KOI

KOI is an endpoint security platform that provides visibility and control over browser extensions, SaaS applications, and web-based threats.

Category

Endpoint

Pack

Koi

Configuration parameters

• url — Server URL (required)
• api_key — API Key (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetchEvents — Fetch events
• event_types_to_fetch — Fetch event types (required)
• audit_types_filter — Audit log type filter
• max_fetch — Maximum number of events per fetch
• eventFetchInterval — Events Fetch Interval

Commands (13)

• koi-allowlist-get — Retrieves all items in the allowlist.
• koi-allowlist-items-add — Adds one or more items to the global allowlist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk addition from a JSON file.
• koi-allowlist-items-remove — Removes one or more items from the global allowlist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk removal from a JSON file.
• koi-blocklist-get — Retrieves all items in the blocklist.
• koi-blocklist-items-add — Adds one or more items to the global blocklist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk addition from a JSON file.
• koi-blocklist-items-remove — Removes one or more items from the global blocklist. Provide either 'item_id' and 'marketplace' for a single item, or 'items_list_raw_json_entry_id' for bulk removal from a JSON file.
• koi-get-events — Gets events from KOI. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
• koi-inventory-item-endpoints-list — Retrieves a paginated list of endpoints that have a specific item installed.
• koi-inventory-item-get — Retrieves comprehensive details for a specific software item, extension, or package using its unique identifier, marketplace, and version.
• koi-inventory-list — Retrieves a paginated list of items installed across your organization's endpoints. Supports extensive filtering by marketplace, platform, risk level, publisher, and specific categories.
• koi-inventory-search — Searches inventory items using advanced query builder filters. Provide a filter via 'filter_json' (inline JSON string) or 'filter_raw_json_entry_id' (War Room file entry ID). At least one filter source must be provided.
• koi-policy-list — Retrieves a list of all policies. Use 'page' and 'page_size' to fetch a specific page, or use 'limit' to auto-paginate and collect up to the specified number of policies. If 'page' is provided, 'limit' is ignored.
• koi-policy-status-update — Enables or disables a policy by ID.