UptycsEventCollector

Details

ID	`UptycsEventCollector`
Provider	Uptycs
Category	Analytics & SIEM
From Version	8.11.0
Docker Image	`demisto/fastapi:0.125.0.10158186`
Supported Modules	Agentix XSIAM

README

This integration is currently in Beta, allowing you to test pre-release software. Note that it may contain bugs, and future updates could include changes that are not backward compatible. We welcome your feedback to help us identify issues and improve the integration.

Overview

Uptycs is a cloud-native security analytics platform that provides unified visibility across endpoints, cloud workloads, and containers. It leverages Osquery-based telemetry and threat intelligence to detect threats, monitor compliance, and investigate security incidents across hybrid environments.

This integration collects security alerts from the Uptycs platform and ingests them into Cortex XSIAM for centralized security monitoring and case (incident) response.

Authentication

This integration uses JWT-based authentication (HS256) to connect to the Uptycs alertsReporting API. The JWT token is generated using the API Key (as the issuer) and API Secret (as the signing key) from the Uptycs API Client Management page.

Before You Start

Before configuring the integration, you must obtain API credentials from your Uptycs console:

Step 1: Generate API Credentials in Uptycs

Log in to your Uptycs console.
Navigate to Configuration > Users > API Key.
Click Create to generate a new API key.
Download the JSON file containing the API credentials. The file includes:
- key — Your API Key
- secret — Your API Secret
- customerId — Your Customer ID
- domain — Your Uptycs domain (used to construct the Server URL)

Step 2: Construct the Server URL

The Server URL follows the format: https://<domain>.uptycs.io

For example, if your domain is mycompany, the Server URL would be https://mycompany.uptycs.io.

Step 3: (Optional) Obtain Role ID and Security Zone ID

If your Uptycs environment uses role-based access control or security zones:

Navigate to Configuration > Roles to find the Role ID.
Navigate to Configuration > Security Zones to find the Security Zone ID.

These are optional and only needed if your API access requires specific role or zone scoping.

Integration Parameters

Parameter	Description	Required
Server URL	The Uptycs API base URL. Format: `https://<domain>.uptycs.io`	True
API Key	The API Key from the Uptycs API Client Management page. Used for JWT authentication.	True
API Secret	The API Secret from the Uptycs API Client Management page. Used for JWT signing.	True
Customer ID	The Uptycs Customer ID (UUID). Found in the API key JSON file or the Uptycs console URL.	True
Role ID	Optional Role ID to include in the JWT token for role-based access control.	False
Security Zone ID	Optional Security Zone ID to include in the JWT token for zone-scoped access.	False
Trust any certificate (not secure)	When selected, the integration will not verify SSL certificates.	False
Use system proxy settings	When selected, the integration will use the system proxy settings.	False
Maximum number of alerts per fetch	Maximum number of alerts to fetch per collection cycle. Default: 10000 Note: The API returns a maximum of 1000 alerts per page.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

uptycs-get-events

Gets alerts from Uptycs. This command is intended for developing and debugging and should be used with caution, as it can create duplicate events and exceed API rate limits.

Note: This command is not supported in XSOAR.

Base Command

uptycs-get-events

Input

Argument Name	Description	Required
start_time	The start time to fetch alerts from. Supports relative time (e.g., “3 days ago”, “2 hours ago”, “now”) or absolute dates (ISO 8601 format, e.g., “2024-12-01” or “2024-12-01T10:00:00Z”).	Optional
end_time	The end time to fetch alerts until. Supports relative time (e.g., “1 hour ago”, “now”) or absolute dates (ISO 8601 format, e.g., “2024-12-01” or “2024-12-01T10:00:00Z”). If not specified, fetches until now.	Optional
limit	Maximum number of alerts to retrieve. Default is 10000.	Optional
should_push_events	Set to true to push events to XSIAM (use with caution to avoid duplicates), false to only return them in the War Room. Default is false. Possible values are: true, false.	Optional

Context Output

Path	Type	Description
Uptycs.Alert.id	String	Unique identifier of the alert.
Uptycs.Alert.agentType	String	Type of agent associated with the alert (e.g., asset).
Uptycs.Alert.alertId	String	Alert identifier.
Uptycs.Alert.alertRuleId	String	Identifier of the alert rule that triggered this alert.
Uptycs.Alert.alertRuleName	String	Name of the alert rule that triggered this alert.
Uptycs.Alert.alertStatusReasonId	String	Identifier for the alert status reason.
Uptycs.Alert.alertTags	Unknown	Tags associated with the alert (e.g., MITRE ATT&CK techniques).
Uptycs.Alert.alertTime	Date	Timestamp when the alert was triggered.
Uptycs.Alert.alertTimeSuppresionDuration	String	Duration of alert time suppression.
Uptycs.Alert.alertTimeSuppresionStart	String	Start time of alert time suppression.
Uptycs.Alert.assetCityId	String	City identifier of the asset.
Uptycs.Alert.assetCores	Number	Number of CPU cores on the asset.
Uptycs.Alert.assetCpuBrand	String	CPU brand of the asset.
Uptycs.Alert.assetDescription	String	Description of the asset.
Uptycs.Alert.assetDisabled	Boolean	Whether the asset is disabled.
Uptycs.Alert.assetGateway	String	Gateway IP address of the asset.
Uptycs.Alert.assetHardwareModel	String	Hardware model of the asset.
Uptycs.Alert.assetHardwareSerial	String	Hardware serial number of the asset.
Uptycs.Alert.assetHardwareVendor	String	Hardware vendor of the asset.
Uptycs.Alert.assetHostName	String	Hostname of the asset associated with the alert.
Uptycs.Alert.assetId	String	Unique identifier of the asset.
Uptycs.Alert.assetLastActivityAt	Date	Timestamp of the asset’s last activity.
Uptycs.Alert.assetLastEnrolledAt	Date	Timestamp when the asset was last enrolled.
Uptycs.Alert.assetLatitude	Number	Latitude of the asset’s location.
Uptycs.Alert.assetLive	Boolean	Whether the asset is currently live.
Uptycs.Alert.assetLocation	String	Geographic location of the asset.
Uptycs.Alert.assetLogicalCores	Number	Number of logical CPU cores on the asset.
Uptycs.Alert.assetLongitude	Number	Longitude of the asset’s location.
Uptycs.Alert.assetManualSlackAssignment	Boolean	Whether the asset has manual Slack assignment.
Uptycs.Alert.assetMemoryMb	Number	Memory in MB of the asset.
Uptycs.Alert.assetObjectGroupId	String	Object group identifier of the asset.
Uptycs.Alert.assetOs	String	Operating system of the asset.
Uptycs.Alert.assetOsFlavor	String	OS flavor of the asset (e.g., debian).
Uptycs.Alert.assetOsKey	String	OS key identifier of the asset.
Uptycs.Alert.assetOsVersion	String	OS version of the asset.
Uptycs.Alert.assetOsqueryVersion	String	Osquery version installed on the asset.
Uptycs.Alert.assetSlackUserId	String	Slack user ID associated with the asset.
Uptycs.Alert.assetStatus	String	Status of the asset (e.g., active).
Uptycs.Alert.assignedTo	String	User the alert is assigned to.
Uptycs.Alert.attackType	String	Type of attack associated with the alert.
Uptycs.Alert.cloudRegionCode	String	Cloud region code of the resource.
Uptycs.Alert.cloudResourceId	String	Cloud resource identifier.
Uptycs.Alert.cloudTenantId	String	Cloud tenant identifier.
Uptycs.Alert.cloudType	String	Cloud provider type.
Uptycs.Alert.code	String	Alert code identifier.
Uptycs.Alert.createdAt	Date	Timestamp when the alert was created.
Uptycs.Alert.custom	Boolean	Whether this is a custom alert rule.
Uptycs.Alert.customerId	String	Customer identifier.
Uptycs.Alert.description	String	Description of the alert.
Uptycs.Alert.displayName	String	Display name of the alert.
Uptycs.Alert.eventId	String	Event identifier associated with the alert.
Uptycs.Alert.exceptionMetadata	Unknown	Exception metadata containing detailed event information.
Uptycs.Alert.groupId	String	Group identifier.
Uptycs.Alert.groupName	String	Group name.
Uptycs.Alert.grouping	String	Alert grouping category (e.g., ATTACK).
Uptycs.Alert.groupingL2	String	Second-level grouping (e.g., MITRE tactic).
Uptycs.Alert.groupingL3	String	Third-level grouping (e.g., MITRE technique).
Uptycs.Alert.groupingL4	String	Fourth-level grouping.
Uptycs.Alert.hashKey	String	Hash key of the alert.
Uptycs.Alert.isContainer	Boolean	Whether the alert is related to a container.
Uptycs.Alert.isTask	Boolean	Whether the alert is a task.
Uptycs.Alert.key	String	Key field of the alert.
Uptycs.Alert.lastActiveAt	Date	Timestamp when the alert was last active.
Uptycs.Alert.lastOccurredAt	Date	Timestamp when the alert last occurred.
Uptycs.Alert.metadata	Unknown	Alert metadata containing detailed event information.
Uptycs.Alert.noisy	Boolean	Whether the alert is marked as noisy.
Uptycs.Alert.note	String	Note attached to the alert.
Uptycs.Alert.noteCreatedAt	Date	Timestamp when the note was created.
Uptycs.Alert.noteCreatedBy	String	User who created the note.
Uptycs.Alert.noteId	String	Identifier of the note.
Uptycs.Alert.remediationActions	String	Remediation actions for the alert.
Uptycs.Alert.resolutionDays	Number	Number of days to resolve the alert.
Uptycs.Alert.resolvedAt	Date	Timestamp when the alert was resolved.
Uptycs.Alert.rowCount	Number	Number of rows associated with the alert.
Uptycs.Alert.ruleId	String	Rule identifier that triggered the alert.
Uptycs.Alert.severity	String	Severity level of the alert (e.g., low, medium, high, critical).
Uptycs.Alert.status	String	Current status of the alert (e.g., open, closed).
Uptycs.Alert.updatedAt	Date	Timestamp when the alert was last updated.
Uptycs.Alert.updatedBy	String	User who last updated the alert.
Uptycs.Alert.value	String	Value associated with the alert key.
Uptycs.Alert.source	String	Source of the alert (e.g., host).

Configuration parameters

url — Server URL (required)
api_key — API Key (required)
credentials — API Secret (required)
customer_id — Customer ID (required)
role_id — Role ID
security_zone_id — Security Zone ID
max_fetch — Maximum number of alerts per fetch

Commands (1)

uptycs-get-events
Gets alerts from Uptycs. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.

Source

UptycsEventCollector.py UptycsEventCollector_test.py UptycsEventCollector.yml UptycsEventCollector_description.md command_examples.txt

Download History Raw

commonfields:
  id: UptycsEventCollector
  version: -1
name: UptycsEventCollector
display: Uptycs Event Collector (Beta)
beta: true
category: Analytics & SIEM
provider: Uptycs
description: Uptycs is a cloud-native security analytics platform that provides visibility, threat detection, and compliance across endpoints and cloud workloads.
sectionorder:
- Connect
- Collect
configuration:
- name: url
  display: Server URL
  required: true
  type: 0
  section: Connect
  additionalinfo: 'The Uptycs API base URL. Format: https://<domain>.uptycs.io.'
- name: api_key
  display: API Key
  required: true
  type: 14
  section: Connect
  additionalinfo: The API Key from the Uptycs API Client Management page. Used for JWT authentication.
- name: credentials
  display: API Secret
  displaypassword: API Secret
  required: true
  type: 9
  section: Connect
  hiddenusername: true
  additionalinfo: The API Secret from the Uptycs API Client Management page. Used for JWT signing.
- name: customer_id
  display: Customer ID
  required: true
  type: 0
  section: Connect
  additionalinfo: The Uptycs Customer ID (UUID). Found in the API key JSON file or the Uptycs console URL.
- name: role_id
  display: Role ID
  required: false
  type: 0
  section: Connect
  additionalinfo: Optional Role ID to include in the JWT token for role-based access control.
- name: security_zone_id
  display: Security Zone ID
  required: false
  type: 0
  section: Connect
  additionalinfo: Optional Security Zone ID to include in the JWT token for zone-scoped access.
- name: max_fetch
  display: Maximum number of alerts per fetch
  required: false
  type: 0
  section: Collect
  advanced: true
  defaultvalue: "10000"
  additionalinfo: Maximum number of alerts to fetch per cycle (default is 10000).
script:
  commands:
  - name: uptycs-get-events
    description: |-
      Gets alerts from Uptycs. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    deprecated: false
    arguments:
    - name: start_time
      description: >-
        The start time to fetch alerts.
        Supports relative time (e.g., "3 days ago", "2 hours ago", "now")
        or absolute dates (ISO 8601 format, e.g., "2024-12-01" or "2024-12-01T10:00:00Z").
    - name: end_time
      description: >-
        The end time to fetch alerts.
        Supports relative time (e.g., "1 hour ago", "now")
        or absolute dates (ISO 8601 format, e.g., "2024-12-01" or "2024-12-01T10:00:00Z").
    - name: limit
      description: Maximum number of alerts to retrieve.
      defaultValue: '10000'
    - name: should_push_events
      description: Set to true to push events to XSIAM. Use with caution to avoid duplicates.
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: Uptycs.Alert.id
      description: Unique identifier of the alert.
      type: String
    - contextPath: Uptycs.Alert.agentType
      description: Type of agent associated with the alert (e.g., asset).
      type: String
    - contextPath: Uptycs.Alert.alertId
      description: Alert identifier.
      type: String
    - contextPath: Uptycs.Alert.alertRuleId
      description: Identifier of the alert rule that triggered this alert.
      type: String
    - contextPath: Uptycs.Alert.alertRuleName
      description: Name of the alert rule that triggered this alert.
      type: String
    - contextPath: Uptycs.Alert.alertStatusReasonId
      description: Identifier for the alert status reason.
      type: String
    - contextPath: Uptycs.Alert.alertTags
      description: Tags associated with the alert (e.g., MITRE ATT&CK techniques).
      type: Unknown
    - contextPath: Uptycs.Alert.alertTime
      description: 'Timestamp when the alert was triggered. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.alertTimeSuppresionDuration
      description: Duration of alert time suppression.
      type: String
    - contextPath: Uptycs.Alert.alertTimeSuppresionStart
      description: Start time of alert time suppression.
      type: String
    - contextPath: Uptycs.Alert.assetCityId
      description: City identifier of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetCores
      description: Number of CPU cores on the asset.
      type: Number
    - contextPath: Uptycs.Alert.assetCpuBrand
      description: CPU brand of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetDescription
      description: Description of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetDisabled
      description: Whether the asset is disabled.
      type: Boolean
    - contextPath: Uptycs.Alert.assetGateway
      description: Gateway IP address of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetHardwareModel
      description: Hardware model of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetHardwareSerial
      description: Hardware serial number of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetHardwareVendor
      description: Hardware vendor of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetHostName
      description: Hostname of the asset associated with the alert.
      type: String
    - contextPath: Uptycs.Alert.assetId
      description: Unique identifier of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetLastActivityAt
      description: 'Timestamp of the asset''s last activity. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.assetLastEnrolledAt
      description: 'Timestamp when the asset was last enrolled. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.assetLatitude
      description: Latitude of the asset's location.
      type: Number
    - contextPath: Uptycs.Alert.assetLive
      description: Whether the asset is currently live.
      type: Boolean
    - contextPath: Uptycs.Alert.assetLocation
      description: Geographic location of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetLogicalCores
      description: Number of logical CPU cores on the asset.
      type: Number
    - contextPath: Uptycs.Alert.assetLongitude
      description: Longitude of the asset's location.
      type: Number
    - contextPath: Uptycs.Alert.assetManualSlackAssignment
      description: Whether the asset has manual Slack assignment.
      type: Boolean
    - contextPath: Uptycs.Alert.assetMemoryMb
      description: Memory in MB of the asset.
      type: Number
    - contextPath: Uptycs.Alert.assetObjectGroupId
      description: Object group identifier of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetOs
      description: Operating system of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetOsFlavor
      description: OS flavor of the asset (e.g., debian).
      type: String
    - contextPath: Uptycs.Alert.assetOsKey
      description: OS key identifier of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetOsVersion
      description: OS version of the asset.
      type: String
    - contextPath: Uptycs.Alert.assetOsqueryVersion
      description: Osquery version installed on the asset.
      type: String
    - contextPath: Uptycs.Alert.assetSlackUserId
      description: Slack user ID associated with the asset.
      type: String
    - contextPath: Uptycs.Alert.assetStatus
      description: Status of the asset (e.g., active).
      type: String
    - contextPath: Uptycs.Alert.assignedTo
      description: User the alert is assigned to.
      type: String
    - contextPath: Uptycs.Alert.attackType
      description: Type of attack associated with the alert.
      type: String
    - contextPath: Uptycs.Alert.cloudRegionCode
      description: Cloud region code of the resource.
      type: String
    - contextPath: Uptycs.Alert.cloudResourceId
      description: Cloud resource identifier.
      type: String
    - contextPath: Uptycs.Alert.cloudTenantId
      description: Cloud tenant identifier.
      type: String
    - contextPath: Uptycs.Alert.cloudType
      description: Cloud provider type.
      type: String
    - contextPath: Uptycs.Alert.code
      description: Alert code identifier.
      type: String
    - contextPath: Uptycs.Alert.createdAt
      description: 'Timestamp when the alert was created. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.custom
      description: Whether this is a custom alert rule.
      type: Boolean
    - contextPath: Uptycs.Alert.customerId
      description: Customer identifier.
      type: String
    - contextPath: Uptycs.Alert.description
      description: Description of the alert.
      type: String
    - contextPath: Uptycs.Alert.displayName
      description: Display name of the alert.
      type: String
    - contextPath: Uptycs.Alert.eventId
      description: Event identifier associated with the alert.
      type: String
    - contextPath: Uptycs.Alert.exceptionMetadata
      description: Exception metadata containing detailed event information.
      type: Unknown
    - contextPath: Uptycs.Alert.groupId
      description: Group identifier.
      type: String
    - contextPath: Uptycs.Alert.groupName
      description: Group name.
      type: String
    - contextPath: Uptycs.Alert.grouping
      description: Alert grouping category (e.g., ATTACK).
      type: String
    - contextPath: Uptycs.Alert.groupingL2
      description: Second-level grouping (e.g., MITRE tactic).
      type: String
    - contextPath: Uptycs.Alert.groupingL3
      description: Third-level grouping (e.g., MITRE technique).
      type: String
    - contextPath: Uptycs.Alert.groupingL4
      description: Fourth-level grouping.
      type: String
    - contextPath: Uptycs.Alert.hashKey
      description: Hash key of the alert.
      type: String
    - contextPath: Uptycs.Alert.isContainer
      description: Whether the alert is related to a container.
      type: Boolean
    - contextPath: Uptycs.Alert.isTask
      description: Whether the alert is a task.
      type: Boolean
    - contextPath: Uptycs.Alert.key
      description: Key field of the alert.
      type: String
    - contextPath: Uptycs.Alert.lastActiveAt
      description: 'Timestamp when the alert was last active. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.lastOccurredAt
      description: 'Timestamp when the alert last occurred. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.metadata
      description: Alert metadata containing detailed event information.
      type: Unknown
    - contextPath: Uptycs.Alert.noisy
      description: Whether the alert is marked as noisy.
      type: Boolean
    - contextPath: Uptycs.Alert.note
      description: Note attached to the alert.
      type: String
    - contextPath: Uptycs.Alert.noteCreatedAt
      description: 'Timestamp when the note was created. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.noteCreatedBy
      description: User who created the note.
      type: String
    - contextPath: Uptycs.Alert.noteId
      description: Identifier of the note.
      type: String
    - contextPath: Uptycs.Alert.remediationActions
      description: Remediation actions for the alert.
      type: String
    - contextPath: Uptycs.Alert.resolutionDays
      description: Number of days to resolve the alert.
      type: Number
    - contextPath: Uptycs.Alert.resolvedAt
      description: 'Timestamp when the alert was resolved. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.rowCount
      description: Number of rows associated with the alert.
      type: Number
    - contextPath: Uptycs.Alert.ruleId
      description: Rule identifier that triggered the alert.
      type: String
    - contextPath: Uptycs.Alert.severity
      description: Severity level of the alert (e.g., low, medium, high, critical).
      type: String
    - contextPath: Uptycs.Alert.status
      description: Current status of the alert (e.g., open, closed).
      type: String
    - contextPath: Uptycs.Alert.updatedAt
      description: 'Timestamp when the alert was last updated. Format: YYYY-MM-DDTHH:MM:SS.sssZ.'
      type: Date
    - contextPath: Uptycs.Alert.updatedBy
      description: User who last updated the alert.
      type: String
    - contextPath: Uptycs.Alert.value
      description: Value associated with the alert key.
      type: String
    - contextPath: Uptycs.Alert.source
      description: Source of the alert (e.g., host).
      type: String
  isfetchevents: true
  runonce: false
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/fastapi:0.125.0.10158186
fromversion: 8.11.0
marketplaces:
- marketplacev2
- platform
supportlevelheader: xsoar
supportedModules:
- xsiam
tests:
- No tests (auto formatted)