Argument Name	Description	Required
event_id	The ID of the IronDefense event.	Required

Context Output

Path	Type	Description
IronDefense.Event.id	String	The event ID.
IronDefense.Event.alert_id	String	The associated alert ID.
IronDefense.Event.category	String	The event category.
IronDefense.Event.sub_category	String	The event sub category.
IronDefense.Event.severity	Number	The event severity (0-1000).
IronDefense.Event.confidence	Number	The event confidence (real number between 0-1).
IronDefense.Event.created	Date	Time the event was created.
IronDefense.Event.updated	Date	Time the event was last updated.
IronDefense.Event.start_time	Date	The start time of this event’s activity.
IronDefense.Event.end_time	Date	The end time of this event’s activity.
IronDefense.Event.iron_dome_shared_time	Date	The time when the event was sent to IronDome - not present if not shared with irondome.
IronDefense.Event.is_whitelisted	Boolean	True if the event activity was whitelisted, false otherwise.
IronDefense.Event.is_blacklisted	Boolean	True if the event activity was blacklisted, false otherwise.
IronDefense.Event.src_ip	String	The source IP associated with this event.
IronDefense.Event.dst_ip	String	The destination IP associated with this event.
IronDefense.Event.dst_port	Number	The destination port associated with this event.
IronDefense.Event.ppp_domains	String	Any domains associated with this event.
IronDefense.Event.primary_app_protocol	String	The primary application protocol associated with this event.
IronDefense.Event.secondary_app_protocol	String	The secondary application protocol associated with this event.
IronDefense.Event.bytes_in	Number	The byte count of incoming traffic for this event.
IronDefense.Event.bytes_out	Number	The byte count of outgoing traffic for this event.
IronDefense.Event.total_bytes	Number	The byte count of the total traffic (in either direction) for this event.
IronDefense.Event.url	String	The related URL for this event, if applicable.
IronDefense.Event.raw_data_formats	String	The list of distinct raw data formats for this event.
IronDefense.Event.src_entity_attribute	String	The source entity attribute related to this event, if one could be determined.
IronDefense.Event.src_entity_attribute_type	String	The source entity attribute type related to this event, if one could be determined.
IronDefense.Event.dst_entity_attribute	String	The destination entity attribute related to this event, if one could be determined.
IronDefense.Event.dst_entity_attribute_type	String	The destination entity attribute type related to this event, if one could be determined.
IronDefense.Event.vue_url	String	The url for displaying the event within IronVUE.
IronDefense.Event.Context.name	String	The name of the context table.
IronDefense.Event.Context.columns	String	Column values for the context table.

irondefense-get-alerts

Pulls Alerts from IronDefense.

Base Command

irondefense-get-alerts

Input

Argument Name	Description	Required
alert_id	The list of Alert IDs to filter by.	Optional
category	The list of Alert categories to filter by. Possible values are: C2, Action, Access, Recon, Other.	Optional
sub_category	The list of Alert sub categories to filter by.	Optional
status	The list of Alert status to filter by. Possible values are: Awaiting Review, Under Review, Closed.	Optional
analyst_severity	The list of Alert analyst severity to filter by. Possible values are: Undecided, Benign, Suspicious, Malicious.	Optional
analyst_expectation	The list of Alert analyst expectation to filter by. Possible values are: Unknown, Expected, Unexpected.	Optional
min_severity	The minimum Alert severity to filter by. (0-1000).	Optional
max_severity	The maximum Alert severity to filter by. (0-1000).	Optional
min_created	The minimum Alert created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
max_created	The maximum Alert created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
min_updated	The minimum Alert updated date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
max_updated	The maximum Alert updated date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
min_first_event_created	The minimum Alert first event created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
max_first_event_created	The maximum Alert first event created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
min_last_event_created	The minimum Alert last event created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
max_last_event_created	The maximum Alert last event created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
min_first_event_start_time	The minimum Alert first event start date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
max_first_event_start_time	The maximum Alert first event start date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
min_last_event_end_time	The minimum Alert last event end date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
max_last_event_end_time	The maximum Alert last event end date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).	Optional
analytic_version	The list of Alert analytic versions to filter by.	Optional
limit	The limit on the number of Alerts to be returned.	Optional
offset	The number of results to skip - used for paging the results.	Optional
sort	The list of Alert fields to sort by.	Optional

Context Output

Path	Type	Description
IronDefense.Alert.id	string	The ID of the alert.
IronDefense.Alert.category	string	The category of the alert.
IronDefense.Alert.sub_category	string	The subcategory of the alert.
IronDefense.Alert.severity	Number	The severity score of the alert. (0-1000)
IronDefense.Alert.status	String	The status of the alert.
IronDefense.Alert.analyst_severity	String	The analyst severity of the alert.
IronDefense.Alert.analyst_expectation	String	The analyst expectation of the alert.
IronDefense.Alert.created	Date	Time the alert was created in IronDefense.
IronDefense.Alert.updated	Date	Time the alert was last updated in IronDefense.
IronDefense.Alert.event_count	Number	The number of non-whitelisted events associated with this alert.
IronDefense.Alert.FirstEventCreated	String	The earliest created date of any associated event on this alert.
IronDefense.Alert.last_event_created	String	The last created date of any associated event on this alert.
IronDefense.Alert.raw_data_format	String	List of distinct raw data formats for this event.
IronDefense.Alert.aggregation_criteria	String	Criteria used to build alert, specific to the event context fields.
IronDefense.Alert.vue_url	String	The url for displaying the alert within IronVUE.
IronDefense.Query.GetAlerts.limit	Number	The maximum number of results that were requested to be returned.
IronDefense.Query.GetAlerts.offset	Number	The number of results that were skipped - used for paging the results.
IronDefense.Query.GetAlerts.total	Number	The total number of results possible from the query.

irondefense-get-alert-irondome-information

Retrieves IronDome information for an IronDefense alert.

Base Command

irondefense-get-alert-irondome-information

Input

Argument Name	Description	Required
alert_id	The ID of the IronDefense alert.	Required

Context Output

Path	Type	Description
IronDome.Correlations.alert_id	String	The alert ID the correlations are associated with.
IronDome.Correlations.dome_tag	String	The IronDome tag.
IronDome.Correlations.correlation.correlations.ip	String	The IP correlated on (if an IP correlation).
IronDome.Correlations.correlation.correlations.domain	String	The Domain correlated on (if a Domain correlation).
IronDome.Correlations.correlation.correlations.behavior	Boolean	True if the correlation was behavior-based.
IronDome.Correlations.correlation.correlations.enterprise_correlations	Number	The number of enterprise correlations.
IronDome.Correlations.correlation.correlations.community_correlations	Number	The number of community correlations.
IronDome.CorrelationParticipation.alert_id	String	The alert ID the correlation participants are associated with.
IronDome.CorrelationParticipation.correlation_participation.dome_tag	String	The IronDome tag.
IronDome.CorrelationParticipation.correlation_participation.behavior.malicious_count	Number	Count of malicious ratings.
IronDome.CorrelationParticipation.correlation_participation.behavior.suspicious_count	Number	Count of suspicious ratings.
IronDome.CorrelationParticipation.correlation_participation.behavior.benign_count	Number	Count of benign ratings.
IronDome.CorrelationParticipation.correlation_participation.behavior.whitelisted_count	Number	Count of whitelisted ratings.
IronDome.CorrelationParticipation.correlation_participation.behavior.comments_count	Number	Count of comments made.
IronDome.CorrelationParticipation.correlation_participation.behavior.activity_count	Number	Count of activity.
IronDome.CorrelationParticipation.correlation_participation.behavior.resource_owner	Boolean	True if the caller is the resource owner.
IronDome.CorrelationParticipation.correlation_participation.behavior.first_seen	Date	The time the activity was first seen.
IronDome.CorrelationParticipation.correlation_participation.behavior.last_seen	Date	The time the activity was last seen.
IronDome.CorrelationParticipation.correlation_participation.domain.malicious_count	Number	Count of malicious ratings.
IronDome.CorrelationParticipation.correlation_participation.domain.suspicious_count	Number	Count of suspicious ratings.
IronDome.CorrelationParticipation.correlation_participation.domain.benign_count	Number	Count of benign ratings.
IronDome.CorrelationParticipation.correlation_participation.domain.whitelisted_count	Number	Count of whitelisted ratings.
IronDome.CorrelationParticipation.correlation_participation.domain.comments_count	Number	Count of comments made.
IronDome.CorrelationParticipation.correlation_participation.domain.activity_count	Number	Count of activity.
IronDome.CorrelationParticipation.correlation_participation.domain.resource_owner	Boolean	True if the caller is the resource owner.
IronDome.CorrelationParticipation.correlation_participation.domain.first_seen	Date	The time the activity was first seen.
IronDome.CorrelationParticipation.correlation_participation.domain.last_seen	Date	The time the activity was last seen.
IronDome.CorrelationParticipation.correlation_participation.ip.malicious_count	Number	Count of malicious ratings.
IronDome.CorrelationParticipation.correlation_participation.ip.suspicious_count	Number	Count of suspicious ratings.
IronDome.CorrelationParticipation.correlation_participation.ip.benign_count	Number	Count of benign ratings.
IronDome.CorrelationParticipation.correlation_participation.ip.whitelisted_count	Number	Count of whitelisted ratings.
IronDome.CorrelationParticipation.correlation_participation.ip.comments_count	Number	Count of comments made.
IronDome.CorrelationParticipation.correlation_participation.ip.activity_count	Number	Count of activity.
IronDome.CorrelationParticipation.correlation_participation.ip.resource_owner	Boolean	True if the caller is the resource owner.
IronDome.CorrelationParticipation.correlation_participation.ip.first_seen	Date	The time the activity was first seen.
IronDome.CorrelationParticipation.correlation_participation.ip.last_seen	Date	The time the activity was last seen.
IronDome.CommunityComments.alert_id	String	The alert ID associated with the community comments.
IronDome.CommunityComments.community_comments.created	Date	The time that the comment was created.
IronDome.CommunityComments.community_comments.comment	String	The comment text.
IronDome.CommunityComments.community_comments.dome_tags	String	The IronDome tags related to the comment.
IronDome.CommunityComments.community_comments.enterprise	Boolean	True if enterprise.
IronDome.CommunityComments.community_comments.self	Boolean	True if the comment was made by the caller.
IronDome.CognitiveSystemScore.alert_id	String	The alert ID associated with the cognitive system score.
IronDome.CognitiveSystemScore.cognitive_system_score	Number	The cognitive system score of the alert.
IronDome.Notification.alert_id	String	The alert ID associated with the IronDome notification.
IronDome.Notification.dome_notification.id	String	The unique ID of the notification.
IronDome.Notification.dome_notification.category	String	The category of Dome notification.
IronDome.Notification.dome_notification.created	Date	The category of Dome notification.
IronDome.Notification.dome_notification.dome_tags	String	The IronDome tags related to this notification.
IronDome.Notification.dome_notification.alert_ids	String	The IDs of the alerts related to this notification.
IronDome.Notification.dome_notification.mismatch_details.enterprise_severities.analyst_severity	String	The mismatched severity across correlated alerts within the enterprise.
IronDome.Notification.dome_notification.mismatch_details.enterprise_severities.count	Number	The count of mismatched severity with this analyst rating.
IronDome.Notification.dome_notification.mismatch_details.community_severities.analyst_severity	String	The mismatched severity across correlated alerts within the community.
IronDome.Notification.dome_notification.mismatch_details.community_severities.count	Number	The count of mismatched severity with this analyst rating.
IronDome.Notification.dome_notification.severity_details.analyst_severity	String	The analyst severity of the alert.
IronDome.Notification.dome_notification.comment_details.comment	String	The comment text in the notification.
IronDome.Notification.dome_notification.severity_suspicious_details.domains	String	The list of domains correlated on a suspicious alert.
IronDome.Notification.dome_notification.severity_suspicious_details.ips	String	The list of IPs correlated on a suspicious alert.
IronDome.Notification.dome_notification.severity_suspicious_details.comments	String	The comments about this suspicious alert correlation.
IronDome.Notification.dome_notification.severity_malicious_details.domains	String	The list of domains correlated on a malicious alert.
IronDome.Notification.dome_notification.severity_malicious_details.ips	String	The list of IPs correlated on a malicious alert.
IronDome.Notification.dome_notification.severity_malicious_details.comments	String	The comments about this malicious alert correlation.
IronDome.Notification.dome_notification.severity_malicious_details.generated_threat_intel_rules.ip	String	The IP of a Threat Intelligence rule that was automatically created based on an IronDome correlation.
IronDome.Notification.dome_notification.severity_malicious_details.generated_threat_intel_rules.domain	String	The domain of a Threat Intelligence rule that was automatically created based on an IronDome correlation.
IronDome.Notification.dome_notification.severity_malicious_details.generated_threat_intel_rules.rule_id	String	The rule ID of a Threat Intelligence rule that was automatically created based on an IronDome correlation.
IronDome.Notification.dome_notification.severity_malicious_details.generated_threat_intel_rules.vue_url	String	The IronVUE URL of a Threat Intelligence rule that was automatically created based on an IronDome correlation.
IronDome.Notification.dome_notification.high_cognitive_system_score_details.enterprise_alert_score	Number	The alert score for the enterprise.
IronDome.Notification.dome_notification.high_cognitive_system_score_details.cognitive_system_score	Number	The cognitive system score.

irondefense-get-events-from-alert

Retrieves IronDefense Events for a given Alert ID.

Base Command

irondefense-get-events-from-alert

Input

Argument Name	Description	Required
alert_id	The ID of the IronDefense alert to retrieve events for.	Required
limit	The limit on the number of Events to be returned.	Optional
offset	The number of results to skip - used for paging the results.	Optional

Context Output

Path	Type	Description
IronDefense.Event.id	String	The event ID.
IronDefense.Event.alert_id	String	The associated alert ID.
IronDefense.Event.category	String	The event category.
IronDefense.Event.sub_category	String	The event sub category.
IronDefense.Event.severity	Number	The event severity (0-1000).
IronDefense.Event.confidence	Number	The event confidence (real number between 0-1).
IronDefense.Event.created	Date	Time the event was created.
IronDefense.Event.updated	Date	Time the event was last updated.
IronDefense.Event.start_time	Date	The start time of this event’s activity.
IronDefense.Event.end_time	Date	The end time of this event’s activity.
IronDefense.Event.iron_dome_shared_time	Date	The time when the event was sent to IronDome - not present if not shared with irondome.
IronDefense.Event.is_whitelisted	Boolean	True if the event activity was whitelisted, false otherwise.
IronDefense.Event.is_blacklisted	Boolean	True if the event activity was blacklisted, false otherwise.
IronDefense.Event.src_ip	String	The source IP associated with this event.
IronDefense.Event.dst_ip	String	The destination IP associated with this event.
IronDefense.Event.dst_port	Number	The destination port associated with this event.
IronDefense.Event.app_domains	String	Any domains associated with this event.
IronDefense.Event.primary_app_protocol	String	The primary application protocol associated with this event.
IronDefense.Event.secondary_app_protocol	String	The secondary application protocol associated with this event.
IronDefense.Event.bytes_in	Number	The byte count of incoming traffic for this event.
IronDefense.Event.bytes_out	Number	The byte count of outgoing traffic for this event.
IronDefense.Event.total_bytes	Number	The byte count of the total traffic (in either direction) for this event.
IronDefense.Event.url	String	The related URL for this event, if applicable.
IronDefense.Event.raw_data_formats	String	The list of distinct raw data formats for this event.
IronDefense.Event.src_entity_attribute	String	The source entity attribute related to this event, if one could be determined.
IronDefense.Event.src_entity_attribute_type	String	The source entity attribute type related to this event, if one could be determined.
IronDefense.Event.dst_entity_attribute	String	The destination entity attribute related to this event, if one could be determined.
IronDefense.Event.dst_entity_attribute_type	String	The destination entity attribute type related to this event, if one could be determined.
IronDefense.Event.vue_url	String	The url for displaying the event within IronVUE.
IronDefense.Query.GetEvents.limit	Number	The maximum number of results that were requested to be returned.
IronDefense.Query.GetEvents.offset	Number	The number of results that were skipped - used for paging the results.
IronDefense.Query.GetEvents.total	Number	The total number of results possible from the query.

Configuration parameters

ironAPIHost — IronAPI Host/IP (required)
ironAPIPort — IronAPI Port (required)
credentials — Username (required)
requestTimeout — Request Timeout (Sec)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
enableAlertNotifications — Enable Alert Notification Ingestion (Refresh Not Supported)
alertLimit — Alert Notification Limit Per Request. (Max 500)
alertCategories — Alert Notification Categories to Exclude
alertSubCategories — Alert Notification SubCategories to Exclude, See https://ironnet.atlassian.net/wiki/x/hADvGg for values (Enter in comma separated list format)
alertSeverityLower — Lower Bound of Severity for Alert Notification (0-1000)
alertSeverityUpper — Upper Bound of Severity for Alert Notification (0-1000)
alertActions — Alert Notification Actions to Include (Alert Created enabled by default)
enableEventNotifications — Enable Event Notification Ingestion (Refresh Not Supported)
eventLimit — Event Notification Limit Per Request. (Max 500)
eventCategories — Event Notification Categories to Exclude
eventSubCategories — Event Notification SubCategories to Exclude, See https://ironnet.atlassian.net/wiki/x/hADvGg for values (Enter in comma separated list format)
eventSeverityLower — Lower Bound of Severity for Event Notification (0-1000)
eventSeverityUpper — Upper Bound of Severity for Event Notification (0-1000)
eventActions — Event Notification Actions to Include (Event Created enabled by default)
enableDomeNotifications — Enable Dome Notification Ingestion (Refresh Not Supported)
domeLimit — Dome Notification Limit Per Request. (Max 500)
domeCategories — Dome Notification Types to Exclude

Commands (8)

irondefense-comment-alert
Adds a comment to an IronDefense alert.
irondefense-get-alert-irondome-information
Retrieves IronDome information for an IronDefense alert.
irondefense-get-alerts
Pulls Alerts from IronDefense.
irondefense-get-event
Retrieves an IronDefense event.
irondefense-get-events-from-alert
Retrieves IronDefense Events for a given Alert ID.
irondefense-rate-alert
Rates an IronDefense alert.
irondefense-report-observed-bad-activity
Submits an observed bad endpoint to IronDefense to create Threat. Intelligence Rules (TIR).
irondefense-set-alert-status
Sets the status of an IronDefense alert.

Source

IronDefense.py IronDefense_test.py IronDefense.yml IronDefense_description.md

Download History Raw

category: Network Security
sectionorder:
- Connect
- Collect
provider: IronNet Cybersecurity
commonfields:
  id: IronDefense
  version: -1
configuration:
- display: IronAPI Host/IP
  name: ironAPIHost
  required: true
  type: 0
  section: Connect
- defaultvalue: '6942'
  display: IronAPI Port
  name: ironAPIPort
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- defaultvalue: '60'
  display: Request Timeout (Sec)
  name: requestTimeout
  type: 0
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- defaultvalue: 'true'
  display: Enable Alert Notification Ingestion (Refresh Not Supported)
  name: enableAlertNotifications
  type: 8
  required: false
  section: Collect
- defaultvalue: '200'
  display: Alert Notification Limit Per Request. (Max 500)
  name: alertLimit
  type: 0
  required: false
  section: Collect
- display: Alert Notification Categories to Exclude
  name: alertCategories
  options:
  - C2
  - Action
  - Access
  - Recon
  - Other
  type: 16
  required: false
  section: Collect
- display: Alert Notification SubCategories to Exclude, See https://ironnet.atlassian.net/wiki/x/hADvGg for values (Enter in comma separated list format)
  name: alertSubCategories
  type: 12
  required: false
  section: Collect
- defaultvalue: '0'
  display: Lower Bound of Severity for Alert Notification (0-1000)
  name: alertSeverityLower
  type: 0
  required: false
  section: Collect
- defaultvalue: '1000'
  display: Upper Bound of Severity for Alert Notification (0-1000)
  name: alertSeverityUpper
  type: 0
  required: false
  section: Collect
- display: Alert Notification Actions to Include (Alert Created enabled by default)
  name: alertActions
  options:
  - Alert Created
  - Alert Updated
  - Workflow Created
  - Workflow Updated
  - Alert Deleted
  - Note Created
  - Note Updated
  - Alert Event Added
  type: 16
  required: false
  section: Collect
- defaultvalue: 'false'
  display: Enable Event Notification Ingestion (Refresh Not Supported)
  name: enableEventNotifications
  type: 8
  required: false
  section: Collect
- defaultvalue: '200'
  display: Event Notification Limit Per Request. (Max 500)
  name: eventLimit
  type: 0
  required: false
  section: Collect
- display: Event Notification Categories to Exclude
  name: eventCategories
  options:
  - C2
  - Action
  - Access
  - Recon
  - Other
  type: 16
  required: false
  section: Collect
- display: Event Notification SubCategories to Exclude, See https://ironnet.atlassian.net/wiki/x/hADvGg for values (Enter in comma separated list format)
  name: eventSubCategories
  type: 12
  required: false
  section: Collect
- defaultvalue: '0'
  display: Lower Bound of Severity for Event Notification (0-1000)
  name: eventSeverityLower
  type: 0
  required: false
  section: Collect
- defaultvalue: '1000'
  display: Upper Bound of Severity for Event Notification (0-1000)
  name: eventSeverityUpper
  type: 0
  required: false
  section: Collect
- display: Event Notification Actions to Include (Event Created enabled by default)
  name: eventActions
  options:
  - Event Created
  - Event Retro Whitelisted
  - Event Added to Alert
  - Event Deleted
  - Event Alert Under Review
  - Event Alert Closed
  type: 16
  required: false
  section: Collect
- defaultvalue: 'false'
  display: Enable Dome Notification Ingestion (Refresh Not Supported)
  name: enableDomeNotifications
  type: 8
  required: false
  section: Collect
- defaultvalue: '500'
  display: Dome Notification Limit Per Request. (Max 500)
  name: domeLimit
  type: 0
  required: false
  section: Collect
- display: Dome Notification Types to Exclude
  name: domeCategories
  options:
  - Participant Added
  - Comment Added
  - Community Severity Changed
  - Community Severity Mismatched
  - Enterprise Severity Mismatched
  - Severity Suspicious
  - Severity Malicious
  - Joined High Risk
  - High Cognitive System Score
  type: 16
  required: false
  section: Collect
description: The IronDefense Integration for Cortex XSOAR allows users to interact with IronDefense alerts within Cortex XSOAR. The Integration provides the ability to rate alerts, update alert statuses, add comments to alerts, to report observed bad activity, get alerts, get events, and get IronDome information.
display: IronDefense
name: IronDefense
script:
  commands:
  - arguments:
    - description: The ID of the IronDefense alert.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: 'The severity rating of the alert. Can be: "Undecided", "Benign", "Suspicious", "Malicious".'
      name: severity
      predefined:
      - Undecided
      - Benign
      - Suspicious
      - Malicious
      required: true
    - auto: PREDEFINED
      description: 'Determines whether the rating was expected. Can be: "Unknown", "Expected", "Unexpected". Use "Unknown" if the rating is undecided.'
      name: expectation
      predefined:
      - Unknown
      - Expected
      - Unexpected
      required: true
    - description: Explains the rating of the alert.
      name: comments
      required: true
    - auto: PREDEFINED
      description: Whether to share the comment with IronDome.
      name: share_comment_with_irondome
      predefined:
      - 'True'
      - 'False'
      required: true
    description: Rates an IronDefense alert.
    name: irondefense-rate-alert
  - arguments:
    - description: The ID of the IronDefense alert.
      name: alert_id
      required: true
    - description: Explains the rating of the alert.
      name: comment
      required: true
    - auto: PREDEFINED
      description: Whether to share the comment with IronDome.
      name: share_comment_with_irondome
      predefined:
      - 'True'
      - 'False'
      required: true
    description: Adds a comment to an IronDefense alert.
    name: irondefense-comment-alert
  - arguments:
    - description: The ID of the IronDefense alert.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: 'The alert status to set. Can be: "Awaiting Review", "Under Review", "Closed".'
      name: status
      predefined:
      - Awaiting Review
      - Under Review
      - Closed
      required: true
    - description: Explains the status of the alert.
      name: comments
      required: true
    - auto: PREDEFINED
      description: Whether to share the comment with IronDome.
      name: share_comment_with_irondome
      predefined:
      - 'True'
      - 'False'
      required: true
    description: Sets the status of an IronDefense alert.
    name: irondefense-set-alert-status
  - arguments:
    - description: The name of the Threat Intelligence Rule (TIR) to be created.
      name: name
      required: true
    - description: A description of the observed bad endpoint.
      name: description
      required: true
    - description: The IP address of the observed bad endpoint.
      name: ip
    - description: The domain name of the observed bad endpoint.
      name: domain
    - description: The start time of the observed bad activity in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: activity_start_time
      required: true
    - description: The end time of the observed bad activity in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: activity_end_time
      required: true
    description: Submits an observed bad endpoint to IronDefense to create Threat. Intelligence Rules (TIR).
    name: irondefense-report-observed-bad-activity
  - arguments:
    - description: The ID of the IronDefense event.
      name: event_id
      required: true
    description: Retrieves an IronDefense event.
    name: irondefense-get-event
    outputs:
    - contextPath: IronDefense.Event.id
      description: The event ID.
      type: String
    - contextPath: IronDefense.Event.alert_id
      description: The associated alert ID.
      type: String
    - contextPath: IronDefense.Event.category
      description: The event category.
      type: String
    - contextPath: IronDefense.Event.sub_category
      description: The event sub category.
      type: String
    - contextPath: IronDefense.Event.severity
      description: The event severity (0-1000).
      type: Number
    - contextPath: IronDefense.Event.confidence
      description: The event confidence (real number between 0-1).
      type: Number
    - contextPath: IronDefense.Event.created
      description: Time the event was created.
      type: Date
    - contextPath: IronDefense.Event.updated
      description: Time the event was last updated.
      type: Date
    - contextPath: IronDefense.Event.start_time
      description: The start time of this event's activity.
      type: Date
    - contextPath: IronDefense.Event.end_time
      description: The end time of this event's activity.
      type: Date
    - contextPath: IronDefense.Event.iron_dome_shared_time
      description: The time when the event was sent to IronDome - not present if not shared with irondome.
      type: Date
    - contextPath: IronDefense.Event.is_whitelisted
      description: True if the event activity was whitelisted, false otherwise.
      type: Boolean
    - contextPath: IronDefense.Event.is_blacklisted
      description: True if the event activity was blacklisted, false otherwise.
      type: Boolean
    - contextPath: IronDefense.Event.src_ip
      description: The source IP associated with this event.
      type: String
    - contextPath: IronDefense.Event.dst_ip
      description: The destination IP associated with this event.
      type: String
    - contextPath: IronDefense.Event.dst_port
      description: The destination port associated with this event.
      type: Number
    - contextPath: IronDefense.Event.ppp_domains
      description: Any domains associated with this event.
      type: String
    - contextPath: IronDefense.Event.primary_app_protocol
      description: The primary application protocol associated with this event.
      type: String
    - contextPath: IronDefense.Event.secondary_app_protocol
      description: The secondary application protocol associated with this event.
      type: String
    - contextPath: IronDefense.Event.bytes_in
      description: The byte count of incoming traffic for this event.
      type: Number
    - contextPath: IronDefense.Event.bytes_out
      description: The byte count of outgoing traffic for this event.
      type: Number
    - contextPath: IronDefense.Event.total_bytes
      description: The byte count of the total traffic (in either direction) for this event.
      type: Number
    - contextPath: IronDefense.Event.url
      description: The related URL for this event, if applicable.
      type: String
    - contextPath: IronDefense.Event.raw_data_formats
      description: The list of distinct raw data formats for this event.
      type: String
    - contextPath: IronDefense.Event.src_entity_attribute
      description: The source entity attribute related to this event, if one could be determined.
      type: String
    - contextPath: IronDefense.Event.src_entity_attribute_type
      description: The source entity attribute type related to this event, if one could be determined.
      type: String
    - contextPath: IronDefense.Event.dst_entity_attribute
      description: The destination entity attribute related to this event, if one could be determined.
      type: String
    - contextPath: IronDefense.Event.dst_entity_attribute_type
      description: The destination entity attribute type related to this event, if one could be determined.
      type: String
    - contextPath: IronDefense.Event.vue_url
      description: The url for displaying the event within IronVUE.
      type: String
    - contextPath: IronDefense.Event.Context.name
      description: The name of the context table.
      type: String
    - contextPath: IronDefense.Event.Context.columns
      description: Column values for the context table.
      type: String
  - arguments:
    - description: The list of Alert IDs to filter by.
      name: alert_id
    - auto: PREDEFINED
      description: The list of Alert categories to filter by.
      name: category
      predefined:
      - C2
      - Action
      - Access
      - Recon
      - Other
    - description: The list of Alert sub categories to filter by.
      name: sub_category
    - auto: PREDEFINED
      description: The list of Alert status to filter by.
      name: status
      predefined:
      - Awaiting Review
      - Under Review
      - Closed
    - auto: PREDEFINED
      description: The list of Alert analyst severity to filter by.
      name: analyst_severity
      predefined:
      - Undecided
      - Benign
      - Suspicious
      - Malicious
    - auto: PREDEFINED
      description: The list of Alert analyst expectation to filter by.
      name: analyst_expectation
      predefined:
      - Unknown
      - Expected
      - Unexpected
    - description: The minimum Alert severity to filter by. (0-1000).
      name: min_severity
    - description: The maximum Alert severity to filter by. (0-1000).
      name: max_severity
    - description: The minimum Alert created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: min_created
    - description: The maximum Alert created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: max_created
    - description: The minimum Alert updated date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: min_updated
    - description: The maximum Alert updated date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: max_updated
    - description: The minimum Alert first event created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: min_first_event_created
    - description: The maximum Alert first event created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: max_first_event_created
    - description: The minimum Alert last event created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: min_last_event_created
    - description: The maximum Alert last event created date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: max_last_event_created
    - description: The minimum Alert first event start date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: min_first_event_start_time
    - description: The maximum Alert first event start date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: max_first_event_start_time
    - description: The minimum Alert last event end date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: min_last_event_end_time
    - description: The maximum Alert last event end date to filter by in RFC 3339 format (E.g. 2017-10-13T07:20:50.52Z).
      name: max_last_event_end_time
    - description: The list of Alert analytic versions to filter by.
      name: analytic_version
    - description: The limit on the number of Alerts to be returned.
      name: limit
    - description: The number of results to skip - used for paging the results.
      name: offset
    - description: The list of Alert fields to sort by.
      name: sort
    description: Pulls Alerts from IronDefense.
    name: irondefense-get-alerts
    outputs:
    - contextPath: IronDefense.Alert.id
      description: The ID of the alert.
      type: string
    - contextPath: IronDefense.Alert.category
      description: The category of the alert.
      type: string
    - contextPath: IronDefense.Alert.sub_category
      description: The subcategory of the alert.
      type: string
    - contextPath: IronDefense.Alert.severity
      description: The severity score of the alert. (0-1000).
      type: Number
    - contextPath: IronDefense.Alert.status
      description: The status of the alert.
      type: String
    - contextPath: IronDefense.Alert.analyst_severity
      description: The analyst severity of the alert.
      type: String
    - contextPath: IronDefense.Alert.analyst_expectation
      description: The analyst expectation of the alert.
      type: String
    - contextPath: IronDefense.Alert.created
      description: Time the alert was created in IronDefense.
      type: Date
    - contextPath: IronDefense.Alert.updated
      description: Time the alert was last updated in IronDefense.
      type: Date
    - contextPath: IronDefense.Alert.event_count
      description: The number of non-whitelisted events associated with this alert.
      type: Number
    - contextPath: IronDefense.Alert.FirstEventCreated
      description: The earliest created date of any associated event on this alert.
      type: String
    - contextPath: IronDefense.Alert.last_event_created
      description: The last created date of any associated event on this alert.
      type: String
    - contextPath: IronDefense.Alert.raw_data_format
      description: List of distinct raw data formats for this event.
      type: String
    - contextPath: IronDefense.Alert.aggregation_criteria
      description: Criteria used to build alert, specific to the event context fields.
      type: String
    - contextPath: IronDefense.Alert.vue_url
      description: The url for displaying the alert within IronVUE.
      type: String
    - contextPath: IronDefense.Query.GetAlerts.limit
      description: The maximum number of results that were requested to be returned.
      type: Number
    - contextPath: IronDefense.Query.GetAlerts.offset
      description: The number of results that were skipped - used for paging the results.
      type: Number
    - contextPath: IronDefense.Query.GetAlerts.total
      description: The total number of results possible from the query.
      type: Number
  - arguments:
    - description: The ID of the IronDefense alert.
      name: alert_id
      required: true
    description: Retrieves IronDome information for an IronDefense alert.
    name: irondefense-get-alert-irondome-information
    outputs:
    - contextPath: IronDome.Correlations.alert_id
      description: The alert ID the correlations are associated with.
      type: String
    - contextPath: IronDome.Correlations.dome_tag
      description: The IronDome tag.
      type: String
    - contextPath: IronDome.Correlations.correlation.correlations.ip
      description: The IP correlated on (if an IP correlation).
      type: String
    - contextPath: IronDome.Correlations.correlation.correlations.domain
      description: The Domain correlated on (if a Domain correlation).
      type: String
    - contextPath: IronDome.Correlations.correlation.correlations.behavior
      description: True if the correlation was behavior-based.
      type: Boolean
    - contextPath: IronDome.Correlations.correlation.correlations.enterprise_correlations
      description: The number of enterprise correlations.
      type: Number
    - contextPath: IronDome.Correlations.correlation.correlations.community_correlations
      description: The number of community correlations.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.alert_id
      description: The alert ID the correlation participants are associated with.
      type: String
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.dome_tag
      description: The IronDome tag.
      type: String
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.malicious_count
      description: Count of malicious ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.suspicious_count
      description: Count of suspicious ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.benign_count
      description: Count of benign ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.whitelisted_count
      description: Count of whitelisted ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.comments_count
      description: Count of comments made.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.activity_count
      description: Count of activity.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.resource_owner
      description: True if the caller is the resource owner.
      type: Boolean
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.first_seen
      description: The time the activity was first seen.
      type: Date
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.behavior.last_seen
      description: The time the activity was last seen.
      type: Date
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.malicious_count
      description: Count of malicious ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.suspicious_count
      description: Count of suspicious ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.benign_count
      description: Count of benign ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.whitelisted_count
      description: Count of whitelisted ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.comments_count
      description: Count of comments made.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.activity_count
      description: Count of activity.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.resource_owner
      description: True if the caller is the resource owner.
      type: Boolean
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.first_seen
      description: The time the activity was first seen.
      type: Date
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.domain.last_seen
      description: The time the activity was last seen.
      type: Date
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.malicious_count
      description: Count of malicious ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.suspicious_count
      description: Count of suspicious ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.benign_count
      description: Count of benign ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.whitelisted_count
      description: Count of whitelisted ratings.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.comments_count
      description: Count of comments made.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.activity_count
      description: Count of activity.
      type: Number
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.resource_owner
      description: True if the caller is the resource owner.
      type: Boolean
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.first_seen
      description: The time the activity was first seen.
      type: Date
    - contextPath: IronDome.CorrelationParticipation.correlation_participation.ip.last_seen
      description: The time the activity was last seen.
      type: Date
    - contextPath: IronDome.CommunityComments.alert_id
      description: The alert ID associated with the community comments.
      type: String
    - contextPath: IronDome.CommunityComments.community_comments.created
      description: The time that the comment was created.
      type: Date
    - contextPath: IronDome.CommunityComments.community_comments.comment
      description: The comment text.
      type: String
    - contextPath: IronDome.CommunityComments.community_comments.dome_tags
      description: The IronDome tags related to the comment.
      type: String
    - contextPath: IronDome.CommunityComments.community_comments.enterprise
      description: True if enterprise.
      type: Boolean
    - contextPath: IronDome.CommunityComments.community_comments.self
      description: True if the comment was made by the caller.
      type: Boolean
    - contextPath: IronDome.CognitiveSystemScore.alert_id
      description: The alert ID associated with the cognitive system score.
      type: String
    - contextPath: IronDome.CognitiveSystemScore.cognitive_system_score
      description: The cognitive system score of the alert.
      type: Number
    - contextPath: IronDome.Notification.alert_id
      description: The alert ID associated with the IronDome notification.
      type: String
    - contextPath: IronDome.Notification.dome_notification.id
      description: The unique ID of the notification.
      type: String
    - contextPath: IronDome.Notification.dome_notification.category
      description: The category of Dome notification.
      type: String
    - contextPath: IronDome.Notification.dome_notification.created
      description: The category of Dome notification.
      type: Date
    - contextPath: IronDome.Notification.dome_notification.dome_tags
      description: The IronDome tags related to this notification.
      type: String
    - contextPath: IronDome.Notification.dome_notification.alert_ids
      description: The IDs of the alerts related to this notification.
      type: String
    - contextPath: IronDome.Notification.dome_notification.mismatch_details.enterprise_severities.analyst_severity
      description: The mismatched severity across correlated alerts within the enterprise.
      type: String
    - contextPath: IronDome.Notification.dome_notification.mismatch_details.enterprise_severities.count
      description: The count of mismatched severity with this analyst rating.
      type: Number
    - contextPath: IronDome.Notification.dome_notification.mismatch_details.community_severities.analyst_severity
      description: The mismatched severity across correlated alerts within the community.
      type: String
    - contextPath: IronDome.Notification.dome_notification.mismatch_details.community_severities.count
      description: The count of mismatched severity with this analyst rating.
      type: Number
    - contextPath: IronDome.Notification.dome_notification.severity_details.analyst_severity
      description: The analyst severity of the alert.
      type: String
    - contextPath: IronDome.Notification.dome_notification.comment_details.comment
      description: The comment text in the notification.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_suspicious_details.domains
      description: The list of domains correlated on a suspicious alert.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_suspicious_details.ips
      description: The list of IPs correlated on a suspicious alert.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_suspicious_details.comments
      description: The comments about this suspicious alert correlation.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_malicious_details.domains
      description: The list of domains correlated on a malicious alert.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_malicious_details.ips
      description: The list of IPs correlated on a malicious alert.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_malicious_details.comments
      description: The comments about this malicious alert correlation.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_malicious_details.generated_threat_intel_rules.ip
      description: The IP of a Threat Intelligence rule that was automatically created based on an IronDome correlation.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_malicious_details.generated_threat_intel_rules.domain
      description: The domain of a Threat Intelligence rule that was automatically created based on an IronDome correlation.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_malicious_details.generated_threat_intel_rules.rule_id
      description: The rule ID of a Threat Intelligence rule that was automatically created based on an IronDome correlation.
      type: String
    - contextPath: IronDome.Notification.dome_notification.severity_malicious_details.generated_threat_intel_rules.vue_url
      description: The IronVUE URL of a Threat Intelligence rule that was automatically created based on an IronDome correlation.
      type: String
    - contextPath: IronDome.Notification.dome_notification.high_cognitive_system_score_details.enterprise_alert_score
      description: The alert score for the enterprise.
      type: Number
    - contextPath: IronDome.Notification.dome_notification.high_cognitive_system_score_details.cognitive_system_score
      description: The cognitive system score.
      type: Number
  - arguments:
    - description: The ID of the IronDefense alert to retrieve events for.
      name: alert_id
      required: true
    - description: The limit on the number of Events to be returned.
      name: limit
    - description: The number of results to skip - used for paging the results.
      name: offset
    description: Retrieves IronDefense Events for a given Alert ID.
    name: irondefense-get-events-from-alert
    outputs:
    - contextPath: IronDefense.Event.id
      description: The event ID.
      type: String
    - contextPath: IronDefense.Event.alert_id
      description: The associated alert ID.
      type: String
    - contextPath: IronDefense.Event.category
      description: The event category.
      type: String
    - contextPath: IronDefense.Event.sub_category
      description: The event sub category.
      type: String
    - contextPath: IronDefense.Event.severity
      description: The event severity (0-1000).
      type: Number
    - contextPath: IronDefense.Event.confidence
      description: The event confidence (real number between 0-1).
      type: Number
    - contextPath: IronDefense.Event.created
      description: Time the event was created.
      type: Date
    - contextPath: IronDefense.Event.updated
      description: Time the event was last updated.
      type: Date
    - contextPath: IronDefense.Event.start_time
      description: The start time of this event's activity.
      type: Date
    - contextPath: IronDefense.Event.end_time
      description: The end time of this event's activity.
      type: Date
    - contextPath: IronDefense.Event.iron_dome_shared_time
      description: The time when the event was sent to IronDome - not present if not shared with irondome.
      type: Date
    - contextPath: IronDefense.Event.is_whitelisted
      description: True if the event activity was whitelisted, false otherwise.
      type: Boolean
    - contextPath: IronDefense.Event.is_blacklisted
      description: True if the event activity was blacklisted, false otherwise.
      type: Boolean
    - contextPath: IronDefense.Event.src_ip
      description: The source IP associated with this event.
      type: String
    - contextPath: IronDefense.Event.dst_ip
      description: The destination IP associated with this event.
      type: String
    - contextPath: IronDefense.Event.dst_port
      description: The destination port associated with this event.
      type: Number
    - contextPath: IronDefense.Event.app_domains
      description: Any domains associated with this event.
      type: String
    - contextPath: IronDefense.Event.primary_app_protocol
      description: The primary application protocol associated with this event.
      type: String
    - contextPath: IronDefense.Event.secondary_app_protocol
      description: The secondary application protocol associated with this event.
      type: String
    - contextPath: IronDefense.Event.bytes_in
      description: The byte count of incoming traffic for this event.
      type: Number
    - contextPath: IronDefense.Event.bytes_out
      description: The byte count of outgoing traffic for this event.
      type: Number
    - contextPath: IronDefense.Event.total_bytes
      description: The byte count of the total traffic (in either direction) for this event.
      type: Number
    - contextPath: IronDefense.Event.url
      description: The related URL for this event, if applicable.
      type: String
    - contextPath: IronDefense.Event.raw_data_formats
      description: The list of distinct raw data formats for this event.
      type: String
    - contextPath: IronDefense.Event.src_entity_attribute
      description: The source entity attribute related to this event, if one could be determined.
      type: String
    - contextPath: IronDefense.Event.src_entity_attribute_type
      description: The source entity attribute type related to this event, if one could be determined.
      type: String
    - contextPath: IronDefense.Event.dst_entity_attribute
      description: The destination entity attribute related to this event, if one could be determined.
      type: String
    - contextPath: IronDefense.Event.dst_entity_attribute_type
      description: The destination entity attribute type related to this event, if one could be determined.
      type: String
    - contextPath: IronDefense.Event.vue_url
      description: The url for displaying the event within IronVUE.
      type: String
    - contextPath: IronDefense.Query.GetEvents.limit
      description: The maximum number of results that were requested to be returned.
      type: Number
    - contextPath: IronDefense.Query.GetEvents.offset
      description: The number of results that were skipped - used for paging the results.
      type: Number
    - contextPath: IronDefense.Query.GetEvents.total
      description: The total number of results possible from the query.
      type: Number
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 5.0.0
defaultclassifier: IronDefense
defaultmapperin: IronDefense-mapper