Vega

Details

ID	`Vega`
Provider	Vega
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

Vega integration for fetching alerts and incidents from the Vega platform.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Vega in Cortex

Parameter	Description	Required
Base URL	The Base URL of the Vega API.	True
Access Key ID	The Access Key ID used to authenticate with the Vega API.	True
Access Key	The Access Key used to authenticate with the Vega API.	True
Fetch incidents		False
Incidents Fetch Interval		True
Maximum incidents per fetch	The Maximum number of Vega alerts and incidents to fetch per cycle, combined. Valid range is 1-50. Invalid values default to 50 during fetch.	True
Fetch Lookback (minutes)	The number of minutes the query window is shifted backwards on each fetch cycle to catch alerts and incidents that were indexed late on the Vega side. Deduplication prevents re- ingestion. Valid range is 1-60.	True
Vega Entities to fetch	The Vega entities to fetch as Cortex XSOAR incidents.	True
Backfill Days	The number of days before today to fetch alerts and incidents on the first run. Use 0 for today only. Valid range is 0–365.	True
Enable Cortex XSOAR to Vega mirroring	Whether to enable Cortex XSOAR to Vega mirroring. When enabled, changes made in Cortex XSOAR investigations are mirrored to Vega for status, verdict, verdict reasoning, severity, and comments. Requires the Vega Outgoing Mapper on this instance. When disabled, Vega to Cortex XSOAR mirroring remains enabled.	False
Outgoing fields to mirror	The investigation fields that are mirrored from Cortex XSOAR to Vega when outgoing mirroring is enabled. If empty, all fields are mirrored. War Room comments are included when Comments is selected. Any custom values entered outside the available options are ignored.	False
Alert Severities to fetch	The severities by which to filter alerts. If empty, all severities are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle.	False
Alert Statuses to fetch	The statuses by which to filter alerts. If empty, all statuses are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle.	False
Alert Verdicts to fetch	The verdicts by which to filter alerts. If empty, all verdicts are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle.	False
Has related incidents	The filter for alerts based on whether they have related incidents. Select Yes to fetch alerts with related incidents, No to fetch alerts without related incidents, or both to fetch all alerts. At least one option must be selected. Filter alerts by whether they have related incidents. Select Yes to fetch alerts with related incidents, No to fetch alerts without related incidents, or both to fetch all alerts. At least one option must be selected.	True
Incident Severities to fetch	The severities by which to filter incidents. If empty, all severities are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle. Filter incidents by severity. If empty, all severities are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle.	False
Incident Statuses to fetch	The statuses by which to filter incidents. If empty, all statuses are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle. Filter incidents by status. If empty, all statuses are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle.	False
Incident Verdicts to fetch	The verdicts by which to filter incidents. If empty, all verdicts are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle. Filter incidents by verdict. If empty, all verdicts are fetched. Any custom values entered outside the available options are ignored and will not affect the fetch cycle.	False
Incident type		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

vega-get-alert-events

Fetch all aggregated alert events for a Vega alert using internal API pagination, then return the requested display page as a markdown table and CustomFields for the Alert Events layout section.

Base Command

vega-get-alert-events

Input

Argument Name	Description	Required
alert_id	The Vega alert API id (UUID). When omitted, resolves the alert id from the current Vega Alert incident.	Optional
limit	The number of alert events to display per page. Also used as the Vega API batch size when fetching all events. Default is 200.	Optional
offset	The pagination offset for alert events. Default is 0.	Optional

Context Output

Path	Type	Description
Vega.AlertEvents.AlertId	String	Vega alert ID.
Vega.AlertEvents.Total	Number	Total number of alert events reported by Vega.
Vega.AlertEvents.Offset	Number	Pagination offset used for the current page.
Vega.AlertEvents.Limit	Number	Page size used for the current fetch.
Vega.AlertEvents.Count	Number	Number of alert events returned in the current page.
Vega.AlertEvents.HasAlertEvents	Boolean	Whether the alert returned real alert events instead of aggregated parse-field summary rows.
Vega.AlertEvents.Cached	Boolean	Whether the response was served from cached incident data.
Vega.AlertEvents.Events	Unknown	Enriched alert events for the current page. JSON `fields` are parsed and `fields._raw` contents are promoted to top-level keys under `fields`.
Vega.AlertEvents.CustomFields	Unknown	Incident custom fields to persist for the Alert Events layout section.

vega-set-detections-state

Set the state for one or more Vega detections.

Base Command

vega-set-detections-state

Input

Argument Name	Description	Required
ids	A comma-separated list of Vega detection IDs to update.	Required
state	The target detection state. Possible values are: ENABLED, DISABLED, TEST_MODE.	Required

Context Output

Path	Type	Description
Vega.DetectionsState.State	String	The state applied to the detections.
Vega.DetectionsState.IDs	String	Detection IDs updated by Vega.
Vega.DetectionsState.Count	Number	Number of detection IDs updated.

vega-update-detections

Update severity, status, state, and/or tags for one or more Vega detections using the updateDetections GraphQL mutation.

Base Command

vega-update-detections

Input

Argument Name	Description	Required
detection_id	A comma-separated list of Vega detection IDs to update.	Required
severity	The target Vega detection severity. Possible values are: LOW, MEDIUM, HIGH, CRITICAL.	Optional
state	The target Vega detection state. Possible values are: ENABLED, DISABLED, TEST_MODE.	Optional
tags	A comma-separated list of tags to apply to the Vega detection.	Optional

Context Output

Path	Type	Description
Vega.Detection.ID	String	Updated Vega detection ID.
Vega.Detection.Name	String	Updated Vega detection name.
Vega.Detection.Severity	String	Updated Vega detection severity.
Vega.Detection.Status	String	Updated Vega detection status.
Vega.Detection.State	String	Updated Vega detection state.
Vega.Detection.Tags	String	Updated Vega detection tags.
Vega.Detection.ValidationStatus	String	Vega validation status for the detection update.

vega-update-alert

Immediately update Vega alert status, severity, verdict, verdict reasoning, assignees, and/or comment on the Vega platform and sync the open Cortex XSOAR investigation when run from a Vega Alert investigation.

Base Command

vega-update-alert

Input

Argument Name	Description	Required
alert_ids	A comma-separated list of Vega alert IDs to update. Accepts a comma-separated list or repeated values (for example, alert_ids=alert-1,alert-2). Use this to update alerts directly from the war room without opening an investigation. When omitted, the alert ID is resolved from the current Vega Alert investigation. One or more Vega alert IDs to update. Accepts a comma-separated list or repeated values (for example, alert_ids=alert-1,alert-2). Use this to update alerts directly from the war room without opening an investigation. When omitted, the alert ID is resolved from the current Vega Alert investigation.	Optional
status	The target Vega alert status. Possible values are: OPEN, IN PROGRESS, PEER REVIEW, RESOLVED.	Optional
verdict	The target Vega alert verdict. Possible values are: MALICIOUS, SUSPICIOUS, BENIGN, INCONCLUSIVE, NA.	Optional
severity	The target Vega alert severity. Possible values are: LOW, MEDIUM, HIGH, CRITICAL.	Optional
verdict_reasoning	The target Vega alert verdict reasoning.	Optional
comment	The comment to add on the Vega alert.	Optional
assignees	A comma-separated list of Vega user IDs to assign to the alert.	Optional

Context Output

Path	Type	Description
Vega.Alert.id	String	Updated Vega alert ID.
Vega.Alert.status	String	Updated Vega alert status.
Vega.Alert.severity	String	Updated Vega alert severity.
Vega.Alert.verdict	String	Updated Vega alert verdict.
Vega.Alert.assignee	String	Updated Vega alert assignee email, display name, or user ID.

vega-update-incident

Immediately update Vega incident status, verdict, verdict reasoning, severity, assignee emails, and/or comment on the Vega platform and sync the open Cortex XSOAR investigation when run from a Vega Incident investigation.

Base Command

vega-update-incident

Input

Argument Name	Description	Required
incident_ids	A comma-separated list of Vega incident IDs to update. Accepts a comma-separated list or repeated values (for example, incident_ids=inc-1,inc-2). Use this to update incidents directly from the war room without opening an investigation. When omitted, the incident ID is resolved from the current Vega Incident investigation. One or more Vega incident IDs to update. Accepts a comma-separated list or repeated values (for example, incident_ids=inc-1,inc-2). Use this to update incidents directly from the war room without opening an investigation. When omitted, the incident ID is resolved from the current Vega Incident investigation.	Optional
status	The target Vega incident status. Possible values are: NEW, INVESTIGATING, ON HOLD, EXTERNAL ESCALATION, RESOLVED, REOPENED, REVIEW RECOMMENDED, RESPONSE REQUIRED, UNDER REVIEW.	Optional
verdict	The target Vega incident verdict. Possible values are: MALICIOUS, SUSPICIOUS, BENIGN, INCONCLUSIVE, NA.	Optional
severity	The target Vega incident severity. Possible values are: LOW, MEDIUM, HIGH, CRITICAL.	Optional
verdict_reasoning	The target Vega incident verdict reasoning.	Optional
comment	The comment to add on the Vega incident.	Optional
assignee_emails	A comma-separated list of email addresses to assign to the Vega incident.	Optional

Context Output

Path	Type	Description
Vega.Incident.id	String	Updated Vega incident ID.
Vega.Incident.status	String	Updated Vega incident status.
Vega.Incident.verdict	String	Updated Vega incident verdict.
Vega.Incident.severity	String	Updated Vega incident severity.
Vega.Incident.assignee	String	Updated Vega incident assignee email, display name, or user ID.

get-remote-data

Gets remote data from a remote Vega alert or incident. Used for debugging incoming mirroring.

Base Command

get-remote-data

Input

Argument Name	Description	Required
id	The remote Vega alert or incident ID.	Required
lastUpdate	The UTC timestamp in seconds (e.g., 1672531200). The incident is only updated if it was modified after the last update time.	Optional

Context Output

There is no context output for this command.

get-modified-remote-data

Gets Vega alert and incident IDs modified since the last update time. Used for debugging incoming mirroring.

Base Command

get-modified-remote-data

Input

Argument Name	Description	Required
lastUpdate	The UTC timestamp in seconds (e.g., 1672531200). Returns Vega alert and incident IDs updated since this time.	Required

Context Output

There is no context output for this command.

update-remote-system

Pushes Cortex XSOAR investigation changes to Vega when outgoing mirroring is enabled.

Base Command

update-remote-system

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

get-mapping-fields

Returns the outgoing mirroring fields for Vega Alert and Vega Incident investigations.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Vega corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Vega.

Configuration parameters

url — Base URL (required)
access_key_id — Access Key ID (required)
access_key — Access Key (required)
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval (required)
max_fetch — Maximum incidents per fetch (required)
lookback_minutes — Fetch Lookback (minutes) (required)
vega_entities — Vega Entities to fetch (required)
backfill_days — Backfill Days (required)
autoclosure — Enable Cortex XSOAR to Vega mirroring
outgoing_mirror_fields — Outgoing fields to mirror
alert_severities — Alert Severities to fetch
alert_statuses — Alert Statuses to fetch
alert_verdicts — Alert Verdicts to fetch
alert_has_related_incidents — Has related incidents (required)
incident_severities — Incident Severities to fetch
incident_statuses — Incident Statuses to fetch
incident_verdicts — Incident Verdicts to fetch
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (9)

get-mapping-fields
Returns the outgoing mirroring fields for Vega Alert and Vega Incident investigations.
get-modified-remote-data
Gets Vega alert and incident IDs modified since the last update time. Used for debugging incoming mirroring.
get-remote-data
Gets remote data from a remote Vega alert or incident. Used for debugging incoming mirroring.
update-remote-system
Pushes Cortex XSOAR investigation changes to Vega when outgoing mirroring is enabled.
vega-get-alert-events
Fetch all aggregated alert events for a Vega alert using internal API pagination, then return the requested display page as a markdown table and CustomFields for the Alert Events layout section.
vega-set-detections-state
Set the state for one or more Vega detections.
vega-update-alert
Immediately update Vega alert status, severity, verdict, verdict reasoning, assignees, and/or comment on the Vega platform and sync the open Cortex XSOAR investigation when run from a Vega Alert investigation.
vega-update-detections
Update severity, status, state, and/or tags for one or more Vega detections using the updateDetections GraphQL mutation.
vega-update-incident
Immediately update Vega incident status, verdict, verdict reasoning, severity, assignee emails, and/or comment on the Vega platform and sync the open Cortex XSOAR investigation when run from a Vega Incident investigation.

Source

Vega.py Vega_test.py Vega.yml Vega_description.md command_examples.txt

Download History Raw

name: Vega
provider: Vega
category: Analytics & SIEM
commonfields:
  id: Vega
  version: -1
sectionorder:
  - Connect
  - Collect
  - Mirroring
configuration:
  - display: Base URL
    additionalinfo: The Base URL of the Vega API.
    name: url
    required: true
    type: 0
    section: Connect
  - display: Access Key ID
    additionalinfo: The Access Key ID used to authenticate with the Vega API.
    name: access_key_id
    required: true
    hiddenusername: true
    displaypassword: Access Key ID
    type: 9
    section: Connect
  - display: Access Key
    additionalinfo: The Access Key used to authenticate with the Vega API.
    name: access_key
    required: true
    displaypassword: Access Key
    type: 9
    hiddenusername: true
    section: Connect
  - display: Fetch incidents
    name: isFetch
    type: 8
    section: Collect
    required: false
    defaultvalue: "true"
  - name: incidentFetchInterval
    type: 19
    display: Incidents Fetch Interval
    defaultvalue: "5"
    required: true
    section: Collect
  - name: max_fetch
    display: Maximum incidents per fetch
    defaultvalue: "50"
    type: 0
    section: Collect
    required: true
    additionalinfo: >-
      The Maximum number of Vega alerts and incidents to fetch per cycle, combined.
      Valid range is 1-50. Invalid values default to 50 during fetch.
  - display: Fetch Lookback (minutes)
    name: lookback_minutes
    type: 0
    section: Collect
    required: true
    defaultvalue: "5"
    additionalinfo: >-
      The number of minutes the query window is shifted backwards on each fetch cycle to catch 
      alerts and incidents that were indexed late on the Vega side. Deduplication prevents re-
      ingestion. Valid range is 1-60.
  - display: Vega Entities to fetch
    additionalinfo: The Vega entities to fetch as Cortex XSOAR incidents.
    name: vega_entities
    type: 16
    section: Collect
    required: true
    options:
      - Alerts
      - Incidents
    defaultvalue: Alerts,Incidents
  - display: Backfill Days
    additionalinfo: >-
      The number of days before today to fetch alerts and incidents on the first run.
      Use 0 for today only. Valid range is 0–365.
    name: backfill_days
    type: 1
    section: Collect
    required: true
    defaultvalue: "30"
  - display: Enable Cortex XSOAR to Vega mirroring
    additionalinfo: >-
      Whether to enable Cortex XSOAR to Vega mirroring. When enabled, changes made in Cortex 
      XSOAR investigations are mirrored to Vega for status, verdict,
      verdict reasoning, severity, and comments. Requires the Vega Outgoing Mapper on this 
      instance.
      When disabled, Vega to Cortex XSOAR mirroring remains enabled.
    name: autoclosure
    type: 8
    section: Mirroring
    required: false
    defaultvalue: "true"
  - display: Outgoing fields to mirror
    additionalinfo: >-
      The investigation fields that are mirrored from Cortex XSOAR to Vega when outgoing 
      mirroring is enabled.
      If empty, all fields are mirrored. War Room comments are included when Comments is 
      selected.
      Any custom values entered outside the available options are ignored.
    name: outgoing_mirror_fields
    type: 16
    section: Mirroring
    required: false
    options:
      - Status
      - Severity
      - Verdict
      - Verdict Reasoning
      - Comments
    defaultvalue: Status,Severity,Verdict,Verdict Reasoning,Comments
  - display: Alert Severities to fetch
    additionalinfo: >-
      The severities by which to filter alerts. If empty, all severities are fetched.
      Any custom values entered outside the available options are ignored and will not affect
      the fetch cycle.
    name: alert_severities
    type: 16
    section: Collect
    required: false
    options:
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    defaultvalue: LOW,MEDIUM,HIGH,CRITICAL
  - display: Alert Statuses to fetch
    additionalinfo: >-
      The statuses by which to filter alerts. If empty, all statuses are fetched.
      Any custom values entered outside the available options are ignored and will not affect 
      the fetch cycle.
    name: alert_statuses
    type: 16
    section: Collect
    required: false
    options:
      - OPEN
      - IN PROGRESS
      - PEER REVIEW
      - RESOLVED
    defaultvalue: OPEN,IN PROGRESS,PEER REVIEW,RESOLVED
  - display: Alert Verdicts to fetch
    additionalinfo: >-
      The verdicts by which to filter alerts. If empty, all verdicts are fetched.
      Any custom values entered outside the available options are ignored and will not affect
      the fetch cycle.
    name: alert_verdicts
    type: 16
    section: Collect
    required: false
    options:
      - MALICIOUS
      - SUSPICIOUS
      - BENIGN
      - INCONCLUSIVE
      - NA
    defaultvalue: MALICIOUS,SUSPICIOUS,BENIGN,INCONCLUSIVE,NA
  - display: Has related incidents
    additionalinfo: >-
      The filter for alerts based on whether they have related incidents. Select Yes to fetch alerts with related incidents,
      No to fetch alerts without related incidents, or both to fetch all alerts.
      At least one option must be selected.
      Filter alerts by whether they have related incidents. Select Yes to fetch alerts with related incidents,
      No to fetch alerts without related incidents, or both to fetch all alerts.
      At least one option must be selected.
    name: alert_has_related_incidents
    type: 16
    section: Collect
    required: true
    options:
      - "Yes"
      - "No"
    defaultvalue: "Yes,No"
  - display: Incident Severities to fetch
    additionalinfo: >-
      The severities by which to filter incidents. If empty, all severities are fetched.
      Any custom values entered outside the available options are ignored and will not affect the fetch cycle.
      Filter incidents by severity. If empty, all severities are fetched.
      Any custom values entered outside the available options are ignored and will not affect the fetch cycle.
    name: incident_severities
    type: 16
    section: Collect
    required: false
    options:
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    defaultvalue: LOW,MEDIUM,HIGH,CRITICAL
  - display: Incident Statuses to fetch
    additionalinfo: >-
      The statuses by which to filter incidents. If empty, all statuses are fetched.
      Any custom values entered outside the available options are ignored and will not affect the fetch cycle.
      Filter incidents by status. If empty, all statuses are fetched.
      Any custom values entered outside the available options are ignored and will not affect the fetch cycle.
    name: incident_statuses
    type: 16
    section: Collect
    required: false
    options:
      - NEW
      - INVESTIGATING
      - ON HOLD
      - EXTERNAL ESCALATION
      - RESOLVED
      - REOPENED
      - REVIEW RECOMMENDED
      - RESPONSE REQUIRED
      - UNDER REVIEW
    defaultvalue: NEW,INVESTIGATING,ON HOLD,EXTERNAL ESCALATION,RESOLVED,REOPENED,REVIEW RECOMMENDED,RESPONSE REQUIRED,UNDER REVIEW
  - display: Incident Verdicts to fetch
    additionalinfo: >-
      The verdicts by which to filter incidents. If empty, all verdicts are fetched.
      Any custom values entered outside the available options are ignored and will not affect the fetch cycle.
      Filter incidents by verdict. If empty, all verdicts are fetched.
      Any custom values entered outside the available options are ignored and will not affect the fetch cycle.
    name: incident_verdicts
    type: 16
    section: Collect
    required: false
    options:
      - MALICIOUS
      - SUSPICIOUS
      - BENIGN
      - INCONCLUSIVE
      - NA
    defaultvalue: MALICIOUS,SUSPICIOUS,BENIGN,INCONCLUSIVE,NA
  - display: Incident type
    name: incidentType
    type: 13
    section: Connect
    required: false
  - display: Trust any certificate (not secure)
    name: insecure
    required: false
    type: 8
    section: Connect
    advanced: true
  - display: Use system proxy settings
    name: proxy
    required: false
    type: 8
    section: Connect
    advanced: true
description: Vega integration for fetching alerts and incidents from the Vega platform.
display: Vega
defaultclassifier: Vega Classifier
defaultmapperin: Vega Mapper
defaultmapperout: Vega Outgoing Mapper
script:
  commands:
    - name: vega-get-alert-events
      arguments:
        - name: alert_id
          description: The Vega alert API id (UUID). When omitted, resolves the alert id from the current Vega Alert incident.
          required: false
        - name: limit
          description: The number of alert events to display per page. Also used as the Vega API batch size when fetching all events.
          defaultValue: "200"
        - name: offset
          description: The pagination offset for alert events.
          defaultValue: "0"
      description: >-
        Fetch all aggregated alert events for a Vega alert using internal API pagination,
        then return the requested display page as a markdown table and CustomFields for the Alert Events layout section.
      outputs:
        - contextPath: Vega.AlertEvents.AlertId
          description: Vega alert ID.
          type: String
        - contextPath: Vega.AlertEvents.Total
          description: Total number of alert events reported by Vega.
          type: Number
        - contextPath: Vega.AlertEvents.Offset
          description: Pagination offset used for the current page.
          type: Number
        - contextPath: Vega.AlertEvents.Limit
          description: Page size used for the current fetch.
          type: Number
        - contextPath: Vega.AlertEvents.Count
          description: Number of alert events returned in the current page.
          type: Number
        - contextPath: Vega.AlertEvents.HasAlertEvents
          description: Whether the alert returned real alert events instead of aggregated parse-field summary rows.
          type: Boolean
        - contextPath: Vega.AlertEvents.Cached
          description: Whether the response was served from cached incident data.
          type: Boolean
        - contextPath: Vega.AlertEvents.Events
          description: The alert events returned in the current page.
          type: Unknown
        - contextPath: Vega.AlertEvents.CustomFields
          description: Incident custom fields to persist for the Alert Events layout section.
          type: Unknown
    - name: vega-set-detections-state
      arguments:
        - name: ids
          description: A comma-separated list of Vega detection IDs to update.
          required: true
          isArray: true
        - name: state
          description: The target detection state.
          required: true
          auto: PREDEFINED
          predefined:
            - ENABLED
            - DISABLED
            - TEST_MODE
      description: >-
        Set the state for one or more Vega detections.
      outputs:
        - contextPath: Vega.DetectionsState.State
          description: The state applied to the detections.
          type: String
        - contextPath: Vega.DetectionsState.IDs
          description: Detection IDs updated by Vega.
          type: String
        - contextPath: Vega.DetectionsState.Count
          description: Number of detection IDs updated.
          type: Number
    - name: vega-update-detections
      arguments:
        - name: detection_id
          description: A comma-separated list of Vega detection IDs to update.
          required: true
          isArray: true
        - name: severity
          description: The target Vega detection severity.
          auto: PREDEFINED
          predefined:
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        - name: state
          description: The target Vega detection state.
          auto: PREDEFINED
          predefined:
            - ENABLED
            - DISABLED
            - TEST_MODE
        - name: tags
          description: A comma-separated list of tags to apply to the Vega detection.
          isArray: true
      description: >-
        Update severity, status, state, and/or tags for one or more Vega detections using the updateDetections GraphQL mutation.
      outputs:
        - contextPath: Vega.Detection.ID
          description: Updated Vega detection ID.
          type: String
        - contextPath: Vega.Detection.Name
          description: Updated Vega detection name.
          type: String
        - contextPath: Vega.Detection.Severity
          description: Updated Vega detection severity.
          type: String
        - contextPath: Vega.Detection.Status
          description: Updated Vega detection status.
          type: String
        - contextPath: Vega.Detection.State
          description: Updated Vega detection state.
          type: String
        - contextPath: Vega.Detection.Tags
          description: Updated Vega detection tags.
          type: String
        - contextPath: Vega.Detection.ValidationStatus
          description: Vega validation status for the detection update.
          type: String
    - name: vega-update-alert
      arguments:
        - name: alert_ids
          description: >-
            A comma-separated list of Vega alert IDs to update. Accepts a comma-separated list or repeated values
            (for example, alert_ids=alert-1,alert-2). Use this to update alerts directly from the war room
            without opening an investigation. When omitted, the alert ID is resolved from the current Vega Alert investigation.
            One or more Vega alert IDs to update. Accepts a comma-separated list or repeated values
            (for example, alert_ids=alert-1,alert-2). Use this to update alerts directly from the war room
            without opening an investigation. When omitted, the alert ID is resolved from the current Vega Alert investigation.
          isArray: true
        - name: alert_id
          description: >-
            A comma-separated list of Vega alert IDs to update. Deprecated alias for alert_ids.
          isArray: true
          hidden: true
        - name: status
          description: The target Vega alert status.
          auto: PREDEFINED
          predefined:
            - OPEN
            - IN PROGRESS
            - PEER REVIEW
            - RESOLVED
        - name: verdict
          description: The target Vega alert verdict.
          auto: PREDEFINED
          predefined:
            - MALICIOUS
            - SUSPICIOUS
            - BENIGN
            - INCONCLUSIVE
            - NA
        - name: severity
          description: The target Vega alert severity.
          auto: PREDEFINED
          predefined:
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        - name: verdict_reasoning
          description: The target Vega alert verdict reasoning.
        - name: comment
          description: The comment to add on the Vega alert.
        - name: assignees
          description: A comma-separated list of Vega user IDs to assign to the alert.
          isArray: true
      description: >-
        Immediately update Vega alert status, severity, verdict, verdict reasoning, assignees,
        and/or comment on the Vega platform and sync the open Cortex XSOAR investigation when run from a Vega Alert investigation.
      outputs:
        - contextPath: Vega.Alert.id
          description: Updated Vega alert ID.
          type: String
        - contextPath: Vega.Alert.status
          description: Updated Vega alert status.
          type: String
        - contextPath: Vega.Alert.severity
          description: Updated Vega alert severity.
          type: String
        - contextPath: Vega.Alert.verdict
          description: Updated Vega alert verdict.
          type: String
        - contextPath: Vega.Alert.assignee
          description: Updated Vega alert assignee email, display name, or user ID.
          type: String
    - name: vega-update-incident
      arguments:
        - name: incident_ids
          description: >-
            A comma-separated list of Vega incident IDs to update. Accepts a comma-separated list or repeated values
            (for example, incident_ids=inc-1,inc-2). Use this to update incidents directly from the war room
            without opening an investigation. When omitted, the incident ID is resolved from the current Vega Incident investigation.
            One or more Vega incident IDs to update. Accepts a comma-separated list or repeated values
            (for example, incident_ids=inc-1,inc-2). Use this to update incidents directly from the war room
            without opening an investigation. When omitted, the incident ID is resolved from the current Vega Incident investigation.
          isArray: true
        - name: incident_id
          description: >-
            A comma-separated list of Vega incident IDs to update. Deprecated alias for incident_ids.
          isArray: true
          hidden: true
        - name: status
          description: The target Vega incident status.
          auto: PREDEFINED
          predefined:
            - NEW
            - INVESTIGATING
            - ON HOLD
            - EXTERNAL ESCALATION
            - RESOLVED
            - REOPENED
            - REVIEW RECOMMENDED
            - RESPONSE REQUIRED
            - UNDER REVIEW
        - name: verdict
          description: The target Vega incident verdict.
          auto: PREDEFINED
          predefined:
            - MALICIOUS
            - SUSPICIOUS
            - BENIGN
            - INCONCLUSIVE
            - NA
        - name: severity
          description: The target Vega incident severity.
          auto: PREDEFINED
          predefined:
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        - name: verdict_reasoning
          description: The target Vega incident verdict reasoning.
        - name: comment
          description: The comment to add on the Vega incident.
        - name: assignee_emails
          description: A comma-separated list of email addresses to assign to the Vega incident.
          isArray: true
      description: >-
        Immediately update Vega incident status, verdict, verdict reasoning, severity, assignee emails,
        and/or comment on the Vega platform and sync the open Cortex XSOAR investigation when run from a Vega Incident investigation.
      outputs:
        - contextPath: Vega.Incident.id
          description: Updated Vega incident ID.
          type: String
        - contextPath: Vega.Incident.status
          description: Updated Vega incident status.
          type: String
        - contextPath: Vega.Incident.verdict
          description: Updated Vega incident verdict.
          type: String
        - contextPath: Vega.Incident.severity
          description: Updated Vega incident severity.
          type: String
        - contextPath: Vega.Incident.assignee
          description: Updated Vega incident assignee email, display name, or user ID.
          type: String
    - name: get-remote-data
      arguments:
        - name: id
          description: The remote Vega alert or incident ID.
          required: true
        - name: lastUpdate
          description: The UTC timestamp in seconds (e.g., 1672531200). The incident is only updated if it was modified after the last update time.
      description: Gets remote data from a remote Vega alert or incident. Used for debugging incoming mirroring.
    - name: get-modified-remote-data
      arguments:
        - name: lastUpdate
          description: The UTC timestamp in seconds (e.g., 1672531200). Returns Vega alert and incident IDs updated since this time.
          required: true
      description: Gets Vega alert and incident IDs modified since the last update time. Used for debugging incoming mirroring.
    - name: update-remote-system
      description: Pushes Cortex XSOAR investigation changes to Vega when outgoing mirroring is enabled.
    - name: get-mapping-fields
      description: Returns the outgoing mirroring fields for Vega Alert and Vega Incident investigations.
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  runonce: false
  script: "-"
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.10.0
marketplaces:
  - xsoar
  - marketplacev2
  - platform
tests:
  - No tests (auto formatted)