OpenAi ChatGPT v3

Details

ID	`OpenAi ChatGPT v3`
Provider	OpenAI
Category	Messaging and Conferencing
From Version	6.0.0
Docker Image	`demisto/parse-emails:0.1.48.10120494`
Supported Modules	Agentix XSIAM

README

OpenAI GPT

Instance Configuration

Generate an API Key
1. Sign up or log in to OpenAI developer platform.
2. Generate a new API key at OpenAI developer platform - api-keys.
Choose a GPT model to interact with
1. This integration supports only the ‘Chat Completions’ endpoint. Therefore, you can only configure models that support this endpoint (https://api.openai.com/v1/chat/completions).
2. For tasks requiring deep understanding and extensive inputs, opt for more advanced models (e.g. gpt-4). These models offer a larger context window, allowing them to process bigger documents, and provide more refined and comprehensive responses.
  The more elementary models (e.g. gpt-3.5) often provide shallower answers and input analysis.
  Refer to Models overview for more information.
Text generation setting (Optional)
1. max-tokens: The maximum number of tokens that can be generated for the response. (Allows controlling tokens’ consumption). Default: unset.
2. temperature: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety. It is generally recommended altering this or top_p but not both. Default: 1.
3. top_p: Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Lower values (closer to 0) result in more focused outputs, while higher values (closer to 1) increase diversity. It is generally recommended altering this or temperature but not both. Default: unset.
Event Collector — Generate API Keys
1. Admin API Key (required for OpenAI Audit logs): generate from the OpenAI Platform admin console. Used to call /v1/organization/audit_logs.
2. Compliance API Key (required for any Compliance event type): generate from the ChatGPT Platform. Used to call /v1/compliance/workspaces/{workspace_id}/....
3. Workspace ID (required for any Compliance event type): the UUID of the compliance workspace whose events you want to collect.

Event Collector — Select event types to fetch

Toggle Fetch events, then select one or more Events types to fetch:

User-facing label	Source	Required credentials
OpenAI Audit logs	OpenAI Platform — Admin API	Admin API Key
Conversation Messages	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID
Apps	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID
Apps Auth	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID
Compliance Audit	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID
Auth	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID
Codex	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID
ChatGPT	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID
Codex Security	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID
Workspace Agents	ChatGPT Platform — Compliance API	Compliance API Key + Workspace ID

Selecting an event type without its matching credentials raises an informative error at instance test time, naming the missing parameter.

Event Collector — Datasets

Each Event Collector stream lands in its own Cortex dataset:

Stream	Vendor	Product	Dataset
OpenAI Audit logs	`openai`	`chatgpt_audit`	`openai_chatgpt_audit_raw`
Compliance logs (all)	`openai`	`chatgpt_compliance`	`openai_chatgpt_compliance_raw`

Event Collector — Tuning (Optional)

Parameter	Default	Description
Maximum number of OpenAI Audit events per fetch	1000	Cap on Audit events ingested per fetch cycle.
Maximum number of Compliance events per fetch	900	Cap on Compliance events ingested per fetch cycle.
Events Fetch Interval	1 minute	How often the scheduled fetch runs.
ChatGPT Server URL	`https://api.chatgpt.com`	Base URL of the ChatGPT Compliance API. Override only for non-default tenants.

Click ‘Test’

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.

gpt-send-message

Send a message as a prompt to the GPT model.

!gpt-send-message message="<MESSAGE_TEXT>"

Input

Argument Name	Description	Required
message	The message to send to the GPT model wrapped with quotes.	Yes
reset_conversation_history	Whether to reset conversation history or keep it as context for the sent message. (Conversation history is not reset by default).	No
max_tokens	The maximum number of tokens that can be generated for the response. Overrides text generation setting for the specific message sent.	No
temperature	Sets the randomness in responses. Overrides text generation setting for the specific message sent.	No
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Overrides text generation setting for the specific message sent.	No

gpt-check-email-body

Check email body for possible security issues.

!gpt-check-email-body entryId="<ENTRY_ID_OF_UPLOADED_EML_FILE>"

Input

Argument Name	Description	Required
entryId	Entry ID of an uploaded .eml file from the context window.	Yes
additionalInstructions	Provide additional instructions for the GPT model when analyzing the email body.	No
max_tokens	The maximum number of tokens that can be generated for the response. Overrides text generation setting for the specific message sent.	No
temperature	Sets the randomness in responses. Overrides text generation setting for the specific message sent.	No
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Overrides text generation setting for the specific message sent.	No

gpt-check-email-header

Check email body for possible security issues.

!gpt-check-email-header entryId="<ENTRY_ID_OF_UPLOADED_EML_FILE>"

Input

Argument Name	Description	Required
entryId	Entry ID of an uploaded .eml file from context window.	Yes
additionalInstructions	Provide additional instructions for the GPT model when analyzing the email headers.	No
max_tokens	The maximum number of tokens that can be generated for the response. Overrides text generation setting for the specific message sent.	No
temperature	Sets the randomness in responses. Overrides text generation setting for the specific message sent.	No
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Overrides text generation setting for the specific message sent.	No

gpt-analyze-email-header

Analyze email headers for potential security issues using the OpenAI Responses API. This command uses the Responses API which is recommended for all new projects (instead of gpt-check-email-header which uses the Chat Completions API).

!gpt-analyze-email-header entry_id="3@123" additional_instructions="Pay close attention to SPF/DKIM."

Input

Argument Name	Description	Required
entry_id	Entry ID of an uploaded .eml file.	Yes
additional_instructions	Additional instructions or security issue to focus on. Substituted into the prompt template.	No
max_tokens	The maximum number of tokens that can be generated for the response. Maps internally to the API body field `max_output_tokens`.	No
temperature	Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety.	No
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Range 0–1.	No
reasoning_effort	Reasoning effort level for reasoning models (o1, o3, o4, gpt-5). Controls how much thinking the model does before responding. Possible values: `low`, `medium`, `high`.	No

Context Output

Path	Type	Description
OpenAiChatGPTV3.Response	Unknown	The conversation state including the response_id.
OpenAiChatGPTV3.Response.user	String	The prompt sent to the model.
OpenAiChatGPTV3.Response.assistant	String	The assistant response text.
OpenAiChatGPTV3.Response.response_id	String	The OpenAI response ID.

Human Readable Output

Two war-room entries are produced:

A table of the parsed email headers.
The AI verdict followed by a token-usage table. A Reasoning tokens row appears in the usage table when a reasoning model is used.

gpt-analyze-email-body

Analyze email body for potential security risks using the OpenAI Responses API. This command uses the Responses API which is recommended for all new projects (instead of gpt-check-email-body which uses the Chat Completions API).

!gpt-analyze-email-body entry_id="3@123"

Input

Argument Name	Description	Required
entry_id	Entry ID of an uploaded .eml file.	Yes
additional_instructions	Additional instructions or security issue to focus on. Substituted into the prompt template.	No
max_tokens	The maximum number of tokens that can be generated for the response. Maps internally to the API body field `max_output_tokens`.	No
temperature	Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety.	No
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Range 0–1.	No
reasoning_effort	Reasoning effort level for reasoning models (o1, o3, o4, gpt-5). Controls how much thinking the model does before responding. Possible values: `low`, `medium`, `high`.	No

Context Output

Path	Type	Description
OpenAiChatGPTV3.Response	Unknown	The conversation state including the response_id.
OpenAiChatGPTV3.Response.user	String	The prompt sent to the model.
OpenAiChatGPTV3.Response.assistant	String	The assistant response text.
OpenAiChatGPTV3.Response.response_id	String	The OpenAI response ID.

Human Readable Output

Two war-room entries are produced:

A table of the parsed email body (text and HTML).
The AI verdict followed by a token-usage table. A Reasoning tokens row appears in the usage table when a reasoning model is used.

gpt-create-soc-email-template

Create an email template out of the conversation context to be sent from the SOC.

!gpt-create-soc-email-template

Input

Argument Name	Description	Required
additionalInstructions	Provide additional instructions for the GPT model when analyzing the email headers.	No
max_tokens	The maximum number of tokens that can be generated for the response. Overrides text generation setting for the specific message sent.	No
temperature	Sets the randomness in responses. Overrides text generation setting for the specific message sent.	No
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Overrides text generation setting for the specific message sent.	No

gpt-draft-soc-email

Draft a SOC email template using the OpenAI Responses API. This command uses the Responses API which is recommended for all new projects (instead of gpt-create-soc-email-template which uses the Chat Completions API). Consumes prior conversation context by design (e.g. from a preceding gpt-analyze-email-body call).

Cortex XSOAR sequence (typical phishing flow)

!gpt-analyze-email-body entry_id="3@123"
…assistant returns analysis…
!gpt-draft-soc-email additional_instructions="Notify the user the email was quarantined."

Input

Argument Name	Description	Required
additional_instructions	Specific issue or focus area to weave into the template. Substituted into the prompt template.	No
max_tokens	The maximum number of tokens that can be generated for the response. Maps internally to the API body field `max_output_tokens`.	No
temperature	Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety.	No
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Range 0–1.	No
reasoning_effort	Reasoning effort level for reasoning models (o1, o3, o4, gpt-5). Controls how much thinking the model does before responding. Possible values: `low`, `medium`, `high`.	No

Context Output

Path	Type	Description
OpenAiChatGPTV3.Response	Unknown	The conversation state including the response_id.
OpenAiChatGPTV3.Response.user	String	The prompt sent to the model.
OpenAiChatGPTV3.Response.assistant	String	The assistant response text.
OpenAiChatGPTV3.Response.response_id	String	The OpenAI response ID.

Human Readable Output

Two war-room entries are produced:

The SOC email template context output (replace_existing=True — running twice overwrites the previous draft).
The AI-generated template followed by a token-usage table. A Reasoning tokens row appears in the usage table when a reasoning model is used.

openai-get-events

Manually fetch a bounded batch of Audit and/or Compliance events for development/debugging. Does NOT advance the persisted last_run cursor, so it is safe to run against production tenants. Use should_push_events=true to additionally ingest the fetched events into the matching Cortex dataset.

Base Command

openai-get-events

Input

Argument Name	Description	Required
event_type	The event type(s) to fetch. Comma-separated list. Possible values: `OpenAI Audit logs`, `Conversation Messages`, `Apps`, `Apps Auth`, `Compliance Audit`, `Auth`, `Codex`, `ChatGPT`, `Codex Security`, `Workspace Agents`. Defaults to the values configured in the integration parameters.	No
limit	Maximum number of events to return per stream. Default: `50`.	No
start_time	Lookback start time for the fetch. Supports ISO 8601 or relative time (e.g., `3 days ago`, `2099-01-01T00:00:00Z`).	No
should_push_events	If `true`, the command also pushes the retrieved events to Cortex (Audit -> `openai_chatgpt_audit_raw`, Compliance -> `openai_chatgpt_compliance_raw`). Possible values: `true`, `false`. Default: `false`.	No

Context Output

Path	Type	Description
OpenAI.Event.id	String	The unique identifier of the event.
OpenAI.Event._event_type	String	The upstream event_type for Compliance events. Left empty for Audit events.
OpenAI.Event.source_log_type	String	The source log type used by downstream parsing rules.
OpenAI.Event._time	Date	The event timestamp in ISO 8601 format.

Human Readable Output

OpenAI GPT Events

id _event_type source_log_type _time

FAKE_AUDIT_EVENT_001 openai_audit_logs 2099-01-01T00:00:00Z

FAKE_LISTING_002 AUDIT_LOG compliance_audit_log 2099-01-02T00:00:00Z

id	_event_type	source_log_type	_time
FAKE_AUDIT_EVENT_001		openai_audit_logs	2099-01-01T00:00:00Z
FAKE_LISTING_002	AUDIT_LOG	compliance_audit_log	2099-01-02T00:00:00Z

gpt-create-response

Sends a message to the OpenAI Responses API and receives the generated response. This command uses the Responses API which is recommended for all new projects (instead of gpt-send-message which uses the Chat Completions API). Supports multi-turn conversations via previous_response_id, reasoning effort control for o-series and gpt-5 models, and background execution.

Base Command

gpt-create-response

Input

Argument Name	Description	Required
message	The user message to send.	Required
reset_conversation_history	Whether to discard the existing conversation context and start fresh. Possible values are: yes, no. Default is no.	Optional
max_tokens	The maximum number of output tokens. Falls back to instance config. Maps internally to the API body field max_output_tokens.	Optional
temperature	The randomness level in responses. Falls back to instance config. Range 0-2. Lower values produce more deterministic outputs, while higher values increase variety.	Optional
top_p	The nucleus sampling threshold. Falls back to instance config. Range 0-1. Lower values result in more focused outputs, while higher values increase diversity.	Optional
reasoning_effort	The reasoning effort level. Honored only for reasoning families (o1, o3, o4, gpt-5); silently dropped on others. Default medium. Possible values are: none, minimal, low, medium, high, xhigh.	Optional
background	Whether to run the model response in the background. When true, the command uses polling to wait for the response to complete. Possible values are: true, false.	Optional
compact_threshold	The token threshold at which compaction should be triggered for this entry. Minimum 1000.	Optional
model	The model to use. Use the gpt-list-models command to see available models. Falls back to instance config.	Optional

Context Output

Path	Type	Description
OpenAiChatGPTV3.Response	Unknown	The conversation state, which includes the response_id for multi-turn continuity.
OpenAiChatGPTV3.Response.user	String	The user message sent.
OpenAiChatGPTV3.Response.assistant	String	The assistant response text.
OpenAiChatGPTV3.Response.response_id	String	The OpenAI response ID used for multi-turn conversation continuity.

gpt-list-models

Lists all models available to the configured API key. Lets users discover models per their actual API-key tier without redeploying the integration when OpenAI ships new ones.

Base Command

gpt-list-models

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
OpenAiChatGPTV3.Model.Id	String	The model identifier (e.g., gpt-4, gpt-3.5-turbo).
OpenAiChatGPTV3.Model.Created	Number	The Unix timestamp when the model was created.
OpenAiChatGPTV3.Model.OwnedBy	String	The organization or entity that owns the model.

gpt-create-moderation

Runs text or an image through the OpenAI Moderations API and returns per-category flagging results. Exactly one of text, entry_id, or image_url must be provided.

Base Command

gpt-create-moderation

Input

Argument Name	Description	Required
text	A comma-separated list of text strings to moderate. Exactly one of text, entry_id, or image_url must be provided.	Optional
entry_id	The war-room entry ID of an uploaded image file. The file is base64-encoded internally and posted as a data URL. Exactly one of text, entry_id, or image_url must be provided.	Optional
image_url	The publicly reachable HTTP(S) URL of an image (limited to 20 MB). Exactly one of text, entry_id, or image_url must be provided.	Optional
model	The moderation model to use. Possible values are: omni-moderation-latest, omni-moderation-2024-09-26. Default is omni-moderation-latest.	Optional

Context Output

Path	Type	Description
OpenAiChatGPTV3.Moderation.Input.input_type	String	The type of input that was moderated (text, image, or image_url).
OpenAiChatGPTV3.Moderation.Input.input_value	String	The value of the input that was moderated.
OpenAiChatGPTV3.Moderation.Flagged	Boolean	Whether the content was flagged by the moderation model.
OpenAiChatGPTV3.Moderation.Categories	Unknown	The object of boolean values indicating which categories were flagged.
OpenAiChatGPTV3.Moderation.CategoryScores	Unknown	The object of float values indicating the confidence score for each category.

<~PLATFORM>

License Requirements

The following configuration parameters require the Cortex XSIAM license:

Fetch events

</~PLATFORM>

Configuration parameters

url — Server URL (required)
chatgpt_api_url — ChatGPT Server URL
apikey —
admin_api_key — Admin API Key
compliance_api_key — Compliance API Key
workspace_id — Workspace ID
model-select — Model
model-freetext — Model (Optional - overrides selected choice)
max_tokens — Max tokens
temperature — Temperature
top_p — Top P
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch events
event_types_to_fetch — Events types to fetch
audit_max_fetch — Maximum number of OpenAI Audit events per fetch
compliance_max_fetch — Maximum number of Compliance events per fetch
eventFetchInterval — Events Fetch Interval

Commands (11)

gpt-analyze-email-body
Analyzes email body for potential security risks using the OpenAI Responses API. This is the Responses-API counterpart of gpt-check-email-body (which uses the Chat Completions API).
gpt-analyze-email-header
Analyzes email headers for potential security issues using the OpenAI Responses API. This is the Responses-API counterpart of gpt-check-email-header (which uses the Chat Completions API).
gpt-check-email-body
Checks the email body for possible security issues. Enables you to ask subsequent questions on the provided information using the 'gpt-send-message' command, and resets the conversation context by default.
gpt-check-email-header
Checking email header for possible security issues. It is possible to keep asking questions on the provided info using 'gpt-send-message'. Resets conversation context by default.
gpt-create-moderation
Runs text or an image through the OpenAI Moderations API and returns per-category flagging results. Exactly one of text, entry_id, or image_url must be provided.
gpt-create-response
Sends a message to the OpenAI Responses API and receives the generated response. This command uses the Responses API which is recommended for all new projects (instead of gpt-send-message which uses the Chat Completions API). Supports multi-turn conversations via previous_response_id, reasoning effort control for o-series and gpt-5 models, and background execution.
gpt-create-soc-email-template
Create an email template out of the conversation context to be sent from the SOC.
gpt-draft-soc-email
Drafts a SOC email template using the OpenAI Responses API. This command uses the Responses API which is recommended for all new projects (instead of gpt-create-soc-email-template which uses the Chat Completions API). Consumes prior conversation context by design (e.g. from a preceding gpt-analyze-email-body call).
gpt-list-models
Lists all models available to the configured API key. Lets users discover models per their actual API-key tier without redeploying the integration when OpenAI ships new ones.
gpt-send-message
Send a plain message to the selected GPT model and receive the generated response.
openai-get-events
Manually retrieves events from OpenAI. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.

Source

OpenAiChatGPTV3.py OpenAiChatGPTV3_test.py OpenAiChatGPTV3.yml OpenAiChatGPTV3_description.md command_examples.txt

Download History Raw

name: OpenAi ChatGPT v3
display: OpenAI GPT
category: Messaging and Conferencing
provider: OpenAI
sectionorder:
- Connect
- Collect
description: This integration assists security professionals with security investigations, threat hunting, and anomaly detection by leveraging OpenAI GPT models' natural language conversation capabilities.  
commonfields:
  id: OpenAi ChatGPT v3
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  defaultvalue: https://api.openai.com/
  section: Connect
  type: 0
- display: ChatGPT Server URL
  name: chatgpt_api_url
  type: 0
  required: false
  defaultvalue: https://api.chatgpt.com
  section: Connect
  additionalinfo: 'The base URL for the ChatGPT Platform Compliance APIs.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- displaypassword: OpenAI API Key
  name: apikey
  type: 9
  required: false
  section: Connect
  hiddenusername: true
  additionalinfo: 'The OpenAI Platform API key used by the chat-completion commands. Required only when running those commands or when running test-module without the event-collector keys.'
- display: Admin API Key
  name: admin_api_key
  type: 14
  required: false
  section: Connect
  additionalinfo: 'The Admin API key for the OpenAI Platform. Required only when fetching the "OpenAI Audit logs" event type.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Compliance API Key
  name: compliance_api_key
  type: 14
  required: false
  section: Connect
  additionalinfo: 'The Compliance API key for the ChatGPT Platform. Required when fetching Compliance event types.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Workspace ID
  name: workspace_id
  type: 0
  required: false
  section: Connect
  additionalinfo: 'The Compliance workspace UUID (for example, 4a4676f3-3d74-4723-b696-c93e6d01078a). Required when fetching Compliance event types.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Model
  additionalinfo: The model that will process the inputs and generate the completion.
  name: model-select
  type: 15
  required: false
  section: Connect
  defaultvalue: gpt-3.5-turbo
  options:
  - gpt-5
  - gpt-5-mini
  - gpt-5-nano
  - gpt-5-chat-latest
  - o4-mini-deep-research
  - o4-mini
  - o3-pro
  - o3
  - o3-deep-research
  - o3-mini
  - o1-pro
  - o1
  - o1-mini
  - gpt-4.1
  - gpt-4.1-mini
  - gpt-4.1-nano
  - gpt-4o
  - gpt-4o-2024-05-13
  - gpt-4o-mini
  - gpt-4o-mini-search-preview
  - gpt-4o-search-preview
- display: Model (Optional - overrides selected choice)
  additionalinfo: The model that will process the inputs and generate the completion.
  name: model-freetext
  type: 0
  required: false
  section: Connect
- display: Max tokens
  name: max_tokens
  additionalinfo: The maximum number of tokens that can be generated for the response. (Allows controlling tokens' consumption).
  type: 0
  required: false
  section: Connect
  advanced: true
- display: Temperature
  name: temperature
  additionalinfo: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety. It is generally recommended altering this or top_p but not both.
  type: 0
  required: false
  section: Connect
  advanced: true
- display: Top P
  name: top_p
  additionalinfo: "Enables nucleus sampling where only the top 'p' percent (0 to 1) of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity. It is generally recommended altering this or temperature but not both."
  type: 0
  required: false
  section: Connect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Events types to fetch
  name: event_types_to_fetch
  type: 16
  required: false
  section: Collect
  options:
  - OpenAI Audit logs
  - Conversation Messages
  - Apps
  - Apps Auth
  - Compliance Audit
  - Auth
  - Codex
  - ChatGPT
  - Codex Security
  - Workspace Agents
  defaultvalue: OpenAI Audit logs,Conversation Messages,Apps,Apps Auth,Compliance Audit,Auth,Codex,ChatGPT,Codex Security,Workspace Agents
  additionalinfo: 'The event types to fetch. OpenAI Audit logs uses the Admin API; all other selections use the Compliance API and require a Workspace ID.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Maximum number of OpenAI Audit events per fetch
  name: audit_max_fetch
  type: 0
  required: false
  defaultvalue: '1000'
  section: Collect
  additionalinfo: 'The maximum number of Audit events to return per fetch.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Maximum number of Compliance events per fetch
  name: compliance_max_fetch
  type: 0
  required: false
  defaultvalue: '900'
  section: Collect
  additionalinfo: 'The maximum number of Compliance events to return per fetch.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- defaultvalue: '1'
  display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
  hidden:
  - xsoar
  supportedModules:
  - xsiam
script:
  commands:
  - name: gpt-send-message
    description: Send a plain message to the selected GPT model and receive the generated response.
    arguments:
    - name: message
      required: true
      description: The message that the GPT model will respond to.

    - name: reset_conversation_history
      required: false
      description: Whether to keep previously sent messages in a conversation context or start a new conversation.
      predefined:
      - "yes"
      - "no"
    - name: max_tokens
      required: false
      description: The maximum number of tokens that can be generated for the response.

    - name: temperature
      required: false
      description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety. It is generally recommended altering this or top_p but not both.

    - name: top_p
      required: false
      description: (0-1) Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity. It is generally recommended altering this or temperature but not both.

    outputs:
    - contextPath: OpenAiChatGPTV3.Conversation
      description: Entire conversation (if not reset) between the user and the GPT model.
      type: Dictionary

  - name: gpt-check-email-header
    description: Checking email header for possible security issues. It is possible to keep asking questions on the provided info using 'gpt-send-message'. Resets conversation context by default.
    arguments:
    - name: entry_id
      description: Entry ID of an uploaded '.eml' file.
      required: true

    - name: additional_instructions
      description: Additional instructions or security issue to focus on.
      required: false

    - name: max_tokens
      required: false
      description: The maximum number of tokens that can be generated for the response.

    - name: temperature
      required: false
      description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety. It is generally recommended altering this or top_p but not both.

    - name: top_p
      required: false
      description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity. It is generally recommended altering this or temperature but not both.
    outputs:
    - contextPath: OpenAiChatGPTV3.Conversation
      description: Entire conversation (if not reset) between the user and the GPT model.
      type: Dictionary

  - name: gpt-analyze-email-header
    description: Analyzes email headers for potential security issues using the OpenAI Responses API. This is the Responses-API counterpart of gpt-check-email-header (which uses the Chat Completions API).
    arguments:
    - name: entry_id
      description: The entry ID of an uploaded .eml file.
      required: true
      type: String

    - name: additional_instructions
      description: The additional instructions or security issue to focus on. Substituted into the prompt template.
      required: false
      type: String

    - name: max_tokens
      required: false
      description: The maximum number of tokens that can be generated for the response. Maps internally to the API body field max_output_tokens.
      type: Number

    - name: temperature
      required: false
      description: The randomness level in responses. Lower values (closer to 0) produce more deterministic outputs, while higher values (up to 2) increase variety. It is generally recommended to alter this or top_p but not both.
      type: Number

    - name: top_p
      required: false
      description: The nucleus sampling threshold where only the top p percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity. Range 0-1. It is generally recommended to alter this or temperature but not both.
      type: Number

    - name: reasoning_effort
      required: false
      description: The reasoning effort level for reasoning models (o1, o3, o4, gpt-5). Controls how much thinking the model does before responding.
      auto: PREDEFINED
      predefined:
      - 'low'
      - 'medium'
      - 'high'
      type: String
    outputs:
    - contextPath: OpenAiChatGPTV3.Response
      description: The conversation state including the response_id.
      type: Unknown
    - contextPath: OpenAiChatGPTV3.Response.user
      description: The prompt sent to the model.
      type: String
    - contextPath: OpenAiChatGPTV3.Response.assistant
      description: The assistant response text.
      type: String
    - contextPath: OpenAiChatGPTV3.Response.response_id
      description: The OpenAI response ID.
      type: String

  - name: gpt-analyze-email-body
    description: Analyzes email body for potential security risks using the OpenAI Responses API. This is the Responses-API counterpart of gpt-check-email-body (which uses the Chat Completions API).
    arguments:
    - name: entry_id
      description: The entry ID of an uploaded .eml file.
      required: true
      type: String

    - name: additional_instructions
      description: The additional instructions or security issue to focus on. Substituted into the prompt template.
      required: false
      type: String

    - name: max_tokens
      required: false
      description: The maximum number of tokens that can be generated for the response. Maps internally to the API body field max_output_tokens.
      type: Number

    - name: temperature
      required: false
      description: The randomness level in responses. Lower values (closer to 0) produce more deterministic outputs, while higher values (up to 2) increase variety. It is generally recommended to alter this or top_p but not both.
      type: Number

    - name: top_p
      required: false
      description: The nucleus sampling threshold where only the top p percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity. Range 0-1. It is generally recommended to alter this or temperature but not both.
      type: Number

    - name: reasoning_effort
      required: false
      description: The reasoning effort level for reasoning models (o1, o3, o4, gpt-5). Controls how much thinking the model does before responding.
      auto: PREDEFINED
      predefined:
      - 'low'
      - 'medium'
      - 'high'
      type: String
    outputs:
    - contextPath: OpenAiChatGPTV3.Response
      description: The conversation state including the response_id.
      type: Unknown
    - contextPath: OpenAiChatGPTV3.Response.user
      description: The prompt sent to the model.
      type: String
    - contextPath: OpenAiChatGPTV3.Response.assistant
      description: The assistant response text.
      type: String
    - contextPath: OpenAiChatGPTV3.Response.response_id
      description: The OpenAI response ID.
      type: String

  - name: gpt-check-email-body
    description: Checks the email body for possible security issues. Enables you to ask subsequent questions on the provided information using the 'gpt-send-message' command, and resets the conversation context by default.  
    arguments:
    - name: entry_id
      description: Entry ID of an uploaded '.eml' file.
      required: true

    - name: additional_instructions
      description: Additional instructions or security issue to focus on.
      required: false

    - name: max_tokens
      required: false
      description: The maximum number of tokens that can be generated for the response.

    - name: temperature
      required: false
      description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety. It is generally recommended altering this or top_p but not both.

    - name: top_p
      required: false
      description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity. It is generally recommended altering this or temperature but not both.
    outputs:
    - contextPath: OpenAiChatGPTV3.Conversation
      description: Entire conversation (if not reset) between the user and the GPT model.
      type: Dictionary

  - name: openai-get-events
    description: Manually retrieves events from OpenAI. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    arguments:
    - name: event_type
      description: 'A comma-separated list of event types to retrieve. If not specified, uses the value configured in the integration parameters.'
      auto: PREDEFINED
      isArray: true
      predefined:
      - 'OpenAI Audit logs'
      - 'Conversation Messages'
      - 'Apps'
      - 'Apps Auth'
      - 'Compliance Audit'
      - 'Auth'
      - 'Codex'
      - 'ChatGPT'
      - 'Codex Security'
      - 'Workspace Agents'
    - name: limit
      description: 'The maximum number of events to return per stream.'
      defaultValue: '50'
    - name: start_time
      description: 'The lookback start time for the fetch. Supports ISO 8601 or relative time (for example, "3 days ago", "2099-01-01T00:00:00Z").'
    - name: should_push_events
      description: 'Whether retrieved events are also ingested by Cortex.'
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: OpenAI.Event.id
      description: The unique identifier of the event.
      type: String
    - contextPath: OpenAI.Event._event_type
      description: The upstream event_type for Compliance events. Left empty for Audit events.
      type: String
    - contextPath: OpenAI.Event.source_log_type
      description: The source log type used by downstream parsing rules.
      type: String
    - contextPath: OpenAI.Event._time
      description: The event timestamp in ISO 8601 format.
      type: Date
  - name: gpt-create-soc-email-template
    description: Create an email template out of the conversation context to be sent from the SOC.
    arguments:
    - name: additional_instructions
      description: Additional instructions or security issue to focus on.
      required: false

    - name: max_tokens
      required: false
      description: The maximum number of tokens that can be generated for the response.

    - name: temperature
      required: false
      description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 2) increase randomness and variety. It is generally recommended altering this or top_p but not both.

    - name: top_p
      required: false
      description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity. It is generally recommended altering this or temperature but not both.
    outputs:
    - contextPath: OpenAiChatGPTV3.Conversation
      description: The entire conversation (if not reset) between the user and the GPT model.  
      type: Dictionary
  - name: gpt-draft-soc-email
    description: Drafts a SOC email template using the OpenAI Responses API. This command uses the Responses API which is recommended for all new projects (instead of gpt-create-soc-email-template which uses the Chat Completions API). Consumes prior conversation context by design (e.g. from a preceding gpt-analyze-email-body call).
    arguments:
    - name: additional_instructions
      description: The specific issue or focus area to weave into the template. Substituted into the prompt template.
      required: false
      type: String

    - name: max_tokens
      required: false
      description: The maximum number of tokens that can be generated for the response. Maps internally to the API body field max_output_tokens.
      type: Number

    - name: temperature
      required: false
      description: The randomness level in responses. Lower values (closer to 0) produce more deterministic outputs, while higher values (up to 2) increase variety. It is generally recommended to alter this or top_p but not both.
      type: Number

    - name: top_p
      required: false
      description: The nucleus sampling threshold where only the top p percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity. Range 0-1. It is generally recommended to alter this or temperature but not both.
      type: Number

    - name: reasoning_effort
      required: false
      description: The reasoning effort level for reasoning models (o1, o3, o4, gpt-5). Controls how much thinking the model does before responding.
      auto: PREDEFINED
      predefined:
      - 'low'
      - 'medium'
      - 'high'
      type: String
    outputs:
    - contextPath: OpenAiChatGPTV3.Response
      description: The conversation state including the response_id.
      type: Unknown
    - contextPath: OpenAiChatGPTV3.Response.user
      description: The prompt sent to the model.
      type: String
    - contextPath: OpenAiChatGPTV3.Response.assistant
      description: The assistant response text.
      type: String
    - contextPath: OpenAiChatGPTV3.Response.response_id
      description: The OpenAI response ID.
      type: String
  - name: gpt-create-response
    description: Sends a message to the OpenAI Responses API and receives the generated response. This command uses the Responses API which is recommended for all new projects (instead of gpt-send-message which uses the Chat Completions API). Supports multi-turn conversations via previous_response_id, reasoning effort control for o-series and gpt-5 models, and background execution.
    arguments:
    - name: message
      required: true
      description: The user message to send.
      type: String

    - name: reset_conversation_history
      required: false
      description: Whether to discard the existing conversation context and start fresh.
      defaultValue: 'no'
      auto: PREDEFINED
      predefined:
      - 'yes'
      - 'no'
      type: String

    - name: max_tokens
      required: false
      description: The maximum number of output tokens. Falls back to instance config. Maps internally to the API body field max_output_tokens.
      type: Number

    - name: temperature
      required: false
      description: The randomness level in responses. Falls back to instance config. Range 0-2. Lower values produce more deterministic outputs, while higher values increase variety.
      type: Number

    - name: top_p
      required: false
      description: The nucleus sampling threshold. Falls back to instance config. Range 0-1. Lower values result in more focused outputs, while higher values increase diversity.
      type: Number

    - name: reasoning_effort
      required: false
      description: The reasoning effort level. This parameter is applicable only to reasoning families (o1, o3, o4, gpt-5) and is ignored for other models. Can be "low", "medium", or "high". Default is "medium". 
      auto: PREDEFINED
      predefined:
      - 'none'
      - 'minimal'
      - 'low'
      - 'medium'
      - 'high'
      - 'xhigh'
      type: String

    - name: background
      required: false
      description: Whether to run the model response in the background. When true, the command uses polling to wait for the response to complete.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      type: String

    - name: compact_threshold
      required: false
      description: The token threshold at which compaction should be triggered for this entry. Minimum 1000.
      type: Number

    - name: model
      required: false
      description: The model to use. Use the gpt-list-models command to see available models. Falls back to instance config.
      type: String

    - name: interval_in_seconds
      description: The interval in seconds between each poll.
      defaultValue: "10"
      hidden: true
      type: Number

    - name: timeout_in_seconds
      description: The timeout in seconds until polling stops.
      defaultValue: "600"
      hidden: true
      type: Number

    - name: _polling_response_id
      description: The response ID used to poll for completion. This is handled internally by the scheduled command and should not be provided manually.  
      hidden: true
      type: String

    polling: true

    outputs:
    - contextPath: OpenAiChatGPTV3.Response
      description: The conversation state, which includes the response_id for multi-turn continuity.  
      type: Unknown
    - contextPath: OpenAiChatGPTV3.Response.user
      description: The user message sent.
      type: String
    - contextPath: OpenAiChatGPTV3.Response.assistant
      description: The assistant response text.
      type: String
    - contextPath: OpenAiChatGPTV3.Response.response_id
      description: The OpenAI response ID used for multi-turn conversation continuity.
      type: String
  - name: gpt-list-models
    description: Lists all models available to the configured API key. Lets users discover models per their actual API-key tier without redeploying the integration when OpenAI ships new ones.
    arguments: []
    outputs:
    - contextPath: OpenAiChatGPTV3.Model.Id
      description: The model identifier (e.g., gpt-4, gpt-3.5-turbo).
      type: String
    - contextPath: OpenAiChatGPTV3.Model.Created
      description: The Unix timestamp when the model was created.
      type: Number
    - contextPath: OpenAiChatGPTV3.Model.OwnedBy
      description: The organization or entity that owns the model.
      type: String
  - name: gpt-create-moderation
    description: Runs text or an image through the OpenAI Moderations API and returns per-category flagging results. Exactly one of text, entry_id, or image_url must be provided.
    arguments:
    - name: text
      description: A comma-separated list of text strings to moderate. Exactly one of text, entry_id, or image_url must be provided.
      required: false
      isArray: true
      type: String
    - name: entry_id
      description: The War Room entry ID of an uploaded image file. The file is base64-encoded internally and posted as a data URL. Exactly one of text, entry_id, or image_url must be provided.
      required: false
      type: String
    - name: image_url
      description: The publicly reachable HTTP(S) URL of an image (limited to 20 MB). Exactly one of text, entry_id, or image_url must be provided.
      required: false
      type: String
    - name: model
      description: The moderation model to use.
      required: false
      defaultValue: omni-moderation-latest
      auto: PREDEFINED
      predefined:
      - 'omni-moderation-latest'
      - 'omni-moderation-2024-09-26'
      type: String
    outputs:
    - contextPath: OpenAiChatGPTV3.Moderation.Input.input_type
      description: The type of input that was moderated (text, image, or image_url).
      type: String
    - contextPath: OpenAiChatGPTV3.Moderation.Input.input_value
      description: The value of the input that was moderated.
      type: String
    - contextPath: OpenAiChatGPTV3.Moderation.Flagged
      description: Whether the content was flagged by the moderation model.
      type: Boolean
    - contextPath: OpenAiChatGPTV3.Moderation.Categories
      description: The object of boolean values indicating which categories were flagged.
      type: Unknown
    - contextPath: OpenAiChatGPTV3.Moderation.CategoryScores
      description: The object of float values indicating the confidence score for each category.
      type: Unknown
  runonce: false
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/parse-emails:0.1.48.10120494
  isfetchevents: true
fromversion: 6.0.0
tests:
- No tests (auto formatted)
marketplaces:
- xsoar
- marketplacev2
- platform

OpenAi ChatGPT v3

Details

README

OpenAI GPT

Instance Configuration

Generate an API Key

Choose a GPT model to interact with

Text generation setting (Optional)

Event Collector — Generate API Keys

Event Collector — Select event types to fetch

Event Collector — Datasets

Event Collector — Tuning (Optional)

Click ‘Test’

Commands

gpt-send-message

Input

gpt-check-email-body

Input

gpt-check-email-header

Input

gpt-analyze-email-header

Input

Context Output

Human Readable Output

gpt-analyze-email-body

Input

Context Output

Human Readable Output

gpt-create-soc-email-template

Input

gpt-draft-soc-email

Cortex XSOAR sequence (typical phishing flow)

Input

Context Output

Human Readable Output

openai-get-events

Base Command

Input

Context Output

Human Readable Output

OpenAI GPT Events

gpt-create-response

Base Command

Input

Context Output

gpt-list-models

Base Command

Input

Context Output

gpt-create-moderation

Base Command

Input

Context Output

License Requirements

Configuration parameters

Commands (11)

Source