SecurityScorecard

Details

ID	`SecurityScorecard`
Provider	SecurityScorecard
Category	Vulnerability Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Provides commands to access SecurityScorecard’s API.
This integration was integrated and tested with the latest version of SecurityScorecard’s API as of August 2024.

Configure SecurityScorecard in Cortex

Parameter	Description	Required
SecurityScorecard API Base URL		True
Username/Email	The SecurityScorecard username/email.	True
API Token		True
Fetch incidents		False
Incidents Fetch Interval	SecurityScorecard is updated on a daily basis therefore there’s no need to modify this value.	False
Fetch Limit	Maximum number of alerts per fetch. The maximum is 50.	False
First fetch	First fetch query (<number> <time unit>, e.g., 12 hours, 7 days. SecurityScorecard provides a maximum of 7 days back. To ensure no alerts are missed, it’s recommended to use a value less than 2 days.	False
Incident type		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Portfolio ID		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

securityscorecard-portfolios-list

List all Portfolios.

Base Command

securityscorecard-portfolios-list

Input

Argument Name	Description	Required
limit	Limit the amount of Portfolios to return. Defaults to 50.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Portfolio.id	String	Portfolio ID.
SecurityScorecard.Portfolio.name	String	Portfolio name.
SecurityScorecard.Portfolio.description	String	Portfolio description.
SecurityScorecard.Portfolio.privacy	String	Portfolio privacy. Can be either private, shared or team.
SecurityScorecard.Portfolio.read_only	Boolean	Whether the portfolio is read only.

securityscorecard-portfolio-list-companies

Lists all companies in Portfolio.

Base Command

securityscorecard-portfolio-list-companies

Input

Argument Name	Description	Required
portfolio_id	Portfolio ID. The Portfolio ID can be retrieved using the ‘securityscorecard-portfolios-list’ command.	Required
grade	Grade filter. To filter multiple grades, comma-separate them, e.g. A,B. Possible values are: A, B, C, D, E, F.	Optional
industry	Industry filter. To filter multiple industries, comma-separate them, e.g. education,financial_services. Possible values are: education, financial_services, food, government, healthcare, information_services, manufacturing, retail, technology.	Optional
vulnerability	Vulnerability filter.	Optional
issue_type	Comma-separated list of issue types. Possible values are: adware_installation_trail, adware_installation, alleged_breach_incident, chatter, anonymous_proxy, service_cassandra, service_couchdb, attack_detected, attack_feed, new_booter_shell, spa_browser, cdn_hosting, tlscert_expired, tlscert_revoked, tlscert_self_signed, tlscert_excessive_expiration, tlscert_weak_signature, tlscert_no_revocation, service_cloud_provider, csp_no_policy_v2, csp_unsafe_policy_v2, csp_too_broad_v2, marketing_site, cookie_missing_secure_attribute, short_term_lending_site, leaked_credentials, leaked_credentials_info, service_dns, new_defacement, ransomware_victim, domain_uses_hsts_preloading, service_elasticsearch, employee_satisfaction, service_end_of_life, service_end_of_service, exposed_personal_information, exposed_personal_information_info, admin_subdomain_v2, tlscert_extended_validation, service_ftp, patching_cadence_high, web_vuln_host_high, service_vuln_host_high, service_imap, iot_camera, industrial_control_device, insecure_https_redirect_pattern_v2, service_ldap, service_ldap_anonymous, social_network_issues, patching_cadence_low, web_vuln_host_low, service_vuln_host_low, spf_record_malformed, malware_controller, malware_1_day, malware_30_day, malware_365_day, malware_infection, malware_infection_trail, patching_cadence_medium, web_vuln_host_medium, service_vuln_host_medium, service_microsoft_sql, minecraft_server, service_mongodb, no_browser_policy, service_mysql, service_neo4j, service_networking, object_storage_bucket_with_risky_acl, open_resolver, exposed_ports, service_open_vpn, service_oracle_db, outdated_os, outdated_browser, non_malware_events_last_month, service_pop3, service_pptp, phishing, typosquat, service_postgresql, exploited_product, public_text_credit_cards, public_text_database_dump, public_text_hashes, public_text_mention, public_text_password_dump, service_pulse_vpn, service_rdp, ransomware_association, redirect_chain_contains_http_v2, service_redis, remote_access, service_smb, mail_server_unusual_port, service_soap, spf_record_wildcard, spf_record_softfail, spf_record_missing, ssh_weak_protocol, ssh_weak_cipher, ssh_weak_mac, tls_weak_protocol, github_information_leak_disclosure, google_information_leak_disclosure, cookie_missing_http_only, domain_missing_https_v2, suspicious_traffic, tls_ocsp_stapling, tls_weak_cipher, telephony, service_telnet, tor_node_events_last_month, upnp_accessible, unsafe_sri_v2, uce, service_vnc, dnssec_detected, waf_detected_v2, hsts_incorrect_v2, hosted_on_object_storage_v2, references_object_storage_v2, x_content_type_options_incorrect_v2, x_frame_options_incorrect_v2, x_xss_protection_incorrect_v2, service_rsync.	Optional
had_breach_within_last_days	Domains with breaches in the last X days. Possible values are numbers, e.g. 1000.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Portfolio.Company.domain	String	Company domain.
SecurityScorecard.Portfolio.Company.name	String	Company name.
SecurityScorecard.Portfolio.Company.score	Number	Company overall score in numeric form (55-100).
SecurityScorecard.Portfolio.Company.grade	String	Company overall score in letter grade.
SecurityScorecard.Portfolio.Company.grade_url	String	Company overall score URL to SVG asset.
SecurityScorecard.Portfolio.Company.last30days_score_change	Number	Company overall score numeric change (±) in the last month.
SecurityScorecard.Portfolio.Company.industry	String	Industry category of the domain.
SecurityScorecard.Portfolio.Company.size	String	Company size, e.g. ‘size_more_than_10000’.
SecurityScorecard.Portfolio.Company.is_custom_vendor	Boolean	Whether the company is a custom vendor.
SecurityScorecard.Portfolio.Company.total	Number	Total number of companies in Portfolio.

securityscorecard-company-score-get

Retrieve company overall score.

Base Command

securityscorecard-company-score-get

Input

Argument Name	Description	Required
domain	Company domain, e.g. google.com. The company must first be added to a Portfolio in order to be able to get its score.	Required

Context Output

Path	Type	Description
SecurityScorecard.Company.Score.domain	String	Company domain.
SecurityScorecard.Company.Score.name	String	Company name.
SecurityScorecard.Company.Score.score	Number	Company overall score in numeric form (55-100).
SecurityScorecard.Company.Score.grade	String	Company overall score in letter grade form (A-F).
SecurityScorecard.Company.Score.last30days_score_change	Number	Company overall score numeric change (±) in the last month.
SecurityScorecard.Company.Score.industry	String	ndustry category of the domain.
SecurityScorecard.Company.Score.size	String	Company size, e.g. ‘size_more_than_10000’.

securityscorecard-company-factor-score-get

Retrieve company factor score.

Base Command

securityscorecard-company-factor-score-get

Input

Argument Name	Description	Required
domain	Company domain.	Required
severity	Issue severity filter. Comma-separated list of the following values: ‘positive’, ‘info’, ‘low’, ‘medium’, ‘high’.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Company.Factor.name	String	Factor name.
SecurityScorecard.Company.Factor.score	Number	Factor score in numeric form (55-100).
SecurityScorecard.Company.Factor.grade	String	Factor score in letter grade form (A-F).
SecurityScorecard.Company.Factor.Issue.type	String	Type of issue found.
SecurityScorecard.Company.Factor.Issue.count	Number	How many times the issue was found.
SecurityScorecard.Company.Factor.Issue.severity	String	Severity of the issue.
SecurityScorecard.Company.Factor.Issue.total_score_impact	Number	Contribution of issue on overall score.
SecurityScorecard.Company.Factor.Issue.detail_url	String	URL to the details of the issue.
SecurityScorecard.Company.Factor.total	Number	Number of factors returned.

securityscorecard-company-history-score-get

Retrieve company historical scores.

Base Command

securityscorecard-company-history-score-get

Input

Argument Name	Description	Required
domain	Company domain, e.g. `google.com`.	Required
from	Initial date for historical data. Value should be in format `YYYY-MM-DD`.	Optional
to	End date for historical data. Value should be in format `YYYY-MM-DD`.	Optional
timing	Timing granularity. Possible values are: daily, weekly.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Company.ScoreHistory.domain	String	Company domain.
SecurityScorecard.Company.ScoreHistory.date	Date	Score date.
SecurityScorecard.Company.ScoreHistory.score	Number	Company historical security score in numeric form (55-100).

securityscorecard-company-history-factor-score-get

Retrieve company historical factor scores.

Base Command

securityscorecard-company-history-factor-score-get

Input

Argument Name	Description	Required
domain	Company domain, e.g. google.com.	Required
from	Initial date for historical data. Value should be in format ‘YYYY-MM-DD’.	Optional
to	End date for historical data. Value should be in format ‘YYYY-MM-DD’.	Optional
timing	Timing granularity. or “monthly”. Possible values are: daily, weekly, monthly.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Company.FactorHistory.domain	String	Company domain.
SecurityScorecard.Company.FactorHistory.date	Date	Score date.
SecurityScorecard.Company.FactorHistory.Factor.name	Number	Factor name.
SecurityScorecard.Company.FactorHistory.score	Number	Company historical security score in numeric form (55-100).

securityscorecard-alert-grade-change-create

Create alert based on grade.

Base Command

securityscorecard-alert-grade-change-create

Input

Argument Name	Description	Required
change_direction	Direction of change. Possible values are: rises, drops.	Required
score_types	Comma-separated list of risk factors to monitor. Possible values are ‘overall’, ‘any_factor_score’, ‘network_security’, ‘dns_health’, ‘patching_cadence’, ‘endpoint_security’, ‘ip_reputation’, ‘application_security’, ‘cubit_score’, ‘hacker_chatter’, ‘leaked_information’, ‘social_engineering’.	Required
target	What do you want to monitor with this alert. This argument is required if the `portfolio` argument is not specified. Possible values are: my_scorecard, any_followed_company.	Optional
portfolio	A portfolio_id to use as a target for the alert. This argument is required if the `target` argument is not specified. You can get a list of portfolios by running `!securityscorecard-portfolios-list`.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Alerts.GradeChangeAlert.id	String	Alert ID.

securityscorecard-alert-score-threshold-create

Create alert based threshold met.

Base Command

securityscorecard-alert-score-threshold-create

Input

Argument Name	Description	Required
change_direction	Direction of change. Possible values are: rises_above, drops_below.	Required
threshold	The numeric score used as the threshold to trigger the alert.	Required
score_types	Comma separated list of risk factors to monitor. Possible values are ‘overall’, ‘any_factor_score’, ‘network_security’, ‘dns_health’, ‘patching_cadence’, ‘endpoint_security’, ‘ip_reputation’, ‘application_security’, ‘cubit_score’, ‘hacker_chatter’, ‘leaked_information’, ‘social_engineering’. For multiple factors, provide comma-separated list, i.e. leaked_information,social_engineering.	Required
target	What do you want to monitor with this alert. This argument is required if the `portfolio` argument is not specified. Possible values are: my_scorecard, any_followed_company.	Optional
portfolio	A portfolio_id to use as a target for the alert. This argument is required if the `target` argument is not specified. You can get a list of portfolios by running `!securityscorecard-portfolios-list`.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Alerts.ScoreThresholdAlert.id	String	Alert ID.

securityscorecard-alert-delete

Delete an alert.

Base Command

securityscorecard-alert-delete

Input

Argument Name	Description	Required
alert_id	Alert ID.	Required

Context Output

There is no context output for this command.

securityscorecard-alerts-list

List alerts triggered in the last week.

Base Command

securityscorecard-alerts-list

Input

Argument Name	Description	Required
portfolio_id	Portfolio ID. Can be retrieved using `!securityscorecard-portfolios-list`.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Alerts.Alert.id	String	Alert ID.
SecurityScorecard.Alerts.Alert.email	String	Alert email recipient.
SecurityScorecard.Alerts.Alert.change_type	String	Alert change type configured (score or threshold).
SecurityScorecard.Alerts.Alert.domain	String	Alert domain.
SecurityScorecard.Alerts.Alert.company_name	String	Alert company name.
SecurityScorecard.Alerts.Alert.Portfolio.id	array	Alert Portfolio ID.
SecurityScorecard.Alerts.Alert.my_scorecard	Boolean	Whether the alert was triggered on private scorecard. This depends on whether ‘my_scorecard’ was added to the optional argument ‘target’ when creating alerts using the ‘securityscorecard-alert-score-threshold-create’ and ‘securityscorecard-alert-grade-change-create’ commands.
SecurityScorecard.Alerts.Alert.created_at	Date	Timestamp of when the alert was triggered.

securityscorecard-company-services-get

Retrieve the service providers of a domain.

Base Command

securityscorecard-company-services-get

Input

Argument Name	Description	Required
domain	Company domain.	Required

Context Output

Path	Type	Description
SecurityScorecard.Service.vendor_domain	String	Vendor domain, e.g. Google, Amazon.
SecurityScorecard.Service.client_domain	String	Client domain. This value is identical to the input of the domain argument.
SecurityScorecard.Service.categories	array	Vendor service provider, e.g. mail_provider, nameserver_provider.

securityscorecard-company-events-get

Retrieve a company’s historical events.

Base Command

securityscorecard-company-events-get

Input

Argument Name	Description	Required
domain	Company domain, e.g. google.com.	Required
date_from	Initial date for historical data. Value should be in format `2020-01-30T00:00:00.000Z`.	Optional
date_to	End date for historical data. Value should be in format `2020-01-30T00:00:00.000Z`.	Optional

Context Output

Path	Type	Description
SecurityScorecard.Events.Event.ssc_event_id	string	event id.
SecurityScorecard.Events.Event.date	date	event date.
SecurityScorecard.Events.Event.status	unknown	event status.
SecurityScorecard.Events.Event.issue_count	number	event issue count.
SecurityScorecard.Events.Event.score_impact	number	event score impact.
SecurityScorecard.Events.Event.issue_type	string	event issue type.
SecurityScorecard.Events.Event.severity	string	event severity.
SecurityScorecard.Events.Event.factor	string	event factor.
SecurityScorecard.Events.Event.ssc_detail_url	string	event detail url.

securityscorecard-company-findings-get

Retrieve an issue_type’s historical findings in a scorecard.

Base Command

securityscorecard-company-findings-get

Input

Argument Name	Description	Required
domain	Retrieve the service providers of a domain.	Required
date	The effective_date for historical data. Value should be in format ‘YYYY-MM-DD’.	Required
issue_type	Key representing issue type, e.g. api_key_exposed.	Required
status	group_status filter. Comma-separated list of the following values: ‘active’, ‘inactive’, ‘all’.	Optional

Context Output

There is no context output for this command.

securityscorecard-issue-metadata

Retrieve metadata for an issue type, including description and recommendation.

Base Command

securityscorecard-issue-metadata

Input

Argument Name	Description	Required
issue_type	Key representing issue type, e.g. api_key_exposed.	Required

Context Output

Path	Type	Description
SecurityScorecard.Metadata.Issues.key	string	Key representing issue type, e.g. api_key_exposed.
SecurityScorecard.Metadata.Issues.severity	string	issue severity.
SecurityScorecard.Metadata.Issues.factor	string	issue factor.
SecurityScorecard.Metadata.Issues.title	string	issue title.
SecurityScorecard.Metadata.Issues.short_description	string	issue short description.
SecurityScorecard.Metadata.Issues.long_description	string	issue long description.
SecurityScorecard.Metadata.Issues.recommendation	string	issue recommendation.

securityscorecard-alert-rules-list

List alert subscriptions for the user.

Base Command

securityscorecard-alert-rules-list

Input

This command does not require any arguments.

Context Output

Path	Type	Description
SecurityScorecard.AlertRules.Rule.id	String	Alert Rule ID.
SecurityScorecard.AlertRules.Rule.name	String	Alert Rule name.
SecurityScorecard.AlertRules.Rule.target	String	Target of the Rule.
SecurityScorecard.AlertRules.Rule.updated_at	Date	Timestamp when the alert rule was last updated.
SecurityScorecard.AlertRules.Rule.paused_at	String	Timestamp when the alert rule was paused.

securityscorecard-issue-details-get

Retrieve issue details for a specific issue type and domain.

Base Command

securityscorecard-issue-details-get

Input

Argument Name	Description	Required
domain	The domain to get the issue details for.	Required
issue_type	The issue type to get the details for.	Required

Context Output

Path	Type	Description
SecurityScorecard.IssueDetails.issue_id	String	Unique UUID for this measurement.
SecurityScorecard.IssueDetails.parent_domain	String	Parent domain aka vendor.
SecurityScorecard.IssueDetails.issue_type	String	issue_type of the findings.
SecurityScorecard.IssueDetails.count	Number	The number of findings.
SecurityScorecard.IssueDetails.group_status	String	If findings are active or not.
SecurityScorecard.IssueDetails.first_seen_time	Date	Epoch of observation in nanoseconds.
SecurityScorecard.IssueDetails.last_seen_time	Date	Epoch of observation in nanoseconds.
SecurityScorecard.IssueDetails.port	Number	Port number of the observation if applicable.
SecurityScorecard.IssueDetails.domain	String	Domain of the observation if applicable.
SecurityScorecard.IssueDetails.ip	String	IP address of the observation if applicable.
SecurityScorecard.IssueDetails.protocol	String	Protocol of the observation if applicable.
SecurityScorecard.IssueDetails.observations	String	Observation data in raw JSON format.

Configuration parameters

base_url — SecurityScorecard API Base URL (required)
username — Username/Email (required)
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
max_fetch — Fetch Limit
first_fetch — First fetch
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
portfolio_id — Portfolio ID

Commands (16)

securityscorecard-alert-delete
Delete an alert.
securityscorecard-alert-grade-change-create
Create alert based on grade.
securityscorecard-alert-rules-list
List alert subscriptions for the user.
securityscorecard-alert-score-threshold-create
Create alert based threshold met.
securityscorecard-alerts-list
List alerts triggered in the last week.
securityscorecard-company-events-get
Retrieve a company's historical events.
securityscorecard-company-factor-score-get
Retrieve company factor score.
securityscorecard-company-findings-get
Retrieve an issue_type's historical findings in a scorecard.
securityscorecard-company-history-factor-score-get
Retrieve company historical factor scores.
securityscorecard-company-history-score-get
Retrieve company historical scores.
securityscorecard-company-score-get
Retrieve company overall score.
securityscorecard-company-services-get
Retrieve the service providers of a domain.
securityscorecard-issue-details-get
Retrieve issue details for a specific issue type and domain.
securityscorecard-issue-metadata
Retrieve metadata for an issue type, including description and recommendation.
securityscorecard-portfolio-list-companies
Lists all companies in Portfolio.
securityscorecard-portfolios-list
List all Portfolios.

Source

SecurityScorecard.py SecurityScorecard_test.py SecurityScorecard.yml SecurityScorecard_description.md command_examples.txt

Download History Raw

name: SecurityScorecard
display: SecurityScorecard
category: Vulnerability Management
provider: SecurityScorecard
description: Provides scorecards for domains.
defaultmapperin: SecurityScorecard Alert Mapper
commonfields:
  id: SecurityScorecard
  version: -1
configuration:
- name: base_url
  display: SecurityScorecard API Base URL
  required: true
  defaultvalue: https://api.securityscorecard.io/
  type: 0
  section: Connect
- name: username
  display: Username/Email
  additionalinfo: The SecurityScorecard username/email.
  required: true
  type: 9
  displaypassword: API Token
  section: Connect
- name: isFetch
  display: Fetch incidents
  type: 8
  required: false
  section: Collect
- name: incidentFetchInterval
  display: Incidents Fetch Interval
  additionalinfo: SecurityScorecard is updated on a daily basis therefore there's no need to modify this value.
  defaultvalue: "1440"
  type: 19
  required: false
  section: Collect
- name: max_fetch
  display: Fetch Limit
  defaultvalue: '50'
  type: 0
  additionalinfo: Maximum number of alerts per fetch. The maximum is 50.
  required: false
  section: Collect
- name: first_fetch
  display: First fetch
  defaultvalue: 2 days
  type: 0
  additionalinfo: First fetch query (<number> <time unit>, e.g., 12 hours, 7 days. SecurityScorecard provides a maximum of 7 days back. To ensure no alerts are missed, it's recommended to use a value less than 2 days.
  required: false
  section: Collect
- name: incidentType
  display: Incident type
  defaultvalue: SecurityScorecard Alert
  type: 13
  required: false
  section: Collect
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  required: false
  section: Connect
- name: proxy
  display: Use system proxy settings
  type: 8
  required: false
  section: Connect
- display: Portfolio ID
  name: portfolio_id
  type: 0
  required: false
  section: Connect
fromversion: 6.0.0
tests:
- No tests (auto formatted)
script:
  script: ''
  type: python
  subtype: python3
  isFetchSamples: true
  isfetch: true
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: securityscorecard-portfolios-list
    description: List all Portfolios.
    arguments:
    - name: limit
      description: Limit the amount of Portfolios to return. Defaults to 50.
    outputs:
    - contextPath: SecurityScorecard.Portfolio.id
      description: Portfolio ID.
      type: String
    - contextPath: SecurityScorecard.Portfolio.name
      description: Portfolio name.
      type: String
    - contextPath: SecurityScorecard.Portfolio.description
      description: Portfolio description.
      type: String
    - contextPath: SecurityScorecard.Portfolio.privacy
      description: Portfolio privacy. Can be either private, shared or team.
      type: String
    - contextPath: SecurityScorecard.Portfolio.read_only
      description: Whether the portfolio is read only.
      type: Boolean
  - name: securityscorecard-portfolio-list-companies
    description: Lists all companies in Portfolio.
    arguments:
    - name: portfolio_id
      description: Portfolio ID. The Portfolio ID can be retrieved using the 'securityscorecard-portfolios-list' command.
      required: true
    - name: grade
      description: Grade filter. To filter multiple grades, comma-separate them, e.g. A,B.
      auto: PREDEFINED
      predefined:
      - "A"
      - "B"
      - "C"
      - "D"
      - "E"
      - "F"
    - name: industry
      description: Industry filter. To filter multiple industries, comma-separate them, e.g. education,financial_services.
      auto: PREDEFINED
      predefined:
      - "education"
      - "financial_services"
      - "food"
      - "government"
      - "healthcare"
      - "information_services"
      - "manufacturing"
      - "retail"
      - "technology"
    - name: vulnerability
      description: Vulnerability filter.
    - name: issue_type
      description: Comma-separated list of issue types. Possible values as listed in the API documentation, e.g. api_key_exposed, patching_cadence_medium, etc.
    - name: had_breach_within_last_days
      description: Domains with breaches in the last X days. Possible values are numbers, e.g. 1000.
    outputs:
    - contextPath: SecurityScorecard.Portfolio.Company.domain
      description: Company domain.
      type: String
    - contextPath: SecurityScorecard.Portfolio.Company.name
      description: Company name.
      type: String
    - contextPath: SecurityScorecard.Portfolio.Company.score
      description: Company overall score in numeric form (55-100).
      type: Number
    - contextPath: SecurityScorecard.Portfolio.Company.grade
      description: Company overall score in letter grade.
      type: String
    - contextPath: SecurityScorecard.Portfolio.Company.grade_url
      description: Company overall score URL to SVG asset.
      type: String
    - contextPath: SecurityScorecard.Portfolio.Company.last30days_score_change
      description: Company overall score numeric change (±) in the last month.
      type: Number
    - contextPath: SecurityScorecard.Portfolio.Company.industry
      description: Industry category of the domain.
      type: String
    - contextPath: SecurityScorecard.Portfolio.Company.size
      description: Company size, e.g. 'size_more_than_10000'.
      type: String
    - contextPath: SecurityScorecard.Portfolio.Company.is_custom_vendor
      description: Whether the company is a custom vendor.
      type: Boolean
    - contextPath: SecurityScorecard.Portfolio.Company.total
      description: Total number of companies in Portfolio.
      type: Number
  - name: securityscorecard-company-score-get
    description: Retrieve company overall score.
    arguments:
    - name: domain
      description: Company domain, e.g. google.com. The company must first be added to a Portfolio in order to be able to get its score.
      required: true
    outputs:
    - contextPath: SecurityScorecard.Company.Score.domain
      description: Company domain.
      type: String
    - contextPath: SecurityScorecard.Company.Score.name
      description: Company name.
      type: String
    - contextPath: SecurityScorecard.Company.Score.score
      description: Company overall score in numeric form (55-100).
      type: Number
    - contextPath: SecurityScorecard.Company.Score.grade
      description: Company overall score in letter grade form (A-F).
      type: String
    - contextPath: SecurityScorecard.Company.Score.last30days_score_change
      description: Company overall score numeric change (±) in the last month.
      type: Number
    - contextPath: SecurityScorecard.Company.Score.industry
      description: ndustry category of the domain.
      type: String
    - contextPath: SecurityScorecard.Company.Score.size
      description: Company size, e.g. 'size_more_than_10000'.
      type: String
  - name: securityscorecard-company-factor-score-get
    description: Retrieve company factor score.
    arguments:
    - name: domain
      description: Company domain.
      required: true
    - name: severity
      isArray: true
      description: "Issue severity filter. Comma-separated list of the following values: 'positive', 'info', 'low', 'medium', 'high'."
    outputs:
    - contextPath: SecurityScorecard.Company.Factor.name
      description: Factor name.
      type: String
    - contextPath: SecurityScorecard.Company.Factor.score
      description: Factor score in numeric form (55-100).
      type: Number
    - contextPath: SecurityScorecard.Company.Factor.grade
      description: Factor score in letter grade form (A-F).
      type: String
    - contextPath: SecurityScorecard.Company.Factor.Issue.type
      description: Type of issue found.
      type: String
    - contextPath: SecurityScorecard.Company.Factor.Issue.count
      description: How many times the issue was found.
      type: Number
    - contextPath: SecurityScorecard.Company.Factor.Issue.severity
      description: Severity of the issue.
      type: String
    - contextPath: SecurityScorecard.Company.Factor.Issue.total_score_impact
      description: Contribution of issue on overall score.
      type: Number
    - contextPath: SecurityScorecard.Company.Factor.Issue.detail_url
      description: URL to the details of the issue.
      type: String
    - contextPath: SecurityScorecard.Company.Factor.total
      description: Number of factors returned.
      type: Number
  - name: securityscorecard-company-history-score-get
    description: Retrieve company historical scores.
    arguments:
    - name: domain
      description: Company domain, e.g. `google.com`.
      required: true
    - name: from
      description: Initial date for historical data. Value should be in format `YYYY-MM-DD`.
    - name: to
      description: End date for historical data. Value should be in format `YYYY-MM-DD`.
    - name: timing
      description: Timing granularity.
      auto: PREDEFINED
      predefined:
      - "daily"
      - "weekly"
    outputs:
    - contextPath: SecurityScorecard.Company.ScoreHistory.domain
      description: Company domain.
      type: String
    - contextPath: SecurityScorecard.Company.ScoreHistory.date
      description: Score date.
      type: Date
    - contextPath: SecurityScorecard.Company.ScoreHistory.score
      description: Company historical security score in numeric form (55-100).
      type: Number
  - name: securityscorecard-company-history-factor-score-get
    description: Retrieve company historical factor scores.
    arguments:
    - name: domain
      description: Company domain, e.g. google.com
      required: true
    - name: from
      description: Initial date for historical data. Value should be in format 'YYYY-MM-DD'.
    - name: to
      description: End date for historical data. Value should be in format 'YYYY-MM-DD'.
    - name: timing
      description: Timing granularity. or "monthly".
      auto: PREDEFINED
      predefined:
      - "daily"
      - "weekly"
      - "monthly"
    outputs:
    - contextPath: SecurityScorecard.Company.FactorHistory.domain
      description: Company domain.
      type: String
    - contextPath: SecurityScorecard.Company.FactorHistory.date
      description: Score date.
      type: Date
    - contextPath: SecurityScorecard.Company.FactorHistory.Factor.name
      description: Factor name.
      type: Number
    - contextPath: SecurityScorecard.Company.FactorHistory.score
      description: Company historical security score in numeric form (55-100).
      type: Number
  - name: securityscorecard-alert-grade-change-create
    description: Create alert based on grade.
    arguments:
    - name: change_direction
      description: Direction of change.
      required: true
      auto: PREDEFINED
      predefined:
      - "rises"
      - "drops"
    - name: score_types
      isArray: true
      description: Comma-separated list of risk factors to monitor. Possible values are 'overall', 'any_factor_score', 'network_security', 'dns_health', 'patching_cadence', 'endpoint_security', 'ip_reputation', 'application_security', 'cubit_score', 'hacker_chatter', 'leaked_information', 'social_engineering'.
      required: true
    - name: target
      description: What do you want to monitor with this alert. This argument is required if the `portfolios` argument is not specified.
      auto: PREDEFINED
      predefined:
      - "my_scorecard"
      - "any_followed_company"
    - name: portfolio
      description: A portfolio_id to use as a target for the alert. This argument is required if the `target` argument is not specified. You can get a list of portfolios by running `!securityscorecard-portfolios-list`.
    outputs:
    - contextPath: SecurityScorecard.Alerts.GradeChangeAlert.id
      description: Alert ID.
      type: String
  - name: securityscorecard-alert-score-threshold-create
    description: Create alert based threshold met.
    arguments:
    - name: change_direction
      description: Direction of change.
      required: true
      auto: PREDEFINED
      predefined:
      - "rises_above"
      - "drops_below"
    - name: threshold
      description: The numeric score used as the threshold to trigger the alert.
      required: true
    - name: score_types
      isArray: true
      description: Comma separated list of risk factors to monitor. Possible values are 'overall', 'any_factor_score', 'network_security', 'dns_health', 'patching_cadence', 'endpoint_security', 'ip_reputation', 'application_security', 'cubit_score', 'hacker_chatter', 'leaked_information', 'social_engineering'. For multiple factors, provide comma-separated list, i.e. leaked_information,social_engineering.
      required: true
    - name: target
      description: What do you want to monitor with this alert. This argument is required if the `portfolios` argument is not specified.
      auto: PREDEFINED
      predefined:
      - "my_scorecard"
      - "any_followed_company"
    - name: portfolio
      description: A portfolio_id to use as a target for the alert. This argument is required if the `target` argument is not specified. You can get a list of portfolios by running `!securityscorecard-portfolios-list`.
    outputs:
    - contextPath: SecurityScorecard.Alerts.ScoreThresholdAlert.id
      description: Alert ID.
      type: String
  - name: securityscorecard-alert-delete
    description: Delete an alert.
    arguments:
    - name: alert_id
      description: Alert ID.
      required: true
  - name: securityscorecard-alerts-list
    description: List alerts triggered in the last week.
    arguments:
    - name: portfolio_id
      description: Portfolio ID. Can be retrieved using `!securityscorecard-portfolios-list`.
    outputs:
    - contextPath: SecurityScorecard.Alerts.Alert.id
      description: Alert ID.
      type: String
    - contextPath: SecurityScorecard.Alerts.Alert.email
      description: Alert email recipient.
      type: String
    - contextPath: SecurityScorecard.Alerts.Alert.change_type
      description: Alert change type configured (score or threshold).
      type: String
    - contextPath: SecurityScorecard.Alerts.Alert.domain
      description: Alert domain.
      type: String
    - contextPath: SecurityScorecard.Alerts.Alert.company_name
      description: Alert company name.
      type: String
    - contextPath: SecurityScorecard.Alerts.Alert.Portfolio.id
      description: Alert Portfolio ID.
      type: array
    - contextPath: SecurityScorecard.Alerts.Alert.my_scorecard
      description: Whether the alert was triggered on private scorecard. This depends on whether 'my_scorecard' was added to the optional argument 'target' when creating alerts using the 'securityscorecard-alert-score-threshold-create' and 'securityscorecard-alert-grade-change-create' commands.
      type: Boolean
    - contextPath: SecurityScorecard.Alerts.Alert.created_at
      description: Timestamp of when the alert was triggered.
      type: Date
  - name: securityscorecard-company-services-get
    description: Retrieve the service providers of a domain.
    arguments:
    - name: domain
      description: Company domain.
      required: true
    outputs:
    - contextPath: SecurityScorecard.Service.vendor_domain
      description: Vendor domain, e.g. Google, Amazon.
      type: String
    - contextPath: SecurityScorecard.Service.client_domain
      description: Client domain. This value is identical to the input of the domain argument.
      type: String
    - contextPath: SecurityScorecard.Service.categories
      description: Vendor service provider, e.g. mail_provider, nameserver_provider.
      type: array
  - name: securityscorecard-company-events-get
    description: Retrieve a company's historical events.
    arguments:
    - name: domain
      description: Company domain, e.g. google.com
      required: true
    - name: date_from
      type: datetime
      description: Initial date for historical data. Value should be in format `2020-01-30T00:00:00.000Z`.
    - name: date_to
      type: datetime
      description: End date for historical data. Value should be in format `2020-01-30T00:00:00.000Z`.
    outputs:
    - contextPath: SecurityScorecard.Events.Event.ssc_event_id
      type: string
      description: event id.
    - contextPath: SecurityScorecard.Events.Event.date
      type: date
      description: event date.
    - contextPath: SecurityScorecard.Events.Event.status
      description: event status.
    - contextPath: SecurityScorecard.Events.Event.issue_count
      type: number
      description: event issue count.
    - contextPath: SecurityScorecard.Events.Event.score_impact
      type: number
      description: event score impact.
    - contextPath: SecurityScorecard.Events.Event.issue_type
      type: string
      description: event issue type.
    - contextPath: SecurityScorecard.Events.Event.severity
      type: string
      description: event severity.
    - contextPath: SecurityScorecard.Events.Event.factor
      type: string
      description: event factor.
    - contextPath: SecurityScorecard.Events.Event.ssc_detail_url
      type: string
      description: event detail url.
  - name: securityscorecard-company-findings-get
    description: Retrieve an issue_type's historical findings in a scorecard.
    arguments:
    - name: domain
      description: Retrieve the service providers of a domain.
      required: true
    - name: date
      type: date
      description: The effective_date for historical data. Value should be in format 'YYYY-MM-DD'.
      required: true
    - name: issue_type
      description: Key representing issue type, e.g. api_key_exposed.
      required: true
    - name: status
      description: "group_status filter. Comma-separated list of the following values: 'active', 'inactive', 'all'."
  - name: securityscorecard-issue-metadata
    description: Retrieve metadata for an issue type, including description and recommendation.
    arguments:
    - name: issue_type
      required: true
      description: Key representing issue type, e.g. api_key_exposed.
    outputs:
    - contextPath: SecurityScorecard.Metadata.Issues.key
      type: string
      description: Key representing issue type, e.g. api_key_exposed.
    - contextPath: SecurityScorecard.Metadata.Issues.severity
      type: string
      description: issue severity.
    - contextPath: SecurityScorecard.Metadata.Issues.factor
      type: string
      description: issue factor.
    - contextPath: SecurityScorecard.Metadata.Issues.title
      type: string
      description: issue title.
    - contextPath: SecurityScorecard.Metadata.Issues.short_description
      type: string
      description: issue short description.
    - contextPath: SecurityScorecard.Metadata.Issues.long_description
      type: string
      description: issue long description.
    - contextPath: SecurityScorecard.Metadata.Issues.recommendation
      type: string
      description: issue recommendation.
  - name: securityscorecard-alert-rules-list
    description: List alert subscriptions for the user.
    arguments: []
    outputs:
    - contextPath: SecurityScorecard.AlertRules.Rule.id
      description: Alert Rule ID.
      type: String
    - contextPath: SecurityScorecard.AlertRules.Rule.name
      description: Alert Rule name.
      type: String
    - contextPath: SecurityScorecard.AlertRules.Rule.target
      description: Target of the Rule.
      type: String
    - contextPath: SecurityScorecard.AlertRules.Rule.updated_at
      description: Timestamp when the alert rule was last updated.
      type: Date
    - contextPath: SecurityScorecard.AlertRules.Rule.paused_at
      description: Timestamp when the alert rule was paused.
      type: Date
  - name: securityscorecard-issue-details-get
    description: Retrieve issue details for a specific issue type and domain.
    arguments:
    - name: domain
      description: The domain to get the issue details for.
      required: true
    - name: issue_type
      description: The issue type to get the details for.
      required: true
    outputs:
    - contextPath: SecurityScorecard.IssueDetails.issue_id
      description: Unique UUID for this measurement.
      type: String
    - contextPath: SecurityScorecard.IssueDetails.parent_domain
      description: Parent domain aka vendor.
      type: String
    - contextPath: SecurityScorecard.IssueDetails.issue_type
      description: issue_type of the findings.
      type: String
    - contextPath: SecurityScorecard.IssueDetails.count
      description: The number of findings.
      type: Number
    - contextPath: SecurityScorecard.IssueDetails.group_status
      description: If findings are active or not.
      type: String
    - contextPath: SecurityScorecard.IssueDetails.first_seen_time
      description: Epoch of observation in nanoseconds.
      type: Date
    - contextPath: SecurityScorecard.IssueDetails.last_seen_time
      description: Epoch of observation in nanoseconds.
      type: Date
    - contextPath: SecurityScorecard.IssueDetails.port
      description: Port number of the observation if applicable.
      type: Number
    - contextPath: SecurityScorecard.IssueDetails.domain
      description: Domain of the observation if applicable.
      type: String
    - contextPath: SecurityScorecard.IssueDetails.ip
      description: IP address of the observation if applicable.
      type: String
    - contextPath: SecurityScorecard.IssueDetails.protocol
      description: Protocol of the observation if applicable.
      type: String
    - contextPath: SecurityScorecard.IssueDetails.observations
      description: Observation data in raw JSON format.
      type: String
  runonce: false
sectionorder:
- Connect
- Collect