ZeroFox

Cloud-based SaaS to detect risks found on social media and digital channels.

Data Enrichment & Threat Intelligence · ZeroFox

Details

IDZeroFox
ProviderHaveli Investments
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.8428455
Supported ModulesAgentix XSIAM

README

Cloud-based SaaS to detect risks found on social media and digital channels.
This integration was integrated and tested with versions 1.0 and 2.0 of ZeroFox.

Configure ZeroFox in Cortex

Parameter Required
URL (e.g., https://api.zerofox.com/) True
Username True
Password True
Fetch only escalated alerts False
Trust any certificate (not secure) False
Use system proxy settings False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) False
Fetch Limit True
Fetch incidents False
Incident type False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

zerofox-get-alert

Fetches an alert by ID.

Base Command

zerofox-get-alert

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved by running the zerofox-list-alerts command. Required

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-alert-user-assignment

Assigns an alert to a user.

Base Command

zerofox-alert-user-assignment

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved by running the zerofox-list-alerts command. Required
username The name of the user to which an alert is assigned. Required

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-close-alert

Closes an alert.

Base Command

zerofox-close-alert

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved by running the zerofox-list-alerts command. Required

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-alert-request-takedown

Requests a takedown of a specified alert.

Base Command

zerofox-alert-request-takedown

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved by running the zerofox-list-alerts command. Required

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-modify-alert-tags

Adds tags to and or removes tags from a specified alert.

Base Command

zerofox-modify-alert-tags

Input

Argument Name Description Required
action Adds or removes tags. Possible values are: add, remove. Default is add. Optional
alert_id The ID of an alert. Can be retrieved by running the zerofox-list-alerts command. Required
tags A CSV of tags to be added to or removed from an alert. Required

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-list-alerts

Returns alerts that match user-defined or default filters and parameters. By default, no filters are applied and the results are sorted by timestamp.

Base Command

zerofox-list-alerts

Input

Argument Name Description Required
account The account number of the social network (unique ID). Optional
alert_type A CSV list of alert types. Possible values are: account_information, entity_discovery_content, entity_discovery_profile, impersonating_account, impersonating_comment, impersonating_post, incoming_comment, incoming_post, incoming_private_message, outgoing_private_message, self_comment, self_post, search_query, location, email. Optional
assignee The name of the user assigned to an alert. Optional
entity The ID of the ZeroFox entity. Optional
entity_term The term ID of the ZeroFox entity. Optional
last_modified The amount of time (in seconds) since an alert was last modified. Optional
limit The maximum number of alerts to retrieve (0 - 100). Default is 10. Optional
max_timestamp The ending date-time string (in ISO-8601 format) by which to filter alerts. Optional
min_timestamp The starting date-time string (in ISO-8601 format) by which to filter alerts. Optional
network Filters results by the specified network names. Optional
offset Used for pagination. Starts response with the first filtered alert. Optional
page_id CSV list of the ZeroFox page IDs. Optional
page_url The URL to the website or social media content that triggered an alert. Optional
pages The encoded JSON array of strings used for filtering alerts. Optional
post The unique post number of the social network. Optional
rule_id CSV list of the ZeroFox rule IDs. Optional
rule_name CSV list of the ZeroFox rule names. Optional
entity_search The matched substring of the protected entity. Optional
perpetrator_search The substring used to filter alerts by the username or display name of a perpetrator. Optional
pro_social_obj_search The substring used to filter alerts by the username, display name, or entity term name of protected social objects. Optional
alert_id CSV list of alert IDs. Optional
risk_rating Risk rating of alert. Possible values are: Critical, High, Medium, Low, Info. Optional
sort_direction Sorts results in ascending or descending order. Possible values are: asc, desc. Optional
sort_field Field used for defining alert filter for sorting. Possible values are: alert_id, alert_status, alert_type, assigned_user, perpetrator, protected_entity, protected_social_object, rule, severity, social_network, timestamp, escalated. Optional
status The alert status. Possible values are: closed, open, takedown_accepted, takedown_denied, takedown_requested, whitelisted. Optional
escalated If true, returns only escalated alerts. Possible values are: true, false. Optional
tags Alert tags. Returns alerts containing at least of the tags in the provided CSV list. Optional

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-create-entity

Creates a new entity associated with the company of the authorized user.

Base Command

zerofox-create-entity

Input

Argument Name Description Required
name Name of the entity (may be non-unique). Required
strict_name_matching Indicates the type of string matching used for comparing entity names
to impersonator names. It must be true or false.		 Optional
tags Comma-separated list of string tags for tagging the entity.
For example:
label1,label2,label3.		 Optional
policy_id The ID of the policy to assign to the new entity. Can be retrieved running the zerofox-get-policy-types command. Possible values are: . Optional
organization The name of the organization associated with the entity. Optional

Context Output

Path Type Description
ZeroFox.Entity.Name String The name of the entity.
ZeroFox.Entity.ID Number The ID of the entity.
ZeroFox.StrictNameMatching Boolean Indicates the type of string matching used for comparing entity names to impersonator names.
ZeroFox.Entity.Tags String The list of string tags that can be used for tagging the entity.
ZeroFox.Entity.PolicyID String The policy ID of the entity.
ZeroFox.Entity.Organization String The name of the organization associated with the entity.

zerofox-alert-cancel-takedown

Cancels a takedown of a specified alert.

Base Command

zerofox-alert-cancel-takedown

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved running the zerofox-list-alerts command. Required

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-open-alert

Opens an alert.

Base Command

zerofox-open-alert

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved running the zerofox-list-alerts command. Required

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-list-entities

Lists all entities associated with the company of the authorized user.

Base Command

zerofox-list-entities

Input

Argument Name Description Required
email_address Filters by matching email_address substrings. Optional
group Filters by entity group ID. Can be filtered by multiple group parameters. Optional
label Filters by entity label ID. Can be filtered by multiple label parameters. Optional
network Filters by entities with network accounts using an ID. Can be filtered by multiple network parameters. Optional
networks Filters by entities with network accounts using a CSV of network names. Optional
page The index of page to fetch. Optional
policy Filters by entity policy ID. Can be filtered by multiple policy parameters. Can be retrieved running the zerofox-get-policy-types command. Optional
type Filters by an entity type ID. Can be filtered by multiple type parameters. Can be retrieved running the zerofox-get-entity-types command. Optional

Context Output

Path Type Description
ZeroFox.Entity.ID Number The ID of the entity.
ZeroFox.Entity.Name String The name of the entity.
ZeroFox.Entity.EmailAddress String The email address associated with the entity.
ZeroFox.Entity.Organization String The organization associated with the entity.
ZeroFox.Entity.Tags String A list of tags of the entity.
ZeroFox.Entity.StrictNameMatching Boolean Indicates the type of string matching used for comparing entity names to impersonator names.
ZeroFox.Entity.PolicyID Number The policy ID of the entity.
ZeroFox.Entity.Profile String A link to a profile resource, if applicable.
ZeroFox.Entity.EntityGroupID Number The ID of the entity group.
ZeroFox.Entity.EntityGroupName String The name of the entity group.
ZeroFox.Entity.TypeID Number The ID of the type of entity.
ZeroFox.Entity.TypeName String The name of the type of entity.

zerofox-get-entity-types

Shows a table of all entity type names and IDs in the War Room.

Base Command

zerofox-get-entity-types

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

zerofox-get-policy-types

Shows a table of all policy type names and IDs in the War Room.

Base Command

zerofox-get-policy-types

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

zerofox-modify-alert-notes

Modify the notes of a specified alert.

Base Command

zerofox-modify-alert-notes

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved running the zerofox-list-alerts command. Required
notes The notes to add to an alert. Required

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-submit-threat

Submits potential threats into the ZF alert registry for disruption.

Base Command

zerofox-submit-threat

Input

Argument Name Description Required
source Content to be considered a threat. Required
alert_type Type of content acting as a threat, could be one of email, ip, domain, url, phone, mail_exchange, page_content or account. Required
violation Type of infringement the submitted threat represents, could be one of phishing, malware, rogue_app, impersonation, trademark, copyright, private_data, fraud or other. Required
entity_id Identifier of the entity being threatened by submitted content. Required
notes Additional notes to include in submission. Optional

Context Output

Path Type Description
ZeroFox.Alert.AlertType String The type of an alert.
ZeroFox.Alert.OffendingContentURL String The URL to the site containing content that triggered an alert.
ZeroFox.Alert.Assignee String The user to which an alert is assigned.
ZeroFox.Alert.Entity.ID Number The ID of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Name String The name of the entity corresponding to the triggered alert.
ZeroFox.Alert.Entity.Image String The URL to the profile image of the entity on which an alert was created.
ZeroFox.Alert.EntityTerm.ID Number The ID of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Name String The name of the entity term corresponding to the triggered alert.
ZeroFox.Alert.EntityTerm.Deleted Boolean Whether an entity term was deleted.
ZeroFox.Alert.ContentCreatedAt Date The date-time string indicating when the alerted content was created, in ISO-8601 format.
ZeroFox.Alert.ID Number The ID of an alert.
ZeroFox.Alert.RiskRating Number The risk rating of an alert. Can be “Critical”, “High”, “Medium”, “Low”, or “Info”.
ZeroFox.Alert.Perpetrator.Name String For account, post, or page alerts, the perpetrator’s social network account display name or the account from which the content was posted.
ZeroFox.Alert.Perpetrator.URL String The URL at which you can view the basic details of the perpetrator.
ZeroFox.Alert.Perpetrator.Timestamp Date The timestamp of a post created by a perpetrator.
ZeroFox.Alert.Perpetrator.Type String The type of perpetrator on which an alert was created. Can be an account, page, or post.
ZeroFox.Alert.Perpetrator.ID Number The ZeroFox resource ID of the alert perpetrator.
ZeroFox.Alert.Perpetrator.Network String The network containing the offending content.
ZeroFox.Alert.RuleGroupID Number The ID of the rule group.
ZeroFox.Alert.Status String The status of an alert. Can be “Open”, “Closed”, “Takedown:Accepted”, “Takedown:Denied”, “Takedown:Requested” and “Whitelisted”.
ZeroFox.Alert.Timestamp Date The date-time string when an alert was created, in ISO-8601 format.
ZeroFox.Alert.RuleName String The name of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.LastModified Date The date and time at which an alert was last modified.
ZeroFox.Alert.DarkwebTerm String Details about the dark web term on which an alert was created. Outputs “null” if the alert has no details.
ZeroFox.Alert.Reviewed Boolean Whether an alert was reviewed.
ZeroFox.Alert.Escalated Boolean Whether an alert was escalated.
ZeroFox.Alert.Network String The network on which an alert was created.
ZeroFox.Alert.ProtectedSocialObject String The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account’s display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
ZeroFox.Alert.Notes String Notes made on an alert.
ZeroFox.Alert.RuleID Number The ID of the rule on which an alert was created. Outputs “null” if the rule has been deleted.
ZeroFox.Alert.Tags String A list of an alert’s tags.
ZeroFox.Alert.EntityAccount String The account associated with the entity.

zerofox-send-alert-attachment

Sends an attachment to a specified alert.

Base Command

zerofox-send-alert-attachment

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved running the zerofox-list-alerts command. Required
attachment_type The type of the attachment. Can be evidence “photo_id”, “disruption_agreement”, “trademark_information”, “trademark”or “copyright”. Possible values are: evidence, photo_id, disruption_agreement, trademark_information, trademark, copyright. Required
entry_id The entry ID of the attachment. Required

Context Output

There is no context output for this command.

zerofox-get-alert-attachments

Retrieves the attachments of a specified alert.

Base Command

zerofox-get-alert-attachments

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved running the zerofox-list-alerts command. Required

Context Output

Path Type Description
ZeroFox.AlertAttachments.ID unknown The ID of an alert.
ZeroFox.AlertAttachments.Name unknown The name attachment of an alert.

zerofox-search-compromised-domain

Looks for a given domain in Zerofox’s CTI feeds.

Base Command

zerofox-search-compromised-domain

Input

Argument Name Description Required
domain Domain to search. Required

Context Output

Path Type Description
ZeroFox.CompromisedDomains.Domain string Domain in which the search domain was found.
ZeroFox.CompromisedDomains.LastModified string Last time that the threat was found.
ZeroFox.CompromisedDomains.IPs string Related domains to the threat separated by commas.

zerofox-search-compromised-email

Looks for a given email in ZeroFox’s CTI feeds.

Base Command

zerofox-search-compromised-email

Input

Argument Name Description Required
email email to search. Required

Context Output

Path Type Description
ZeroFox.CompromisedEmails.Domain string Domain in which the search domain was found.
ZeroFox.CompromisedEmails.Email string Email involved in the threat.
ZeroFox.CompromisedEmails.CreatedAt string Date in which the email was found related to a threat.

zerofox-search-malicious-ip

Looks for malicious ips in ZeroFox’s CTI feeds.

Base Command

zerofox-search-malicious-ip

Input

Argument Name Description Required
ip ip to search. Required

Context Output

Path Type Description
ZeroFox.MaliciousIPs.Domain string Domain in which the search domain was found.
ZeroFox.MaliciousIPs.IPAddress string IP in which the search domain was found.
ZeroFox.MaliciousIPs.CreatedAt string Date in which the ip was found related to a threat.

zerofox-search-malicious-hash

Looks for registered hashes in ZeroFox’s CTI feeds.

Base Command

zerofox-search-malicious-hash

Input

Argument Name Description Required
hash hash to search. Required

Context Output

Path Type Description
ZeroFox.MaliciousHashes.CreatedAt string Date in which the ip was found related to a threat.
ZeroFox.MaliciousHashes.Family string Family related threat.
ZeroFox.MaliciousHashes.MD5 string Hash in MD5 format.
ZeroFox.MaliciousHashes.SHA1 string Hash in SHA1 format.
ZeroFox.MaliciousHashes.SHA256 string Hash in SHA256 format.
ZeroFox.MaliciousHashes.SHA512 string Hash in SHA512 format.
ZeroFox.MaliciousHashes.FoundHash string Indicates in which hash format was found the search.

zerofox-search-exploits

Looks for registered exploits in ZeroFox’s CTI feeds.

Base Command

zerofox-search-exploits

Input

Argument Name Description Required
since Staring date for exploit search. Required

Context Output

Path Type Description
ZeroFox.Exploits.CreatedAt string Date in which the ip was found related to a threat.
ZeroFox.Exploits.CVECode string CVE Code to identify the exploit.
ZeroFox.Exploits.URLs string URLs associated to the threat separated by commas.

zerofox-get-compromised-credentials

Gets compromised credentials data for a given ZeroFox alert and uploads it to the current investigation War Room.

Base Command

zerofox-get-compromised-credentials

Input

Argument Name Description Required
alert_id The ID of an alert. Can be retrieved running the zerofox-list-alerts command. Required

Context Output

Path Type Description
File.Size Number The size of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.SHA512 String The SHA512 hash of the file.
File.Name String The name of the file.
File.SSDeep String The SSDeep hash of the file.
File.EntryID String The entry ID of the file.
File.Info String File information.
File.Type String The file type.
File.MD5 String The MD5 hash of the file.
File.Extension String The file extension.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and ZeroFox corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

  1. Enable Fetching incidents in your instance configuration.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and ZeroFox.

Configuration parameters

  • url — URL (e.g., https://api.zerofox.com/) (required)
  • credentials — Username (required)
  • only_escalated — Fetch only escalated alerts
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • fetch_limit — Fetch Limit
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • incidentType — Incident type

Commands (22)

  • zerofox-alert-cancel-takedown

    Cancels a takedown of a specified alert.

  • zerofox-alert-request-takedown

    Requests a takedown of a specified alert.

  • zerofox-alert-user-assignment

    Assigns an alert to a user.

  • zerofox-close-alert

    Closes an alert.

  • zerofox-create-entity

    Creates a new entity associated with the company of the authorized user.

  • zerofox-get-alert

    Fetches an alert by ID.

  • zerofox-get-alert-attachments Deprecated

    Retrieves the attachments of a specified alert.

  • zerofox-get-compromised-credentials

    Gets compromised credentials data for a given ZeroFox alert and uploads it to the current investigation War Room.

  • zerofox-get-entity-types

    Shows a table of all entity type names and IDs in the War Room.

  • zerofox-get-policy-types

    Shows a table of all policy type names and IDs in the War Room.

  • zerofox-list-alerts

    Returns alerts that match user-defined or default filters and parameters. By default, no filters are applied and the results are sorted by timestamp.

  • zerofox-list-entities

    Lists all entities associated with the company of the authorized user.

  • zerofox-modify-alert-notes

    Modify the notes of a specified alert.

  • zerofox-modify-alert-tags

    Adds tags to and or removes tags from a specified alert.

  • zerofox-open-alert

    Opens an alert.

  • zerofox-search-compromised-domain

    Looks for a given domain in Zerofox's CTI feeds.

  • zerofox-search-compromised-email

    Looks for a given email in ZeroFox's CTI feeds.

  • zerofox-search-exploits

    Looks for registered exploits in ZeroFox's CTI feeds.

  • zerofox-search-malicious-hash

    Looks for registered hashes in ZeroFox's CTI feeds.

  • zerofox-search-malicious-ip

    Looks for malicious ips in ZeroFox's CTI feeds.

  • zerofox-send-alert-attachment

    Sends an attachment to a specified alert.

  • zerofox-submit-threat

    Submits potential threats into the ZF alert registry for disruption.

Source

ZeroFox.py ZeroFox_test.py ZeroFox.yml ZeroFox_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Haveli Investments
sectionorder:
- Connect
- Collect
commonfields:
  id: ZeroFox
  version: -1
configuration:
- defaultvalue: https://api.zerofox.com/
  display: URL (e.g., https://api.zerofox.com/)
  name: url
  required: true
  section: Connect
  type: 0
- display: Username
  name: credentials
  required: true
  section: Connect
  type: 9
- display: Fetch only escalated alerts
  name: only_escalated
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: "3 days"
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  required: false
  section: Collect
  type: 0
- display: Fetch Limit
  name: fetch_limit
  type: 0
  required: false
  hidden: true
  defaultvalue: "100"
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  additionalinfo: This controls how often the integration will perform a fetch_incidents command
  defaultvalue: "10"
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
description: Cloud-based SaaS to detect risks found on social media and digital channels.
display: ZeroFox
name: ZeroFox
script:
  commands:
  - name: zerofox-get-alert
    description: Fetches an alert by ID.
    arguments:
    - description: The ID of an alert. Can be retrieved by running the zerofox-list-alerts command.
      name: alert_id
      required: true
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-alert-user-assignment
    description: Assigns an alert to a user.
    arguments:
    - description: The ID of an alert. Can be retrieved by running the zerofox-list-alerts command.
      name: alert_id
      required: true
    - description: The name of the user to which an alert is assigned.
      name: username
      required: true
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-close-alert
    description: Closes an alert.
    arguments:
    - description: The ID of an alert. Can be retrieved by running the zerofox-list-alerts command.
      name: alert_id
      required: true
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-alert-request-takedown
    description: Requests a takedown of a specified alert.
    arguments:
    - description: The ID of an alert. Can be retrieved by running the zerofox-list-alerts command.
      name: alert_id
      required: true
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-modify-alert-tags
    description: Adds tags to and or removes tags from a specified alert.
    arguments:
    - auto: PREDEFINED
      default: true
      defaultValue: add
      description: Adds or removes tags.
      name: action
      predefined:
      - add
      - remove
    - description: The ID of an alert. Can be retrieved by running the zerofox-list-alerts command.
      name: alert_id
      required: true
    - description: A CSV of tags to be added to or removed from an alert.
      name: tags
      required: true
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-list-alerts
    description: Returns alerts that match user-defined or default filters and parameters. By default, no filters are applied and the results are sorted by timestamp.
    arguments:
    - name: account
      description: The account number of the social network (unique ID).
    - name: alert_type
      auto: PREDEFINED
      description: A CSV list of alert types.
      required: false
      secret: false
      predefined:
      - account_information
      - entity_discovery_content
      - entity_discovery_profile
      - impersonating_account
      - impersonating_comment
      - impersonating_post
      - incoming_comment
      - incoming_post
      - incoming_private_message
      - outgoing_private_message
      - self_comment
      - self_post
      - search_query
      - location
      - email
    - name: assignee
      description: The name of the user assigned to an alert.
    - name: entity
      description: The ID of the ZeroFox entity.
    - name: entity_term
      description: The term ID of the ZeroFox entity.
    - name: last_modified
      description: The amount of time (in seconds) since an alert was last modified.
    - name: limit
      default: true
      defaultValue: "10"
      description: The maximum number of alerts to retrieve (0 - 100).
    - name: max_timestamp
      description: The ending date-time string (in ISO-8601 format) by which to filter alerts.
    - name: min_timestamp
      description: The starting date-time string (in ISO-8601 format) by which to filter alerts.
    - name: network
      description: Filters results by the specified network names.
    - name: offset
      description: Used for pagination. Starts response with the first filtered alert.
    - name: page_id
      description: CSV list of the ZeroFox page IDs.
    - name: page_url
      description: The URL to the website or social media content that triggered an alert.
    - name: pages
      description: The encoded JSON array of strings used for filtering alerts.
    - name: post
      description: The unique post number of the social network.
    - name: rule_id
      description: CSV list of the ZeroFox rule IDs.
    - name: rule_name
      description: CSV list of the ZeroFox rule names.
    - name: entity_search
      description: The matched substring of the protected entity.
    - name: perpetrator_search
      description: The substring used to filter alerts by the username or display name of a perpetrator.
    - name: pro_social_obj_search
      description: The substring used to filter alerts by the username, display name, or entity term name of protected social objects.
    - name: alert_id
      description: CSV list of alert IDs.
    - name: risk_rating
      description: Risk rating of alert.
      auto: PREDEFINED
      predefined:
      - Critical
      - High
      - Medium
      - Low
      - Info
    - name: sort_direction
      description: Sorts results in ascending or descending order.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: sort_field
      description: Field used for defining alert filter for sorting.
      auto: PREDEFINED
      predefined:
      - alert_id
      - alert_status
      - alert_type
      - assigned_user
      - perpetrator
      - protected_entity
      - protected_social_object
      - rule
      - severity
      - social_network
      - timestamp
      - escalated
    - name: status
      description: The alert status.
      auto: PREDEFINED
      predefined:
      - closed
      - open
      - takedown_accepted
      - takedown_denied
      - takedown_requested
      - whitelisted
    - name: escalated
      description: If true, returns only escalated alerts.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: tags
      description: Alert tags. Returns alerts containing at least of the tags in the provided CSV list.
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-create-entity
    description: Creates a new entity associated with the company of the authorized user.
    arguments:
    - description: Name of the entity (may be non-unique).
      name: name
      required: true
      secret: false
    - default: false
      description: |-
        Indicates the type of string matching used for comparing entity names
        to impersonator names. It must be `true` or `false`.
      isArray: false
      name: strict_name_matching
    - description: |-
        Comma-separated list of string tags for tagging the entity.
        For example:
        label1,label2,label3.
      isArray: true
      name: tags
    - description: The ID of the policy to assign to the new entity. Can be retrieved running the zerofox-get-policy-types command.
      name: policy_id
      predefined:
      - ""
    - description: The name of the organization associated with the entity.
      name: organization
    outputs:
    - contextPath: ZeroFox.Entity.Name
      description: The name of the entity.
      type: String
    - contextPath: ZeroFox.Entity.ID
      description: The ID of the entity.
      type: Number
    - contextPath: ZeroFox.StrictNameMatching
      description: Indicates the type of string matching used for comparing entity names to impersonator names.
      type: Boolean
    - contextPath: ZeroFox.Entity.Tags
      description: The list of string tags that can be used for tagging the entity.
      type: String
    - contextPath: ZeroFox.Entity.PolicyID
      description: The policy ID of the entity.
      type: String
    - contextPath: ZeroFox.Entity.Organization
      description: The name of the organization associated with the entity.
      type: String
  - name: zerofox-alert-cancel-takedown
    description: Cancels a takedown of a specified alert.
    arguments:
    - description: The ID of an alert. Can be retrieved running the zerofox-list-alerts command.
      name: alert_id
      required: true
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-open-alert
    description: Opens an alert.
    arguments:
    - description: The ID of an alert. Can be retrieved running the zerofox-list-alerts command.
      name: alert_id
      required: true
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-list-entities
    description: Lists all entities associated with the company of the authorized user.
    arguments:
    - description: Filters by matching email_address substrings.
      name: email_address
    - description: Filters by entity group ID. Can be filtered by multiple group parameters.
      name: group
    - description: Filters by entity label ID. Can be filtered by multiple label parameters.
      name: label
    - description: Filters by entities with network accounts using an ID. Can be filtered by multiple network parameters.
      name: network
    - description: Filters by entities with network accounts using a CSV of network names.
      name: networks
    - description: The index of page to fetch.
      name: page
    - description: Filters by entity policy ID. Can be filtered by multiple policy parameters. Can be retrieved running the zerofox-get-policy-types command.
      name: policy
    - description: Filters by an entity type ID. Can be filtered by multiple type parameters. Can be retrieved running the zerofox-get-entity-types command.
      name: type
    outputs:
    - contextPath: ZeroFox.Entity.ID
      description: The ID of the entity.
      type: Number
    - contextPath: ZeroFox.Entity.Name
      description: The name of the entity.
      type: String
    - contextPath: ZeroFox.Entity.EmailAddress
      description: The email address associated with the entity.
      type: String
    - contextPath: ZeroFox.Entity.Organization
      description: The organization associated with the entity.
      type: String
    - contextPath: ZeroFox.Entity.Tags
      description: A list of tags of the entity.
      type: String
    - contextPath: ZeroFox.Entity.StrictNameMatching
      description: Indicates the type of string matching used for comparing entity names to impersonator names.
      type: Boolean
    - contextPath: ZeroFox.Entity.PolicyID
      description: The policy ID of the entity.
      type: Number
    - contextPath: ZeroFox.Entity.Profile
      description: A link to a profile resource, if applicable.
      type: String
    - contextPath: ZeroFox.Entity.EntityGroupID
      description: The ID of the entity group.
      type: Number
    - contextPath: ZeroFox.Entity.EntityGroupName
      description: The name of the entity group.
      type: String
    - contextPath: ZeroFox.Entity.TypeID
      description: The ID of the type of entity.
      type: Number
    - contextPath: ZeroFox.Entity.TypeName
      description: The name of the type of entity.
      type: String
  - name: zerofox-get-entity-types
    description: Shows a table of all entity type names and IDs in the War Room.
  - name: zerofox-get-policy-types
    description: Shows a table of all policy type names and IDs in the War Room.
  - name: zerofox-modify-alert-notes
    description: Modify the notes of a specified alert.
    arguments:
    - name: alert_id
      description: The ID of an alert. Can be retrieved running the zerofox-list-alerts command.
      required: true
    - name: notes
      description: The notes to add to an alert.
      required: true
    - name: action
      default: true
      defaultValue: replace
      description: Whether to replace or append new notes.
      auto: PREDEFINED
      predefined:
      - replace
      - append
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
  - name: zerofox-submit-threat
    description: Submits potential threats into the ZF alert registry for disruption.
    arguments:
    - name: source
      required: true
      auto: PREDEFINED
      description: Content to be considered a threat.
      type: keyValue
    - name: alert_type
      required: true
      auto: PREDEFINED
      description: Type of content acting as a threat, could be one of email, ip, domain, url, phone, mail_exchange, page_content or account.
      type: keyValue
    - name: violation
      required: true
      auto: PREDEFINED
      description: Type of infringement the submitted threat represents, could be one of phishing, malware, rogue_app, impersonation, trademark, copyright, private_data, fraud or other.
      type: keyValue
    - name: entity_id
      required: true
      auto: PREDEFINED
      description: Identifier of the entity being threatened by submitted content.
      type: keyValue
    - name: notes
      description: Additional notes to include in submission.
      type: textArea
    - name: request_takedown
      description: Whether to request a takedown of the submitted threat.
      type: boolean
      required: false
      defaultValue: false
    outputs:
    - contextPath: ZeroFox.Alert.AlertType
      description: The type of an alert.
      type: String
    - contextPath: ZeroFox.Alert.OffendingContentURL
      description: The URL to the site containing content that triggered an alert.
      type: String
    - contextPath: ZeroFox.Alert.Assignee
      description: The user to which an alert is assigned.
      type: String
    - contextPath: ZeroFox.Alert.Entity.ID
      description: The ID of the entity corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.Entity.Name
      description: The name of the entity corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.Entity.Image
      description: The URL to the profile image of the entity on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.ID
      description: The ID of the entity term corresponding to the triggered alert.
      type: Number
    - contextPath: ZeroFox.Alert.EntityTerm.Name
      description: The name of the entity term corresponding to the triggered alert.
      type: String
    - contextPath: ZeroFox.Alert.EntityTerm.Deleted
      description: Whether an entity term was deleted.
      type: Boolean
    - contextPath: ZeroFox.Alert.ContentCreatedAt
      description: The date-time string indicating when the alerted content was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.ID
      description: The ID of an alert.
      type: Number
    - contextPath: ZeroFox.Alert.RiskRating
      description: The risk rating of an alert. Can be "Critical", "High", "Medium", "Low", or "Info".
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Name
      description: For account, post, or page alerts, the perpetrator's social network account display name or the account from which the content was posted.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.URL
      description: The URL at which you can view the basic details of the perpetrator.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.Timestamp
      description: The timestamp of a post created by a perpetrator.
      type: Date
    - contextPath: ZeroFox.Alert.Perpetrator.Type
      description: The type of perpetrator on which an alert was created. Can be an account, page, or post.
      type: String
    - contextPath: ZeroFox.Alert.Perpetrator.ID
      description: The ZeroFox resource ID of the alert perpetrator.
      type: Number
    - contextPath: ZeroFox.Alert.Perpetrator.Network
      description: The network containing the offending content.
      type: String
    - contextPath: ZeroFox.Alert.RuleGroupID
      description: The ID of the rule group.
      type: Number
    - contextPath: ZeroFox.Alert.Status
      description: The status of an alert. Can be "Open", "Closed", "Takedown:Accepted", "Takedown:Denied", "Takedown:Requested" and "Whitelisted".
      type: String
    - contextPath: ZeroFox.Alert.Timestamp
      description: The date-time string when an alert was created, in ISO-8601 format.
      type: Date
    - contextPath: ZeroFox.Alert.RuleName
      description: The name of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: String
    - contextPath: ZeroFox.Alert.LastModified
      description: The date and time at which an alert was last modified.
      type: Date
    - contextPath: ZeroFox.Alert.DarkwebTerm
      description: Details about the dark web term on which an alert was created. Outputs "null" if the alert has no details.
      type: String
    - contextPath: ZeroFox.Alert.Reviewed
      description: Whether an alert was reviewed.
      type: Boolean
    - contextPath: ZeroFox.Alert.Escalated
      description: Whether an alert was escalated.
      type: Boolean
    - contextPath: ZeroFox.Alert.Network
      description: The network on which an alert was created.
      type: String
    - contextPath: ZeroFox.Alert.ProtectedSocialObject
      description: The protected object corresponding to an alert. If the alert occurred on an entity term, the protected object will be an entity term name. If the alert occurred on a protected account, (account information or an incoming or outgoing content), and it was network defined, the protected object will be an account username. If the alert was not network-defined, the protected object will default to the account's display name. Otherwise, the protected account will be an account display name. For impersonation alerts, the protected object is null.
      type: String
    - contextPath: ZeroFox.Alert.Notes
      description: Notes made on an alert.
      type: String
    - contextPath: ZeroFox.Alert.RuleID
      description: The ID of the rule on which an alert was created. Outputs "null" if the rule has been deleted.
      type: Number
    - contextPath: ZeroFox.Alert.Tags
      description: A list of an alert's tags.
      type: String
    - contextPath: ZeroFox.Alert.EntityAccount
      description: The account associated with the entity.
      type: String
    deprecated: false
    execution: false
  - name: zerofox-send-alert-attachment
    description: Sends an attachment to a specified alert.
    arguments:
    - name: alert_id
      required: true
      description: The ID of an alert. Can be retrieved running the zerofox-list-alerts command.
    - name: attachment_type
      description: The type of the attachment. Can be evidence "photo_id", "disruption_agreement", "trademark_information", "trademark"or "copyright".
      required: true
      auto: PREDEFINED
      predefined:
      - evidence
      - photo_id
      - disruption_agreement
      - trademark_information
      - trademark
      - copyright
    - name: entry_id
      description: The entry ID of the attachment.
      required: true
  - name: zerofox-get-alert-attachments
    deprecated: true
    description: Retrieves the attachments of a specified alert.
    arguments:
    - name: alert_id
      required: true
      description: The ID of an alert. Can be retrieved running the zerofox-list-alerts command.
    outputs:
    - contextPath: ZeroFox.AlertAttachments.ID
      description: The ID of an alert.
    - contextPath: ZeroFox.AlertAttachments.Name
      description: The name attachment of an alert.
  - name: zerofox-search-compromised-domain
    description: Looks for a given domain in Zerofox's CTI feeds.
    arguments:
    - name: domain
      required: true
      description: Domain to search.
      type: keyValue
    outputs:
    - contextPath: ZeroFox.CompromisedDomains.Domain
      type: string
      description: Domain in which the search domain was found.
    - contextPath: ZeroFox.CompromisedDomains.LastModified
      type: string
      description: Last time that the threat was found.
    - contextPath: ZeroFox.CompromisedDomains.IPs
      type: string
      description: Related domains to the threat separated by commas.
  - name: zerofox-search-compromised-email
    description: Looks for a given email in ZeroFox's CTI feeds.
    arguments:
    - name: email
      required: true
      auto: PREDEFINED
      description: email to search.
      type: keyValue
    outputs:
    - contextPath: ZeroFox.CompromisedEmails.Domain
      description: Domain in which the search domain was found.
      type: string
    - contextPath: ZeroFox.CompromisedEmails.Email
      description: Email involved in the threat.
      type: string
    - contextPath: ZeroFox.CompromisedEmails.CreatedAt
      description: Date in which the email was found related to a threat.
      type: string
  - name: zerofox-search-malicious-ip
    description: Looks for malicious ips in ZeroFox's CTI feeds.
    arguments:
    - name: ip
      required: true
      auto: PREDEFINED
      description: ip to search.
      type: keyValue
    outputs:
    - contextPath: ZeroFox.MaliciousIPs.Domain
      description: Domain in which the search domain was found.
      type: string
    - contextPath: ZeroFox.MaliciousIPs.IPAddress
      description: IP in which the search domain was found.
      type: string
    - contextPath: ZeroFox.MaliciousIPs.CreatedAt
      description: Date in which the ip was found related to a threat.
      type: string
  - name: zerofox-search-malicious-hash
    description: Looks for registered hashes in ZeroFox's CTI feeds.
    arguments:
    - name: hash
      required: true
      auto: PREDEFINED
      description: hash to search.
      type: keyValue
    outputs:
    - contextPath: ZeroFox.MaliciousHashes.CreatedAt
      description: Date in which the ip was found related to a threat.
      type: string
    - contextPath: ZeroFox.MaliciousHashes.Family
      description: Family related threat.
      type: string
    - contextPath: ZeroFox.MaliciousHashes.MD5
      description: Hash in MD5 format.
      type: string
    - contextPath: ZeroFox.MaliciousHashes.SHA1
      description: Hash in SHA1 format.
      type: string
    - contextPath: ZeroFox.MaliciousHashes.SHA256
      description: Hash in SHA256 format.
      type: string
    - contextPath: ZeroFox.MaliciousHashes.SHA512
      description: Hash in SHA512 format.
      type: string
    - contextPath: ZeroFox.MaliciousHashes.FoundHash
      description: Indicates in which hash format was found the search.
      type: string
  - name: zerofox-search-exploits
    description: Looks for registered exploits in ZeroFox's CTI feeds.
    arguments:
    - name: since
      required: true
      auto: PREDEFINED
      description: Staring date for exploit search.
      type: keyValue
    outputs:
    - contextPath: ZeroFox.Exploits.CreatedAt
      description: Date in which the ip was found related to a threat.
      type: string
    - contextPath: ZeroFox.Exploits.CVECode
      description: CVE Code to identify the exploit.
      type: string
    - contextPath: ZeroFox.Exploits.URLs
      description: URLs associated to the threat separated by commas.
      type: string
  - name: zerofox-get-compromised-credentials
    description: Gets compromised credentials data for a given ZeroFox alert and uploads it to the current investigation War Room.
    arguments:
    - name: alert_id
      required: true
      description: The ID of an alert. Can be retrieved running the zerofox-list-alerts command.
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  dockerimage: demisto/python3:3.12.13.8428455
  longRunning: false
  longRunningPort: false
  runonce: false
  script: "-"
  type: python
  subtype: python3
  isfetch: true
  ismappable: false
  isremotesyncin: true
  isremotesyncout: false
tests:
- ZeroFox-Test
fromversion: 5.0.0