Sekoia XDR

Fetch alerts and events from SEKOIA.IO XDR.\nTo use this integration, please create an API Key with the appropriate permissions.

Analytics & SIEM · SekoiaXDR

Details

ID	`Sekoia XDR`
Provider	Sekoia
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

Fetch alerts and events from SEKOIA.IO XDR.
To use this integration, please create an API Key with the appropriate permissions.
This integration was integrated and tested with version 1.0 of Sekoia XDR.

Configure Sekoia XDR in Cortex

Parameter	Description	Required
API Key		True
Server URL (i.e. https://api.sekoia.io)		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
Incident type		False
First fetch timestamp (<sign + or -><number><time unit>, e.g., -7d, -1h)		True
Maximum incidents to fetch per interval.	By default the max_fetch is set to 10	True
Incidents Fetch Interval		False
Alerts status.	Filter alerts to fetch by status. You can write and press enter to insert new types.	False
Alerts types.	Filter alerts to fetch by types. You can write and press enter to insert new types.	False
Alerts urgency levels ( “MINurgency,MAXurgency”. i.e: 80,100 ).	Filter alerts by their urgency levels. Use the format “MINurgency, MAXurgency”	False
Fetch mode	If there’s no max_fetch it will fetch 10 incidents by default.	True
Replace “dots” in event field names with another character.	Replacing dots in events will make names look pretty good for users	True
Events fields to exclude from the events search result.	These are the names of the headers presented in the events table. If the header is not in the dropdown list write it and press enter.	False
Include assets information in the alerts when fetching.	When selected, it includes the assets information in the alert when fetched from Sekoia. And also If there’s no max_fetch it will fetch 10 incidents by default.	False
Include kill chain information in the alerts when fetching.	When selected, it includes the kill chain information in the alert when fetched from Sekoia. And also If there’s no max_fetch it will fetch 10 incidents by default.	False
Incident Mirroring Direction.	Choose the direction to mirror the incident: None(Disable mirroring), Incoming (from Sekoia XDR to Cortex XSOAR) , Outgoing (from Cortex XSOAR to Sekoia XDR), or Incoming and Outgoing (from/to Cortex XSOAR and Sekoia XDR). Cortex XSOAR only parameter.	False
Include events in the mirroring of the alerts.	When selected, it includes the events in the mirrored alerts when an alert is updated in Sekoia.	False
Include kill chain information in the mirroring of the alerts.	When selected, it includes the kill chain information of the alert in the mirrored alerts when an alert is updated in Sekoia.	False
Reopen Mirrored Cortex XSOAR Incidents (Incoming Mirroring)	When selected, reopening the Sekoia XDR alert will reopen the Cortex XSOAR incident.	False
Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)	When selected, closing the Sekoia XDR alert with a “Closed” or “Reject” status will close the Cortex XSOAR incident. Cortex XSOAR only parameter.	False
Close notes.	Change the closing notes that will be added to the tickets closed automatically by the automation.	True
Timezone ( TZ format )	This will be used to present dates in the appropiate timezones, used for comment timestamps, etc.	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

sekoia-xdr-list-alerts

Command to retrieve a list of Alerts from Sekoia XDR.

Base Command

sekoia-xdr-list-alerts

Input

Argument Name	Description	Required
limit	The number of alerts to return. The allowed range is 1-100, default is 20. Default is 20.	Optional
status	Match alerts by their status name (separated by commas). Possible values are: Pending, Acknowledged, Ongoing, Rejected, Closed.	Optional
created_at	Filter alerts by their creation dates, starting date followed by ending date, i.e: “-3d,now” , “-1w,now” or “2023-01-15,2023-01-17”.	Optional
updated_at	Filter alerts by their update dates starting date followed by ending date, i.e: “-3d,now” , “-1w,now” or “2023-01-15,2023-01-17”.	Optional
urgency	Filter alerts by their urgencies range in the following format: “MINurgency,MAXurgency”. i.e: 80,100.	Optional
Alerts type	Match alerts by their categories (separated by commas). Possible values are: spam, ddos, outage, phishing, unauthorized-use-of-resources, unauthorised-information-access, appscan, scanner, brute-force, exploit.	Optional
sort_by	Sort the alerts by any information. Possible values are: created_at, updated_at, target, urgency, status. Default is created_at.	Optional

Context Output

Path	Type	Description
SekoiaXDR.ListAlerts.updated_at	unknown	The time at which the alert was updated.
SekoiaXDR.ListAlerts.updated_by	unknown	The user who last updated the alert.
SekoiaXDR.ListAlerts.uuid	unknown	The unique identifier of the alert.
SekoiaXDR.ListAlerts.title	unknown	The title of the alert.
SekoiaXDR.ListAlerts.time_to_respond	unknown	The time it took to respond to the alert.
SekoiaXDR.ListAlerts.short_id	unknown	The short identifier of the alert.
SekoiaXDR.ListAlerts.community_uuid	unknown	The unique identifier of the community associated with the alert.
SekoiaXDR.ListAlerts.kill_chain_short_id	unknown	The short identifier of the kill chain associated with the alert.
SekoiaXDR.ListAlerts.number_of_unseen_comments	unknown	The number of unseen comments on the alert.
SekoiaXDR.ListAlerts.updated_by_type	unknown	The type of user who last updated the alert.
SekoiaXDR.ListAlerts.source	unknown	The source of the alert.
SekoiaXDR.ListAlerts.alert_type.value	unknown	The type of the alert.
SekoiaXDR.ListAlerts.alert_type.category	unknown	The category type of the alert.
SekoiaXDR.ListAlerts.time_to_acknowledge	unknown	The time it took to acknowledge the alert.
SekoiaXDR.ListAlerts.stix	unknown	The STIX data associated with the alert.
SekoiaXDR.ListAlerts.first_seen_at	unknown	The time the alert was first seen.
SekoiaXDR.ListAlerts.ttps.type	unknown	The type of the TTP associated with the alert.
SekoiaXDR.ListAlerts.ttps.name	unknown	The name of the TTP associated with the alert.
SekoiaXDR.ListAlerts.ttps.id	unknown	The unique identifier of the TTP associated with the alert.
SekoiaXDR.ListAlerts.ttps.description	unknown	The description of the TTP associated with the alert.
SekoiaXDR.ListAlerts.adversaries.type	unknown	The type of the adversary associated with the alert.
SekoiaXDR.ListAlerts.adversaries.name	unknown	The name of the adversary associated with the alert.
SekoiaXDR.ListAlerts.adversaries.id	unknown	The unique identifier of the adversary associated with the alert.
SekoiaXDR.ListAlerts.adversaries.description	unknown	The description of the adversary associated with the alert.
SekoiaXDR.ListAlerts.time_to_ingest	unknown	The time it took to ingest the alert.
SekoiaXDR.ListAlerts.target	unknown	The target of the alert.
SekoiaXDR.ListAlerts.time_to_resolve	unknown	The time it took to resolve the alert.
SekoiaXDR.ListAlerts.created_at	unknown	The time at which the alert was created.
SekoiaXDR.ListAlerts.last_seen_at	unknown	The time at which the alert was last seen.
SekoiaXDR.ListAlerts.assets	unknown	The assets associated with the alert.
SekoiaXDR.ListAlerts.rule.severity	unknown	The severity level of the rule that triggered the alert.
SekoiaXDR.ListAlerts.rule.type	unknown	The type of rule that triggered the alert.
SekoiaXDR.ListAlerts.rule.uuid	unknown	The unique identifier of the rule that triggered the alert.
SekoiaXDR.ListAlerts.rule.name	unknown	The name of the rule that triggered the alert.
SekoiaXDR.ListAlerts.rule.description	unknown	The description of the rule that triggered the alert.
SekoiaXDR.ListAlerts.rule.pattern	unknown	The pattern of the rule that triggered the alert.
SekoiaXDR.ListAlerts.similar	unknown	The number of similar alerts to this one.
SekoiaXDR.ListAlerts.status.name	unknown	The name of the status of the alert.
SekoiaXDR.ListAlerts.status.description	unknown	The description of the status of the alert.
SekoiaXDR.ListAlerts.status.uuid	unknown	The unique identifier of the status of the alert.
SekoiaXDR.ListAlerts.urgency.criticity	unknown	The level of criticity of the urgency of the alert.
SekoiaXDR.ListAlerts.urgency.current_value	unknown	The current value of the urgency of the alert.
SekoiaXDR.ListAlerts.urgency.severity	unknown	The severity level of the urgency of the alert.
SekoiaXDR.ListAlerts.urgency.display	unknown	The display of the urgency of the alert.
SekoiaXDR.ListAlerts.urgency.value	unknown	The value of the urgency of the alert.
SekoiaXDR.ListAlerts.created_by	unknown	The user who created the alert.
SekoiaXDR.ListAlerts.number_of_total_comments	unknown	The total number of comments on the alert.
SekoiaXDR.ListAlerts.time_to_detect	unknown	The time it took to detect the alert.
SekoiaXDR.ListAlerts.entity.name	unknown	The name of the entity associated with the alert.
SekoiaXDR.ListAlerts.entity.uuid	unknown	The unique identifier of the entity associated with the alert.
SekoiaXDR.ListAlerts.created_by_type	unknown	The type of user who created the alert.
SekoiaXDR.ListAlerts.details	unknown	The details of the alert.

sekoia-xdr-get-alert

Command to retrieve a specific alert by uuid or short_id from Sekoia XDR.

Base Command

sekoia-xdr-get-alert

Input

Argument Name	Description	Required
id	The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts or from sekoia plateform. i.e: “f5dcb81c-8d81-4332-9f1e-f119a1b31217” or “ALUnyZCYZ9Ga”.	Required

Context Output

Path	Type	Description
SekoiaXDR.Alert.short_id	string	Short ID of the alert.
SekoiaXDR.Alert.title	string	Title of the alert.
SekoiaXDR.Alert.urgency	string	urgency of the alert.

sekoia-xdr-events-execute-query

Command to create an event search job on Sekoia XDR, after this execute “sekoia-xdr-status-events-query” to see the status of the query job and “sekoia-xdr-results-events-query” to retrieve the results..

Base Command

sekoia-xdr-events-execute-query

Input

Argument Name	Description	Required
earliest_time	Valid formats <sign + or -><number><time unit> or ISO 8601 e.g -3d, -2w, -7d, 2023-01-15T00:00:00Z.	Required
lastest_time	Valid formats <sign + or -><number><time unit> or ISO 8601 e.g +3d, +2w, now, 2023-01-15T00:00:00Z.	Required
query	The query to use, i.e: “alert_short_ids:ALUnyZCYZ9Ga”.	Optional
max_last_events	Maximum number of listed events.	Optional

Context Output

Path	Type	Description
SekoiaXDR.Events.Query.uuid	unknown	The unique identifier for the event.
SekoiaXDR.Events.Query.term	unknown	The search term associated with the event.
SekoiaXDR.Events.Query.started_at	unknown	The time at which the event started.
SekoiaXDR.Events.Query.short_histogram.cases	unknown	The number of cases associated with the event.
SekoiaXDR.Events.Query.short_histogram.total	unknown	The total number of events associated with the search term.
SekoiaXDR.Events.Query.short_histogram.alerts	unknown	The number of alerts associated with the event.
SekoiaXDR.Events.Query.short_histogram.earliest_time	unknown	The earliest time associated with the event.
SekoiaXDR.Events.Query.short_histogram.length	unknown	The length of the histogram for the event.
SekoiaXDR.Events.Query.created_by	unknown	The user who created the event.
SekoiaXDR.Events.Query.expired	unknown	A boolean indicating whether the event has expired.
SekoiaXDR.Events.Query.latest_time	unknown	The latest time associated with the event.
SekoiaXDR.Events.Query.expiration_date	unknown	The date on which the event will expire.
SekoiaXDR.Events.Query.created_at	unknown	The time at which the event was created.
SekoiaXDR.Events.Query.status	unknown	The status of the event.
SekoiaXDR.Events.Query.view_uuid	unknown	The unique identifier for the view associated with the event.
SekoiaXDR.Events.Query.canceled_at	unknown	The time at which the event was canceled.
SekoiaXDR.Events.Query.only_eternal	unknown	A boolean indicating whether the event is only eternal.
SekoiaXDR.Events.Query.results_ttl	unknown	The time-to-live for the event results.
SekoiaXDR.Events.Query.canceled_by	unknown	The user who canceled the event.
SekoiaXDR.Events.Query.term_lang	unknown	The language of the search term associated with the event.
SekoiaXDR.Events.Query.ended_at	unknown	The time at which the event ended.
SekoiaXDR.Events.Query.earliest_time	unknown	The earliest time associated with the event.
SekoiaXDR.Events.Query.max_last_events	unknown	The maximum number of events to include in the results.
SekoiaXDR.Events.Query.canceled_by_type	unknown	The type of the user who canceled the event.
SekoiaXDR.Events.Query.total	unknown	The total number of events associated with the event.
SekoiaXDR.Events.Query.created_by_type	unknown	The type of the user who created the event.
SekoiaXDR.Events.Query.community_uuids	unknown	The list of community UUIDs associated with the event.
SekoiaXDR.Events.Query.filters.field	unknown	The field associated with the filter.
SekoiaXDR.Events.Query.filters.value	unknown	The value associated with the filter.
SekoiaXDR.Events.Query.filters.operator	unknown	The operator used in the filter.
SekoiaXDR.Events.Query.filters.excluded	unknown	Indicates whether the filter is excluded or not.
SekoiaXDR.Events.Query.filters.disabled	unknown	Indicates whether the filter is disabled or not.

sekoia-xdr-events-status-query

Command to query the status of the search job on Sekoia XDR.

Base Command

sekoia-xdr-events-status-query

Input

Argument Name	Description	Required
uuid	UUID of the query executed previously with the “sekoia-xdr-query-events” command.	Required

Context Output

Path	Type	Description
SekoiaXDR.Events.Status.uuid	unknown	The unique identifier for the event.
SekoiaXDR.Events.Status.term	unknown	The term associated with the event.
SekoiaXDR.Events.Status.started_at	unknown	The time at which the event started.
SekoiaXDR.Events.Status.short_histogram.cases	unknown	The number of cases associated with the event.
SekoiaXDR.Events.Status.short_histogram.total	unknown	The total number of events associated with the event.
SekoiaXDR.Events.Status.short_histogram.alerts	unknown	The number of alerts associated with the event.
SekoiaXDR.Events.Status.short_histogram.earliest_time	unknown	The earliest time associated with the event.
SekoiaXDR.Events.Status.short_histogram.length	unknown	The length associated with the event.
SekoiaXDR.Events.Status.created_by	unknown	The user who created the event.
SekoiaXDR.Events.Status.expired	unknown	Whether the event is expired.
SekoiaXDR.Events.Status.latest_time	unknown	The latest time associated with the event.
SekoiaXDR.Events.Status.expiration_date	unknown	The date when the event expires.
SekoiaXDR.Events.Status.created_at	unknown	The time when the event was created.
SekoiaXDR.Events.Status.status	unknown	The current status of the event.
SekoiaXDR.Events.Status.view_uuid	unknown	The view associated with the event.
SekoiaXDR.Events.Status.canceled_at	unknown	The time when the event was canceled.
SekoiaXDR.Events.Status.only_eternal	unknown	Whether only eternal events are associated with the event.
SekoiaXDR.Events.Status.results_ttl	unknown	The time-to-live for the event results.
SekoiaXDR.Events.Status.canceled_by	unknown	The user who canceled the event.
SekoiaXDR.Events.Status.term_lang	unknown	The language associated with the term for the event.
SekoiaXDR.Events.Status.ended_at	unknown	The time when the event ended.
SekoiaXDR.Events.Status.earliest_time	unknown	The earliest time associated with the event.
SekoiaXDR.Events.Status.max_last_events	unknown	The maximum number of events to retrieve.
SekoiaXDR.Events.Status.canceled_by_type	unknown	The type of user who canceled the event.
SekoiaXDR.Events.Status.total	unknown	The total number of events associated with the event.
SekoiaXDR.Events.Status.created_by_type	unknown	The type of user who created the event.
SekoiaXDR.Events.Status.community_uuids[0]	unknown	The community associated with the event.
SekoiaXDR.Events.Status.filters.field	unknown	The field used for filtering events.
SekoiaXDR.Events.Status.filters.field	unknown	The field used in the filter.
SekoiaXDR.Events.Status.filters.value	unknown	The value of the filter.
SekoiaXDR.Events.Status.filters.operator	unknown	The operator used in the filter.
SekoiaXDR.Events.Status.filters.excluded	unknown	A boolean indicating whether the filter is excluded or not.
SekoiaXDR.Events.Status.filters.disabled	unknown	A boolean indicating whether the filter is disabled or not.

sekoia-xdr-events-results-query

Command to retrieve the events from the search job “sekoia-xdr-execute-events-query” previously done on Sekoia XDR.

Base Command

sekoia-xdr-events-results-query

Input

Argument Name	Description	Required
uuid	UUID from response of the query executed previously with the “sekoia-xdr-query-events” command.	Required

Context Output

Path	Type	Description
SekoiaXDR.Events.Results	unknown	The outputs are different for each event, they will be output inside SekoiaXDR.Events.Results.

sekoia-xdr-search-events

Command to search and retrieve the events from an alert. This is a combination of 3 commands: sekoia-xdr-events-execute-query, sekoia-xdr-events-status-query and sekoia-xdr-events-results-query.

Base Command

sekoia-xdr-search-events

Input

Argument Name	Description	Required
earliest_time	Valid formats <sign + or -><number><time unit> or ISO 8601 e.g -3d, -2w, -7d, 2023-01-15T00:00:00Z.	Required
lastest_time	Valid formats <sign + or -><number><time unit> or ISO 8601 e.g +3d, +2w, now, 2023-01-15T00:00:00Z.	Required
query	The query to use, i.e: “alert_short_ids:ALUnyZCYZ9Ga”.	Optional
max_last_events	Maximum number of listed events.	Optional
exclude_info	Indicate if there is any information you want to exclude from the results of the events. i.e: original.message, message, agent.name, etc. These are the names of the headers presented in the table. If the header you want to exclude is not in the list write it and press enter. Possible values are: original.message, message, __event_id, agent.name, alert_short_ids, client.address, client.ip, client.user.id, customer.community_name, customer.community_uuid, customer.id, customer.intake_key, customer.intake_name, customer.intake_uuid, ecs.version, entity.id, entity.name, entity.uuid, event.created, event.dialect, event.dialect_uuid, event.id, event.outcome, http.request.method, http.request.referrer, related.ip, sekoiaio.activity.client.id, sekoiaio.activity.client.type, sekoiaio.customer.community_name, sekoiaio.customer.community_uuid, sekoiaio.customer.id, sekoiaio.entity.id, sekoiaio.entity.name, sekoiaio.entity.uuid, sekoiaio.intake.dialect, sekoiaio.intake.dialect_uuid, sekoiaio.intake.key, sekoiaio.intake.name, sekoiaio.intake.parsing_status, sekoiaio.intake.uuid, timestamp, url.domain, url.original, url.path, url.port, url.query, url.registered_domain, url.scheme, url.subdomain, url.top_level_domain, user_agent.original.	Optional
job_uuid	The job UUID to retrieve query results.	Optional

Context Output

Path	Type	Description
SekoiaXDR.Events.Results	unknown	The outputs are different for each event, they will be output inside SekoiaXDR.Events.Results.

sekoia-xdr-update-status-alert

Command to update the status of a specific Alert by uuid or short_id.

Base Command

sekoia-xdr-update-status-alert

Input

Argument Name	Description	Required
id	The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts or from sekoia plateform. i.e: “f5dcb81c-8d81-4332-9f1e-f119a1b31217” or “ALUnyZCYZ9Ga”.	Required
status	The status you want to apply. (Acknowledged, Rejected, Ongoing, Closed)). Possible values are: Acknowledged, Rejected, Ongoing, Closed.	Required
comment	Comment to describe why the alert status has changed.	Optional

Context Output

There is no context output for this command.

sekoia-xdr-post-comment-alert

Command to post comments to alerts in Sekoia XDR.

Base Command

sekoia-xdr-post-comment-alert

Input

Argument Name	Description	Required
id	The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts command. i.e: “f5dcb81c-8d81-4332-9f1e-f119a1b31217” or “ALUnyZCYZ9Ga”.	Required
comment	Content of the comment to be posted on the alert.	Required
author	Author of the comment.	Optional

Context Output

There is no context output for this command.

sekoia-xdr-get-comments

Command to get all the comments from an alert in Sekoia XDR.

Base Command

sekoia-xdr-get-comments

Input

Argument Name	Description	Required
id	The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts command or from sekoia plateform. i.e: “f5dcb81c-8d81-4332-9f1e-f119a1b31217” or “ALUnyZCYZ9Ga”.	Required

Context Output

Path	Type	Description
SekoiaXDR.Comments.total	unknown	The total number of items in the comments.
SekoiaXDR.Comments.items.date	unknown	The date at which the comment was created.
SekoiaXDR.Comments.items.created_by	unknown	The user who created the comment.
SekoiaXDR.Comments.items.uuid	unknown	The unique identifier for the comment.
SekoiaXDR.Comments.items.content	unknown	The content of the comment.
SekoiaXDR.Comments.items.created_by_type	unknown	The type of the user who created the comment.
SekoiaXDR.Comments.items.unseen	unknown	Indicates whether the comment has been seen by the user.
SekoiaXDR.Comments.items.author	unknown	The author of the comment.

sekoia-xdr-get-workflow-alert

Command to get the possible transitions of status on the alert.

Base Command

sekoia-xdr-get-workflow-alert

Input

Argument Name	Description	Required
id	The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts command or from sekoia plateform. i.e: “f5dcb81c-8d81-4332-9f1e-f119a1b31217” or “ALUnyZCYZ9Ga”.	Required

Context Output

Path	Type	Description
SekoiaXDR.StatusTransitions.actions.name	unknown	The name of the action.
SekoiaXDR.StatusTransitions.actions.description	unknown	The description of the action.
SekoiaXDR.StatusTransitions.actions.id	unknown	The ID of the action.

sekoia-xdr-get-cases-alert

Command to retrieve the cases related to an Alert from Sekoia XDR. If a case_id is given, returns the information about it, and if not it will give all cases in this alert.

Base Command

sekoia-xdr-get-cases-alert

Input

Argument Name	Description	Required
alert_id	The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts command or from sekoia plateform. i.e: “f5dcb81c-8d81-4332-9f1e-f119a1b31217” or “ALUnyZCYZ9Ga”.	Required
case_id	The short_id of the case to retrieve from sekoia plateform or from this command without case_is param i.e: “CAQNurTJM8q2”.	Optional

Context Output

Path	Type	Description
SekoiaXDR.Cases.updated_at	unknown	The time at which the case was updated.
SekoiaXDR.Cases.updated_by	unknown	The user who updated the case.
SekoiaXDR.Cases.uuid	unknown	The unique identifier of the case.
SekoiaXDR.Cases.title	unknown	The title of the case.
SekoiaXDR.Cases.priority	unknown	The priority level of the case.
SekoiaXDR.Cases.short_id	unknown	The short ID of the case.
SekoiaXDR.Cases.community_uuid	unknown	The unique identifier of the community to which the case belongs.
SekoiaXDR.Cases.updated_by_type	unknown	The type of user who updated the case.
SekoiaXDR.Cases.first_seen_at	unknown	The time at which the case was first seen.
SekoiaXDR.Cases.number_of_comments	unknown	The number of comments on the case.
SekoiaXDR.Cases.alerts.updated_at	unknown	The time at which the alert was updated.
SekoiaXDR.Cases.alerts.updated_by	unknown	The user who updated the alert.
SekoiaXDR.Cases.alerts.uuid	unknown	The unique identifier of the alert.
SekoiaXDR.Cases.alerts.title	unknown	The title of the alert.
SekoiaXDR.Cases.alerts.time_to_respond	unknown	The time it took to respond to the alert.
SekoiaXDR.Cases.alerts.short_id	unknown	The short ID of the alert.
SekoiaXDR.Cases.alerts.community_uuid	unknown	The unique identifier of the community to which the alert belongs.
SekoiaXDR.Cases.alerts.kill_chain_short_id	unknown	The short ID of the kill chain.
SekoiaXDR.Cases.alerts.number_of_unseen_comments	unknown	The number of unseen comments on the alert.
SekoiaXDR.Cases.alerts.updated_by_type	unknown	The type of user who updated the alert.
SekoiaXDR.Cases.alerts.source	unknown	The source of the alert.
SekoiaXDR.Cases.alerts.alert_type.value	unknown	The type of the alert.
SekoiaXDR.Cases.alerts.alert_type.category	unknown	The category type of the alert.
SekoiaXDR.Cases.alerts.time_to_acknowledge	unknown	The time it took to acknowledge the alert.
SekoiaXDR.Cases.alerts.stix	unknown	The STIX data of the alert.
SekoiaXDR.Cases.alerts.first_seen_at	unknown	The time at which the alert was first seen.
SekoiaXDR.Cases.alerts.ttps.type	unknown	The type of TTP associated with the alert.
SekoiaXDR.Cases.alerts.ttps.name	unknown	The name of the TTP associated with the alert.
SekoiaXDR.Cases.alerts.ttps.id	unknown	The ID of the TTP associated with the alert.
SekoiaXDR.Cases.alerts.ttps.description	unknown	The description of the TTP associated with the alert.
SekoiaXDR.Cases.alerts.adversaries.type	unknown	The type of adversary associated with the alert.
SekoiaXDR.Cases.alerts.adversaries.name	unknown	The name of the adversary associated with the alert.
SekoiaXDR.Cases.alerts.adversaries.id	unknown	The ID of the adversary associated with the alert.
SekoiaXDR.Cases.alerts.adversaries.description	unknown	The description of the adversary associated with the alert.
SekoiaXDR.Cases.alerts.time_to_ingest	unknown	The time it took to ingest the alert.
SekoiaXDR.Cases.alerts.target	unknown	The target of the alert.
SekoiaXDR.Cases.alerts.time_to_resolve	unknown	The time it took to resolve the alert.
SekoiaXDR.Cases.alerts.created_at	unknown	The time at which the alert was created.
SekoiaXDR.Cases.alerts.last_seen_at	unknown	The time at which the alert was last seen.
SekoiaXDR.Cases.alerts.assets	unknown	The assets associated with the alert.
SekoiaXDR.Cases.alerts.rule.severity	unknown	The severity level of the rule associated with the alert.
SekoiaXDR.Cases.alerts.rule.type	unknown	The type of rule associated with the alert.
SekoiaXDR.Cases.alerts.rule.uuid	unknown	The unique identifier of the rule associated with the alert.
SekoiaXDR.Cases.alerts.rule.name	unknown	The name of the rule associated with the alert.
SekoiaXDR.Cases.alerts.rule.description	unknown	The description of the rule associated with the alert.
SekoiaXDR.Cases.alerts.rule.pattern	unknown	The pattern of the rule associated with the alert.
SekoiaXDR.Cases.alerts.similar	unknown	The number of similar alerts.
SekoiaXDR.Cases.alerts.status.name	unknown	The name of the status of the alert.
SekoiaXDR.Cases.alerts.status.description	unknown	The description of the status of the alert.
SekoiaXDR.Cases.alerts.status.uuid	unknown	The unique identifier of the status of the alert.
SekoiaXDR.Cases.alerts.urgency.criticity	unknown	The level of criticality of the urgency of the alert.
SekoiaXDR.Cases.alerts.urgency.current_value	unknown	The current value of the urgency of the alert.
SekoiaXDR.Cases.alerts.urgency.severity	unknown	The severity level of the urgency of the alert.
SekoiaXDR.Cases.alerts.urgency.display	unknown	The display value of the urgency of the alert.
SekoiaXDR.Cases.alerts.urgency.value	unknown	The value of the urgency of the alert.
SekoiaXDR.Cases.alerts.created_by	unknown	The user who created the alert.
SekoiaXDR.Cases.alerts.number_of_total_comments	unknown	The total number of comments on the alert.
SekoiaXDR.Cases.alerts.time_to_detect	unknown	The time it took to detect the alert.
SekoiaXDR.Cases.alerts.entity.name	unknown	The name of the entity associated with the alert.
SekoiaXDR.Cases.alerts.entity.uuid	unknown	The unique identifier of the entity associated with the alert.
SekoiaXDR.Cases.alerts.created_by_type	unknown	The type of user who created the alert.
SekoiaXDR.Cases.alerts.details	unknown	The details of the alert.
SekoiaXDR.Cases.number_of_alerts	unknown	The number of alerts in the case.
SekoiaXDR.Cases.created_at	unknown	The time at which the case was created.
SekoiaXDR.Cases.last_seen_at	unknown	The time at which the case was last seen.
SekoiaXDR.Cases.status	unknown	The status of the case.
SekoiaXDR.Cases.description	unknown	The description of the case.
SekoiaXDR.Cases.status_uuid	unknown	The unique identifier of the status of the case.
SekoiaXDR.Cases.created_by	unknown	The user who created the case.
SekoiaXDR.Cases.tags	unknown	The tags associated with the case.
SekoiaXDR.Cases.created_by_type	unknown	The type of user who created the case.
SekoiaXDR.Cases.subscribers.avatar_uuid	unknown	The unique identifier of the avatar of the subscriber.
SekoiaXDR.Cases.subscribers.type	unknown	The type of subscriber.

sekoia-xdr-get-asset

Get an asset by its UUID from Sekoia XDR.

Base Command

sekoia-xdr-get-asset

Input

Argument Name	Description	Required
asset_uuid	UUID of the asset to get, the UUID should appear with “sekoia-xdr-list-assets” if that alert have assets related, example: “d4cc3b05-a78d-4f29-b27c-c637d86fa03a”.	Required

Context Output

Path	Type	Description
SekoiaXDR.Asset.owners	unknown	The owners of the asset.
SekoiaXDR.Asset.category.types.description	unknown	The description of the category type of the asset.
SekoiaXDR.Asset.category.types.name	unknown	The name of the category type of the asset.
SekoiaXDR.Asset.category.types.uuid	unknown	The UUID of the category type of the asset.
SekoiaXDR.Asset.category.description	unknown	The description of the category of the asset.
SekoiaXDR.Asset.category.name	unknown	The name of the category of the asset.
SekoiaXDR.Asset.category.uuid	unknown	The UUID of the category of the asset.
SekoiaXDR.Asset.created_at	unknown	The time at which the asset was created.
SekoiaXDR.Asset.keys.value	unknown	The value of the keys of the asset.
SekoiaXDR.Asset.keys.name	unknown	The name of the keys of the asset.
SekoiaXDR.Asset.keys.uuid	unknown	The UUID of the keys of the asset.
SekoiaXDR.Asset.attributes.value	unknown	The value of the attributes of the asset.
SekoiaXDR.Asset.attributes.name	unknown	The name of the attributes of the asset.
SekoiaXDR.Asset.attributes.uuid	unknown	The UUID of the attributes of the asset.
SekoiaXDR.Asset.updated_at	unknown	The time at which the asset was updated.
SekoiaXDR.Asset.asset_type.description	unknown	The description of the asset type.
SekoiaXDR.Asset.asset_type.name	unknown	The name of the asset type.
SekoiaXDR.Asset.asset_type.uuid	unknown	The UUID of the asset type.
SekoiaXDR.Asset.criticity.value	unknown	The criticality value of the asset.
SekoiaXDR.Asset.criticity.display	unknown	The display value of the criticality of the asset.
SekoiaXDR.Asset.description	unknown	The description of the asset.
SekoiaXDR.Asset.community_uuid	unknown	The UUID of the community of the asset.
SekoiaXDR.Asset.name	unknown	The name of the asset.
SekoiaXDR.Asset.uuid	unknown	The UUID of the asset.

get-remote-data

This command gets new information about the incidents in the remote system and updates existing incidents in Cortex XSOAR.

Base Command

get-remote-data

Input

Argument Name	Description	Required
id	The remote alert ID.	Optional
lastUpdate	ISO format date with timezone, e.g., 2023-03-01T16:41:30.589575+02:00. The incident is only updated if it was modified after the last update time. Default is 0.	Optional

Context Output

There is no context output for this command.

get-modified-remote-data

available from Cortex XSOAR version 6.1.0. This command queries for incidents that were modified since the last update.

Base Command

get-modified-remote-data

Input

Argument Name	Description	Required
lastUpdate	ISO format date with timezone, e.g., 2023-03-01T16:41:30.589575+02:00. The incident is only returned if it was modified after the last update time. Default is 0.	Optional

Context Output

There is no context output for this command.

get-mapping-fields

This command pulls the remote schema for the different incident types, and their associated incident fields, from the remote system.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

sekoia-xdr-list-assets

Command to retrieve a list of Assets from Sekoia XDR.

Base Command

sekoia-xdr-list-assets

Input

Argument Name	Description	Required
limit	Limit a number of items. Default is 10.	Optional
assets_type	Type of assets to list (computer, network, etc).	Optional

Context Output

Path	Type	Description
SekoiaXDR.Assets.total	unknown	The total number of items in the response.
SekoiaXDR.Assets.items.0.owners.0	unknown	The ID of the owner of the asset.
SekoiaXDR.Assets.items.0.category.types.0.description	unknown	The description of the type of the asset category.
SekoiaXDR.Assets.items.0.category.types.0.name	unknown	The name of the type of the asset category.
SekoiaXDR.Assets.items.0.category.types.0.uuid	unknown	The UUID of the type of the asset category.
SekoiaXDR.Assets.items.0.category.description	unknown	The description of the asset category.
SekoiaXDR.Assets.items.0.category.name	unknown	The name of the asset category.
SekoiaXDR.Assets.items.0.category.uuid	unknown	The UUID of the asset category.
SekoiaXDR.Assets.items.0.created_at	unknown	The time at which the asset was created.
SekoiaXDR.Assets.items.0.keys.0.value	unknown	The value of the asset key.
SekoiaXDR.Assets.items.0.keys.0.name	unknown	The name of the asset key.
SekoiaXDR.Assets.items.0.keys.0.uuid	unknown	The UUID of the asset key.
SekoiaXDR.Assets.items.0.attributes.0.value	unknown	The value of the asset attribute.
SekoiaXDR.Assets.items.0.attributes.0.name	unknown	The name of the asset attribute.
SekoiaXDR.Assets.items.0.attributes.0.uuid	unknown	The UUID of the asset attribute.
SekoiaXDR.Assets.items.0.updated_at	unknown	The time at which the asset was last updated.
SekoiaXDR.Assets.items.0.asset_type.description	unknown	The description of the asset type.
SekoiaXDR.Assets.items.0.asset_type.name	unknown	The name of the asset type.
SekoiaXDR.Assets.items.0.asset_type.uuid	unknown	The UUID of the asset type.
SekoiaXDR.Assets.items.0.criticity.value	unknown	The numeric value of the asset criticality.
SekoiaXDR.Assets.items.0.criticity.display	unknown	The display value of the asset criticality.
SekoiaXDR.Assets.items.0.description	unknown	The description of the asset.
SekoiaXDR.Assets.items.0.community_uuid	unknown	The UUID of the community to which the asset belongs.
SekoiaXDR.Assets.items.0.name	unknown	The name of the asset.
SekoiaXDR.Assets.items.0.uuid	unknown	The UUID of the asset.

sekoia-xdr-get-user

Command to get information about a user in Sekoia XDR. Used also in the command !sekoia-xdr-get-comments to have the name of the persons who made the comments.

Base Command

sekoia-xdr-get-user

Input

Argument Name	Description	Required
user_uuid	UUID of the user, you get it from `sekoia-xdr-get-comments` for example. But make sure that `created_by_type` field is `user`.	Required

Context Output

Path	Type	Description
SekoiaXDR.User.creator.description	unknown	The description of the creator.
SekoiaXDR.User.creator.name	unknown	The name of the creator.
SekoiaXDR.User.creator.uuid	unknown	The UUID of the creator.
SekoiaXDR.User.updated_at	unknown	The time at which the object was last updated.
SekoiaXDR.User.created_by	unknown	The UUID of the user who created the object.
SekoiaXDR.User.total_members	unknown	The total number of members in the community.
SekoiaXDR.User.subcommunities	unknown	The UUIDs of the subcommunities.
SekoiaXDR.User.parent_community_uuid	unknown	The UUID of the parent community.
SekoiaXDR.User.applications.description	unknown	The description of the application.
SekoiaXDR.User.applications.name	unknown	The name of the application.
SekoiaXDR.User.applications.uuid	unknown	The UUID of the application.
SekoiaXDR.User.is_parent	unknown	Whether the community is a parent community.
SekoiaXDR.User.name	unknown	The name of the community.
SekoiaXDR.User.members.uuid	unknown	The UUID of the member.
SekoiaXDR.User.members.created_at	unknown	The time at which the member was created.
SekoiaXDR.User.members.user.firstname	unknown	The first name of the user associated with the member.
SekoiaXDR.User.members.user.mfa_enabled	unknown	Whether multi-factor authentication is enabled for the user associated with the member.
SekoiaXDR.User.members.user.uuid	unknown	The UUID of the user associated with the member.
SekoiaXDR.User.members.user.company_name	unknown	The company name of the user associated with the member.
SekoiaXDR.User.members.user.lastname	unknown	The last name of the user associated with the member.
SekoiaXDR.User.members.user.created_at	unknown	The time at which the user associated with the member was created.
SekoiaXDR.User.members.user.picture_mode	unknown	The picture mode of the user associated with the member.
SekoiaXDR.User.members.user.last_activity	unknown	The last activity time of the user associated with the member.
SekoiaXDR.User.members.user.updated_at	unknown	The time at which the user associated with the member was last updated.
SekoiaXDR.User.members.user.auth_provider	unknown	The authentication provider of the user associated with the member.
SekoiaXDR.User.members.user.email	unknown	The email address of the user associated with the member.
SekoiaXDR.User.members.user.invitation_v2.email	unknown	The email address for the invitation associated with the user associated with the member.
SekoiaXDR.User.members.name	unknown	The name of the member.
SekoiaXDR.User.members.updated_at	unknown	The time at which the member was last updated.
SekoiaXDR.User.members.status_changed_at	unknown	The time at which the status of the member was last changed.
SekoiaXDR.User.members.status	unknown	The status of the member.
SekoiaXDR.User.session_timeout	unknown	The session timeout for the community.
SekoiaXDR.User.is_mfa_enforced	unknown	Whether multi-factor authentication is enforced for the community.
SekoiaXDR.User.uuid	unknown	The UUID of the community.
SekoiaXDR.User.created_at	unknown	The time at which the community was created.
SekoiaXDR.User.picture_mode	unknown	The picture mode for the community.
SekoiaXDR.User.homepage_url	unknown	The homepage URL for the community.
SekoiaXDR.User.created_by_type	unknown	The type of the user who created the community.
SekoiaXDR.User.disable_inactive_avatars	unknown	Whether inactive avatars are disabled for the community.
SekoiaXDR.User.description	unknown	The description of the community.

sekoia-xdr-add-attributes-asset

Command to add attributes to an asset in Sekoia XDR.

Base Command

sekoia-xdr-add-attributes-asset

Input

Argument Name	Description	Required
asset_uuid	UUID of the asset to get, the UUID should appear with “sekoia-xdr-list-assets” if that alert have assets related, example: “d4cc3b05-a78d-4f29-b27c-c637d86fa03a”.	Required
name	The name of attributes.	Required
value	The value of attributes.	Required

Context Output

There is no context output for this command.

sekoia-xdr-add-keys-asset

Command to add keys to an asset in Sekoia XDR.

Base Command

sekoia-xdr-add-keys-asset

Input

Argument Name	Description	Required
asset_uuid	UUID of the asset to get, the UUID should appear with “sekoia-xdr-list-assets” if that alert have assets related, example: “d4cc3b05-a78d-4f29-b27c-c637d86fa03a”.	Required
name	The name of the key to be added.	Required
value	The value of the key to be added.	Required

Context Output

There is no context output for this command.

sekoia-xdr-get-kill-chain

Command to retrieve the definition of a Cyber Kill Chain Step.

Base Command

sekoia-xdr-get-kill-chain

Input

Argument Name	Description	Required
kill_chain_uuid	UUID or short_id of the kill chain the UUID should appear with “sekoia-xdr-list-alerts”.	Required

Context Output

Path	Type	Description
SekoiaXDR.KillChain.stix_name	unknown	The name of the STIX object.
SekoiaXDR.KillChain.description	unknown	The description of the STIX object.
SekoiaXDR.KillChain.name	unknown	The common name of the STIX object.
SekoiaXDR.KillChain.uuid	unknown	The unique identifier of the STIX object.
SekoiaXDR.KillChain.short_id	unknown	The short identifier of the STIX object.
SekoiaXDR.KillChain.order_id	unknown	The order identifier of the STIX object.

sekoia-xdr-remove-attribute-asset

Command to remove an attribute from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the attribute_uuid to delete.

Base Command

sekoia-xdr-remove-attribute-asset

Input

Argument Name	Description	Required
asset_uuid	UUID of the asset, the UUID should appear with “sekoia-xdr-list-assets” if that alert have assets related, example: “d4cc3b05-a78d-4f29-b27c-c637d86fa03a”.	Required
attribute_uuid	UUID of the attribute to delete. Note: use !sekoia-xdr-get-asset to find the attribute_uuid to delete.	Required

Context Output

There is no context output for this command.

sekoia-xdr-remove-key-asset

Command to remove a key from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the key_uuid to delete.

Base Command

sekoia-xdr-remove-key-asset

Input

Argument Name	Description	Required
asset_uuid	UUID of the asset, the UUID should appear with “sekoia-xdr-list-assets” if that alert have assets related, example: “d4cc3b05-a78d-4f29-b27c-c637d86fa03a”.	Required
key_uuid	UUID of the key to remove. Note: use !sekoia-xdr-get-asset to find the key_uuid to delete.	Required

Context Output

There is no context output for this command.

sekoia-xdr-http-request

Command that performs a HTTP request to Sekoia using the integration authentication configured.

Base Command

sekoia-xdr-http-request

Input

Argument Name	Description	Required
method	Method to use with the http request (GET,POST,etc). Default is GET.	Required
url_sufix	The URL suffix after https://api.sekoia.io, i.e. /v1/sic/alerts/ or /v1/asset-management/assets/.	Required
parameters	Query parameters, i.e. limit -> 10 , match[‘status_name’] -> Ongoing.	Optional
data	Body of the request	Optional

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Sekoia XDR corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

Option	Description
None	Turns off incident mirroring.
Incoming	Any changes in Sekoia XDR events (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
Outgoing	Any changes in Cortex XSOAR incidents will be reflected in Sekoia XDR events (outgoing mirrored fields).
Incoming and Outgoing	Changes made in Sekoia will be reflected in Cortex, and vice versa, ensuring status updates are synchronized between both systems.

Optional: Check the Close Mirrored XSOAR Incident integration parameter to close the Cortex XSOAR incident when the corresponding event is closed in Sekoia XDR.
Optional: Check the Reopen Mirrored Cortex XSOAR Incidents integration parameter to reopen the Cortex XSOAR incident when the matching Sekoia XDR alert is reopened.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Sekoia XDR.

Troubleshooting

To troubleshoot possible issues with the SEKOIA XDR integration, consider the following steps:

Debug Mode:
- In your integration instance, enable the Debug option.
- Navigate to Settings > About > Troubleshooting > Download logs to download the logs. Analyzing these logs can provide valuable insights into any issues.
Mirror Values:
- To diagnose mirroring issues beyond what debug mode offers, you can inspect specific fields in the context data. Check if the following dbot fields are set:
  - dbotMirrorInstance: Indicates the instance managing the mirroring.
  - dbotMirrorDirection: Shows the direction of mirroring.
  - dbotMirrorId: The unique identifier for the mirroring process.
- If these fields are not set, review the mappers to ensure that they are configured correctly.
dbotMirrorLastSync Field:
- The dbotMirrorLastSync field in the context data will update when the mirroring process updates an incident.
- You can observe these updates in the War Room as well, which will provide a log of the mirroring activity.

By following these troubleshooting steps, you can effectively diagnose and resolve issues within the SEKOIA XDR integration.

Best Practices

To make the most out of your SEKOIA XDR integration, consider the following best practices:

Mirroring Changes: When mirroring is enabled, please allow at least 1 minute for changes to be reflected. The mirroring process runs every 1 minute, ensuring that data between SEKOIA and Cortex is kept in sync.
Handling Reopened Incidents: If you have enabled the reopening option, the Cortex incident will be reopened under two specific conditions:
- Reopened Alert in SEKOIA: If an alert is reopened in SEKOIA, the corresponding incident in Cortex will also be reopened. This ensures that the incident tracking is consistent across both platforms.
- Reopened Incident in Cortex: If you reopen an incident directly in Cortex, you need to be cautious. After reopening the incident in Cortex, you should promptly change the status of the SEKOIA alert. Failing to do so might lead to the incident being automatically closed by the mirroring process.

By adhering to these best practices, you can ensure a smoother and more effective synchronization between SEKOIA and your incident management platform.

Additional documentation

The following documentation can be useful to understand the integration:

Information	Description
Mirroring	Adittional information for mirroring
Post process scripts	Adittional information for post process scripts
Sekoia XDR documentation	Sekoia XDR Documentation
Rest API Documentation	Sekoia XDR API Documentation

Configuration parameters

credentials — API key (required)
url — Server URL (i.e. https://api.sekoia.io) (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
first_fetch — First fetch timestamp (<sign + or -><number><time unit>, e.g., -7d, -1h) (required)
max_fetch — Maximum incidents to fetch per interval. (required)
incidentFetchInterval — Incidents Fetch Interval
alerts_status — Alerts status.
alerts_type — Alerts types.
alerts_urgency — Alerts urgency levels ( "MINurgency,MAXurgency". i.e: 80,100 ).
fetch_mode — Fetch mode (required)
replace_dots_event — Replace "dots" in event field names with another character. (required)
exclude_info_events — Events fields to exclude from the events search result.
fetch_with_assets — Include assets information in the alerts when fetching.
fetch_with_kill_chain — Include kill chain information in the alerts when fetching.
mirror_direction — Incident Mirroring Direction.
mirror_events — Include events in the mirroring of the alerts.
mirror_kill_chain — Include kill chain information in the mirroring of the alerts.
reopen_incident — Reopen Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
close_incident — Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
close_notes — Close notes. (required)
timezone — Timezone ( TZ format ) (required)

Commands (23)

get-mapping-fields
This command pulls the remote schema for the different incident types, and their associated incident fields, from the remote system.
get-modified-remote-data
available from Cortex XSOAR version 6.1.0. This command queries for incidents that were modified since the last update.
get-remote-data
This command gets new information about the incidents in the remote system and updates existing incidents in Cortex XSOAR.
sekoia-xdr-add-attributes-asset
Command to add attributes to an asset in Sekoia XDR.
sekoia-xdr-add-keys-asset
Command to add keys to an asset in Sekoia XDR.
sekoia-xdr-events-execute-query
Command to create an event search job on Sekoia XDR, after this execute "sekoia-xdr-status-events-query" to see the status of the query job and "sekoia-xdr-results-events-query" to retrieve the results..
sekoia-xdr-events-results-query
Command to retrieve the events from the search job "sekoia-xdr-execute-events-query" previously done on Sekoia XDR.
sekoia-xdr-events-status-query
Command to query the status of the search job on Sekoia XDR.
sekoia-xdr-get-alert
Command to retrieve a specific alert by uuid or short_id from Sekoia XDR.
sekoia-xdr-get-asset
Get an asset by its UUID from Sekoia XDR.
sekoia-xdr-get-cases-alert
Command to retrieve the cases related to an Alert from Sekoia XDR. If a case_id is given, returns the information about it, and if not it will give all cases in this alert.
sekoia-xdr-get-comments
Command to get all the comments from an alert in Sekoia XDR.
sekoia-xdr-get-kill-chain
Command to retrieve the definition of a Cyber Kill Chain Step.
sekoia-xdr-get-user
Command to get information about a user in Sekoia XDR. Used also in the command !sekoia-xdr-get-comments to have the name of the persons who made the comments.
sekoia-xdr-get-workflow-alert
Command to get the possible transitions of status on the alert.
sekoia-xdr-http-request
Command that performs a HTTP request to Sekoia using the integration authentication configured.
sekoia-xdr-list-alerts
Command to retrieve a list of Alerts from Sekoia XDR.
sekoia-xdr-list-assets
Command to retrieve a list of Assets from Sekoia XDR.
sekoia-xdr-post-comment-alert
Command to post comments to alerts in Sekoia XDR.
sekoia-xdr-remove-attribute-asset
Command to remove an attribute from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the attribute_uuid to delete.
sekoia-xdr-remove-key-asset
Command to remove a key from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the key_uuid to delete.
sekoia-xdr-search-events
Command to search and retrieve the events from an alert. This is a combination of 3 commands: sekoia-xdr-events-execute-query, sekoia-xdr-events-status-query and sekoia-xdr-events-results-query.
sekoia-xdr-update-status-alert
Command to update the status of a specific Alert by uuid or short_id.

Source

SekoiaXDR.py SekoiaXDR_test.py SekoiaXDR.yml SekoiaXDR_description.md command_examples.txt

Download History Raw

commonfields:
  id: Sekoia XDR
  version: -1
name: Sekoia XDR
display: Sekoia XDR
category: Analytics & SIEM
provider: Sekoia
sectionorder:
- Connect
- Collect
description: Fetch alerts and events from SEKOIA.IO XDR.\nTo use this integration, please create an API Key with the appropriate permissions.
configuration:
- section: Connect
  display: API key
  displaypassword: API Key
  name: credentials
  type: 9
  required: true
  hiddenusername: true
- section: Connect
  display: Server URL (i.e. https://api.sekoia.io)
  name: url
  defaultvalue: https://api.sekoia.io
  type: 0
  required: true
- section: Connect
  advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- section: Connect
  advanced: true
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- section: Collect
  display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- section: Collect
  display: Incident type
  name: incidentType
  type: 13
  required: false
- section: Collect
  display: First fetch timestamp (<sign + or -><number><time unit>, e.g., -7d, -1h)
  name: first_fetch
  defaultvalue: -7d
  type: 0
  required: true
- section: Collect
  display: Maximum incidents to fetch per interval.
  name: max_fetch
  defaultvalue: "10"
  type: 0
  required: true
  additionalinfo: By default the max_fetch is set to 10
- section: Collect
  advanced: true
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
- section: Collect
  advanced: true
  display: Alerts status.
  name: alerts_status
  defaultvalue: Pending,Acknowledged,Ongoing
  type: 16
  required: false
  options:
  - Pending
  - Acknowledged
  - Ongoing
  - Rejected
  - Closed
  additionalinfo: Filter alerts to fetch by status. You can write and press enter to insert new types.
- section: Collect
  advanced: true
  display: Alerts types.
  name: alerts_type
  type: 16
  required: false
  options:
  - spam
  - ddos
  - outage
  - phishing
  - unauthorized-use-of-resources
  - unauthorised-information-access
  - appsacan
  - scanner
  - brute-force
  - exploit
  - sniffing
  - ransomware
  - malware
  - trojan
  - rootkit
  - worm
  - virus
  - privileged-account-compromise
  - unprivileged-account-compromise
  - application-compromise
  - bot
  - defacement
  - system-compromise
  - backdoor
  - privilege-escalation
  - lateral-move
  - reconnaissance
  - c&c
  - payload
  - tunnel
  - exfiltration
  - blacklist
  additionalinfo: Filter alerts to fetch by types. You can write and press enter to insert new types.
- section: Collect
  advanced: true
  display: 'Alerts urgency levels  ( "MINurgency,MAXurgency".  i.e: 80,100 ).'
  name: alerts_urgency
  type: 0
  required: false
  additionalinfo: Filter alerts by their urgency levels. Use the format "MINurgency, MAXurgency"
- section: Collect
  display: Fetch mode
  name: fetch_mode
  defaultvalue: Fetch Without Events
  type: 15
  required: true
  options:
  - Fetch Without Events
  - Fetch With All Events
  additionalinfo: If there's no max_fetch it will fetch 10 incidents by default.
- section: Collect
  display: Replace "dots" in event field names with another character.
  name: replace_dots_event
  defaultvalue: _
  type: 15
  required: true
  options:
  - _
  - '-'
  additionalinfo: Replacing dots in events will make names look pretty good for users
- section: Collect
  advanced: true
  display: Events fields to exclude from the events search result.
  name: exclude_info_events
  type: 16
  required: false
  options:
  - original.message
  - message
  - __event_id
  - agent.name
  - alert_short_ids
  - client.address
  - client.ip
  - client.user.id
  - customer.community_name
  - customer.community_uuid
  - customer.id
  - customer.intake_key
  - customer.intake_name
  - customer.intake_uuid
  - ecs.version
  - entity.id
  - entity.name
  - entity.uuid
  - event.created
  - event.dialect
  - event.dialect_uuid
  - event.id
  - event.outcome
  - http.request.method
  - sekoiaio.customer.community_name
  additionalinfo: These are the names of the headers presented in the events table. If the header is not in the dropdown list write it and press enter.
- section: Collect
  advanced: true
  display: Include assets information in the alerts when fetching.
  name: fetch_with_assets
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: |-
    When selected, it includes the assets information in the alert when fetched from Sekoia.
    And also If there's no max_fetch it will fetch 10 incidents by default.
- section: Collect
  advanced: true
  display: Include kill chain information in the alerts when fetching.
  name: fetch_with_kill_chain
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: |-
    When selected, it includes the kill chain information in the alert when fetched from Sekoia.
    And also If there's no max_fetch it will fetch 10 incidents by default.
- section: Collect
  display: Incident Mirroring Direction.
  name: mirror_direction
  defaultvalue: None
  type: 15
  required: false
  additionalinfo: 'Choose the direction to mirror the incident: None(Disable mirroring), Incoming (from Sekoia XDR  to Cortex XSOAR) , Outgoing (from Cortex XSOAR to Sekoia XDR), or Incoming and Outgoing (from/to Cortex XSOAR and Sekoia XDR). Cortex XSOAR only parameter.'
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming and Outgoing
  hidden:
  - marketplacev2
  - platform
- section: Collect
  advanced: true
  display: Include events in the mirroring of the alerts.
  name: mirror_events
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: When selected, it includes the events in the mirrored alerts when an alert is updated in Sekoia.
- section: Collect
  advanced: true
  display: Include kill chain information in the mirroring of the alerts.
  name: mirror_kill_chain
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: When selected, it includes the kill chain information of the alert in the mirrored alerts when an alert is updated in Sekoia.
- section: Collect
  advanced: true
  display: Reopen Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
  name: reopen_incident
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: When selected, reopening the Sekoia XDR alert will reopen the Cortex XSOAR incident.
- section: Collect
  advanced: true
  display: Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
  name: close_incident
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: When selected, closing the Sekoia XDR alert with a "Closed" or "Reject" status will close the Cortex XSOAR incident. Cortex XSOAR only parameter.
  hidden:
  - marketplacev2
  - platform
- section: Collect
  display: Close notes.
  name: close_notes
  defaultvalue: Closed by Sekoia.
  type: 0
  required: true
  additionalinfo: Change the closing notes that will be added to the tickets closed automatically by the automation.
- section: Collect
  display: Timezone ( TZ format )
  name: timezone
  defaultvalue: Europe/Paris
  type: 0
  required: true
  additionalinfo: This will be used to present dates in the appropiate timezones,  used for comment timestamps, etc.
script:
  script: "-"
  type: python
  commands:
  - name: sekoia-xdr-list-alerts
    arguments:
    - name: limit
      description: The number of alerts to return. The allowed range is 1-100, default is 20.
      defaultValue: "20"
    - name: status
      auto: PREDEFINED
      predefined:
      - Pending
      - Acknowledged
      - Ongoing
      - Rejected
      - Closed
      description: Match alerts by their status name (separated by commas).
      isArray: true
    - name: created_at
      description: 'Filter alerts by their creation dates, starting date followed by ending date, i.e:  "-3d,now" , "-1w,now" or "2023-01-15,2023-01-17".'
    - name: updated_at
      description: 'Filter alerts by their update dates starting date followed by ending date, i.e:  "-3d,now" , "-1w,now" or "2023-01-15,2023-01-17".'
    - name: urgency
      description: 'Filter alerts by their urgencies range in the following format: "MINurgency,MAXurgency". i.e: 80,100.'
    - name: Alerts type
      auto: PREDEFINED
      predefined:
      - spam
      - ddos
      - outage
      - phishing
      - unauthorized-use-of-resources
      - unauthorised-information-access
      - appscan
      - scanner
      - brute-force
      - exploit
      description: Match alerts by their categories (separated by commas).
      isArray: true
    - name: sort_by
      default: true
      auto: PREDEFINED
      predefined:
      - created_at
      - updated_at
      - target
      - urgency
      - status
      description: Sort the alerts by any information.
      defaultValue: created_at
    outputs:
    - contextPath: SekoiaXDR.ListAlerts.updated_at
      description: The time at which the alert was updated.
    - contextPath: SekoiaXDR.ListAlerts.updated_by
      description: The user who last updated the alert.
    - contextPath: SekoiaXDR.ListAlerts.uuid
      description: The unique identifier of the alert.
    - contextPath: SekoiaXDR.ListAlerts.title
      description: The title of the alert.
    - contextPath: SekoiaXDR.ListAlerts.time_to_respond
      description: The time it took to respond to the alert.
    - contextPath: SekoiaXDR.ListAlerts.short_id
      description: The short identifier of the alert.
    - contextPath: SekoiaXDR.ListAlerts.community_uuid
      description: The unique identifier of the community associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.kill_chain_short_id
      description: The short identifier of the kill chain associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.number_of_unseen_comments
      description: The number of unseen comments on the alert.
    - contextPath: SekoiaXDR.ListAlerts.updated_by_type
      description: The type of user who last updated the alert.
    - contextPath: SekoiaXDR.ListAlerts.source
      description: The source of the alert.
    - contextPath: SekoiaXDR.ListAlerts.alert_type.value
      description: The type of the alert.
    - contextPath: SekoiaXDR.ListAlerts.alert_type.category
      description: The category type of the alert.
    - contextPath: SekoiaXDR.ListAlerts.time_to_acknowledge
      description: The time it took to acknowledge the alert.
    - contextPath: SekoiaXDR.ListAlerts.stix
      description: The STIX data associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.first_seen_at
      description: The time the alert was first seen.
    - contextPath: SekoiaXDR.ListAlerts.ttps.type
      description: The type of the TTP associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.ttps.name
      description: The name of the TTP associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.ttps.id
      description: The unique identifier of the TTP associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.ttps.description
      description: The description of the TTP associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.adversaries.type
      description: The type of the adversary associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.adversaries.name
      description: The name of the adversary associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.adversaries.id
      description: The unique identifier of the adversary associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.adversaries.description
      description: The description of the adversary associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.time_to_ingest
      description: The time it took to ingest the alert.
    - contextPath: SekoiaXDR.ListAlerts.target
      description: The target of the alert.
    - contextPath: SekoiaXDR.ListAlerts.time_to_resolve
      description: The time it took to resolve the alert.
    - contextPath: SekoiaXDR.ListAlerts.created_at
      description: The time at which the alert was created.
    - contextPath: SekoiaXDR.ListAlerts.last_seen_at
      description: The time at which the alert was last seen.
    - contextPath: SekoiaXDR.ListAlerts.assets
      description: The assets associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.rule.severity
      description: The severity level of the rule that triggered the alert.
    - contextPath: SekoiaXDR.ListAlerts.rule.type
      description: The type of rule that triggered the alert.
    - contextPath: SekoiaXDR.ListAlerts.rule.uuid
      description: The unique identifier of the rule that triggered the alert.
    - contextPath: SekoiaXDR.ListAlerts.rule.name
      description: The name of the rule that triggered the alert.
    - contextPath: SekoiaXDR.ListAlerts.rule.description
      description: The description of the rule that triggered the alert.
    - contextPath: SekoiaXDR.ListAlerts.rule.pattern
      description: The pattern of the rule that triggered the alert.
    - contextPath: SekoiaXDR.ListAlerts.similar
      description: The number of similar alerts to this one.
    - contextPath: SekoiaXDR.ListAlerts.status.name
      description: The name of the status of the alert.
    - contextPath: SekoiaXDR.ListAlerts.status.description
      description: The description of the status of the alert.
    - contextPath: SekoiaXDR.ListAlerts.status.uuid
      description: The unique identifier of the status of the alert.
    - contextPath: SekoiaXDR.ListAlerts.urgency.criticity
      description: The level of criticity of the urgency of the alert.
    - contextPath: SekoiaXDR.ListAlerts.urgency.current_value
      description: The current value of the urgency of the alert.
    - contextPath: SekoiaXDR.ListAlerts.urgency.severity
      description: The severity level of the urgency of the alert.
    - contextPath: SekoiaXDR.ListAlerts.urgency.display
      description: The display of the urgency of the alert.
    - contextPath: SekoiaXDR.ListAlerts.urgency.value
      description: The value of the urgency of the alert.
    - contextPath: SekoiaXDR.ListAlerts.created_by
      description: The user who created the alert.
    - contextPath: SekoiaXDR.ListAlerts.number_of_total_comments
      description: The total number of comments on the alert.
    - contextPath: SekoiaXDR.ListAlerts.time_to_detect
      description: The time it took to detect the alert.
    - contextPath: SekoiaXDR.ListAlerts.entity.name
      description: The name of the entity associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.entity.uuid
      description: The unique identifier of the entity associated with the alert.
    - contextPath: SekoiaXDR.ListAlerts.created_by_type
      description: The type of user who created the alert.
    - contextPath: SekoiaXDR.ListAlerts.details
      description: The details of the alert.
    description: Command to retrieve a list of Alerts from Sekoia XDR.
  - name: sekoia-xdr-get-alert
    arguments:
    - name: id
      required: true
      description: 'The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts or from sekoia plateform. i.e: "f5dcb81c-8d81-4332-9f1e-f119a1b31217" or "ALUnyZCYZ9Ga".'
    outputs:
    - contextPath: SekoiaXDR.Alert.short_id
      description: Short ID of the alert.
      type: string
    - contextPath: SekoiaXDR.Alert.title
      description: Title of the alert.
      type: string
    - contextPath: SekoiaXDR.Alert.urgency
      description: urgency of the alert.
      type: string
    description: Command to retrieve a specific alert by uuid or short_id from Sekoia XDR.
  - name: sekoia-xdr-events-execute-query
    arguments:
    - name: earliest_time
      required: true
      description: Valid formats <sign + or -><number><time unit> or ISO 8601 e.g -3d, -2w, -7d, 2023-01-15T00:00:00Z.
    - name: lastest_time
      required: true
      description: Valid formats <sign + or -><number><time unit> or ISO 8601 e.g +3d, +2w, now, 2023-01-15T00:00:00Z.
    - name: query
      defaultValue: ""
      description: 'The query to use, i.e: "alert_short_ids:ALUnyZCYZ9Ga".'
    - name: max_last_events
      description: Maximum number of listed events.
    outputs:
    - contextPath: SekoiaXDR.Events.Query.uuid
      description: The unique identifier for the event.
    - contextPath: SekoiaXDR.Events.Query.term
      description: The search term associated with the event.
    - contextPath: SekoiaXDR.Events.Query.started_at
      description: The time at which the event started.
    - contextPath: SekoiaXDR.Events.Query.short_histogram.cases
      description: The number of cases associated with the event.
    - contextPath: SekoiaXDR.Events.Query.short_histogram.total
      description: The total number of events associated with the search term.
    - contextPath: SekoiaXDR.Events.Query.short_histogram.alerts
      description: The number of alerts associated with the event.
    - contextPath: SekoiaXDR.Events.Query.short_histogram.earliest_time
      description: The earliest time associated with the event.
    - contextPath: SekoiaXDR.Events.Query.short_histogram.length
      description: The length of the histogram for the event.
    - contextPath: SekoiaXDR.Events.Query.created_by
      description: The user who created the event.
    - contextPath: SekoiaXDR.Events.Query.expired
      description: A boolean indicating whether the event has expired.
    - contextPath: SekoiaXDR.Events.Query.latest_time
      description: The latest time associated with the event.
    - contextPath: SekoiaXDR.Events.Query.expiration_date
      description: The date on which the event will expire.
    - contextPath: SekoiaXDR.Events.Query.created_at
      description: The time at which the event was created.
    - contextPath: SekoiaXDR.Events.Query.status
      description: The status of the event.
    - contextPath: SekoiaXDR.Events.Query.view_uuid
      description: The unique identifier for the view associated with the event.
    - contextPath: SekoiaXDR.Events.Query.canceled_at
      description: The time at which the event was canceled.
    - contextPath: SekoiaXDR.Events.Query.only_eternal
      description: A boolean indicating whether the event is only eternal.
    - contextPath: SekoiaXDR.Events.Query.results_ttl
      description: The time-to-live for the event results.
    - contextPath: SekoiaXDR.Events.Query.canceled_by
      description: The user who canceled the event.
    - contextPath: SekoiaXDR.Events.Query.term_lang
      description: The language of the search term associated with the event.
    - contextPath: SekoiaXDR.Events.Query.ended_at
      description: The time at which the event ended.
    - contextPath: SekoiaXDR.Events.Query.earliest_time
      description: The earliest time associated with the event.
    - contextPath: SekoiaXDR.Events.Query.max_last_events
      description: The maximum number of events to include in the results.
    - contextPath: SekoiaXDR.Events.Query.canceled_by_type
      description: The type of the user who canceled the event.
    - contextPath: SekoiaXDR.Events.Query.total
      description: The total number of events associated with the event.
    - contextPath: SekoiaXDR.Events.Query.created_by_type
      description: The type of the user who created the event.
    - contextPath: SekoiaXDR.Events.Query.community_uuids
      description: The list of community UUIDs associated with the event.
    - contextPath: SekoiaXDR.Events.Query.filters.field
      description: The field associated with the filter.
    - contextPath: SekoiaXDR.Events.Query.filters.value
      description: The value associated with the filter.
    - contextPath: SekoiaXDR.Events.Query.filters.operator
      description: The operator used in the filter.
    - contextPath: SekoiaXDR.Events.Query.filters.excluded
      description: Indicates whether the filter is excluded or not.
    - contextPath: SekoiaXDR.Events.Query.filters.disabled
      description: Indicates whether the filter is disabled or not.
    description: Command to create an event search job on Sekoia XDR, after this execute "sekoia-xdr-status-events-query" to see the status of the query job and "sekoia-xdr-results-events-query" to retrieve the results..
  - name: sekoia-xdr-events-status-query
    arguments:
    - name: uuid
      required: true
      description: UUID of the query executed previously with the "sekoia-xdr-query-events" command.
    outputs:
    - contextPath: SekoiaXDR.Events.Status.uuid
      description: The unique identifier for the event.
    - contextPath: SekoiaXDR.Events.Status.term
      description: The term associated with the event.
    - contextPath: SekoiaXDR.Events.Status.started_at
      description: The time at which the event started.
    - contextPath: SekoiaXDR.Events.Status.short_histogram.cases
      description: The number of cases associated with the event.
    - contextPath: SekoiaXDR.Events.Status.short_histogram.total
      description: The total number of events associated with the event.
    - contextPath: SekoiaXDR.Events.Status.short_histogram.alerts
      description: The number of alerts associated with the event.
    - contextPath: SekoiaXDR.Events.Status.short_histogram.earliest_time
      description: The earliest time associated with the event.
    - contextPath: SekoiaXDR.Events.Status.short_histogram.length
      description: The length associated with the event.
    - contextPath: SekoiaXDR.Events.Status.created_by
      description: The user who created the event.
    - contextPath: SekoiaXDR.Events.Status.expired
      description: Whether the event is expired.
    - contextPath: SekoiaXDR.Events.Status.latest_time
      description: The latest time associated with the event.
    - contextPath: SekoiaXDR.Events.Status.expiration_date
      description: The date when the event expires.
    - contextPath: SekoiaXDR.Events.Status.created_at
      description: The time when the event was created.
    - contextPath: SekoiaXDR.Events.Status.status
      description: The current status of the event.
    - contextPath: SekoiaXDR.Events.Status.view_uuid
      description: The view associated with the event.
    - contextPath: SekoiaXDR.Events.Status.canceled_at
      description: The time when the event was canceled.
    - contextPath: SekoiaXDR.Events.Status.only_eternal
      description: Whether only eternal events are associated with the event.
    - contextPath: SekoiaXDR.Events.Status.results_ttl
      description: The time-to-live for the event results.
    - contextPath: SekoiaXDR.Events.Status.canceled_by
      description: The user who canceled the event.
    - contextPath: SekoiaXDR.Events.Status.term_lang
      description: The language associated with the term for the event.
    - contextPath: SekoiaXDR.Events.Status.ended_at
      description: The time when the event ended.
    - contextPath: SekoiaXDR.Events.Status.earliest_time
      description: The earliest time associated with the event.
    - contextPath: SekoiaXDR.Events.Status.max_last_events
      description: The maximum number of events to retrieve.
    - contextPath: SekoiaXDR.Events.Status.canceled_by_type
      description: The type of user who canceled the event.
    - contextPath: SekoiaXDR.Events.Status.total
      description: The total number of events associated with the event.
    - contextPath: SekoiaXDR.Events.Status.created_by_type
      description: The type of user who created the event.
    - contextPath: SekoiaXDR.Events.Status.community_uuids[0]
      description: The community associated with the event.
    - contextPath: SekoiaXDR.Events.Status.filters.field
      description: The field used for filtering events.
    - contextPath: SekoiaXDR.Events.Status.filters.field
      description: The field used in the filter.
    - contextPath: SekoiaXDR.Events.Status.filters.value
      description: The value of the filter.
    - contextPath: SekoiaXDR.Events.Status.filters.operator
      description: The operator used in the filter.
    - contextPath: SekoiaXDR.Events.Status.filters.excluded
      description: A boolean indicating whether the filter is excluded or not.
    - contextPath: SekoiaXDR.Events.Status.filters.disabled
      description: A boolean indicating whether the filter is disabled or not.
    description: Command to query the status of the search job on Sekoia XDR.
  - name: sekoia-xdr-events-results-query
    arguments:
    - name: uuid
      required: true
      description: UUID from response of the query executed previously with the "sekoia-xdr-query-events" command.
    outputs:
    - contextPath: SekoiaXDR.Events.Results
      description: The outputs are different for each event, they will be output inside SekoiaXDR.Events.Results.
    description: Command to retrieve the events from the search job "sekoia-xdr-execute-events-query" previously done on Sekoia XDR.
  - name: sekoia-xdr-search-events
    polling: true
    arguments:
    - name: earliest_time
      required: true
      description: Valid formats <sign + or -><number><time unit> or ISO 8601 e.g -3d, -2w, -7d, 2023-01-15T00:00:00Z.
    - name: lastest_time
      required: true
      description: Valid formats <sign + or -><number><time unit> or ISO 8601 e.g +3d, +2w, now, 2023-01-15T00:00:00Z.
    - name: query
      description: 'The query to use, i.e: "alert_short_ids:ALUnyZCYZ9Ga".'
      defaultValue: ""
    - name: max_last_events
      description: Maximum number of listed events.
    - name: exclude_info
      auto: PREDEFINED
      predefined:
      - original.message
      - message
      - __event_id
      - agent.name
      - alert_short_ids
      - client.address
      - client.ip
      - client.user.id
      - customer.community_name
      - customer.community_uuid
      - customer.id
      - customer.intake_key
      - customer.intake_name
      - customer.intake_uuid
      - ecs.version
      - entity.id
      - entity.name
      - entity.uuid
      - event.created
      - event.dialect
      - event.dialect_uuid
      - event.id
      - event.outcome
      - http.request.method
      - http.request.referrer
      - related.ip
      - sekoiaio.activity.client.id
      - sekoiaio.activity.client.type
      - sekoiaio.customer.community_name
      - sekoiaio.customer.community_uuid
      - sekoiaio.customer.id
      - sekoiaio.entity.id
      - sekoiaio.entity.name
      - sekoiaio.entity.uuid
      - sekoiaio.intake.dialect
      - sekoiaio.intake.dialect_uuid
      - sekoiaio.intake.key
      - sekoiaio.intake.name
      - sekoiaio.intake.parsing_status
      - sekoiaio.intake.uuid
      - timestamp
      - url.domain
      - url.original
      - url.path
      - url.port
      - url.query
      - url.registered_domain
      - url.scheme
      - url.subdomain
      - url.top_level_domain
      - user_agent.original
      description: "Indicate if there is any information you want to exclude from the results of the events.  i.e:  original.message, message,  agent.name, etc. These are the names of the headers presented in the table. If the header you want to exclude is not in the list write it and press enter."
      isArray: true
    - name: job_uuid
      description: The job UUID to retrieve query results.
      hidden: true
    outputs:
    - contextPath: SekoiaXDR.Events.Results
      description: The outputs are different for each event, they will be output inside SekoiaXDR.Events.Results.
    description: "Command to search and retrieve the events from an alert. This is a combination of 3 commands: sekoia-xdr-events-execute-query, sekoia-xdr-events-status-query and sekoia-xdr-events-results-query."
  - name: sekoia-xdr-update-status-alert
    arguments:
    - name: id
      required: true
      description: 'The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts or from sekoia plateform. i.e: "f5dcb81c-8d81-4332-9f1e-f119a1b31217" or "ALUnyZCYZ9Ga".'
    - name: status
      auto: PREDEFINED
      predefined:
      - Acknowledged
      - Rejected
      - Ongoing
      - Closed
      description: The status you want to apply. (Acknowledged, Rejected, Ongoing, Closed)).
      required: true
    - name: comment
      description: Comment to describe why the alert status has changed.
    description: Command to update the status of a specific Alert by uuid or short_id.
  - name: sekoia-xdr-post-comment-alert
    arguments:
    - name: id
      required: true
      description: 'The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts command. i.e: "f5dcb81c-8d81-4332-9f1e-f119a1b31217" or "ALUnyZCYZ9Ga".'
    - name: comment
      required: true
      description: Content of the comment to be posted on the alert.
    - name: author
      description: Author of the comment.
    description: Command to post comments to alerts in Sekoia XDR.
  - name: sekoia-xdr-get-comments
    arguments:
    - name: id
      required: true
      description: 'The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts command or from sekoia plateform. i.e: "f5dcb81c-8d81-4332-9f1e-f119a1b31217" or "ALUnyZCYZ9Ga".'
    outputs:
    - contextPath: SekoiaXDR.Comments.total
      description: The total number of items in the comments.
    - contextPath: SekoiaXDR.Comments.items.date
      description: The date at which the comment was created.
    - contextPath: SekoiaXDR.Comments.items.created_by
      description: The user who created the comment.
    - contextPath: SekoiaXDR.Comments.items.uuid
      description: The unique identifier for the comment.
    - contextPath: SekoiaXDR.Comments.items.content
      description: The content of the comment.
    - contextPath: SekoiaXDR.Comments.items.created_by_type
      description: The type of the user who created the comment.
    - contextPath: SekoiaXDR.Comments.items.unseen
      description: Indicates whether the comment has been seen by the user.
    - contextPath: SekoiaXDR.Comments.items.author
      description: The author of the comment.
    description: Command to get all the comments from an alert in Sekoia XDR.
  - name: sekoia-xdr-get-workflow-alert
    arguments:
    - name: id
      required: true
      description: 'The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts command or from sekoia plateform. i.e: "f5dcb81c-8d81-4332-9f1e-f119a1b31217" or "ALUnyZCYZ9Ga".'
    outputs:
    - contextPath: SekoiaXDR.StatusTransitions.actions.name
      description: The name of the action.
    - contextPath: SekoiaXDR.StatusTransitions.actions.description
      description: The description of the action.
    - contextPath: SekoiaXDR.StatusTransitions.actions.id
      description: The ID of the action.
    description: Command to get the possible transitions of status on the alert.
  - name: sekoia-xdr-get-cases-alert
    arguments:
    - name: alert_id
      description: 'The uuid or short_id of the alert to retrieve from sekoia-xdr-list-alerts command or from sekoia plateform. i.e: "f5dcb81c-8d81-4332-9f1e-f119a1b31217" or "ALUnyZCYZ9Ga".'
      required: true
    - name: case_id
      description: 'The short_id of the case to retrieve from sekoia plateform or from this command without case_is param i.e: "CAQNurTJM8q2".'
    outputs:
    - contextPath: SekoiaXDR.Cases.updated_at
      description: The time at which the case was updated.
    - contextPath: SekoiaXDR.Cases.updated_by
      description: The user who updated the case.
    - contextPath: SekoiaXDR.Cases.uuid
      description: The unique identifier of the case.
    - contextPath: SekoiaXDR.Cases.title
      description: The title of the case.
    - contextPath: SekoiaXDR.Cases.priority
      description: The priority level of the case.
    - contextPath: SekoiaXDR.Cases.short_id
      description: The short ID of the case.
    - contextPath: SekoiaXDR.Cases.community_uuid
      description: The unique identifier of the community to which the case belongs.
    - contextPath: SekoiaXDR.Cases.updated_by_type
      description: The type of user who updated the case.
    - contextPath: SekoiaXDR.Cases.first_seen_at
      description: The time at which the case was first seen.
    - contextPath: SekoiaXDR.Cases.number_of_comments
      description: The number of comments on the case.
    - contextPath: SekoiaXDR.Cases.alerts.updated_at
      description: The time at which the alert was updated.
    - contextPath: SekoiaXDR.Cases.alerts.updated_by
      description: The user who updated the alert.
    - contextPath: SekoiaXDR.Cases.alerts.uuid
      description: The unique identifier of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.title
      description: The title of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.time_to_respond
      description: The time it took to respond to the alert.
    - contextPath: SekoiaXDR.Cases.alerts.short_id
      description: The short ID of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.community_uuid
      description: The unique identifier of the community to which the alert belongs.
    - contextPath: SekoiaXDR.Cases.alerts.kill_chain_short_id
      description: The short ID of the kill chain.
    - contextPath: SekoiaXDR.Cases.alerts.number_of_unseen_comments
      description: The number of unseen comments on the alert.
    - contextPath: SekoiaXDR.Cases.alerts.updated_by_type
      description: The type of user who updated the alert.
    - contextPath: SekoiaXDR.Cases.alerts.source
      description: The source of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.alert_type.value
      description: The type of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.alert_type.category
      description: The category type of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.time_to_acknowledge
      description: The time it took to acknowledge the alert.
    - contextPath: SekoiaXDR.Cases.alerts.stix
      description: The STIX data of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.first_seen_at
      description: The time at which the alert was first seen.
    - contextPath: SekoiaXDR.Cases.alerts.ttps.type
      description: The type of TTP associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.ttps.name
      description: The name of the TTP associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.ttps.id
      description: The ID of the TTP associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.ttps.description
      description: The description of the TTP associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.adversaries.type
      description: The type of adversary associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.adversaries.name
      description: The name of the adversary associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.adversaries.id
      description: The ID of the adversary associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.adversaries.description
      description: The description of the adversary associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.time_to_ingest
      description: The time it took to ingest the alert.
    - contextPath: SekoiaXDR.Cases.alerts.target
      description: The target of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.time_to_resolve
      description: The time it took to resolve the alert.
    - contextPath: SekoiaXDR.Cases.alerts.created_at
      description: The time at which the alert was created.
    - contextPath: SekoiaXDR.Cases.alerts.last_seen_at
      description: The time at which the alert was last seen.
    - contextPath: SekoiaXDR.Cases.alerts.assets
      description: The assets associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.rule.severity
      description: The severity level of the rule associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.rule.type
      description: The type of rule associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.rule.uuid
      description: The unique identifier of the rule associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.rule.name
      description: The name of the rule associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.rule.description
      description: The description of the rule associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.rule.pattern
      description: The pattern of the rule associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.similar
      description: The number of similar alerts.
    - contextPath: SekoiaXDR.Cases.alerts.status.name
      description: The name of the status of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.status.description
      description: The description of the status of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.status.uuid
      description: The unique identifier of the status of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.urgency.criticity
      description: The level of criticality of the urgency of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.urgency.current_value
      description: The current value of the urgency of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.urgency.severity
      description: The severity level of the urgency of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.urgency.display
      description: The display value of the urgency of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.urgency.value
      description: The value of the urgency of the alert.
    - contextPath: SekoiaXDR.Cases.alerts.created_by
      description: The user who created the alert.
    - contextPath: SekoiaXDR.Cases.alerts.number_of_total_comments
      description: The total number of comments on the alert.
    - contextPath: SekoiaXDR.Cases.alerts.time_to_detect
      description: The time it took to detect the alert.
    - contextPath: SekoiaXDR.Cases.alerts.entity.name
      description: The name of the entity associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.entity.uuid
      description: The unique identifier of the entity associated with the alert.
    - contextPath: SekoiaXDR.Cases.alerts.created_by_type
      description: The type of user who created the alert.
    - contextPath: SekoiaXDR.Cases.alerts.details
      description: The details of the alert.
    - contextPath: SekoiaXDR.Cases.number_of_alerts
      description: The number of alerts in the case.
    - contextPath: SekoiaXDR.Cases.created_at
      description: The time at which the case was created.
    - contextPath: SekoiaXDR.Cases.last_seen_at
      description: The time at which the case was last seen.
    - contextPath: SekoiaXDR.Cases.status
      description: The status of the case.
    - contextPath: SekoiaXDR.Cases.description
      description: The description of the case.
    - contextPath: SekoiaXDR.Cases.status_uuid
      description: The unique identifier of the status of the case.
    - contextPath: SekoiaXDR.Cases.created_by
      description: The user who created the case.
    - contextPath: SekoiaXDR.Cases.tags
      description: The tags associated with the case.
    - contextPath: SekoiaXDR.Cases.created_by_type
      description: The type of user who created the case.
    - contextPath: SekoiaXDR.Cases.subscribers.avatar_uuid
      description: The unique identifier of the avatar of the subscriber.
    - contextPath: SekoiaXDR.Cases.subscribers.type
      description: The type of subscriber.
    description: Command to retrieve the cases related to an Alert from Sekoia XDR. If a case_id is given, returns the information about it, and if not it will give all cases in this alert.
  - name: sekoia-xdr-get-asset
    arguments:
    - name: asset_uuid
      required: true
      description: 'UUID of the asset to get, the UUID should appear with "sekoia-xdr-list-assets" if that alert have assets related, example: "d4cc3b05-a78d-4f29-b27c-c637d86fa03a".'
    outputs:
    - contextPath: SekoiaXDR.Asset.owners
      description: The owners of the asset.
    - contextPath: SekoiaXDR.Asset.category.types.description
      description: The description of the category type of the asset.
    - contextPath: SekoiaXDR.Asset.category.types.name
      description: The name of the category type of the asset.
    - contextPath: SekoiaXDR.Asset.category.types.uuid
      description: The UUID of the category type of the asset.
    - contextPath: SekoiaXDR.Asset.category.description
      description: The description of the category of the asset.
    - contextPath: SekoiaXDR.Asset.category.name
      description: The name of the category of the asset.
    - contextPath: SekoiaXDR.Asset.category.uuid
      description: The UUID of the category of the asset.
    - contextPath: SekoiaXDR.Asset.created_at
      description: The time at which the asset was created.
    - contextPath: SekoiaXDR.Asset.keys.value
      description: The value of the keys of the asset.
    - contextPath: SekoiaXDR.Asset.keys.name
      description: The name of the keys of the asset.
    - contextPath: SekoiaXDR.Asset.keys.uuid
      description: The UUID of the keys of the asset.
    - contextPath: SekoiaXDR.Asset.attributes.value
      description: The value of the attributes of the asset.
    - contextPath: SekoiaXDR.Asset.attributes.name
      description: The name of the attributes of the asset.
    - contextPath: SekoiaXDR.Asset.attributes.uuid
      description: The UUID of the attributes of the asset.
    - contextPath: SekoiaXDR.Asset.updated_at
      description: The time at which the asset was updated.
    - contextPath: SekoiaXDR.Asset.asset_type.description
      description: The description of the asset type.
    - contextPath: SekoiaXDR.Asset.asset_type.name
      description: The name of the asset type.
    - contextPath: SekoiaXDR.Asset.asset_type.uuid
      description: The UUID of the asset type.
    - contextPath: SekoiaXDR.Asset.criticity.value
      description: The criticality value of the asset.
    - contextPath: SekoiaXDR.Asset.criticity.display
      description: The display value of the criticality of the asset.
    - contextPath: SekoiaXDR.Asset.description
      description: The description of the asset.
    - contextPath: SekoiaXDR.Asset.community_uuid
      description: The UUID of the community of the asset.
    - contextPath: SekoiaXDR.Asset.name
      description: The name of the asset.
    - contextPath: SekoiaXDR.Asset.uuid
      description: The UUID of the asset.
    description: Get an asset by its UUID from Sekoia XDR.
  - name: get-remote-data
    arguments:
    - name: id
      description: The remote alert ID.
    - name: lastUpdate
      description: ISO format date with timezone, e.g., 2023-03-01T16:41:30.589575+02:00. The incident is only updated if it was modified after the last update time.
      defaultValue: "0"
    description: This command gets new information about the incidents in the remote system and updates existing incidents in Cortex XSOAR.
  - name: get-modified-remote-data
    arguments:
    - name: lastUpdate
      description: ISO format date with timezone, e.g., 2023-03-01T16:41:30.589575+02:00. The incident is only returned if it was modified after the last update time.
      defaultValue: "0"
    description: available from Cortex XSOAR version 6.1.0. This command queries for incidents that were modified since the last update.
  - name: get-mapping-fields
    arguments: []
    description: This command pulls the remote schema for the different incident types, and their associated incident fields, from the remote system.
  - name: sekoia-xdr-list-assets
    arguments:
    - name: limit
      description: 'Limit a number of items.'
      defaultValue: "10"
    - name: assets_type
      description: Type of assets to list (computer, network, etc).
    description: Command to retrieve a list of Assets from Sekoia XDR.
    outputs:
    - contextPath: SekoiaXDR.Assets.total
      description: The total number of items in the response.
    - contextPath: SekoiaXDR.Assets.items.0.owners.0
      description: The ID of the owner of the asset.
    - contextPath: SekoiaXDR.Assets.items.0.category.types.0.description
      description: The description of the type of the asset category.
    - contextPath: SekoiaXDR.Assets.items.0.category.types.0.name
      description: The name of the type of the asset category.
    - contextPath: SekoiaXDR.Assets.items.0.category.types.0.uuid
      description: The UUID of the type of the asset category.
    - contextPath: SekoiaXDR.Assets.items.0.category.description
      description: The description of the asset category.
    - contextPath: SekoiaXDR.Assets.items.0.category.name
      description: The name of the asset category.
    - contextPath: SekoiaXDR.Assets.items.0.category.uuid
      description: The UUID of the asset category.
    - contextPath: SekoiaXDR.Assets.items.0.created_at
      description: The time at which the asset was created.
    - contextPath: SekoiaXDR.Assets.items.0.keys.0.value
      description: The value of the asset key.
    - contextPath: SekoiaXDR.Assets.items.0.keys.0.name
      description: The name of the asset key.
    - contextPath: SekoiaXDR.Assets.items.0.keys.0.uuid
      description: The UUID of the asset key.
    - contextPath: SekoiaXDR.Assets.items.0.attributes.0.value
      description: The value of the asset attribute.
    - contextPath: SekoiaXDR.Assets.items.0.attributes.0.name
      description: The name of the asset attribute.
    - contextPath: SekoiaXDR.Assets.items.0.attributes.0.uuid
      description: The UUID of the asset attribute.
    - contextPath: SekoiaXDR.Assets.items.0.updated_at
      description: The time at which the asset was last updated.
    - contextPath: SekoiaXDR.Assets.items.0.asset_type.description
      description: The description of the asset type.
    - contextPath: SekoiaXDR.Assets.items.0.asset_type.name
      description: The name of the asset type.
    - contextPath: SekoiaXDR.Assets.items.0.asset_type.uuid
      description: The UUID of the asset type.
    - contextPath: SekoiaXDR.Assets.items.0.criticity.value
      description: The numeric value of the asset criticality.
    - contextPath: SekoiaXDR.Assets.items.0.criticity.display
      description: The display value of the asset criticality.
    - contextPath: SekoiaXDR.Assets.items.0.description
      description: The description of the asset.
    - contextPath: SekoiaXDR.Assets.items.0.community_uuid
      description: The UUID of the community to which the asset belongs.
    - contextPath: SekoiaXDR.Assets.items.0.name
      description: The name of the asset.
    - contextPath: SekoiaXDR.Assets.items.0.uuid
      description: The UUID of the asset.
  - name: sekoia-xdr-get-user
    arguments:
    - name: user_uuid
      required: true
      description: UUID of the user, you get it from `sekoia-xdr-get-comments` for example. But make sure that `created_by_type` field is `user`.
    outputs:
    - contextPath: SekoiaXDR.User.creator.description
      description: The description of the creator.
    - contextPath: SekoiaXDR.User.creator.name
      description: The name of the creator.
    - contextPath: SekoiaXDR.User.creator.uuid
      description: The UUID of the creator.
    - contextPath: SekoiaXDR.User.updated_at
      description: The time at which the object was last updated.
    - contextPath: SekoiaXDR.User.created_by
      description: The UUID of the user who created the object.
    - contextPath: SekoiaXDR.User.total_members
      description: The total number of members in the community.
    - contextPath: SekoiaXDR.User.subcommunities
      description: The UUIDs of the subcommunities.
    - contextPath: SekoiaXDR.User.parent_community_uuid
      description: The UUID of the parent community.
    - contextPath: SekoiaXDR.User.applications.description
      description: The description of the application.
    - contextPath: SekoiaXDR.User.applications.name
      description: The name of the application.
    - contextPath: SekoiaXDR.User.applications.uuid
      description: The UUID of the application.
    - contextPath: SekoiaXDR.User.is_parent
      description: Whether the community is a parent community.
    - contextPath: SekoiaXDR.User.name
      description: The name of the community.
    - contextPath: SekoiaXDR.User.members.uuid
      description: The UUID of the member.
    - contextPath: SekoiaXDR.User.members.created_at
      description: The time at which the member was created.
    - contextPath: SekoiaXDR.User.members.user.firstname
      description: The first name of the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.mfa_enabled
      description: Whether multi-factor authentication is enabled for the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.uuid
      description: The UUID of the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.company_name
      description: The company name of the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.lastname
      description: The last name of the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.created_at
      description: The time at which the user associated with the member was created.
    - contextPath: SekoiaXDR.User.members.user.picture_mode
      description: The picture mode of the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.last_activity
      description: The last activity time of the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.updated_at
      description: The time at which the user associated with the member was last updated.
    - contextPath: SekoiaXDR.User.members.user.auth_provider
      description: The authentication provider of the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.email
      description: The email address of the user associated with the member.
    - contextPath: SekoiaXDR.User.members.user.invitation_v2.email
      description: The email address for the invitation associated with the user associated with the member.
    - contextPath: SekoiaXDR.User.members.name
      description: The name of the member.
    - contextPath: SekoiaXDR.User.members.updated_at
      description: The time at which the member was last updated.
    - contextPath: SekoiaXDR.User.members.status_changed_at
      description: The time at which the status of the member was last changed.
    - contextPath: SekoiaXDR.User.members.status
      description: The status of the member.
    - contextPath: SekoiaXDR.User.session_timeout
      description: The session timeout for the community.
    - contextPath: SekoiaXDR.User.is_mfa_enforced
      description: Whether multi-factor authentication is enforced for the community.
    - contextPath: SekoiaXDR.User.uuid
      description: The UUID of the community.
    - contextPath: SekoiaXDR.User.created_at
      description: The time at which the community was created.
    - contextPath: SekoiaXDR.User.picture_mode
      description: The picture mode for the community.
    - contextPath: SekoiaXDR.User.homepage_url
      description: The homepage URL for the community.
    - contextPath: SekoiaXDR.User.created_by_type
      description: The type of the user who created the community.
    - contextPath: SekoiaXDR.User.disable_inactive_avatars
      description: Whether inactive avatars are disabled for the community.
    - contextPath: SekoiaXDR.User.description
      description: The description of the community.
    description: Command to get information about a user in Sekoia XDR. Used also in the command !sekoia-xdr-get-comments to have the name of the persons who made the comments.
  - name: sekoia-xdr-add-attributes-asset
    arguments:
    - name: asset_uuid
      required: true
      description: 'UUID of the asset to get, the UUID should appear with "sekoia-xdr-list-assets" if that alert have assets related, example: "d4cc3b05-a78d-4f29-b27c-c637d86fa03a".'
    - name: name
      required: true
      description: "The name of attributes."
    - name: value
      required: true
      description: The value of attributes.
    description: Command to add attributes to an asset in Sekoia XDR.
  - name: sekoia-xdr-add-keys-asset
    arguments:
    - name: asset_uuid
      required: true
      description: 'UUID of the asset to get, the UUID should appear with "sekoia-xdr-list-assets" if that alert have assets related, example: "d4cc3b05-a78d-4f29-b27c-c637d86fa03a".'
    - name: name
      required: true
      description: The name of the key to be added.
    - name: value
      required: true
      description: The value of the key to be added.
    description: "Command to add keys to an asset in Sekoia XDR."
  - name: sekoia-xdr-get-kill-chain
    arguments:
    - name: kill_chain_uuid
      required: true
      description: UUID or short_id of the kill chain the UUID should appear with "sekoia-xdr-list-alerts".
    description: Command to retrieve the definition of a Cyber Kill Chain Step.
    outputs:
    - contextPath: SekoiaXDR.KillChain.stix_name
      description: The name of the STIX object.
    - contextPath: SekoiaXDR.KillChain.description
      description: The description of the STIX object.
    - contextPath: SekoiaXDR.KillChain.name
      description: The common name of the STIX object.
    - contextPath: SekoiaXDR.KillChain.uuid
      description: The unique identifier of the STIX object.
    - contextPath: SekoiaXDR.KillChain.short_id
      description: The short identifier of the STIX object.
    - contextPath: SekoiaXDR.KillChain.order_id
      description: The order identifier of the STIX object.
  - name: sekoia-xdr-remove-attribute-asset
    arguments:
    - name: asset_uuid
      required: true
      description: 'UUID of the asset, the UUID should appear with "sekoia-xdr-list-assets" if that alert have assets related, example: "d4cc3b05-a78d-4f29-b27c-c637d86fa03a".'
    - name: attribute_uuid
      required: true
      description: "UUID of the attribute to delete. Note: use !sekoia-xdr-get-asset to find the attribute_uuid to delete."
    description: "Command to remove an attribute from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the attribute_uuid to delete."
  - name: sekoia-xdr-remove-key-asset
    arguments:
    - name: asset_uuid
      required: true
      description: 'UUID of the asset, the UUID should appear with "sekoia-xdr-list-assets" if that alert have assets related, example: "d4cc3b05-a78d-4f29-b27c-c637d86fa03a".'
    - name: key_uuid
      required: true
      description: "UUID of the key to remove. Note: use !sekoia-xdr-get-asset to find the key_uuid to delete."
    description: "Command to remove a key from an asset in Sekoia XDR. Note: use !sekoia-xdr-get-asset to find the key_uuid to delete."
  - name: sekoia-xdr-http-request
    arguments:
    - name: method
      required: true
      description: Method to use with the http request (GET,POST,etc).
      defaultValue: GET
    - name: url_sufix
      required: false
      description: |
          The URL suffix after https://api.sekoia.io, i.e. /v1/sic/alerts/ or /v1/asset-management/assets/.
          DEPRECATED: Use 'url_suffix' instead. This parameter is kept for backward compatibility.
      deprecated: true
    - name: url_suffix
      required: true
      description: The URL suffix after https://api.sekoia.io, i.e. /v1/sic/alerts/ or /v1/asset-management/assets/.
    - name: parameters
      description: Query parameters, i.e. limit -> 10 , match['status_name'] -> Ongoing.
      type: keyValue
    - name: data
      description: Body of the request.
      type: string
    description: Command that performs a HTTP request to Sekoia using the integration authentication configured.
  dockerimage: demisto/python3:3.12.13.10404775
  isfetch: true
  runonce: false
  subtype: python3
  isFetchSamples: true
  ismappable: true
  isremotesyncin: true
fromversion: 6.10.0
tests:
- No tests (auto formatted)