ProtectWise

Cloud based Security Network DVR.

Network Security · ProtectWise

Details

ID	`ProtectWise`
Provider	Verizon Communications
Category	Network Security
From Version	5.0.0
Supported Modules	Agentix XSIAM EDR Cortex Cloud Attack Surface Management Cloud Runtime Security Cloud Posture Security Exposure Management

README

When integrating Protectwise with Cortex XSOAR, event data is received in a continues stream of data which can be handled by Cortex XSOAR.

To set up the integration on Cortex XSOAR:

Go to ‘Settings > Integrations > Servers & Services’
Locate the Protectwise integration by searching for ‘Protectwise’ using the search box on the top of the page.
1. Click ‘Add instance’ to create and configure a new integration. You should configure the following Protectwise and Cortex XSOAR-specific settings:
  
  Name: A textual name for the integration instance.

URL: The hostname or IP address of the application. Make sure it is reachable with respect to IP address and port.

Email & Password: the credentials for accessing the API.

Do not validate certificate (insecure): Select to avoid server certification validation. You may want to do this in case Cortex XSOAR cannot validate the integration server certificate (due to missing CA certificate).

Only fetch events with this text in the name: To only pull events with a specific name, specify it here. Cortex XSOAR will look for one of the filter values in the Event name (comparison is case insensitive).
Separate multiple names with a comma. For example: Progression,Lateral Movement

Filter by threat category: To pull threats according to threat category.

Filter by killchain stage: To pull threats according to threat killchain stage.

Filter by LOW , MEDIUM , or HIGH threatLevel: To pull threats according to Threat Level.

Fetch incidents: Select whether to automatically create Cortex XSOAR incidents from the integration's events.
If this option is checked, the first fetch will search for events 10 minutes back from the moment you turn on Fetching. Subsequently, new offences will be fetched as soon as they are generated. Use the "Query to fetch offences" option to pull older offences as incidents.
The next fetch interval depends on the systemwide interval (default 1 min).

Incident type: Specify the Cortex XSOAR incident type that will be set for incidents from this integration.

Use system proxy settings: Select whether to communicate via the system proxy server or not.

Cortex XSOAR engine: If relevant, select the engine that acts as a proxy to the server.

Engines are used when you need to access a remote network segments and there are network devices such as proxies, firewalls, etc. that prevent the Cortex XSOAR server from accessing the remote networks.

For more information on Cortex XSOAR engines see:
Cortex XSOAR 6.13 - Engines
Cortex XSOAR 8 Cloud- Engines
Cortex XSOAR 8.7 On-prem - Engines

Press the ‘Test’ button to validate connection.
After completing the test successfully, press the ‘Done’ button.

Commands:

protectwise-event-info - Lookup a single event and its associated observations for ProtectWise.

protectwise-event-pcap-download - Event Pcap Download.

protectwise-event-pcap-info - Get ProtectWise Event Pcap info.

protectwise-observation-info - Lookup a single observation for ProtectWise.

protectwise-observation-pcap-download - Observation Pcap Download.

protectwise-observation-pcap-info - Get ProtectWise Observation Pcap info.

protectwise-search-events - search Events ,Events are resources that describe a threat and contains a collection of observations.

protectwise-search-observations - search observations in ProtectWise.

protectwise-show-sensors - Collection of all available sensors.

Example:

The following shows how fields provided by the API are mapped as labels in fetched Events.

[killChainStage] Fortification
[observedAt] 2017-08-04T13:00:03.436Z
[isUpdate] true
[type] MaliciousFlow
[threatLevel] High
[category] Suspicious
[observationCount] 2
[sensorId] 1849
[cid] 1820
[message] Critical Lateral Movement Activity on Hosts: 192.168.2.81,192.168.2.170
[confidence] 100
[endedAt] 2017-08-04T12:59:49.156Z
[threatScore] 70
[id] 000555ed127a1ca0b771fc0e4270cfcc24510b32d7ff9b9d66dfedcf
[startedAt] 2017-08-04T12:59:49.156Z
[threatSubCategory] None
[priority] false
[agentId] 1849
[observedStage] Realtime
[netflowCount] 1
[sensorIds] 1849
[Brand] ProtectWise
[Instance] ProtectWise_instance_1

Configuration parameters

url — Url (required)
email — Email
password — Password
credentials_login — Email
token — API Token
credentials_api_token —
insecure — Trust any certificate (not secure)
messageFilter — Only fetch events with this text in the name
threatCategory — Filter by threat category
killChainStage — Filter by killchain stage
threatLevel — Filter by threat level (LOW, MEDIUM, or HIGH)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
proxy — Use system proxy settings
maxFetch — Maximum events to fetch per fetch

Commands (19)

event-pcap-download Deprecated
The Event PCAP file to download.
event-pcap-info Deprecated
Returns details of the ProtectWise Event PCAP files.
get-token Deprecated
Returns the API token, which is used in the integration configuration.
observation-pcap-download Deprecated
Downloads the observation PCAP file.
observation-pcap-info Deprecated
Returns PCAP details of observations in Protectwise.
observation-search Deprecated
Searches for observations in ProtectWise.
protectwise-event-info
Searches for a single event in ProtectWise. Deprecated - use the protectwise-event-info command.
protectwise-event-pcap-download
Event Pcap Download. Deprecated - use the protectwise-event-pcap-info command.
protectwise-event-pcap-info
Get ProtectWise Event Pcap info. Deprecated - use the protectwise-observation-pcap-download command.
protectwise-observation-info
Lookup a single observation for ProtectWise. Deprecated - use the protectwise-event-pcap-download command.
protectwise-observation-pcap-download
Downloads the Observation PCAP file. Deprecated - use the protectwise-observation-pcap-info command.
protectwise-observation-pcap-info
Returns ProtectWise Observation PCAP file information.
protectwise-search-events
Searches for events. Events are resources that describe a threat and contains a collection of observations. Deprecated - use the protectwise-search-events command.
protectwise-search-observations
Searches for observations in ProtectWise. Deprecated - use the protectwise-search-observations command.
protectwise-show-sensors
Returns all available sensors.
pw-event-get Deprecated
Returns information about a single event and its associated observations.
pw-observation-get Deprecated
Searches for a single observation in ProtectWise.
search Deprecated
Searches for events. Events are resources that describe a threat and contain a collection of observations.
sensors Deprecated
Returns the specified, or all available sensors.

Source

ProtectWise.js ProtectWise.yml ProtectWise_description.md

Download History Raw

commonfields:
  id: ProtectWise
  version: -1
name: ProtectWise
display: ProtectWise
category: Network Security
provider: Verizon Communications
description: Cloud based Security Network DVR.
sectionorder:
- Connect
- Collect
configuration:
- display: Url
  name: url
  defaultvalue: https://api.protectwise.com/api/v1/
  type: 0
  required: true
  section: Connect
- display: Email
  name: email
  defaultvalue: ""
  type: 0
  hidden: true
  required: false
  section: Connect
- display: Password
  name: password
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- display: Email
  name: credentials_login
  type: 9
  displaypassword: Password
  section: Connect
  required: false
- display: API Token
  name: token
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: API Token
  name: credentials_api_token
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Only fetch events with this text in the name
  name: messageFilter
  defaultvalue: ""
  type: 0
  required: false
  section: Collect
- display: Filter by threat category
  name: threatCategory
  defaultvalue: ""
  type: 0
  required: false
  section: Collect
- display: Filter by killchain stage
  name: killChainStage
  defaultvalue: ""
  type: 0
  required: false
  section: Collect
- display: Filter by  threat level (LOW, MEDIUM, or HIGH)
  name: threatLevel
  defaultvalue: ""
  type: 0
  required: false
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: "Maximum events to fetch per fetch"
  name: maxFetch
  defaultvalue: "50"
  type: 0
  required: false
  section: Collect
script:
  script: ''
  type: javascript
  commands:
  - name: sensors
    deprecated: true
    arguments:
    - name: sensorId
      default: true
      description: The ID of the individual sensor. If empty, will query all available sensors.
    description: Returns the specified, or all available sensors.
  - name: protectwise-show-sensors
    arguments:
    - name: sensorId
      default: true
      description: The ID of the individual sensor. If empty, will query all available sensors.
    outputs:
    - contextPath: Protectwise.Sensor.id
      description: The ID of the sensor.
    - contextPath: Protectwise.Sensor.friendly_name
      description: The name of the sensor.
    - contextPath: Protectwise.Sensor.ip_address
      description: The IP address of the sensor.
    - contextPath: Protectwise.Sensor.last_seen
      description: The time when the sensor was last seen.
    - contextPath: Protectwise.Sensor.customer_id
      description: The customer ID of the sensor.
    - contextPath: Protectwise.Sensor.enabled
      description: Whether the sensor is enabled.
    description: Returns all available sensors.
  - name: search
    deprecated: true
    arguments:
    - name: start
      required: true
      description: 'The timestamp of the start time of the event. For example, 1401451200000, or 2015-03-25T12:00:00.'
    - name: end
      required: true
      description: 'The timestamp of the end of the event. For example, 1401451500000, or 2015-03-25T12:00:00.'
    - name: eventType
      description: 'Filter by one or more event types. Can be: "MaliciousFlow", "KillChainEscalation", or "MaliciousConversation".'
    - name: killChainStage
      description: 'Filter by killchain stage. Can be: "Methodology", "Recon", "Delivery", "Exploit", "Beacon", "CnC", "Fortification", or Data_Theft".'
    - name: threatLevel
      description: 'Filter by the threat level. Can be: "NONE", "LOW", "MEDIUM", or "HIGH".'
    - name: threatCategory
      description: 'Filter by the threat category. Can be: "ExploitsAndAttacks", "DenialOfService", "Malware", "Scanning", "Botnets", "Phishing", "Suspicious", "MaliciousHost", "APT", "Misc", or "Unknown".'
    - name: observationStage
      description: 'Filter by the observation stage. Can be: "Realtime" or "Retrospective".'
    - name: ip
      description: Filter by events that are affected by a specific IP address.
    - name: minLimit
      description: The minimum number of results to return per page.
    - name: maxLimit
      description: The maximum number of results to return per page.
    - name: reverseOrder
      description: Whether to sort results by descending timestamp. If "true", results are returned in descending timestamp order. If "false", results are returned in ascending timestamp order. Default is "true".
    - name: nextPage
      description: An identifier to fetch the next page in the result set.
    description: Searches for events. Events are resources that describe a threat and contain a collection of observations.
  - name: protectwise-search-events
    arguments:
    - name: start
      required: true
      description: 'Timestamp of the start time of the event. For example, 1401451200000, or 2015-03-25T12:00:00.'
    - name: end
      required: true
      description: Timestamp of the end of the event. For example, 1401451500000, or 2015-03-25T12:00:00.
    - name: eventType
      description: 'Filters by one or more event types. Can be: "MaliciousFlow:, "KillChainEscalation", or "MaliciousConversation".'
    - name: killChainStage
      description: 'Filters by the killchain stage. Can be: "Methodology", "Recon", "Delivery", "Exploit", "Beacon", "CnC", "Fortification", or "Data_Theft".'
    - name: threatLevel
      description: 'Filters by Low, Medium, or High threats. Can be: "NONE", "LOW", "MEDIUM", or "HIGH".'
    - name: threatCategory
      description: 'Filters by threat category. Can be: "ExploitsAndAttacks", "DenialOfService", "Malware", "Scanning", "Botnets", "Phishing", "Suspicious", "MaliciousHost", "APT", "Misc", or "Unknown".'
    - name: observationStage
      description: Filters by Realtime or Retrospective.
    - name: ip
      description: Filters by events that are affected by a specific IP address.
    - name: minLimit
      description: Minimum number of results to return per page.
    - name: maxLimit
      description: Maximum number of results to return per page.
    - name: reverseOrder
      description: Return results sorted by descending timestamp (default = true).
    - name: nextPage
      description: An identifier which fetches the next page in the result set.
    outputs:
    - contextPath: Protectwise.Event.message
      description: Name of the event.
    - contextPath: Protectwise.Event.id
      description: Protectwise event ID.
    - contextPath: Protectwise.Event.type
      description: The type of the event.
    - contextPath: Protectwise.Event.sensorId
      description: The sensor ID of the event.
    - contextPath: Protectwise.Event.threatScore
      description: The threat score (0-100).
    - contextPath: Protectwise.Event.killChainStage
      description: The Kill Chain Stage of the event.
    - contextPath: Protectwise.Event.confidence
      description: The confidence level (0-100).
    - contextPath: Protectwise.Event.startedAt
      description: The time that Event started.
    - contextPath: Protectwise.Event.observedAt
      description: The time the event was observed.
    - contextPath: Protectwise.Event.endedAt
      description: The time the event ended.
    - contextPath: Protectwise.Event.observationCount
      description: The number of observations related to this event.
    - contextPath: Protectwise.Event.netflowCount
      description: The number of netflows related to this event.
    - contextPath: Protectwise.Event.observedStage
      description: The observed stage (Realtime or Retrospective).
    description: Searches for events. Events are resources that describe a threat and contains a collection of observations. Deprecated - use the protectwise-search-events command.
  - name: pw-event-get
    deprecated: true
    arguments:
    - name: id
      required: true
      default: true
      description: The ID of the event to return.
    description: Returns information about a single event and its associated observations.
  - name: protectwise-event-info
    arguments:
    - name: id
      required: true
      default: true
      description: The ID of the event.
    outputs:
    - contextPath: Protectwise.Event.message
      description: Name of the event.
    - contextPath: Protectwise.Event.id
      description: The ID of the event.
    - contextPath: Protectwise.Event.type
      description: The type of the event.
    - contextPath: Protectwise.Event.sensorId
      description: The sensor ID of the event.
    - contextPath: Protectwise.Event.threatScore
      description: The Threat score. From 0-100.
    - contextPath: Protectwise.Event.killChainStage
      description: Kill Chain Stage of the event.
    - contextPath: Protectwise.Event.confidence
      description: The Confidence level. From 0-100.
    - contextPath: Protectwise.Event.startedAt
      description: The time the event started.
    - contextPath: Protectwise.Event.observedAt
      description: The time the event was observed.
    - contextPath: Protectwise.Event.endedAt
      description: The time the event ended.
    - contextPath: Protectwise.Event.observationCount
      description: The number of observations related to this event.
    - contextPath: Protectwise.Event.netflowCount
      description: The number of netflows related to this event.
    - contextPath: Protectwise.Event.observedStage
      description: The observed stage (Realtime or Retrospective).
    - contextPath: Protectwise.Event.Netflows.key
      description: The Netflow key.
    - contextPath: Protectwise.Event.Netflows.srcIp
      description: The Netflow Source IP.
    - contextPath: Protectwise.Event.Netflows.dstIp
      description: The Netflow Dst IP.
    - contextPath: Protectwise.Event.Netflows.srcPort
      description: The Netflow source port.
    - contextPath: Protectwise.Event.Netflows.dstPort
      description: The Netflow DST Port.
    - contextPath: Protectwise.Event.Netflows.layer4Proto
      description: The Netflow Layer 4 Protocol.
    - contextPath: Protectwise.Event.Observations.id
      description: The observation ID.
    - contextPath: Protectwise.Event.Observations.killChainStage
      description: The Observation Killchain Stage.
    - contextPath: Protectwise.Event.Observations.source
      description: The Observation Source.
    - contextPath: Protectwise.Event.Observations.sensorId
      description: The Observation's Sensor ID.
    - contextPath: Protectwise.Event.Observations.threatScore
      description: The Observation threat score.
    - contextPath: Protectwise.Event.Observations.severity
      description: The Observation Severity.
    - contextPath: Protectwise.Event.Observations.confidence
      description: The observation confidence level (0-100).
    - contextPath: Protectwise.Event.Observations.occurredAt
      description: The time the observation occurred.
    - contextPath: Protectwise.Event.Observations.observedAt
      description: The time the observation observed.
    - contextPath: Protectwise.Event.Observations.endedAt
      description: The time the observation ended.
    - contextPath: Protectwise.Event.Observations.netflowId
      description: The ID of the related Netflow for this observation.
    - contextPath: Protectwise.Event.Observations.observedStage
      description: The observed stage of the observation.
    description: Searches for a single event in ProtectWise. Deprecated - use the protectwise-event-info command.
  - name: observation-search
    deprecated: true
    arguments:
    - name: sensorId
      required: true
      description: The sensor ID or a comma-separated list of sensor IDs.
    - name: start
      required: true
      description: 'The timestamp of the start time of the event. For example, 1401451200000, or 2015-03-25T12:00:00.'
    - name: end
      required: true
      description: 'The timestamp of the end of the event. For example, 1401451500000, or 2015-03-25T12:00:00.'
    - name: type
      description: 'Filter by observation type. Can be: "ids", "http", "iprep", "urlrep", "protocol" or "file".'
    - name: hasKillChain
      description: Search for observations in every kill chain stage (true false).
    - name: killChainStage
      description: Filter by kill chain stage (Methodology  Recon  Delivery  Exploit  Beacon  CnC  Fortification  Data_Theft).
    - name: ip
      description: Filter observations by IP address in the src/dst fields.
    - name: threatLevel
      description: Filter by Low, Medium, or High threats (NONE  LOW  MEDIUM  HIGH).
    - name: threatCategory
      description: Filter by threat category (ExploitsAndAttacks  DenialOfService  Malware  Scanning  Botnets  Phishing  Suspicious  MaliciousHost  APT  Misc  Unknown).
    - name: signatureId
      description: 'Filter by threat signature (find observations of the same type of threat) -  Example: 69020504.'
    - name: minLimit
      description: Try to return at least this many results per page.
    - name: maxLimit
      description: Do not return more than this many results.
    - name: reverseOrder
      description: Return results sorted by descending timestamp (default = true).
    - name: nextPage
      description: An identifier to fetch the next page in the result set.
    description: Searches for observations in ProtectWise.
  - name: protectwise-search-observations
    arguments:
    - name: sensorId
      required: true
      description: The ID of the individual sensor or a comma-separated list of Sensor IDs.
    - name: start
      required: true
      description: 'Timestamp of the start time of the event. For example, 1401451200000, or 2015-03-25T12:00:00.'
    - name: end
      required: true
      description: 'Timestamp of the end of the event. For example, 1401451500000, or 2015-03-25T12:00:00.'
    - name: type
      description: 'Filter by observation type. Can be: "ids", "http", "iprep", "urlrep", "protocol", or "file".'
    - name: hasKillChain
      description: 'Searches for observations in every kill chain stage. Can be: "true" or "false".'
    - name: killChainStage
      description: 'Filter by killchain stage. Can be: "Methodology", "Recon", "Delivery", "Exploit", "Beacon", "CnC", "Fortification", or "Data_Theft".'
    - name: ip
      description: Filter observations by IP address in the src/dst fields.
    - name: threatLevel
      description: 'Filter by Low, Medium, or High threats. Can be: "NONE", "LOW", "MEDIUM", or "HIGH".'
    - name: threatCategory
      description: 'Filter by threat category. Can be: "ExploitsAndAttacks", "DenialOfService", "Malware", "Scanning", "Botnets", "Phishing", "Suspicious", "MaliciousHost", "APT", "Misc", or "Unknown".'
    - name: signatureId
      description: 'Filter by threat signature. Finds observations of the same type of threat). For example, 69020504.'
    - name: minLimit
      description: Minimum number of results per page.
    - name: maxLimit
      description: Maximum number of results per page.
    - name: reverseOrder
      description: Returns results sorted by descending timestamp. Default is true.
    - name: nextPage
      description: An identifier to fetch the next page in the result set.
    outputs:
    - contextPath: Protectwise.Observation.id
      description: The ID of the observation.
    - contextPath: Protectwise.Observation.killChainStage
      description: The Killchain Stage of the observation.
    - contextPath: Protectwise.Observation.source
      description: The source of the observation.
    - contextPath: Protectwise.Observation.sensorId
      description: The ID of the protectwise sensor that generated the observation.
    - contextPath: Protectwise.Observation.threatScore
      description: The threat score of the observation.
    - contextPath: Protectwise.Observation.severity
      description: The severity of the observation.
    - contextPath: Protectwise.Observation.confidence
      description: The confidence level of the observation.
    - contextPath: Protectwise.Observation.occurredAt
      description: The time the observation occurred.
    - contextPath: Protectwise.Observation.observedAt
      description: The time the observation was observed.
    - contextPath: Protectwise.Observation.endedAt
      description: The time the observation ended.
    - contextPath: Protectwise.Observation.netflowId
      description: The ID of the Netflow attached to this observation.
    - contextPath: Protectwise.Observation.observedStage
      description: The attack stage reflected by the observation.
    description: Searches for observations in ProtectWise. Deprecated - use the protectwise-search-observations command.
  - name: pw-observation-get
    deprecated: true
    arguments:
    - name: id
      required: true
      description: The ID of the observation.
    - name: sensorId
      required: true
      description: The ID of an individual sensor or a comma-separated list of sensor IDs.
    description: Searches for a single observation in ProtectWise.
  - name: protectwise-observation-info
    arguments:
    - name: id
      required: true
      description: The ID of the observation.
    - name: sensorId
      required: true
      description: The Sensor ID or a comma-separated list of Sensor IDs.
    outputs:
    - contextPath: Protectwise.Observation.id
      description: The ID of the observation.
    - contextPath: Protectwise.Observation.killChainStage
      description: The Killchain Stage of the observation.
    - contextPath: Protectwise.Observation.source
      description: Observation Source.
    - contextPath: Protectwise.Observation.sensorId
      description: ID of the Protectwise sensor that generated the observation.
    - contextPath: Protectwise.Observation.threatScore
      description: The threat Score of the observation.
    - contextPath: Protectwise.Observation.severity
      description: The severity of the observation.
    - contextPath: Protectwise.Observation.confidence
      description: The confidence level of the observation.
    - contextPath: Protectwise.Observation.occurredAt
      description: The time the observation occurred.
    - contextPath: Protectwise.Observation.observedAt
      description: The time the observation was Observed.
    - contextPath: Protectwise.Observation.endedAt
      description: The time the observation ended.
    - contextPath: Protectwise.Observation.netflowId
      description: The ID of the Netflow tied to this observation.
    - contextPath: Protectwise.Observation.observedStage
      description: The attack stage reflected by the observation.
    description: Lookup a single observation for ProtectWise. Deprecated - use the protectwise-event-pcap-download command.
  - name: event-pcap-download
    deprecated: true
    arguments:
    - name: eventId
      required: true
      default: true
      description: The event ID.
    - name: filename
      description: The filename for download.
    description: The Event PCAP file to download.
  - name: protectwise-event-pcap-download
    arguments:
    - name: eventId
      required: true
      default: true
      description: The ID of the event.
    - name: filename
      description: The filename for the download.
    description: Event Pcap Download. Deprecated - use the protectwise-event-pcap-info command.
  - name: event-pcap-info
    deprecated: true
    arguments:
    - name: eventId
      required: true
      default: true
      description: The ID of the event.
    description: Returns details of the ProtectWise Event PCAP files.
  - name: protectwise-event-pcap-info
    arguments:
    - name: eventId
      required: true
      default: true
      description: The event ID.
    outputs:
    - contextPath: Protectwise.Event.id
      description: The ID of the Event.
    - contextPath: Protectwise.Event.PCAPSize
      description: Estimated PCAP size in bytes.
    description: Get ProtectWise Event Pcap info. Deprecated - use the protectwise-observation-pcap-download command.
  - name: observation-pcap-download
    deprecated: true
    arguments:
    - name: id
      required: true
      default: true
      description: The ID of the observation.
    - name: sensorId
      required: true
      description: The ID of the sensor.
    - name: filename
      description: The filename for the download.
    description: Downloads the observation PCAP file.
  - name: protectwise-observation-pcap-download
    arguments:
    - name: id
      required: true
      default: true
      description: The ID of the observation.
    - name: sensorId
      required: true
      description: The ID of the sensor.
    - name: filename
      description: The filename for the download.
    description: Downloads the Observation PCAP file. Deprecated - use the protectwise-observation-pcap-info command.
  - name: observation-pcap-info
    deprecated: true
    arguments:
    - name: id
      required: true
      description: The ID of the observation.
    - name: sensorId
      required: true
      description: The ID of the sensor.
    description: Returns PCAP details of observations in Protectwise.
  - name: protectwise-observation-pcap-info
    arguments:
    - name: id
      required: true
      description: The ID of the observation.
    - name: sensorId
      required: true
      description: The ID of the Sensor.
    outputs:
    - contextPath: Protectwise.Observation.id
      description: The ID of the observation.
    - contextPath: Protectwise.Observation.sensorId
      description: The Sensor ID of the observation.
    - contextPath: Protectwise.Observation.PCAPSize
      description: Estimated PCAP size in bytes.
    description: Returns ProtectWise Observation PCAP file information.
  - name: get-token
    deprecated: true
    arguments: []
    description: Returns the API token, which is used in the integration configuration.
  isfetch: true
fromversion: 5.0.0
tests:
- Protectwise-Test