RSA NetWitness Security Analytics

RSA Security Analytics, compatible with prior to v11. A distributed and modular system that enables highly flexible deployment architectures that scale with the needs of the organization. Security Analytics allows administrators to collect two types of data from the network infrastructure, packet data and log data.

Analytics & SIEM · RSA NetWitness Security Analytics

Details

IDRSA NetWitness Security Analytics
ProviderPartnerOne
CategoryAnalytics & SIEM
From Version5.0.0
Supported ModulesAgentix XSIAM

README

RSA Security Analytics is a distributed and modular system that enables highly flexible deployment architectures that scale with the needs of the organization. Security Analytics allows administrators to collect two types of data from the network infrastructure, packet data and log data.
This integraitons should work with RSA Netwitness older than v11. For versions v11 and above use the integration RSA NetWitness v11.1.

Configure RSA NetWitness Security Analytics in Cortex

Parameter Description Required
url Server Url (192.168.56.101) True
username Username True
password Password True
isFetch Fetch incidents False
incidentType Incident type False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

nw-login

Logins to the system and returns valid sessionId

Base Command

nw-login

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

fetch-incidents

Simulates fetching incidents. Returns array of incidents from NetWitness.

Base Command

fetch-incidents

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

netwitness-im-list-incidents

Fetches incidents by filter

Base Command

netwitness-im-list-incidents

Input

Argument Name Description Required
query If query provided all other parameters ignored. Query should contain page, limit, start, sort and filter, joined by &, For example: page=1&start=0&limit=100&sort=[{“property”:”created”,”direction”:”DESC”}]&filter=[{“property”:”created”,”value”:[851171984031,1482323984031]}] Optional
page The default is 1. Indicates the page number of incidents Optional
start The default is 0. Indicates the start index of incident in page Optional
limit The default is 100. Limits the number of incidents per page Optional
sort By default sorts by “created” field in “DESC” order. Example: “[{"property":"created","direction":"DESC"}]” Optional
filter By default filters by “created” from 1996 to this date. Example: “[{"property":"id", "value":"INC-21"}]” Optional
incidentManagementId [optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running netwitness-im-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server. Optional
loadAlerts [optinal boolean] By default alerts and events related to incident not loaded. If loadAlerts is true, then command will load all alerts and their events from SA. Please be noticed THIS IS HAS PERFORMANCE IMPACT! For each alert XHR request send to SA. Optional

Context Output

Path Type Description
Netwitness.Incident.Id unknown Netwitness Incident ID
Netwitness.Incident.Name unknown Netwitness Incident Name
Netwitness.Incident.Priority unknown Netwitness Incident Priority
Netwitness.Incident.CreatedBy unknown User who created Netwitness Incident
Netwitness.Incident.Summary unknown Netwitness Incident Summary
Netwitness.Incident.Assignee unknown User Assigned To Incident
Netwitness.Incident.Created unknown Time of Incident Creation
Netwitness.Incident.FirstAlertTime unknown Time of Incident Creation
Netwitness.Incident.LastUpdatedByUserName unknown User who was last to update Incident
Netwitness.Incident.RiskScore unknown Netwitness Incident Risk Score
Netwitness.Incident.AverageAlertRiskScore unknown Netwitness Incident Average Risk Score
Netwitness.Incident.Categories unknown Netwitness Incident Category
Netwitness.Incident.AlertCount unknown Netwitness Incident Alerts Counts

netwitness-im-login

Logins to the system and returns valid sessionId

Base Command

netwitness-im-login

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

netwitness-im-get-components

Returns all the components in the system

Base Command

netwitness-im-get-components

Input

Argument Name Description Required
query [optional string] Query must contain page, start, limit Optional

Context Output

Path Type Description
Netwitness.Component.Id unknown Netwitness Component ID
Netwitness.Component.DisplayName unknown Netwitness Component DisplayName
Netwitness.Component.DeviceVersion unknown Netwitness Component Device Version
Netwitness.Component.DisplayType unknown Netwitness Component Device Type
Netwitness.Component.Host unknown Netwitness Component Device Host
Netwitness.Component.Port unknown Netwitness Component Device Port
Netwitness.Component.Validated unknown Netwitness Component is passed validation
Netwitness.Component.Licensed unknown Netwitness Component license
Netwitness.Component.Username unknown Netwitness Component User Name
Netwitness.Component.EnableSSL unknown Netwitness Component Enable SSL

netwitness-im-get-events

Returns all the events in defined time range

Base Command

netwitness-im-get-events

Input

Argument Name Description Required
timeRangeType Filter of time range in which events occured Required
deviceId [number] Id of the device where the events stored/occurred. In order to get list of available devices/components run command netwitness-im-get-components Required
collectionName [optional] Optional
predicateIds [optional] Optional
startDate [optional datetime] If timeRangeType defined as CUSTOM, set this argument Optional
endDate [optional datetime] If timeRangeType defined as CUSTOM, set this argument Optional
lastCollectionTime [optional datetime] Last collection time Optional
mid1 The unique meta id for this field. If nw-get-events was called this will be your starting id for this distinct value Optional
mid2 The unique meta id for this field. If nw-get-events was called this will be your ending id for this distinct value. Optional
investigationToken [optional guid] Investigation id token Optional
page [optional number] Default set to 1. The page number Optional
start [optional number] Default set to 0. The starting index of event in page. Optional
limit [optional number] Default set to 25. Limits the number of events per page Optional
sort By default sorts by “id” field in “ASC” order. Example: “[{"property":"id","direction":"ASC"}]” Optional
filter <string> Must provide key value pairs of fieldName and their value separated by comma. Example: “ip.src=1.1.1.1,meta.device.type="crowdstrike"” Optional

Context Output

There is no context output for this command.

netwitness-im-get-available-assignees

Returns the available users to be assigned to incidents

Base Command

netwitness-im-get-available-assignees

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Netwitness.Account.Id unknown Netwitness Account ID
Netwitness.Account.Name unknown Netwitness Account Name
Netwitness.Account.Login unknown Netwitness Account Login Name
Netwitness.Account.EmailAddress unknown Netwitness Account Email Address

netwitness-im-create-incident

Creating new incident

Base Command

netwitness-im-create-incident

Input

Argument Name Description Required
alertSummary [string] Short summary of the alert which will be attached to incident Required
severity [optional string] Default set to “50”. Optional
name [string] The name of the incident. Required
assigned [optional string] Set assignee login name if assignee has changed. You can execute netwitness-im-get-available-assignees to get the list of users. Example: demisto123 Optional
eventList List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use netwitness-im-get-events Required
deviceId The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command netwitness-im-get-components Required
priority Priority of the incident Required
summary Summary of the incident Optional
incidentManagementId [optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running netwitness-im-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server. Optional

Context Output

Path Type Description
Netwitness.Incident.Id unknown Netwitness Incident ID
Netwitness.Incident.Name unknown Netwitness Incident Name
Netwitness.Incident.Priority unknown Netwitness Incident Priority
Netwitness.Incident.CreatedBy unknown User who created Netwitness.Incident
Netwitness.Incident.AlertIDList unknown Alerts which rised by incident

netwitness-im-add-events-to-incident

This command will add new events to existing incident

Base Command

netwitness-im-add-events-to-incident

Input

Argument Name Description Required
incidentId [string] Existing incident id. Required
eventList [array of strings] List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use netwitness-im-get-events. Example: “23,12,3” Required
alertSummary [string] Short summary of the alert which will be attached to incident Required
severity [number] Severity of the incident. Example: 50 Required
deviceId [number] The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command netwitness-im-get-components Required
incidentManagementId [optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running netwitness-im-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server. Optional

Context Output

There is no context output for this command.

netwitness-im-update-incident

Updates incident

Base Command

netwitness-im-update-incident

Input

Argument Name Description Required
idList List of incident ids which will be updated, separated by comma [,]. Must not contain spaces. Example: “INC-13,INC-15,INC-23” Required
name [optional string] Set name if incident name has been changed Optional
summary [optional string] Updated incident summary Optional
assignee [optional string] Set assignee login name if assignee has changed. You can execute netwitness-im-get-available-assignees to get the list of users. Example: demisto123 Optional
comment [optional string] Add a journal entry describing your changes Optional
status [optional status] Set status if changed Optional
priority [optional priority] Set priority if incident priority has been changed Optional
categories List of categories. Optional
incidentManagementId [optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running netwitness-im-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server. Optional

Context Output

There is no context output for this command.

netwitness-im-get-alerts

Return all the alerts filtered by filter.

Base Command

netwitness-im-get-alerts

Input

Argument Name Description Required
page The default is 1. Indicates the page number of incidents Optional
start The default is 0. Indicates the start index of incident in page Optional
limit The default is 100. Limits the number of incidents per page Optional
sort By default sorts by “alert.timestamp” field in “DESC” order. Example: “[{"property":"alert.timestamp","direction":"DESC"}]” Optional
filter By default filters by “alert.timestamp” from 1996 to this date. Example: “[{"property":"incidentId", "value":"INC-21"}]” Optional

Context Output

There is no context output for this command.

netwitness-im-get-alert-details

Return single alert by id

Base Command

netwitness-im-get-alert-details

Input

Argument Name Description Required
alertId Alert id Required

Context Output

Path Type Description
Netwitness.Alert.Id unknown Netwitness Alert ID
Netwitness.Alert.Name unknown Netwitness Alert Name
Netwitness.Alert.IncidentId unknown Id of Incident which caused to Alert
Netwitness.Alert.Timestamp unknown Time of Alert
Netwitness.Alert.HostSummary unknown Netwitness Alert Summary
Netwitness.Alert.SignatureId unknown Singnature Id of Alert
Netwitness.Alert.Source unknown Score of Alert
Netwitness.Alert.Type unknown Type of Alert
Netwitness.Alert.RiskScore unknown Risk score of Alert
Netwitness.Alert.SourceCountry unknown Netwitness Alert Source Country
Netwitness.Alert.DestinationCountry unknown Netwitness Alert Destination Country
Netwitness.Alert.NumEvents unknown Netwitness Alert Evevts Number
Netwitness.Alert.SourceIp unknown Netwitness Alert Source Ip
Netwitness.Alert.DestonationIp unknown Netwitness Alert Destonation Ip
Netwitness.Alert.DestonationPort unknown Netwitness Alert Destonation Port

netwitness-im-get-event-details

Returns two entries. One is event details json and the second is

Base Command

netwitness-im-get-event-details

Input

Argument Name Description Required
deviceId [number] Id of the device where the events stored/occurred. In order to get list of available devices/components run command netwitness-im-get-components Required
eventId [number] Id of the event Required

Context Output

Path Type Description
Netwitness.Event.EventId unknown Netwitness Event ID
Netwitness.Event.DeviceId unknown Netwitness Event Device Id
Netwitness.Event.ReconstructedContentType unknown Netwitness Event Reconstructed Content
Netwitness.Event.PacketsTotal unknown Total Packets Netwitness Event
Netwitness.Event.PacketsProcessed unknown Packets Processed in Current Event

netwitness-im-get-incident-details

Returns incident json by id

Base Command

netwitness-im-get-incident-details

Input

Argument Name Description Required
incidentId [number] ID of incident. Example: “INC-12” Required

Context Output

Path Type Description
Netwitness.Incident.Id unknown Netwitness Incident ID
Netwitness.Incident.Name unknown Netwitness Incident Name
Netwitness.Incident.Priority unknown Netwitness Incident Priority
Netwitness.Incident.CreatedBy unknown User who created Netwitness Incident
Netwitness.Incident.Summary unknown Netwitness Incident Summary
Netwitness.Incident.Assignee unknown User Assigned To Incident
Netwitness.Incident.Created unknown Time of Incident Creation
Netwitness.Incident.FirstAlertTime unknown Time of Incident Creation
Netwitness.Incident.LastUpdatedByUserName unknown User who was last to update Incident
Netwitness.Incident.RiskScore unknown Netwitness Incident Risk Score
Netwitness.Incident.AverageAlertRiskScore unknown Netwitness Incident Average Risk Score
Netwitness.Incident.Categories unknown Netwitness Incident Category
Netwitness.Incident.AlertCount unknown Netwitness Incident Alerts Counts

netwitness-im-get-alert-original

Returns the original events which this alert contains

Base Command

netwitness-im-get-alert-original

Input

Argument Name Description Required
alertId Id of the alert Required

Configuration parameters

  • url — Server Url (192.168.56.101) (required)
  • username — Username
  • password — Password
  • credentials — Username
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • proxy — Use system proxy settings

Commands (27)

  • fetch-incidents

    Simulates fetching incidents. Returns array of incidents from NetWitness.

  • netwitness-im-add-events-to-incident

    This command will add new events to existing incident.

  • netwitness-im-create-incident

    Creating new incident.

  • netwitness-im-get-alert-details

    Return single alert by id

  • netwitness-im-get-alert-original

    Returns the original events which this alert contains.

  • netwitness-im-get-alerts

    Return all the alerts filtered by filter.

  • netwitness-im-get-available-assignees

    Returns the available users to be assigned to incidents.

  • netwitness-im-get-components

    Returns all the components in the system.

  • netwitness-im-get-event-details

    Returns two entries. One is event details json and the second is.

  • netwitness-im-get-events

    Returns all the events in defined time range.

  • netwitness-im-get-incident-details

    Returns incident json by id.

  • netwitness-im-list-incidents

    Fetches incidents by filter.

  • netwitness-im-login

    Logins to the system and returns valid sessionId.

  • netwitness-im-update-incident

    Updates incident.

  • nw-add-events-to-incident Deprecated

    This command will add new events to existing incident.

  • nw-create-incident Deprecated

    Creating new incident.

  • nw-get-alert-details Deprecated

    Return single alert by id

  • nw-get-alert-original Deprecated

    Returns the original events which this alert contains.

  • nw-get-alerts Deprecated

    Return all the alerts filtered by filter.

  • nw-get-available-assignees Deprecated

    Returns the available users to be assigned to incidents.

  • nw-get-components Deprecated

    Returns all the components in the system.

  • nw-get-event-details Deprecated

    Returns two entries. One is event details json and the second is event/session content.

  • nw-get-events Deprecated

    Returns all the events in defined time range.

  • nw-get-incident-details Deprecated

    Returns incident json by id.

  • nw-list-incidents Deprecated

    Fetches incidents by filter.

  • nw-login

    Logins to the system and returns valid sessionId.

  • nw-update-incident Deprecated

    Updates incident.

Source

RSANetWitnessSecurityAnalytics.js RSANetWitnessSecurityAnalytics.yml
Download History Raw 
commonfields:
  id: RSA NetWitness Security Analytics
  version: -1
sectionorder:
- Connect
- Collect
name: RSA NetWitness Security Analytics
system: true
fromversion: 5.0.0
display: RSA NetWitness Security Analytics
category: Analytics & SIEM
provider: PartnerOne
description: RSA Security Analytics, compatible with prior to v11. A distributed and modular system that enables highly flexible deployment architectures that scale with the needs of the organization. Security Analytics allows administrators to collect two types of data from the network infrastructure, packet data and log data.
configuration:
- display: Server Url (192.168.56.101)
  name: url
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: Username
  name: username
  defaultvalue: ""
  type: 0
  hidden: true
  required: false
  section: Connect
- display: Password
  name: password
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- display: Username
  name: credentials
  type: 9
  displaypassword: Password
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  script: ''
  type: javascript
  commands:
  - name: nw-list-incidents
    deprecated: true
    arguments:
    - name: query
      description: 'If query provided all other parameters ignored. Query should contain page, limit, start, sort and filter, joined by &, For example: page=1&start=0&limit=100&sort=[{"property":"created","direction":"DESC"}]&filter=[{"property":"created","value":[851171984031,1482323984031]}].'
    - name: page
      description: The default is 1. Indicates the page number of incidents.
    - name: start
      description: The default is 0. Indicates the start index of incident in page.
    - name: limit
      description: The default is 100. Limits the number of incidents per page.
    - name: sort
      description: 'By default sorts by "created" field in "DESC" order. Example: "[{\"property\":\"created\",\"direction\":\"DESC\"}]".'
    - name: filter
      description: 'By default filters by "created" from 1996 to this date. Example: "[{\"property\":\"id\", \"value\":\"INC-21\"}]".'
    - name: incidentManagementId
      description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running nw-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
    - name: loadAlerts
      description: '[optinal boolean] By default alerts and events related to incident not loaded. If loadAlerts is true, then command will load all alerts and their events from SA. Please be noticed THIS IS HAS PERFORMANCE IMPACT! For each alert XHR request send to SA.'
    description: Fetches incidents by filter.
  - name: nw-login
    arguments: []
    description: Logins to the system and returns valid sessionId.
  - name: nw-get-components
    deprecated: true
    arguments:
    - name: query
      description: '[optional string] Query must contain page, start, limit.'
    description: Returns all the components in the system.
  - name: nw-get-events
    deprecated: true
    arguments:
    - name: timeRangeType
      required: true
      auto: PREDEFINED
      predefined:
      - LAST_5_MINUTES
      - LAST_10_MINUTES
      - LAST_15_MINUTES
      - LAST_30_MINUTES
      - LAST_HOUR
      - LAST_3_HOURS
      - LAST_6_HOURS
      - LAST_12_HOURS
      - LAST_24_HOURS
      - LAST_2_DAYS
      - LAST_5_DAYS
      - EARLY_MORNING
      - MORNING
      - AFTERNOON
      - EVENING
      - TODAY
      - YESTERDAY
      - THIS_WEEK
      - LAST_WEEK
      - ALL_DATA
      - CUSTOM
      description: Filter of time range in which events occured.
    - name: deviceId
      required: true
      description: '[number] Id of the device where the events stored/occurred. In order to get list of available devices/components run command nw-get-components.'
    - name: collectionName
      description: '[optional].'
    - name: predicateIds
      description: '[optional].'
    - name: startDate
      description: '[optional datetime] If timeRangeType defined as CUSTOM, set this argument.'
    - name: endDate
      description: '[optional datetime] If timeRangeType defined as CUSTOM, set this argument.'
    - name: lastCollectionTime
      description: '[optional datetime] Last collection time.'
    - name: mid1
      description: 'The unique meta id for this field. If nw-get-events was called this will be your starting id for this distinct value.'
    - name: mid2
      description: 'The unique meta id for this field. If nw-get-events was called this will be your ending id for this distinct value.'
    - name: investigationToken
      description: '[optional guid] Investigation id token.'
    - name: page
      description: '[optional number] Default set to 1. The page number.'
    - name: start
      description: '[optional number] Default set to 0. The starting index of event in page.'
    - name: limit
      description: '[optional number] Default set to 25. Limits the number of events per page.'
    - name: sort
      description: 'By default sorts by "id" field in "ASC" order. Example: "[{\"property\":\"id\",\"direction\":\"ASC\"}]".'
    - name: filter
      description: '<string> Must provide key value pairs of fieldName and their value separated by comma. Example: "ip.src=1.1.1.1,meta.device.type=\"crowdstrike\"".'
    description: Returns all the events in defined time range.
  - name: nw-get-available-assignees
    deprecated: true
    arguments: []
    description: Returns the available users to be assigned to incidents.
    outputs:
    - contextPath: Netwitness.Component.Id
      description: Netwitness User ID.
    - contextPath: Netwitness.Component.Name
      description: Netwitness User Name.
    - contextPath: Netwitness.Component.Login
      description: Netwitness User Lofin Name.
    - contextPath: Netwitness.Component.EmailAddress
      description: Netwitness User Email Address.
  - name: nw-create-incident
    deprecated: true
    arguments:
    - name: alertSummary
      required: true
      description: '[string] Short summary of the alert which will be attached to incident.'
    - name: severity
      description: '[optional string] Default set to "50".'
    - name: name
      required: true
      description: '[string] The name of the incident.'
    - name: assigned
      description: '[optional string] Set assignee login name if assignee has changed. You can execute nw-get-available-assignees to get the list of users. Example: demisto123.'
    - name: eventList
      required: true
      description: List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use nw-get-events.
    - name: deviceId
      required: true
      description: The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command nw-get-components.
    - name: priority
      required: true
      auto: PREDEFINED
      predefined:
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      description: Priority of the incident.
    - name: summary
      description: Summary of the incident.
    - name: incidentManagementId
      description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running nw-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
    description: Creating new incident.
    execution: true
  - name: nw-add-events-to-incident
    deprecated: true
    arguments:
    - name: incidentId
      required: true
      default: true
      description: '[string] Existing incident id.'
    - name: eventList
      required: true
      description: '[array of strings] List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use nw-get-events. Example: "23,12,3".'
    - name: alertSummary
      required: true
      description: '[string] Short summary of the alert which will be attached to incident.'
    - name: severity
      required: true
      description: '[number] Severity of the incident. Example: 50.'
    - name: deviceId
      required: true
      description: '[number] The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command nw-get-components.'
    - name: incidentManagementId
      description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running nw-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
    description: This command will add new events to existing incident.
    execution: true
  - name: nw-update-incident
    deprecated: true
    arguments:
    - name: idList
      required: true
      description: 'List of incident ids which will be updated, separated by comma [,]. Must not contain spaces. Example: "INC-13,INC-15,INC-23".'
    - name: name
      description: '[optional string] Set name if incident name has been changed.'
    - name: summary
      description: '[optional string] Updated incident summary.'
    - name: assignee
      description: '[optional string] Set assignee login name if assignee has changed. You can execute nw-get-available-assignees to get the list of users. Example: demisto123.'
    - name: comment
      description: '[optional string] Add a journal entry describing your changes.'
    - name: status
      auto: PREDEFINED
      predefined:
      - NEW
      - ASSIGNED
      - IN_PROGRESS
      - REMEDIATION_REQUESTED
      - REMEDIATION_COMPLETED
      - CLOSED
      - CLOSED_FALSE_POSITIVE
      description: '[optional status] Set status if changed.'
    - name: priority
      auto: PREDEFINED
      predefined:
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      description: '[optional priority] Set priority if incident priority has been changed.'
    - name: categories
      description: List of categories.
    - name: incidentManagementId
      description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running nw-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
    description: Updates incident.
    execution: true
  - name: fetch-incidents
    description: Simulates fetching incidents. Returns array of incidents from NetWitness.
    arguments: []
  - name: nw-get-alerts
    description: Return all the alerts filtered by filter.
    deprecated: true
    arguments:
    - name: page
      description: The default is 1. Indicates the page number of incidents.
    - name: start
      description: The default is 0. Indicates the start index of incident in page.
    - name: limit
      description: The default is 100. Limits the number of incidents per page.
    - name: sort
      description: 'By default sorts by "alert.timestamp" field in "DESC" order. Example: "[{\"property\":\"alert.timestamp\",\"direction\":\"DESC\"}]".'
    - name: filter
      description: 'By default filters by "alert.timestamp" from 1996 to this date. Example: "[{\"property\":\"incidentId\", \"value\":\"INC-21\"}]".'
  - name: nw-get-alert-details
    description: Return single alert by id
    deprecated: true
    arguments:
    - name: alertId
      description: Alert id.
      required: true
  - name: nw-get-event-details
    deprecated: true
    arguments:
    - name: deviceId
      required: true
      description: '[number] Id of the device where the events stored/occurred. In order to get list of available devices/components run command nw-get-components.'
    - name: eventId
      required: true
      description: '[number] Id of the event.'
    description: Returns two entries. One is event details json and the second is event/session content.
  - name: nw-get-incident-details
    deprecated: true
    arguments:
    - name: incidentId
      required: true
      default: true
      description: '[number] ID of incident. Example: "INC-12".'
    description: Returns incident json by id.
  - name: nw-get-alert-original
    deprecated: true
    arguments:
    - name: alertId
      required: true
      default: true
      description: Id of the alert.
    description: Returns the original events which this alert contains.
  - name: netwitness-im-list-incidents
    arguments:
    - name: query
      description: 'If query provided all other parameters ignored. Query should contain page, limit, start, sort and filter, joined by &, For example: page=1&start=0&limit=100&sort=[{"property":"created","direction":"DESC"}]&filter=[{"property":"created","value":[851171984031,1482323984031]}].'
    - name: page
      description: The default is 1. Indicates the page number of incidents.
    - name: start
      description: The default is 0. Indicates the start index of incident in page.
    - name: limit
      description: The default is 100. Limits the number of incidents per page.
    - name: sort
      description: 'By default sorts by "created" field in "DESC" order. Example: "[{\"property\":\"created\",\"direction\":\"DESC\"}]".'
    - name: filter
      description: 'By default filters by "created" from 1996 to this date. Example: "[{\"property\":\"id\", \"value\":\"INC-21\"}]".'
    - name: incidentManagementId
      description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running netwitness-im-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
    - name: loadAlerts
      description: '[optinal boolean] By default alerts and events related to incident not loaded. If loadAlerts is true, then command will load all alerts and their events from SA. Please be noticed THIS IS HAS PERFORMANCE IMPACT! For each alert XHR request send to SA.'
    description: Fetches incidents by filter.
    outputs:
    - contextPath: Netwitness.Incident.Id
      description: Netwitness Incident ID.
    - contextPath: Netwitness.Incident.Name
      description: Netwitness Incident Name.
    - contextPath: Netwitness.Incident.Priority
      description: Netwitness Incident Priority.
    - contextPath: Netwitness.Incident.CreatedBy
      description: User who created Netwitness Incident.
    - contextPath: Netwitness.Incident.Summary
      description: Netwitness Incident Summary.
    - contextPath: Netwitness.Incident.Assignee
      description: User Assigned To Incident.
    - contextPath: Netwitness.Incident.Created
      description: Time of Incident Creation.
    - contextPath: Netwitness.Incident.FirstAlertTime
      description: Time of Incident Creation.
    - contextPath: Netwitness.Incident.LastUpdatedByUserName
      description: User who was last to update Incident.
    - contextPath: Netwitness.Incident.RiskScore
      description: Netwitness Incident Risk Score.
    - contextPath: Netwitness.Incident.AverageAlertRiskScore
      description: Netwitness Incident Average Risk Score.
    - contextPath: Netwitness.Incident.Categories
      description: Netwitness Incident Category.
    - contextPath: Netwitness.Incident.AlertCount
      description: Netwitness Incident Alerts Counts.
  - name: netwitness-im-login
    arguments: []
    description: Logins to the system and returns valid sessionId.
  - name: netwitness-im-get-components
    arguments:
    - name: query
      description: '[optional string] Query must contain page, start, limit.'
    description: Returns all the components in the system.
    outputs:
    - contextPath: Netwitness.Component.Id
      description: Netwitness Component ID.
    - contextPath: Netwitness.Component.DisplayName
      description: Netwitness Component DisplayName.
    - contextPath: Netwitness.Component.DeviceVersion
      description: Netwitness Component Device Version.
    - contextPath: Netwitness.Component.DisplayType
      description: Netwitness Component Device Type.
    - contextPath: Netwitness.Component.Host
      description: Netwitness Component Device Host.
    - contextPath: Netwitness.Component.Port
      description: Netwitness Component Device Port.
    - contextPath: Netwitness.Component.Validated
      description: Netwitness Component is passed validation.
    - contextPath: Netwitness.Component.Licensed
      description: Netwitness Component license.
    - contextPath: Netwitness.Component.Username
      description: Netwitness Component User Name.
    - contextPath: Netwitness.Component.EnableSSL
      description: Netwitness Component Enable SSL.
  - name: netwitness-im-get-events
    arguments:
    - name: timeRangeType
      required: true
      auto: PREDEFINED
      predefined:
      - LAST_5_MINUTES
      - LAST_10_MINUTES
      - LAST_15_MINUTES
      - LAST_30_MINUTES
      - LAST_HOUR
      - LAST_3_HOURS
      - LAST_6_HOURS
      - LAST_12_HOURS
      - LAST_24_HOURS
      - LAST_2_DAYS
      - LAST_5_DAYS
      - EARLY_MORNING
      - MORNING
      - AFTERNOON
      - EVENING
      - TODAY
      - YESTERDAY
      - THIS_WEEK
      - LAST_WEEK
      - ALL_DATA
      - CUSTOM
      description: Filter of time range in which events occured.
    - name: deviceId
      required: true
      description: '[number] Id of the device where the events stored/occurred. In order to get list of available devices/components run command netwitness-im-get-components.'
    - name: collectionName
      description: '[optional].'
    - name: predicateIds
      description: '[optional].'
    - name: startDate
      description: '[optional datetime] If timeRangeType defined as CUSTOM, set this argument.'
    - name: endDate
      description: '[optional datetime] If timeRangeType defined as CUSTOM, set this argument.'
    - name: lastCollectionTime
      description: '[optional datetime] Last collection time.'
    - name: mid1
      description: 'The unique meta id for this field. If nw-get-events was called this will be your starting id for this distinct value.'
    - name: mid2
      description: 'The unique meta id for this field. If nw-get-events was called this will be your ending id for this distinct value.'
    - name: investigationToken
      description: '[optional guid] Investigation id token.'
    - name: page
      description: '[optional number] Default set to 1. The page number.'
    - name: start
      description: '[optional number] Default set to 0. The starting index of event in page.'
    - name: limit
      description: '[optional number] Default set to 25. Limits the number of events per page.'
    - name: sort
      description: 'By default sorts by "id" field in "ASC" order. Example: "[{\"property\":\"id\",\"direction\":\"ASC\"}]".'
    - name: filter
      description: '<string> Must provide key value pairs of fieldName and their value separated by comma. Example: "ip.src=1.1.1.1,meta.device.type=\"crowdstrike\"".'
    description: Returns all the events in defined time range.
  - name: netwitness-im-get-available-assignees
    arguments: []
    description: Returns the available users to be assigned to incidents.
    outputs:
    - contextPath: Netwitness.Account.Id
      description: Netwitness Account ID.
    - contextPath: Netwitness.Account.Name
      description: Netwitness Account Name.
    - contextPath: Netwitness.Account.Login
      description: Netwitness Account Login Name.
    - contextPath: Netwitness.Account.EmailAddress
      description: Netwitness Account Email Address.
  - name: netwitness-im-create-incident
    arguments:
    - name: alertSummary
      required: true
      description: '[string] Short summary of the alert which will be attached to incident.'
    - name: severity
      description: '[optional string] Default set to "50".'
    - name: name
      required: true
      description: '[string] The name of the incident.'
    - name: assigned
      description: '[optional string] Set assignee login name if assignee has changed. You can execute netwitness-im-get-available-assignees to get the list of users. Example: demisto123.'
    - name: eventList
      required: true
      description: List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use netwitness-im-get-events.
    - name: deviceId
      required: true
      description: The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command netwitness-im-get-components.
    - name: priority
      required: true
      auto: PREDEFINED
      predefined:
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      description: Priority of the incident.
    - name: summary
      description: Summary of the incident.
    - name: incidentManagementId
      description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running netwitness-im-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
    description: Creating new incident.
    outputs:
    - contextPath: Netwitness.Incident.Id
      description: Netwitness Incident ID.
    - contextPath: Netwitness.Incident.Name
      description: Netwitness Incident Name.
    - contextPath: Netwitness.Incident.Priority
      description: Netwitness Incident Priority.
    - contextPath: Netwitness.Incident.CreatedBy
      description: User who created Netwitness.Incident.
    - contextPath: Netwitness.Incident.AlertIDList
      description: Alerts which rised by incident.
    execution: true
  - name: netwitness-im-add-events-to-incident
    arguments:
    - name: incidentId
      required: true
      default: true
      description: '[string] Existing incident id.'
    - name: eventList
      required: true
      description: '[array of strings] List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use netwitness-im-get-events. Example: "23,12,3".'
    - name: alertSummary
      required: true
      description: '[string] Short summary of the alert which will be attached to incident.'
    - name: severity
      required: true
      description: '[number] Severity of the incident. Example: 50.'
    - name: deviceId
      required: true
      description: '[number] The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command netwitness-im-get-components.'
    - name: incidentManagementId
      description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running netwitness-im-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
    description: This command will add new events to existing incident.
    execution: true
  - name: netwitness-im-update-incident
    arguments:
    - name: idList
      required: true
      description: 'List of incident ids which will be updated, separated by comma [,]. Must not contain spaces. Example: "INC-13,INC-15,INC-23".'
    - name: name
      description: '[optional string] Set name if incident name has been changed.'
    - name: summary
      description: '[optional string] Updated incident summary.'
    - name: assignee
      description: '[optional string] Set assignee login name if assignee has changed. You can execute netwitness-im-get-available-assignees to get the list of users. Example: demisto123.'
    - name: comment
      description: '[optional string] Add a journal entry describing your changes.'
    - name: status
      auto: PREDEFINED
      predefined:
      - NEW
      - ASSIGNED
      - IN_PROGRESS
      - REMEDIATION_REQUESTED
      - REMEDIATION_COMPLETED
      - CLOSED
      - CLOSED_FALSE_POSITIVE
      description: '[optional status] Set status if changed.'
    - name: priority
      auto: PREDEFINED
      predefined:
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      description: '[optional priority] Set priority if incident priority has been changed.'
    - name: categories
      description: List of categories.
    - name: incidentManagementId
      description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running netwitness-im-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
    description: Updates incident.
    execution: true
  - name: netwitness-im-get-alerts
    description: Return all the alerts filtered by filter.
    arguments:
    - name: page
      description: The default is 1. Indicates the page number of incidents.
    - name: start
      description: The default is 0. Indicates the start index of incident in page.
    - name: limit
      description: The default is 100. Limits the number of incidents per page.
    - name: sort
      description: 'By default sorts by "alert.timestamp" field in "DESC" order. Example: "[{\"property\":\"alert.timestamp\",\"direction\":\"DESC\"}]".'
    - name: filter
      description: 'By default filters by "alert.timestamp" from 1996 to this date. Example: "[{\"property\":\"incidentId\", \"value\":\"INC-21\"}]".'
  - name: netwitness-im-get-alert-details
    description: Return single alert by id
    arguments:
    - name: alertId
      description: Alert id.
      required: true
    outputs:
    - contextPath: Netwitness.Alert.Id
      description: Netwitness Alert ID.
    - contextPath: Netwitness.Alert.Name
      description: Netwitness Alert Name.
    - contextPath: Netwitness.Alert.IncidentId
      description: Id of Incident which caused to Alert.
    - contextPath: Netwitness.Alert.Timestamp
      description: Time of Alert.
    - contextPath: Netwitness.Alert.HostSummary
      description: Netwitness Alert Summary.
    - contextPath: Netwitness.Alert.SignatureId
      description: Singnature Id of Alert.
    - contextPath: Netwitness.Alert.Source
      description: Score of Alert.
    - contextPath: Netwitness.Alert.Type
      description: Type of Alert.
    - contextPath: Netwitness.Alert.RiskScore
      description: Risk score of Alert.
    - contextPath: Netwitness.Alert.SourceCountry
      description: Netwitness Alert Source Country.
    - contextPath: Netwitness.Alert.DestinationCountry
      description: Netwitness Alert Destination Country.
    - contextPath: Netwitness.Alert.NumEvents
      description: Netwitness Alert Evevts Number.
    - contextPath: Netwitness.Alert.SourceIp
      description: Netwitness Alert Source Ip.
    - contextPath: Netwitness.Alert.DestonationIp
      description: Netwitness Alert Destonation Ip.
    - contextPath: Netwitness.Alert.DestonationPort
      description: Netwitness Alert Destonation Port.
  - name: netwitness-im-get-event-details
    arguments:
    - name: deviceId
      required: true
      description: '[number] Id of the device where the events stored/occurred. In order to get list of available devices/components run command netwitness-im-get-components.'
    - name: eventId
      required: true
      description: '[number] Id of the event.'
    description: Returns two entries. One is event details json and the second is.
    outputs:
    - contextPath: Netwitness.Event.EventId
      description: Netwitness Event ID.
    - contextPath: Netwitness.Event.DeviceId
      description: Netwitness Event Device Id.
    - contextPath: Netwitness.Event.ReconstructedContentType
      description: Netwitness Event Reconstructed Content.
    - contextPath: Netwitness.Event.PacketsTotal
      description: Total Packets Netwitness Event.
    - contextPath: Netwitness.Event.PacketsProcessed
      description: Packets Processed in Current Event.
  - name: netwitness-im-get-incident-details
    arguments:
    - name: incidentId
      required: true
      default: true
      description: '[number] ID of incident. Example: "INC-12".'
    description: Returns incident json by id.
    outputs:
    - contextPath: Netwitness.Incident.Id
      description: Netwitness Incident ID.
    - contextPath: Netwitness.Incident.Name
      description: Netwitness Incident Name.
    - contextPath: Netwitness.Incident.Priority
      description: Netwitness Incident Priority.
    - contextPath: Netwitness.Incident.CreatedBy
      description: User who created Netwitness Incident.
    - contextPath: Netwitness.Incident.Summary
      description: Netwitness Incident Summary.
    - contextPath: Netwitness.Incident.Assignee
      description: User Assigned To Incident.
    - contextPath: Netwitness.Incident.Created
      description: Time of Incident Creation.
    - contextPath: Netwitness.Incident.FirstAlertTime
      description: Time of Incident Creation.
    - contextPath: Netwitness.Incident.LastUpdatedByUserName
      description: User who was last to update Incident.
    - contextPath: Netwitness.Incident.RiskScore
      description: Netwitness Incident Risk Score.
    - contextPath: Netwitness.Incident.AverageAlertRiskScore
      description: Netwitness Incident Average Risk Score.
    - contextPath: Netwitness.Incident.Categories
      description: Netwitness Incident Category.
    - contextPath: Netwitness.Incident.AlertCount
      description: Netwitness Incident Alerts Counts.
  - name: netwitness-im-get-alert-original
    arguments:
    - name: alertId
      required: true
      default: true
      description: Id of the alert.
    description: Returns the original events which this alert contains.
  isfetch: true
tests:
- no test