Palo Alto Networks IoT

Details

ID	`Palo Alto Networks IoT`
Provider	Palo Alto Networks
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This is the Palo Alto Networks IoT integration (previously Zingbox).
This integration was integrated and tested with the Banff release of Palo Alto Networks IoT.

Get your Palo Alto Networks IoT Access Keys

This integration requires that API access be configured.
To obtain the Access Key ID and Secret Access Key, refer to the Palo Alto Networks IoT API User Guide.

Configure Palo Alto Networks IoT in Cortex

Parameter	Description	Required
url	Palo Alto Networks IoT Security Portal URL (e.g. https://example.iot.paloaltonetworks.com)	True
tenant_id	Tenant ID	True
access_key_id	Access Key ID	True
secret_access_key	Secret Access Key	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False
first_fetch	First fetch time	False
max_fetch	Maximum number of incidents per fetch	False
fetch_alerts	Fetch IoT Alerts	False
fetch_vulns	Fetch IoT Vulnerabilities	False
api_timeout	The timeout for querying APIs	False
incidentType	Incident type	False
isFetch	Fetch incidents	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iot-security-get-device

IoT get device command - get a single device’s details.

Base Command

iot-security-get-device

Input

Argument Name	Description	Required
id	The device uid (mac address)	Required

Context Output

Path	Type	Description
PaloAltoNetworksIoT.Device	unknown	Device details.
PaloAltoNetworksIoT.Device.hostname	String	The hostname of the device.
PaloAltoNetworksIoT.Device.ip_address	String	The IP address of the device.
PaloAltoNetworksIoT.Device.profile_type	String	The device profile type: Non_IoT vs IoT.
PaloAltoNetworksIoT.Device.profile_vertical	String	The device profile vertical.
PaloAltoNetworksIoT.Device.category	String	The device category
PaloAltoNetworksIoT.Device.profile	String	The device profile.
PaloAltoNetworksIoT.Device.last_activity	Date	The last activity timestamp of the device.
PaloAltoNetworksIoT.Device.long_description	String	The long description of the device.
PaloAltoNetworksIoT.Device.vlan	Number	The device VLAN ID.
PaloAltoNetworksIoT.Device.site_name	String	The site which the device is in.
PaloAltoNetworksIoT.Device.risk_score	Number	The device risk score.
PaloAltoNetworksIoT.Device.risk_level	String	The device risk level: Low, Medium, High, Critical
PaloAltoNetworksIoT.Device.subnet	String	The device subnet.
PaloAltoNetworksIoT.Device.first_seen_date	Date	The first seen date of the device.
PaloAltoNetworksIoT.Device.confidence_score	Number	The device confidence score.
PaloAltoNetworksIoT.Device.deviceid	Date	The device ID.
PaloAltoNetworksIoT.Device.location	String	The device location.
PaloAltoNetworksIoT.Device.vendor	String	The device vendor.
PaloAltoNetworksIoT.Device.model	String	The device model.
PaloAltoNetworksIoT.Device.description	String	The device description.
PaloAltoNetworksIoT.Device.asset_tag	String	The device asset tag (e.g. a sticky label at the bottom of the device).
PaloAltoNetworksIoT.Device.os_group	String	The device OS group.
PaloAltoNetworksIoT.Device.Serial_Number	String	The device serial number.
PaloAltoNetworksIoT.Device.DHCP	String	Whether the device is in DHCP model: Valid values are Yes or No.
PaloAltoNetworksIoT.Device.wire_or_wireless	String	Is the device wired or wireless.
PaloAltoNetworksIoT.Device.department	String	The device department.
PaloAltoNetworksIoT.Device.Switch_Port	Number	The port of the switch this device is connected to.
PaloAltoNetworksIoT.Device.Switch_Name	String	The name of the switch this device is connected to.
PaloAltoNetworksIoT.Device.Switch_IP	String	The IP of the switch this device is connected to.
PaloAltoNetworksIoT.Device.Access_Point_IP	String	The IP of the access point this device is connected to.
PaloAltoNetworksIoT.Device.Access_Point_Name	String	The name of the access point this device is connected to.
PaloAltoNetworksIoT.Device.SSID	String	The SSID of the wireless network this device is connected to.
PaloAltoNetworksIoT.Device.MAC	Date	The device MAC address.
PaloAltoNetworksIoT.Device.display_tags	String	The user tags of the device.
PaloAltoNetworksIoT.Device.mac_address	String	The device MAC address.

Command Example

iot-security-get-device id=00:0f:e5:04:14:4c

Human Readable Output

AD_Domain	AD_Username	AET	Access_Point_IP	Access_Point_Name	Applications	Authentication_Method	CMMS_Category	CMMS_Source	CMMS_State	DHCP	EAP_Method	Encryption_Cipher	External_Inventory_Sync_Field	MAC	NAC_Auth_Info	NAC_Auth_State	NAC_profile	NAC_profile_source	NetworkLocation	SMB	SSID	Serial_Number	Source	Switch_IP	Switch_Name	Switch_Port	Synced_With_Third-Party	Time_Synced_With_Third-Party	WIFI_Auth_Status	WIFI_Auth_Timestamp	asset_tag	category	confidence_score	department	description	deviceid	display_tags	endpoint_protection	endpoint_protection_vendor	first_seen_date	hostname	in_use	ip_address	is_server	last_activity	location	long_description	mac_address	model	number_of_caution_alerts	number_of_critical_alerts	number_of_info_alerts	number_of_warning_alerts	os/firmware_version	os_combined	os_group	parent_mac	profile	profile_type	profile_vertical	risk_level	risk_score	services	site_name	source	subnet	vendor	vlan	wire_or_wireless
														00:0f:e5:04:14:4c									Monitored									Physical Security	94			00:0f:e5:04:14:4c		not_protected		2020-08-13T07:21:02.000Z	00:0f:e5:04:14:4c		10.70.112.20		2020-08-18T19:26:05.000Z			00:0f:e5:04:14:4c		0	0	0	0					Access Control Device	IoT	Facility	Low	10		test-katherine-0821		10.0.0.0/8	HID Global/Mercury Security

iot-security-list-devices

IoT list devices command

Base Command

iot-security-list-devices

Input

Argument Name	Description	Required
offset	The offset in the pagination.	Optional
limit	The maximum size of the list of the devices.	Optional

Context Output

Path	Type	Description
PaloAltoNetworksIoT.DeviceList	unknown	List of devices.

Command Example

iot-security-list-devices offset=0 limit=2

Human Readable Output

AD_Domain	AD_Username	AET	Access_Point_IP	Access_Point_Name	Applications	Authentication_Method	CMMS_Category	CMMS_Source	CMMS_State	DHCP	EAP_Method	Encryption_Cipher	External_Inventory_Sync_Field	MAC	NAC_Auth_Info	NAC_Auth_State	NAC_profile	NAC_profile_source	NetworkLocation	SMB	SSID	Serial_Number	Source	Switch_IP	Switch_Name	Switch_Port	Synced_With_Third-Party	Time_Synced_With_Third-Party	WIFI_Auth_Status	WIFI_Auth_Timestamp	asset_tag	category	confidence_score	department	description	deviceid	display_tags	endpoint_protection	endpoint_protection_vendor	first_seen_date	hostname	in_use	ip_address	is_server	last_activity	location	long_description	mac_address	model	number_of_caution_alerts	number_of_critical_alerts	number_of_info_alerts	number_of_warning_alerts	os/firmware_version	os_combined	os_group	parent_mac	profile	profile_type	profile_vertical	risk_level	risk_score	services	site_name	source	subnet	vendor	vlan	wire_or_wireless
																							Monitored									Smartphone	90			356582100001420		not_protected		2020-08-11T01:45:31.000Z	356582100001420		1.0.2.2		2020-08-11T00:09:02.000Z			356582100001420	iPhone 11 (A2223)	0	0	0	0		iOS	iOS		Apple iPhone 11 (A2223)	IoT	Traditional IT	Low	21		test		uknown
																							Monitored									Smartphone	90			356582100001430		not_protected		2020-08-11T01:48:05.000Z	356582100001430		1.0.3.2		2020-08-11T00:09:02.000Z			356582100001430	iPhone 11 (A2223)	0	0	0	0		iOS	iOS		Apple iPhone 11 (A2223)	IoT	Traditional IT	Low	21		test		uknown

iot-security-list-alerts

IoT list alerts.

Base Command

iot-security-list-alerts

Input

Argument Name	Description	Required
start_time	The start time in the format of ISO 8601 in UTC, e.g. 2018-11-06T08:56:41Z.	Optional
offset	The offset in the pagination.	Optional
limit	The maximum size of the list of the alerts.	Optional

Context Output

Path	Type	Description
PaloAltoNetworksIoT.Alerts	unknown	List of alerts.

Command Example

iot-security-list-alerts offset=0 limit=2

Human Readable Output

category	date	description	deviceid	hostname	id	inspectorid	internal_hostname	msg	name	profile	reason_history	resolved	serviceLevel	severity	severityNumber	siteid	tenantid	type	zb_ticketid
Network Security Equipment	2020-08-26T06:11:04.000Z	The usage of an outdated Chrome version has been detected on this device. Using older versions of a web browser can expose your device to security risks.	d4:f4:be:b0:c3:10		5f463c8703a2260700a99dbf	012501000732		severity: low<br>taggedBy: PolicyAlert<br>userPolicy: false<br>alertType: security risk<br>localDeviceRole: initiator<br>values: {‘label’: ‘user agent’, ‘value’: ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041’}<br>localProfile: Palo Alto Networks Device<br>description: The usage of an outdated Chrome version has been detected on this device. Using older versions of a web browser can expose your device to security risks.<br>recommendation: {“content”: [“Update the browser to the latest version”, “If browser usage on the device is authorized and essential, use a URL-filtering tool to block connections to known malicious websites or update firewall policy rules to permit connections only to designated websites.”, “Check network traffic coming to and from the device on the device details page and enable trusted behavior by applying an ACL (access control list) to restrict nonessential traffic.”]}<br>alertKey: 24072002d4:f4:be:b0:c3:10analytics-outdated-chrome<br>anomalyMap: {“application”: 1}<br>generationTimestamp: 1598438532757<br>autoPublish: true<br>name: Outdated Chrome version used by IoT device<br>localip: 192.168.58.56<br>fromip: 192.168.58.56<br>id: ObDMsWG0<br>ruleid: analytics-outdated-chrome<br>status: publish<br>toURL: UNKNOWN URL<br>hostname: unknown	Outdated Chrome version used by IoT device	Palo Alto Networks Device		no		low	2	0		policy_alert	alert-ObDMsWG0
IT Server	2020-08-26T02:09:43.000Z	This event indicates a brute force attack through multiple login attempts to an SSH server.	00:25:90:92:82:2a		5f45c4a52f31500800a47fc7	012501003437		taggedBy: PolicyAlert<br>values: {‘label’: ‘device profile’, ‘value’: ‘Super Micro Computer’},<br>{‘label’: ‘client port’, ‘value’: 34904},<br>{‘label’: ‘threat ID’, ‘value’: 40015},<br>{‘label’: ‘threat category’, ‘value’: ‘brute-force’},<br>{‘label’: ‘threat type’, ‘value’: ‘vulnerability’},<br>{‘label’: ‘number of occurrences’, ‘value’: 2},<br>{‘label’: ‘alert source’, ‘value’: ‘Firewall’},<br>{‘label’: ‘firewall name’, ‘value’: ‘SJC-Eng-5260-fw1’},<br>{‘label’: ‘firewall action’, ‘value’: ‘Raised an alert’},<br>{‘label’: ‘firewall inbound interface’, ‘value’: ‘vlan’},<br>{‘label’: ‘firewall outbound interface’, ‘value’: ‘vlan’}<br>localProfile: Super Micro Computer<br>localDeviceLabels: Attacker<br>description: This event indicates a brute force attack through multiple login attempts to an SSH server.<br>recommendation: {“content”: [“Enable brute-force login protection by setting a maximum limit for the number of unsuccessful login attempts the device will accept before refusing further attempts.”, “If unauthorized users tried to log in, block the IP addresses from which they made their attempts.”, “Avoid using the manufacturer’s default credentials or the same text string as both the username and password.”, “Strengthen the login username and password for the ssh application.”]}<br>anomalyMap: {“payload”: 2}<br>generationTimestamp: 1598407836500<br>remoteHostMetadata: {‘deviceIds’: [‘10.0.16.245’], ‘ip’: ‘10.0.16.245’, ‘connections’: [{‘app’: ‘ssh’, ‘port’: 22, ‘ipProto’: ‘tcp’}], ‘network’: ‘internal’}<br>toip: 10.0.16.245<br>fromip: 10.0.6.174<br>id: KbYbFjYw<br>severity: medium<br>threatid: 40015<br>userPolicy: false<br>alertType: vulnerability<br>localDeviceRole: initiator<br>appName: ssh<br>alertKey: 2407200200:25:90:92:82:2aanalytics-evt-threat-attacker40015<br>remoteHostLabels: Victim<br>autoPublish: true<br>isAttempt: false<br>forensicData: {“search”: {“iotdevid”: “00:25:90:92:82:2a”, “threatid”: 40015, “remoteIPAddr”: [“10.0.16.245”], “appName”: “ssh”, “tenantid”: “24072002”, “isClient”: “Yes”, “reverse”: true, “timestamp”: 1598407783000, “isLocal”: true, “direction”: “client to server”}, “addFields”: {“rxPkts”: “packets”, “txPkts”: “packets”}}<br>name: SSH User Authentication Brute Force Attempt<br>localip: 10.0.6.174<br>threatCategory: brute-force<br>ruleid: analytics-evt-threat-attacker<br>status: publish<br>toURL: UNKNOWN URL<br>hostname: unknown	SSH User Authentication Brute Force Attempt	Super Micro Computer		no		medium	3	0		policy_alert	alert-KbYbFjYw

iot-security-list-vulns

IoT list Vulnerabilities.

Base Command

iot-security-list-vulns

Input

Argument Name	Description	Required
start_time	The start time in the format of ISO 8601 in UTC, e.g. 2018-11-06T08:56:41Z.	Optional
offset	The offset in the pagination.	Optional
limit	The maximum size of the list of the vulnerabilities.	Optional

Context Output

Path	Type	Description
PaloAltoNetworksIoT.Vulns	unknown	List of vulnerabilities.

Command Example

iot-security-list-vulns limit=2 offset=0

Human Readable Output

asset_tag	date	detected_date	deviceid	display_profile_category	ip	model	name	os	osCombined	profile	profile_vertical	reason_history	remediate_checkbox	remediate_instruction	remediate_workorder	risk_level	risk_score	siteName	siteid	sn	ticketAssignees	ticketState	vendor	vulnerability_name	zb_ticketid
	2020-07-16T09:18:21.000Z	2020-08-20T23:59:59.000Z	64:16:7f:77:45:c9	Video Audio Conference	10.72.32.237	Trio8800	Polycom_64167f7745c9	Embedded	Embedded	Polycom Video Conferencing Device	Office					Low	26	test	0				Polycom	Vulnerability Test - Medium	vuln-65046ad8
	2020-07-22T19:18:32.000Z	2020-08-20T23:59:59.000Z	64:16:7f:76:64:c6	Video Audio Conference	10.72.33.195	Trio8800	Polycom_64167f7664c6	Embedded	Embedded	Polycom Device	Office					Low	26	test	0				Polycom	Vulnerability Test - Medium	vuln-8cc12cd4

iot-security-resolve-alert

Resolving an IoT alert.

Base Command

iot-security-resolve-alert

Input

Argument Name	Description	Required
id	The alert ID	Required
reason	The alert resolution reason.	Optional
reason_type	The alert resolution reason type (No Action Needed, Issue Mitigated).	Optional

Context Output

There is no context output for this command.

Command Example

iot-security-resolve-alert id="5e73ecb3eff46f80a7cdc57a" reason=test reason_type="No Action Needed"

iot-security-resolve-vuln

Resolving an IoT vulnerability.

Base Command

iot-security-resolve-vuln

Input

Argument Name	Description	Required
id	The vulnerability ID.	Required
full_name	The vulnerability full name.	Required
reason	The vulnerability resolution reason.	Optional

Context Output

There is no context output for this command.

Command Example

iot-security-resolve-vuln full_name=CVE-2019-10960 id=vuln-b12d4f0a reason=test

iot-security-get-device-by-ip

IoT get device command - get a single device’s details.

Base Command

iot-security-get-device-by-ip

Input

Argument Name	Description	Required
ip	The device ip (ip address).	Required

Context Output

Path	Type	Description
PaloAltoNetworksIoT.Device	unknown	Device details.
PaloAltoNetworksIoT.Device.hostname	String	The hostname of the device.
PaloAltoNetworksIoT.Device.ip_address	String	The IP address of the device.
PaloAltoNetworksIoT.Device.profile_type	String	The device profile type: Non_IoT vs IoT.
PaloAltoNetworksIoT.Device.profile_vertical	String	The device profile vertical.
PaloAltoNetworksIoT.Device.category	String	The device category
PaloAltoNetworksIoT.Device.profile	String	The device profile.
PaloAltoNetworksIoT.Device.last_activity	Date	The last activity timestamp of the device.
PaloAltoNetworksIoT.Device.long_description	String	The long description of the device.
PaloAltoNetworksIoT.Device.vlan	Number	The device VLAN ID.
PaloAltoNetworksIoT.Device.site_name	String	The site which the device is in.
PaloAltoNetworksIoT.Device.risk_score	Number	The device risk score.
PaloAltoNetworksIoT.Device.risk_level	String	The device risk level: Low, Medium, High, Critical
PaloAltoNetworksIoT.Device.subnet	String	The device subnet.
PaloAltoNetworksIoT.Device.first_seen_date	Date	The first seen date of the device.
PaloAltoNetworksIoT.Device.confidence_score	Number	The device confidence score.
PaloAltoNetworksIoT.Device.deviceid	Date	The device ID.
PaloAltoNetworksIoT.Device.location	String	The device location.
PaloAltoNetworksIoT.Device.vendor	String	The device vendor.
PaloAltoNetworksIoT.Device.model	String	The device model.
PaloAltoNetworksIoT.Device.description	String	The device description.
PaloAltoNetworksIoT.Device.asset_tag	String	The device asset tag (e.g. a sticky label at the bottom of the device).
PaloAltoNetworksIoT.Device.os_group	String	The device OS group.
PaloAltoNetworksIoT.Device.Serial_Number	String	The device serial number.
PaloAltoNetworksIoT.Device.DHCP	String	Whether the device is in DHCP model: Valid values are Yes or No.
PaloAltoNetworksIoT.Device.wire_or_wireless	String	Is the device wired or wireless.
PaloAltoNetworksIoT.Device.department	String	The device department.
PaloAltoNetworksIoT.Device.Switch_Port	Number	The port of the switch this device is connected to.
PaloAltoNetworksIoT.Device.Switch_Name	String	The name of the switch this device is connected to.
PaloAltoNetworksIoT.Device.Switch_IP	String	The IP of the switch this device is connected to.
PaloAltoNetworksIoT.Device.Access_Point_IP	String	The IP of the access point this device is connected to.
PaloAltoNetworksIoT.Device.Access_Point_Name	String	The name of the access point this device is connected to.
PaloAltoNetworksIoT.Device.SSID	String	The SSID of the wireless network this device is connected to.
PaloAltoNetworksIoT.Device.MAC	Date	The device MAC address.
PaloAltoNetworksIoT.Device.display_tags	String	The user tags of the device.
PaloAltoNetworksIoT.Device.mac_address	String	The device MAC address.

Configuration parameters

url — Palo Alto Networks IoT Security Portal URL (e.g. https://example.iot.paloaltonetworks.com) (required)
tenant_id — Tenant ID (required)
credentials — Access Key ID
access_key_id — Access Key ID
secret_access_key — Secret Access Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — First fetch time
max_fetch — Maximum number of incidents per fetch
fetch_alerts — Fetch IoT Alerts
fetch_vulns — Fetch IoT Vulnerabilities
api_timeout — The timeout for querying APIs
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (7)

iot-security-get-device
IoT get device command - get a single device's details.
iot-security-get-device-by-ip
IoT get device command - get a single device's details.
iot-security-list-alerts
IoT list alerts.
iot-security-list-devices
IoT list devices command.
iot-security-list-vulns
IoT list Vulnerabilities.
iot-security-resolve-alert
Resolving an IoT alert.
iot-security-resolve-vuln
Resolving an IoT vulnerability.

Source

PaloAltoNetworks_IoT.py PaloAltoNetworks_IoT_test.py PaloAltoNetworks_IoT.yml PaloAltoNetworks_IoT_description.md

Download History Raw

category: Network Security
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: Palo Alto Networks IoT
  version: -1
configuration:
- defaultvalue: https://example.iot.paloaltonetworks.com
  display: Palo Alto Networks IoT Security Portal URL (e.g. https://example.iot.paloaltonetworks.com)
  name: url
  required: true
  type: 0
  section: Connect
- defaultvalue: paloaltonetworks
  display: Tenant ID
  name: tenant_id
  required: true
  type: 0
  section: Connect
- display: Access Key ID
  name: credentials
  type: 9
  displaypassword: Secret Access Key
  section: Connect
  required: false
- display: Access Key ID
  name: access_key_id
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Secret Access Key
  name: secret_access_key
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: '7 days'
  display: First fetch time
  name: first_fetch
  type: 0
  additionalinfo: "The format: <number> <time unit>. e.g., 12 hours, 7 days, 2 seconds etc."
  section: Collect
  required: false
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: '10'
  type: 0
  additionalinfo: Maximal number of events is 100
  section: Collect
  required: false
- display: Fetch IoT Alerts
  name: fetch_alerts
  defaultvalue: "true"
  type: 8
  additionalinfo: When selected, the integration fetches IoT alerts from the IoT Security Portal.
  section: Collect
  advanced: true
  required: false
- display: Fetch IoT Vulnerabilities
  name: fetch_vulns
  defaultvalue: "true"
  type: 8
  additionalinfo: When selected, the integration fetches IoT vulnerabilities from the IoT Security Portal.
  section: Collect
  advanced: true
  required: false
- display: The timeout for querying APIs
  name: api_timeout
  type: 0
  defaultvalue: "60"
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
description: This is the Palo Alto Networks IoT integration (previously Zingbox).
display: Palo Alto Networks IoT
name: Palo Alto Networks IoT
script:
  commands:
  - name: iot-security-get-device
    arguments:
    - description: The device uid (mac address).
      name: id
      required: true
    description: IoT get device command - get a single device's details.
    outputs:
    - contextPath: PaloAltoNetworksIoT.Device
      description: Device details.
      type: unknown
    - contextPath: PaloAltoNetworksIoT.Device.hostname
      description: The hostname of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.ip_address
      description: The IP address of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile_type
      description: "The device profile type: Non_IoT vs IoT."
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile_vertical
      description: The device profile vertical.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.category
      description: The device category.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile
      description: The device profile.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.last_activity
      description: The last activity timestamp of the device.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.long_description
      description: The long description of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.vlan
      description: The device VLAN ID.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.site_name
      description: The site which the device is in.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.risk_score
      description: The device risk score.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.risk_level
      description: "The device risk level: Low, Medium, High, Critical."
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.subnet
      description: The device subnet.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.first_seen_date
      description: The first seen date of the device.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.confidence_score
      description: The device confidence score.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.deviceid
      description: The device ID.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.location
      description: The device location.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.vendor
      description: The device vendor.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.model
      description: The device model.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.description
      description: The device description.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.asset_tag
      description: 'The device asset tag (e.g. a sticky label at the bottom of the device).'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.os_group
      description: 'The device OS group.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Serial_Number
      description: 'The device serial number.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.DHCP
      description: 'Whether the device is in DHCP model: Valid values are Yes or No.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.wire_or_wireless
      description: 'Is the device wired or wireless.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.department
      description: 'The device department.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Switch_Port
      description: 'The port of the switch this device is connected to.'
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.Switch_Name
      description: 'The name of the switch this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Switch_IP
      description: 'The IP of the switch this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Access_Point_IP
      description: 'The IP of the access point this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Access_Point_Name
      description: 'The name of the access point this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.SSID
      description: 'The SSID of the wireless network this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.MAC
      description: 'The device MAC address.'
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.display_tags
      description: 'The user tags of the device.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.mac_address
      description: 'The device MAC address.'
      type: String
  - name: iot-security-get-device-by-ip
    arguments:
    - name: ip
      required: true
      description: The device ip (ip address).
    outputs:
    - contextPath: PaloAltoNetworksIoT.Device
      description: Device details.
      type: unknown
    - contextPath: PaloAltoNetworksIoT.Device.hostname
      description: The hostname of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.ip_address
      description: The IP address of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile_type
      description: 'The device profile type: Non_IoT vs IoT.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile_vertical
      description: The device profile vertical.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.category
      description: The device category.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile
      description: The device profile.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.last_activity
      description: The last activity timestamp of the device.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.long_description
      description: The long description of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.vlan
      description: The device VLAN ID.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.site_name
      description: The site which the device is in.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.risk_score
      description: The device risk score.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.risk_level
      description: 'The device risk level: Low, Medium, High, Critical.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.subnet
      description: The device subnet.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.first_seen_date
      description: The first seen date of the device.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.confidence_score
      description: The device confidence score.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.deviceid
      description: The device ID.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.location
      description: The device location.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.vendor
      description: The device vendor.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.model
      description: The device model.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.description
      description: The device description.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.asset_tag
      description: The device asset tag (e.g. a sticky label at the bottom of the device).
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.os_group
      description: The device OS group.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Serial_Number
      description: The device serial number.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.DHCP
      description: 'Whether the device is in DHCP model: Valid values are Yes or No.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.wire_or_wireless
      description: Is the device wired or wireless.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.department
      description: The device department.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Switch_Port
      description: The port of the switch this device is connected to.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.Switch_Name
      description: The name of the switch this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Switch_IP
      description: The IP of the switch this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Access_Point_IP
      description: The IP of the access point this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Access_Point_Name
      description: The name of the access point this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.SSID
      description: The SSID of the wireless network this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.MAC
      description: The device MAC address.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.display_tags
      description: The user tags of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.mac_address
      description: The device MAC address.
      type: String
    description: IoT get device command - get a single device's details.
  - name: iot-security-list-devices
    arguments:
    - description: The offset in the pagination.
      name: offset
    - description: The maximum size of the list of the devices.
      name: limit
    description: IoT list devices command.
    outputs:
    - contextPath: PaloAltoNetworksIoT.DeviceList
      description: List of devices.
      type: unknown
  - name: iot-security-list-alerts
    arguments:
    - description: The start time in the format of ISO 8601 in UTC, e.g. 2018-11-06T08:56:41Z.
      name: start_time
    - description: The offset in the pagination.
      name: offset
    - description: The maximum size of the list of the alerts.
      name: limit
    description: IoT list alerts.
    outputs:
    - contextPath: PaloAltoNetworksIoT.Alerts
      description: List of alerts.
      type: unknown
  - name: iot-security-list-vulns
    arguments:
    - description: The start time in the format of ISO 8601 in UTC, e.g. 2018-11-06T08:56:41Z.
      name: start_time
    - description: The offset in the pagination.
      name: offset
    - description: The maximum size of the list of the vulnerabilities.
      name: limit
    description: IoT list Vulnerabilities.
    outputs:
    - contextPath: PaloAltoNetworksIoT.Vulns
      description: List of vulnerabilities.
      type: unknown
  - name: iot-security-resolve-alert
    arguments:
    - description: The alert ID.
      name: id
      required: true
    - description: The alert resolution reason.
      name: reason
    - description: The alert resolution reason type (No Action Needed, Issue Mitigated).
      name: reason_type
      predefined:
      - 'No Action Needed'
      - 'Issue Mitigated'
    description: Resolving an IoT alert.
  - name: iot-security-resolve-vuln
    arguments:
    - description: The vulnerability ID.
      name: id
      required: true
    - description: The vulnerability full name.
      name: full_name
      required: true
    - description: The vulnerability resolution reason.
      name: reason
    description: Resolving an IoT vulnerability.
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 5.0.0
tests:
- PaloAltoNetworks_IoT-Test