KOI

KOI is an endpoint security platform that provides visibility and control over browser extensions, SaaS applications, and web-based threats.

Endpoint · KOI

Configuration parameters

  • url — Server URL (required)
  • api_key — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetchEvents — Fetch events
  • event_types_to_fetch — Fetch event types (required)
  • audit_types_filter — Audit log type filter
  • max_fetch — Maximum number of events per fetch
  • eventFetchInterval — Events Fetch Interval

Commands (13)

  • koi-allowlist-get

    Retrieves all items in the allowlist.

  • koi-allowlist-items-add

    Adds one or more items to the global allowlist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk addition from a JSON file.

  • koi-allowlist-items-remove

    Removes one or more items from the global allowlist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk removal from a JSON file.

  • koi-blocklist-get

    Retrieves all items in the blocklist.

  • koi-blocklist-items-add

    Adds one or more items to the global blocklist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk addition from a JSON file.

  • koi-blocklist-items-remove

    Removes one or more items from the global blocklist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk removal from a JSON file.

  • koi-get-events

    Gets events from KOI. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.

  • koi-inventory-item-endpoints-list

    Retrieves a paginated list of endpoints that have a specific item installed.

  • koi-inventory-item-get

    Retrieves comprehensive details for a specific software item, extension, or package using its unique identifier, marketplace, and version.

  • koi-inventory-list

    Retrieves a paginated list of items installed across your organization's endpoints. Supports extensive filtering by marketplace, platform, risk level, publisher, and specific categories.

  • koi-inventory-search

    Searches inventory items using advanced query builder filters. Provide a filter via 'filter_json' (inline JSON string) or 'filter_raw_json_entry_id' (War Room file entry ID). At least one filter source must be provided.

  • koi-policy-list

    Retrieves a list of all policies. Use 'page' and 'page_size' to fetch a specific page, or use 'limit' to auto-paginate and collect up to the specified number of policies. If 'page' is provided, 'limit' is ignored.

  • koi-policy-status-update

    Enables or disables a policy by ID.