Reco

Reco is the leader in SaaS & AI Security, providing full visibility and control across your SaaS ecosystem and AI agents.

Data Enrichment & Threat Intelligence · Reco

Details

ID	`Reco`
Provider	Reco AI
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

Reco is the leader in SaaS & AI Security — securing AI sprawl across SaaS apps and agents. This integration connects Reco’s SaaS & AI Security platform to Cortex XSOAR, enabling real-time threat response, posture management, AI governance, and identity risk workflows.

This integration was integrated and tested with Reco External API v1.

Configure Reco in Cortex

Parameter	Description	Required
Server URL (e.g. https://host.reco.ai/api/v1)	Base URL of your Reco instance	True
JWT app token	API Token (Bearer)	True
Trust any certificate (not secure)	Skip TLS verification	False
Use system proxy settings	Route requests through the system proxy	False
Incident type	Incident type to map Reco alerts to	False
Fetch incidents	Enable automatic incident fetching	False
Max fetch	Maximum incidents to fetch per run (up to 500)	False
Source	Filter fetched incidents by SaaS source	False
Before	Fetch incidents created before this timestamp	False
After	Fetch incidents created after this timestamp	False
Minimum risk level (e.g. MEDIUM fetches medium and higher)	The minimum severity threshold for fetched incidents. Accepts a single value: LOW, MEDIUM, HIGH, or CRITICAL (or numeric equivalents 10, 20, 30, 40). Alerts at or above this severity are fetched.	False
First fetch timestamp	How far back to fetch on first run (e.g. `7 days`, `12 hours`)	False

SCIM v2 Filters

All reco-list-* commands accept an optional filters argument using SCIM v2 syntax:

Operator	Meaning	Example
`eq`	Equals	`severity eq "HIGH"`
`ne`	Not equals	`status ne "CLOSED"`
`co`	Contains	`email co "@example.com"`
`sw`	Starts with	`name sw "John"`
`gt` / `ge`	Greater than / or equal	`createdAt gt "2024-01-01T00:00:00Z"`
`lt` / `le`	Less than / or equal	`lastSeen le "2024-12-31T23:59:59Z"`
`in`	Matches any listed value	`severity in ["HIGH","CRITICAL"]`
`not in`	Excludes listed values	`status not in ["CLOSED"]`
`and` / `or` / `not`	Logical operators	`isAdmin eq true and hasMfa eq false`

Pagination is embedded in the filter string: limit eq 100 and page eq 1.

Commands

reco-add-comment-to-alert

Add a comment to an alert in Reco.

Base Command

reco-add-comment-to-alert

Input

Argument Name	Description	Required
alert_id	Alert ID to add the comment to.	Required
comment	Comment text.	Required

reco-update-incident-timeline

Add a comment to an incident timeline in Reco.

Base Command

reco-update-incident-timeline

Input

Argument Name	Description	Required
incident_id	Incident ID.	Required
comment	Comment text.	Required

reco-resolve-visibility-event

Resolve an event in a Reco Finding.

Base Command

reco-resolve-visibility-event

Input

Argument Name	Description	Required
entity_id	Entity ID of the file to resolve.	Required
label_name	Label name to resolve (e.g. `Accessible to All Org Users`).	Required

reco-get-risky-users

List all accounts flagged as risky (auto-paginates all results).

Base Command

reco-get-risky-users

Context Output

Path	Type	Description
Reco.RiskyUsers.id	String	Account ID
Reco.RiskyUsers.name	String	Account display name
Reco.RiskyUsers.accountEmail	String	Account email address
Reco.RiskyUsers.permissions	String	Account permissions (ADMIN / PRIVILEGED / STANDARD)
Reco.RiskyUsers.hasMfa	String	MFA status (MFA / NOMFA / NA)
Reco.RiskyUsers.openAlerts	Number	Number of open alerts for this account
Reco.RiskyUsers.isAdmin	Boolean	Whether the account has admin privileges
Reco.RiskyUsers.isRiskyUser	Boolean	Whether the account is flagged as risky
Reco.RiskyUsers.lastSeen	Date	Last activity timestamp
Reco.RiskyUsers	Unknown	Risky Users.

reco-add-risky-user-label

Tag a user as risky in Reco.

Base Command

reco-add-risky-user-label

Input

Argument Name	Description	Required
email_address	Email address of the user to tag as risky.	Required

reco-add-leaving-org-user-label

Tag a user as a departing employee in Reco.

Base Command

reco-add-leaving-org-user-label

Input

Argument Name	Description	Required
email_address	Email address of the user to tag as departing.	Required

reco-get-assets-user-has-access-to

List files a user has access to.

Base Command

reco-get-assets-user-has-access-to

Input

Argument Name	Description	Required
email_address	User email address.	Required
only_sensitive	Return only sensitive assets.	Optional

Context Output

Path	Type	Description
Reco.Assets	Unknown	Assets the user has access to

reco-get-sensitive-assets-by-name

Find sensitive assets by name.

Base Command

reco-get-sensitive-assets-by-name

Input

Argument Name	Description	Required
asset_name	Asset name to search for.	Required
regex_search	Use substring/contains matching instead of exact match.	Optional

Context Output

Path	Type	Description
Reco.SensitiveAssets.id	String	Asset ID
Reco.SensitiveAssets.name	String	Asset name
Reco.SensitiveAssets.owner	String	Asset owner
Reco.SensitiveAssets.url	String	Asset URL
Reco.SensitiveAssets.sensitivityLevel	Number	Sensitivity level (30=HIGH, 40=CRITICAL)
Reco.SensitiveAssets.permissionVisibility	String	Permission visibility (PUBLIC / INTERNAL / RESTRICTED)
Reco.SensitiveAssets.location	String	File path
Reco.SensitiveAssets.dataCategories	Unknown	Detected data categories
Reco.SensitiveAssets.file_name	String	The name of the asset.
Reco.SensitiveAssets.file_owner	String	The owner of the asset.
Reco.SensitiveAssets.file_url	Unknown	Json string of the asset’s url and the name.
Reco.SensitiveAssets.currently_permitted_users	String	List of currently permitted users.
Reco.SensitiveAssets.visibility	String	Visibility of the asset.
Reco.SensitiveAssets.source	String	SaaS tool source of the asset.
Reco.SensitiveAssets.sensitivity_level	Number	The sensitivity level of the asset.

reco-get-sensitive-assets-by-id

Find sensitive assets by ID.

Base Command

reco-get-sensitive-assets-by-id

Input

Argument Name	Description	Required
asset_id	Asset ID.	Required

Context Output

Path	Type	Description
Reco.SensitiveAssets.id	String	Asset ID
Reco.SensitiveAssets.name	String	Asset name
Reco.SensitiveAssets.owner	String	Asset owner
Reco.SensitiveAssets.url	String	Asset URL
Reco.SensitiveAssets.sensitivityLevel	Number	Sensitivity level (30=HIGH, 40=CRITICAL)
Reco.SensitiveAssets.permissionVisibility	String	Permission visibility (PUBLIC / INTERNAL / RESTRICTED)
Reco.SensitiveAssets.location	String	File path
Reco.SensitiveAssets.dataCategories	Unknown	Detected data categories
Reco.SensitiveAssets.file_name	String	The name of the asset.
Reco.SensitiveAssets.file_owner	String	The owner of the asset.
Reco.SensitiveAssets.file_url	Unknown	Json string of the asset’s url and the name.
Reco.SensitiveAssets.currently_permitted_users	String	List of currently permitted users.
Reco.SensitiveAssets.visibility	String	Visibility of the asset.
Reco.SensitiveAssets.source	String	SaaS tool source of the asset.
Reco.SensitiveAssets.sensitivity_level	Number	The sensitivity level of the asset.

reco-get-assets-by-id

Find any asset by ID.

Base Command

reco-get-assets-by-id

Input

Argument Name	Description	Required
asset_id	Asset ID.	Required

Context Output

Path	Type	Description
Reco.SensitiveAssets.id	String	Asset ID
Reco.SensitiveAssets.name	String	Asset name
Reco.SensitiveAssets.owner	String	Asset owner
Reco.SensitiveAssets.url	String	Asset URL
Reco.SensitiveAssets.sensitivityLevel	Number	Sensitivity level (30=HIGH, 40=CRITICAL)
Reco.SensitiveAssets.permissionVisibility	String	Permission visibility (PUBLIC / INTERNAL / RESTRICTED)
Reco.SensitiveAssets.location	String	File path
Reco.SensitiveAssets.dataCategories	Unknown	Detected data categories
Reco.SensitiveAssets.file_name	String	The name of the asset.
Reco.SensitiveAssets.file_owner	String	The owner of the asset.
Reco.SensitiveAssets.file_url	Unknown	Json string of the asset’s url and the name.
Reco.SensitiveAssets.currently_permitted_users	String	List of currently permitted users.
Reco.SensitiveAssets.visibility	String	Visibility of the asset.
Reco.SensitiveAssets.source	String	SaaS tool source of the asset.
Reco.SensitiveAssets.sensitivity_level	Number	The sensitivity level of the asset.

reco-get-link-to-user-overview-page

Generate a deep link to the Reco UI overview page for an entity.

Base Command

reco-get-link-to-user-overview-page

Input

Argument Name	Description	Required
entity	Entity type (e.g. `RM_LINK_TYPE_USER`).	Required
param	Entity ID or email.	Optional

reco-get-3rd-parties-accessible-to-data-list

List third-party domains that have access to sensitive data.

Base Command

reco-get-3rd-parties-accessible-to-data-list

Input

Argument Name	Description	Required
last_interaction_time_in_days	Include domains with activity within this many days.	Required

Context Output

Path	Type	Description
Reco.Domains.domain	String	Third-party domain
Reco.Domains.last_activity	String	Last interaction date
Reco.Domains.files_num	Number	Number of files accessible
Reco.Domains.users_with_access_num	Number	Number of users with access

reco-get-sensitive-assets-with-public-link

List sensitive assets exposed via a public link.

Base Command

reco-get-sensitive-assets-with-public-link

Context Output

Path	Type	Description
Reco.Assets.asset_id	String	Asset ID
Reco.Assets.asset	Unknown	Asset metadata
Reco.Assets.data_category	String	Primary data category
Reco.Assets.data_categories	String	Data categories of the asset
Reco.SensitiveAssets.location	String	Path of the asset
Reco.SensitiveAssets.source	String	SaaS tool source of the asset
Reco.Assets.last_access_date	String	Last access date

reco-get-files-shared-with-3rd-parties

List files shared with a specific third-party domain.

Base Command

reco-get-files-shared-with-3rd-parties

Input

Argument Name	Description	Required
domain	Third-party domain to query.	Required
last_interaction_time_in_days	Include files with activity within this many days.	Required

Context Output

Path	Type	Description
Reco.Assets.asset_id	String	Asset ID
Reco.Assets.location	String	File location
Reco.Assets.file_owner	String	File owner
Reco.Assets.asset	Unknown	Asset metadata
Reco.Assets.data_category	String	Data category of the asset
Reco.Assets.users	String	Users the file is shared with
Reco.Assets.domain	String	Third-party domain
Reco.Assets.last_access_date	String	Last access date

reco-change-alert-status

Update the status of a Reco alert.

Base Command

reco-change-alert-status

Input

Argument Name	Description	Required
alert_id	Alert ID.	Required
status	New status. Possible values: `ALERT_STATUS_NEW`, `ALERT_STATUS_IN_PROGRESS`, `ALERT_STATUS_CLOSED`, `ALERT_STATUS_PREVIEW`, `ALERT_STATUS_TO_REVIEW`, `ALERT_STATUS_PASSED`, `ALERT_STATUS_RISK_ACCEPTED`, `ALERT_STATUS_RISK_MITIGATED`, `ALERT_STATUS_NA`, `ALERT_STATUS_NA_NEW`, `ALERT_STATUS_NA_NO_AD`, `ALERT_STATUS_NOT_APPLICABLE`.	Required

reco-get-user-context-by-email-address

Get identity context for a user by email address.

Base Command

reco-get-user-context-by-email-address

Input

Argument Name	Description	Required
email_address	User email address.	Required

Context Output

Path	Type	Description
Reco.User.id	String	Identity ID
Reco.User.email	String	Primary email address
Reco.User.name	String	Full name
Reco.User.departments	String	Departments
Reco.User.jobTitles	String	Job titles
Reco.User.isFormer	Boolean	Whether the user is a former employee
Reco.User.isInternal	Boolean	Whether the user is an internal employee
Reco.User.openAlerts	Number	Number of open alerts
Reco.User.lastSeen	Date	Last activity timestamp
Reco.User.email_account	String	The email of the user.
Reco.User.full_name	String	The user full name.
Reco.User.job_titles	String	Job Title.
Reco.User.category	String	Category.
Reco.User.groups	String	The groups user is member of.
Reco.User.labels	Unknown	User Labels.

reco-get-files-exposed-to-email-address

List files accessible to a specific email address.

Base Command

reco-get-files-exposed-to-email-address

Input

Argument Name	Description	Required
email_address	Email address.	Required

Context Output

Path	Type	Description
Reco.Assets.asset_id	String	Asset ID
Reco.Assets.asset	Unknown	Asset metadata
Reco.Assets.data_category	String	Data category of the asset
Reco.Assets.data_categories	String	Data categories of the asset
Reco.Assets.location	String	File location
Reco.Assets.source	String	SaaS tool source of the asset
Reco.Assets.last_access_date	String	Last access date
Reco.Assets.email_account	String	Email account with access
Reco.Assets.file_owner	String	File owner

reco-get-assets-shared-externally

List files an owner has shared outside the organization.

Base Command

reco-get-assets-shared-externally

Input

Argument Name	Description	Required
email_address	File owner email address.	Required

Context Output

Path	Type	Description
Reco.Assets.asset_id	String	Asset ID
Reco.Assets.asset	Unknown	Asset metadata
Reco.Assets.data_category	String	Data category of the asset
Reco.Assets.data_categories	String	Data categories of the asset
Reco.SensitiveAssets.location	String	Path of the asset
Reco.SensitiveAssets.source	String	SaaS tool source of the asset
Reco.Assets.last_access_date	String	Last access date
Reco.Assets.file_owner	String	File owner

reco-get-private-email-list-with-access

List private (non-corporate) email addresses with file access.

Base Command

reco-get-private-email-list-with-access

Context Output

Path	Type	Description
Reco.privateEmails.email_account	String	Private email account
Reco.privateEmails.primary_email	String	Associated corporate email
Reco.privateEmails.files_num	Number	Number of files accessible
Reco.privateEmails.user_category	String	User category

reco-get-alert-ai-summary

Get an AI-generated summary of an alert.

Base Command

reco-get-alert-ai-summary

Input

Argument Name	Description	Required
alert_id	Alert ID.	Required

Context Output

Path	Type	Description
Reco.AlertSummary.markdown	String	Markdown-formatted alert summary

reco-get-apps

List all discovered SaaS applications (auto-paginates all results).

Base Command

reco-get-apps

Input

Argument Name	Description	Required
before	Filter apps last seen before this date.	Optional
after	Filter apps last seen after this date.	Optional
limit	Page size (omit for all results).	Optional

Context Output

Path	Type	Description
Reco.Apps.id	String	The unique identifier of the application.
Reco.Apps.name	String	The name of the application.
Reco.Apps.category	String	The category of the application.
Reco.Apps.usersCount	Number	The number of users with access to the application.
Reco.Apps.authorization	String	The authorization/sanction status of the application.
Reco.Apps.authType	String	The authentication type used by the application.
Reco.Apps.isUsingAi	Boolean	Whether the application uses AI.
Reco.Apps.isShadowApp	Boolean	Whether the application is a shadow/unmanaged app.
Reco.Apps.vendorGrade	String	The vendor security grade of the application.
Reco.Apps.aiCapability	String	The AI capability description for the application.
Reco.Apps.lastSeen	Date	The last activity timestamp for the application.
Reco.Apps.app_name	String	The name of the application.
Reco.Apps.app_id	String	The unique identifier of the application.
Reco.Apps.risk_score	Number	The risk score of the application.
Reco.Apps.users_count	Number	The number of users with access to the application.
Reco.Apps.data_access	String	The data access level of the application.
Reco.Apps.updated_at	Date	The last update timestamp of the application.
Reco.Apps.created_at	Date	The creation timestamp of the application.
Reco.Apps.status	String	The status of the application.

reco-set-app-authorization-status

Update the authorization status of an application.

Base Command

reco-set-app-authorization-status

Input

Argument Name	Description	Required
app_id	Application ID.	Required
authorization_status	Authorization status. Possible values: `AUTH_STATUS_SANCTIONED`, `AUTH_STATUS_UNSANCTIONED`, `AUTH_STATUS_TO_REVIEW`, `AUTH_STATUS_ACCEPTED_RISK`, `AUTH_STATUS_EVALUATING`, `AUTH_STATUS_UNDER_INVESTIGATION`, `AUTH_STATUS_INVESTIGATED`, `AUTH_STATUS_CLOUD_INVENTORY`, `AUTH_STATUS_SYSTEM_SANCTIONED`.	Required

Context Output

Path	Type	Description
Reco.AppAuthorization.app_id	String	The application ID that was updated.
Reco.AppAuthorization.authorization_status	String	The authorization status that was set.
Reco.AppAuthorization.updated	Boolean	Whether the update was successful.
Reco.AppAuthorization.rows_affected	Number	Number of rows affected by the update operation.

Command example

!reco-set-app-authorization-status app_id="microsoft.com" authorization_status="AUTH_STATUS_SANCTIONED"

reco-add-exclusion-filter

Add values to a Reco classifier exclusion list.

Base Command

reco-add-exclusion-filter

Input

Argument Name	Description	Required
key_to_add	Exclusion key (e.g. `CASE_SENSITIVE_TERMS`, `OWNERS`, `FILE_IDS`, `LOCATIONS`).	Required
values_to_add	Comma-separated values to add.	Required

List Commands (External API)

All commands below accept filters (SCIM v2 expression) and limit (default 1000).

reco-list-events

List SaaS activity events.

Base Command

reco-list-events

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “actor.email eq “user@example.com” and eventTime gt “2024-01-01T00:00:00Z””).	Optional
limit	The maximum number of events to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.Events.id	String	Event ID
Reco.Events.eventType	String	Event type code
Reco.Events.formattedEventType	String	Human-readable event type
Reco.Events.application	String	Source SaaS application
Reco.Events.actorEmail	String	Actor email address
Reco.Events.actorName	String	Actor display name
Reco.Events.eventTime	Date	Event timestamp
Reco.Events.outcomeString	String	Event outcome description

reco-list-posture-issues

List security posture issues.

Base Command

reco-list-posture-issues

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “severity eq “HIGH””).	Optional
limit	The maximum number of posture issues to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.PostureIssues.id	String	Issue ID
Reco.PostureIssues.name	String	Issue name
Reco.PostureIssues.severity	String	Severity (LOW/MEDIUM/HIGH/CRITICAL)
Reco.PostureIssues.checkStatus	String	Check status
Reco.PostureIssues.scorePercentage	Number	Compliance score percentage
Reco.PostureIssues.checkedInstance	Unknown	The SaaS instance this issue was checked against
Reco.PostureIssues.url	String	Link to issue in Reco UI

reco-list-accounts

List SaaS accounts.

Base Command

reco-list-accounts

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “isRiskyUser eq true” or “accountEmail co “@example.com””).	Optional
limit	The maximum number of accounts to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.Accounts.id	String	Account ID
Reco.Accounts.name	String	Account display name
Reco.Accounts.accountEmail	String	Account email address
Reco.Accounts.permissions	String	Permission level
Reco.Accounts.hasMfa	String	MFA status
Reco.Accounts.openAlerts	Number	Open alerts count
Reco.Accounts.isAdmin	Boolean	Admin flag
Reco.Accounts.isRiskyUser	Boolean	Risky user flag
Reco.Accounts.lastSeen	Date	Last activity

reco-list-devices

List managed and unmanaged devices.

Base Command

reco-list-devices

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “isUnmanaged eq true” or “devicePlatform eq “Windows””).	Optional
limit	The maximum number of devices to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.Devices.id	String	Device ID
Reco.Devices.name	String	Device name
Reco.Devices.devicePlatform	String	Device platform (Windows, macOS, iOS, Android, etc.)
Reco.Devices.os	String	Operating system of the device
Reco.Devices.osVersion	String	Operating system version
Reco.Devices.isUnmanaged	Boolean	Whether the device is unmanaged (not enrolled in MDM)
Reco.Devices.hasNonCompliant	Boolean	Whether the device has non-compliant policies
Reco.Devices.lastSeen	Date	Last activity timestamp

reco-list-ai-agents

List detected AI agents.

Base Command

reco-list-ai-agents

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “authorization eq “AUTH_STATUS_UNSANCTIONED””).	Optional
limit	The maximum number of AI agents to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.AiAgents.id	String	AI agent ID
Reco.AiAgents.name	String	AI agent name
Reco.AiAgents.vendor	String	Vendor of the AI agent
Reco.AiAgents.type	String	Type of AI agent
Reco.AiAgents.authorization	String	Authorization/sanction status of the AI agent
Reco.AiAgents.agentStatus	String	Current status of the AI agent
Reco.AiAgents.risk	Number	Risk level of the AI agent (0=NA, 1=LOW, 2=MEDIUM, 3=HIGH, 4=CRITICAL)
Reco.AiAgents.lastUsage	Date	Last usage timestamp

reco-list-groups

List SaaS groups.

Base Command

reco-list-groups

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “name co “Engineering””).	Optional
limit	The maximum number of groups to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.Groups.id	String	Group ID
Reco.Groups.name	String	Group name
Reco.Groups.email	String	Group email address
Reco.Groups.membersCount	Number	Number of members in the group
Reco.Groups.appsCount	Number	Number of apps the group has access to

reco-list-saas-to-saas

List SaaS-to-SaaS OAuth grants.

Base Command

reco-list-saas-to-saas

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “authorization eq “AUTH_STATUS_UNSANCTIONED” or permissionRisk eq “30””).	Optional
limit	The maximum number of SaaS-to-SaaS grants to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.SaasToSaas.id	String	SaaS-to-SaaS grant ID
Reco.SaasToSaas.plugin	String	The plugin or app name receiving the grant
Reco.SaasToSaas.authorization	String	Authorization status of the grant
Reco.SaasToSaas.permissionRisk	String	Permission risk level (10=LOW, 20=MEDIUM, 30=HIGH)
Reco.SaasToSaas.accounts	Number	Number of accounts with this grant
Reco.SaasToSaas.aiCapability	String	AI capability of the third-party app
Reco.SaasToSaas.lastSeen	Date	Last activity timestamp for this grant

reco-list-ip-addresses

List observed IP addresses.

Base Command

reco-list-ip-addresses

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “country eq “CN” or hasVpn eq true”).	Optional
limit	The maximum number of IP addresses to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.IpAddresses.ipAddress	String	The IP address or CIDR range
Reco.IpAddresses.country	String	Country of the IP address
Reco.IpAddresses.asnName	String	ASN name of the IP address
Reco.IpAddresses.eventsCount	Number	Number of events from this IP
Reco.IpAddresses.usersCount	Number	Number of users seen from this IP
Reco.IpAddresses.hasVpn	Boolean	Whether the IP is associated with a VPN
Reco.IpAddresses.hasProxy	Boolean	Whether the IP is associated with a proxy
Reco.IpAddresses.lastEventTime	Date	Last event timestamp from this IP

reco-list-business-units

List external business units.

Base Command

reco-list-business-units

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “name eq “Finance””).	Optional
limit	The maximum number of business units to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.BusinessUnits.id	String	Business unit ID
Reco.BusinessUnits.name	String	Business unit name
Reco.BusinessUnits.manager	String	Manager of the business unit
Reco.BusinessUnits.createdAt	Date	Creation timestamp of the business unit

reco-list-audit-logs

List Reco platform audit logs.

Base Command

reco-list-audit-logs

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “userEmail eq “admin@example.com” and action eq “DELETE””).	Optional
limit	The maximum number of audit log entries to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.AuditLogs.id	String	Audit log entry ID
Reco.AuditLogs.userEmail	String	Email of the user who performed the action
Reco.AuditLogs.module	String	Module where the action was performed
Reco.AuditLogs.action	String	Action performed
Reco.AuditLogs.objectName	String	Name of the object affected
Reco.AuditLogs.timestamp	Date	Timestamp of the audit log entry
Reco.AuditLogs.remoteAddr	String	Remote IP address of the actor

reco-list-posture-checks

List posture check definitions.

Base Command

reco-list-posture-checks

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “severity eq “HIGH” and apps co “Google””).	Optional
limit	The maximum number of posture check definitions to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.PostureChecks.id	String	Posture check ID
Reco.PostureChecks.name	String	Posture check name
Reco.PostureChecks.severity	String	Severity of the posture check
Reco.PostureChecks.policyType	String	Policy type of the posture check
Reco.PostureChecks.apps	Unknown	Applications this posture check applies to
Reco.PostureChecks.type	String	Type of posture check (built-in or custom)

reco-list-threat-detection-policies

List threat detection policies.

Base Command

reco-list-threat-detection-policies

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “severity eq “HIGH” and status eq “ON””).	Optional
limit	The maximum number of policies to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.ThreatDetectionPolicies.id	String	Policy ID
Reco.ThreatDetectionPolicies.name	String	Policy name
Reco.ThreatDetectionPolicies.severity	String	Severity of the policy
Reco.ThreatDetectionPolicies.status	String	Status of the policy (ON, OFF, or PREVIEW)
Reco.ThreatDetectionPolicies.apps	Unknown	Applications monitored by the policy
Reco.ThreatDetectionPolicies.openAlerts	Number	Number of open alerts triggered by this policy
Reco.ThreatDetectionPolicies.type	String	Type of policy (built-in or custom)

reco-list-exclusions

List alert suppression exclusion rules.

Base Command

reco-list-exclusions

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “policyName co “MFA””).	Optional
limit	The maximum number of exclusions to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.Exclusions.id	String	Exclusion rule ID
Reco.Exclusions.name	String	Exclusion rule name
Reco.Exclusions.policyName	String	Name of the policy this exclusion applies to
Reco.Exclusions.apps	Unknown	Applications this exclusion applies to
Reco.Exclusions.createdBy	String	User who created the exclusion
Reco.Exclusions.createdAt	Date	Creation timestamp of the exclusion

reco-list-app-instances

List integrated app instances (app portfolio). Only returns instances with an active integration status.

Base Command

reco-list-app-instances

Input

Argument Name	Description	Required
filters	The SCIM v2 filter expression (e.g. “isUsingAi eq true”).	Optional
limit	The maximum number of app instances to return. Default is 1000.	Optional

Context Output

Path	Type	Description
Reco.AppInstances.id	String	App instance ID
Reco.AppInstances.name	String	App instance name
Reco.AppInstances.instanceType	String	Instance type
Reco.AppInstances.accountsCount	Number	Number of accounts
Reco.AppInstances.isUsingAi	Boolean	Whether AI features are used
Reco.AppInstances.saasToSaasCount	Number	SaaS-to-SaaS grant count
Reco.AppInstances.filesCount	Number	File count

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

Fetch incidents

</~PLATFORM>

Configuration parameters

url — Server URL (e.g. https://host.reco.ai/api/v1) (required)
api_token — JWT app token (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
isFetch — Fetch incidents
max_fetch — Max fetch
source — Source
before — Before
after — After
risk_level — Minimum risk level (e.g. MEDIUM fetches medium and higher)
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
incidentFetchInterval — Incidents Fetch Interval

Commands (37)

reco-add-comment-to-alert
Add a comment to an alert in Reco.
reco-add-exclusion-filter
Add exclusion filter to Reco Classifier.
reco-add-leaving-org-user-label
Tag a user as leaving org user in Reco.
reco-add-risky-user-label
Tag a user as risky in Reco.
reco-change-alert-status
update alert status in Reco.
reco-get-3rd-parties-accessible-to-data-list
Get 3rd parties accessible to sensitive assets.
reco-get-alert-ai-summary
Get alert ai summary from Reco.
reco-get-apps
Get app discovery data from Reco. Fetches all available apps using pagination.
reco-get-assets-by-id
Get all assets from Reco by id.
reco-get-assets-shared-externally
Get files user has access to from Reco.
reco-get-assets-user-has-access-to
Get all files user has access to from Reco.
reco-get-files-exposed-to-email-address
Get files user has access to from Reco.
reco-get-files-shared-with-3rd-parties
Get files shared with 3rd parties.
reco-get-link-to-user-overview-page
Generate a magic link for reco UI (overview page).
reco-get-private-email-list-with-access
Get Private emails with access.
reco-get-risky-users
Get Risky Users from Reco.
reco-get-sensitive-assets-by-id
Get all sensitive assets from Reco by id.
reco-get-sensitive-assets-by-name
Get all sensitive assets from Reco by name.
reco-get-sensitive-assets-with-public-link
Get all sensitive assets with public link from Reco.
reco-get-user-context-by-email-address
Get user context by email address from Reco.
reco-list-accounts
Lists accounts (SaaS user accounts) from Reco using the external API.
reco-list-ai-agents
Lists AI agents detected by Reco using the external API.
reco-list-app-instances
Lists integrated app instances (app portfolio) from Reco using the external API. Only returns instances with an active integration status.
reco-list-audit-logs
Lists Reco platform audit logs using the external API.
reco-list-business-units
Lists external business units from Reco using the external API.
reco-list-devices
Lists devices from Reco using the external API.
reco-list-events
Lists SaaS events from Reco using the external API.
reco-list-exclusions
Lists alert suppression exclusion rules from Reco using the external API.
reco-list-groups
Lists SaaS groups from Reco using the external API.
reco-list-ip-addresses
Lists observed IP addresses from Reco using the external API.
reco-list-posture-checks
Lists posture check definitions from Reco using the external API.
reco-list-posture-issues
Lists posture issues from Reco using the external API.
reco-list-saas-to-saas
Lists SaaS-to-SaaS OAuth grants and integrations from Reco using the external API.
reco-list-threat-detection-policies
Lists threat detection policies from Reco using the external API.
reco-resolve-visibility-event
Resolve an event in Reco Finding. Reco Findings contains aggregations of events. This command resolves the event in the Reco Finding.
reco-set-app-authorization-status
Set authorization status for an application in Reco.
reco-update-incident-timeline
Add a comment to an alert in Reco.

Source

Reco.py Reco_test.py Reco.yml Reco_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Reco AI
sectionorder:
- Connect
- Collect
commonfields:
  id: Reco
  version: -1
configuration:
- additionalinfo: The base URL of your Reco instance.
  display: Server URL (e.g. https://host.reco.ai/api/v1)
  name: url
  required: true
  type: 0
  section: Connect
- section: Connect
  additionalinfo: The API token (Bearer) used to authenticate with the Reco External API.
  display: JWT app token
  displaypassword: API Token
  name: api_token
  type: 4
  required: true
  hiddenusername: true
- additionalinfo: The option to skip TLS certificate verification when connecting to the Reco API.
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- additionalinfo: The option to route requests through the system proxy.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: The incident type to map Reco alerts to.
  display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: The option to enable automatic incident fetching.
  display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: The maximum number of incidents to fetch per run (up to 500).
  defaultvalue: '200'
  display: Max fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Incidents SaaS Source
  display: Source
  name: source
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Created At time before which incidents will be fetched
  display: Before
  name: before
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Created At time after which incidents will be fetched
  display: After
  name: after
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: 'The minimum severity threshold for fetched incidents. Accepts a single value: LOW, MEDIUM, HIGH, or CRITICAL (or numeric equivalents 10, 20, 30, 40). Alerts at or above this severity are fetched. For example, "MEDIUM" fetches medium, high, and critical severity alerts.'
  display: Minimum risk level (e.g. MEDIUM fetches medium and higher)
  name: risk_level
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: The amount of time to look back on the first fetch run (e.g. `7 days`, `12 hours`).
  defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Interval in minutes between two consecutive fetch incidents runs.
  defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
description: Reco is the leader in SaaS & AI Security, providing full visibility and control across your SaaS ecosystem and AI agents.
display: Reco
name: Reco
script:
  dockerimage: demisto/python3:3.12.13.10404775
  isfetch: true
  runonce: false
  script: "-"
  subtype: python3
  type: python
  commands:
  - arguments:
    - description: Values to add to the exclusion filter (split by ',').
      name: values_to_add
      required: true
      type: List
      isArray: true
    - description: key too add to the exclusion filter (e.g. "CASE_SENSITIVE_TERMS", "LOCATION_CASE_INSENSITIVE_TERMS", "OWNERS", "FILE_IDS", "LOCATIONS").
      name: key_to_add
      required: true
    description: Add exclusion filter to Reco Classifier.
    name: reco-add-exclusion-filter
  - arguments:
    - description: Comment to add to the alert.
      name: comment
      required: true
    - description: Alert ID to add the comment to.
      name: alert_id
      required: true
    description: Add a comment to an alert in Reco.
    name: reco-add-comment-to-alert
  - arguments:
    - description: Comment to add to the alert.
      name: comment
      required: true
    - description: Incident ID to add the comment to.
      name: incident_id
      required: true
    description: Add a comment to an alert in Reco.
    name: reco-update-incident-timeline
  - arguments:
    - description: entity id of the file to resolve.
      name: entity_id
      required: true
    - description: label name to resolve (e.g. "Accessible to All Org Users", "Accessible by General Public").
      name: label_name
      required: true
    description: Resolve an event in Reco Finding. Reco Findings contains aggregations of events. This command resolves the event in the Reco Finding.
    name: reco-resolve-visibility-event
  - arguments: []
    description: Get Risky Users from Reco.
    name: reco-get-risky-users
    outputs:
    - contextPath: Reco.RiskyUsers
      description: Risky Users.
    - contextPath: Reco.RiskyUsers.id
      description: The account ID.
      type: String
    - contextPath: Reco.RiskyUsers.name
      description: The account display name.
      type: String
    - contextPath: Reco.RiskyUsers.accountEmail
      description: The account email address.
      type: String
    - contextPath: Reco.RiskyUsers.permissions
      description: The account permissions in the SaaS application.
      type: String
    - contextPath: Reco.RiskyUsers.hasMfa
      description: The value that indicates whether the account has MFA enabled.
      type: Boolean
    - contextPath: Reco.RiskyUsers.openAlerts
      description: The number of open alerts for this account.
      type: Number
    - contextPath: Reco.RiskyUsers.isAdmin
      description: The value that indicates whether the account has admin privileges.
      type: Boolean
    - contextPath: Reco.RiskyUsers.isRiskyUser
      description: The value that indicates whether the account is flagged as risky.
      type: Boolean
    - contextPath: Reco.RiskyUsers.lastSeen
      description: The last activity timestamp for the account.
      type: Date
  - arguments:
    - description: Email address of the user to add to the risky users list in Reco.
      name: email_address
      required: true
    description: Tag a user as risky in Reco.
    name: reco-add-risky-user-label
  - arguments:
    - description: Email address of the user.
      name: email_address
      required: true
    - description: Return only sensitive assets owned by this user.
      name: only_sensitive
      type: Boolean
    description: Get all files user has access to from Reco.
    name: reco-get-assets-user-has-access-to
    outputs:
    - contextPath: Reco.Assets
      description: Assets user has access to.
  - arguments:
    - description: Email address of the user to tag as levaing org user.
      name: email_address
      required: true
    description: Tag a user as leaving org user in Reco.
    name: reco-add-leaving-org-user-label
  - arguments:
    - description: Asset name to search for.
      name: asset_name
      required: true
    - description: Return only sensitive assets owned by this user.
      name: regex_search
      type: Boolean
    description: Get all sensitive assets from Reco by name.
    name: reco-get-sensitive-assets-by-name
    outputs:
    - contextPath: Reco.SensitiveAssets.id
      description: The unique identifier of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.url
      description: The URL of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivityLevel
      description: The sensitivity level of the asset (numeric).
      type: Number
    - contextPath: Reco.SensitiveAssets.permissionVisibility
      description: The visibility/permission level of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.dataCategories
      description: The data categories detected in the asset.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.file_name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_url
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.currently_permitted_users
      description: List of currently permitted users.
      type: String
    - contextPath: Reco.SensitiveAssets.visibility
      description: Visibility of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivity_level
      description: The sensitivity level of the asset.
      type: Number
  - arguments:
    - description: Asset id to search for.
      name: asset_id
      required: true
    description: Get all sensitive assets from Reco by id.
    name: reco-get-sensitive-assets-by-id
    outputs:
    - contextPath: Reco.SensitiveAssets.id
      description: The unique identifier of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.url
      description: The URL of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivityLevel
      description: The sensitivity level of the asset (numeric).
      type: Number
    - contextPath: Reco.SensitiveAssets.permissionVisibility
      description: The visibility/permission level of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.dataCategories
      description: The data categories detected in the asset.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.file_name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_url
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.currently_permitted_users
      description: List of currently permitted users.
      type: String
    - contextPath: Reco.SensitiveAssets.visibility
      description: Visibility of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivity_level
      description: The sensitivity level of the asset.
      type: Number
  - arguments:
    - description: Entity Type (RM_LINK_TYPE_USER).
      name: entity
      required: true
    - description: Entity ID (user email).
      name: param
      type: Boolean
    description: Generate a magic link for reco UI (overview page).
    name: reco-get-link-to-user-overview-page
  - arguments:
    - description: Last interaction time in days.
      name: last_interaction_time_in_days
      required: true
    description: Get 3rd parties accessible to sensitive assets.
    name: reco-get-3rd-parties-accessible-to-data-list
    outputs:
    - contextPath: Reco.Domains.domain
      description: The domain of the 3rd party.
      type: String
    - contextPath: Reco.Domains.last_activity
      description: The last interaction time with the 3rd party.
      type: String
    - contextPath: Reco.Domains.files_num
      description: The number of files the 3rd party has access to.
      type: Number
    - contextPath: Reco.Domains.users_with_access_num
      description: The number of users the 3rd party has access to.
      type: Number
  - arguments: []
    description: Get all sensitive assets with public link from Reco.
    name: reco-get-sensitive-assets-with-public-link
    outputs:
    - contextPath: Reco.Assets.asset_id
      description: The asset id.
      type: String
    - contextPath: Reco.Assets.asset
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.Assets.data_category
      description: The data category of the asset.
      type: String
    - contextPath: Reco.Assets.data_categories
      description: The data categories of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.Assets.last_access_date
      description: The last access date of the asset.
      type: String
  - arguments:
    - description: Last interaction time in days.
      name: last_interaction_time_in_days
      required: true
    - description: Domain to search.
      name: domain
      required: true
    description: Get files shared with 3rd parties.
    name: reco-get-files-shared-with-3rd-parties
    outputs:
    - contextPath: Reco.Assets.asset_id
      description: The asset id of the file.
      type: String
    - contextPath: Reco.Assets.location
      description: The location of the file.
      type: String
    - contextPath: Reco.Assets.file_owner
      description: The owner of the file.
      type: String
    - contextPath: Reco.Assets.users
      description: Users the file is shared with.
      type: String
    - contextPath: Reco.Assets.asset
      description: The asset metadata.
      type: Unknown
    - contextPath: Reco.Assets.data_category
      description: The data category of the assets the 3rd party has access to.
      type: String
    - contextPath: Reco.Assets.last_access_date
      description: The last access date of the asset.
      type: String
    - contextPath: Reco.Assets.domain
      description: The domain of the 3rd party.
      type: String
  - arguments:
    - description: alert id to get.
      name: alert_id
      required: true
    - description: status to set the alert to.
      name: status
      required: true
      auto: PREDEFINED
      predefined:
      - ALERT_STATUS_NEW
      - ALERT_STATUS_IN_PROGRESS
      - ALERT_STATUS_CLOSED
      - ALERT_STATUS_PREVIEW
      - ALERT_STATUS_TO_REVIEW
      - ALERT_STATUS_PASSED
      - ALERT_STATUS_RISK_ACCEPTED
      - ALERT_STATUS_RISK_MITIGATED
      - ALERT_STATUS_NA
      - ALERT_STATUS_NA_NEW
      - ALERT_STATUS_NA_NO_AD
      - ALERT_STATUS_NOT_APPLICABLE
    description: update alert status in Reco.
    name: reco-change-alert-status
  - arguments:
    - description: user email address.
      name: email_address
      required: true
    outputs:
    - contextPath: Reco.User.id
      description: The identity ID.
      type: String
    - contextPath: Reco.User.email
      description: The primary email of the identity.
      type: String
    - contextPath: Reco.User.name
      description: The full name of the identity.
      type: String
    - contextPath: Reco.User.departments
      description: The departments the identity belongs to.
      type: String
    - contextPath: Reco.User.jobTitles
      description: The job titles of the identity.
      type: String
    - contextPath: Reco.User.isFormer
      description: The value that indicates whether the identity is a former employee.
      type: Boolean
    - contextPath: Reco.User.isInternal
      description: The value that indicates whether the identity is an internal employee.
      type: Boolean
    - contextPath: Reco.User.openAlerts
      description: The number of open alerts for this identity.
      type: Number
    - contextPath: Reco.User.lastSeen
      description: The last activity timestamp for the identity.
      type: Date
    - contextPath: Reco.User.email_account
      description: The email of the user.
      type: String
    - contextPath: Reco.User.full_name
      description: The user full name.
      type: String
    - contextPath: Reco.User.job_titles
      description: Job Title.
      type: String
    - contextPath: Reco.User.category
      description: Category.
      type: String
    - contextPath: Reco.User.groups
      description: The groups user is member of.
      type: String
    - contextPath: Reco.User.labels
      description: User Labels.
      type: Unknown
    description: Get user context by email address from Reco.
    name: reco-get-user-context-by-email-address
  - arguments:
    - description: user email address.
      name: email_address
      required: true
    outputs:
    - contextPath: Reco.Assets.asset_id
      description: The asset id.
      type: String
    - contextPath: Reco.Assets.asset
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.Assets.data_category
      description: The data category of the asset.
      type: String
    - contextPath: Reco.Assets.data_categories
      description: The data categories of the asset.
      type: String
    - contextPath: Reco.Assets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.Assets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.Assets.last_access_date
      description: The last access date of the asset.
      type: String
    - contextPath: Reco.Assets.email_account
      description: Email account of the user.
      type: String
    - contextPath: Reco.Assets.file_owner
      description: The owner of the asset.
      type: String
    description: Get files user has access to from Reco.
    name: reco-get-files-exposed-to-email-address
  - arguments:
    - description: user email address.
      name: email_address
      required: true
    outputs:
    - contextPath: Reco.Assets.asset_id
      description: The asset id.
      type: String
    - contextPath: Reco.Assets.asset
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.Assets.data_category
      description: The data category of the asset.
      type: String
    - contextPath: Reco.Assets.data_categories
      description: The data categories of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.Assets.last_access_date
      description: The last access date of the asset.
      type: String
    - contextPath: Reco.Assets.file_owner
      description: The owner of the asset.
      type: String
    description: Get files user has access to from Reco.
    name: reco-get-assets-shared-externally
  - arguments: []
    description: Get Private emails with access.
    name: reco-get-private-email-list-with-access
    outputs:
    - contextPath: Reco.privateEmails.email_account
      description: Private email account.
      type: String
    - contextPath: Reco.privateEmails.primary_email
      description: Primary email account.
      type: String
    - contextPath: Reco.privateEmails.files_num
      description: Number of files the private email account has access to.
      type: Number
    - contextPath: Reco.privateEmails.user_category
      description: User category.
      type: String
  - arguments:
    - description: Asset id to search for.
      name: asset_id
      required: true
    description: Get all assets from Reco by id.
    name: reco-get-assets-by-id
    outputs:
    - contextPath: Reco.SensitiveAssets.id
      description: The unique identifier of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.url
      description: The URL of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivityLevel
      description: The sensitivity level of the asset (numeric).
      type: Number
    - contextPath: Reco.SensitiveAssets.permissionVisibility
      description: The visibility/permission level of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.dataCategories
      description: The data categories detected in the asset.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.file_name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_url
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.currently_permitted_users
      description: List of currently permitted users.
      type: String
    - contextPath: Reco.SensitiveAssets.visibility
      description: Visibility of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivity_level
      description: The sensitivity level of the asset.
      type: Number
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    description: Get alert ai summary from Reco.
    name: reco-get-alert-ai-summary
    outputs:
    - contextPath: Reco.AlertSummary.markdown
      description: The markdown of the alert summary.
      type: String
  - arguments:
    - description: Before date filter (YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ format).
      name: before
      required: false
    - description: After date filter (YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ format).
      name: after
      required: false
    - description: Page size for pagination (default 1000). The command fetches all available apps across all pages.
      name: limit
      required: false
      defaultValue: '1000'
    description: Get app discovery data from Reco. Fetches all available apps using pagination.
    name: reco-get-apps
    outputs:
    - contextPath: Reco.Apps.id
      description: The unique identifier of the application.
      type: String
    - contextPath: Reco.Apps.name
      description: The name of the application.
      type: String
    - contextPath: Reco.Apps.category
      description: The category of the application.
      type: String
    - contextPath: Reco.Apps.usersCount
      description: The number of users with access to the application.
      type: Number
    - contextPath: Reco.Apps.authorization
      description: The authorization/sanction status of the application.
      type: String
    - contextPath: Reco.Apps.authType
      description: The authentication type used by the application.
      type: String
    - contextPath: Reco.Apps.isUsingAi
      description: The value that indicates whether the application uses AI.
      type: Boolean
    - contextPath: Reco.Apps.isShadowApp
      description: The value that indicates whether the application is a shadow/unmanaged app.
      type: Boolean
    - contextPath: Reco.Apps.vendorGrade
      description: The vendor security grade of the application.
      type: String
    - contextPath: Reco.Apps.aiCapability
      description: The AI capability description for the application.
      type: String
    - contextPath: Reco.Apps.lastSeen
      description: The last activity timestamp for the application.
      type: Date
    - contextPath: Reco.Apps.app_name
      description: The name of the application.
      type: String
    - contextPath: Reco.Apps.app_id
      description: The unique identifier of the application.
      type: String
    - contextPath: Reco.Apps.risk_score
      description: The risk score of the application.
      type: Number
    - contextPath: Reco.Apps.users_count
      description: The number of users with access to the application.
      type: Number
    - contextPath: Reco.Apps.data_access
      description: The data access level of the application.
      type: String
    - contextPath: Reco.Apps.updated_at
      description: The last update timestamp of the application.
      type: Date
    - contextPath: Reco.Apps.created_at
      description: The creation timestamp of the application.
      type: Date
    - contextPath: Reco.Apps.status
      description: The status of the application.
      type: String
  - arguments:
    - description: Application ID to update authorization status for.
      name: app_id
      required: true
    - description: Authorization status to set for the application.
      name: authorization_status
      required: true
      auto: PREDEFINED
      predefined:
      - AUTH_STATUS_UNSPECIFIED
      - AUTH_STATUS_TO_REVIEW
      - AUTH_STATUS_SANCTIONED
      - AUTH_STATUS_UNSANCTIONED
      - AUTH_STATUS_ACCEPTED_RISK
      - AUTH_STATUS_EVALUATING
      - AUTH_STATUS_UNDER_INVESTIGATION
      - AUTH_STATUS_INVESTIGATED
      - AUTH_STATUS_CLOUD_INVENTORY
      - AUTH_STATUS_SYSTEM_SANCTIONED
    description: Set authorization status for an application in Reco.
    name: reco-set-app-authorization-status
    outputs:
    - contextPath: Reco.AppAuthorization.app_id
      description: The application ID that was updated.
      type: String
    - contextPath: Reco.AppAuthorization.authorization_status
      description: The authorization status that was set.
      type: String
    - contextPath: Reco.AppAuthorization.updated
      description: The value that indicates whether the update was successful.
      type: Boolean
    - contextPath: Reco.AppAuthorization.rows_affected
      description: Number of rows affected by the update operation.
      type: Number
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "actor.email eq \"user@example.com\" and eventTime gt \"2024-01-01T00:00:00Z\"").'
      name: filters
      required: false
    - description: The maximum number of events to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists SaaS events from Reco using the external API.
    name: reco-list-events
    outputs:
    - contextPath: Reco.Events.id
      description: The event ID.
      type: String
    - contextPath: Reco.Events.eventType
      description: The event type code.
      type: String
    - contextPath: Reco.Events.formattedEventType
      description: The human-readable event type.
      type: String
    - contextPath: Reco.Events.application
      description: The SaaS application the event belongs to.
      type: String
    - contextPath: Reco.Events.actorEmail
      description: The email of the actor who triggered the event.
      type: String
    - contextPath: Reco.Events.actorName
      description: The name of the actor who triggered the event.
      type: String
    - contextPath: Reco.Events.eventTime
      description: The timestamp of the event.
      type: Date
    - contextPath: Reco.Events.outcomeString
      description: The outcome description of the event.
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "severity eq \"HIGH\"").'
      name: filters
      required: false
    - description: The maximum number of posture issues to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists posture issues from Reco using the external API.
    name: reco-list-posture-issues
    outputs:
    - contextPath: Reco.PostureIssues.id
      description: The posture issue ID.
      type: String
    - contextPath: Reco.PostureIssues.name
      description: The posture issue name.
      type: String
    - contextPath: Reco.PostureIssues.severity
      description: The severity of the posture issue.
      type: String
    - contextPath: Reco.PostureIssues.checkStatus
      description: The current check status of the posture issue.
      type: String
    - contextPath: Reco.PostureIssues.scorePercentage
      description: The compliance score percentage for this issue.
      type: Number
    - contextPath: Reco.PostureIssues.checkedInstance
      description: The SaaS instance this issue was checked against.
      type: Unknown
    - contextPath: Reco.PostureIssues.url
      description: The link to the posture issue detail in the Reco UI.
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "isRiskyUser eq true" or "accountEmail co \"@example.com\"").'
      name: filters
      required: false
    - description: The maximum number of accounts to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists accounts (SaaS user accounts) from Reco using the external API.
    name: reco-list-accounts
    outputs:
    - contextPath: Reco.Accounts.id
      description: The account ID.
      type: String
    - contextPath: Reco.Accounts.name
      description: The account display name.
      type: String
    - contextPath: Reco.Accounts.accountEmail
      description: The account email address.
      type: String
    - contextPath: Reco.Accounts.permissions
      description: The account permissions in the SaaS application.
      type: String
    - contextPath: Reco.Accounts.hasMfa
      description: The value that indicates whether the account has MFA enabled.
      type: Boolean
    - contextPath: Reco.Accounts.openAlerts
      description: The number of open alerts for this account.
      type: Number
    - contextPath: Reco.Accounts.isAdmin
      description: The value that indicates whether the account has admin privileges.
      type: Boolean
    - contextPath: Reco.Accounts.isRiskyUser
      description: The value that indicates whether the account is flagged as risky.
      type: Boolean
    - contextPath: Reco.Accounts.lastSeen
      description: The last activity timestamp for the account.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "isUnmanaged eq true" or "devicePlatform eq \"Windows\"").'
      name: filters
      required: false
    - description: The maximum number of devices to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists devices from Reco using the external API.
    name: reco-list-devices
    outputs:
    - contextPath: Reco.Devices.id
      description: The device ID.
      type: String
    - contextPath: Reco.Devices.name
      description: The device name.
      type: String
    - contextPath: Reco.Devices.devicePlatform
      description: The device platform (Windows, macOS, iOS, Android, etc.).
      type: String
    - contextPath: Reco.Devices.os
      description: The operating system of the device.
      type: String
    - contextPath: Reco.Devices.osVersion
      description: The operating system version.
      type: String
    - contextPath: Reco.Devices.isUnmanaged
      description: The value that indicates whether the device is unmanaged (not enrolled in MDM).
      type: Boolean
    - contextPath: Reco.Devices.hasNonCompliant
      description: The value that indicates whether the device has non-compliant policies.
      type: Boolean
    - contextPath: Reco.Devices.lastSeen
      description: The last activity timestamp for the device.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "authorization eq \"AUTH_STATUS_UNSANCTIONED\"").'
      name: filters
      required: false
    - description: The maximum number of AI agents to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists AI agents detected by Reco using the external API.
    name: reco-list-ai-agents
    outputs:
    - contextPath: Reco.AiAgents.id
      description: The AI agent ID.
      type: String
    - contextPath: Reco.AiAgents.name
      description: The AI agent name.
      type: String
    - contextPath: Reco.AiAgents.vendor
      description: The vendor of the AI agent.
      type: String
    - contextPath: Reco.AiAgents.type
      description: The type of AI agent.
      type: String
    - contextPath: Reco.AiAgents.authorization
      description: The authorization/sanction status of the AI agent.
      type: String
    - contextPath: Reco.AiAgents.agentStatus
      description: The current status of the AI agent.
      type: String
    - contextPath: Reco.AiAgents.risk
      description: The risk level of the AI agent.
      type: String
    - contextPath: Reco.AiAgents.lastUsage
      description: The last usage timestamp for the AI agent.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "name co \"Engineering\"").'
      name: filters
      required: false
    - description: The maximum number of groups to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists SaaS groups from Reco using the external API.
    name: reco-list-groups
    outputs:
    - contextPath: Reco.Groups.id
      description: The group ID.
      type: String
    - contextPath: Reco.Groups.name
      description: The group name.
      type: String
    - contextPath: Reco.Groups.email
      description: The group email address.
      type: String
    - contextPath: Reco.Groups.membersCount
      description: The number of members in the group.
      type: Number
    - contextPath: Reco.Groups.appsCount
      description: The number of apps the group has access to.
      type: Number
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "authorization eq \"AUTH_STATUS_UNSANCTIONED\" or permissionRisk eq \"30\"").'
      name: filters
      required: false
    - description: The maximum number of SaaS-to-SaaS grants to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists SaaS-to-SaaS OAuth grants and integrations from Reco using the external API.
    name: reco-list-saas-to-saas
    outputs:
    - contextPath: Reco.SaasToSaas.id
      description: The SaaS-to-SaaS grant ID.
      type: String
    - contextPath: Reco.SaasToSaas.plugin
      description: The plugin or app name receiving the grant.
      type: String
    - contextPath: Reco.SaasToSaas.authorization
      description: The authorization status of the grant.
      type: String
    - contextPath: Reco.SaasToSaas.permissionRisk
      description: The permission risk level (10=LOW, 20=MEDIUM, 30=HIGH).
      type: String
    - contextPath: Reco.SaasToSaas.accounts
      description: The number of accounts with this grant.
      type: Number
    - contextPath: Reco.SaasToSaas.aiCapability
      description: The AI capability of the third-party app.
      type: String
    - contextPath: Reco.SaasToSaas.lastSeen
      description: The last activity timestamp for this grant.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "country eq \"CN\" or hasVpn eq true").'
      name: filters
      required: false
    - description: The maximum number of IP addresses to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists observed IP addresses from Reco using the external API.
    name: reco-list-ip-addresses
    outputs:
    - contextPath: Reco.IpAddresses.ipAddress
      description: The IP address or CIDR range.
      type: String
    - contextPath: Reco.IpAddresses.country
      description: The country of the IP address.
      type: String
    - contextPath: Reco.IpAddresses.asnName
      description: The ASN name of the IP address.
      type: String
    - contextPath: Reco.IpAddresses.eventsCount
      description: The number of events from this IP.
      type: Number
    - contextPath: Reco.IpAddresses.usersCount
      description: The number of users seen from this IP.
      type: Number
    - contextPath: Reco.IpAddresses.hasVpn
      description: The value that indicates whether the IP is associated with a VPN.
      type: Boolean
    - contextPath: Reco.IpAddresses.hasProxy
      description: The value that indicates whether the IP is associated with a proxy.
      type: Boolean
    - contextPath: Reco.IpAddresses.lastEventTime
      description: The last event timestamp from this IP.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "name eq \"Finance\"").'
      name: filters
      required: false
    - description: The maximum number of business units to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists external business units from Reco using the external API.
    name: reco-list-business-units
    outputs:
    - contextPath: Reco.BusinessUnits.id
      description: The business unit ID.
      type: String
    - contextPath: Reco.BusinessUnits.name
      description: The business unit name.
      type: String
    - contextPath: Reco.BusinessUnits.manager
      description: The manager of the business unit.
      type: String
    - contextPath: Reco.BusinessUnits.createdAt
      description: The creation timestamp of the business unit.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "userEmail eq \"admin@example.com\" and action eq \"DELETE\"").'
      name: filters
      required: false
    - description: The maximum number of audit log entries to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists Reco platform audit logs using the external API.
    name: reco-list-audit-logs
    outputs:
    - contextPath: Reco.AuditLogs.id
      description: The audit log entry ID.
      type: String
    - contextPath: Reco.AuditLogs.userEmail
      description: The email of the user who performed the action.
      type: String
    - contextPath: Reco.AuditLogs.module
      description: The module where the action was performed.
      type: String
    - contextPath: Reco.AuditLogs.action
      description: The action performed.
      type: String
    - contextPath: Reco.AuditLogs.objectName
      description: The name of the object affected.
      type: String
    - contextPath: Reco.AuditLogs.timestamp
      description: The timestamp of the audit log entry.
      type: Date
    - contextPath: Reco.AuditLogs.remoteAddr
      description: The remote IP address of the actor.
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "severity eq \"HIGH\" and apps co \"Google\"").'
      name: filters
      required: false
    - description: The maximum number of posture check definitions to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists posture check definitions from Reco using the external API.
    name: reco-list-posture-checks
    outputs:
    - contextPath: Reco.PostureChecks.id
      description: The posture check ID.
      type: String
    - contextPath: Reco.PostureChecks.name
      description: The posture check name.
      type: String
    - contextPath: Reco.PostureChecks.severity
      description: The severity of the posture check.
      type: String
    - contextPath: Reco.PostureChecks.policyType
      description: The policy type of the posture check.
      type: String
    - contextPath: Reco.PostureChecks.apps
      description: The applications this posture check applies to.
      type: Unknown
    - contextPath: Reco.PostureChecks.type
      description: The type of posture check (built-in or custom).
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "severity eq \"HIGH\" and status eq \"ON\"").'
      name: filters
      required: false
    - description: The maximum number of policies to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists threat detection policies from Reco using the external API.
    name: reco-list-threat-detection-policies
    outputs:
    - contextPath: Reco.ThreatDetectionPolicies.id
      description: The policy ID.
      type: String
    - contextPath: Reco.ThreatDetectionPolicies.name
      description: The policy name.
      type: String
    - contextPath: Reco.ThreatDetectionPolicies.severity
      description: The severity of the policy.
      type: String
    - contextPath: Reco.ThreatDetectionPolicies.status
      description: The status of the policy (ON, OFF, or PREVIEW).
      type: String
    - contextPath: Reco.ThreatDetectionPolicies.apps
      description: The applications monitored by the policy.
      type: Unknown
    - contextPath: Reco.ThreatDetectionPolicies.openAlerts
      description: The number of open alerts triggered by this policy.
      type: Number
    - contextPath: Reco.ThreatDetectionPolicies.type
      description: The type of policy (built-in or custom).
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "policyName co \"MFA\"").'
      name: filters
      required: false
    - description: The maximum number of exclusions to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists alert suppression exclusion rules from Reco using the external API.
    name: reco-list-exclusions
    outputs:
    - contextPath: Reco.Exclusions.id
      description: The exclusion rule ID.
      type: String
    - contextPath: Reco.Exclusions.name
      description: The exclusion rule name.
      type: String
    - contextPath: Reco.Exclusions.policyName
      description: The name of the policy this exclusion applies to.
      type: String
    - contextPath: Reco.Exclusions.apps
      description: The applications this exclusion applies to.
      type: Unknown
    - contextPath: Reco.Exclusions.createdBy
      description: The user who created the exclusion.
      type: String
    - contextPath: Reco.Exclusions.createdAt
      description: The creation timestamp of the exclusion.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "isUsingAi eq true").'
      name: filters
      required: false
    - description: The maximum number of app instances to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists integrated app instances (app portfolio) from Reco using the external API. Only returns instances with an active integration status.
    name: reco-list-app-instances
    outputs:
    - contextPath: Reco.AppInstances.id
      description: The app instance ID.
      type: String
    - contextPath: Reco.AppInstances.name
      description: The app instance name.
      type: String
    - contextPath: Reco.AppInstances.instanceType
      description: The type of the app instance.
      type: String
    - contextPath: Reco.AppInstances.accountsCount
      description: The number of accounts in this app instance.
      type: Number
    - contextPath: Reco.AppInstances.isUsingAi
      description: The value that indicates whether this app instance uses AI features.
      type: Boolean
    - contextPath: Reco.AppInstances.saasToSaasCount
      description: The number of SaaS-to-SaaS grants for this instance.
      type: Number
    - contextPath: Reco.AppInstances.filesCount
      description: The number of files tracked in this instance.
      type: Number
tests:
- No tests
fromversion: 6.5.0