KOI

KOI is an endpoint security platform that provides visibility and control over browser extensions, SaaS applications, and web-based threats.

Endpoint · KOI

Details

IDKOI
ProviderKOI
CategoryEndpoint
From Version6.10.0
Docker Imagedemisto/fastapi:0.125.0.10158186

README

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

koi-get-events

Gets events from KOI. This command is used for developing/debugging. Use with caution, as it can create events, leading to event duplication and exceeding API request limitations.

Base Command

koi-get-events

Input

Argument Name Description Required
event_type The type of events to retrieve. If not specified, uses the value configured in the integration parameters. Possible values are: Alerts, Audit. Default is Alerts,Audit. Optional
limit The maximum number of events to return per type. Default is 50. Optional
start_time Filter events created at or after this time. Supports ISO 8601 format or relative time expressions (e.g., “3 days ago”, “2024-01-01T00:00:00Z”). Optional
end_time Filter events created at or before this time. Supports ISO 8601 format or relative time expressions (e.g., “now”, “2024-01-01T00:00:00Z”). Optional
should_push_events The flag that indicates whether to push events to Cortex XSIAM. Pushing events is supported on Cortex XSIAM only. When set to false, or on non-XSIAM platforms, events are displayed without being pushed. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
KOI.Event.id String The unique identifier of the event.
KOI.Event.source_log_type String The source log type of the event (Alerts or Audit).
KOI.Event._time Date The timestamp of the event in ISO 8601 format.
KOI.Event.created_at Date The creation time of the event (audit logs).

Human Readable Output

KOI Events

id source_log_type _time severity status
alert-001 Alerts 2024-01-01T00:00:00Z high open
audit-001 Audit 2024-01-01T00:00:00Z    

koi-blocklist-get

Retrieves all items in the blocklist.

Base Command

koi-blocklist-get

Input

There are no input arguments for this command.

Context Output

Path Type Description
Koi.Blocklist.item_id String The unique identifier of the blocklist item.
Koi.Blocklist.item_name String The name of the blocklist item.
Koi.Blocklist.item_display_name String The display name of the blocklist item.
Koi.Blocklist.marketplace String The marketplace of the blocklist item (e.g., vscode).
Koi.Blocklist.publisher_name String The publisher name of the blocklist item.
Koi.Blocklist.package_name String The package name of the blocklist item.
Koi.Blocklist.notes String Notes associated with the blocklist item.
Koi.Blocklist.created_by String The user who created the blocklist item.
Koi.Blocklist.created_at Date The creation time of the blocklist item in ISO 8601 format.

Command example

!koi-blocklist-get

Human Readable Output

KOI Blocklist

Item Id Item Name Item Display Name Marketplace Publisher Name Package Name Notes Created By Created At
mal-001 Bad Extension Malicious Extension chrome_web_store Suspicious Publisher bad-package Known malware distribution security@example.com 2025-05-01T09:15:00.000Z
mal-002 Risky Plugin Risky Plugin vscode Unknown Publisher risky-plugin Data exfiltration risk admin@example.com 2025-05-02T14:30:00.000Z

koi-allowlist-get

Retrieves all items in the allowlist.

Base Command

koi-allowlist-get

Input

There are no input arguments for this command.

Context Output

Path Type Description
Koi.Allowlist.item_id String The unique identifier of the allowlist item.
Koi.Allowlist.item_name String The name of the allowlist item.
Koi.Allowlist.item_display_name String The display name of the allowlist item.
Koi.Allowlist.marketplace String The marketplace of the allowlist item (e.g., vscode).
Koi.Allowlist.publisher_name String The publisher name of the allowlist item.
Koi.Allowlist.package_name String The package name of the allowlist item.
Koi.Allowlist.notes String Notes associated with the allowlist item.
Koi.Allowlist.created_by String The user who created the allowlist item.
Koi.Allowlist.created_at Date The creation time of the allowlist item in ISO 8601 format.

Command example

!koi-allowlist-get

Human Readable Output

KOI Allowlist

Item Id Item Name Item Display Name Marketplace Publisher Name Package Name Notes Created By Created At
ext-123 My Extension My Extension Display Name vscode My Publisher my-package Approved for development purposes admin@example.com 2025-04-23T17:22:24.023Z
ext-456 Another Ext Another Extension chrome Another Publisher another-package Approved by security team user@example.com 2025-04-24T10:00:00.000Z

koi-inventory-search

Searches inventory items using advanced query builder filters. Provide a filter via the ‘filter_json’ argument (inline JSON string) or the ‘filter_raw_json_entry_id’ argument (War Room file entry ID). At least one filter source must be provided.

Base Command

koi-inventory-search

Input

Argument Name Description Required
filter_json Advanced filter using query builder syntax as a JSON string. Either the ‘filter_json’ or the ‘filter_raw_json_entry_id’ argument must be provided. Optional
filter_raw_json_entry_id War Room entry ID of a JSON file containing the filter object. Takes priority over the ‘filter_json’ argument when both are provided. Optional
page Page number for pagination (1-based). When provided, fetches a single page and ignores the ‘limit’ argument. Optional
page_size Number of results per page (default: 50, max: 500). Used in single-page mode with the ‘page’ argument. Optional
limit Maximum total number of inventory items to return (default: 50, max: 1000). When provided without the ‘page’ argument, auto-paginates to collect up to this many items. Default is 50. Optional
sort_by Column to sort by. Possible values are: first_seen, last_seen, item_display_name, item_id, version, marketplace, endpoint_count, risk, risk_level, status, installs_count, released_at, publisher_name. Default is first_seen. Optional
sort_direction Sort direction. Possible values are: asc, desc. Default is desc. Optional

Context Output

Path Type Description
Koi.Inventory.item_id String The unique identifier of the inventory item.
Koi.Inventory.item_display_name String The display name of the inventory item.
Koi.Inventory.marketplace String The marketplace source of the item.
Koi.Inventory.platforms Unknown List of platforms where the item is installed.
Koi.Inventory.publisher_name String The publisher name of the item.
Koi.Inventory.risk Number The numeric risk score of the item.
Koi.Inventory.risk_level String The risk level classification of the item.
Koi.Inventory.version String The version of the item.
Koi.Inventory.status String The governance status of the item.
Koi.Inventory.endpoint_count Number The number of endpoints where the item is installed.
Koi.Inventory.installs_count Number The total number of installs for the item.
Koi.Inventory.first_seen Date The date the item was first seen in ISO 8601 format.
Koi.Inventory.last_seen Date The date the item was last seen in ISO 8601 format.
Koi.Inventory.last_used Date The date the item was last used in ISO 8601 format.
Koi.Inventory.installation_method String The method used to install the item.
Koi.Inventory.short_description String A short description of the item.
Koi.Inventory.is_first_party Boolean Whether the item is a first-party item.
Koi.Inventory.is_signed Boolean Whether the item is signed.
Koi.Inventory.categories Unknown List of categories the item belongs to.
Koi.Inventory.findings Unknown List of findings associated with the item.
Koi.Inventory.governed_details Unknown Governance policy details for the item.
Koi.Inventory.released_at Date The release date of the item. Format: YYYY-MM-DD (e.g., 2023-01-15).
Koi.Inventory.brew_category_koi String The Homebrew package category (Koi classification).
Koi.Inventory.browser_category_koi String The browser extension category (Koi classification).
Koi.Inventory.chocolatey_category_koi String The Chocolatey package category (Koi classification).
Koi.Inventory.ide_category_koi String The IDE extension category (Koi classification).
Koi.Inventory.software_category_koi String The software category (Koi classification).

Command example

!koi-inventory-search filter_json="{\"field\":\"risk_level\",\"operator\":\"eq\",\"value\":\"high\"}" limit=50

Human Readable Output

KOI Inventory Search

Item Id Item Display Name Marketplace Platforms Publisher Name Risk Risk Level Version Status Endpoint Count Installs Count Installation Method Is First Party Is Signed First Seen Last Seen Last Used Released At Short Description Categories Findings
abc123 React Developer Tools chrome_web_store chrome, edge Meta 5 high 1.0.0 APPROVED 42 1000000 marketplace false true 2024-01-01T10:00:00Z 2024-10-15T10:00:00Z 2025-06-15T10:00:00Z 2023-01-15 React debugging tools Developer Tools malware, permissions

koi-policy-list

Retrieves a list of all policies. Use the ‘page’ and ‘page_size’ arguments to fetch a specific page, or use the ‘limit’ argument to auto-paginate and collect up to the specified number of policies. If the ‘page’ argument is provided, the ‘limit’ argument is ignored.

Base Command

koi-policy-list

Input

Argument Name Description Required
page Page number for pagination (1-based). When provided, fetches a single page and ignores the ‘limit’ argument. Optional
page_size Number of results per page (default: 50, max: 500). Used only in single-page mode together with the ‘page’ argument. Optional
limit Maximum total number of policies to return (default: 50, max: 1000). When provided without the ‘page’ argument, auto-paginates to collect up to this many policies. Default is 50. Optional

Context Output

Path Type Description
Koi.Policy.id Number The unique identifier of the policy.
Koi.Policy.name String The name of the policy.
Koi.Policy.description String The description of the policy.
Koi.Policy.action String The action taken by the policy (e.g., block).
Koi.Policy.enabled Boolean Whether the policy is enabled.
Koi.Policy.group_ids Unknown List of group IDs associated with the policy.
Koi.Policy.creator_fullname String The full name of the policy creator.
Koi.Policy.created_at Date The creation time of the policy in ISO 8601 format.
Koi.Policy.updated_at Date The last update time of the policy in ISO 8601 format.

Command example

!koi-policy-list limit=50

Human Readable Output

KOI Policies

Id Name Description Action Enabled Group Ids Creator Fullname Created At Updated At
1 My Policy This policy blocks high-risk extensions block true 1, 2, 3 John Doe 2025-04-23T17:22:24.023Z 2025-04-23T17:22:24.023Z
2 Allow Policy This policy allows approved extensions allow false 4 Jane Smith 2025-04-24T10:00:00.000Z 2025-04-24T12:30:00.000Z

koi-inventory-item-get

Retrieves comprehensive details for a specific software item, extension, or package using its unique identifier, marketplace, and version.

Base Command

koi-inventory-item-get

Input

Argument Name Description Required
item_id Unique identifier for the item. Required
marketplace The marketplace where the item is hosted. Possible values are: chocolatey, chrome_web_store, claude_desktop_extensions, cursor, docker, edge_add_ons, firefox_add_ons, github_mcp_registry, homebrew, hugging_face, jetbrains, linux, mac, notepad++, npm, office_add_ins, open_vsx_registry, pypi, visual_studio, vscode, windows, windsurf. Required
version The specific version of the item to retrieve. Required

Context Output

Path Type Description
Koi.Inventory.item_id String The unique identifier of the inventory item.
Koi.Inventory.item_display_name String The display name of the inventory item.
Koi.Inventory.marketplace String The marketplace source of the item.
Koi.Inventory.platforms Unknown List of platforms where the item is installed.
Koi.Inventory.publisher_name String The publisher name of the item.
Koi.Inventory.risk Number The numeric risk score of the item.
Koi.Inventory.risk_level String The risk level classification of the item.
Koi.Inventory.version String The version of the item.
Koi.Inventory.status String The governance status of the item.
Koi.Inventory.endpoint_count Number The number of endpoints where the item is installed.
Koi.Inventory.installs_count Number The total number of installs for the item.
Koi.Inventory.installation_method String The method used to install the item.
Koi.Inventory.is_first_party Boolean Whether the item is a first-party item.
Koi.Inventory.is_signed Boolean Whether the item is signed.
Koi.Inventory.first_seen Date The date the item was first seen in ISO 8601 format.
Koi.Inventory.last_seen Date The date the item was last seen in ISO 8601 format.
Koi.Inventory.last_used Date The date the item was last used in ISO 8601 format.
Koi.Inventory.released_at Date The release date of the item. Format: YYYY-MM-DD (e.g., 2023-01-15).
Koi.Inventory.short_description String A short description of the item.
Koi.Inventory.categories Unknown List of categories the item belongs to.
Koi.Inventory.findings Unknown List of findings associated with the item including severity and evidence.
Koi.Inventory.governed_details Unknown Governance policy details for the item.
Koi.Inventory.brew_category_koi String The Homebrew package category (Koi classification).
Koi.Inventory.browser_category_koi String The browser extension category (Koi classification).
Koi.Inventory.chocolatey_category_koi String The Chocolatey package category (Koi classification).
Koi.Inventory.ide_category_koi String The IDE extension category (Koi classification).
Koi.Inventory.software_category_koi String The software category (Koi classification).

Command example

!koi-inventory-item-get item_id=example-extension marketplace=vscode

Human Readable Output

KOI Inventory Item

Item Id Item Display Name Marketplace Platforms Publisher Name Risk Risk Level Version Status Endpoint Count Installs Count Installation Method Is First Party Is Signed First Seen Last Seen Last Used Released At Short Description Categories Findings
abc123 React Developer Tools chrome_web_store chrome, edge Meta 5 high 1.0.0 Allowed 42 1000000 marketplace false true 2024-01-01T10:00:00Z 2024-10-15T10:00:00Z 2025-06-15T10:00:00Z 2023-01-15 React debugging tools Developer Tools {‘description’: ‘This item contains malware’, ‘evidence’: {}, ‘finding_id’: ‘malware_detected’, ‘finding_name’: ‘Malware Detected’, ‘severity’: ‘critical’}

koi-blocklist-items-add

Adds one or more items to the global blocklist. Provide either the ‘item_id’ and ‘marketplace’ arguments for a single item, or the ‘items_list_raw_json_entry_id’ argument for bulk addition from a JSON file.

Base Command

koi-blocklist-items-add

Input

Argument Name Description Required
item_id The ID of the item to add to the blocklist. Required when not using the ‘items_list_raw_json_entry_id’ argument. Optional
marketplace The source marketplace of the item. Required when not using the ‘items_list_raw_json_entry_id’ argument. Possible values are: chocolatey, chrome_web_store, claude_desktop_extensions, cursor, docker, edge_add_ons, firefox_add_ons, github_mcp_registry, homebrew, hugging_face, jetbrains, linux, mac, notepad++, npm, office_add_ins, open_vsx_registry, pypi, visual_studio, vscode, windows, windsurf. Optional
created_by Email of the user who created this entry. Optional
notes Additional notes or justification for blocking the item. Optional
items_list_raw_json_entry_id War Room entry ID of a JSON file containing a list of items to add. Each item must have “item_id” and “marketplace” fields. Optional fields: “created_by”, “notes”. When provided, the ‘item_id’ and ‘marketplace’ arguments are ignored. Optional

Context Output

There is no context output for this command.

Command example

!koi-blocklist-items-add item_id=malicious-ext marketplace=chrome_web_store notes="Blocked due to security risk"

Human Readable Output

Blocklist item ‘malicious-ext’ (marketplace: chrome_web_store) was added successfully.

koi-policy-status-update

Enables or disables a policy by ID.

Base Command

koi-policy-status-update

Input

Argument Name Description Required
policy_id The ID of the policy to update. Required
enabled Whether to enable (true) or disable (false) the policy. Possible values are: true, false. Required

Context Output

Path Type Description
Koi.Policy.id Number The unique identifier of the policy.
Koi.Policy.name String The name of the policy.
Koi.Policy.description String The description of the policy.
Koi.Policy.action String The action taken by the policy (e.g., block).
Koi.Policy.enabled Boolean Whether the policy is enabled.
Koi.Policy.group_ids Unknown List of group IDs associated with the policy.
Koi.Policy.creator_fullname String The full name of the policy creator.
Koi.Policy.created_at Date The creation time of the policy in ISO 8601 format.
Koi.Policy.updated_at Date The last update time of the policy in ISO 8601 format.

Command example

!koi-policy-status-update policy_id=1 enabled=true

Human Readable Output

KOI Policy Updated

Id Name Description Action Enabled Group Ids Creator Fullname Created At Updated At
1 My Policy This policy blocks high-risk extensions block true 1, 2, 3 John Doe 2025-04-23T17:22:24.023Z 2025-04-23T17:22:24.023Z

koi-inventory-list

Retrieves a paginated list of items installed across your organization’s endpoints. Supports extensive filtering by marketplace, platform, risk level, publisher, and specific categories.

Base Command

koi-inventory-list

Input

Argument Name Description Required
page Page number for pagination (1-based). When provided, fetches a single page and ignores the ‘limit’ argument. Optional
page_size Number of results per page (default: 50, max: 500). Used in single-page mode with the ‘page’ argument. Optional
limit Maximum total number of inventory items to return (default: 50, max: 1000). When provided without the ‘page’ argument, auto-paginates to collect up to this many items. Default is 50. Optional
brew_category_koi Filter by Homebrew package category (Koi classification). Optional
browser_category_koi Filter by browser extension category (Koi classification). Optional
chocolatey_category_koi Filter by Chocolatey package category (Koi classification). Optional
device_id Filter devices by device ID. Optional
finding_id Filter devices by finding ID. Optional
first_seen Filter by first seen date (items first seen on or after this date). ISO 8601 format (e.g., “2024-01-01T00:00:00Z”). Optional
ide_category_koi Filter by IDE extension category (Koi classification). Optional
installation_method Filter by installation method. Possible values are: marketplace, manual, built_in, side_loaded. Optional
item_display_name Filter by item display name. Performs case-insensitive partial match. Optional
item_id Filter by item ID. Optional
marketplace Filter by marketplace. Possible values are: chocolatey, chrome_web_store, claude_desktop_extensions, cursor, docker, edge_add_ons, firefox_add_ons, github_mcp_registry, homebrew, hugging_face, jetbrains, linux, mac, notepad++, npm, office_add_ins, open_vsx_registry, pypi, visual_studio, vscode, windows, windsurf. Optional
platform Filter by platform. Possible values are: antigravity, aqua, arc, brave, brew, chatgpt_atlas, chocolatey, chrome, chromium, claude, clion, codex, comet, cursor, datagrip, dataspell, dia, edge, excel, firefox, fleet, goland, hugging_face, intellij_community, intellij, kiro, mac, npm, notepad++, opera, outlook, phpstorm, powerpoint, prisma_access_browser, pycharm, pypi, rider, rubymine, rustrover, vscode, webstorm, windsurf, word, windows, writerside. Optional
publisher_name Filter by publisher name. Performs case-insensitive partial match. Optional
risk_level Filter by risk level. Possible values are: low, medium, high, critical, pending. Optional
software_category_koi Filter by software category (Koi classification). Optional
sort_by Column to sort by. Possible values are: first_seen, last_seen, item_display_name, item_id, version, marketplace, endpoint_count, risk, risk_level, status, installs_count, released_at, publisher_name. Default is first_seen. Optional
sort_direction Sort direction. Possible values are: asc, desc. Optional
view Filter by predefined view (marketplace group). Possible values are: agentic_ai, ai_models, code_packages, extensions, os_packages, software. Optional

Context Output

Path Type Description
Koi.Inventory.item_id String The unique identifier of the inventory item.
Koi.Inventory.item_display_name String The display name of the inventory item.
Koi.Inventory.marketplace String The marketplace source of the item.
Koi.Inventory.platforms Unknown List of platforms where the item is installed.
Koi.Inventory.publisher_name String The publisher name of the item.
Koi.Inventory.risk Number The numeric risk score of the item.
Koi.Inventory.risk_level String The risk level classification of the item.
Koi.Inventory.version String The version of the item.
Koi.Inventory.status String The governance status of the item.
Koi.Inventory.endpoint_count Number The number of endpoints where the item is installed.
Koi.Inventory.installs_count Number The total number of installs for the item.
Koi.Inventory.first_seen Date The date the item was first seen in ISO 8601 format.
Koi.Inventory.last_seen Date The date the item was last seen in ISO 8601 format.
Koi.Inventory.last_used Date The date the item was last used in ISO 8601 format.
Koi.Inventory.installation_method String The method used to install the item.
Koi.Inventory.short_description String A short description of the item.
Koi.Inventory.is_first_party Boolean Whether the item is a first-party item.
Koi.Inventory.is_signed Boolean Whether the item is signed.
Koi.Inventory.categories Unknown List of categories the item belongs to.
Koi.Inventory.findings Unknown List of findings associated with the item.
Koi.Inventory.governed_details Unknown Governance policy details for the item.
Koi.Inventory.released_at Date The release date of the item. Format: YYYY-MM-DD (e.g., 2023-01-15).
Koi.Inventory.brew_category_koi String The Homebrew package category (Koi classification).
Koi.Inventory.browser_category_koi String The browser extension category (Koi classification).
Koi.Inventory.chocolatey_category_koi String The Chocolatey package category (Koi classification).
Koi.Inventory.ide_category_koi String The IDE extension category (Koi classification).
Koi.Inventory.software_category_koi String The software category (Koi classification).

Command example

!koi-inventory-list limit=50 marketplace=vscode sort_by=first_seen sort_direction=desc

Human Readable Output

KOI Inventory

Item Id Item Display Name Marketplace Platforms Publisher Name Risk Risk Level Version Status Endpoint Count Installs Count Installation Method Is First Party Is Signed First Seen Last Seen Last Used Released At Short Description Categories Findings
abc123 React Developer Tools chrome_web_store chrome, edge Meta 5 high 1.0.0 APPROVED 42 1000000 marketplace false true 2024-01-01T10:00:00Z 2024-10-15T10:00:00Z 2025-06-15T10:00:00Z 2023-01-15 React debugging tools Developer Tools malware, permissions
def456 Prettier - Code formatter vscode vscode Prettier 2 low 10.1.0 APPROVED 15 500000 manual true true 2024-03-10T08:30:00Z 2024-11-01T14:00:00Z   2022-06-01 Code formatter using prettier Productivity  

koi-inventory-item-endpoints-list

Retrieves a paginated list of endpoints that have a specific item installed.

Base Command

koi-inventory-item-endpoints-list

Input

Argument Name Description Required
item_id Unique identifier for the item. Required
marketplace The marketplace where the item is hosted. Possible values are: chocolatey, chrome_web_store, claude_desktop_extensions, cursor, docker, edge_add_ons, firefox_add_ons, github_mcp_registry, homebrew, hugging_face, jetbrains, linux, mac, notepad++, npm, office_add_ins, open_vsx_registry, pypi, visual_studio, vscode, windows, windsurf. Required
version The specific version of the item. Required
page Page number for pagination (1-based). When provided, fetches a single page and ignores the ‘limit’ argument. Optional
page_size Number of results per page (default: 50, max: 500). Used in single-page mode with the ‘page’ argument. Optional
limit Maximum total number of endpoints to return (default: 50, max: 1000). When provided without the ‘page’ argument, auto-paginates to collect up to this many endpoints. Default is 50. Optional

Context Output

Path Type Description
Koi.Inventory.Endpoint.id String The unique identifier of the endpoint device.
Koi.Inventory.Endpoint.hostname String The hostname of the endpoint.
Koi.Inventory.Endpoint.os String The operating system of the endpoint.
Koi.Inventory.Endpoint.platform String The platform where the item is installed on this endpoint.
Koi.Inventory.Endpoint.serial String The serial number of the endpoint device.
Koi.Inventory.Endpoint.last_logged_on_user String The last logged on user of the endpoint.
Koi.Inventory.Endpoint.activation_status String The activation status of the endpoint.
Koi.Inventory.Endpoint.path String The installation path of the item on the endpoint.
Koi.Inventory.Endpoint.first_seen Date The date the item was first seen on this endpoint in ISO 8601 format.
Koi.Inventory.Endpoint.last_seen Date The date the item was last seen on this endpoint in ISO 8601 format.

Command example

!koi-inventory-item-endpoints-list item_id=example-extension marketplace=vscode limit=50

Human Readable Output

KOI Inventory Item Endpoints

Id Hostname Os Platform Serial Last Logged On User Activation Status Path First Seen Last Seen
device-123 laptop-01 windows chrome ABC123XYZ john.doe enabled /Applications/Google Chrome.app/Contents/Extensions/abc123 2024-01-01T10:00:00Z 2024-10-15T10:00:00Z
device-456 desktop-02 macos chrome DEF456UVW jane.smith enabled /Users/jane/Library/Application Support/Google/Chrome/Extensions/abc123 2024-02-15T08:30:00Z 2024-11-01T14:00:00Z

koi-blocklist-items-remove

Removes one or more items from the global blocklist. Provide either the ‘item_id’ and ‘marketplace’ arguments for a single item, or the ‘items_list_raw_json_entry_id’ argument for bulk removal from a JSON file.

Base Command

koi-blocklist-items-remove

Input

Argument Name Description Required
item_id The ID of the item to remove from the blocklist. Required when not using the ‘items_list_raw_json_entry_id’ argument. Optional
marketplace The source marketplace of the item. Required when not using the ‘items_list_raw_json_entry_id’ argument. Possible values are: chocolatey, chrome_web_store, claude_desktop_extensions, cursor, docker, edge_add_ons, firefox_add_ons, github_mcp_registry, homebrew, hugging_face, jetbrains, linux, mac, notepad++, npm, office_add_ins, open_vsx_registry, pypi, visual_studio, vscode, windows, windsurf. Optional
created_by Email of the user who created this entry. Optional
notes Additional notes about the removal. Optional
items_list_raw_json_entry_id War Room entry ID of a JSON file containing a list of items to remove. Each item must have “item_id” and “marketplace” fields. Optional fields: “created_by”, “notes”. When provided, the ‘item_id’ and ‘marketplace’ arguments are ignored. Optional

Context Output

There is no context output for this command.

Command example

!koi-blocklist-items-remove item_id=malicious-ext marketplace=chrome_web_store

Human Readable Output

Blocklist item ‘malicious-ext’ (marketplace: chrome_web_store) was removed successfully.

koi-allowlist-items-remove

Removes one or more items from the global allowlist. Provide either the ‘item_id’ and ‘marketplace’ arguments for a single item, or the ‘items_list_raw_json_entry_id’ argument for bulk removal from a JSON file.

Base Command

koi-allowlist-items-remove

Input

Argument Name Description Required
item_id The ID of the item to remove from the allowlist. Required when not using the ‘items_list_raw_json_entry_id’ argument. Optional
marketplace The source marketplace of the item. Required when not using the ‘items_list_raw_json_entry_id’ argument. Possible values are: chocolatey, chrome_web_store, claude_desktop_extensions, cursor, docker, edge_add_ons, firefox_add_ons, github_mcp_registry, homebrew, hugging_face, jetbrains, linux, mac, notepad++, npm, office_add_ins, open_vsx_registry, pypi, visual_studio, vscode, windows, windsurf. Optional
created_by Email of the user who created this entry. Optional
notes Additional notes about the removal. Optional
items_list_raw_json_entry_id War Room entry ID of a JSON file containing a list of items to remove. Each item must have “item_id” and “marketplace” fields. Optional fields: “created_by”, “notes”. When provided, the ‘item_id’ and ‘marketplace’ arguments are ignored. Optional

Context Output

There is no context output for this command.

Command example

!koi-allowlist-items-remove item_id=example-extension marketplace=vscode

Human Readable Output

Allowlist item ‘example-extension’ (marketplace: vscode) was removed successfully.

koi-allowlist-items-add

Adds one or more items to the global allowlist. Provide either the ‘item_id’ and ‘marketplace’ arguments for a single item, or the ‘items_list_raw_json_entry_id’ argument for bulk addition from a JSON file.

Base Command

koi-allowlist-items-add

Input

Argument Name Description Required
item_id The ID of the item to add to the allowlist. Required when not using the ‘items_list_raw_json_entry_id’ argument. Optional
marketplace The source marketplace of the item. Required when not using the ‘items_list_raw_json_entry_id’ argument. Possible values are: chocolatey, chrome_web_store, claude_desktop_extensions, cursor, docker, edge_add_ons, firefox_add_ons, github_mcp_registry, homebrew, hugging_face, jetbrains, linux, mac, notepad++, npm, office_add_ins, open_vsx_registry, pypi, visual_studio, vscode, windows, windsurf. Optional
created_by Email of the user who created this entry. Optional
notes Additional notes about the entry. Optional
items_list_raw_json_entry_id War Room entry ID of a JSON file containing a list of items to add. Each item must have “item_id” and “marketplace” fields. Optional fields: “created_by”, “notes”. When provided, the ‘item_id’ and ‘marketplace’ arguments are ignored. Optional

Context Output

There is no context output for this command.

Command example

!koi-allowlist-items-add item_id=example-extension marketplace=vscode notes="Approved by security team"

Human Readable Output

Allowlist item ‘example-extension’ (marketplace: vscode) was added successfully.

Configuration parameters

  • url — Server URL (required)
  • api_key — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetchEvents — Fetch events
  • event_types_to_fetch — Fetch event types (required)
  • audit_types_filter — Audit log type filter
  • max_fetch — Maximum number of events per fetch
  • eventFetchInterval — Events Fetch Interval

Commands (13)

  • koi-allowlist-get

    Retrieves all items in the allowlist.

  • koi-allowlist-items-add

    Adds one or more items to the global allowlist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk addition from a JSON file.

  • koi-allowlist-items-remove

    Removes one or more items from the global allowlist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk removal from a JSON file.

  • koi-blocklist-get

    Retrieves all items in the blocklist.

  • koi-blocklist-items-add

    Adds one or more items to the global blocklist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk addition from a JSON file.

  • koi-blocklist-items-remove

    Removes one or more items from the global blocklist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk removal from a JSON file.

  • koi-get-events

    Gets events from KOI. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.

  • koi-inventory-item-endpoints-list

    Retrieves a paginated list of endpoints that have a specific item installed.

  • koi-inventory-item-get

    Retrieves comprehensive details for a specific software item, extension, or package using its unique identifier, marketplace, and version.

  • koi-inventory-list

    Retrieves a paginated list of items installed across your organization's endpoints. Supports extensive filtering by marketplace, platform, risk level, publisher, and specific categories.

  • koi-inventory-search

    Searches inventory items using advanced query builder filters. Provide a filter via 'filter_json' (inline JSON string) or 'filter_raw_json_entry_id' (War Room file entry ID). At least one filter source must be provided.

  • koi-policy-list

    Retrieves a list of all policies. Use 'page' and 'page_size' to fetch a specific page, or use 'limit' to auto-paginate and collect up to the specified number of policies. If 'page' is provided, 'limit' is ignored.

  • koi-policy-status-update

    Enables or disables a policy by ID.

Source

Koi.py Koi_test.py Koi.yml Koi_description.md command_examples.txt
Download History Raw 
category: Endpoint
provider: KOI
sectionorder:
- Connect
- Collect
commonfields:
  id: KOI
  version: -1
configuration:
- name: url
  display: Server URL
  required: true
  defaultvalue: https://api.prod.koi.security/
  type: 0
  additionalinfo: 'The KOI API server URL.'
  section: Connect
- name: api_key
  display: API Key
  required: true
  type: 14
  additionalinfo: 'The API key for authenticating with the KOI API. See the help section for instructions on creating an API key.'
  section: Connect
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  additionalinfo:
  section: Connect
  advanced: true
  required: false
- name: proxy
  display: Use system proxy settings
  type: 8
  additionalinfo:
  section: Connect
  advanced: true
  required: false
- name: isFetchEvents
  display: Fetch events
  type: 8
  section: Collect
  required: false
  hidden:
  - xsoar
- name: event_types_to_fetch
  display: Fetch event types
  required: true
  defaultvalue: Alerts,Audit
  type: 16
  options:
  - Alerts
  - Audit
  additionalinfo: 'Select which event types to fetch from KOI.'
  section: Collect
  hidden:
  - xsoar
- name: audit_types_filter
  display: Audit log type filter
  required: false
  type: 16
  options:
  - approval_requests
  - devices
  - endpoints
  - extensions
  - firewall
  - guardrails
  - notifications
  - policies
  - remediation
  - requests
  - settings
  - vetting
  additionalinfo: 'Filter audit logs by type(s). If not specified, all audit log types will be fetched.'
  section: Collect
  hidden:
  - xsoar
- name: max_fetch
  display: Maximum number of events per fetch
  type: 0
  defaultvalue: '5000'
  additionalinfo: 'Maximum number of events to fetch per type per fetch cycle (default: 5000).'
  section: Collect
  required: false
  hidden:
  - xsoar
- defaultvalue: 1
  display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
  hidden:
  - xsoar
description: KOI is an endpoint security platform that provides visibility and control over browser extensions, SaaS applications, and web-based threats.
display: KOI
name: KOI
script:
  commands:
  - name: koi-get-events
    description: Gets events from KOI. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    arguments:
    - name: event_type
      description: 'The type of events to retrieve. If not specified, uses the value configured in the integration parameters.'
      auto: PREDEFINED
      defaultValue: 'Alerts,Audit'
      predefined:
      - 'Alerts'
      - 'Audit'
      isArray: true
    - name: limit
      description: The maximum number of events to return per type.
      defaultValue: '50'
    - name: start_time
      description: 'Filter events created at or after this time. Supports ISO 8601 format or relative time expressions (e.g., "3 days ago", "2024-01-01T00:00:00Z").'
    - name: end_time
      description: 'Filter events created at or before this time. Supports ISO 8601 format or relative time expressions (e.g., "now", "2024-01-01T00:00:00Z").'
    - name: should_push_events
      auto: PREDEFINED
      defaultValue: 'false'
      description: The flag that indicates whether to push events to Cortex XSIAM. Pushing events is supported on Cortex XSIAM only. When set to false, or on non-XSIAM platforms, events are displayed without being pushed.
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: KOI.Event.id
      description: The unique identifier of the event.
      type: String
    - contextPath: KOI.Event.source_log_type
      description: The source log type of the event (Alerts or Audit).
      type: String
    - contextPath: KOI.Event._time
      description: The timestamp of the event in ISO 8601 format.
      type: Date
    - contextPath: KOI.Event.created_at
      description: The creation time of the event (audit logs).
      type: Date
  - name: koi-policy-list
    description: Retrieves a list of all policies. Use 'page' and 'page_size' to fetch a specific page, or use 'limit' to auto-paginate and collect up to the specified number of policies. If 'page' is provided, 'limit' is ignored.
    arguments:
    - name: page
      description: 'Page number for pagination (1-based). When provided, fetches a single page and ignores the limit argument.'
    - name: page_size
      description: 'Number of results per page (default: 50, max: 500). Used only in single-page mode together with the page argument.'
    - name: limit
      description: 'Maximum total number of policies to return (default: 50, max: 1000). When provided without page, auto-paginates to collect up to this many policies.'
      defaultValue: '50'
    outputs:
    - contextPath: Koi.Policy.id
      description: The unique identifier of the policy.
      type: Number
    - contextPath: Koi.Policy.name
      description: The name of the policy.
      type: String
    - contextPath: Koi.Policy.description
      description: The description of the policy.
      type: String
    - contextPath: Koi.Policy.action
      description: The action taken by the policy (e.g., block).
      type: String
    - contextPath: Koi.Policy.enabled
      description: Whether the policy is enabled.
      type: Boolean
    - contextPath: Koi.Policy.group_ids
      description: List of group IDs associated with the policy.
      type: Unknown
    - contextPath: Koi.Policy.creator_fullname
      description: The full name of the policy creator.
      type: String
    - contextPath: Koi.Policy.created_at
      description: The creation time of the policy in ISO 8601 format.
      type: Date
    - contextPath: Koi.Policy.updated_at
      description: The last update time of the policy in ISO 8601 format.
      type: Date
  - name: koi-allowlist-get
    description: Retrieves all items in the allowlist.
    arguments: []
    outputs:
    - contextPath: Koi.Allowlist.item_id
      description: The unique identifier of the allowlist item.
      type: String
    - contextPath: Koi.Allowlist.item_name
      description: The name of the allowlist item.
      type: String
    - contextPath: Koi.Allowlist.item_display_name
      description: The display name of the allowlist item.
      type: String
    - contextPath: Koi.Allowlist.marketplace
      description: The marketplace of the allowlist item (e.g., vscode).
      type: String
    - contextPath: Koi.Allowlist.publisher_name
      description: The publisher name of the allowlist item.
      type: String
    - contextPath: Koi.Allowlist.package_name
      description: The package name of the allowlist item.
      type: String
    - contextPath: Koi.Allowlist.notes
      description: Notes associated with the allowlist item.
      type: String
    - contextPath: Koi.Allowlist.created_by
      description: The user who created the allowlist item.
      type: String
    - contextPath: Koi.Allowlist.created_at
      description: The creation time of the allowlist item in ISO 8601 format.
      type: Date
  - name: koi-allowlist-items-remove
    description: Removes one or more items from the global allowlist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk removal from a JSON file.
    execution: true
    arguments:
    - name: item_id
      description: The ID of the item to remove from the allowlist. Required when not using items_list_raw_json_entry_id.
    - name: marketplace
      description: The source marketplace of the item. Required when not using items_list_raw_json_entry_id.
      auto: PREDEFINED
      predefined:
      - chocolatey
      - chrome_web_store
      - claude_desktop_extensions
      - cursor
      - docker
      - edge_add_ons
      - firefox_add_ons
      - github_mcp_registry
      - homebrew
      - hugging_face
      - jetbrains
      - linux
      - mac
      - notepad++
      - npm
      - office_add_ins
      - open_vsx_registry
      - pypi
      - visual_studio
      - vscode
      - windows
      - windsurf
    - name: created_by
      description: Email of the user who created this entry.
    - name: notes
      description: Additional notes about the removal.
    - name: items_list_raw_json_entry_id
      description: 'War Room entry ID of a JSON file containing a list of items to remove. Each item must have "item_id" and "marketplace" fields. Optional fields: "created_by", "notes". When provided, item_id and marketplace arguments are ignored.'
    outputs: []
  - name: koi-allowlist-items-add
    description: Adds one or more items to the global allowlist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk addition from a JSON file.
    arguments:
    - name: item_id
      description: The ID of the item to add to the allowlist. Required when not using items_list_raw_json_entry_id.
    - name: marketplace
      description: The source marketplace of the item. Required when not using items_list_raw_json_entry_id.
      auto: PREDEFINED
      predefined:
      - chocolatey
      - chrome_web_store
      - claude_desktop_extensions
      - cursor
      - docker
      - edge_add_ons
      - firefox_add_ons
      - github_mcp_registry
      - homebrew
      - hugging_face
      - jetbrains
      - linux
      - mac
      - notepad++
      - npm
      - office_add_ins
      - open_vsx_registry
      - pypi
      - visual_studio
      - vscode
      - windows
      - windsurf
    - name: created_by
      description: Email of the user who created this entry.
    - name: notes
      description: Additional notes about the entry.
    - name: items_list_raw_json_entry_id
      description: 'War Room entry ID of a JSON file containing a list of items to add. Each item must have "item_id" and "marketplace" fields. Optional fields: "created_by", "notes". When provided, item_id and marketplace arguments are ignored.'
    outputs: []
  - name: koi-blocklist-get
    description: Retrieves all items in the blocklist.
    arguments: []
    outputs:
    - contextPath: Koi.Blocklist.item_id
      description: The unique identifier of the blocklist item.
      type: String
    - contextPath: Koi.Blocklist.item_name
      description: The name of the blocklist item.
      type: String
    - contextPath: Koi.Blocklist.item_display_name
      description: The display name of the blocklist item.
      type: String
    - contextPath: Koi.Blocklist.marketplace
      description: The marketplace of the blocklist item (e.g., vscode).
      type: String
    - contextPath: Koi.Blocklist.publisher_name
      description: The publisher name of the blocklist item.
      type: String
    - contextPath: Koi.Blocklist.package_name
      description: The package name of the blocklist item.
      type: String
    - contextPath: Koi.Blocklist.notes
      description: Notes associated with the blocklist item.
      type: String
    - contextPath: Koi.Blocklist.created_by
      description: The user who created the blocklist item.
      type: String
    - contextPath: Koi.Blocklist.created_at
      description: The creation time of the blocklist item in ISO 8601 format.
      type: Date
  - name: koi-blocklist-items-remove
    description: Removes one or more items from the global blocklist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk removal from a JSON file.
    execution: true
    arguments:
    - name: item_id
      description: The ID of the item to remove from the blocklist. Required when not using items_list_raw_json_entry_id.
    - name: marketplace
      description: The source marketplace of the item. Required when not using items_list_raw_json_entry_id.
      auto: PREDEFINED
      predefined:
      - chocolatey
      - chrome_web_store
      - claude_desktop_extensions
      - cursor
      - docker
      - edge_add_ons
      - firefox_add_ons
      - github_mcp_registry
      - homebrew
      - hugging_face
      - jetbrains
      - linux
      - mac
      - notepad++
      - npm
      - office_add_ins
      - open_vsx_registry
      - pypi
      - visual_studio
      - vscode
      - windows
      - windsurf
    - name: created_by
      description: Email of the user who created this entry.
    - name: notes
      description: Additional notes about the removal.
    - name: items_list_raw_json_entry_id
      description: 'War Room entry ID of a JSON file containing a list of items to remove. Each item must have "item_id" and "marketplace" fields. Optional fields: "created_by", "notes". When provided, item_id and marketplace arguments are ignored.'
    outputs: []
  - name: koi-blocklist-items-add
    description: Adds one or more items to the global blocklist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk addition from a JSON file.
    arguments:
    - name: item_id
      description: The ID of the item to add to the blocklist. Required when not using items_list_raw_json_entry_id.
    - name: marketplace
      description: The source marketplace of the item. Required when not using items_list_raw_json_entry_id.
      auto: PREDEFINED
      predefined:
      - chocolatey
      - chrome_web_store
      - claude_desktop_extensions
      - cursor
      - docker
      - edge_add_ons
      - firefox_add_ons
      - github_mcp_registry
      - homebrew
      - hugging_face
      - jetbrains
      - linux
      - mac
      - notepad++
      - npm
      - office_add_ins
      - open_vsx_registry
      - pypi
      - visual_studio
      - vscode
      - windows
      - windsurf
    - name: created_by
      description: Email of the user who created this entry.
    - name: notes
      description: Additional notes or justification for blocking the item.
    - name: items_list_raw_json_entry_id
      description: 'War Room entry ID of a JSON file containing a list of items to add. Each item must have "item_id" and "marketplace" fields. Optional fields: "created_by", "notes". When provided, item_id and marketplace arguments are ignored.'
    outputs: []
  - name: koi-policy-status-update
    description: Enables or disables a policy by ID.
    arguments:
    - name: policy_id
      description: The ID of the policy to update.
      required: true
    - name: enabled
      description: Whether to enable (true) or disable (false) the policy.
      required: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: Koi.Policy.id
      description: The unique identifier of the policy.
      type: Number
    - contextPath: Koi.Policy.name
      description: The name of the policy.
      type: String
    - contextPath: Koi.Policy.description
      description: The description of the policy.
      type: String
    - contextPath: Koi.Policy.action
      description: The action taken by the policy (e.g., block).
      type: String
    - contextPath: Koi.Policy.enabled
      description: Whether the policy is enabled.
      type: Boolean
    - contextPath: Koi.Policy.group_ids
      description: List of group IDs associated with the policy.
      type: Unknown
    - contextPath: Koi.Policy.creator_fullname
      description: The full name of the policy creator.
      type: String
    - contextPath: Koi.Policy.created_at
      description: The creation time of the policy in ISO 8601 format.
      type: Date
    - contextPath: Koi.Policy.updated_at
      description: The last update time of the policy in ISO 8601 format.
      type: Date
  - name: koi-inventory-list
    description: Retrieves a paginated list of items installed across your organization's endpoints. Supports extensive filtering by marketplace, platform, risk level, publisher, and specific categories.
    arguments:
    - name: page
      description: 'Page number for pagination (1-based). When provided, fetches a single page and ignores the limit argument.'
    - name: page_size
      description: 'Number of results per page (default: 50, max: 500). Used in single-page mode with the page argument.'
    - name: limit
      description: 'Maximum total number of inventory items to return (default: 50, max: 1000). When provided without page, auto-paginates to collect up to this many items.'
      defaultValue: '50'
    - name: brew_category_koi
      description: Filter by Homebrew package category (Koi classification).
    - name: browser_category_koi
      description: Filter by browser extension category (Koi classification).
    - name: chocolatey_category_koi
      description: Filter by Chocolatey package category (Koi classification).
    - name: device_id
      description: Filter devices by device ID.
    - name: finding_id
      description: Filter devices by finding ID.
    - name: first_seen
      description: 'Filter by first seen date (items first seen on or after this date). ISO 8601 format (e.g., "2024-01-01T00:00:00Z").'
    - name: ide_category_koi
      description: Filter by IDE extension category (Koi classification).
    - name: installation_method
      description: Filter by installation method.
      auto: PREDEFINED
      predefined:
      - marketplace
      - manual
      - built_in
      - side_loaded
    - name: item_display_name
      description: Filter by item display name. Performs case-insensitive partial match.
    - name: item_id
      description: Filter by item ID.
    - name: marketplace
      description: Filter by marketplace.
      auto: PREDEFINED
      predefined:
      - chocolatey
      - chrome_web_store
      - claude_desktop_extensions
      - cursor
      - docker
      - edge_add_ons
      - firefox_add_ons
      - github_mcp_registry
      - homebrew
      - hugging_face
      - jetbrains
      - linux
      - mac
      - notepad++
      - npm
      - office_add_ins
      - open_vsx_registry
      - pypi
      - visual_studio
      - vscode
      - windows
      - windsurf
    - name: platform
      description: Filter by platform.
      auto: PREDEFINED
      predefined:
      - antigravity
      - aqua
      - arc
      - brave
      - brew
      - chatgpt_atlas
      - chocolatey
      - chrome
      - chromium
      - claude
      - clion
      - codex
      - comet
      - cursor
      - datagrip
      - dataspell
      - dia
      - edge
      - excel
      - firefox
      - fleet
      - goland
      - hugging_face
      - intellij_community
      - intellij
      - kiro
      - mac
      - npm
      - notepad++
      - opera
      - outlook
      - phpstorm
      - powerpoint
      - prisma_access_browser
      - pycharm
      - pypi
      - rider
      - rubymine
      - rustrover
      - vscode
      - webstorm
      - windsurf
      - word
      - windows
      - writerside
    - name: publisher_name
      description: Filter by publisher name. Performs case-insensitive partial match.
    - name: risk_level
      description: Filter by risk level.
      auto: PREDEFINED
      predefined:
      - low
      - medium
      - high
      - critical
      - pending
    - name: software_category_koi
      description: Filter by software category (Koi classification).
    - name: sort_by
      description: Column to sort by.
      auto: PREDEFINED
      defaultValue: first_seen
      predefined:
      - first_seen
      - last_seen
      - item_display_name
      - item_id
      - version
      - marketplace
      - endpoint_count
      - risk
      - risk_level
      - status
      - installs_count
      - released_at
      - publisher_name
    - name: sort_direction
      description: Sort direction.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: view
      description: Filter by predefined view (marketplace group).
      auto: PREDEFINED
      predefined:
      - agentic_ai
      - ai_models
      - code_packages
      - extensions
      - os_packages
      - software
    outputs:
    - contextPath: Koi.Inventory.item_id
      description: The unique identifier of the inventory item.
      type: String
    - contextPath: Koi.Inventory.item_display_name
      description: The display name of the inventory item.
      type: String
    - contextPath: Koi.Inventory.marketplace
      description: The marketplace source of the item.
      type: String
    - contextPath: Koi.Inventory.platforms
      description: List of platforms where the item is installed.
      type: Unknown
    - contextPath: Koi.Inventory.publisher_name
      description: The publisher name of the item.
      type: String
    - contextPath: Koi.Inventory.risk
      description: The numeric risk score of the item.
      type: Number
    - contextPath: Koi.Inventory.risk_level
      description: The risk level classification of the item.
      type: String
    - contextPath: Koi.Inventory.version
      description: The version of the item.
      type: String
    - contextPath: Koi.Inventory.status
      description: The governance status of the item.
      type: String
    - contextPath: Koi.Inventory.endpoint_count
      description: The number of endpoints where the item is installed.
      type: Number
    - contextPath: Koi.Inventory.installs_count
      description: The total number of installs for the item.
      type: Number
    - contextPath: Koi.Inventory.first_seen
      description: The date the item was first seen in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.last_seen
      description: The date the item was last seen in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.last_used
      description: The date the item was last used in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.installation_method
      description: The method used to install the item.
      type: String
    - contextPath: Koi.Inventory.short_description
      description: A short description of the item.
      type: String
    - contextPath: Koi.Inventory.is_first_party
      description: Whether the item is a first-party item.
      type: Boolean
    - contextPath: Koi.Inventory.is_signed
      description: Whether the item is signed.
      type: Boolean
    - contextPath: Koi.Inventory.categories
      description: List of categories the item belongs to.
      type: Unknown
    - contextPath: Koi.Inventory.findings
      description: List of findings associated with the item.
      type: Unknown
    - contextPath: Koi.Inventory.governed_details
      description: Governance policy details for the item.
      type: Unknown
    - contextPath: Koi.Inventory.released_at
      description: 'The release date of the item. Format: YYYY-MM-DD (e.g., 2023-01-15).'
      type: Date
    - contextPath: Koi.Inventory.brew_category_koi
      description: The Homebrew package category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.browser_category_koi
      description: The browser extension category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.chocolatey_category_koi
      description: The Chocolatey package category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.ide_category_koi
      description: The IDE extension category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.software_category_koi
      description: The software category (Koi classification).
      type: String
  - name: koi-inventory-item-get
    description: Retrieves comprehensive details for a specific software item, extension, or package using its unique identifier, marketplace, and version.
    arguments:
    - name: item_id
      description: Unique identifier for the item.
      required: true
    - name: marketplace
      description: The marketplace where the item is hosted.
      required: true
      auto: PREDEFINED
      predefined:
      - chocolatey
      - chrome_web_store
      - claude_desktop_extensions
      - cursor
      - docker
      - edge_add_ons
      - firefox_add_ons
      - github_mcp_registry
      - homebrew
      - hugging_face
      - jetbrains
      - linux
      - mac
      - notepad++
      - npm
      - office_add_ins
      - open_vsx_registry
      - pypi
      - visual_studio
      - vscode
      - windows
      - windsurf
    - name: version
      required: true
      description: The specific version of the item to retrieve.
    outputs:
    - contextPath: Koi.Inventory.item_id
      description: The unique identifier of the inventory item.
      type: String
    - contextPath: Koi.Inventory.item_display_name
      description: The display name of the inventory item.
      type: String
    - contextPath: Koi.Inventory.marketplace
      description: The marketplace source of the item.
      type: String
    - contextPath: Koi.Inventory.platforms
      description: List of platforms where the item is installed.
      type: Unknown
    - contextPath: Koi.Inventory.publisher_name
      description: The publisher name of the item.
      type: String
    - contextPath: Koi.Inventory.risk
      description: The numeric risk score of the item.
      type: Number
    - contextPath: Koi.Inventory.risk_level
      description: The risk level classification of the item.
      type: String
    - contextPath: Koi.Inventory.version
      description: The version of the item.
      type: String
    - contextPath: Koi.Inventory.status
      description: The governance status of the item.
      type: String
    - contextPath: Koi.Inventory.endpoint_count
      description: The number of endpoints where the item is installed.
      type: Number
    - contextPath: Koi.Inventory.installs_count
      description: The total number of installs for the item.
      type: Number
    - contextPath: Koi.Inventory.installation_method
      description: The method used to install the item.
      type: String
    - contextPath: Koi.Inventory.is_first_party
      description: Whether the item is a first-party item.
      type: Boolean
    - contextPath: Koi.Inventory.is_signed
      description: Whether the item is signed.
      type: Boolean
    - contextPath: Koi.Inventory.first_seen
      description: The date the item was first seen in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.last_seen
      description: The date the item was last seen in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.last_used
      description: The date the item was last used in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.released_at
      description: 'The release date of the item. Format: YYYY-MM-DD (e.g., 2023-01-15).'
      type: Date
    - contextPath: Koi.Inventory.short_description
      description: A short description of the item.
      type: String
    - contextPath: Koi.Inventory.categories
      description: List of categories the item belongs to.
      type: Unknown
    - contextPath: Koi.Inventory.findings
      description: List of findings associated with the item including severity and evidence.
      type: Unknown
    - contextPath: Koi.Inventory.governed_details
      description: Governance policy details for the item.
      type: Unknown
    - contextPath: Koi.Inventory.brew_category_koi
      description: The Homebrew package category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.browser_category_koi
      description: The browser extension category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.chocolatey_category_koi
      description: The Chocolatey package category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.ide_category_koi
      description: The IDE extension category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.software_category_koi
      description: The software category (Koi classification).
      type: String
  - name: koi-inventory-search
    description: Searches inventory items using advanced query builder filters. Provide a filter via 'filter_json' (inline JSON string) or 'filter_raw_json_entry_id' (War Room file entry ID). At least one filter source must be provided.
    arguments:
    - name: filter_json
      description: 'Advanced filter using query builder syntax as a JSON string. Either filter_json or filter_raw_json_entry_id must be provided.'
    - name: filter_raw_json_entry_id
      description: 'War Room entry ID of a JSON file containing the filter object. Takes priority over filter_json when both are provided.'
    - name: page
      description: 'Page number for pagination (1-based). When provided, fetches a single page and ignores the limit argument.'
    - name: page_size
      description: 'Number of results per page (default: 50, max: 500). Used in single-page mode with the page argument.'
    - name: limit
      description: 'Maximum total number of inventory items to return (default: 50, max: 1000). When provided without page, auto-paginates to collect up to this many items.'
      defaultValue: '50'
    - name: sort_by
      description: Column to sort by.
      auto: PREDEFINED
      defaultValue: first_seen
      predefined:
      - first_seen
      - last_seen
      - item_display_name
      - item_id
      - version
      - marketplace
      - endpoint_count
      - risk
      - risk_level
      - status
      - installs_count
      - released_at
      - publisher_name
    - name: sort_direction
      description: Sort direction.
      auto: PREDEFINED
      defaultValue: desc
      predefined:
      - asc
      - desc
    outputs:
    - contextPath: Koi.Inventory.item_id
      description: The unique identifier of the inventory item.
      type: String
    - contextPath: Koi.Inventory.item_display_name
      description: The display name of the inventory item.
      type: String
    - contextPath: Koi.Inventory.marketplace
      description: The marketplace source of the item.
      type: String
    - contextPath: Koi.Inventory.platforms
      description: List of platforms where the item is installed.
      type: Unknown
    - contextPath: Koi.Inventory.publisher_name
      description: The publisher name of the item.
      type: String
    - contextPath: Koi.Inventory.risk
      description: The numeric risk score of the item.
      type: Number
    - contextPath: Koi.Inventory.risk_level
      description: The risk level classification of the item.
      type: String
    - contextPath: Koi.Inventory.version
      description: The version of the item.
      type: String
    - contextPath: Koi.Inventory.status
      description: The governance status of the item.
      type: String
    - contextPath: Koi.Inventory.endpoint_count
      description: The number of endpoints where the item is installed.
      type: Number
    - contextPath: Koi.Inventory.installs_count
      description: The total number of installs for the item.
      type: Number
    - contextPath: Koi.Inventory.first_seen
      description: The date the item was first seen in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.last_seen
      description: The date the item was last seen in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.last_used
      description: The date the item was last used in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.installation_method
      description: The method used to install the item.
      type: String
    - contextPath: Koi.Inventory.short_description
      description: A short description of the item.
      type: String
    - contextPath: Koi.Inventory.is_first_party
      description: Whether the item is a first-party item.
      type: Boolean
    - contextPath: Koi.Inventory.is_signed
      description: Whether the item is signed.
      type: Boolean
    - contextPath: Koi.Inventory.categories
      description: List of categories the item belongs to.
      type: Unknown
    - contextPath: Koi.Inventory.findings
      description: List of findings associated with the item.
      type: Unknown
    - contextPath: Koi.Inventory.governed_details
      description: Governance policy details for the item.
      type: Unknown
    - contextPath: Koi.Inventory.released_at
      description: 'The release date of the item. Format: YYYY-MM-DD (e.g., 2023-01-15).'
      type: Date
    - contextPath: Koi.Inventory.brew_category_koi
      description: The Homebrew package category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.browser_category_koi
      description: The browser extension category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.chocolatey_category_koi
      description: The Chocolatey package category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.ide_category_koi
      description: The IDE extension category (Koi classification).
      type: String
    - contextPath: Koi.Inventory.software_category_koi
      description: The software category (Koi classification).
      type: String
  - name: koi-inventory-item-endpoints-list
    description: Retrieves a paginated list of endpoints that have a specific item installed.
    arguments:
    - name: item_id
      description: Unique identifier for the item.
      required: true
    - name: marketplace
      description: The marketplace where the item is hosted.
      required: true
      auto: PREDEFINED
      predefined:
      - chocolatey
      - chrome_web_store
      - claude_desktop_extensions
      - cursor
      - docker
      - edge_add_ons
      - firefox_add_ons
      - github_mcp_registry
      - homebrew
      - hugging_face
      - jetbrains
      - linux
      - mac
      - notepad++
      - npm
      - office_add_ins
      - open_vsx_registry
      - pypi
      - visual_studio
      - vscode
      - windows
      - windsurf
    - name: version
      required: true
      description: The specific version of the item.
    - name: page
      description: 'Page number for pagination (1-based). When provided, fetches a single page and ignores the limit argument.'
    - name: page_size
      description: 'Number of results per page (default: 50, max: 500). Used in single-page mode with the page argument.'
    - name: limit
      description: 'Maximum total number of endpoints to return (default: 50, max: 1000). When provided without page, auto-paginates to collect up to this many endpoints.'
      defaultValue: '50'
    outputs:
    - contextPath: Koi.Inventory.Endpoint.id
      description: The unique identifier of the endpoint device.
      type: String
    - contextPath: Koi.Inventory.Endpoint.hostname
      description: The hostname of the endpoint.
      type: String
    - contextPath: Koi.Inventory.Endpoint.os
      description: The operating system of the endpoint.
      type: String
    - contextPath: Koi.Inventory.Endpoint.platform
      description: The platform where the item is installed on this endpoint.
      type: String
    - contextPath: Koi.Inventory.Endpoint.serial
      description: The serial number of the endpoint device.
      type: String
    - contextPath: Koi.Inventory.Endpoint.last_logged_on_user
      description: The last logged on user of the endpoint.
      type: String
    - contextPath: Koi.Inventory.Endpoint.activation_status
      description: The activation status of the endpoint.
      type: String
    - contextPath: Koi.Inventory.Endpoint.path
      description: The installation path of the item on the endpoint.
      type: String
    - contextPath: Koi.Inventory.Endpoint.first_seen
      description: The date the item was first seen on this endpoint in ISO 8601 format.
      type: Date
    - contextPath: Koi.Inventory.Endpoint.last_seen
      description: The date the item was last seen on this endpoint in ISO 8601 format.
      type: Date
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  isfetchevents:xsoar: false
  dockerimage: demisto/fastapi:0.125.0.10158186
fromversion: 6.10.0
tests:
- No tests (auto formatted)
marketplaces:
- xsoar
- marketplacev2
- platform