MagnetAutomate

Magnet Automate is an orchestration and automation platform that accelerates your digital forensics investigations by automating workflows and integrating with various forensic tools.

Forensics & Malware Analysis · Magnet Forensics

Details

IDMagnetAutomate
ProviderMagnet Forensics
CategoryForensics & Malware Analysis
From Version6.10.0
Docker Imagedemisto/fastapi:0.125.0.11206988

README

Magnet Automate is an orchestration and automation platform that accelerates your digital forensics investigations by automating workflows and integrating with various forensic tools.
This integration was integrated and tested with version 0.2.0 of Magnet Automate API.

Configure Magnet Automate in Cortex

Parameter Required
Server URL True
API Key True
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

mf-automate-custom-fields-list

Retrieves a list of custom fields for cases and evidence sources.

Base Command

mf-automate-custom-fields-list

Input

Argument Name Description Required
limit The maximum number of results to return. Default value is 50. Default is 50. Optional
all_results Whether to return all of the results. Overrides the limit argument if used. Default value is False. Optional

Context Output

Path Type Description
MagnetAutomate.CustomFields.id Number The unique identifier of the custom field.
MagnetAutomate.CustomFields.name String The name of the custom field.
MagnetAutomate.CustomFields.type String The data type of the custom field.
MagnetAutomate.CustomFields.elementType Unknown The element type of the custom field.
MagnetAutomate.CustomFields.description String A description of the custom field.
MagnetAutomate.CustomFields.required Boolean Whether the custom field is required.
MagnetAutomate.CustomFields.exposeInWorkflow Boolean Whether the custom field is exposed in workflows.
MagnetAutomate.CustomFields.variableName String The variable name associated with the custom field.

Command Example

!mf-automate-custom-fields-list limit=10

mf-automate-case-create

Creates a new case in Magnet Automate. Use mf-automate-custom-fields-list to get all available custom fields.

Base Command

mf-automate-case-create

Input

Argument Name Description Required
case_number The unique case number to assign to the new case. Required
custom_field_values A JSON object containing custom field values for the case. Optional

Context Output

Path Type Description
MagnetAutomate.Case.id Number The unique identifier of the created case.
MagnetAutomate.Case.caseNumber String The case number assigned to the case.
MagnetAutomate.Case.customFieldValues Unknown The custom field values associated with the case.

Command Example

!mf-automate-case-create case_number="CASE-2024-001" custom_field_values="{\"2\": \"Civil\", \"3\": \"Magnet Forensics\"}"

mf-automate-cases-list

Retrieves a list of all cases or information about a specific case.

Base Command

mf-automate-cases-list

Input

Argument Name Description Required
case_id The unique identifier of the case to retrieve. Optional
limit The maximum number of results to return. Default value is 50. Default is 50. Optional
all_results Whether to return all of the results. Overrides the limit argument if used. Default value is False. Optional

Context Output

Path Type Description
MagnetAutomate.Case.id Number The unique identifier of the case.
MagnetAutomate.Case.caseNumber String The case number.

Command Example

!mf-automate-cases-list limit=5

Command Example

!mf-automate-cases-list case_id=10

mf-automate-case-delete

Deletes a specific case from Magnet Automate.

Base Command

mf-automate-case-delete

Input

Argument Name Description Required
case_id The unique identifier of the case to delete. Required

Context Output

There is no context output for this command.

Command Example

!mf-automate-case-delete case_id=10

mf-automate-case-cancel

Cancels an ongoing case in Magnet Automate.

Base Command

mf-automate-case-cancel

Input

Argument Name Description Required
case_id The unique identifier of the case to cancel. Required

Context Output

There is no context output for this command.

Command Example

!mf-automate-case-cancel case_id=10

mf-automate-workflow-run-start

Starts a new workflow run and associates it with a specific case.

Base Command

mf-automate-workflow-run-start

Input

Argument Name Description Required
case_id The unique identifier of the case to associate the workflow run with. Required
evidence_number An evidence number to apply to the evidence source. Required
type A JSON object defining the evidence type and its parameters (e.g., ImageSource path). Required
workflow_id The unique identifier of the workflow to run. Required
output_path The directory path where the workflow output will be stored. Optional
platform The platform associated with the evidence. Optional
decryption_type The type of decryption to use (e.g., Password, RecoveryKey). Optional
decryption_value The decryption key or password. Optional
continue_on_decryption_fail Whether to continue the workflow if decryption fails. Optional
custom_field_values A JSON object containing custom field values for the workflow run. Optional
assigned_node_name The name of the specific node to assign the workflow run to. Optional

Context Output

Path Type Description
MagnetAutomate.WorkflowRun.id Number The unique identifier of the started workflow run.
MagnetAutomate.WorkflowRun.path String The path to the workflow run data.
MagnetAutomate.WorkflowRun.version Number The version of the workflow run.
MagnetAutomate.WorkflowRun.caseId Number The identifier of the associated case.
MagnetAutomate.WorkflowRun.caseTypeId Number The identifier of the case type.
MagnetAutomate.WorkflowRun.basePath String The base path for the workflow run.
MagnetAutomate.WorkflowRun.automateVersion String The version of Magnet Automate used for the run.

Command Example

!mf-automate-workflow-run-start case_id=10 evidence_number="ExhibitA" type="{\"ImageSource\": {\"path\": \"C:\\\\testdata\\\\image\\\\image123.001\"}}" workflow_id=3 output_path="C:\\testdata\\output" platform="windows" decryption_type="password" decryption_value="MySecretPassword" continue_on_decryption_fail=false custom_field_values="{\"5\": \"Evidence Value A\", \"7\": \"Evidence Value B\"}" assigned_node_name="AGENT1"

mf-automate-workflow-run-list

Retrieves a list of all workflow runs for a specific case or details of a specific run.

Base Command

mf-automate-workflow-run-list

Input

Argument Name Description Required
case_id The unique identifier of the case to retrieve workflow runs for. Required
run_id The unique identifier of a specific workflow run to retrieve. Optional
limit The maximum number of results to return. Default value is 50. Default is 50. Optional
all_results Whether to return all of the results. Overrides the limit argument if used. Default value is False. Optional

Context Output

Path Type Description
MagnetAutomate.WorkflowRun.id Number The unique identifier of the workflow run.
MagnetAutomate.WorkflowRun.evidence Unknown Details about the evidence associated with the run.
MagnetAutomate.WorkflowRun.status String The current status of the workflow run.
MagnetAutomate.WorkflowRun.workflowId Number The identifier of the workflow being run.
MagnetAutomate.WorkflowRun.currentStage Unknown Information about the current stage of the workflow run.
MagnetAutomate.WorkflowRun.outputPath String The output path for the workflow run.
MagnetAutomate.WorkflowRun.startDateTime Date The date and time when the workflow run started.
MagnetAutomate.WorkflowRun.endDateTime Date The date and time when the workflow run ended.
MagnetAutomate.WorkflowRun.automateVersion String The version of Magnet Automate used.
MagnetAutomate.WorkflowRun.createdBy Unknown Information about the user who created the workflow run.
MagnetAutomate.WorkflowRun.duration Number The duration of the workflow run in seconds.
MagnetAutomate.WorkflowRun.completedStages Unknown A list of completed stages in the workflow run.

Command Example

!mf-automate-workflow-run-list case_id=10

Command Example

!mf-automate-workflow-run-list case_id=10 run_id=11

mf-automate-workflow-run-delete

Deletes a specific workflow run from a case.

Base Command

mf-automate-workflow-run-delete

Input

Argument Name Description Required
case_id The unique identifier of the case. Required
run_id The unique identifier of the workflow run to delete. Required

Context Output

There is no context output for this command.

Command Example

!mf-automate-workflow-run-delete case_id=10 run_id=11

mf-automate-workflow-run-cancel

Cancels a specific workflow run.

Base Command

mf-automate-workflow-run-cancel

Input

Argument Name Description Required
case_id The unique identifier of the case. Required
run_id The unique identifier of the workflow run to cancel. Required

Context Output

There is no context output for this command.

Command Example

!mf-automate-workflow-run-cancel case_id=10 run_id=11

mf-automate-merge-workflow-run-start

Starts a merge workflow run for multiple existing workflow runs.

Base Command

mf-automate-merge-workflow-run-start

Input

Argument Name Description Required
case_id The unique identifier of the case. Required
run_ids A list of workflow run identifiers to merge. Required
workflow_id The unique identifier of the merge workflow to run. Required
output_path The directory path where the merged output will be stored. Optional
assigned_node_name The name of the specific node to assign the merge workflow run to. Optional

Context Output

Path Type Description
MagnetAutomate.WorkflowRun.id Number The unique identifier of the started merge workflow run.
MagnetAutomate.WorkflowRun.path String The path to the merge workflow run data.
MagnetAutomate.WorkflowRun.version Number The version of the workflow run.
MagnetAutomate.WorkflowRun.caseId Number The identifier of the associated case.
MagnetAutomate.WorkflowRun.caseTypeId Number The identifier of the case type.
MagnetAutomate.WorkflowRun.basePath String The base path for the workflow run.
MagnetAutomate.WorkflowRun.automateVersion String The version of Magnet Automate used.

Command Example

!mf-automate-merge-workflow-run-start case_id=10 run_ids="1,2,3" workflow_id=3 output_path="C:\\testdata\\output" assigned_node_name="AGENT1"

mf-automate-workflow-list

Retrieves a list of all available workflows.

Base Command

mf-automate-workflow-list

Input

Argument Name Description Required
limit The maximum number of results to return. Default value is 50. Default is 50. Optional
all_results Whether to return all of the results. Overrides the limit argument if used. Default value is False. Optional

Context Output

Path Type Description
MagnetAutomate.Workflow.id Number The unique identifier of the workflow.
MagnetAutomate.Workflow.name String The name of the workflow.
MagnetAutomate.Workflow.type.name String The name of the workflow type.
MagnetAutomate.Workflow.description String A description of the workflow.
MagnetAutomate.Workflow.outputPath String The default output path for the workflow.

Command Example

!mf-automate-workflow-list limit=10

mf-automate-workflow-delete

Deletes a specific workflow from Magnet Automate.

Base Command

mf-automate-workflow-delete

Input

Argument Name Description Required
workflow_id The unique identifier of the workflow to delete. Required

Context Output

There is no context output for this command.

Command Example

!mf-automate-workflow-delete workflow_id=5

mf-automate-workflow-get

Retrieves detailed information and export data for a specific workflow. Use mf-automate-workflow-list to get all available workflows.

Base Command

mf-automate-workflow-get

Input

Argument Name Description Required
workflow_id The unique identifier of the workflow to retrieve. Required

Context Output

Path Type Description
MagnetAutomate.Workflow.id Number The unique identifier of the workflow.
MagnetAutomate.Workflow.automateVersion String The version of Magnet Automate the workflow was created in.
MagnetAutomate.Workflow.name String The name of the workflow.
MagnetAutomate.Workflow.description String A description of the workflow.
MagnetAutomate.Workflow.sourceType String The type of evidence source the workflow accepts.
MagnetAutomate.Workflow.sourceConfig Unknown Configuration details for the evidence source.
MagnetAutomate.Workflow.outputPath String The output path for the workflow.
MagnetAutomate.Workflow.keylistPath String The path to the keylist used by the workflow.
MagnetAutomate.Workflow.passwordListPath String The path to the password list used by the workflow.
MagnetAutomate.Workflow.continueOnDecryptionFail String Whether the workflow continues if decryption fails.
MagnetAutomate.Workflow.distribution String The distribution settings for the workflow.
MagnetAutomate.Workflow.localMode Boolean Whether the workflow runs in local mode.
MagnetAutomate.Workflow.timeExported Date The date and time when the workflow was exported.

Command Example

!mf-automate-workflow-get workflow_id=5

mf-automate-node-create

Creates a new node (agent) in Magnet Automate.

Base Command

mf-automate-node-create

Input

Argument Name Description Required
name The name of the node. Optional
address The network address or hostname of the node. Optional
working_directory The working directory for the node. Optional
applications_json A JSON array of applications installed on the node. Optional

Context Output

Path Type Description
MagnetAutomate.Node.id Number The unique identifier of the created node.
MagnetAutomate.Node.name String The name of the node.
MagnetAutomate.Node.status String The current status of the node.
MagnetAutomate.Node.workingDirectory String The working directory of the node.
MagnetAutomate.Node.address String The network address of the node.
MagnetAutomate.Node.applications Unknown A list of applications installed on the node.

Command Example

!mf-automate-node-create name="NODE-002" address="automate-node-2" working_directory="C:\\automate\\temp" applications_json="[{\"applicationName\": \"AXIOM Process\", \"applicationVersion\": \"7.0.0\", \"applicationPath\": \"C:\\\\Program Files\\\\Magnet Forensics\\\\Magnet AUTOMATE\\\\agent\\\\AXIOM Process\\\\AXIOMProcess.CLI.exe\"}]"

mf-automate-nodes-list

Retrieves a list of all available nodes (agents).

Base Command

mf-automate-nodes-list

Input

Argument Name Description Required
limit The maximum number of results to return. Default value is 50. Default is 50. Optional
all_results Whether to return all of the results. Overrides the limit argument if used. Default value is False. Optional

Context Output

Path Type Description
MagnetAutomate.Node.id Number The unique identifier of the node.
MagnetAutomate.Node.name String The name of the node.
MagnetAutomate.Node.status String The current status of the node.
MagnetAutomate.Node.workingDirectory String The working directory of the node.
MagnetAutomate.Node.address String The network address of the node.
MagnetAutomate.Node.applications Unknown A list of applications installed on the node.

Command Example

!mf-automate-nodes-list limit=10

mf-automate-node-update

Updates the configuration of an existing node.

Base Command

mf-automate-node-update

Input

Argument Name Description Required
node_id The unique identifier of the node to update. Required
address The new network address or hostname of the node. Optional
working_directory The new working directory for the node. Optional
applications_json A JSON array of applications installed on the node. Optional

Context Output

There is no context output for this command.

Command Example

!mf-automate-node-update node_id=1 address="automate-node-updated" working_directory="C:\\automate\\updatedTemp" applications_json="[{\"applicationName\": \"AXIOM Process\", \"applicationVersion\": \"7.1.0\"}]"

mf-automate-node-delete

Deletes a specific node from Magnet Automate.

Base Command

mf-automate-node-delete

Input

Argument Name Description Required
node_id The unique identifier of the node to delete. Required

Context Output

There is no context output for this command.

Command Example

!mf-automate-node-delete node_id=1

Configuration parameters

  • url — Server URL (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (17)

  • mf-automate-case-cancel

    Cancels an ongoing case in Magnet Automate.

  • mf-automate-case-create

    Creates a new case in Magnet Automate. Use mf-automate-custom-fields-list to get all available custom fields.

  • mf-automate-case-delete

    Deletes a specific case from Magnet Automate.

  • mf-automate-cases-list

    Retrieves a list of all cases or information about a specific case.

  • mf-automate-custom-fields-list

    Retrieves a list of custom fields for cases and evidence sources.

  • mf-automate-merge-workflow-run-start

    Starts a merge workflow run for multiple existing workflow runs.

  • mf-automate-node-create

    Creates a new node (agent) in Magnet Automate.

  • mf-automate-node-delete

    Deletes a specific node from Magnet Automate.

  • mf-automate-node-update

    Updates the configuration of an existing node.

  • mf-automate-nodes-list

    Retrieves a list of all available nodes (agents).

  • mf-automate-workflow-delete

    Deletes a specific workflow from Magnet Automate.

  • mf-automate-workflow-get

    Retrieves detailed information and export data for a specific workflow. Use mf-automate-workflow-list to get all available workflows.

  • mf-automate-workflow-list

    Retrieves a list of all available workflows.

  • mf-automate-workflow-run-cancel

    Cancels a specific workflow run.

  • mf-automate-workflow-run-delete

    Deletes a specific workflow run from a case.

  • mf-automate-workflow-run-list

    Retrieves a list of all workflow runs for a specific case or details of a specific run.

  • mf-automate-workflow-run-start

    Starts a new workflow run and associates it with a specific case.

Source

MagnetAutomate.py MagnetAutomate_test.py MagnetAutomate.yml MagnetAutomate_description.md command_examples.txt
Download History Raw 
category: Forensics & Malware Analysis
commonfields:
  id: MagnetAutomate
  version: -1
provider: Magnet Forensics
configuration:
- defaultvalue: https://127.0.0.1:8080/
  display: Server URL
  name: url
  required: true
  type: 0
  additionalinfo: "Format: `https://{hostName}:{port}`"
  section: Connect
- name: credentials
  displaypassword: API Key
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Magnet Automate is an orchestration and automation platform that accelerates your digital forensics investigations by automating workflows and integrating with various forensic tools.
display: Magnet Automate Beta
name: MagnetAutomate
script:
  commands:

  - name: mf-automate-custom-fields-list
    description: Retrieves a list of custom fields for cases and evidence sources.
    execution: false
    arguments:
    - name: limit
      required: false
      defaultValue: 50
      description: The maximum number of results to return.
    - name: all_results
      required: false
      defaultValue: false
      description: Whether to return all of the results. Overrides the limit argument if used.
    outputs:
    - contextPath: MagnetAutomate.CustomFields.id
      description: The unique identifier of the custom field.
      type: Number
    - contextPath: MagnetAutomate.CustomFields.name
      description: The name of the custom field.
      type: String
    - contextPath: MagnetAutomate.CustomFields.type
      description: The data type of the custom field.
      type: String
    - contextPath: MagnetAutomate.CustomFields.elementType
      description: The element type of the custom field.
      type: Unknown
    - contextPath: MagnetAutomate.CustomFields.description
      description: A description of the custom field.
      type: String
    - contextPath: MagnetAutomate.CustomFields.required
      description: Whether the custom field is required.
      type: Boolean
    - contextPath: MagnetAutomate.CustomFields.exposeInWorkflow
      description: Whether the custom field is exposed in workflows.
      type: Boolean
    - contextPath: MagnetAutomate.CustomFields.variableName
      description: The variable name associated with the custom field.
      type: String

  - name: mf-automate-case-create
    description: Creates a new case in Magnet Automate. Use mf-automate-custom-fields-list to get all available custom fields.
    execution: false
    arguments:
    - name: case_number
      required: true
      description: The unique case number to assign to the new case.
    - name: custom_field_values
      required: false
      description: 'A JSON object containing custom field values for the case. For example, custom_field_values="{\"2\": \"Civil\", \"3\": \"Magnet Forensics\"}".'
    outputs:
    - contextPath: MagnetAutomate.Case.id
      description: The unique identifier of the created case.
      type: Number
    - contextPath: MagnetAutomate.Case.caseNumber
      description: The case number assigned to the case.
      type: String
    - contextPath: MagnetAutomate.Case.customFieldValues
      description: The custom field values associated with the case.
      type: Unknown

  - name: mf-automate-cases-list
    description: Retrieves a list of all cases or information about a specific case.
    execution: false
    arguments:
    - name: case_id
      required: false
      description: The unique identifier of the case to retrieve.
    - name: limit
      required: false
      defaultValue: 50
      description: The maximum number of results to return.
    - name: all_results
      required: false
      defaultValue: false
      description: Whether to return all of the results. Overrides the limit argument if used.
    outputs:
    - contextPath: MagnetAutomate.Case.id
      description: The unique identifier of the case.
      type: Number
    - contextPath: MagnetAutomate.Case.caseNumber
      description: The case number.
      type: String

  - name: mf-automate-case-delete
    description: Deletes a specific case from Magnet Automate.
    execution: false
    arguments:
    - name: case_id
      required: true
      description: The unique identifier of the case to delete.

  - name: mf-automate-case-cancel
    description: Cancels an ongoing case in Magnet Automate.
    execution: false
    arguments:
    - name: case_id
      required: true
      description: The unique identifier of the case to cancel.

  - name: mf-automate-workflow-run-start
    description: Starts a new workflow run and associates it with a specific case.
    execution: false
    arguments:
    - name: case_id
      required: true
      description: The unique identifier of the case to associate the workflow run with.
    - name: evidence_number
      required: true
      description: An evidence number to apply to the evidence source.
    - name: type
      required: true
      description: A JSON object defining the evidence type and its parameters (e.g., ImageSource path).
    - name: workflow_id
      required: true
      description: The unique identifier of the workflow to run.
    - name: output_path
      required: false
      description: The directory path where the workflow output will be stored.
    - name: platform
      required: false
      description: The platform associated with the evidence.
    - name: decryption_type
      required: false
      description: The type of decryption to use (e.g., Password, RecoveryKey).
    - name: decryption_value
      required: false
      secret: true
      description: The decryption key or password.
    - name: continue_on_decryption_fail
      required: false
      description: Whether to continue the workflow if decryption fails.
    - name: custom_field_values
      required: false
      description: 'A JSON object containing custom field values for the workflow run. For example, custom_field_values="{\"2\": \"Civil\", \"3\": \"Magnet Forensics\"}".'
    - name: assigned_node_name
      required: false
      description: The name of the specific node to assign the workflow run to.
    outputs:
    - contextPath: MagnetAutomate.WorkflowRun.id
      description: The unique identifier of the started workflow run.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.path
      description: The path to the workflow run data.
      type: String
    - contextPath: MagnetAutomate.WorkflowRun.version
      description: The version of the workflow run.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.caseId
      description: The identifier of the associated case.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.caseTypeId
      description: The identifier of the case type.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.basePath
      description: The base path for the workflow run.
      type: String
    - contextPath: MagnetAutomate.WorkflowRun.automateVersion
      description: The version of Magnet Automate used for the run.
      type: String

  - name: mf-automate-workflow-run-list
    description: Retrieves a list of all workflow runs for a specific case or details of a specific run.
    execution: false
    arguments:
    - name: case_id
      required: true
      description: The unique identifier of the case to retrieve workflow runs for.
    - name: run_id
      required: false
      description: The unique identifier of a specific workflow run to retrieve.
    - name: limit
      required: false
      defaultValue: 50
      description: The maximum number of results to return.
    - name: all_results
      required: false
      defaultValue: false
      description: Whether to return all of the results. Overrides the limit argument if used.
    outputs:
    - contextPath: MagnetAutomate.WorkflowRun.id
      description: The unique identifier of the workflow run.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.evidence
      description: Details about the evidence associated with the run.
      type: Unknown
    - contextPath: MagnetAutomate.WorkflowRun.status
      description: The current status of the workflow run.
      type: String
    - contextPath: MagnetAutomate.WorkflowRun.workflowId
      description: The identifier of the workflow being run.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.currentStage
      description: Information about the current stage of the workflow run.
      type: Unknown
    - contextPath: MagnetAutomate.WorkflowRun.outputPath
      description: The output path for the workflow run.
      type: String
    - contextPath: MagnetAutomate.WorkflowRun.startDateTime
      description: The date and time the workflow run started.
      type: Date
    - contextPath: MagnetAutomate.WorkflowRun.endDateTime
      description: The date and time the workflow run ended.
      type: Date
    - contextPath: MagnetAutomate.WorkflowRun.automateVersion
      description: The version of Magnet Automate used.
      type: String
    - contextPath: MagnetAutomate.WorkflowRun.createdBy
      description: Information about the user who created the workflow run.
      type: Unknown
    - contextPath: MagnetAutomate.WorkflowRun.duration
      description: The duration of the workflow run in seconds.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.completedStages
      description: A list of completed stages in the workflow run.
      type: Unknown

  - name: mf-automate-workflow-run-delete
    description: Deletes a specific workflow run from a case.
    execution: false
    arguments:
    - name: case_id
      required: true
      description: The unique identifier of the case.
    - name: run_id
      required: true
      description: The unique identifier of the workflow run to delete.

  - name: mf-automate-workflow-run-cancel
    description: Cancels a specific workflow run.
    execution: false
    arguments:
    - name: case_id
      required: true
      description: The unique identifier of the case.
    - name: run_id
      required: true
      description: The unique identifier of the workflow run to cancel.

  - name: mf-automate-merge-workflow-run-start
    description: Starts a merge workflow run for multiple existing workflow runs.
    execution: false
    arguments:
    - name: case_id
      required: true
      description: The unique identifier of the case.
    - name: run_ids
      required: true
      isArray: true
      description: A list of workflow run identifiers to merge.
    - name: workflow_id
      required: true
      description: The unique identifier of the merge workflow to run.
    - name: output_path
      required: false
      description: The directory path where the merged output will be stored.
    - name: assigned_node_name
      required: false
      description: The name of the specific node to assign the merge workflow run to.
    outputs:
    - contextPath: MagnetAutomate.WorkflowRun.id
      description: The unique identifier of the started merge workflow run.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.path
      description: The path to the merge workflow run data.
      type: String
    - contextPath: MagnetAutomate.WorkflowRun.version
      description: The version of the workflow run.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.caseId
      description: The identifier of the associated case.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.caseTypeId
      description: The identifier of the case type.
      type: Number
    - contextPath: MagnetAutomate.WorkflowRun.basePath
      description: The base path for the workflow run.
      type: String
    - contextPath: MagnetAutomate.WorkflowRun.automateVersion
      description: The version of Magnet Automate used.
      type: String

  - name: mf-automate-workflow-list
    description: Retrieves a list of all available workflows.
    execution: false
    arguments:
    - name: limit
      required: false
      defaultValue: 50
      description: The maximum number of results to return.
    - name: all_results
      required: false
      defaultValue: false
      description: Whether to return all of the results. Overrides the limit argument if used.
    outputs:
    - contextPath: MagnetAutomate.Workflow.id
      description: The unique identifier of the workflow.
      type: Number
    - contextPath: MagnetAutomate.Workflow.name
      description: The name of the workflow.
      type: String
    - contextPath: MagnetAutomate.Workflow.type.name
      description: The name of the workflow type.
      type: String
    - contextPath: MagnetAutomate.Workflow.description
      description: A description of the workflow.
      type: String
    - contextPath: MagnetAutomate.Workflow.outputPath
      description: The default output path for the workflow.
      type: String

  - name: mf-automate-workflow-delete
    description: Deletes a specific workflow from Magnet Automate.
    execution: false
    arguments:
    - name: workflow_id
      required: true
      description: The unique identifier of the workflow to delete.

  - name: mf-automate-workflow-get
    description: Retrieves detailed information and export data for a specific workflow. Use mf-automate-workflow-list to get all available workflows.
    execution: false
    arguments:
    - name: workflow_id
      required: true
      description: The unique identifier of the workflow to retrieve.
    outputs:
    - contextPath: MagnetAutomate.Workflow.id
      description: The unique identifier of the workflow.
      type: Number
    - contextPath: MagnetAutomate.Workflow.automateVersion
      description: The version of Magnet Automate the workflow was created in.
      type: String
    - contextPath: MagnetAutomate.Workflow.name
      description: The name of the workflow.
      type: String
    - contextPath: MagnetAutomate.Workflow.description
      description: A description of the workflow.
      type: String
    - contextPath: MagnetAutomate.Workflow.sourceType
      description: The type of evidence source the workflow accepts.
      type: String
    - contextPath: MagnetAutomate.Workflow.sourceConfig
      description: Configuration details for the evidence source.
      type: Unknown
    - contextPath: MagnetAutomate.Workflow.outputPath
      description: The output path for the workflow.
      type: String
    - contextPath: MagnetAutomate.Workflow.keylistPath
      description: The path to the keylist used by the workflow.
      type: String
    - contextPath: MagnetAutomate.Workflow.passwordListPath
      description: The path to the password list used by the workflow.
      type: String
    - contextPath: MagnetAutomate.Workflow.continueOnDecryptionFail
      description: Whether the workflow continues if decryption fails.
      type: String
    - contextPath: MagnetAutomate.Workflow.distribution
      description: The distribution settings for the workflow.
      type: String
    - contextPath: MagnetAutomate.Workflow.localMode
      description: Whether the workflow runs in local mode.
      type: Boolean
    - contextPath: MagnetAutomate.Workflow.timeExported
      description: The date and time the workflow was exported.
      type: Date

  - name: mf-automate-node-create
    description: Creates a new node (agent) in Magnet Automate.
    execution: false
    arguments:
    - name: name
      required: false
      description: The name of the node.
    - name: address
      required: false
      description: The network address or hostname of the node.
    - name: working_directory
      required: false
      description: The working directory for the node.
    - name: applications_json
      required: false
      description: A JSON array of applications installed on the node.
    outputs:
    - contextPath: MagnetAutomate.Node.id
      description: The unique identifier of the created node.
      type: Number
    - contextPath: MagnetAutomate.Node.name
      description: The name of the node.
      type: String
    - contextPath: MagnetAutomate.Node.status
      description: The current status of the node.
      type: String
    - contextPath: MagnetAutomate.Node.workingDirectory
      description: The working directory of the node.
      type: String
    - contextPath: MagnetAutomate.Node.address
      description: The network address of the node.
      type: String
    - contextPath: MagnetAutomate.Node.applications
      description: A list of applications installed on the node.
      type: Unknown

  - name: mf-automate-nodes-list
    description: Retrieves a list of all available nodes (agents).
    execution: false
    arguments:
    - name: limit
      required: false
      defaultValue: 50
      description: The maximum number of results to return.
    - name: all_results
      required: false
      defaultValue: false
      description: Whether to return all of the results. Overrides the limit argument if used.
    outputs:
    - contextPath: MagnetAutomate.Node.id
      description: The unique identifier of the node.
      type: Number
    - contextPath: MagnetAutomate.Node.name
      description: The name of the node.
      type: String
    - contextPath: MagnetAutomate.Node.status
      description: The current status of the node.
      type: String
    - contextPath: MagnetAutomate.Node.workingDirectory
      description: The working directory of the node.
      type: String
    - contextPath: MagnetAutomate.Node.address
      description: The network address of the node.
      type: String
    - contextPath: MagnetAutomate.Node.applications
      description: A list of applications installed on the node.
      type: Unknown

  - name: mf-automate-node-update
    description: Updates the configuration of an existing node.
    execution: false
    arguments:
    - name: node_id
      required: true
      description: The unique identifier of the node to update.
    - name: address
      required: false
      description: The new network address or hostname of the node.
    - name: working_directory
      required: false
      description: The new working directory for the node.
    - name: applications_json
      required: false
      description: A JSON array of applications installed on the node.

  - name: mf-automate-node-delete
    description: Deletes a specific node from Magnet Automate.
    execution: false
    arguments:
    - name: node_id
      required: true
      description: The unique identifier of the node to delete.

  isfetch: false
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/fastapi:0.125.0.11206988
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform
beta: true
tests:
- No tests
sectionorder:
- Connect