SOCRadarIncidentsV4

SOCRadar Incidents v4 API integration with advanced incident management, status reasons, and compliance tracking. Fetches security incidents from SOCRadar platform with proper deduplication and date handling. Supports filtering by alarm type IDs for granular control.

Analytics & SIEM · SOCRadar

Details

ID	`SOCRadarIncidentsV4`
Provider	SOCRadar
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

SOCRadar Incidents v4.0

Fetch and manage security incidents from SOCRadar’s Incident API v4 with advanced filtering, multi-status selection, and comprehensive incident enrichment.

Overview

SOCRadar is a digital risk protection platform that provides extended threat intelligence and brand protection capabilities. This integration enables XSOAR to ingest security incidents from SOCRadar’s Incident API v4, including:

Brand Protection: Impersonating domains, phishing attacks, brand abuse
Cyber Threat Intelligence: Stolen credentials, data leaks, malware infections
Attack Surface Management: External exposure findings, misconfigurations
Dark Web Intelligence: Compromised credentials, leaked data from dark web sources
Supply Chain Security: Third-party risks and vendor security issues

What’s New in v4.0

Major Enhancements

Multi-Status Filtering: Select multiple statuses (OPEN, CLOSED, ON_HOLD) simultaneously
Epoch Time Precision: Second-level accuracy for incident fetching - zero duplicates
Reverse Pagination: Fetches newest incidents first for better performance
Dynamic Content Extraction: Automatically extracts alarm-specific fields regardless of type
Parametric Company ID Display: Control whether company ID appears in incidents
Enhanced Deduplication: Two-layer protection prevents duplicate incidents
New Commands: Ask analyst, change severity, and more

Technical Improvements

Interval-based fetching with overlap protection
Configurable content and entity inclusion
Integer company ID with validation
Comprehensive debug logging
Better error handling and recovery

Key Features

Incident Fetching

Fetch incidents with configurable interval (default: 1 minute)
Support for date ranges and epoch timestamps
Automatic deduplication (tracks last 1000 alarm IDs)
Reverse pagination for optimal performance

Flexible Filtering

Multi-Status Selection: OPEN, CLOSED, ON_HOLD (multi-select)
Severity Levels: LOW, MEDIUM, HIGH, CRITICAL
Alarm Types: Filter by main type, sub-type, or type ID
Custom Filters: Tags, assignees, date ranges

Rich Incident Data

Dynamic CustomFields based on alarm type
Configurable content extraction (varies by alarm type)
Optional entity details inclusion
Optional company ID visibility

Incident Management

Change alarm status (11 status options)
Add comments to alarms
Change assignees
Add/remove tags
Request analyst assistance
Modify severity levels
Mark as false positive/resolved

Prerequisites

Required

SOCRadar account with Incident API access
API Key from SOCRadar platform
Company ID
XSOAR 6.x or later

API Access

To obtain your API credentials:

Log in to SOCRadar Platform
Navigate to Settings → API & Integrations
Go to API Options page
Copy your Company API Key (for Incident API)
Note your Company ID

Configuration

Integration Settings

Parameter	Required	Default	Description
Server URL	Yes	`https://platform.socradar.com/api`	SOCRadar API base URL
API Key	Yes	-	Your Company API Key from SOCRadar
Company ID	Yes	-	Your Company ID (integer)
Fetch incidents	No	False	Enable automatic incident fetching
Incident type	No	-	XSOAR incident type to create
Max incidents per fetch	No	10000	Maximum incidents per fetch cycle
First fetch time	No	3 days	Initial time range for first fetch
Fetch Interval (Minutes)	No	1	Time window for subsequent fetches

Filtering Options

Parameter	Type	Description
Status Filter	Multi-select	Select one or more: OPEN, CLOSED, ON_HOLD
Severity	Multi-select	Filter by: LOW, MEDIUM, HIGH, CRITICAL
Alarm Type IDs	Text	Comma-separated list of type IDs to include
Excluded Alarm Type IDs	Text	Comma-separated list of type IDs to exclude
Main Alarm Types	Text	Comma-separated main types (e.g., “Brand Protection”)
Alarm Sub Types	Text	Comma-separated sub types

Content Options

Parameter	Default	Description
Include Alarm Content	True	Extract content fields to CustomFields
Include Related Entities	True	Include entity details in CustomFields
Include Company ID	False	Show company ID in incidents (for multi-tenant)

Installation

From XSOAR Marketplace

Navigate to Settings → Marketplace
Search for “SOCRadar”
Click Install
Configure integration instance

From GitHub (Manual)

# Clone the content repository
git clone https://github.com/demisto/content.git
cd content/Packs/SOCRadar

# Copy to your XSOAR instance
# Upload via Settings → Integrations → Upload

Setup Guide

Step 1: Create Integration Instance

Navigate to Settings → Integrations → Servers & Services
Search for “SOCRadar Incidents v4”
Click Add instance

Step 2: Configure Basic Settings

Name: SOCRadar Production
Server URL: https://platform.socradar.com/api
API Key: [Your API Key from SOCRadar]
Company ID: [Your Company ID]

Step 3: Configure Fetching (Optional)

✓ Fetches incidents
Incident type: SOCRadar Incident
Max incidents per fetch: 10000
First fetch time: 3 days
Fetch Interval: 1 (minutes)

Step 4: Configure Filters (Optional)

Status Filter:
  ☑ OPEN
  ☐ CLOSED
  ☐ ON_HOLD

Content Options:
  ☑ Include Alarm Content in Custom Fields
  ☑ Include Related Entities Details
  ☐ Include Company ID in Incidents

Step 5: Test Connection

Click Test button to verify:

API connectivity
Authentication
Company ID validity

Commands

Incident Management

`socradar-change-alarm-status`

Change the status of one or more alarms.

Arguments:

alarm_ids (Required): Comma-separated alarm IDs (e.g., “12345,67890”)
status_reason (Required): New status
- OPEN, INVESTIGATING, RESOLVED, PENDING_INFO
- LEGAL_REVIEW, VENDOR_ASSESSMENT, FALSE_POSITIVE
- DUPLICATE, PROCESSED_INTERNALLY, MITIGATED, NOT_APPLICABLE
comments (Optional): Status change comments
company_id (Optional): Override default company ID

Example:

!socradar-change-alarm-status alarm_ids="81171696" status_reason="INVESTIGATING" comments="Under review"

From Incident Context:

!socradar-change-alarm-status alarm_ids=${incident.dbotMirrorId} status_reason="RESOLVED"

`socradar-mark-false-positive`

Mark alarm as false positive (shortcut command).

Arguments:

alarm_id (Required): Alarm ID
comments (Optional): Reason for false positive
company_id (Optional): Override default company ID

Example:

!socradar-mark-false-positive alarm_id="81171696" comments="Not a real threat"

`socradar-mark-resolved`

Mark alarm as resolved (shortcut command).

Arguments:

alarm_id (Required): Alarm ID
comments (Optional): Resolution notes
company_id (Optional): Override default company ID

Example:

!socradar-mark-resolved alarm_id="81171696" comments="Issue fixed"

For Notes

`socradar-add-comment`

Add a comment to an alarm.

Arguments:

alarm_id (Required): Alarm ID
user_email (Required): Email of user posting comment
comment (Required): Comment text
company_id (Optional): Override default company ID

Example:

!socradar-add-comment alarm_id="81171696" user_email="useremail" comment="Investigating with security team"

`socradar-ask-analyst`

Request assistance from SOCRadar analyst.

Arguments:

alarm_id (Required): Alarm ID
comment (Required): Message for analyst
company_id (Optional): Override default company ID

Example:

!socradar-ask-analyst alarm_id="81171696" comment="Need help analyzing this credential leak"

Assignment & Organization

`socradar-add-assignee`

Change alarm assignee(s).(User must be defined the same company)

Arguments:

alarm_id (Required): Alarm ID
user_emails (Required): Comma-separated email addresses
company_id (Optional): Override default company ID

Example:

!socradar-add-assignee alarm_id="81171696" user_emails="useremail"

`socradar-add-tag`

Add or remove a tag from alarm.

Arguments:

alarm_id (Required): Alarm ID
tag (Required): Tag name
company_id (Optional): Override default company ID

Example:

!socradar-add-tag alarm_id="81171696" tag="reviewed"

`socradar-change-severity`

Modify alarm severity level.

Arguments:

alarm_id (Required): Alarm ID
severity (Required): New severity (LOW, MEDIUM, HIGH, CRITICAL)
company_id (Optional): Override default company ID

Example:

!socradar-change-severity alarm_id="81171696" severity="HIGH"

Testing

`socradar-test-fetch`

Test the fetch incidents functionality without creating incidents.

Arguments:

first_fetch (Optional): Time range to test (default: “3 days”)
limit (Optional): Number of incidents to fetch (default: 5)

Example:

!socradar-test-fetch first_fetch="1 hour" limit="10"

Output:

Found 150 incident(s) from 2024-12-20!
Total available: 1000 records across 10 pages
Using REVERSE PAGINATION (page 10 → page 1)

Sample incidents:
- [81171696] HIGH | OPEN | example.com
  Company: 789 | Type: Brand Protection / Impersonating Domain

Custom Fields

The integration creates these CustomFields in XSOAR incidents:

Standard Fields (Always Present)

socradaralarmid: Alarm ID
socradarstatus: Current status
socradarasset: Affected asset
socradaralarmtype: Main alarm type
socradaralarmsubtype: Alarm sub-type
socradaralarmtypeid: Type ID
socradartags: Comma-separated tags
socradarrisklevel: Risk level
socradaralarmtext: Alarm description (truncated to 1000 chars)

Optional Fields

socradarcompanyid: Company ID (if “Include Company ID” enabled)
socradarentities: Related entities (if “Include Entities” enabled)

Dynamic Content Fields (if “Include Content” enabled)

Content structure varies by alarm type. Examples:

Impersonating Domain:

socradarcontentdns_information
socradarcontentwhois_information
socradarcontentdomain_status

Stolen Credentials:

socradarcontentcredential_details
socradarcontentlog_content_link
socradarcontentmalware_family

Data Leak:

socradarcontentsource_full_content
socradarcontentcompromised_emails
socradarcontentcompromised_domains

Use Cases

1. Brand Protection

Scenario: Detect and respond to phishing domains impersonating your brand.

Configuration:

Main Alarm Types: Brand Protection
Status Filter: OPEN
Severity: HIGH, CRITICAL

Automation:

# Get incident
incident = demisto.incident()
alarm_id = incident.get('dbotMirrorId')

# Check domain details
domain_info = incident.get('CustomFields', {}).get('socradarcontentdns_information')

# Take action
demisto.executeCommand('socradar-add-assignee', {
    'alarm_id': alarm_id,
    'user_emails': 'useremail@usermail.com'
})

2. Multi-Tenant Operations (MSSP)

Scenario: Manage incidents for multiple customers.

Configuration:

Instance 1:
- Company ID: 789
- Include Company ID: ✓ YES

Instance 2:
- Company ID: 456
- Include Company ID: ✓ YES

Automation:

# Company ID is visible in CustomFields
company_id = incident.get('CustomFields', {}).get('socradarcompanyid')

# Route to appropriate team
if company_id == "789":
    assign_to = "useremail"
else:
    assign_to = "useremail"

demisto.executeCommand('socradar-add-assignee', {
    'alarm_id': incident.get('dbotMirrorId'),
    'user_emails': assign_to
})

Troubleshooting

No Incidents Fetched

Check:

Test connection: Click “Test” button
Date range: Increase “First fetch time” to “7 days”
Filters: Remove status/severity filters temporarily
Debug logs: Check XSOAR server logs

Debug Command:

!socradar-test-fetch first_fetch="7 days" limit="10"

Look for:

[SOCRadar V4.0] Total available: 0 records

If 0 records, no alarms match your filters.

Duplicate Incidents

This should NOT happen in v4.0! If you see duplicates:

Check fetch interval: Should be ≥ 1 minute

Check logs for deduplication stats:

[SOCRadar V4.0] Page 1: Created 5 NEW incidents, skipped 95 duplicates

Verify epoch time usage:

[SOCRadar V4.0] Time window (epoch seconds): 1734465600 to 1734465660

If duplicates persist, contact support with debug logs.

API Errors

401 Unauthorized:

Verify API Key is correct

404 Not Found:

Verify Company ID is correct (integer, not string)
Check endpoint URLs in debug logs

Rate Limiting:

Reduce fetch frequency
Decrease “Max incidents per fetch”

Missing CustomFields

If dynamic content fields not appearing:

Verify “Include Alarm Content” is enabled
Create CustomFields manually in XSOAR:
- Settings → Advanced → Fields
- Add fields with type “Short Text”
- Prefix: socradarcontent

If entities not appearing:

Verify “Include Related Entities Details” is enabled

Performance Optimization

High-Volume Environments

Recommended Settings:

Max incidents per fetch: 10000
Fetch Interval: 5 (minutes)
Include Alarm Content: ✓ (enabled)
Include Related Entities: ✓ (enabled)

With Filters:

Status Filter: OPEN only
Severity: HIGH, CRITICAL only

This reduces data volume while capturing critical alerts.

Low-Volume Environments

Recommended Settings:

Max incidents per fetch: 1000
Fetch Interval: 1 (minutes)
Include Alarm Content: ✓ (enabled)
Include Related Entities: ✓ (enabled)

Faster response to new incidents.

Support

Official Support

SOCRadar XSOAR Support: XSOAR@socradar.io
SOCRadar Support: support@socradar.io
Platform: platform.socradar.com

Feature Requests

Submit feature requests through:

SOCRadar platform Request
XSOAR content repository issues

Version History

v4.0.0 (December 2024)

Initial release of SOCRadar Incidents v4.0
Multi-status filtering support
Epoch time precision for zero duplicates
Reverse pagination implementation
Dynamic content extraction
Enhanced deduplication (2-layer)
New commands: ask-analyst, change-severity
Parametric company ID display
Comprehensive debug logging

License

This integration is provided under the MIT License.

About SOCRadar

SOCRadar is a leading Extended Threat Intelligence (XTI) platform that helps organizations:

Monitor and protect their digital assets
Detect brand abuse and phishing attacks
Identify stolen credentials and data leaks
Track dark web activities
Manage attack surface exposure
Ensure supply chain security

Configuration parameters

apikey — (required)
company_id — Company ID (required)
isFetch — Fetch incidents
first_fetch — First Fetch Time
fetch_interval_minutes — Fetch Interval (Minutes)
max_fetch — Max incidents per fetch
show_content — Show Alarm Content
status — Status Filter
severities — Severity Levels
alarm_type_ids — Alarm Type IDs (Include)
excluded_alarm_type_ids — Alarm Type IDs (Exclude)
alarm_main_types — Alarm Main Types
excluded_alarm_main_types — Alarm Main Types (Exclude)
alarm_sub_types — Alarm Sub Types
excluded_alarm_sub_types — Alarm Sub Types (Exclude)
include_company_id — Include Company ID
include_incident_link — Include Incident Link
include_mitigation — Include Mitigation
include_response — Include Response
include_detection_and_analysis — Include Detection And Analysis
include_post_incident_analysis — Include Post Incident Analysis
include_related_assets — Include Related Assets
include_related_entities — Include Related Entities
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (8)

socradar-add-assignee
add the assignee(s) of an alarm.
socradar-add-comment
Add a comment to an alarm.
socradar-add-tag
Add or remove a tag from an alarm.
socradar-change-alarm-status
Change the status of one or more alarms.
socradar-change-assignee Deprecated
add the assignee(s) of an alarm.
socradar-mark-false-positive
Mark an alarm as false positive.
socradar-mark-resolved
Mark an alarm as resolved.
socradar-test-fetch
Test incident fetching to verify alarms are available and date parsing works correctly.

Source

SOCRadarIncidentsV4.py SOCRadarIncidentsV4_test.py SOCRadarIncidentsV4.yml SOCRadarIncidentsV4_description.md

Download History Raw

category: Analytics & SIEM
provider: SOCRadar
commonfields:
  id: SOCRadarIncidentsV4
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- displaypassword: API Key
  name: apikey
  required: true
  type: 9
  hiddenusername: true
  section: Connect
  additionalinfo: Your SOCRadar API key from platform.socradar.com
- display: Company ID
  name: company_id
  required: true
  type: 0
  section: Connect
  additionalinfo: Your company ID from SOCRadar platform
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: First Fetch Time
  name: first_fetch
  type: 0
  defaultvalue: 3 days
  section: Collect
  additionalinfo: 'Time range for FIRST fetch only. Examples: "3 days", "7 days", "30 days". After first fetch, integration will use Fetch Interval for subsequent fetches.'
- display: Fetch Interval (Minutes)
  name: fetch_interval_minutes
  type: 0
  defaultvalue: "1"
  section: Collect
  additionalinfo: "Time window for subsequent fetches in minutes. Default: 1 minute. Integration will fetch alarms from last N minutes. Example: If set to 1, it fetches alarms from last 1 minute each cycle."
- display: Max incidents per fetch
  name: max_fetch
  type: 0
  defaultvalue: "200"
  section: Collect
  additionalinfo: "Maximum number of incidents to create per cycle. Recommended: 200 for stability. The actual number fetched depends on the time window and available alarms."
- display: Show Alarm Content
  name: show_content
  type: 8
  required: false
  defaultvalue: "true"
  section: Collect
  additionalinfo: If enabled, alarm content will be appended to incident details field (may increase incident size).
- display: Status Filter
  name: status
  type: 16
  required: false
  section: Collect
  options:
  - OPEN
  - CLOSED
  - ON_HOLD
  additionalinfo: Filter incidents by status (leave empty for all statuses)
- display: Severity Levels
  name: severities
  type: 16
  required: false
  section: Collect
  options:
  - LOW
  - INFO
  - MEDIUM
  - HIGH
  - CRITICAL
  additionalinfo: Filter incidents by severity levels (leave empty for all severities)
- display: Alarm Type IDs (Include)
  name: alarm_type_ids
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm type IDs to include (e.g., "1,2,3"). Leave empty to include all alarm types.
- display: Alarm Type IDs (Exclude)
  name: excluded_alarm_type_ids
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm type IDs to exclude (e.g., "4,5,6"). Takes precedence if same ID appears in both include and exclude.
- display: Alarm Main Types
  name: alarm_main_types
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm main types to filter (e.g., "Brand Protection,Attack Surface Management")
- display: Alarm Main Types (Exclude)
  name: excluded_alarm_main_types
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm main types to exclude (e.g., "Brand Protection,Attack Surface Management")
- display: Alarm Sub Types
  name: alarm_sub_types
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm sub types to filter (e.g., "Impersonating Domain,Stolen Credential")
- display: Alarm Sub Types (Exclude)
  name: excluded_alarm_sub_types
  type: 0
  required: false
  section: Collect
  additionalinfo: Comma-separated list of alarm sub types to exclude (e.g., "Impersonating Domain,Stolen Credential")
- display: Include Company ID
  name: include_company_id
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: If enabled, the SOCRadar Company ID will be stored as a custom field on each fetched incident. Also adds company_id to rawJSON labels. Useful for multi-tenant environments to identify which company an incident belongs to.
- display: Include Incident Link
  name: include_incident_link
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: If enabled, adds the SOCRadar platform incident link and incident content as custom fields on each fetched incident. Also adds incident_link to rawJSON labels.
- display: Include Mitigation
  name: include_mitigation
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: Includes the default mitigation plan provided by SOCRadar for each alarm type. Contains actionable remediation steps such as credential rotation, domain takedown procedures, and vulnerability patching guidance.
- display: Include Response
  name: include_response
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: Includes recommended response actions for the alarm. Contains step-by-step incident response procedures such as CVE identification, system isolation, evidence collection, and stakeholder communication.
- display: Include Detection And Analysis
  name: include_detection_and_analysis
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: Includes detection and analysis guidance for the alarm. Describes how to integrate alarm output into security systems, set up alerts, and perform initial triage and investigation.
- display: Include Post Incident Analysis
  name: include_post_incident_analysis
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: Includes post-incident analysis recommendations. Contains lessons learned guidance such as reviewing incident response processes, updating security policies, and monitoring for recurrence. Available for select alarm types (e.g., Vulnerability Intelligence).
- display: Include Related Assets
  name: include_related_assets
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: Includes related assets associated with the alarm such as CPE identifiers, websites, hostnames, and IP addresses. Helps identify the scope and blast radius of the incident.
- display: Include Related Entities
  name: include_related_entities
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: Includes related entities extracted from the alarm such as domains, CVE IDs, IP addresses, email addresses, and URLs. Provides context for threat hunting and correlation with other incidents.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
description: SOCRadar Incidents v4 API integration with advanced incident management, status reasons, and compliance tracking. Fetches security incidents from SOCRadar platform with proper deduplication and date handling. Supports filtering by alarm type IDs for granular control.
display: SOCRadar Incidents v4
name: SOCRadarIncidentsV4
script:
  commands:
  - name: socradar-change-alarm-status
    description: Change the status of one or more alarms.
    arguments:
    - name: alarm_ids
      description: Comma-separated list of alarm IDs to update.
      required: true
    - name: status_reason
      description: New status reason for the alarms.
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - INVESTIGATING
      - RESOLVED
      - PENDING_INFO
      - LEGAL_REVIEW
      - VENDOR_ASSESSMENT
      - FALSE_POSITIVE
      - DUPLICATE
      - PROCESSED_INTERNALLY
      - MITIGATED
      - NOT_APPLICABLE
    - name: comments
      description: Optional comments explaining the status change.
      required: false
    - name: company_id
      description: Optional company_id to specify company.
      required: false
    - name: update_related_finding_status
      description: Decide whether to update related finding status.
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
      required: false
    - name: email
      description: Email of action owner (required if update_related_finding_status is True).
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Status
      description: New alarm status.
      type: String

  - name: socradar-mark-false-positive
    description: Mark an alarm as false positive.
    arguments:
    - name: alarm_id
      description: Alarm ID to mark as false positive.
      required: true
    - name: comments
      description: Optional comments explaining why this is a false positive.
      required: false
      defaultValue: False positive
    - name: company_id
      description: Optional company_id to specify company.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Status
      description: New alarm status.
      type: String

  - name: socradar-mark-resolved
    description: Mark an alarm as resolved.
    arguments:
    - name: alarm_id
      description: Alarm ID to mark as resolved.
      required: true
    - name: comments
      description: Optional comments explaining the resolution.
      required: false
      defaultValue: Resolved
    - name: company_id
      description: Optional company_id to specify company.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Status
      description: New alarm status.
      type: String

  - name: socradar-add-comment
    description: Add a comment to an alarm.
    arguments:
    - name: alarm_id
      description: Alarm ID to add comment to.
      required: true
    - name: user_email
      description: Email address of the user adding the comment.
      required: true
    - name: comment
      description: Comment text to add.
      required: true
    - name: company_id
      description: Optional company_id to specify company.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String

  - name: socradar-change-assignee
    deprecated: true
    description: add the assignee(s) of an alarm.
    arguments:
    - name: alarm_id
      description: Alarm ID to add assignee for.
      required: true
    - name: user_emails
      description: Comma-separated list of user email addresses to assign.
      required: true
    - name: company_id
      description: Optional company_id to specify company.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Assignees
      description: New assignees.
      type: String

  - name: socradar-add-assignee
    description: add the assignee(s) of an alarm.
    arguments:
    - name: alarm_id
      description: Alarm ID to add assignee for.
      required: true
    - name: user_emails
      description: Comma-separated list of user email addresses to assign.
      required: true
    - name: company_id
      description: Optional company_id to specify company.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Assignees
      description: New assignees.
      type: String

  - name: socradar-add-tag
    description: Add or remove a tag from an alarm.
    arguments:
    - name: alarm_id
      description: Alarm ID to add/remove tag for.
      required: true
    - name: tag
      description: Tag name to add or remove.
      required: true
    - name: company_id
      description: Optional company_id to specify company.
      required: false
    outputs:
    - contextPath: SOCRadar.Alarm.ID
      description: Alarm ID.
      type: String
    - contextPath: SOCRadar.Alarm.Tags
      description: Alarm tags.
      type: String

  - name: socradar-test-fetch
    description: Test incident fetching to verify alarms are available and date parsing works correctly.
    arguments:
    - name: limit
      description: Number of incidents to test fetch (default 5).
      required: false
      defaultValue: "5"
    - name: first_fetch
      description: 'Test date range (e.g., "3 days", "7 days").'
      required: false
      defaultValue: "3 days"
    outputs:
    - contextPath: SOCRadar.TestFetch.TotalCount
      description: Total number of incidents found.
      type: Number
    - contextPath: SOCRadar.TestFetch.SampleIncidents
      description: Sample incidents for testing.
      type: Unknown
    - contextPath: SOCRadar.TestFetch.StartDate
      description: Parsed start date used for the test.
      type: String

  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: "-"
  subtype: python3
  type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)