Lacework

Lacework provides end-to-end cloud security automation for AWS, Azure, and GCP with a comprehensive view of risks across cloud workloads and containers.

Analytics & SIEM · Lacework

Details

IDLacework
ProviderFortinet
CategoryAnalytics & SIEM
From Version5.0.0
Docker Imagedemisto/lacework:1.0.0.10133006
Supported ModulesAgentix XSIAM

README

Lacework provides end-to-end cloud security automation for AWS, Azure, and GCP with a comprehensive view of risks across cloud workloads and containers.
This integration was integrated and tested with version 2 of the Lacework APIs

Configure Lacework in Cortex

Parameter Required
Lacework Account Name (i.e. Sub-Domain of the URL: <ACCOUNT>.lacework.net) True
Lacework Sub-Account Name (If Required) False
Lacework API Key True
Lacework API Secret True
Lacework Alert Severity Threshold True
Fetch incidents False
Incident type False
Lacework Alert History to Import (in days) False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

lw-get-alert-details

Fetch details for a specific Alert in Lacework.

Base Command

lw-get-alert-details

Input

Argument Name Description Required
alert_id The Lacework Alert ID to be retrieved. Required
scope The scope of data to retrieve from Lacework for the specified Alert ID. Possible values are: Details, Investigation, Events, RelatedAlerts, Integrations, Timeline. Default is Details. Optional

Context Output

Path Type Description
Lacework.Alert.startTime Date The start time of the alert.
Lacework.Alert.endTime Date The end time of the alert.
Lacework.Alert.alertType String The type of the alert.
Lacework.Alert.alertName String The name of the alert.
Lacework.Alert.alertId String The ID of the alert.
Lacework.Alert.severity String The severity of the alert.
Lacework.Alert.status String The status of the alert.
Lacework.Alert.alertInfo.description String The alert description provides why the potential threat occurred.
Lacework.Alert.alertInfo.subject String The alert subject. In some cases, the alert subject can be the same as the alert name.
Lacework.Alert.entityMap Unknown The entity map for the alert.

lw-get-aws-compliance-assessment

Fetch the latest AWS compliance data from Lacework.

Base Command

lw-get-aws-compliance-assessment

Input

Argument Name Description Required
account_id The AWS Account ID to use when fetching compliance data. Required
report_type The Report Type to fetch from Lacework. Possible values are: AWS_CIS_S3, HIPAA, ISO_2700, NIST_800-53_Rev4, NIST_800-171_Rev2, PCI, SOC. Default is AWS_CIS_S3. Optional
rec_id Setting the ‘rec_id’ will filter compliance results for the specified Recommendation ID. Optional

Context Output

Path Type Description
Lacework.Compliance.reportType String The Type of the compliance report.
Lacework.Compliance.reportTitle String The Title of the compliance report.
Lacework.Compliance.recommendations.SUPPRESSIONS String The suppressions for the current recommendation.
Lacework.Compliance.recommendations.INFO_LINK String The URL to the compliance violation information.
Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT Number The number of assessed resources for the violation.
Lacework.Compliance.recommendations.STATUS String The status of the recommendation.
Lacework.Compliance.recommendations.REC_ID String The ID of the recommendation.
Lacework.Compliance.recommendations.CATEGORY String The category of the recommendation
Lacework.Compliance.recommendations.SERVICE String The service associated with the recommendation.
Lacework.Compliance.recommendations.TITLE String The title of the recommendation.
Lacework.Compliance.recommendations.VIOLATIONS.region String The region of the violating resource.
Lacework.Compliance.recommendations.VIOLATIONS.reasons String The reason for the violation.
Lacework.Compliance.recommendations.VIOLATIONS.resource String The resource causing the violation.
Lacework.Compliance.recommendations.RESOURCE_COUNT Number The number of resources associated with the compliance failure.
Lacework.Compliance.recommendations.SEVERITY Number The severity of the compliance failure.
Lacework.Compliance.summary.NUM_RECOMMENDATIONS Number The number of recommendations contained in the report.
Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE Number The number of Severity 2 compliance violations.
Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE Number The number of Severity 4 compliance violations.
Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE Number The number of severity 1 compliance violations.
Lacework.Compliance.summary.NUM_COMPLIANT Number The number of compliant resources.
Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE Number The number of severity 3 compliance violations.
Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT Number The number of assessed resources.
Lacework.Compliance.summary.NUM_SUPPRESSED Number The number of suppressed alerts.
Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE Number The number of severity 5 compliance violations.
Lacework.Compliance.summary.NUM_NOT_COMPLIANT Number The number of resources not in compliance.
Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT Number The number of resources violating compliance.
Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT Number The number of resources with suppressed violations.
Lacework.Compliance.accountId String The AWS account ID.
Lacework.Compliance.accountAlias String The AWS account alias.
Lacework.Compliance.tenantId String The Azure tenant ID.
Lacework.Compliance.tenantName String The Azure tenant name.
Lacework.Compliance.subscriptionId String The Azure subscription ID.
Lacework.Compliance.subscriptionName String The Azure subscription name.
Lacework.Compliance.projectId String The GCP project ID.
Lacework.Compliance.projectName String The GCP project name.
Lacework.Compliance.organizationId String The GCP organization ID.
Lacework.Compliance.organizationName String The GCP organization name.
Lacework.Compliance.reportTime String The time the report completed.

lw-get-azure-compliance-assessment

Fetch the latest Azure compliance data from Lacework.

Base Command

lw-get-azure-compliance-assessment

Input

Argument Name Description Required
tenant_id The Azure Tenant ID to use when fetching compliance data. Required
subscription_id The Azure Subscription ID to use when fetching compliance data. Required
report_type The Report Type to fetch from Lacework. Possible values are: AZURE_CIS, AZURE_PCI, AZURE_SOC. Default is AZURE_CIS. Optional
rec_id Setting the ‘rec_id’ will filter compliance results for the specified Recommendation ID. Optional

Context Output

Path Type Description
Lacework.Compliance.reportType String The Type of the compliance report.
Lacework.Compliance.reportTitle String The Title of the compliance report.
Lacework.Compliance.recommendations.SUPPRESSIONS String The suppressions for the current recommendation.
Lacework.Compliance.recommendations.INFO_LINK String The URL to the compliance violation information.
Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT Number The number of assessed resources for the violation.
Lacework.Compliance.recommendations.STATUS String The status of the recommendation.
Lacework.Compliance.recommendations.REC_ID String The ID of the recommendation.
Lacework.Compliance.recommendations.CATEGORY String The category of the recommendation
Lacework.Compliance.recommendations.SERVICE String The service associated with the recommendation.
Lacework.Compliance.recommendations.TITLE String The title of the recommendation.
Lacework.Compliance.recommendations.VIOLATIONS.region String The region of the violating resource.
Lacework.Compliance.recommendations.VIOLATIONS.reasons String The reason for the violation.
Lacework.Compliance.recommendations.VIOLATIONS.resource String The resource causing the violation.
Lacework.Compliance.recommendations.RESOURCE_COUNT Number The number of resources associated with the compliance failure.
Lacework.Compliance.recommendations.SEVERITY Number The severity of the compliance failure.
Lacework.Compliance.summary.NUM_RECOMMENDATIONS Number The number of recommendations contained in the report.
Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE Number The number of Severity 2 compliance violations.
Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE Number The number of Severity 4 compliance violations.
Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE Number The number of severity 1 compliance violations.
Lacework.Compliance.summary.NUM_COMPLIANT Number The number of compliant resources.
Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE Number The number of severity 3 compliance violations.
Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT Number The number of assessed resources.
Lacework.Compliance.summary.NUM_SUPPRESSED Number The number of suppressed alerts.
Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE Number The number of severity 5 compliance violations.
Lacework.Compliance.summary.NUM_NOT_COMPLIANT Number The number of resources not in compliance.
Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT Number The number of resources violating compliance.
Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT Number The number of resources with suppressed violations.
Lacework.Compliance.accountId String The AWS account ID.
Lacework.Compliance.accountAlias String The AWS account alias.
Lacework.Compliance.tenantId String The Azure tenant ID.
Lacework.Compliance.tenantName String The Azure tenant name.
Lacework.Compliance.subscriptionId String The Azure subscription ID.
Lacework.Compliance.subscriptionName String The Azure subscription name.
Lacework.Compliance.projectId String The GCP project ID.
Lacework.Compliance.projectName String The GCP project name.
Lacework.Compliance.organizationId String The GCP organization ID.
Lacework.Compliance.organizationName String The GCP organization name.
Lacework.Compliance.reportTime String The time the report completed.

lw-get-gcp-compliance-assessment

Fetch the latest GCP compliance data from Lacework.

Base Command

lw-get-gcp-compliance-assessment

Input

Argument Name Description Required
project_id The GCP Project ID to use when fetching compliance data. Required
report_type The Report Type to fetch from Lacework. Possible values are: GCP_CIS, GCP_PCI, GCP_SOC. Default is GCP_CIS. Optional
rec_id Setting the ‘rec_id’ will filter compliance results for the specified Recommendation ID. Optional

Context Output

Path Type Description
Lacework.Compliance.reportType String The Type of the compliance report.
Lacework.Compliance.reportTitle String The Title of the compliance report.
Lacework.Compliance.recommendations.SUPPRESSIONS String The suppressions for the current recommendation.
Lacework.Compliance.recommendations.INFO_LINK String The URL to the compliance violation information.
Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT Number The number of assessed resources for the violation.
Lacework.Compliance.recommendations.STATUS String The status of the recommendation.
Lacework.Compliance.recommendations.REC_ID String The ID of the recommendation.
Lacework.Compliance.recommendations.CATEGORY String The category of the recommendation
Lacework.Compliance.recommendations.SERVICE String The service associated with the recommendation.
Lacework.Compliance.recommendations.TITLE String The title of the recommendation.
Lacework.Compliance.recommendations.VIOLATIONS.region String The region of the violating resource.
Lacework.Compliance.recommendations.VIOLATIONS.reasons String The reason for the violation.
Lacework.Compliance.recommendations.VIOLATIONS.resource String The resource causing the violation.
Lacework.Compliance.recommendations.RESOURCE_COUNT Number The number of resources associated with the compliance failure.
Lacework.Compliance.recommendations.SEVERITY Number The severity of the compliance failure.
Lacework.Compliance.summary.NUM_RECOMMENDATIONS Number The number of recommendations contained in the report.
Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE Number The number of Severity 2 compliance violations.
Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE Number The number of Severity 4 compliance violations.
Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE Number The number of severity 1 compliance violations.
Lacework.Compliance.summary.NUM_COMPLIANT Number The number of compliant resources.
Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE Number The number of severity 3 compliance violations.
Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT Number The number of assessed resources.
Lacework.Compliance.summary.NUM_SUPPRESSED Number The number of suppressed alerts.
Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE Number The number of severity 5 compliance violations.
Lacework.Compliance.summary.NUM_NOT_COMPLIANT Number The number of resources not in compliance.
Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT Number The number of resources violating compliance.
Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT Number The number of resources with suppressed violations.
Lacework.Compliance.accountId String The AWS account ID.
Lacework.Compliance.accountAlias String The AWS account alias.
Lacework.Compliance.tenantId String The Azure tenant ID.
Lacework.Compliance.tenantName String The Azure tenant name.
Lacework.Compliance.subscriptionId String The Azure subscription ID.
Lacework.Compliance.subscriptionName String The Azure subscription name.
Lacework.Compliance.projectId String The GCP project ID.
Lacework.Compliance.projectName String The GCP project name.
Lacework.Compliance.organizationId String The GCP organization ID.
Lacework.Compliance.organizationName String The GCP organization name.
Lacework.Compliance.reportTime String The time the report completed.

lw-get-gcp-projects-by-organization

Fetch a list of GCP projects that are under an organization.

Base Command

lw-get-gcp-projects-by-organization

Input

Argument Name Description Required
organization_id The GCP Organization ID to use when fetching projects data. Required

Context Output

Path Type Description
Lacework.GCP.organization String The GCP Organization.
Lacework.GCP.projects String The GCP Projects associated to the Organization.

lw-get-compliance-report

Fetch a specified compliance report from Lacework.

Base Command

lw-get-compliance-report

Input

Argument Name Description Required
primary_query_id The primary ID that is used to fetch the report; for example, AWS Account ID or Azure Tenant ID. Optional
secondary_query_id The secondary ID that is used to fetch the report; for example, GCP Project ID or Azure Subscription ID. Optional
report_name The report definition’s name that is used when generating the report. Optional
report_type The report’s notification type; for example, AZURE_NIST_CSF. Possible values are: AZURE_CIS, AZURE_CIS_131, AZURE_SOC, AZURE_SOC_Rev2, AZURE_PCI, AZURE_PCI_Rev2, AZURE_ISO_27001, AZURE_NIST_CSF, AZURE_NIST_800_53_REV5, AZURE_NIST_800_171_REV2, AZURE_HIPAA, AWS_CIS_S3, NIST_800-53_Rev4, NIST_800-171_Rev2, ISO_2700, HIPAA, SOC, AWS_SOC_Rev2, GCP_HIPAA, PCI, GCP_CIS, GCP_SOC, GCP_CIS12, GCP_K8S, GCP_PCI_Rev2, GCP_SOC_Rev2, GCP_HIPAA_Rev2, GCP_ISO_27001, GCP_NIST_CSF, GCP_NIST_800_53_REV4, GCP_NIST_800_171_REV2, GCP_PCI, AWS_CIS_14, GCP_CIS13, AWS_CMMC_1.02, AWS_HIPAA, AWS_ISO_27001:2013, AWS_NIST_CSF, AWS_NIST_800-171_rev2, AWS_NIST_800-53_rev5, AWS_PCI_DSS_3.2.1, AWS_SOC_2, LW_AWS_SEC_ADD_1_0. Default is LW_AWS_SEC_ADD_1_0. Optional
template_name The template’s name that is used for the report; for example, Default. Default is Default. Required
rec_id Setting the ‘rec_id’ will filter compliance results for the specified Recommendation ID. Optional

Context Output

Path Type Description
Lacework.Compliance.reportType String The Type of the compliance report.
Lacework.Compliance.reportTitle String The Title of the compliance report.
Lacework.Compliance.recommendations.SUPPRESSIONS String The suppressions for the current recommendation.
Lacework.Compliance.recommendations.INFO_LINK String The URL to the compliance violation information.
Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT Number The number of assessed resources for the violation.
Lacework.Compliance.recommendations.STATUS String The status of the recommendation.
Lacework.Compliance.recommendations.REC_ID String The ID of the recommendation.
Lacework.Compliance.recommendations.CATEGORY String The category of the recommendation
Lacework.Compliance.recommendations.SERVICE String The service associated with the recommendation.
Lacework.Compliance.recommendations.TITLE String The title of the recommendation.
Lacework.Compliance.recommendations.VIOLATIONS.region String The region of the violating resource.
Lacework.Compliance.recommendations.VIOLATIONS.reasons String The reason for the violation.
Lacework.Compliance.recommendations.VIOLATIONS.resource String The resource causing the violation.
Lacework.Compliance.recommendations.RESOURCE_COUNT Number The number of resources associated with the compliance failure.
Lacework.Compliance.recommendations.SEVERITY Number The severity of the compliance failure.
Lacework.Compliance.summary.NUM_RECOMMENDATIONS Number The number of recommendations contained in the report.
Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE Number The number of Severity 2 compliance violations.
Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE Number The number of Severity 4 compliance violations.
Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE Number The number of severity 1 compliance violations.
Lacework.Compliance.summary.NUM_COMPLIANT Number The number of compliant resources.
Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE Number The number of severity 3 compliance violations.
Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT Number The number of assessed resources.
Lacework.Compliance.summary.NUM_SUPPRESSED Number The number of suppressed alerts.
Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE Number The number of severity 5 compliance violations.
Lacework.Compliance.summary.NUM_NOT_COMPLIANT Number The number of resources not in compliance.
Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT Number The number of resources violating compliance.
Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT Number The number of resources with suppressed violations.
Lacework.Compliance.accountId String The AWS account ID.
Lacework.Compliance.accountAlias String The AWS account alias.
Lacework.Compliance.tenantId String The Azure tenant ID.
Lacework.Compliance.tenantName String The Azure tenant name.
Lacework.Compliance.subscriptionId String The Azure subscription ID.
Lacework.Compliance.subscriptionName String The Azure subscription name.
Lacework.Compliance.projectId String The GCP project ID.
Lacework.Compliance.projectName String The GCP project name.
Lacework.Compliance.organizationId String The GCP organization ID.
Lacework.Compliance.organizationName String The GCP organization name.
Lacework.Compliance.reportTime String The time the report completed.

lw-get-container-vulnerabilities

Fetch container vulnerability information from Lacework.

Base Command

lw-get-container-vulnerabilities

Input

Argument Name Description Required
start_time A “%Y-%m-%dT%H:%M:%SZ” structured timestamp to begin from. (ex. “2020-01-01T01:10:00Z”). Optional
end_time A “%Y-%m-%dT%H:%M:%SZ” structured timestamp to end at. (ex. “2020-01-01T01:10:00Z”). Optional
filters An array of objects to add information to refine your search results. Optional
returns An array of strings to specify which top-level fields of the response schema you want to receive. Optional
limit An integer representing a limit on the number or results to return. Optional

Context Output

Path Type Description
Lacework.Vulnerability.Container.evalCtx.exception_props String The exception properties that were applied in the evaluation
Lacework.Vulnerability.Container.evalCtx.image_info Date The image information for the container scanned in the evaluation
Lacework.Vulnerability.Container.evalCtx.integration_props String The properties of the integration that performed the evaluation
Lacework.Vulnerability.Container.evalCtx.is_reeval Boolean A boolean representing whether the evaluation was a re-evaluation
Lacework.Vulnerability.Container.evalCtx.request_source String The source of the evaluation request
Lacework.Vulnerability.Container.evalCtx.scan_batch_id String The scan batch ID for the evaluation
Lacework.Vulnerability.Container.evalCtx.scan_request_props String The scan request properties for the evaluation
Lacework.Vulnerability.Container.evalCtx.vuln_batch_id String The vulnerability batch ID for the evaluation
Lacework.Vulnerability.Container.evalCtx.vuln_created_time Date The time at which the vulnerability was created
Lacework.Vulnerability.Container.featureKey.name String The name of the package identified in the evaluation
Lacework.Vulnerability.Container.featureKey.namespace String The namespace of the package identified in the evaluation
Lacework.Vulnerability.Container.featureKey.version String The version of the package identified in the evaluation
Lacework.Vulnerability.Container.featureProps.feed String The type of data feed used in the evaluation
Lacework.Vulnerability.Container.featureProps.introduced_in String The Dockerfile command which introduced the vulnerability
Lacework.Vulnerability.Container.featureProps.layer String The SHA256 hash of the layer which introduced the vulnerability
Lacework.Vulnerability.Container.featureProps.src String The path within the container identifying the source of the vulnerability data
Lacework.Vulnerability.Container.featureProps.version_format String The format of the version data for the vulnerable package
Lacework.Vulnerability.Container.fixInfo.fix_available Number An integer representing whether a fix is available for the vulnerability
Lacework.Vulnerability.Container.fixInfo.fixed_version String The version in which the vulnerability is fixed for the CVE and package
Lacework.Vulnerability.Container.imageId String The image ID of the container identified in the evaluation
Lacework.Vulnerability.Container.severity String The severity of the vulnerability identified in the evaluation
Lacework.Vulnerability.Container.startTime Date The start time for the vulnerability evaluation
Lacework.Vulnerability.Container.status String The status of the vulnerability identified in the evaluation
Lacework.Vulnerability.Container.vulnId String The vulnerability ID (CVE, ALAS, etc.)
Lacework.Vulnerability.Container.vulnHash String A unique hash of all data contained in the vulnerability

lw-get-host-vulnerabilities

Fetch host vulnerability information from Lacework.

Base Command

lw-get-host-vulnerabilities

Input

Argument Name Description Required
start_time A “%Y-%m-%dT%H:%M:%SZ” structured timestamp to begin from. (ex. “2020-01-01T01:10:00Z”). Optional
end_time A “%Y-%m-%dT%H:%M:%SZ” structured timestamp to end at. (ex. “2020-01-01T01:10:00Z”). Optional
filters An array of objects to add information to refine your search results. Optional
returns An array of strings to specify which top-level fields of the response schema you want to receive. Optional
limit An integer representing a limit on the number or results to return. Optional

Context Output

Path Type Description
Lacework.Vulnerability.Host.cveProps.description String The CVE Properties description
Lacework.Vulnerability.Host.cveProps.link String The CVE Properties description URL
Lacework.Vulnerability.Host.endTime Date The end time for the vulnerability evaluation period
Lacework.Vulnerability.Host.evalCtx.exception_props.status String The status of any exception properties for the evaluation
Lacework.Vulnerability.Host.evalCtx.hostname String The hostname of the host assessed in the evaluation
Lacework.Vulnerability.Host.evalCtx.mc_eval_guid String The GUID for the evaluation
Lacework.Vulnerability.Host.featureKey.name String The name of the package identified in the evaluation
Lacework.Vulnerability.Host.featureKey.namespace String The namespace of the package identified in the evaluation
Lacework.Vulnerability.Host.featureKey.package_active Number An integer representing whether the package is Active on the host
Lacework.Vulnerability.Host.featureKey.version_installed String The version of the package identified in the evaluation
Lacework.Vulnerability.Host.fixInfo.fix_available String An integer representing whether a fix is available for the vulnerability
Lacework.Vulnerability.Host.fixInfo.fixed_version String The version in which the vulnerability is fixed for the CVE and package
Lacework.Vulnerability.Host.machineTags String A string representing the machine tags in key/value pairs
Lacework.Vulnerability.Host.mid String The machine ID for the host identified in the evaluation
Lacework.Vulnerability.Host.severity String The severity of the vulnerability identified in the evaluation
Lacework.Vulnerability.Host.startTime Date The start time for the vulnerability evaluation period
Lacework.Vulnerability.Host.status String The status of the vulnerability identified in the evaluation
Lacework.Vulnerability.Host.vulnId String The vulnerability ID (CVE, ALAS, etc.)
Lacework.Vulnerability.Host.vulnHash String A unique hash of all data contained in the vulnerability

Configuration parameters

  • lacework_account — Lacework Account Name (i.e. Sub-Domain of the URL: <ACCOUNT>.lacework.net) (required)
  • lacework_subaccount — Lacework Sub-Account Name (If Required)
  • lacework_api_key — Lacework API Key (required)
  • lacework_api_secret — Lacework API Secret (required)
  • lacework_event_severity — Lacework Alert Severity Threshold (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • lacework_event_history — Lacework Alert History to Import (in days)

Commands (8)

  • lw-get-alert-details

    Fetch details for a specific Alert in Lacework.

  • lw-get-aws-compliance-assessment

    Fetch the latest AWS compliance data from Lacework.

  • lw-get-azure-compliance-assessment

    Fetch the latest Azure compliance data from Lacework.

  • lw-get-compliance-report

    Fetch a specified compliance report from Lacework.

  • lw-get-container-vulnerabilities

    Fetch container vulnerability information from Lacework.

  • lw-get-gcp-compliance-assessment

    Fetch the latest GCP compliance data from Lacework.

  • lw-get-gcp-projects-by-organization

    Fetch a list of GCP projects that are under an organization.

  • lw-get-host-vulnerabilities

    Fetch host vulnerability information from Lacework.

Source

Lacework.py Lacework.yml Lacework_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: Fortinet
commonfields:
  id: Lacework
  version: -1
configuration:
- display: 'Lacework Account Name (i.e. Sub-Domain of the URL: <ACCOUNT>.lacework.net)'
  name: lacework_account
  required: true
  type: 0
  section: Connect
- display: Lacework Sub-Account Name (If Required)
  name: lacework_subaccount
  type: 0
  required: false
  section: Connect
- display: Lacework API Key
  name: lacework_api_key
  required: true
  type: 4
  section: Connect
- display: Lacework API Secret
  name: lacework_api_secret
  required: true
  type: 4
  section: Connect
- defaultvalue: high
  display: Lacework Alert Severity Threshold
  name: lacework_event_severity
  options:
  - critical
  - high
  - medium
  - low
  - informational
  required: true
  type: 15
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- defaultvalue: '7'
  display: Lacework Alert History to Import (in days)
  name: lacework_event_history
  options:
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  - '6'
  - '7'
  type: 15
  required: false
  section: Collect
description: Lacework provides end-to-end cloud security automation for AWS, Azure, and GCP with a comprehensive view of risks across cloud workloads and containers.
display: Lacework
name: Lacework
script:
  commands:
  - arguments:
    - description: The Lacework Alert ID to be retrieved.
      name: alert_id
      required: true
    - auto: PREDEFINED
      defaultValue: Details
      description: The scope of data to retrieve from Lacework for the specified Alert ID.
      name: scope
      predefined:
      - Details
      - Investigation
      - Events
      - RelatedAlerts
      - Integrations
      - Timeline
    description: Fetch details for a specific Alert in Lacework.
    name: lw-get-alert-details
    outputs:
    - contextPath: Lacework.Alert.startTime
      description: The start time of the alert.
      type: Date
    - contextPath: Lacework.Alert.endTime
      description: The end time of the alert.
      type: Date
    - contextPath: Lacework.Alert.alertType
      description: The type of the alert.
      type: String
    - contextPath: Lacework.Alert.alertName
      description: The name of the alert.
      type: String
    - contextPath: Lacework.Alert.alertId
      description: The ID of the alert.
      type: String
    - contextPath: Lacework.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: Lacework.Alert.status
      description: The status of the alert.
      type: String
    - contextPath: Lacework.Alert.alertInfo.description
      description: The alert description provides why the potential threat occurred.
      type: String
    - contextPath: Lacework.Alert.alertInfo.subject
      description: The alert subject. In some cases, the alert subject can be the same as the alert name.
      type: String
    - contextPath: Lacework.Alert.entityMap
      description: The entity map for the alert.
      type: Unknown
  - arguments:
    - description: The AWS Account ID to use when fetching compliance data.
      name: account_id
      required: true
    - auto: PREDEFINED
      defaultValue: AWS_CIS_S3
      description: The Report Type to fetch from Lacework.
      name: report_type
      predefined:
      - AWS_CIS_S3
      - HIPAA
      - ISO_2700
      - NIST_800-53_Rev4
      - NIST_800-171_Rev2
      - PCI
      - SOC
    - description: Setting the 'rec_id' will filter compliance results for the specified Recommendation ID.
      name: rec_id
    description: Fetch the latest AWS compliance data from Lacework.
    name: lw-get-aws-compliance-assessment
    outputs:
    - contextPath: Lacework.Compliance.reportType
      description: The Type of the compliance report.
      type: String
    - contextPath: Lacework.Compliance.reportTitle
      description: The Title of the compliance report.
      type: String
    - contextPath: Lacework.Compliance.recommendations.SUPPRESSIONS
      description: The suppressions for the current recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.INFO_LINK
      description: The URL to the compliance violation information.
      type: String
    - contextPath: Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT
      description: The number of assessed resources for the violation.
      type: Number
    - contextPath: Lacework.Compliance.recommendations.STATUS
      description: The status of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.REC_ID
      description: The ID of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.CATEGORY
      description: The category of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.SERVICE
      description: The service associated with the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.TITLE
      description: The title of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.region
      description: The region of the violating resource.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.reasons
      description: The reason for the violation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.resource
      description: The resource causing the violation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.RESOURCE_COUNT
      description: The number of resources associated with the compliance failure.
      type: Number
    - contextPath: Lacework.Compliance.recommendations.SEVERITY
      description: The severity of the compliance failure.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_RECOMMENDATIONS
      description: The number of recommendations contained in the report.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE
      description: The number of Severity 2 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE
      description: The number of Severity 4 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE
      description: The number of severity 1 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_COMPLIANT
      description: The number of compliant resources.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE
      description: The number of severity 3 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT
      description: The number of assessed resources.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SUPPRESSED
      description: The number of suppressed alerts.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE
      description: The number of severity 5 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_NOT_COMPLIANT
      description: The number of resources not in compliance.
      type: Number
    - contextPath: Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT
      description: The number of resources violating compliance.
      type: Number
    - contextPath: Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT
      description: The number of resources with suppressed violations.
      type: Number
    - contextPath: Lacework.Compliance.accountId
      description: The AWS account ID.
      type: String
    - contextPath: Lacework.Compliance.accountAlias
      description: The AWS account alias.
      type: String
    - contextPath: Lacework.Compliance.tenantId
      description: The Azure tenant ID.
      type: String
    - contextPath: Lacework.Compliance.tenantName
      description: The Azure tenant name.
      type: String
    - contextPath: Lacework.Compliance.subscriptionId
      description: The Azure subscription ID.
      type: String
    - contextPath: Lacework.Compliance.subscriptionName
      description: The Azure subscription name.
      type: String
    - contextPath: Lacework.Compliance.projectId
      description: The GCP project ID.
      type: String
    - contextPath: Lacework.Compliance.projectName
      description: The GCP project name.
      type: String
    - contextPath: Lacework.Compliance.organizationId
      description: The GCP organization ID.
      type: String
    - contextPath: Lacework.Compliance.organizationName
      description: The GCP organization name.
      type: String
    - contextPath: Lacework.Compliance.reportTime
      description: The time the report completed.
      type: String
  - arguments:
    - description: The Azure Tenant ID to use when fetching compliance data.
      name: tenant_id
      required: true
    - description: The Azure Subscription ID to use when fetching compliance data.
      name: subscription_id
      required: true
    - auto: PREDEFINED
      defaultValue: AZURE_CIS
      description: The Report Type to fetch from Lacework.
      name: report_type
      predefined:
      - AZURE_CIS
      - AZURE_PCI
      - AZURE_SOC
    - description: Setting the 'rec_id' will filter compliance results for the specified Recommendation ID.
      name: rec_id
    description: Fetch the latest Azure compliance data from Lacework.
    name: lw-get-azure-compliance-assessment
    outputs:
    - contextPath: Lacework.Compliance.reportType
      description: The Type of the compliance report.
      type: String
    - contextPath: Lacework.Compliance.reportTitle
      description: The Title of the compliance report.
      type: String
    - contextPath: Lacework.Compliance.recommendations.SUPPRESSIONS
      description: The suppressions for the current recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.INFO_LINK
      description: The URL to the compliance violation information.
      type: String
    - contextPath: Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT
      description: The number of assessed resources for the violation.
      type: Number
    - contextPath: Lacework.Compliance.recommendations.STATUS
      description: The status of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.REC_ID
      description: The ID of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.CATEGORY
      description: The category of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.SERVICE
      description: The service associated with the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.TITLE
      description: The title of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.region
      description: The region of the violating resource.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.reasons
      description: The reason for the violation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.resource
      description: The resource causing the violation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.RESOURCE_COUNT
      description: The number of resources associated with the compliance failure.
      type: Number
    - contextPath: Lacework.Compliance.recommendations.SEVERITY
      description: The severity of the compliance failure.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_RECOMMENDATIONS
      description: The number of recommendations contained in the report.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE
      description: The number of Severity 2 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE
      description: The number of Severity 4 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE
      description: The number of severity 1 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_COMPLIANT
      description: The number of compliant resources.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE
      description: The number of severity 3 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT
      description: The number of assessed resources.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SUPPRESSED
      description: The number of suppressed alerts.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE
      description: The number of severity 5 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_NOT_COMPLIANT
      description: The number of resources not in compliance.
      type: Number
    - contextPath: Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT
      description: The number of resources violating compliance.
      type: Number
    - contextPath: Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT
      description: The number of resources with suppressed violations.
      type: Number
    - contextPath: Lacework.Compliance.accountId
      description: The AWS account ID.
      type: String
    - contextPath: Lacework.Compliance.accountAlias
      description: The AWS account alias.
      type: String
    - contextPath: Lacework.Compliance.tenantId
      description: The Azure tenant ID.
      type: String
    - contextPath: Lacework.Compliance.tenantName
      description: The Azure tenant name.
      type: String
    - contextPath: Lacework.Compliance.subscriptionId
      description: The Azure subscription ID.
      type: String
    - contextPath: Lacework.Compliance.subscriptionName
      description: The Azure subscription name.
      type: String
    - contextPath: Lacework.Compliance.projectId
      description: The GCP project ID.
      type: String
    - contextPath: Lacework.Compliance.projectName
      description: The GCP project name.
      type: String
    - contextPath: Lacework.Compliance.organizationId
      description: The GCP organization ID.
      type: String
    - contextPath: Lacework.Compliance.organizationName
      description: The GCP organization name.
      type: String
    - contextPath: Lacework.Compliance.reportTime
      description: The time the report completed.
      type: String
  - arguments:
    - description: The GCP Project ID to use when fetching compliance data.
      name: project_id
      required: true
    - auto: PREDEFINED
      defaultValue: GCP_CIS
      description: The Report Type to fetch from Lacework.
      name: report_type
      predefined:
      - GCP_CIS
      - GCP_PCI
      - GCP_SOC
    - description: Setting the 'rec_id' will filter compliance results for the specified Recommendation ID.
      name: rec_id
    description: Fetch the latest GCP compliance data from Lacework.
    name: lw-get-gcp-compliance-assessment
    outputs:
    - contextPath: Lacework.Compliance.reportType
      description: The Type of the compliance report.
      type: String
    - contextPath: Lacework.Compliance.reportTitle
      description: The Title of the compliance report.
      type: String
    - contextPath: Lacework.Compliance.recommendations.SUPPRESSIONS
      description: The suppressions for the current recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.INFO_LINK
      description: The URL to the compliance violation information.
      type: String
    - contextPath: Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT
      description: The number of assessed resources for the violation.
      type: Number
    - contextPath: Lacework.Compliance.recommendations.STATUS
      description: The status of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.REC_ID
      description: The ID of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.CATEGORY
      description: The category of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.SERVICE
      description: The service associated with the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.TITLE
      description: The title of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.region
      description: The region of the violating resource.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.reasons
      description: The reason for the violation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.resource
      description: The resource causing the violation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.RESOURCE_COUNT
      description: The number of resources associated with the compliance failure.
      type: Number
    - contextPath: Lacework.Compliance.recommendations.SEVERITY
      description: The severity of the compliance failure.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_RECOMMENDATIONS
      description: The number of recommendations contained in the report.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE
      description: The number of Severity 2 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE
      description: The number of Severity 4 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE
      description: The number of severity 1 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_COMPLIANT
      description: The number of compliant resources.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE
      description: The number of severity 3 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT
      description: The number of assessed resources.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SUPPRESSED
      description: The number of suppressed alerts.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE
      description: The number of severity 5 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_NOT_COMPLIANT
      description: The number of resources not in compliance.
      type: Number
    - contextPath: Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT
      description: The number of resources violating compliance.
      type: Number
    - contextPath: Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT
      description: The number of resources with suppressed violations.
      type: Number
    - contextPath: Lacework.Compliance.accountId
      description: The AWS account ID.
      type: String
    - contextPath: Lacework.Compliance.accountAlias
      description: The AWS account alias.
      type: String
    - contextPath: Lacework.Compliance.tenantId
      description: The Azure tenant ID.
      type: String
    - contextPath: Lacework.Compliance.tenantName
      description: The Azure tenant name.
      type: String
    - contextPath: Lacework.Compliance.subscriptionId
      description: The Azure subscription ID.
      type: String
    - contextPath: Lacework.Compliance.subscriptionName
      description: The Azure subscription name.
      type: String
    - contextPath: Lacework.Compliance.projectId
      description: The GCP project ID.
      type: String
    - contextPath: Lacework.Compliance.projectName
      description: The GCP project name.
      type: String
    - contextPath: Lacework.Compliance.organizationId
      description: The GCP organization ID.
      type: String
    - contextPath: Lacework.Compliance.organizationName
      description: The GCP organization name.
      type: String
    - contextPath: Lacework.Compliance.reportTime
      description: The time the report completed.
      type: String
  - arguments:
    - description: The GCP Organization ID to use when fetching projects data.
      name: organization_id
      required: true
    description: Fetch a list of GCP projects that are under an organization.
    name: lw-get-gcp-projects-by-organization
    outputs:
    - contextPath: Lacework.GCP.organization
      description: The GCP Organization.
      type: String
    - contextPath: Lacework.GCP.projects
      description: The GCP Projects associated to the Organization.
      type: String
  - arguments:
    - description: The primary ID that is used to fetch the report; for example, AWS Account ID or Azure Tenant ID.
      name: primary_query_id
    - description: The secondary ID that is used to fetch the report; for example, GCP Project ID or Azure Subscription ID.
      name: secondary_query_id
    - description: The report definition's name that is used when generating the report.
      name: report_name
    - auto: PREDEFINED
      defaultValue: LW_AWS_SEC_ADD_1_0
      description: The report's notification type; for example, AZURE_NIST_CSF.
      name: report_type
      predefined:
      - AZURE_CIS
      - AZURE_CIS_131
      - AZURE_SOC
      - AZURE_SOC_Rev2
      - AZURE_PCI
      - AZURE_PCI_Rev2
      - AZURE_ISO_27001
      - AZURE_NIST_CSF
      - AZURE_NIST_800_53_REV5
      - AZURE_NIST_800_171_REV2
      - AZURE_HIPAA
      - AWS_CIS_S3
      - NIST_800-53_Rev4
      - NIST_800-171_Rev2
      - ISO_2700
      - HIPAA
      - SOC
      - AWS_SOC_Rev2
      - GCP_HIPAA
      - PCI
      - GCP_CIS
      - GCP_SOC
      - GCP_CIS12
      - GCP_K8S
      - GCP_PCI_Rev2
      - GCP_SOC_Rev2
      - GCP_HIPAA_Rev2
      - GCP_ISO_27001
      - GCP_NIST_CSF
      - GCP_NIST_800_53_REV4
      - GCP_NIST_800_171_REV2
      - GCP_PCI
      - AWS_CIS_14
      - GCP_CIS13
      - AWS_CMMC_1.02
      - AWS_HIPAA
      - AWS_ISO_27001:2013
      - AWS_NIST_CSF
      - AWS_NIST_800-171_rev2
      - AWS_NIST_800-53_rev5
      - AWS_PCI_DSS_3.2.1
      - AWS_SOC_2
      - LW_AWS_SEC_ADD_1_0
    - defaultValue: Default
      description: The template's name that is used for the report; for example, Default.
      name: template_name
      required: true
    - description: Setting the 'rec_id' will filter compliance results for the specified Recommendation ID.
      name: rec_id
    description: Fetch a specified compliance report from Lacework.
    name: lw-get-compliance-report
    outputs:
    - contextPath: Lacework.Compliance.reportType
      description: The Type of the compliance report.
      type: String
    - contextPath: Lacework.Compliance.reportTitle
      description: The Title of the compliance report.
      type: String
    - contextPath: Lacework.Compliance.recommendations.SUPPRESSIONS
      description: The suppressions for the current recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.INFO_LINK
      description: The URL to the compliance violation information.
      type: String
    - contextPath: Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT
      description: The number of assessed resources for the violation.
      type: Number
    - contextPath: Lacework.Compliance.recommendations.STATUS
      description: The status of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.REC_ID
      description: The ID of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.CATEGORY
      description: The category of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.SERVICE
      description: The service associated with the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.TITLE
      description: The title of the recommendation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.region
      description: The region of the violating resource.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.reasons
      description: The reason for the violation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.resource
      description: The resource causing the violation.
      type: String
    - contextPath: Lacework.Compliance.recommendations.RESOURCE_COUNT
      description: The number of resources associated with the compliance failure.
      type: Number
    - contextPath: Lacework.Compliance.recommendations.SEVERITY
      description: The severity of the compliance failure.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_RECOMMENDATIONS
      description: The number of recommendations contained in the report.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE
      description: The number of Severity 2 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE
      description: The number of Severity 4 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE
      description: The number of severity 1 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_COMPLIANT
      description: The number of compliant resources.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE
      description: The number of severity 3 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT
      description: The number of assessed resources.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SUPPRESSED
      description: The number of suppressed alerts.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE
      description: The number of severity 5 compliance violations.
      type: Number
    - contextPath: Lacework.Compliance.summary.NUM_NOT_COMPLIANT
      description: The number of resources not in compliance.
      type: Number
    - contextPath: Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT
      description: The number of resources violating compliance.
      type: Number
    - contextPath: Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT
      description: The number of resources with suppressed violations.
      type: Number
    - contextPath: Lacework.Compliance.accountId
      description: The AWS account ID.
      type: String
    - contextPath: Lacework.Compliance.accountAlias
      description: The AWS account alias.
      type: String
    - contextPath: Lacework.Compliance.tenantId
      description: The Azure tenant ID.
      type: String
    - contextPath: Lacework.Compliance.tenantName
      description: The Azure tenant name.
      type: String
    - contextPath: Lacework.Compliance.subscriptionId
      description: The Azure subscription ID.
      type: String
    - contextPath: Lacework.Compliance.subscriptionName
      description: The Azure subscription name.
      type: String
    - contextPath: Lacework.Compliance.projectId
      description: The GCP project ID.
      type: String
    - contextPath: Lacework.Compliance.projectName
      description: The GCP project name.
      type: String
    - contextPath: Lacework.Compliance.organizationId
      description: The GCP organization ID.
      type: String
    - contextPath: Lacework.Compliance.organizationName
      description: The GCP organization name.
      type: String
    - contextPath: Lacework.Compliance.reportTime
      description: The time the report completed.
      type: String
  - arguments:
    - description: A "%Y-%m-%dT%H:%M:%SZ" structured timestamp to begin from. (ex. "2020-01-01T01:10:00Z").
      name: start_time
    - description: A "%Y-%m-%dT%H:%M:%SZ" structured timestamp to end at. (ex. "2020-01-01T01:10:00Z").
      name: end_time
    - description: An array of objects to add information to refine your search results.
      name: filters
    - description: An array of strings to specify which top-level fields of the response schema you want to receive.
      name: returns
    - description: An integer representing a limit on the number or results to return.
      name: limit
    description: Fetch container vulnerability information from Lacework.
    name: lw-get-container-vulnerabilities
    outputs:
    - contextPath: Lacework.Vulnerability.Container.evalCtx.exception_props
      description: The exception properties that were applied in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.evalCtx.image_info
      description: The image information for the container scanned in the evaluation.
      type: Date
    - contextPath: Lacework.Vulnerability.Container.evalCtx.integration_props
      description: The properties of the integration that performed the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.evalCtx.is_reeval
      description: A boolean representing whether the evaluation was a re-evaluation.
      type: Boolean
    - contextPath: Lacework.Vulnerability.Container.evalCtx.request_source
      description: The source of the evaluation request.
      type: String
    - contextPath: Lacework.Vulnerability.Container.evalCtx.scan_batch_id
      description: The scan batch ID for the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.evalCtx.scan_request_props
      description: The scan request properties for the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.evalCtx.vuln_batch_id
      description: The vulnerability batch ID for the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.evalCtx.vuln_created_time
      description: The time at which the vulnerability was created.
      type: Date
    - contextPath: Lacework.Vulnerability.Container.featureKey.name
      description: The name of the package identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.featureKey.namespace
      description: The namespace of the package identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.featureKey.version
      description: The version of the package identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.featureProps.feed
      description: The type of data feed used in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.featureProps.introduced_in
      description: The Dockerfile command which introduced the vulnerability.
      type: String
    - contextPath: Lacework.Vulnerability.Container.featureProps.layer
      description: The SHA256 hash of the layer which introduced the vulnerability.
      type: String
    - contextPath: Lacework.Vulnerability.Container.featureProps.src
      description: The path within the container identifying the source of the vulnerability data.
      type: String
    - contextPath: Lacework.Vulnerability.Container.featureProps.version_format
      description: The format of the version data for the vulnerable package.
      type: String
    - contextPath: Lacework.Vulnerability.Container.fixInfo.fix_available
      description: An integer representing whether a fix is available for the vulnerability.
      type: Number
    - contextPath: Lacework.Vulnerability.Container.fixInfo.fixed_version
      description: The version in which the vulnerability is fixed for the CVE and package.
      type: String
    - contextPath: Lacework.Vulnerability.Container.imageId
      description: The image ID of the container identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.severity
      description: The severity of the vulnerability identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.startTime
      description: The start time for the vulnerability evaluation.
      type: Date
    - contextPath: Lacework.Vulnerability.Container.status
      description: The status of the vulnerability identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Container.vulnId
      description: The vulnerability ID (CVE, ALAS, etc.)
      type: String
    - contextPath: Lacework.Vulnerability.Container.vulnHash
      description: A unique hash of all data contained in the vulnerability.
      type: String
  - arguments:
    - description: A "%Y-%m-%dT%H:%M:%SZ" structured timestamp to begin from. (ex. "2020-01-01T01:10:00Z").
      name: start_time
    - description: A "%Y-%m-%dT%H:%M:%SZ" structured timestamp to end at. (ex. "2020-01-01T01:10:00Z").
      name: end_time
    - description: An array of objects to add information to refine your search results.
      name: filters
    - description: An array of strings to specify which top-level fields of the response schema you want to receive.
      name: returns
    - description: An integer representing a limit on the number or results to return.
      name: limit
    description: Fetch host vulnerability information from Lacework.
    name: lw-get-host-vulnerabilities
    outputs:
    - contextPath: Lacework.Vulnerability.Host.cveProps.description
      description: The CVE Properties description.
      type: String
    - contextPath: Lacework.Vulnerability.Host.cveProps.link
      description: The CVE Properties description URL.
      type: String
    - contextPath: Lacework.Vulnerability.Host.endTime
      description: The end time for the vulnerability evaluation period.
      type: Date
    - contextPath: Lacework.Vulnerability.Host.evalCtx.exception_props.status
      description: The status of any exception properties for the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.evalCtx.hostname
      description: The hostname of the host assessed in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.evalCtx.mc_eval_guid
      description: The GUID for the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.featureKey.name
      description: The name of the package identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.featureKey.namespace
      description: The namespace of the package identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.featureKey.package_active
      description: An integer representing whether the package is Active on the host.
      type: Number
    - contextPath: Lacework.Vulnerability.Host.featureKey.version_installed
      description: The version of the package identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.fixInfo.fix_available
      description: An integer representing whether a fix is available for the vulnerability.
      type: String
    - contextPath: Lacework.Vulnerability.Host.fixInfo.fixed_version
      description: The version in which the vulnerability is fixed for the CVE and package.
      type: String
    - contextPath: Lacework.Vulnerability.Host.machineTags
      description: A string representing the machine tags in key/value pairs.
      type: String
    - contextPath: Lacework.Vulnerability.Host.mid
      description: The machine ID for the host identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.severity
      description: The severity of the vulnerability identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.startTime
      description: The start time for the vulnerability evaluation period.
      type: Date
    - contextPath: Lacework.Vulnerability.Host.status
      description: The status of the vulnerability identified in the evaluation.
      type: String
    - contextPath: Lacework.Vulnerability.Host.vulnId
      description: The vulnerability ID (CVE, ALAS, etc.)
      type: String
    - contextPath: Lacework.Vulnerability.Host.vulnHash
      description: A unique hash of all data contained in the vulnerability.
      type: String
  dockerimage: demisto/lacework:1.0.0.10133006
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No Tests
defaultmapperin: Lacework - Incoming Mapper
defaultclassifier: Lacework - Classifier
fromversion: 5.0.0