category: Cloud Services provider: Amazon description: Cloud integrations are installed from the **Data Sources** page. To configure a cloud integration, go to Settings > Data Sources and click "Add Data Source", select AWS, then in Advanced Settings > Security Capabilities, enable "Automation". display: Amazon Web Services name: AWS commonfields: id: AWS version: -1 configuration: - display: Access Key name: credentials displaypassword: Secret Key additionalinfo: "The AWS Access Key ID (username) and Secret Access Key (password) paired together. If a 'Role ARN' is also provided, these credentials will be used to call AWS STS AssumeRole to obtain temporary credentials." type: 9 section: Connect required: false - display: Role ARN name: role_arn type: 0 section: Connect required: false additionalinfo: "The full ARN of the role to assume via AWS STS, for example 'arn:aws:iam::123456789012:role/MyRole'." - display: Role Session Name name: role_session_name type: 0 defaultvalue: cortex-session section: Connect advanced: true additionalinfo: Role session name to be used for authentication - display: Role Session Duration name: session_duration type: 0 section: Connect advanced: true required: false additionalinfo: Max role session duration - display: Default AWS region. name: region type: 0 section: Connect additionalinfo: "The AWS region to use for API requests when a region is not explicitly specified in a command. This serves as the default region for operations across all AWS service-specific commands. Default value is us-east-1" - display: Timeout name: timeout type: 0 section: Connect advanced: true required: false additionalinfo: "The time in seconds until a timeout exception is reached. You can specify just the read timeout (for example 60) or the read and connect timeouts separated by a comma (for example 60,10). Default is 60,10." defaultvalue: 60,10 - display: Retries additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time." name: retries type: 0 section: Connect advanced: true required: false defaultvalue: '5' - display: PrivateLink service URL. name: endpoint_url type: 0 section: Connect advanced: true required: false - display: STS PrivateLink URL. name: sts_endpoint_url type: 0 section: Connect advanced: true required: false - display: AWS STS Regional Endpoints name: sts_regional_endpoint type: 15 section: Connect advanced: true required: false additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration. options: - legacy - regional - display: STS Region name: sts_region type: 15 section: Connect advanced: true required: false additionalinfo: The AWS region used to create the STS client. Set this explicitly when STS calls must target a fixed region regardless of the command's target region. options: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-1 - ap-south-2 - ap-northeast-1 - ap-northeast-2 - ap-northeast-3 - ap-southeast-1 - ap-southeast-2 - ap-southeast-3 - ap-southeast-4 - ap-southeast-5 - ap-southeast-7 - ca-central-1 - ca-west-1 - eu-central-1 - eu-central-2 - eu-north-1 - eu-south-1 - eu-south-2 - eu-west-1 - eu-west-2 - eu-west-3 - il-central-1 - me-central-1 - me-south-1 - mx-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - display: Role name for cross-organization account access name: access_role_name type: 0 section: Connect advanced: true required: false additionalinfo: The role name used to access accounts in the organization. This role name must exist in the accounts provided in "AWS Organization accounts" and be assumable with the credentials provided. - display: AWS organization accounts name: accounts_to_access type: 0 section: Connect advanced: true required: false additionalinfo: A comma-separated list of AWS organization accounts to use when running commands across multiple accounts. A role name for cross-organization account access must also be provided to use this feature. - display: Max concurrent command calls name: max_workers type: 0 section: Connect advanced: true required: false defaultvalue: '5' additionalinfo: The maximum number of concurrent calls to allow when running a command across the list of accounts provided in the AWS organization accounts field. - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false script: commands: - name: aws-s3-public-access-block-update description: "Creates or modifies the PublicAccessBlock configuration for an Amazon S3 bucket. Required IAM permission: s3:PutBucketPublicAccessBlock." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The name of the Amazon S3 bucket. name: bucket required: true - description: Whether Amazon S3 should block public access control lists (ACLs) for this bucket and objects in this bucket. name: block_public_acls auto: PREDEFINED predefined: - 'true' - 'false' - description: Whether Amazon S3 should ignore public ACLs for this bucket and objects in this bucket. name: ignore_public_acls auto: PREDEFINED predefined: - 'true' - 'false' - description: Whether Amazon S3 should block public bucket policies for this bucket. name: block_public_policy auto: PREDEFINED predefined: - 'true' - 'false' - description: Whether Amazon S3 should restrict public bucket policies for this bucket. name: restrict_public_buckets auto: PREDEFINED predefined: - 'true' - 'false' - name: aws-s3-bucket-delete description: "Delete AWS S3 bucket, the bucket must be empty from files. Required IAM Permission: s3:DeleteBucket." execution: true arguments: - description: The name of S3 bucket. name: bucket required: true - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: aws-s3-bucket-objects-list description: "Returns some or all (up to 1,000) of the objects in a bucket. Required IAM Permission: s3:ListBucket." arguments: - description: The name of S3 bucket. name: bucket required: true - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: A delimiter is a character (like a slash /) used to bundle files into folders. It turns a long list of file names into an organized, clickable hierarchy. name: delimiter - description: Restricts the response to include only those keys that begin with the specified string. This is commonly used to filter results to a specific folder or category. name: prefix - description: The next_token is the marker where you want Amazon S3 to start listing from. Amazon S3 starts listing after this specified key. Marker can be any key in the bucket. name: next_token - description: "Specifies the maximum number of keys to return in the response, ranging from 1 to 1,000. Default: 50." name: limit outputs: - contextPath: AWS.S3.Buckets.BucketName description: The name of S3 bucket. type: String - contextPath: AWS.S3.Buckets.Objects.Key description: The name of S3 object. type: String - contextPath: AWS.S3.Buckets.Objects.Size description: Object size in bytes. type: Number - contextPath: AWS.S3.Buckets.Objects.LastModified description: Last date object was modified. type: String - contextPath: AWS.S3.Buckets.Objects.StorageClass description: The storage class of the object. type: String - contextPath: AWS.S3.Buckets.Objects.ChecksumType description: The checksum algorithm used to calculate the object checksum. type: Array - contextPath: AWS.S3.Buckets.Objects.ETag description: The entity tag (hash) of the object. type: String - contextPath: AWS.S3.Buckets.ObjectsNextToken description: Token to use for pagination in subsequent requests. type: String - name: aws-s3-bucket-objects-list-v2 description: "Returns some or all (up to 1,000) of the objects in a bucket using the ListObjectsV2 API. Unlike aws-s3-bucket-objects-list, this command consistently returns a pagination token for truncated results, even when no delimiter is used. Required IAM Permission: s3:ListBucket." arguments: - name: bucket description: The name of S3 bucket. required: true - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: delimiter description: The delimiter character (like a slash /) used to bundle keys into folders, turning a long list of file names into an organized hierarchy. - name: prefix description: The string that restricts the response to include only those keys that begin with it. This is commonly used to filter results to a specific folder or category. - name: start_after description: The key to start listing after. Amazon S3 lists objects alphabetically and returns only keys that come after this value. This can be any key in the bucket. - name: next_token description: The continuation token indicating where Amazon S3 should continue listing from. Use the ObjectsNextToken value returned by a previous call to retrieve the next set of results. - name: limit description: The maximum number of keys to return in the response, ranging from 1 to 1,000. defaultValue: '50' outputs: - contextPath: AWS.S3.Buckets.BucketName description: The name of S3 bucket. type: String - contextPath: AWS.S3.Buckets.ObjectsV2.Key description: The name of S3 object. type: String - contextPath: AWS.S3.Buckets.ObjectsV2.Size description: The object size in bytes. type: Number - contextPath: AWS.S3.Buckets.ObjectsV2.LastModified description: 'The date and time the object was last modified, in ISO 8601 format (for example: 2023-01-01T12:00:00+00:00).' type: String - contextPath: AWS.S3.Buckets.ObjectsV2.StorageClass description: The storage class of the object. type: String - contextPath: AWS.S3.Buckets.ObjectsV2.ChecksumType description: The checksum algorithm used to calculate the object checksum. type: String - contextPath: AWS.S3.Buckets.ObjectsV2.ETag description: The entity tag (hash) of the object. type: String - contextPath: AWS.S3.Buckets.ObjectsV2NextToken description: The token to use for pagination in subsequent requests. type: String - name: aws-s3-bucket-acl-put description: "Sets the access control list (ACL) permissions for an existing Amazon S3 bucket. This command allows you to define who can access the bucket and what actions they can perform, using predefined ACLs. Since 2023, all new S3 buckets block ACLs by default for better security. Required IAM permission: s3:PutBucketAcl." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: acl description: 'The canned ACL to apply to the bucket.' required: true auto: PREDEFINED predefined: - private - public-read - public-read-write - authenticated-read - name: bucket description: 'The bucket to which to apply the ACL.' required: true - name: aws-s3-bucket-acl-set-to-private-quick-action description: "Sets the Access Control List (ACL) for the S3 bucket to private. Required IAM permission: s3:PutBucketAcl." prettyname: Set Bucket ACL to Private hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: bucket prettyname: Bucket Name description: 'The bucket to which to apply the ACL.' required: true defaultValue: Bucket Name prettypredefined: Bucket Name: ${asset.xdm.asset.name} - name: acl description: 'The canned ACL to apply to the bucket.' defaultValue: 'private' hidden: true - name: aws-s3-bucket-logging-put description: "Configures logging settings for an AWS S3 bucket, enabling monitoring bucket access via logs delivered to a designated target bucket. Required IAM permission: s3:PutBucketLogging." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: 'The name of the bucket for which to set the logging parameters.' name: bucket required: true - description: 'The name of the bucket where server access logs should be delivered. If this is NOT provided, logging will be disabled.' name: target_bucket required: false - description: 'The prefix to be used for log object keys (e.g., "logs/"). Objects will be stored as: targetBucket/targetPrefix/sourceBucket/YYYY-MM-DD-HH-MM-SS-UniqueString.' name: target_prefix required: false - name: aws-s3-bucket-enable-bucket-access-logging-quick-action description: "Enables server access logging for the S3 bucket, delivering logs to a target bucket and prefix. Required IAM permission: s3:PutBucketLogging." prettyname: Enable S3 Access Logging hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: bucket prettyname: Bucket Name description: The name of the bucket for which to set the logging parameters. required: true defaultValue: Bucket Name prettypredefined: Bucket Name: ${asset.xdm.asset.name} - name: target_bucket description: 'The name of the bucket where server access logs should be delivered. If this is NOT provided, logging will be disabled.' defaultValue: ${asset.xdm.asset.name} hidden: true - name: target_prefix description: 'The prefix to be used for log object keys (e.g., "logs/"). Objects will be stored as: targetBucket/targetPrefix/sourceBucket/YYYY-MM-DD-HH-MM-SS-UniqueString.' defaultValue: "AWSLogs/" hidden: true - name: aws-s3-bucket-versioning-put description: "Sets the versioning state of an existing bucket. Required IAM permission: s3:PutBucketVersioning." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The name of the bucket for which to set the logging parameters. name: bucket required: true - description: Whether MFA delete is enabled in the bucket versioning configuration. This element is only returned if the bucket has been configured with MFA delete. If the bucket has never been so configured, this element is not returned. name: mfa_delete required: false - auto: PREDEFINED description: The versioning state of the bucket. name: status predefined: - 'Enabled' - 'Suspended' required: true - name: aws-s3-bucket-versioning-enable-quick-action description: "Enables versioning on the S3 bucket to retain multiple versions of objects. Required IAM permission: s3:PutBucketVersioning." prettyname: Enable S3 Versioning hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: bucket prettyname: Bucket Name description: The name of the bucket for which to set the logging parameters. required: true defaultValue: Bucket Name prettypredefined: Bucket Name: ${asset.xdm.asset.name} - name: status description: The versioning state of the bucket. defaultValue: 'Enabled' hidden: true - name: aws-s3-bucket-policy-put description: "Applies an Amazon S3 bucket policy to an Outposts bucket. Required IAM permission: s3:PutBucketPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: bucket description: 'The name of the bucket to which the policy will be applied.' required: true - name: policy description: 'The bucket policy to apply as a JSON string.' required: true - name: aws-s3-bucket-policy-put-quick-action description: "Enforces SSL-only access on the S3 bucket by applying a bucket policy that denies all non-HTTPS requests. Required IAM permission: s3:PutBucketPolicy." prettyname: Enforce SSL Only on Bucket hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: bucket description: The name of the bucket to which the policy will be applied. prettyname: Bucket Name required: true defaultValue: Bucket Name prettypredefined: Bucket Name: ${asset.xdm.asset.name} - name: policy description: The bucket policy to apply as a JSON string. defaultValue: '{"Version":"2012-10-17","Statement":[{"Sid":"ForceSSLOnlyAccess","Effect":"Deny","Principal":"*","Action":"s3:*","Resource":["arn:aws:s3:::${asset.xdm.asset.name}","arn:aws:s3:::${asset.xdm.asset.name}/*"],"Condition":{"Bool":{"aws:SecureTransport":"false"}}}]}' hidden: true - name: aws-s3-bucket-website-delete description: "Removes the website configuration for a bucket. Required IAM permission: s3:DeleteBucketWebsite." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: bucket description: The name of the S3 bucket from which the website configuration will be removed. required: true - name: aws-s3-bucket-website-disable-hosting-quick-action description: "Removes the static website hosting configuration from an S3 bucket. Required IAM permission: s3:DeleteBucketWebsite." prettyname: Disable S3 Website Hosting hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: bucket prettyname: Bucket Name description: The name of the S3 bucket from which the website configuration will be removed. required: true defaultValue: Bucket Name prettypredefined: Bucket Name: ${asset.xdm.asset.name} - name: aws-s3-bucket-ownership-controls-put description: "Creates or modifies ownership controls for an Amazon S3 bucket. Required IAM permission: s3:PutBucketOwnershipControls." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: bucket description: The name of the Amazon S3 bucket for which to configure Ownership Controls. required: true - name: ownership_controls_rule description: Ownership for a bucket's ownership controls. required: true auto: PREDEFINED predefined: - BucketOwnerPreferred - ObjectWriter - BucketOwnerEnforced - name: aws-s3-bucket-ownership-controls-put-quick-action description: 'Switches the bucket to "Bucket Owner Enforced" mode, placing all access control under your account policies. Required IAM permission: s3:PutBucketOwnershipControls.' prettyname: Set S3 ACL to BucketOwnerEnforced hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: bucket description: The name of the S3 bucket to configure with Ownership Controls. prettyname: Bucket Name required: true defaultValue: Bucket Name prettypredefined: Bucket Name: ${asset.xdm.asset.name} - name: ownership_controls_rule description: Specifies the ownership setting for objects uploaded to the bucket. defaultValue: 'BucketOwnerEnforced' hidden: true - name: aws-s3-bucket-website-get description: "Retrieves the website configuration for a bucket. Required IAM permission: s3:GetBucketWebsite." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: bucket description: The bucket name for which to get the website configuration. required: true outputs: - contextPath: AWS.S3.Buckets.BucketWebsite.ErrorDocument description: The object key name of the website error document to use for 4XX class errors. type: Object - contextPath: AWS.S3.Buckets.BucketWebsite.IndexDocument description: The name of the index document for the website (for example index.html). type: Object - contextPath: AWS.S3.Buckets.BucketWebsite.RedirectAllRequestsTo description: The redirect behavior of all requests to a website endpoint of an Amazon S3 bucket. type: Object - contextPath: AWS.S3.Buckets.BucketWebsite.RoutingRules description: The rules that define when a redirect is applied and the redirect behavior. type: Array - name: aws-s3-bucket-acl-get description: "Retrieves the access control list (ACL) of a bucket. Required IAM permission: s3:GetBucketAcl." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: bucket description: Specifies the S3 bucket whose ACL is being requested. required: true outputs: - contextPath: AWS.S3.Buckets.BucketAcl.Grants description: The list of grants. type: Array - contextPath: AWS.S3.Buckets.BucketAcl.Owner description: The container for the bucket owner's display name and ID. type: Object - name: aws-iam-account-password-policy-get description: "Retrieves the AWS account password policy. Required IAM permission: iam:GetAccountPasswordPolicy." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 outputs: - contextPath: AWS.IAM.PasswordPolicy.MinimumPasswordLength description: Minimum length to require for IAM user passwords. type: number - contextPath: AWS.IAM.PasswordPolicy.RequireSymbols description: Whether IAM user passwords must contain at least one of the symbols. type: boolean - contextPath: AWS.IAM.PasswordPolicy.RequireNumbers description: Whether IAM user passwords must contain at least one numeric character (0 to 9). type: boolean - contextPath: AWS.IAM.PasswordPolicy.RequireUppercaseCharacters description: Whether IAM user passwords must contain at least one uppercase character (A to Z). type: boolean - contextPath: AWS.IAM.PasswordPolicy.RequireLowercaseCharacters description: Whether IAM user passwords must contain at least one lowercase character (a to z). type: boolean - contextPath: AWS.IAM.PasswordPolicy.AllowUsersToChangePassword description: Whether IAM users are allowed to change their own password. type: boolean - contextPath: AWS.IAM.PasswordPolicy.ExpirePasswords description: Whether passwords in the account expire. type: boolean - contextPath: AWS.IAM.PasswordPolicy.MaxPasswordAge description: The number of days that an IAM user password is valid. type: number - contextPath: AWS.IAM.PasswordPolicy.PasswordReusePrevention description: The number of previous passwords that IAM users are prevented from reusing. type: number - contextPath: AWS.IAM.PasswordPolicy.HardExpiry description: Whether IAM users are prevented from setting a new password via the Amazon Web Services Management Console after their password has expired. type: boolean - name: aws-iam-account-password-policy-update description: "Creates or updates AWS account password policy. Required IAM permission: iam:UpdateAccountPasswordPolicy." execution: true arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The minimum number of characters allowed in an IAM user password. name: minimum_password_length - auto: PREDEFINED description: Whether IAM user passwords must contain at least one of the non-alphanumeric characters. name: require_symbols predefined: - 'true' - 'false' - auto: PREDEFINED description: Whether IAM user passwords must contain at least one numeric character (0 to 9). name: require_numbers predefined: - 'true' - 'false' - auto: PREDEFINED description: Whether IAM user passwords must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). Can be "True" or "False". name: require_uppercase_characters predefined: - 'true' - 'false' - auto: PREDEFINED description: Whether IAM user passwords must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). Can be "True" or "False". name: require_lowercase_characters predefined: - 'true' - 'false' - auto: PREDEFINED description: Allows all IAM users in your account to use the AWS Management Console to change their own passwords. Can be "True" or "False". name: allow_users_to_change_password predefined: - 'true' - 'false' - description: The number of days that an IAM user password is valid. name: max_password_age - description: The number of previous passwords that IAM users are prevented from reusing. name: password_reuse_prevention - auto: PREDEFINED description: Prevents IAM users from setting a new password after their password has expired. Can be "True" or "False". name: hard_expiry predefined: - 'true' - 'false' - name: aws-iam-role-policy-put description: "Adds or updates an inline policy document that is embedded in the specified IAM role. Required IAM permission: iam:PutRolePolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: role_name description: 'The name of the role to associate the policy with. This parameter accepts a string of upper and lowercase letters and numbers, with no spaces. You can also include any of the following characters: _+=,.@-.' required: true - name: policy_name description: 'The name of the policy document. This parameter accepts a string of upper and lowercase letters and numbers, with no spaces. You can also include any of the following characters: _+=,.@-.' required: true - name: policy_document description: 'The policy document in JSON format. Must be a valid IAM policy document that defines the permissions for the role.' required: true - name: aws-iam-login-profile-delete description: "Deletes the password for the specified IAM user, which terminates the user's ability to access AWS services through the AWS Management Console. Required IAM permission: iam:DeleteLoginProfile." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: user_name description: The name of the user whose password you want to delete. required: true - name: aws-iam-user-policy-put description: "Adds or updates an inline policy document that is embedded in the specified IAM user. Required IAM permission: iam:PutUserPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: user_name description: The name of the user to associate the policy with. required: true - name: policy_name description: The name of the policy document. required: true - name: policy_document description: The policy document in JSON format. Must be a valid IAM policy document that defines the permissions for the user. required: true - name: aws-iam-role-from-instance-profile-remove description: "Removes the specified IAM role from the specified EC2 instance profile. Required IAM permission: iam:RemoveRoleFromInstanceProfile." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: instance_profile_name description: The name of the instance profile to update. required: true - name: role_name description: The name of the role to remove. required: false - name: aws-iam-access-key-update description: "Changes the status of the specified access key from Active to Inactive, or vice versa. Can be used to disable a user's access key as part of a key rotation workflow. Required IAM permission: iam:UpdateAccessKey." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: access_key_id description: The access key ID of the secret access key you want to update. required: true - name: status description: The status you want to assign to the secret access key. required: true auto: PREDEFINED predefined: - 'Active' - 'Inactive' - name: user_name description: The name of the user whose key you want to update. If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID signing the request. required: false - name: aws-eks-cluster-config-update description: 'Updates an Amazon EKS cluster configuration. Only one type of update is allowed per call (logging or resources_vpc_config). Required IAM permission: eks:UpdateClusterConfig.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: cluster_name description: 'The name of the Amazon EKS cluster to update.' required: true - name: logging description: "Enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren’t exported to CloudWatch Logs. For example \"{'clusterLogging': [{'types': ['api', 'audit', 'authenticator', 'controllerManager', 'scheduler'], 'enabled': true}]}\"." required: false - name: resources_vpc_config description: "A JSON representation of the VPC configuration used by the cluster control plane. For example \"{'subnetIds': ['string'], 'securityGroupIds': ['string'], 'endpointPublicAccess': True, 'endpointPrivateAccess': True, 'publicAccessCidrs': ['string']}\"." required: false - name: aws-eks-enable-control-plane-logging-quick-action description: "Enables control plane logging for an EKS cluster. Required IAM permission: eks:UpdateClusterConfig." prettyname: Enable Control Plane Logging hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: cluster_name prettyname: EKS Cluster description: The name of the Amazon EKS cluster to update. required: true defaultValue: EKS Cluster prettypredefined: EKS Cluster: ${asset.xdm.asset.name} - name: logging description: "Enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren’t exported to CloudWatch Logs. For example \"{'clusterLogging': [{'types': ['api', 'audit', 'authenticator', 'controllerManager', 'scheduler'], 'enabled': true}]}\"." defaultValue: '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}' hidden: true - name: aws-eks-disable-public-access-quick-action description: "Disables public access to the EKS cluster's API endpoint, making it only accessible from within the cluster's VPC. Required IAM permission: eks:UpdateClusterConfig." prettyname: Set EKS Cluster to Private hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: cluster_name prettyname: EKS Cluster description: The name of the Amazon EKS cluster to update. required: true defaultValue: EKS Cluster prettypredefined: EKS Cluster: ${asset.xdm.asset.name} - name: resources_vpc_config description: "A JSON representation of the VPC configuration used by the cluster control plane. For example \"{'subnetIds': ['string'], 'securityGroupIds': ['string'], 'endpointPublicAccess': True, 'endpointPrivateAccess': True, 'publicAccessCidrs': ['string']}\"." defaultValue: '{"endpointPublicAccess": false, "endpointPrivateAccess": true}' hidden: true - name: aws-eks-cluster-describe description: "Returns details for an Amazon EKS cluster. Required IAM permission: eks:DescribeCluster." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: cluster_name description: The name of the cluster to describe. required: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. auto: PREDEFINED required: false required:platform: true predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 outputs: - contextPath: AWS.EKS.Cluster.name description: The name of your cluster. type: String - contextPath: AWS.EKS.Cluster.arn description: The Amazon Resource Name (ARN) of the cluster. type: String - contextPath: AWS.EKS.Cluster.createdAt description: The creation date of the object. type: String - contextPath: AWS.EKS.Cluster.version description: The Kubernetes server version for the cluster. type: String - contextPath: AWS.EKS.Cluster.endpoint description: The endpoint for your Kubernetes API server. type: String - contextPath: AWS.EKS.Cluster.roleArn description: The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to Amazon Web Services API operations on your behalf. type: String - contextPath: AWS.EKS.Cluster.resourcesVpcConfig.subnetIds description: The subnets associated with your cluster. type: List - contextPath: AWS.EKS.Cluster.resourcesVpcConfig.securityGroupIds description: The security groups associated with the cross-account elastic network interfaces that are used to allow communication between your nodes and the Kubernetes control plane. type: List - contextPath: AWS.EKS.Cluster.resourcesVpcConfig.clusterSecurityGroupId description: The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. type: String - contextPath: AWS.EKS.Cluster.resourcesVpcConfig.vpcId description: The VPC associated with your cluster. type: String - contextPath: AWS.EKS.Cluster.resourcesVpcConfig.endpointPublicAccess description: Whether the public API server endpoint is enabled. type: Boolean - contextPath: AWS.EKS.Cluster.resourcesVpcConfig.endpointPrivateAccess description: This parameter indicates whether the Amazon EKS private API server endpoint is enabled. type: Boolean - contextPath: AWS.EKS.Cluster.resourcesVpcConfig.publicAccessCidrs description: The CIDR blocks that are allowed access to your cluster’s public Kubernetes API server endpoint. type: List - contextPath: AWS.EKS.Cluster.kubernetesNetworkConfig.serviceIpv4Cidr description: The CIDR block that Kubernetes Pod and Service object IP addresses are assigned from. type: String - contextPath: AWS.EKS.Cluster.kubernetesNetworkConfig.serviceIpv6Cidr description: The CIDR block that Kubernetes Pod and Service IP addresses are assigned from if you created a 1.21 or later cluster with version 1.10.1 or later of the Amazon VPC CNI add-on and specified ipv6 for ipFamily when you created the cluster. type: String - contextPath: AWS.EKS.Cluster.kubernetesNetworkConfig.ipFamily description: The IP family used to assign Kubernetes Pod and Service objects IP addresses. type: String - contextPath: AWS.EKS.Cluster.logging.clusterLogging description: The cluster control plane logging configuration for your cluster. type: Object - contextPath: AWS.EKS.Cluster.identity description: The identity provider information for the cluster. type: Object - contextPath: AWS.EKS.Cluster.status description: The current status of the cluster. type: String - contextPath: AWS.EKS.Cluster.certificateAuthority.data description: The Base64-encoded certificate data required to communicate with your cluster. type: String - contextPath: AWS.EKS.Cluster.clientRequestToken description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. type: String - contextPath: AWS.EKS.Cluster.platformVersion description: The platform version of your Amazon EKS cluster. type: String - contextPath: AWS.EKS.Cluster.tags description: A dictionary containing metadata for categorization and organization. type: Object - contextPath: AWS.EKS.Cluster.encryptionConfig.resources description: Specifies the resources to be encrypted. The only supported value is secrets. type: List - contextPath: AWS.EKS.Cluster.encryptionConfig.provider description: Key Management Service (KMS) key. type: Object - contextPath: AWS.EKS.Cluster.connectorConfig.activationId description: A unique ID associated with the cluster for registration purposes. type: String - contextPath: AWS.EKS.Cluster.connectorConfig.activationCode description: A unique code associated with the cluster for registration purposes. type: String - contextPath: AWS.EKS.Cluster.connectorConfig.activationExpiry description: The expiration time of the connected cluster. type: String - contextPath: AWS.EKS.Cluster.connectorConfig.provider description: The cluster’s cloud service provider. type: String - contextPath: AWS.EKS.Cluster.connectorConfig.roleArn description: The Amazon Resource Name (ARN) of the role to communicate with services from the connected Kubernetes cluster. type: String - contextPath: AWS.EKS.Cluster.id description: The ID of your local Amazon EKS cluster on an Amazon Web Services Outpost. type: String - contextPath: AWS.EKS.Cluster.health.issues description: An object representing the health issues of your local Amazon EKS cluster on an Amazon Web Services Outpost. type: List - contextPath: AWS.EKS.Cluster.outpostConfig.outpostArns description: An object representing the configuration of your local Amazon EKS cluster on an Amazon Web Services Outpost. type: Object - contextPath: AWS.EKS.Cluster.outpostConfig.controlPlaneInstanceType description: The Amazon EC2 instance type used for the control plane. type: String - contextPath: AWS.EKS.Cluster.outpostConfig.controlPlanePlacement description: An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on an Amazon Web Services Outpost. type: Object - contextPath: AWS.EKS.Cluster.accessConfig.bootstrapClusterCreatorAdminPermissions description: Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time. type: Boolean - contextPath: AWS.EKS.Cluster.accessConfig.authenticationMode description: The current authentication mode of the cluster. type: String - name: aws-eks-access-policy-associate description: "Associates an access policy and its scope to an access entry. Required IAM permission: eks:AssociateAccessPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: cluster_name description: The name of the cluster for which to create an access entry. required: true - name: principal_arn description: 'The Amazon Resource Name (ARN) of the IAM user or role for the AccessEntry that you’re associating the access policy to.' required: true - name: policy_arn description: 'The ARN of the AccessPolicy that you’re associating.' required: true - name: type description: 'The scope type of an access policy.' required: true auto: PREDEFINED predefined: - cluster - namespace - name: namespaces description: 'A comma-separated list of Kubernetes namespaces that an access policy is scoped to. A value is required if you specified namespace for type.' required: false - auto: PREDEFINED description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 outputs: - contextPath: AWS.EKS.AssociatedAccessPolicy.clusterName description: The name of your cluster. type: String - contextPath: AWS.EKS.AssociatedAccessPolicy.principalArn description: The ARN of the IAM principal for the AccessEntry. type: String - contextPath: AWS.EKS.AssociatedAccessPolicy.policyArn description: The ARN of the AccessPolicy. type: String - contextPath: AWS.EKS.AssociatedAccessPolicy.accessScope.type description: The scope type of an access policy. type: String - contextPath: AWS.EKS.AssociatedAccessPolicy.accessScope.namespaces description: A Kubernetes namespace that an access policy is scoped to. type: String - contextPath: AWS.EKS.AssociatedAccessPolicy.associatedAt description: The date and time the AccessPolicy was associated with an AccessEntry. type: String - contextPath: AWS.EKS.AssociatedAccessPolicy.modifiedAt description: The date and time for the last modification to the object. type: String - name: aws-eks-access-entry-update description: "Updates an existing Access Entry for an Amazon EKS cluster. Required IAM Permission: eks:UpdateAccessEntry." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: cluster_name description: The name of the cluster for which to update the AccessEntry. required: true - name: principal_arn description: The ARN of the IAM principal to associate with the access entry. required: true - name: kubernetes_groups description: The Kubernetes groups that the access entry is associated with. required: false isArray: true - name: client_request_token description: The unique string used to ensure the request is processed only once. required: false - name: user_name description: The username for Kubernetes authentication. required: false outputs: - contextPath: AWS.EKS.AccessEntry.clusterName description: The name of the cluster. type: String - contextPath: AWS.EKS.AccessEntry.principalArn description: The ARN of the IAM principal for the access entry. type: String - contextPath: AWS.EKS.AccessEntry.username description: The Kubernetes user name for the access entry. type: String - contextPath: AWS.EKS.AccessEntry.type description: The access entry type. type: String - contextPath: AWS.EKS.AccessEntry.createdAt description: The date and time the access entry was created. type: String - contextPath: AWS.EKS.AccessEntry.modifiedAt description: The date and time the access entry was last modified. type: String - contextPath: AWS.EKS.AccessEntry.kubernetesGroups description: The Kubernetes groups that the access entry is associated with. type: Array - contextPath: AWS.EKS.AccessEntry.tags description: The metadata tags associated with the access entry. type: Object - contextPath: AWS.EKS.AccessEntry.accessEntryArn description: The ARN of the access entry. type: String - name: aws-eks-access-entry-create description: "Creates a new Access Entry for an Amazon EKS cluster. Required IAM Permissions: eks:CreateAccessEntry, eks:TagResource (only when the tags argument is provided)." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: cluster_name description: The name of the cluster for which to create an access entry. required: true - name: principal_arn description: The ARN of the IAM principal to associate with the access entry. required: true - name: kubernetes_groups description: A comma-separated list of names for Kubernetes groups in RoleBindings or ClusterRoleBindings. required: false isArray: true - name: client_request_token description: The unique string used to ensure the request is processed only once. required: false - name: type description: The type of access entry to create. required: false auto: PREDEFINED predefined: - Standard - FARGATE_LINUX - EC2_LINUX - EC2_WINDOWS - EC2 - HYBRID_LINUX - HYPERPOD_LINUX - name: user_name description: The username for Kubernetes authentication. required: false - name: tags description: "The metadata tags to apply to the access entry. Format: key=,value=;key=,value=." required: false outputs: - contextPath: AWS.EKS.AccessEntry.clusterName description: The name of the cluster. type: String - contextPath: AWS.EKS.AccessEntry.principalArn description: The ARN of the IAM principal for the access entry. type: String - contextPath: AWS.EKS.AccessEntry.username description: The Kubernetes user name for the access entry. type: String - contextPath: AWS.EKS.AccessEntry.type description: The access entry type. type: String - contextPath: AWS.EKS.AccessEntry.createdAt description: The date and time the access entry was created. type: String - contextPath: AWS.EKS.AccessEntry.modifiedAt description: The date and time the access entry was last modified. type: String - contextPath: AWS.EKS.AccessEntry.kubernetesGroups description: The Kubernetes groups that the access entry is associated with. type: Array - contextPath: AWS.EKS.AccessEntry.tags description: The metadata tags associated with the access entry. type: Object - contextPath: AWS.EKS.AccessEntry.accessEntryArn description: The ARN of the access entry. type: String - name: aws-eks-clusters-list description: "Returns a list of EKS clusters. Required IAM Permission: eks:ListClusters." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: limit description: The maximum number of clusters returned in response. Possible values are between 1 and 100. required: false defaultValue: 50 - name: next_token description: The nextToken value returned from a previous paginated ListClusters request. Use the value from AWS.EKS.ClustersNextToken. required: false - name: include description: Whether external clusters are included in the returned list. Set to 'all' to include connected clusters. required: false isArray: true outputs: - contextPath: AWS.EKS.Clusters description: A list of all of the clusters for your account in the specified Region. type: String - contextPath: AWS.EKS.ClustersNextToken description: The nextToken value to include in a future ListClusters request. When the results of a ListClusters request exceed maxResults, you can use this value to retrieve the next page of results. type: String - name: aws-rds-db-cluster-modify description: "Modifies settings for an Amazon RDS DB cluster. Allows you to update cluster settings such as port, master credentials, VPC security groups, deletion protection, and other configuration options. Required IAM Permission: rds:ModifyDBCluster." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: db_cluster_identifier description: 'The DB cluster identifier for the modified cluster. This parameter is not case sensitive and is valid for Aurora DB and Multi-AZ DB cluster types. It must match the identifier of an existing DB cluster.' required: true - name: deletion_protection description: 'Whether the DB cluster has deletion protection enabled. The database can’t be deleted when deletion protection is enabled. By default, deletion protection isn’t enabled.' auto: PREDEFINED predefined: - 'true' - 'false' - name: enable_iam_database_authentication description: 'Whether to enable mapping of Amazon Web Services Identity and Access Management (IAM) accounts to database accounts. By default, mapping isn’t enabled.' auto: PREDEFINED predefined: - 'true' - 'false' - name: aws-rds-db-cluster-enable-iam-auth-quick-action description: "Enables 'iam database authentication' for the RDS cluster. Required IAM permission: rds:ModifyDBCluster." prettyname: Enable IAM Authentication on RDS Cluster hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_cluster_identifier prettyname: RDS Cluster ID description: 'The DB cluster identifier for the modified cluster. This parameter is not case sensitive and is valid for Aurora DB and Multi-AZ DB cluster types. It must match the identifier of an existing DB cluster.' required: true defaultValue: RDS Cluster ID prettypredefined: RDS Cluster ID: ${asset.xdm.asset.name} - name: enable_iam_database_authentication description: 'Whether to enable mapping of Amazon Web Services Identity and Access Management (IAM) accounts to database accounts. By default, mapping isn’t enabled.' defaultValue: 'true' hidden: true - name: aws-rds-db-cluster-snapshot-attribute-modify description: "Modifies the attributes associated with a DB cluster snapshot. Required IAM permission: rds:ModifyDBClusterSnapshotAttribute." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: db_cluster_snapshot_identifier description: 'The identifier for the DB cluster snapshot to modify the attributes for.' required: true - name: attribute_name description: 'The name of the DB cluster snapshot attribute to modify.' required: true - name: values_to_remove description: 'A CSV list of DB cluster snapshot attributes to remove from the attribute specified by AttributeName. Default is all.' required: false - name: values_to_add description: 'A CSV list of DB cluster snapshot attributes to add to the attribute specified by AttributeName.' required: false - name: aws-rds-db-cluster-snapshot-set-to-private-quick-action description: "Revokes public access to the RDS DB cluster snapshot, making it private. Required IAM permission: rds:ModifyDBClusterSnapshotAttribute." prettyname: Set RDS Cluster Snapshot to Private hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_cluster_snapshot_identifier prettyname: RDS Cluster Snapshot ID description: 'The identifier for the DB cluster snapshot to modify the attributes for.' required: true defaultValue: RDS Cluster Snapshot ID prettypredefined: RDS Cluster Snapshot ID: ${asset.xdm.asset.name} - name: attribute_name description: 'The name of the DB cluster snapshot attribute to modify.' defaultValue: 'restore' hidden: true - name: values_to_remove description: 'A CSV list of DB cluster snapshot attributes to remove from the attribute specified by AttributeName. The default value is all.' defaultValue: 'all' hidden: true - name: aws-rds-db-cluster-enable-deletion-protection-quick-action description: "Enables deletion protection for the RDS DB cluster to prevent accidental deletion. Required IAM permission: rds:ModifyDBCluster." prettyname: Enable RDS Cluster Deletion Protection hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_cluster_identifier prettyname: RDS Cluster ID description: 'The DB cluster identifier for the modified cluster. This parameter is not case sensitive and is valid for Aurora DB and Multi-AZ DB cluster types. It must match the identifier of an existing DB cluster.' required: true defaultValue: RDS Cluster ID prettypredefined: RDS Cluster ID: ${asset.xdm.asset.name} - name: deletion_protection description: 'Whether the DB cluster has deletion protection enabled. The database can’t be deleted when deletion protection is enabled. By default, deletion protection isn’t enabled.' defaultValue: 'true' hidden: true - name: aws-rds-db-instance-modify description: "Modifies an existing Amazon RDS DB instance. Enables updating the instance class, storage capacity, security groups, and other configuration parameters without the need to create a new instance. Required IAM permission: rds:ModifyDBInstance." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: db_instance_identifier description: 'The identifier of DB instance to modify. This value is stored as a lowercase string.' required: true - name: publicly_accessible description: 'Whether the DB instance is publicly accessible.' required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: apply_immediately description: 'Whether the modifications in this request and any pending modifications are asynchronously applied as soon as possible, regardless of the PreferredMaintenanceWindow setting for the DB instance. By default, this parameter is disabled. If this parameter is disabled, changes to the DB instance are applied during the next maintenance window. Some parameter changes can cause an outage and are applied on the next call to RebootDBInstance , or the next failure reboot.' required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: copy_tags_to_snapshot description: 'Whether to copy all tags from the DB instance to snapshots of the DB instance. By default, tags aren’t copied.' required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: backup_retention_period description: 'The number of days to retain automated backups. Setting this parameter to a positive number enables backups. Setting this parameter to 0 disables automated backups.' required: false - name: enable_iam_database_authentication description: 'Whether to enable mapping of Amazon Web Services Identity and Access Management (IAM) accounts to database accounts. By default, mapping isn’t enabled.' required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: deletion_protection description: 'Whether the DB instance has deletion protection enabled. The database can’t be deleted when deletion protection is enabled. By default, deletion protection isn’t enabled. For more information, see Deleting a DB Instance.' required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: auto_minor_version_upgrade description: 'Specifies whether minor version upgrades are applied automatically to the DB instance during the maintenance window. Behavior: An outage occurs only if automatic upgrades are enabled for the maintenance window, a newer minor version is available, and RDS has enabled automatic patching for the engine version; otherwise, changes are applied as soon as possible without causing an outage. Note: Do not enable for RDS Custom DB instances (operation will fail).' required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: multi_az description: 'Behavior: Specifies whether the DB instance is a Multi-AZ deployment. Changing this parameter does not cause an outage and is applied during the next maintenance window unless ApplyImmediately is enabled. Not applicable to RDS Custom DB instances.' required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: vpc_security_group_ids description: "A list of Amazon EC2 VPC security groups to associate with this DB instance. This setting doesn’t apply to the following DB instances: Amazon Aurora, RDS Custom." required: false - name: aws-rds-db-instance-modify-publicly-accessible-quick-action description: "Disables public access for AWS RDS database instance by modifying the instance settings. Required IAM permission: rds:ModifyDBInstance." prettyname: Disable Public Access on RDS hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_instance_identifier prettyname: RDS Instance ID description: 'The identifier of DB instance to modify.' required: true defaultValue: RDS Instance ID prettypredefined: RDS Instance ID: ${asset.xdm.asset.name} - name: publicly_accessible description: 'Whether the DB instance is publicly accessible.' defaultValue: 'false' hidden: true - name: apply_immediately description: 'Whether the modifications in this request and any pending modifications are asynchronously applied as soon as possible, regardless of the PreferredMaintenanceWindow setting for the DB instance. By default, this parameter is disabled. If this parameter is disabled, changes to the DB instance are applied during the next maintenance window. Some parameter changes can cause an outage and are applied on the next call to RebootDBInstance, or the next failure reboot.' defaultValue: 'true' hidden: true - name: aws-rds-db-instance-modify-copy-tags-on-rds-snapshot-quick-action description: "Enables 'copy tags to snapshots' for the RDS instance. Required IAM permission: rds:ModifyDBInstance." prettyname: Enable Copy Tags on RDS Snapshot hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_instance_identifier prettyname: RDS Instance ID description: 'The identifier of DB instance to modify.' required: true defaultValue: RDS Instance ID prettypredefined: RDS Instance ID: ${asset.xdm.asset.name} - name: copy_tags_to_snapshot description: 'Whether to copy all tags from the DB instance to snapshots of the DB instance. By default, tags aren’t copied.' defaultValue: 'true' hidden: true - name: apply_immediately description: 'Whether the modifications in this request and any pending modifications are asynchronously applied as soon as possible, regardless of the PreferredMaintenanceWindow setting for the DB instance. By default, this parameter is disabled. If this parameter is disabled, changes to the DB instance are applied during the next maintenance window. Some parameter changes can cause an outage and are applied on the next call to RebootDBInstance, or the next failure reboot.' defaultValue: 'true' hidden: true - name: aws-rds-db-instance-modify-enable-automatic-backup-quick-action description: "Enables automatic backup settings for the RDS DB instance with a default retention period of 30 days. Required IAM permission: rds:ModifyDBInstance." prettyname: Enable Automatic Backup for RDS DB hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_instance_identifier prettyname: RDS Instance ID description: 'The identifier of DB instance to modify.' required: true defaultValue: RDS Instance ID prettypredefined: RDS Instance ID: ${asset.xdm.asset.name} - name: backup_retention_period description: 'The number of days to retain automated backups. Setting this parameter to a positive number enables backups. Setting this parameter to 0 disables automated backups.' defaultValue: '30' hidden: true - name: apply_immediately description: 'Whether the modifications in this request and any pending modifications are asynchronously applied as soon as possible, regardless of the PreferredMaintenanceWindow setting for the DB instance. By default, this parameter is disabled. If this parameter is disabled, changes to the DB instance are applied during the next maintenance window. Some parameter changes can cause an outage and are applied on the next call to RebootDBInstance, or the next failure reboot.' defaultValue: 'true' hidden: true - name: aws-rds-db-instance-enable-iam-auth-quick-action description: "Enables IAM database authentication for the RDS DB instance. Required IAM permission: rds:ModifyDBInstance." prettyname: Enable IAM Authentication on RDS hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_instance_identifier prettyname: RDS Instance ID description: 'The identifier of DB instance to modify.' required: true defaultValue: RDS Instance ID prettypredefined: RDS Instance ID: ${asset.xdm.asset.name} - name: enable_iam_database_authentication description: 'Whether to enable mapping of Amazon Web Services Identity and Access Management (IAM) accounts to database accounts. By default, mapping isn’t enabled.' defaultValue: 'true' hidden: true - name: aws-rds-db-instance-enable-deletion-protection-quick-action description: "Enables deletion protection for the RDS DB instance. Required IAM permission: rds:ModifyDBInstance." prettyname: Enable Deletion Protection on RDS hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_instance_identifier prettyname: RDS Instance ID description: 'The identifier of DB instance to modify.' required: true defaultValue: RDS Instance ID prettypredefined: RDS Instance ID: ${asset.xdm.asset.name} - name: deletion_protection description: 'Whether the DB instance has deletion protection enabled. The database can’t be deleted when deletion protection is enabled. By default, deletion protection isn’t enabled. For more information, see [Deleting a DB Instance.](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html).' defaultValue: 'true' hidden: true - name: aws-rds-db-instance-enable-auto-upgrade-quick-action description: "Enables automatic minor version upgrades for the RDS DB instance. Required IAM permission: rds:ModifyDBInstance." prettyname: Enable RDS Auto Upgrade hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_instance_identifier prettyname: RDS Instance ID description: 'The identifier of DB instance to modify.' required: true defaultValue: RDS Instance ID prettypredefined: RDS Instance ID: ${asset.xdm.asset.name} - name: auto_minor_version_upgrade description: 'Whether minor version upgrades are applied automatically to the DB instance during the maintenance window. An outage occurs only if all of the following conditions are met: the automatic upgrade is enabled for the maintenance window, a newer minor version is available, and RDS has enabled automatic patching for the engine version. If any of these conditions are not met, Amazon RDS applies the change as soon as possible without causing an outage. For an RDS Custom DB instance, do not enable this setting; otherwise, the operation returns an error.' defaultValue: 'true' hidden: true - name: apply_immediately description: 'Whether the modifications in this request and any pending modifications are applied asynchronously as soon as possible, regardless of the PreferredMaintenanceWindow setting for the DB instance. By default, this parameter is disabled. If disabled, changes to the DB instance are applied during the next maintenance window. Some parameter changes can cause an outage and are applied on the next call to RebootDBInstance or on the next failure reboot.' defaultValue: 'true' hidden: true - name: aws-rds-db-instance-enable-multi-az-quick-action description: "Enables Multi-AZ deployment for the RDS database instance to enhance availability and durability. Required IAM permission: rds:ModifyDBInstance." prettyname: Enable Multi-AZ for RDS hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_instance_identifier prettyname: RDS Instance ID description: 'The identifier of DB instance to modify.' required: true defaultValue: RDS Instance ID prettypredefined: RDS Instance ID: ${asset.xdm.asset.name} - name: multi_az description: 'Whether the DB instance is a Multi-AZ deployment. Changing this parameter does not cause an outage. The change is applied during the next maintenance window unless the ApplyImmediately parameter is enabled for this request. This setting does not apply to RDS Custom DB instances.' defaultValue: 'true' hidden: true - name: apply_immediately description: 'Whether the modifications in this request and any pending modifications are applied asynchronously as soon as possible, regardless of the PreferredMaintenanceWindow setting for the DB instance. By default, this parameter is disabled. If disabled, changes to the DB instance are applied during the next maintenance window. Some parameter changes can cause an outage and are applied on the next call to RebootDBInstance or on the next failure reboot.' defaultValue: 'true' hidden: true - name: aws-rds-db-instances-describe description: "Returns information about provisioned RDS instances. Required IAM Permission: rds:DescribeDBInstances." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: db_instance_identifier description: The user-supplied instance identifier or the Amazon Resource Name (ARN) of the DB instance. If this parameter is specified, information from only the specific DB instance is returned. This parameter isn't case-sensitive. required: false - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. required: false - name: limit description: The maximum number of records to include in the response. If more records exist than the specified limit value, a pagination token is included in the response so that the remaining results can be retrieved. The minimum value is 20, the maximum is 100. required: false - name: next_token description: An optional pagination token provided by a previous request. If this parameter is specified, the response includes only records beyond the token, up to the value specified by limit. required: false outputs: - contextPath: AWS.RDS.DBInstancesNextToken description: An optional pagination token provided by a previous request. type: String - contextPath: AWS.RDS.DBInstances.DBInstanceIdentifier description: The user-supplied database identifier. This identifier is the unique key that identifies a DB instance. type: String - contextPath: AWS.RDS.DBInstances.DBInstanceClass description: The name of the compute and memory capacity class of the DB instance. type: String - contextPath: AWS.RDS.DBInstances.Engine description: The database engine used for this DB instance. type: String - contextPath: AWS.RDS.DBInstances.DBInstanceStatus description: The current state of this database. type: String - contextPath: AWS.RDS.DBInstances.MasterUsername description: The master username for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.DBName description: The initial database name that you provided (if required) when you created the DB instance. type: String - contextPath: AWS.RDS.DBInstances.Endpoint.Address description: The DNS address of the DB instance. type: String - contextPath: AWS.RDS.DBInstances.Endpoint.Port description: The port that the database engine is listening on. type: Number - contextPath: AWS.RDS.DBInstances.Endpoint.HostedZoneId description: The ID that Amazon Route 53 assigns when you create a hosted zone. type: String - contextPath: AWS.RDS.DBInstances.AllocatedStorage description: The amount of storage in GiB allocated for the DB instance. type: Number - contextPath: AWS.RDS.DBInstances.InstanceCreateTime description: The date and time the DB instance was created. type: String - contextPath: AWS.RDS.DBInstances.PreferredBackupWindow description: The daily time range during which automated backups are created if automated backups are enabled, as determined by the BackupRetentionPeriod. type: String - contextPath: AWS.RDS.DBInstances.BackupRetentionPeriod description: The number of days automatic DB snapshots are retained. type: Number - contextPath: AWS.RDS.DBInstances.DBSecurityGroups.DBSecurityGroupName description: The name of the DB security group. type: String - contextPath: AWS.RDS.DBInstances.DBSecurityGroups.Status description: The status of the DB security group. type: String - contextPath: AWS.RDS.DBInstances.VpcSecurityGroups.VpcSecurityGroupId description: The name of the VPC security group. type: String - contextPath: AWS.RDS.DBInstances.VpcSecurityGroups.Status description: The membership status of the VPC security group. type: String - contextPath: AWS.RDS.DBInstances.DBParameterGroups.DBParameterGroupName description: The name of the DB parameter group. type: String - contextPath: AWS.RDS.DBInstances.DBParameterGroups.ParameterApplyStatus description: The status of parameter updates. type: String - contextPath: AWS.RDS.DBInstances.AvailabilityZone description: The name of the Availability Zone where the DB instance is located. type: String - contextPath: AWS.RDS.DBInstances.DBSubnetGroup.DBSubnetGroupName description: The name of the DB subnet group. type: String - contextPath: AWS.RDS.DBInstances.DBSubnetGroup.DBSubnetGroupDescription description: The description of the DB subnet group. type: String - contextPath: AWS.RDS.DBInstances.DBSubnetGroup.VpcId description: The VpcId of the DB subnet group. type: String - contextPath: AWS.RDS.DBInstances.DBSubnetGroup.SubnetGroupStatus description: The status of the DB subnet group. type: String - contextPath: AWS.RDS.DBInstances.DBSubnetGroup.Subnets description: A list of Subnet elements. type: Unknown - contextPath: AWS.RDS.DBInstances.DBSubnetGroup.DBSubnetGroupArn description: The Amazon Resource Name (ARN) for the DB subnet group. type: String - contextPath: AWS.RDS.DBInstances.DBSubnetGroup.SupportedNetworkTypes description: The network type of the DB subnet group. type: String - contextPath: AWS.RDS.DBInstances.PreferredMaintenanceWindow description: The weekly time range during which system maintenance can occur, in UTC. type: String - contextPath: AWS.RDS.DBInstances.UpgradeRolloutOrder description: The order in which the instances are upgraded. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.DBInstanceClass description: The name of the compute and memory capacity class for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.AllocatedStorage description: The allocated storage size for the DB instance specified in gibibytes (GiB). type: Number - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.Port description: The port for the DB instance. type: Number - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.BackupRetentionPeriod description: The number of days automated backups are retained. type: Number - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.MultiAZ description: Whether the Single-AZ DB instance will change to a Multi-AZ deployment. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.EngineVersion description: The database engine version. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.LicenseModel description: The license model for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.Iops description: The Provisioned IOPS value for the DB instance. type: Number - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.StorageThroughput description: The storage throughput of the DB instance. type: Number - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.DBInstanceIdentifier description: The database identifier for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.StorageType description: The storage type of the DB instance. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.CACertificateIdentifier description: The identifier of the CA certificate for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.DBSubnetGroupName description: The DB subnet group for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.PendingCloudwatchLogsExports description: A list of log types whose configuration is still pending, they are in the process of being activated or deactivated. type: Unknown - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.ProcessorFeatures description: The number of CPU cores and the number of threads per core for the DB instance class of the DB instance. type: Unknown - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.AutomationMode description: 'The automation mode of the RDS Custom DB instance: full or all-paused.' type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.ResumeFullAutomationModeTime description: The number of minutes to pause the automation. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.MultiTenant description: Whether the DB instance will change to the multi-tenant configuration (TRUE) or the single-tenant configuration (FALSE). type: Boolean - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.IAMDatabaseAuthenticationEnabled description: Whether mapping of Amazon Web Services Identity and Access Management (IAM) accounts to database accounts is enabled. type: Boolean - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.DedicatedLogVolume description: Whether the DB instance has a dedicated log volume (DLV) enabled. type: Boolean - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.Engine description: The database engine of the DB instance. type: String - contextPath: AWS.RDS.DBInstances.PendingModifiedValues.AdditionalStorageVolumes description: The additional storage volume modifications that are pending for the DB instance. type: Unknown - contextPath: AWS.RDS.DBInstances.LatestRestorableTime description: The latest time to which a database in this DB instance can be restored with point-in-time restore. type: String - contextPath: AWS.RDS.DBInstances.MultiAZ description: Whether the DB instance is a Multi-AZ deployment. This setting doesn’t apply to RDS Custom DB instances. type: Boolean - contextPath: AWS.RDS.DBInstances.EngineVersion description: The version of the database engine. type: String - contextPath: AWS.RDS.DBInstances.AutoMinorVersionUpgrade description: Whether minor version patches are applied automatically. type: Boolean - contextPath: AWS.RDS.DBInstances.ReadReplicaSourceDBInstanceIdentifier description: The identifier of the source DB instance if this DB instance is a read replica. type: String - contextPath: AWS.RDS.DBInstances.ReadReplicaDBInstanceIdentifiers description: The identifiers of the read replicas associated with this DB instance. type: String - contextPath: AWS.RDS.DBInstances.ReadReplicaDBClusterIdentifiers description: The identifiers of Aurora DB clusters to which the RDS DB instance is replicated as a read replica. type: String - contextPath: AWS.RDS.DBInstances.ReplicaMode description: The open mode of a Db2 or an Oracle read replica. type: String - contextPath: AWS.RDS.DBInstances.LicenseModel description: The license model information for this DB instance. type: String - contextPath: AWS.RDS.DBInstances.Iops description: The Provisioned IOPS (I/O operations per second) value for the DB instance. type: Number - contextPath: AWS.RDS.DBInstances.StorageThroughput description: The storage throughput for the DB instance. type: Number - contextPath: AWS.RDS.DBInstances.OptionGroupMemberships.OptionGroupName description: The name of the option group that the instance belongs to. type: String - contextPath: AWS.RDS.DBInstances.OptionGroupMemberships.Status description: The status of the DB instance’s option group membership. type: String - contextPath: AWS.RDS.DBInstances.CharacterSetName description: Specifies the name of the character set that this instance is associated with. type: String - contextPath: AWS.RDS.DBInstances.NcharCharacterSetName description: The name of the NCHAR character set for the Oracle DB instance. type: String - contextPath: AWS.RDS.DBInstances.SecondaryAvailabilityZone description: Specifies the name of the secondary Availability Zone for a DB instance with multi-AZ support. type: String - contextPath: AWS.RDS.DBInstances.PubliclyAccessible description: Whether the DB instance is publicly accessible. type: Boolean - contextPath: AWS.RDS.DBInstances.StatusInfos description: The status of a read replica. type: Unknown - contextPath: AWS.RDS.DBInstances.StorageType description: The storage type associated with the DB instance. type: String - contextPath: AWS.RDS.DBInstances.StorageEncryptionType description: The type of encryption used to protect data at rest in the DB instance. type: String - contextPath: AWS.RDS.DBInstances.TdeCredentialArn description: The ARN from the key store with which the instance is associated for TDE encryption. type: String - contextPath: AWS.RDS.DBInstances.DbInstancePort description: The port that the DB instance listens on. type: Number - contextPath: AWS.RDS.DBInstances.DBClusterIdentifier description: The name of the DB cluster that the DB instance is a member of (if it is a member of a DB cluster). type: String - contextPath: AWS.RDS.DBInstances.StorageEncrypted description: Whether the DB instance is encrypted. type: Boolean - contextPath: AWS.RDS.DBInstances.KmsKeyId description: If StorageEncrypted is enabled, the Amazon Web Services KMS key identifier for the encrypted DB instance. type: String - contextPath: AWS.RDS.DBInstances.DbiResourceId description: The Amazon Web Services Region-unique, immutable identifier for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.CACertificateIdentifier description: The identifier of the CA certificate for this DB instance. type: String - contextPath: AWS.RDS.DBInstances.DomainMemberships.Domain description: The identifier of the Active Directory Domain. type: String - contextPath: AWS.RDS.DBInstances.DomainMemberships.Status description: The status of the Active Directory Domain membership for the DB instance or cluster. type: String - contextPath: AWS.RDS.DBInstances.DomainMemberships.FQDN description: The fully qualified domain name (FQDN) of the Active Directory Domain. type: String - contextPath: AWS.RDS.DBInstances.DomainMemberships.IAMRoleName description: The name of the IAM role used when making API calls to the Directory Service. type: String - contextPath: AWS.RDS.DBInstances.DomainMemberships.OU description: The Active Directory organizational unit for the DB instance or cluster. type: String - contextPath: AWS.RDS.DBInstances.DomainMemberships.AuthSecretArn description: The ARN for the Secrets Manager secret with the credentials for the user that’s a member of the domain. type: String - contextPath: AWS.RDS.DBInstances.DomainMemberships.DnsIps description: The IPv4 DNS IP addresses of the primary and secondary Active Directory domain controllers. type: String - contextPath: AWS.RDS.DBInstances.CopyTagsToSnapshot description: Whether tags are copied from the DB instance to snapshots of the DB instance. type: Boolean - contextPath: AWS.RDS.DBInstances.MonitoringInterval description: The interval, in seconds, for collecting Enhanced Monitoring metrics. type: Number - contextPath: AWS.RDS.DBInstances.EnhancedMonitoringResourceArn description: The Amazon Resource Name (ARN) of the Amazon CloudWatch Logs log stream that receives the Enhanced Monitoring metrics data for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.MonitoringRoleArn description: The ARN for the IAM role that permits RDS to send Enhanced Monitoring metrics to Amazon CloudWatch Logs. type: String - contextPath: AWS.RDS.DBInstances.PromotionTier description: The order of priority in which an Aurora Replica is promoted to the primary instance after a failure of the existing primary instance. type: Number - contextPath: AWS.RDS.DBInstances.DBInstanceArn description: The Amazon Resource Name (ARN) for the DB instance. type: String - contextPath: AWS.RDS.DBInstances.Timezone description: The time zone of the DB instance. type: String - contextPath: AWS.RDS.DBInstances.IAMDatabaseAuthenticationEnabled description: Whether mapping of Amazon Web Services Identity and Access Management (IAM) accounts to database accounts is enabled for the DB instance. type: Boolean - contextPath: AWS.RDS.DBInstances.DatabaseInsightsMode description: The mode of Database Insights that is enabled for the instance. type: String - contextPath: AWS.RDS.DBInstances.PerformanceInsightsEnabled description: Whether Performance Insights is enabled for the DB instance. type: Boolean - contextPath: AWS.RDS.DBInstances.PerformanceInsightsKMSKeyId description: The Amazon Web Services KMS key identifier for encryption of Performance Insights data. type: String - contextPath: AWS.RDS.DBInstances.PerformanceInsightsRetentionPeriod description: The number of days to retain Performance Insights data. type: Number - contextPath: AWS.RDS.DBInstances.EnabledCloudwatchLogsExports description: A list of log types that this DB instance is configured to export to CloudWatch Logs. type: Unknown - contextPath: AWS.RDS.DBInstances.ProcessorFeatures description: The number of CPU cores and the number of threads per core for the DB instance class of the DB instance. type: Unknown - contextPath: AWS.RDS.DBInstances.DeletionProtection description: Whether the DB instance has deletion protection enabled. type: Boolean - contextPath: AWS.RDS.DBInstances.AssociatedRoles.RoleArn description: 'The Amazon Resource Name (ARN) of the role.' type: String - contextPath: AWS.RDS.DBInstances.AssociatedRoles.FeatureName description: 'The name of the feature for the IAM role.' type: String - contextPath: AWS.RDS.DBInstances.AssociatedRoles.Status description: 'The status of the IAM role association.' type: String - contextPath: AWS.RDS.DBInstances.ListenerEndpoint.Address description: 'The DNS address of the DB instance listener endpoint.' type: String - contextPath: AWS.RDS.DBInstances.ListenerEndpoint.Port description: 'The port that the database engine is listening on for the listener endpoint.' type: Number - contextPath: AWS.RDS.DBInstances.ListenerEndpoint.HostedZoneId description: 'The ID of the Amazon Route 53 hosted zone that contains the listener endpoint.' type: String - contextPath: AWS.RDS.DBInstances.MaxAllocatedStorage description: 'The upper limit to which Amazon RDS can automatically scale the storage of the DB instance.' type: Number - contextPath: AWS.RDS.DBInstances.TagList.Key description: 'The key of a tag.' type: String - contextPath: AWS.RDS.DBInstances.TagList.Value description: 'The value of a tag.' type: String - contextPath: AWS.RDS.DBInstances.AutomationMode description: 'The automation mode of the DB instance.' type: String - contextPath: AWS.RDS.DBInstances.ResumeFullAutomationModeTime description: 'The time when the DB instance will resume full automation mode.' type: String - contextPath: AWS.RDS.DBInstances.CustomerOwnedIpEnabled description: 'Whether the DB instance has a customer-owned IP address.' type: Boolean - contextPath: AWS.RDS.DBInstances.NetworkType description: 'The network type of the DB instance.' type: String - contextPath: AWS.RDS.DBInstances.ActivityStreamStatus description: 'The status of the activity stream.' type: String - contextPath: AWS.RDS.DBInstances.ActivityStreamKmsKeyId description: 'The AWS KMS key identifier for encryption of the activity stream.' type: String - contextPath: AWS.RDS.DBInstances.ActivityStreamKinesisStreamName description: 'The name of the Amazon Kinesis data stream used for the activity stream.' type: String - contextPath: AWS.RDS.DBInstances.ActivityStreamMode description: 'The mode of the activity stream.' type: String - contextPath: AWS.RDS.DBInstances.ActivityStreamEngineNativeAuditFieldsIncluded description: 'Whether the native audit fields are included in the activity stream.' type: Boolean - contextPath: AWS.RDS.DBInstances.AwsBackupRecoveryPointArn description: 'The Amazon Resource Name (ARN) of the recovery point in AWS Backup.' type: String - contextPath: AWS.RDS.DBInstances.DBInstanceAutomatedBackupsReplications.DBInstanceAutomatedBackupsArn description: 'The Amazon Resource Name (ARN) of the replicated automated backups.' type: String - contextPath: AWS.RDS.DBInstances.BackupTarget description: 'The backup target of the DB instance.' type: String - contextPath: AWS.RDS.DBInstances.AutomaticRestartTime description: The time the DB instance is scheduled for automatic restart. type: String - contextPath: AWS.RDS.DBInstances.CustomIamInstanceProfile description: 'The instance profile associated with the DB instance.' type: String - contextPath: AWS.RDS.DBInstances.ActivityStreamPolicyStatus description: 'The status of the policy used for the activity stream.' type: String - contextPath: AWS.RDS.DBInstances.CertificateDetails.CAIdentifier description: 'The CA identifier of the certificate.' type: String - contextPath: AWS.RDS.DBInstances.CertificateDetails.ValidTill description: 'The expiration date of the certificate.' type: String - contextPath: AWS.RDS.DBInstances.DBSystemId description: 'The DB system identifier of the DB instance.' type: String - contextPath: AWS.RDS.DBInstances.MasterUserSecret.SecretArn description: 'The Amazon Resource Name (ARN) of the secret.' type: String - contextPath: AWS.RDS.DBInstances.MasterUserSecret.SecretStatus description: 'The status of the secret.' type: String - contextPath: AWS.RDS.DBInstances.MasterUserSecret.KmsKeyId description: 'The AWS KMS key identifier that is used to encrypt the secret.' type: String - contextPath: AWS.RDS.DBInstances.ReadReplicaSourceDBClusterIdentifier description: 'The identifier of the source DB cluster if this DB instance is a read replica.' type: String - contextPath: AWS.RDS.DBInstances.PercentProgress description: 'The percentage of the estimated data that has been transferred.' type: String - contextPath: AWS.RDS.DBInstances.MultiTenant description: 'Whether the DB instance is a multi-tenant instance.' type: Boolean - contextPath: AWS.RDS.DBInstances.DedicatedLogVolume description: 'Whether the DB instance has a dedicated log volume.' type: Boolean - contextPath: AWS.RDS.DBInstances.IsStorageConfigUpgradeAvailable description: 'Whether a storage configuration upgrade is available for the DB instance.' type: Boolean - contextPath: AWS.RDS.DBInstances.EngineLifecycleSupport description: 'The life cycle of the DB instance engine.' type: String - contextPath: AWS.RDS.DBInstances.AdditionalStorageVolumes.VolumeName description: 'The name of the storage volume.' type: String - contextPath: AWS.RDS.DBInstances.AdditionalStorageVolumes.StorageVolumeStatus description: 'The status of the storage volume.' type: String - contextPath: AWS.RDS.DBInstances.AdditionalStorageVolumes.AllocatedStorage description: 'The allocated storage for the storage volume.' type: Number - contextPath: AWS.RDS.DBInstances.AdditionalStorageVolumes.IOPS description: 'The IOPS for the storage volume.' type: Number - contextPath: AWS.RDS.DBInstances.AdditionalStorageVolumes.MaxAllocatedStorage description: 'The maximum allocated storage for the storage volume.' type: Number - contextPath: AWS.RDS.DBInstances.AdditionalStorageVolumes.StorageThroughput description: 'The storage throughput for the storage volume.' type: Number - contextPath: AWS.RDS.DBInstances.AdditionalStorageVolumes.StorageType description: 'The storage type for the storage volume.' type: String - contextPath: AWS.RDS.DBInstances.StorageVolumeStatus description: The detailed status information for storage volumes associated with the DB instance. type: String - name: aws-rds-db-snapshot-attribute-modify description: 'Adds or removes permission for the specified AWS account ID to restore the specified DB snapshot. Required IAM permission: rds:ModifyDBSnapshotAttribute.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: db_snapshot_identifier description: 'The identifier for the DB snapshot to modify the attributes for.' required: true - name: attribute_name description: 'The name of the DB snapshot attribute to modify.' required: true - name: values_to_add description: 'A list of DB snapshot attributes to add to the attribute specified by AttributeName.' required: false isArray: true - name: values_to_remove description: 'A list of DB snapshot attributes to remove from the attribute specified by AttributeName.' required: false isArray: true - name: aws-rds-event-subscription-modify description: "Modifies an existing RDS event notification subscription. Required IAM permission: rds:ModifyEventSubscription." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: subscription_name description: The name of the RDS event notification subscription. required: true - name: enabled description: Specifies whether to activate the subscription. - name: event_categories description: A list of event categories for a source type (SourceType) that you want to subscribe to. isArray: true - name: sns_topic_arn description: The Amazon Resource Name (ARN) of the SNS topic created for event notification. - name: source_type description: The type of source that is generating the events. outputs: - contextPath: AWS.RDS.EventSubscription.CustomerAwsId description: The AWS customer account associated with the RDS event notification subscription. type: string - contextPath: AWS.RDS.EventSubscription.CustSubscriptionId description: The RDS event notification subscription Id. type: string - contextPath: AWS.RDS.EventSubscription.Enabled description: Specifies whether the subscription is enabled. True indicates the subscription is enabled. type: boolean - contextPath: AWS.RDS.EventSubscription.EventCategoriesList description: A list of event categories for the RDS event notification subscription. type: array - contextPath: AWS.RDS.EventSubscription.EventSubscriptionArn description: The Amazon Resource Name (ARN) for the event subscription. type: string - contextPath: AWS.RDS.EventSubscription.SnsTopicArn description: The topic ARN of the RDS event notification subscription. type: string - contextPath: AWS.RDS.EventSubscription.SourceIdsList description: A list of source IDs for the RDS event notification subscription. type: array - contextPath: AWS.RDS.EventSubscription.SourceType description: The source type for the RDS event notification subscription. type: string - contextPath: AWS.RDS.EventSubscription.Status description: The status of the RDS event notification subscription. type: string - contextPath: AWS.RDS.EventSubscription.SubscriptionCreationTime description: The time the RDS event notification subscription was created. type: string - name: aws-rds-event-subscription-modify-quick-action description: "Activates an existing RDS event subscription. Required IAM permission: rds:ModifyEventSubscription." prettyname: Enable RDS Event Subscription hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: subscription_name description: The name of the RDS event notification subscription. prettyname: RDS Instance required: true defaultValue: RDS Instance prettypredefined: RDS Instance: ${asset.xdm.asset.name} - name: enabled description: Whether to activate the subscription. defaultValue: 'true' hidden: true outputs: - contextPath: AWS.RDS.EventSubscription.CustomerAwsId description: The AWS customer account associated with the RDS event notification subscription. type: string - contextPath: AWS.RDS.EventSubscription.CustSubscriptionId description: The RDS event notification subscription ID. type: string - contextPath: AWS.RDS.EventSubscription.Enabled description: Whether the subscription is enabled. If True, the subscription is enabled. type: boolean - contextPath: AWS.RDS.EventSubscription.EventCategoriesList description: A list of event categories for the RDS event notification subscription. type: array - contextPath: AWS.RDS.EventSubscription.EventSubscriptionArn description: The Amazon Resource Name (ARN) for the event subscription. type: string - contextPath: AWS.RDS.EventSubscription.SnsTopicArn description: The topic ARN of the RDS event notification subscription. type: string - contextPath: AWS.RDS.EventSubscription.SourceIdsList description: A list of source IDs for the RDS event notification subscription. type: array - contextPath: AWS.RDS.EventSubscription.SourceType description: The source type for the RDS event notification subscription. type: string - contextPath: AWS.RDS.EventSubscription.Status description: The status of the RDS event notification subscription. type: string - contextPath: AWS.RDS.EventSubscription.SubscriptionCreationTime description: The time the RDS event notification subscription was created. type: string - name: aws-rds-db-snapshot-attribute-set-snapshot-to-private-quick-action description: "Revokes public access to the RDS DB snapshot, making it private. Required IAM permission: rds:ModifyDBSnapshotAttribute." prettyname: Set RDS Snapshot to Private hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: db_snapshot_identifier prettyname: RDS Snapshot ID description: 'The identifier for the DB snapshot to modify the attributes for.' required: true defaultValue: RDS Snapshot ID prettypredefined: RDS Snapshot ID: ${asset.xdm.asset.name} - name: attribute_name description: 'The name of the DB snapshot attribute to modify.' defaultValue: 'restore' hidden: true - name: values_to_remove description: 'A list of DB snapshot attributes to remove from the attribute specified by AttributeName.' defaultValue: 'all' hidden: true - name: aws-redshift-cluster-modify description: "Modifies the settings of a cluster. Required IAM Permission: redshift:ModifyCluster." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: "The unique identifier of the cluster to be modified." name: cluster_identifier required: true - description: A comma-separated list of VPC security groups to be associated with the cluster. This change is asynchronously applied as soon as possible. name: vpc_security_group_ids isArray: true required: false - description: The new cluster type. name: cluster_type auto: PREDEFINED predefined: - multi-node - single-node - description: The new node type of the cluster. If you specify a new node type, you must also specify the number of nodes parameter. name: node_type auto: PREDEFINED predefined: - "dc2.large" - "dc2.8xlarge" - "ra3.large" - "ra3.xlplus" - "ra3.4xlarge" - "ra3.16xlarge" - description: The new number of nodes of the cluster. If you specify a new number of nodes, you must also specify the node type parameter. name: number_of_nodes - description: A comma-separated list of cluster security groups to be authorized on this cluster. name: cluster_security_groups isArray: true - description: 'The name of the cluster parameter group to apply to the cluster. This change is applied only after the cluster is rebooted. Constraints: The cluster parameter group must be in the same parameter group family that matches the cluster version.' name: cluster_parameter_group_name - description: The number of days that automated snapshots are retained. If the value is 0, automated snapshots are disabled. name: automated_snapshot_retention_period - description: The number of days a newly created manual snapshot is retained. If the value is -1, the manual snapshot is retained indefinitely. name: manual_snapshot_retention_period - description: The weekly time range (in UTC) during which automated cluster maintenance can occur. name: preferred_maintenance_window - description: The new version number of the Amazon Redshift engine to upgrade to. name: cluster_version - description: Whether major version upgrades will be applied automatically to the cluster during the maintenance window. name: allow_version_upgrade auto: PREDEFINED predefined: - 'true' - 'false' - description: The name of the HSM client certificate the Amazon Redshift cluster uses to retrieve the data encryption keys stored in an HSM. name: hsm_client_certificate_identifier - description: The name of the HSM configuration that contains the information the Amazon Redshift cluster can use to retrieve and store keys in an HSM. name: hsm_configuration_identifier - description: The new identifier for the cluster. name: new_cluster_identifier - description: Whether the cluster can be accessed from a public network. Only clusters in VPCs can be set to be publicly available. name: publicly_accessible auto: PREDEFINED predefined: - 'true' - 'false' - description: The Elastic IP (EIP) address for the cluster. name: elastic_ip - description: Whether to create the cluster with enhanced VPC routing enabled. name: enhanced_vpc_routing auto: PREDEFINED predefined: - 'true' - 'false' - description: The name for the maintenance track that you want to assign for the cluster. This name change is asynchronous. The new track name stays in the PendingModifiedValues for the cluster until the next maintenance window. When the maintenance track changes, the cluster is switched to the latest cluster release available for the maintenance track. At this point, the maintenance track name is applied. name: maintenance_track_name - description: Whether the cluster is encrypted. If the value is encrypted (true) and you provide a value for the KmsKeyId parameter, we encrypt the cluster with the provided KmsKeyId. If you don’t provide a KmsKeyId, we encrypt with the default key. If the value is not encrypted (false), then the cluster is decrypted. name: encrypted auto: PREDEFINED predefined: - 'true' - 'false' - description: The Key Management Service (KMS) key ID of the encryption key that you want to use to encrypt data in the cluster. name: kms_key_id - description: Whether to enable relocation for an Amazon Redshift cluster between Availability Zones after the cluster modification is complete. name: availability_zone_relocation auto: PREDEFINED predefined: - 'true' - 'false' - description: Whether to initiate relocation for an Amazon Redshift cluster to the target Availability Zone. name: availability_zone - description: Whether to change the port of an Amazon Redshift cluster. name: port - description: The IP address types that the cluster supports. name: ip_address_type auto: PREDEFINED predefined: - ipv4 - dualstack - description: Whether the cluster will be modified to be deployed in two Availability Zones if the cluster is currently only deployed in a single Availability Zone. name: multi_az auto: PREDEFINED predefined: - 'true' - 'false' - description: Whether to allocate additional compute resources for running automatic optimization operations. name: extra_compute_for_automatic_optimization auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.Redshift.Clusters.ClusterIdentifier description: The unique identifier of the cluster. type: String - contextPath: AWS.Redshift.Clusters.NodeType description: The node type for the nodes in the cluster. type: String - contextPath: AWS.Redshift.Clusters.ClusterStatus description: The current state of the cluster. type: String - contextPath: AWS.Redshift.Clusters.ClusterAvailabilityStatus description: 'The availability status of the cluster for queries. Possible values are the following: Available, Unavailable, Maintenance, Modifying, Failed.' type: String - contextPath: AWS.Redshift.Clusters.ModifyStatus description: The status of a cluster modification. type: String - contextPath: AWS.Redshift.Clusters.MasterUsername description: The master user name for the cluster. This name is used to connect to the database that is hosted on the cluster. type: String - contextPath: AWS.Redshift.Clusters.DBName description: The name of the initial database that was created when the cluster was created. type: String - contextPath: AWS.Redshift.Clusters.Endpoint.Address description: The DNS address of the cluster. type: String - contextPath: AWS.Redshift.Clusters.Endpoint.Port description: The port that the database engine is listening on. type: Number - contextPath: AWS.Redshift.Clusters.Endpoint.VpcEndpoints description: The connection endpoint description. type: Unknown - contextPath: AWS.Redshift.Clusters.ClusterCreateTime description: The date and time that the cluster was created. type: String - contextPath: AWS.Redshift.Clusters.AutomatedSnapshotRetentionPeriod description: The number of days that automatic cluster snapshots are retained. type: Number - contextPath: AWS.Redshift.Clusters.ManualSnapshotRetentionPeriod description: The number of days to retain a manual snapshot. type: Number - contextPath: AWS.Redshift.Clusters.ClusterSecurityGroups.ClusterSecurityGroupName description: The name of a cluster security group. type: String - contextPath: AWS.Redshift.Clusters.ClusterSecurityGroups.Status description: The status of the cluster security group. type: String - contextPath: AWS.Redshift.Clusters.VpcSecurityGroups.VpcSecurityGroupId description: The identifier of the VPC security group. type: String - contextPath: AWS.Redshift.Clusters.VpcSecurityGroups.Status description: The status of the VPC security group. type: String - contextPath: AWS.Redshift.Clusters.ClusterParameterGroups.ParameterGroupName description: The name of the parameter group. type: String - contextPath: AWS.Redshift.Clusters.ClusterParameterGroups.ParameterApplyStatus description: The status of parameter updates. type: String - contextPath: AWS.Redshift.Clusters.ClusterParameterGroups.ClusterParameterStatusList description: A comma-separated list of parameter statuses. type: Unknown - contextPath: AWS.Redshift.Clusters.ClusterSubnetGroupName description: The name of the subnet group that is associated with the cluster. type: String - contextPath: AWS.Redshift.Clusters.VpcId description: The identifier of the VPC the cluster is in, if the cluster is in a VPC. type: String - contextPath: AWS.Redshift.Clusters.AvailabilityZone description: The name of the Availability Zone in which the cluster is located. type: String - contextPath: AWS.Redshift.Clusters.PreferredMaintenanceWindow description: The weekly time range (in UTC) during which system maintenance can occur. type: String - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.MasterUserPassword description: The pending or in-progress change of the master user password for the cluster. type: String - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.NodeType description: The pending or in-progress node type for the cluster. type: String - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.NumberOfNodes description: The pending or in-progress number of nodes for the cluster. type: Number - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.ClusterType description: The pending or in-progress cluster type for the cluster. type: String - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.ClusterVersion description: The pending or in-progress cluster version for the cluster. type: String - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.AutomatedSnapshotRetentionPeriod description: The pending or in-progress change of the automated snapshot retention period for the cluster. type: Number - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.ClusterIdentifier description: The pending or in-progress change of the new identifier for the cluster. type: String - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.PubliclyAccessible description: The pending or in-progress change of the ability to connect to the cluster from a public network. type: Boolean - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.EnhancedVpcRouting description: An option that specifies whether to create the cluster with enhanced VPC routing enabled. type: Boolean - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.MaintenanceTrackName description: The name of the maintenance track that the cluster will change to during the next maintenance window. type: String - contextPath: AWS.Redshift.Clusters.PendingModifiedValues.EncryptionType description: The encryption type for a cluster. type: String - contextPath: AWS.Redshift.Clusters.ClusterVersion description: The version ID of the Amazon Redshift engine that is running on the cluster. type: String - contextPath: AWS.Redshift.Clusters.AllowVersionUpgrade description: Whether major version upgrades will be applied automatically to the cluster during the maintenance window. type: Boolean - contextPath: AWS.Redshift.Clusters.NumberOfNodes description: The number of compute nodes in the cluster. type: Number - contextPath: AWS.Redshift.Clusters.PubliclyAccessible description: Whether the cluster can be accessed from a public network. type: Boolean - contextPath: AWS.Redshift.Clusters.Encrypted description: Whether the cluster is encrypted. type: Boolean - contextPath: AWS.Redshift.Clusters.RestoreStatus.Status description: The status of the restore action. type: String - contextPath: AWS.Redshift.Clusters.RestoreStatus.CurrentRestoreRateInMegaBytesPerSecond description: The number of megabytes per second being transferred from the backup storage. type: Number - contextPath: AWS.Redshift.Clusters.RestoreStatus.SnapshotSizeInMegaBytes description: The size of the set of snapshot data that was used to restore the cluster. type: Number - contextPath: AWS.Redshift.Clusters.RestoreStatus.ProgressInMegaBytes description: The number of megabytes that have been transferred from snapshot storage. type: Number - contextPath: AWS.Redshift.Clusters.RestoreStatus.ElapsedTimeInSeconds description: The amount of time an in-progress restore has been running, or the amount of time it took a completed restore to finish. type: Number - contextPath: AWS.Redshift.Clusters.RestoreStatus.EstimatedTimeToCompletionInSeconds description: The estimate of the time remaining before the restore will complete. type: Number - contextPath: AWS.Redshift.Clusters.DataTransferProgress.Status description: The cluster status. type: String - contextPath: AWS.Redshift.Clusters.DataTransferProgress.CurrentRateInMegaBytesPerSecond description: The data transfer rate in megabytes per second. type: Number - contextPath: AWS.Redshift.Clusters.DataTransferProgress.TotalDataInMegaBytes description: The total amount of data to be transfered in megabytes. type: Number - contextPath: AWS.Redshift.Clusters.DataTransferProgress.DataTransferredInMegaBytes description: The total amount of data that has been transfered in MB’s. type: Number - contextPath: AWS.Redshift.Clusters.DataTransferProgress.EstimatedTimeToCompletionInSeconds description: The estimated number of seconds remaining to complete the transfer. type: Number - contextPath: AWS.Redshift.Clusters.DataTransferProgress.ElapsedTimeInSeconds description: The number of seconds that have elapsed during the data transfer. type: Number - contextPath: AWS.Redshift.Clusters.HsmStatus.HsmClientCertificateIdentifier description: The name of the HSM client certificate the Amazon Redshift cluster uses to retrieve the data encryption keys stored in an HSM. type: String - contextPath: AWS.Redshift.Clusters.HsmStatus.HsmConfigurationIdentifier description: The name of the HSM configuration that contains the information the Amazon Redshift cluster can use to retrieve and store keys in an HSM. type: String - contextPath: AWS.Redshift.Clusters.HsmStatus.Status description: Whether the Amazon Redshift cluster has finished applying any HSM settings changes specified in a modify cluster command. type: String - contextPath: AWS.Redshift.Clusters.ClusterSnapshotCopyStatus.DestinationRegion description: The destination region that snapshots are automatically copied to when cross-region snapshot copy is enabled. type: String - contextPath: AWS.Redshift.Clusters.ClusterSnapshotCopyStatus.RetentionPeriod description: The number of days that automated snapshots are retained in the destination region after they are copied from a source region. type: Number - contextPath: AWS.Redshift.Clusters.ClusterSnapshotCopyStatus.ManualSnapshotRetentionPeriod description: The number of days that automated snapshots are retained in the destination region after they are copied from a source region. If the value is -1, the manual snapshot is retained indefinitely. type: Number - contextPath: AWS.Redshift.Clusters.ClusterSnapshotCopyStatus.SnapshotCopyGrantName description: The name of the snapshot copy grant. type: String - contextPath: AWS.Redshift.Clusters.ClusterPublicKey description: The public key for the cluster. type: String - contextPath: AWS.Redshift.Clusters.ClusterNodes.NodeRole description: Whether the node is a leader node or a compute node. type: String - contextPath: AWS.Redshift.Clusters.ClusterNodes.PrivateIPAddress description: The private IP address of a node within a cluster. type: String - contextPath: AWS.Redshift.Clusters.ClusterNodes.PublicIPAddress description: The public IP address of a node within a cluster. type: String - contextPath: AWS.Redshift.Clusters.ElasticIpStatus.ElasticIp description: The elastic IP (EIP) address for the cluster. type: String - contextPath: AWS.Redshift.Clusters.ElasticIpStatus.Status description: The status of the elastic IP (EIP) address. type: String - contextPath: AWS.Redshift.Clusters.ClusterRevisionNumber description: The specific revision number of the database in the cluster. type: String - contextPath: AWS.Redshift.Clusters.Tags.Key description: The key, or name, for the resource tag. type: String - contextPath: AWS.Redshift.Clusters.Tags.Value description: The value for the resource tag. type: String - contextPath: AWS.Redshift.Clusters.KmsKeyId description: The Key Management Service (KMS) key ID of the encryption key used to encrypt data in the cluster. type: String - contextPath: AWS.Redshift.Clusters.EnhancedVpcRouting description: Whether to create the cluster with enhanced VPC routing enabled. type: Boolean - contextPath: AWS.Redshift.Clusters.IamRoles.IamRoleArn description: The Amazon Resource Name (ARN) of the IAM role. type: String - contextPath: AWS.Redshift.Clusters.IamRoles.ApplyStatus description: The status of the IAM role’s association with an Amazon Redshift cluster. type: String - contextPath: AWS.Redshift.Clusters.PendingActions description: The cluster operations that are waiting to be started. type: Unknown - contextPath: AWS.Redshift.Clusters.MaintenanceTrackName description: The name of the maintenance track for the cluster. type: String - contextPath: AWS.Redshift.Clusters.ElasticResizeNumberOfNodeOptions description: The number of nodes that you can resize the cluster to with the elastic resize method. type: String - contextPath: AWS.Redshift.Clusters.DeferredMaintenanceWindows.DeferMaintenanceIdentifier description: A unique identifier for the maintenance window. type: String - contextPath: AWS.Redshift.Clusters.DeferredMaintenanceWindows.DeferMaintenanceStartTime description: A timestamp for the beginning of the time period when we defer maintenance. type: String - contextPath: AWS.Redshift.Clusters.DeferredMaintenanceWindows.DeferMaintenanceEndTime description: A timestamp for the end of the time period when we defer maintenance. type: String - contextPath: AWS.Redshift.Clusters.SnapshotScheduleIdentifier description: A unique identifier for the cluster snapshot schedule. type: String - contextPath: AWS.Redshift.Clusters.SnapshotScheduleState description: The current state of the cluster snapshot schedule. type: String - contextPath: AWS.Redshift.Clusters.ExpectedNextSnapshotScheduleTime description: The current state of the cluster snapshot schedule. type: String - contextPath: AWS.Redshift.Clusters.ExpectedNextSnapshotScheduleTimeStatus description: The status of next expected snapshot for clusters having a valid snapshot schedule and backups enabled. type: String - contextPath: AWS.Redshift.Clusters.NextMaintenanceWindowStartTime description: The date and time in UTC when system maintenance can begin. type: String - contextPath: AWS.Redshift.Clusters.ResizeInfo.ResizeType description: Returns the value ClassicResize. type: String - contextPath: AWS.Redshift.Clusters.ResizeInfo.AllowCancelResize description: Whether the resize operation can be cancelled. type: Boolean - contextPath: AWS.Redshift.Clusters.AvailabilityZoneRelocationStatus description: The status of the Availability Zone relocation operation. type: String - contextPath: AWS.Redshift.Clusters.ClusterNamespaceArn description: The namespace Amazon Resource Name (ARN) of the cluster. type: String - contextPath: AWS.Redshift.Clusters.TotalStorageCapacityInMegaBytes description: The total storage capacity of the cluster in megabytes. type: Number - contextPath: AWS.Redshift.Clusters.DefaultIamRoleArn description: The Amazon Resource Name (ARN) for the IAM role set as default for the cluster. type: String - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.ReservedNodeExchangeRequestId description: The identifier of the reserved-node exchange request. type: String - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.Status description: The status of the reserved-node exchange request. type: String - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.RequestTime description: The date and time the reserved-node exchange was requested. type: String - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.SourceReservedNodeId description: The identifier of the source reserved node. type: String - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.SourceReservedNodeType description: The source reserved-node type. type: String - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.SourceReservedNodeCount description: The source reserved-node count in the cluster. type: Number - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.TargetReservedNodeOfferingId description: The identifier of the target reserved node offering. type: String - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.TargetReservedNodeType description: The node type of the target reserved node. type: String - contextPath: AWS.Redshift.Clusters.ReservedNodeExchangeStatus.TargetReservedNodeCount description: The count of target reserved nodes in the cluster. type: Number - contextPath: AWS.Redshift.Clusters.CustomDomainName description: The custom domain name associated with the cluster. type: String - contextPath: AWS.Redshift.Clusters.CustomDomainCertificateArn description: The certificate Amazon Resource Name (ARN) for the custom domain name. type: String - contextPath: AWS.Redshift.Clusters.CustomDomainCertificateExpiryDate description: The expiration date for the certificate associated with the custom domain name. type: String - contextPath: AWS.Redshift.Clusters.MasterPasswordSecretArn description: The Amazon Resource Name (ARN) for the cluster’s admin user credentials secret. type: String - contextPath: AWS.Redshift.Clusters.MasterPasswordSecretKmsKeyId description: The ID of the Key Management Service (KMS) key used to encrypt and store the cluster’s admin credentials secret. type: String - contextPath: AWS.Redshift.Clusters.IpAddressType description: The IP address type for the cluster. type: String - contextPath: AWS.Redshift.Clusters.MultiAZ description: Whether the cluster is deployed in two Availability Zones. type: Boolean - contextPath: AWS.Redshift.Clusters.MultiAZSecondary.AvailabilityZone description: The name of the Availability Zone in which the secondary compute unit of the cluster is located. type: String - contextPath: AWS.Redshift.Clusters.MultiAZSecondary.ClusterNodes description: The nodes in the secondary compute unit. type: String - contextPath: AWS.Redshift.Clusters.LakehouseRegistrationStatus description: The status of the lakehouse registration for the cluster. Indicates whether the cluster is successfully registered with Amazon Redshift federated permissions. type: String - contextPath: AWS.Redshift.Clusters.CatalogArn description: The Amazon Resource Name (ARN) of the Glue data catalog associated with the cluster enabled with Amazon Redshift federated permissions. type: String - contextPath: AWS.Redshift.Clusters.ExtraComputeForAutomaticOptimization description: Whether the cluster allocates additional compute resources to run automatic optimization operations. type: String - name: aws-ec2-security-group-ingress-revoke description: 'Revokes ingress rules in a security group. Required IAM permission: ec2:RevokeSecurityGroupIngress.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: group_id description: 'The ID of the security group.' required: true - name: protocol description: 'The IP protocol: tcp, udp, icmp, or icmpv6 or a number. Use -1 to specify all protocols. Use with port and CIDR arguments for simple rule revocation.' required: false - name: port description: 'For TCP or UDP: The range of ports to revoke (e.g., "80" or "80-443"). For ICMP: A single integer or range (type-code) representing the ICMP type and code. Use with protocol and cidr for simple rule revocation.' required: false deprecated: true - name: from_port description: 'If the protocol is TCP or UDP, this is the start of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP type or -1 (all ICMP types).' required: false - name: to_port description: 'If the protocol is TCP or UDP, this is the end of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP code or -1 (all ICMP codes). If the start port is -1 (all ICMP types), then the end port must be -1 (all ICMP codes).' required: false - name: cidr description: 'The IPv4 address range in CIDR format (e.g., "0.0.0.0/0"). Use with protocol and port for simple rule revocation.' required: false - name: ip_permissions description: 'The sets of IP permissions to revoke, in JSON format. Use this for complex rule configurations or when revoking multiple rules. Cannot be used together with protocol/port/CIDR arguments.' required: false - name: aws-ec2-security-group-ingress-authorize description: 'Adds specified inbound (ingress) rules to a security group. Required IAM permission: ec2:AuthorizeSecurityGroupIngress.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: group_id description: 'The ID of the security group.' required: true - name: protocol description: 'The IP protocol: tcp, udp, icmp, or icmpv6 or a number. Use -1 to specify all protocols. Use with port and CIDR arguments for simple rule authorization.' required: false - name: port description: 'For TCP or UDP: The range of ports to authorize (e.g., "80" or "80-443"). For ICMP: A single integer or range (type-code) representing the ICMP type and code. Use with protocol and cidr for simple rule authorization.' required: false deprecated: true - name: from_port description: 'If the protocol is TCP or UDP, this is the start of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP type or -1 (all ICMP types).' required: false - name: to_port description: 'If the protocol is TCP or UDP, this is the end of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP code or -1 (all ICMP codes). If the start port is -1 (all ICMP types), then the end port must be -1 (all ICMP codes).' required: false - name: cidr description: 'The IPv4 address range in CIDR format (e.g., "0.0.0.0/0"). Use with protocol and port for simple rule authorization.' required: false - name: ip_permissions description: 'The sets of IP permissions to authorize, in JSON format. Use this for complex rule configurations or when authorizing multiple rules. Cannot be used together with protocol/port/CIDR arguments.' required: false - name: aws-ec2-security-group-egress-revoke description: 'Removes specified outbound (egress) rules from a security group. Required IAM permission: ec2:RevokeSecurityGroupEgress.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: group_id description: 'The ID of the security group.' required: true - name: protocol description: 'The IP protocol: tcp, udp, icmp, or icmpv6 or a number. Use -1 to specify all protocols. Use with port and CIDR arguments for simple rule revocation.' required: false - name: port description: 'For TCP or UDP: The range of ports to revoke (e.g., "80" or "80-443"). For ICMP: A single integer or range (type-code) representing the ICMP type and code. Use with protocol and cidr for simple rule revocation.' required: false deprecated: true - name: from_port description: 'If the protocol is TCP or UDP, this is the start of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP type or -1 (all ICMP types).' required: false - name: to_port description: 'If the protocol is TCP or UDP, this is the end of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP code or -1 (all ICMP codes). If the start port is -1 (all ICMP types), then the end port must be -1 (all ICMP codes).' required: false - name: cidr description: 'The IPv4 address range in CIDR format (e.g., "0.0.0.0/0"). Use with protocol and port for simple rule revocation.' required: false - name: ip_permissions description: 'The sets of IP permissions to revoke, in JSON format. Use this for complex rule configurations or when revoking multiple rules. Cannot be used together with protocol/port/CIDR arguments.' required: false - name: aws-ec2-security-group-egress-authorize execution: true description: 'Adds the specified inbound (egress) rules to a security group. Required IAM Permission: ec2:AuthorizeSecurityGroupEgress.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: group_id description: 'The ID of the security group.' required: true - name: protocol description: 'The IP protocol: tcp, udp, icmp, or icmpv6 or a number. Use -1 to specify all protocols. Use with from_port, to_port and CIDR arguments for simple rule authorization. VPC security group rules must specify protocols explicitly.' required: false - name: from_port description: 'If the protocol is TCP or UDP, this is the start of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP type or -1 (all ICMP types).' required: false - name: to_port description: 'If the protocol is TCP or UDP, this is the end of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP code or -1 (all ICMP codes). If the start port is -1 (all ICMP types), then the end port must be -1 (all ICMP codes).' required: false - name: cidr description: 'The IPv4 address range in CIDR format (e.g., "0.0.0.0/0"). Use with protocol and from_port, to_port arguments for simple rule authorization.' required: false - name: ip_permissions description: 'The sets of IP permissions to authorize, in JSON format. Use this for complex rule configurations or when authorizing multiple rules. Cannot be used together with protocol/port/CIDR arguments.' required: false - name: aws-ec2-snapshot-attribute-modify description: 'Adds or removes permission settings for a specified snapshot. Note: snapshots encrypted with the AWS-managed default key (alias/aws/ebs) cannot be shared. Use unencrypted snapshots or those encrypted with a customer-managed KMS key to allow permission modifications. Required IAM permission: ec2:ModifySnapshotAttribute.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: snapshot_id description: 'The ID of the snapshot.' required: true - name: attribute description: 'The snapshot attribute to modify.' required: true auto: PREDEFINED defaultValue: 'createVolumePermission' - name: operation_type description: 'The operation to perform.' required: true auto: PREDEFINED predefined: - 'add' - 'remove' - name: user_ids isArray: true description: 'A comma-separated list of AWS user account IDs to add to or remove from the list of users permitted to create EBS volumes from the snapshot.' required: false - name: group description: 'The groups to add to or remove from the list of entities that have permission to create volumes from the snapshot.' required: false auto: PREDEFINED predefined: - 'all' - name: aws-ec2-instance-attribute-modify description: "Modifies a specific attribute for a specific instance. You can define only one attribute at a time. Required IAM permission: ec2:ModifyInstanceAttribute." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The ID of the instance. name: instance_id required: true - description: Whether an instance is enabled for stop protection. name: disable_api_stop predefined: - 'true' - 'false' - description: "A comma-separated list of security groups to replace the instance's current security groups. You must specify the ID of at least one security group, even if it’s just the default security group for the VPC." name: groups - name: attribute description: 'The name of the attribute to modify. Possible values: sourceDestCheck, groupSet, ebsOptimized, sriovNetSupport, enaSupport, enclaveOptions, disableApiStop.' predefined: - 'instanceType' - 'kernel' - 'ramdisk' - 'userData' - 'disableApiTermination' - 'instanceInitiatedShutdownBehavior' - 'rootDeviceName' - 'blockDeviceMapping' - 'productCodes' - 'sourceDestCheck' - 'groupSet' - 'ebsOptimized' - 'striovNetSupport' - 'enaSupport' - 'enclaveOptions' - 'disableApiStop' - name: value description: A new value for the attribute. Use only with the kernel, ramdisk, userData, disableApiTermination, or instanceInitiatedShutdownBehavior attribute. - name: aws-ec2-instance-attribute-modify-quick-action description: "Removes the associated security group from the EC2 instance profile. Required IAM permission: ec2:ModifyInstanceAttribute." prettyname: Detach Security Group from EC2 hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: instance_id description: The ID of the instance. prettyname: EC2 Instance ID prettypredefined: EC2 Instance ID: ${asset.xdm.asset.strong_id} required: true defaultValue: EC2 Instance ID - name: aws-ec2-image-attribute-modify description: 'Modifies a specific attribute of the specified AMI. Required IAM permission: ec2:ModifyImageAttribute.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: image_id description: 'The ID of the AMI.' required: true - name: attribute description: 'The AMI attribute to modify.' required: true auto: PREDEFINED predefined: - 'description' - 'launchPermission' - name: operation_type description: 'The operation to perform on the attribute.' required: false auto: PREDEFINED predefined: - 'add' - 'remove' - name: user_ids description: 'The AWS account IDs to add to or remove from the list of users that have launch permissions for the AMI.' required: false isArray: true - name: user_groups description: 'The user groups to add to or remove from the list of user groups that have launch permissions for the AMI.' required: false isArray: true - name: description description: 'A new description for the AMI.' required: false - name: aws-ec2-image-attribute-set-ami-to-private-quick-action description: "Revokes public launch permissions for the EC2 AMI. Required IAM permission: ec2:ModifyImageAttribute." prettyname: Set AMI to Private hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: image_id prettyname: AMI ID description: 'The ID of the AMI.' required: true defaultValue: AMI ID prettypredefined: AMI ID: ${asset.xdm.asset.strong_id} - name: attribute description: 'The AMI attribute to modify.' defaultValue: 'launchPermission' hidden: true - name: operation_type description: 'The operation to perform on the attribute.' defaultValue: 'remove' hidden: true - name: aws-ec2-instance-metadata-options-modify description: "Modifes the EC2 instance metadata parameters on a running or stopped instance. Required IAM permission: ec2:ModifyInstanceMetadataOptions." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_id description: 'The ID of the instance.' required: true - description: Whether IMDSv2 is required. auto: PREDEFINED name: http_tokens predefined: - 'optional' - 'required' - description: Enables or disables the HTTP metadata endpoint on your instances. name: http_endpoint auto: PREDEFINED predefined: - 'disabled' - 'enabled' - name: aws-ec2-snapshot-create arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - description: The ID of the EBS volume. name: volume_id required: true - description: A description for the snapshot. name: description - description: The tags to apply to the snapshot during creation. name: tags - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 description: "Creates a snapshot of an EBS volume and stores it in Amazon S3. You can use snapshots for backups, to make copies of EBS volumes, and to save data before shutting down an instance. Required IAM permission: ec2:CreateSnapshot." outputs: - contextPath: AWS.EC2.Snapshot.DataEncryptionKeyId description: The data encryption key identifier for the snapshot. type: string - contextPath: AWS.EC2.Snapshot.Description description: The description for the snapshot. type: string - contextPath: AWS.EC2.Snapshot.Encrypted description: Indicates whether the snapshot is encrypted. type: number - contextPath: AWS.EC2.Snapshot.KmsKeyId description: The full ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) that was used to protect the volume encryption key for the parent volume. type: string - contextPath: AWS.EC2.Snapshot.OwnerId description: The AWS account ID of the EBS snapshot owner. type: string - contextPath: AWS.EC2.Snapshot.Progress description: The progress of the snapshot, as a percentage. type: string - contextPath: AWS.EC2.Snapshot.SnapshotId description: The ID of the snapshot. type: string - contextPath: AWS.EC2.Snapshot.StartTime description: The time stamp when the snapshot was initiated. type: date - contextPath: AWS.EC2.Snapshot.State description: The snapshot state. type: string - contextPath: AWS.EC2.Snapshot.StateMessage description: this field displays error state details to help you diagnose why the error occurred. type: string - contextPath: AWS.EC2.Snapshot.VolumeId description: The ID of the volume that was used to create the snapshot. type: string - contextPath: AWS.EC2.Snapshot.VolumeSize description: The size of the volume, in GiB. type: number - contextPath: AWS.EC2.Snapshot.OwnerAlias description: Value from an Amazon-maintained list of snapshot owners. type: string - contextPath: AWS.EC2.Snapshot.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Snapshot.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.Snapshot.AccountId description: The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided. type: string - name: aws-ec2-snapshot-permission-modify arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - description: The ID of the EBS snapshot. name: snapshot_id required: true - auto: PREDEFINED predefined: - 'add' - 'remove' description: The operation type, add or remove. name: operation_type required: true - description: CSV of security group names. This parameter can be used only when UserIds not provided. name: group_names - description: CSV of AWS account IDs. This parameter can be used only when groupNames not provided. name: user_ids - auto: PREDEFINED description: Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. name: dry_run predefined: - 'True' - 'False' - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 description: "Adds or removes permission settings for a specific snapshot. Required IAM permission: ec2:ModifySnapshotAttribute." - name: aws-ec2-set-snapshot-to-private-quick-action description: "Revokes public access to the EC2 snapshot. Required IAM permission: ec2:ModifySnapshotAttribute." prettyname: Set Snapshot to Private hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: snapshot_id prettyname: EC2 Snapshot ID description: The ID of the EBS snapshot. required: true defaultValue: EC2 Snapshot ID prettypredefined: EC2 Snapshot ID: ${asset.xdm.asset.name} - name: operation_type description: The operation type, add or remove. defaultValue: 'remove' hidden: true - name: group_names description: A CSV list of security group names. This parameter can be used only when UserIds is not provided. defaultValue: 'all' hidden: true - name: aws-ecs-cluster-settings-update arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - description: The name of the cluster. name: cluster_name required: true - description: The value of the containerInsights setting to update. name: value required: true auto: PREDEFINED predefined: - 'enabled' - 'disabled' - 'enhanced' - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 description: "Updates the containerInsights setting of an ECS cluster. Required IAM permission: ecs:UpdateClusterSettings." - name: aws-ec2-subnet-attribute-modify description: "Modifies a subnet attribute. Required IAM permission: ec2:ModifySubnetAttribute." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The ID of the subnet. name: subnet_id required: true - description: Set to true to assign an IPv6 address to network interfaces created in the specified subnet. name: assign_ipv6_address_on_creation - description: The customer-owned IPv4 address pool associated with the subnet. name: customer_owned_ipv4_pool - description: Set to true to disable local network interfaces at the current position. name: disable_lni_at_device_index - description: Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. name: enable_dns64 - description: Indicates the device position for local network interfaces in this subnet. name: enable_lni_at_device_index - description: Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. name: enable_resource_name_dns_aaaa_record_on_launch - description: Indicates whether to respond to DNS queries for instance hostnames with DNS A records. name: enable_resource_name_dns_a_record_on_launch - description: Set to true to assign a customer-owned IPv4 address to network interfaces attached to instances created in the specified subnet. name: map_customer_owned_ip_on_launch - description: Set to true to assign a public IPv4 address to network interfaces attached to instances created in the specified subnet. name: map_public_ip_on_launch - description: The type of hostname to assign to instances in the subnet at launch. name: private_dns_hostname_type_on_launch - arguments: - description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. name: filters - description: A comma-separated list of VPC IDs. name: vpc_ids - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 description: "Returns details for one or more provided VPCs. Required IAM permission: ec2:DescribeVpcs." name: aws-ec2-vpcs-describe outputs: - contextPath: AWS.EC2.Vpcs.CidrBlock description: The primary IPv4 CIDR block for the VPC. type: string - contextPath: AWS.EC2.Vpcs.DhcpOptionsId description: The ID of the set of DHCP options you have associated with the VPC. type: string - contextPath: AWS.EC2.Vpcs.State description: The current state of the VPC. type: string - contextPath: AWS.EC2.Vpcs.VpcId description: The ID of the VPC. type: string - contextPath: AWS.EC2.Vpcs.InstanceTenancy description: The allowed tenancy of instances launched into the VPC. type: string - contextPath: AWS.EC2.Vpcs.IsDefault description: Indicates whether the VPC is the default VPC. type: string - contextPath: AWS.EC2.Vpcs.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Vpcs.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.Vpcs.Tags.Ipv6CidrBlockAssociationSet.AssociationId description: The association ID for the IPv6 CIDR block. type: string - contextPath: AWS.EC2.Vpcs.Tags.Ipv6CidrBlockAssociationSet.Ipv6CidrBlock description: The IPv6 CIDR block. type: string - contextPath: AWS.EC2.Vpcs.Tags.Ipv6CidrBlockAssociationSet.Ipv6CidrBlockState.State description: The state of the CIDR block. type: string - contextPath: AWS.EC2.Vpcs.Tags.Ipv6CidrBlockAssociationSet.Ipv6CidrBlockState.StatusMessage description: A message about the status of the CIDR block, if applicable. type: string - contextPath: AWS.EC2.Vpcs.Tags.CidrBlockAssociationSet.AssociationId description: The association ID for the IPv4 CIDR block. type: string - contextPath: AWS.EC2.Vpcs.Tags.CidrBlockAssociationSet.CidrBlock description: The IPv4 CIDR block. type: string - contextPath: AWS.EC2.Vpcs.Tags.CidrBlockAssociationSet.CidrBlockState.State description: The state of the CIDR block. type: string - contextPath: AWS.EC2.Vpcs.Tags.CidrBlockAssociationSet.CidrBlockState.StatusMessage description: A message about the status of the CIDR block, if applicable. type: string - contextPath: AWS.EC2.Vpcs.AccountId description: The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided. type: string - arguments: - description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. name: filters - description: A comma-separated list of subnet IDs. name: subnet_ids - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 description: "Returns details for one or more provided subnets. Required IAM permission: ec2:DescribeSubnets." name: aws-ec2-subnets-describe outputs: - contextPath: AWS.EC2.Subnets.AvailabilityZone description: The Availability Zone of the subnet. type: string - contextPath: AWS.EC2.Subnets.AvailableIpAddressCount description: The number of unused private IPv4 addresses in the subnet. Note that the IPv4 addresses for any stopped instances are considered unavailable. type: number - contextPath: AWS.EC2.Subnets.CidrBlock description: The IPv4 CIDR block assigned to the subnet. type: string - contextPath: AWS.EC2.Subnets.DefaultForAz description: Indicates whether this is the default subnet for the Availability Zone. type: boolean - contextPath: AWS.EC2.Subnets.MapPublicIpOnLaunch description: Indicates whether instances launched in this subnet receive a public IPv4 address. type: boolean - contextPath: AWS.EC2.Subnets.State description: The current state of the subnet. type: string - contextPath: AWS.EC2.Subnets.SubnetId description: The ID of the subnet. type: string - contextPath: AWS.EC2.Subnets.VpcId description: The ID of the VPC the subnet is in. type: string - contextPath: AWS.EC2.Subnets.AssignIpv6AddressOnCreation description: Indicates whether a network interface created in this subnet (including a network interface created by RunInstances) receives an IPv6 address. type: boolean - contextPath: AWS.EC2.Subnets.Ipv6CidrBlockAssociationSet.AssociationId description: The association ID for the CIDR block. type: string - contextPath: AWS.EC2.Subnets.Ipv6CidrBlockAssociationSet.Ipv6CidrBlock description: The IPv6 CIDR block. type: string - contextPath: AWS.EC2.Subnets.Ipv6CidrBlockAssociationSet.Ipv6CidrBlockState.State description: The state of a CIDR block. type: string - contextPath: AWS.EC2.Subnets.Ipv6CidrBlockAssociationSet.Ipv6CidrBlockState.StatusMessage description: A message about the status of the CIDR block, if applicable. type: string - contextPath: AWS.EC2.Subnets.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Subnets.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.Subnets.AccountId description: The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided. type: string - name: aws-ec2-ipam-resource-discoveries-describe description: "Returns details for IPAM resource discoveries. A resource discovery is an IPAM component that enables IPAM to manage and monitor resources owned by the account. Required IAM permission: ec2:DescribeIpamResourceDiscoveries." arguments: - description: A comma-separated list of the IPAM resource discovery IDs. name: ipam_resource_discovery_ids - description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. name: filters - description: The maximum number of results to return in a single call. Specify a value between 5 and 1000. Default value is 50. name: limit defaultValue: 50 - description: The token for the next set of results. name: next_token - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The Amazon Web Services region for the IP address. name: address_region hidden: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 outputs: - contextPath: AWS.EC2.IpamResourceDiscoveries.IpamResourceDiscoveryId description: The resource discovery ID. type: String - contextPath: AWS.EC2.IpamResourceDiscoveries.OwnerId description: The ID of the owner. type: String - contextPath: AWS.EC2.IpamResourceDiscoveries.IpamResourceDiscoveryRegion description: The resource discovery region. type: String - contextPath: AWS.EC2.IpamResourceDiscoveries.AccountId description: The ID of the AWS account associated with the EC2 instance. This key is only present when the parameter "AWS organization accounts" is provided. type: string - name: aws-ec2-ipam-resource-discovery-associations-describe description: "Returns details for a resource discovery associated with an Amazon VPC IPAM. Required IAM permission: ec2:DescribeIpamResourceDiscoveryAssociations." arguments: - description: A comma-separated list of the resource discovery association IDs. name: ipam_resource_discovery_association_ids - description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. name: filters - description: The maximum number of results to return in a single call. Specify a value between 5 and 1000. Default value is 50. name: limit defaultValue: 50 - description: The token for the next set of results. name: next_token - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The Amazon Web Services region for the IP address. name: address_region hidden: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 outputs: - contextPath: AWS.EC2.IpamResourceDiscoveryAssociations.IpamResourceDiscoveryAssociationId description: The resource discovery association ID. type: String - contextPath: AWS.EC2.IpamResourceDiscoveryAssociations.IpamResourceDiscoveryId description: The resource discovery ID. type: String - contextPath: AWS.EC2.IpamResourceDiscoveryAssociations.IpamRegion description: The IPAM home region. type: String - contextPath: AWS.EC2.IpamResourceDiscoveryAssociations.AccountId description: The ID of the AWS account associated with the EC2 instance. This key is only present when the parameter "AWS organization accounts" is provided. type: string - name: aws-cloudtrail-trail-update description: 'Updates trail settings for event logging and log file handling. Designates an existing bucket for log delivery without requiring a service restart. Note: This must be executed from the region where the trail was created. Required IAM permission: cloudtrail:UpdateTrail.' arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: name description: The name of the trail or trail ARN. required: true - name: s3_bucket_name description: The name of the Amazon S3 bucket designated for publishing log files. required: false - name: s3_key_prefix description: The Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery. required: false - name: sns_topic_name description: The name of the Amazon SNS topic defined for notification of log file delivery. required: false - name: include_global_service_events description: Whether the trail is publishing events from global services such as IAM to the log files. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: is_multi_region_trail description: Whether the trail applies only to the current region or to all regions. The default is false. If the trail exists only in the current region and this value is set to true, shadow trails (replications of the trail) will be created in the other regions. If the trail exists in all regions and this value is set to false, the trail will remain in the region where it was created, and its shadow trails in other regions will be deleted. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: enable_log_file_validation description: Whether log file validation is enabled. The default is false. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: cloud_watch_logs_log_group_arn description: Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered. Not required unless you specify CloudWatchLogsRoleArn. required: false - name: cloud_watch_logs_role_arn description: The role for the CloudWatch Logs endpoint to assume to write to a user's log group. required: false - name: kms_key_id description: The KMS key ID to use to encrypt the logs delivered by CloudTrail. required: false outputs: - contextPath: AWS.CloudTrail.Trail.TrailARN description: The Amazon Resource Name (ARN) of the trail. type: string - contextPath: AWS.CloudTrail.Trail.Name description: The name of the trail. type: string - contextPath: AWS.CloudTrail.Trail.S3BucketName description: The name of the Amazon S3 bucket into which CloudTrail delivers your trail files. type: string - contextPath: AWS.CloudTrail.Trail.S3KeyPrefix description: The Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery. type: string - contextPath: AWS.CloudTrail.Trail.SnsTopicName description: The name of the Amazon SNS topic defined for notification of log file delivery. type: string - contextPath: AWS.CloudTrail.Trail.SnsTopicARN description: The Amazon Resource Name (ARN) of the Amazon SNS topic defined for notification of log file delivery. type: string - contextPath: AWS.CloudTrail.Trail.IncludeGlobalServiceEvents description: Set to True to include AWS API calls from AWS global services such as IAM. type: boolean - contextPath: AWS.CloudTrail.Trail.IsMultiRegionTrail description: Whether the trail exists only in one region or exists in all regions. type: boolean - contextPath: AWS.CloudTrail.Trail.HomeRegion description: The region in which the trail was created. type: string - contextPath: AWS.CloudTrail.Trail.LogFileValidationEnabled description: Whether log file validation is enabled. type: boolean - contextPath: AWS.CloudTrail.Trail.CloudWatchLogsLogGroupArn description: Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered. type: string - contextPath: AWS.CloudTrail.Trail.CloudWatchLogsRoleArn description: The role for the CloudWatch Logs endpoint to assume to write to a user's log group. type: string - contextPath: AWS.CloudTrail.Trail.KMSKeyId description: The KMS key ID that encrypts the logs delivered by CloudTrail. type: string - contextPath: AWS.CloudTrail.Trail.HasCustomEventSelectors description: Specifies if the trail has custom event selectors. type: boolean - contextPath: AWS.CloudTrail.Trail.HasInsightSelectors description: Whether a trail has insight selectors enabled. type: boolean - contextPath: AWS.CloudTrail.Trail.IsOrganizationTrail description: Whether the trail is an organization trail. type: boolean - name: aws-cloudtrail-trail-enable-log-validation-quick-action description: "Enables log file validation for the reported CloudTrail. Required IAM permission: cloudtrail:UpdateTrail." prettyname: Enable CloudTrail Log Validation hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: name prettyname: Name description: The name of the trail or trail ARN. required: true defaultValue: Name prettypredefined: Name: ${asset.xdm.asset.name} - name: enable_log_file_validation description: Whether log file validation is enabled. defaultValue: 'true' hidden: true outputs: - contextPath: AWS.CloudTrail.Trail.TrailARN description: The Amazon Resource Name (ARN) of the trail. type: string - contextPath: AWS.CloudTrail.Trail.Name description: The name of the trail. type: string - contextPath: AWS.CloudTrail.Trail.S3BucketName description: The name of the Amazon S3 bucket into which CloudTrail delivers your trail files. type: string - contextPath: AWS.CloudTrail.Trail.S3KeyPrefix description: The Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery. type: string - contextPath: AWS.CloudTrail.Trail.SnsTopicName description: The name of the Amazon SNS topic defined for notification of log file delivery. type: string - contextPath: AWS.CloudTrail.Trail.SnsTopicARN description: The Amazon Resource Name (ARN) of the Amazon SNS topic defined for notification of log file delivery. type: string - contextPath: AWS.CloudTrail.Trail.IncludeGlobalServiceEvents description: Set to True to include AWS API calls from global services, such as IAM. type: boolean - contextPath: AWS.CloudTrail.Trail.IsMultiRegionTrail description: Whether the trail exists in a single region or in all regions. type: boolean - contextPath: AWS.CloudTrail.Trail.HomeRegion description: The region in which the trail was created. type: string - contextPath: AWS.CloudTrail.Trail.LogFileValidationEnabled description: Whether log file validation is enabled. type: boolean - contextPath: AWS.CloudTrail.Trail.CloudWatchLogsLogGroupArn description: The Amazon Resource Name (ARN), a unique identifier representing the log group to which CloudTrail logs are delivered. type: string - contextPath: AWS.CloudTrail.Trail.CloudWatchLogsRoleArn description: The role that the CloudWatch Logs endpoint assumes to write to a user’s log group. type: string - contextPath: AWS.CloudTrail.Trail.KMSKeyId description: The KMS key ID that encrypts the logs delivered by CloudTrail. type: string - contextPath: AWS.CloudTrail.Trail.HasCustomEventSelectors description: Specifies if the trail has custom event selectors. type: boolean - contextPath: AWS.CloudTrail.Trail.HasInsightSelectors description: Whether a trail has insight selectors enabled. type: boolean - contextPath: AWS.CloudTrail.Trail.IsOrganizationTrail description: Whether the trail is an organization trail. type: boolean - name: aws-cloudtrail-logging-start description: "Starts recording AWS API calls and log file delivery for a trail. For trails enabled in all regions, this must be executed from the region where the trail was created. Cannot be executed on shadow trails (replicated trails in other regions). Required IAM permission: cloudtrail:StartLogging." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: name description: 'The name or the CloudTrail ARN of the trail for which CloudTrail logs Amazon Web Services API calls. e.g. arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail.' required: true - name: aws-cloudtrail-logging-start-enable-logging-quick-action description: "Enables CloudTrail logging. Required IAM permission: cloudtrail:StartLogging." prettyname: Enable CloudTrail Logging hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: name prettyname: Name description: 'The name or the CloudTrail ARN of the trail for which CloudTrail logs Amazon Web Services API calls. e.g. arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail.' required: true defaultValue: Name prettypredefined: Name: ${asset.xdm.asset.name} - name: aws-ec2-instances-describe description: "Returns details for specific instances or all instances. Required IAM permission: ec2:DescribeInstances." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: "A comma-separated list of instance IDs to describe. If empty, returns all accessible instances in the specified region." required: false isArray: true - name: filters description: "One or more custom filters to apply, separated by ';' (for example, name=;values=).You can specify up to 50 filters and up to 200 values per filter in a single request." required: false isArray: true - name: next_token description: "Token for pagination when retrieving large result sets. Use the InstancesNextToken value from a previous response to continue listing instances." required: false - name: limit description: "Maximum number of instances to return in a single request. You cannot specify this parameter and the instance IDs parameter in the same request." required: false defaultValue: 50 outputs: - contextPath: AWS.EC2.InstancesNextToken description: Token to use for pagination in subsequent requests. type: String - contextPath: AWS.EC2.Instances.Architecture description: The architecture of the image. type: String - contextPath: AWS.EC2.Instances.BlockDeviceMappings.DeviceName description: The device name. type: String - contextPath: AWS.EC2.Instances.BlockDeviceMappings.Ebs description: Parameters used to automatically set up EBS volumes when the instance is launched. type: Dictionary - contextPath: AWS.EC2.Instances.ClientToken description: The idempotency token you provided when you launched the instance, if applicable. type: String - contextPath: AWS.EC2.Instances.EbsOptimized description: Indicates whether the instance is optimized for Amazon EBS I/O. type: Boolean - contextPath: AWS.EC2.Instances.EnaSupport description: Specifies whether enhanced networking with ENA is enabled. type: Boolean - contextPath: AWS.EC2.Instances.Hypervisor description: The hypervisor type of the instance. type: String - contextPath: AWS.EC2.Instances.IamInstanceProfile.Arn description: The Amazon Resource Name (ARN) of the instance profile. type: String - contextPath: AWS.EC2.Instances.IamInstanceProfile.Id description: The ID of the instance profile. type: String - contextPath: AWS.EC2.Instances.InstanceLifecycle description: Indicates whether this is a Spot Instance or a Scheduled Instance. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.Association description: The association information for an Elastic IPv4 associated with the network interface. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.Attachment description: The network interface attachment. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.Description description: The description of the network interface. Applies only if creating a network interface when launching an instance. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.Groups description: The security groups. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.Ipv6Addresses description: The IPv6 addresses associated with the network interface. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.MacAddress description: The MAC address. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.NetworkInterfaceId description: The ID of the network interface. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.OwnerId description: The ID of the AWS account that owns the network interface. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.PrivateDnsName description: The private DNS name. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress description: The IPv4 address of the network interface within the subnet. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddresses description: The private IPv4 addresses associated with the network interface. type: Array - contextPath: AWS.EC2.Instances.NetworkInterfaces.SourceDestCheck description: Indicates whether to validate network traffic to or from this network interface. type: Boolean - contextPath: AWS.EC2.Instances.NetworkInterfaces.Status description: The status of the network interface. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.SubnetId description: The ID of the subnet associated with the network interface. Applies only if creating a network interface when launching an instance. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.VpcId description: The ID of the VPC. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.InterfaceType description: The type of network interface. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.Ipv4Prefixes description: The IPv4 prefixes assigned to the network interface. type: Array - contextPath: AWS.EC2.Instances.NetworkInterfaces.Ipv6Prefixes description: The IPv6 prefixes assigned to the network interface. type: Array - contextPath: AWS.EC2.Instances.NetworkInterfaces.ConnectionTrackingConfiguration description: A security group connection tracking configuration that enables you to set the timeout for connection tracking on an Elastic network interface. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.Operator description: The service provider that manages the network interface. type: Dictionary - contextPath: AWS.EC2.Instances.OutpostArn description: The Amazon Resource Name (ARN) of the Outpost. type: String - contextPath: AWS.EC2.Instances.RootDeviceName description: The device name of the root device volume. type: String - contextPath: AWS.EC2.Instances.RootDeviceType description: The root device type used by the AMI. type: String - contextPath: AWS.EC2.Instances.SecurityGroups.GroupId description: The ID of the security group. type: String - contextPath: AWS.EC2.Instances.SecurityGroups.GroupName description: The name of the security group. type: String - contextPath: AWS.EC2.Instances.SourceDestCheck description: Indicates whether source/destination checking is enabled. type: Boolean - contextPath: AWS.EC2.Instances.SpotInstanceRequestId description: The ID of the request for a Spot Instance request. type: String - contextPath: AWS.EC2.Instances.SriovNetSupport description: Specifies whether enhanced networking with the Intel 82599 Virtual Function interface is enabled. type: String - contextPath: AWS.EC2.Instances.StateReason description: The reason for the most recent state transition. May be an empty string. type: Dictionary - contextPath: AWS.EC2.Instances.Tags.Key description: The key of the tag. type: String - contextPath: AWS.EC2.Instances.Tags.Value description: The value of the tag. type: String - contextPath: AWS.EC2.Instances.VirtualizationType description: The virtualization type of the instance. type: String - contextPath: AWS.EC2.Instances.CpuOptions description: The CPU options for the instance. type: Dictionary - contextPath: AWS.EC2.Instances.CapacityBlockId description: The ID of the Capacity Block. type: String - contextPath: AWS.EC2.Instances.CapacityReservationId description: The ID of the Capacity Reservation. type: String - contextPath: AWS.EC2.Instances.CapacityReservationSpecification description: Information about the Capacity Reservation targeting option. type: Dictionary - contextPath: AWS.EC2.Instances.HibernationOptions.Configured description: Indicates whether the instance is enabled for hibernation. type: Boolean - contextPath: AWS.EC2.Instances.Licenses.LicenseConfigurationArn description: The Amazon Resource Name (ARN) of the license configuration. type: String - contextPath: AWS.EC2.Instances.MetadataOptions description: The metadata options for the instance. type: Dictionary - contextPath: AWS.EC2.Instances.EnclaveOptions.Enabled description: Indicates whether the instance is enabled for Amazon Web Services Nitro Enclaves. type: Boolean - contextPath: AWS.EC2.Instances.BootMode description: The boot mode that was specified by the AMI. type: String - contextPath: AWS.EC2.Instances.PlatformDetails description: The platform details value for the instance. type: String - contextPath: AWS.EC2.Instances.UsageOperation description: The usage operation value for the instance. type: String - contextPath: AWS.EC2.Instances.UsageOperationUpdateTime description: The time that the usage operation was last updated. type: Date - contextPath: AWS.EC2.Instances.PrivateDnsNameOptions.HostnameType description: The type of hostname to assign to an instance. type: String - contextPath: AWS.EC2.Instances.PrivateDnsNameOptions.EnableResourceNameDnsARecord description: Indicates whether to respond to DNS queries for instance hostnames with DNS A records. type: Boolean - contextPath: AWS.EC2.Instances.PrivateDnsNameOptions.EnableResourceNameDnsAAAARecord description: Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. type: Boolean - contextPath: AWS.EC2.Instances.Ipv6Address description: The IPv6 address assigned to the instance. type: String - contextPath: AWS.EC2.Instances.TpmSupport description: If the instance is configured for NitroTPM support, the value is v2.0. type: String - contextPath: AWS.EC2.Instances.MaintenanceOptions.AutoRecovery description: Information on the current automatic recovery behavior of your instance. type: String - contextPath: AWS.EC2.Instances.MaintenanceOptions.RebootMigration description: Specifies whether to attempt reboot migration during a user-initiated reboot of an instance that has a scheduled system-reboot event. type: String - contextPath: AWS.EC2.Instances.CurrentInstanceBootMode description: The boot mode that is used to boot the instance at launch or start. type: String - contextPath: AWS.EC2.Instances.NetworkPerformanceOptions.BandwidthWeighting description: Contains settings for the network performance options for your instance. type: String - contextPath: AWS.EC2.Instances.Operator description: The service provider that manages the instance. type: Dictionary - contextPath: AWS.EC2.Instances.InstanceId description: The ID of the instance. type: String - contextPath: AWS.EC2.Instances.ImageId description: The ID of the AMI used to launch the instance. type: String - contextPath: AWS.EC2.Instances.State.Code description: The current state of the instance as a 16-bit unsigned integer. type: Number - contextPath: AWS.EC2.Instances.State.Name description: The current state of the instance. type: String - contextPath: AWS.EC2.Instances.PrivateDnsName description: The private DNS hostname name assigned to the instance. type: String - contextPath: AWS.EC2.Instances.PublicDnsName description: The public DNS name assigned to the instance. type: String - contextPath: AWS.EC2.Instances.StateTransitionReason description: The reason for the most recent state transition. May be an empty string. type: String - contextPath: AWS.EC2.Instances.KeyName description: The name of the key pair used when the instance was launched. type: String - contextPath: AWS.EC2.Instances.AmiLaunchIndex description: The AMI launch index, which can be used to find this instance in the launch group. type: Number - contextPath: AWS.EC2.Instances.ProductCodes description: The product codes attached to this instance, if applicable. type: Dictionary - contextPath: AWS.EC2.Instances.InstanceType description: The instance type. type: String - contextPath: AWS.EC2.Instances.LaunchTime description: The time the instance was launched. type: String - contextPath: AWS.EC2.Instances.Placement.AvailabilityZoneId description: The ID of the Availability Zone of the instance. type: String - contextPath: AWS.EC2.Instances.Placement.Affinity description: The affinity setting for the instance on the Dedicated Host. type: String - contextPath: AWS.EC2.Instances.Placement.GroupName description: The name of the placement group the instance is in. type: String - contextPath: AWS.EC2.Instances.Placement.PartitionNumber description: The number of the partition that the instance is in. type: Number - contextPath: AWS.EC2.Instances.Placement.HostId description: The ID of the Dedicated Host on which the instance resides. type: String - contextPath: AWS.EC2.Instances.Placement.Tenancy description: The tenancy of the instance. type: String - contextPath: AWS.EC2.Instances.Placement.HostResourceGroupArn description: The ARN of the host resource group in which to launch the instances. type: String - contextPath: AWS.EC2.Instances.Placement.GroupId description: The ID of the placement group that the instance is in. type: String - contextPath: AWS.EC2.Instances.Placement.AvailabilityZone description: The availability zone of the instance. type: String - contextPath: AWS.EC2.Instances.KernelId description: The kernel associated with this instance, if applicable. type: String - contextPath: AWS.EC2.Instances.RamdiskId description: The RAM disk associated with this instance, if applicable. type: String - contextPath: AWS.EC2.Instances.Platform description: The platform the instance uses. The value is Windows for Windows instances; otherwise, blank. type: String - contextPath: AWS.EC2.Instances.Monitoring.State description: Indicates whether detailed monitoring is enabled. type: String - contextPath: AWS.EC2.Instances.SubnetId description: The ID of the subnet in which the instance is running. type: String - contextPath: AWS.EC2.Instances.VpcId description: The ID of the VPC in which the instance is running. type: String - contextPath: AWS.EC2.Instances.PrivateIpAddress description: The private IPv4 address assigned to the instance. type: String - contextPath: AWS.EC2.Instances.PublicIpAddress description: The public IPv4 address assigned to the instance. type: String - name: aws-ec2-instances-start description: "Starts an Amazon EBS-backed instance that was previously stopped. Required IAM permission: ec2:StartInstances." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: "A comma-separated list of instance IDs to start, in i-xxxxxxxxx format. Must be in 'stopped' state and user must have permissions." required: true isArray: true - name: aws-ec2-instances-stop description: "Stops an Amazon EBS-backed instance. Required IAM permission: ec2:StopInstances." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: "A comma-separated list of instance IDs to stop. Must be in 'running' or 'pending' state. User must have stop permissions for each instance." required: true isArray: true - name: force description: "Force stop instances without graceful shutdown. Default: false. Use with caution, as it may cause data loss." required: false auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' - name: hibernate description: "Hibernates the instance if the instance was enabled for hibernation at launch. If the instance cannot hibernate successfully, a normal shutdown occurs." required: false auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' - name: aws-ec2-instances-terminate description: "Shuts down specific instances. This operation is idempotent; you can terminate an instance multiple times without causing an error. Required IAM permission: ec2:TerminateInstances." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: "A comma-separated list of instance IDs to terminate. If you specify multiple instances and the request fails (for example, because of a single incorrect instance ID), none of the instances are terminated." required: true isArray: true - name: aws-ec2-instances-run description: "Launches a defined number of instances using an authorized AMI. Supports using a launch template to automate parameter entry. Check instance status using the aws-ec2-instances-describe command. Required IAM permission: ec2:RunInstances." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: count description: "The number of instances to launch. Must be greater than 0." required: true defaultValue: "1" - name: image_id description: "The ID of the AMI. An AMI ID is required to launch an instance and must be specified here or in a launch template." required: false - name: instance_type description: "The instance type, for example: t2.large, t3.medium, m5.xlarge." required: false - name: security_group_ids description: "A comma-separated list of security group IDs. Use this for VPC instances. If you don’t specify a security group ID, we use the default security group for the VPC." required: false isArray: true - name: security_groups_names description: "A comma-separated list of security group names. For a nondefault VPC, you must use security group IDs instead." required: false isArray: true - name: subnet_id description: "The ID of the subnet to launch the instance into. If you don't choose a subnet, we will use a default one from your default VPC. If you don't have a default VPC, you must specify a subnet ID yourself in the request." required: false - name: user_data description: "The user data to make available to the instance. This value will be base64 encoded automatically. Do not base64 encode this value prior to performing the operation." required: false - name: disable_api_termination description: "Indicates whether termination protection is enabled for the instance. The default is false, which means that you can terminate the instance using the Amazon EC2 console, command line tools, or API." required: false auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' - name: iam_instance_profile_arn description: "The Amazon Resource Name (ARN) of the instance profile. Both iam_instance_profile_arn and iam_instance_profile_name are required if you would like to associate an instance profile." required: false - name: iam_instance_profile_name description: "The name of the instance profile. Both iam_instance_profile_arn and iam_instance_profile_name are required if you would like to associate an instance profile." required: false - name: key_name description: "The name of the key pair. Warning - If you do not specify a key pair, you can't connect to the instance unless you choose an AMI that is configured to allow users another way to log in." required: false - name: ebs_optimized description: "Indicates whether the instance is optimized for Amazon EBS I/O." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: device_name description: "The device name (for example, /dev/sdh or xvdh). If the argument is given, EBS arguments must also be specified." required: false - name: ebs_volume_size description: "The size of the volume, in GiBs. You must specify either an ebs_snapshot_id or an ebs_volume_size. If you specify a snapshot, the default is the snapshot size. You can specify a volume size that is equal to or larger than the snapshot size." required: false - name: ebs_volume_type description: "The volume type." required: false auto: PREDEFINED predefined: - gp2 - gp3 - io1 - io2 - st1 - sc1 - standard - name: ebs_iops description: "The number of I/O operations per second (IOPS). For gp3, io1, and io2 volumes, this represents the number of IOPS that are provisioned for the volume. For gp2 volumes, this represents the baseline performance of the volume and the rate at which the volume accumulates I/O credits for bursting. This parameter is required for io1 and io2 volumes. The default for gp3 volumes is 3,000 IOPS." required: false - name: ebs_delete_on_termination description: "Indicates whether the EBS volume is deleted on instance termination." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: ebs_kms_key_id description: "Identifier (key ID, key alias, ID ARN, or alias ARN) for a user-managed CMK under which the EBS volume is encrypted." required: false - name: ebs_snapshot_id description: "The ID of the snapshot." required: false - name: ebs_encrypted description: "Indicates whether the encryption state of an EBS volume is changed while being restored from a backing snapshot." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: launch_template_id description: "The ID of the launch template to use to launch the instances. Any parameters that you specify in the command override the same parameters in the launch template. You can specify either the name or ID of a launch template, but not both." required: false - name: launch_template_name description: "The name of the launch template to use to launch the instances. Any parameters that you specify in the command override the same parameters in the launch template. You can specify either the name or ID of a launch template, but not both." required: false - name: launch_template_version description: "The launch template version number, $Latest, or $Default." required: false - name: tags description: One or more tags. Must be separated by a semicolon (;) and specified using the format "key=abc,value=123;key=fed,value=456". required: false - name: host_id description: "The Dedicated Host ID." required: false - name: enabled_monitoring description: "Indicates whether detailed monitoring is enabled. Otherwise, basic monitoring is enabled." required: false auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' outputs: - contextPath: AWS.EC2.Instances.Architecture description: The architecture of the image. type: String - contextPath: AWS.EC2.Instances.BlockDeviceMappings.DeviceName description: The device name. type: String - contextPath: AWS.EC2.Instances.BlockDeviceMappings.Ebs description: Parameters used to automatically set up EBS volumes when the instance is launched. type: Dictionary - contextPath: AWS.EC2.Instances.ClientToken description: The idempotency token you provided when you launched the instance, if applicable. type: String - contextPath: AWS.EC2.Instances.EbsOptimized description: Indicates whether the instance is optimized for Amazon EBS I/O. type: Boolean - contextPath: AWS.EC2.Instances.EnaSupport description: Specifies whether enhanced networking with ENA is enabled. type: Boolean - contextPath: AWS.EC2.Instances.Hypervisor description: The hypervisor type of the instance. type: String - contextPath: AWS.EC2.Instances.IamInstanceProfile.Arn description: The Amazon Resource Name (ARN) of the instance profile. type: String - contextPath: AWS.EC2.Instances.IamInstanceProfile.Id description: The ID of the instance profile. type: String - contextPath: AWS.EC2.Instances.InstanceLifecycle description: Indicates whether this is a Spot Instance or a Scheduled Instance. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.Association description: The association information for an Elastic IPv4 associated with the network interface. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.Attachment description: The network interface attachment. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.Description description: The description of the network interface. Applies only if creating a network interface when launching an instance. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.Groups description: The security groups. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.Ipv6Addresses description: The IPv6 addresses associated with the network interface. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.MacAddress description: The MAC address. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.NetworkInterfaceId description: The ID of the network interface. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.OwnerId description: The private DNS name. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.PrivateDnsName description: The IPv4 address of the network interface within the subnet. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress description: The IPv4 address of the network interface within the subnet. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddresses description: The private IPv4 addresses associated with the network interface. type: Array - contextPath: AWS.EC2.Instances.NetworkInterfaces.SourceDestCheck description: Indicates whether to validate network traffic to or from this network interface. type: Boolean - contextPath: AWS.EC2.Instances.NetworkInterfaces.Status description: The status of the network interface. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.SubnetId description: The ID of the subnet associated with the network interface. Applies only if creating a network interface when launching an instance. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.VpcId description: The ID of the VPC. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.InterfaceType description: The type of network interface. type: String - contextPath: AWS.EC2.Instances.NetworkInterfaces.Ipv4Prefixes description: The IPv4 prefixes assigned to the network interface. type: Array - contextPath: AWS.EC2.Instances.NetworkInterfaces.Ipv6Prefixes description: The IPv6 prefixes assigned to the network interface. type: Array - contextPath: AWS.EC2.Instances.NetworkInterfaces.ConnectionTrackingConfiguration description: A security group connection tracking configuration that enables you to set the timeout for connection tracking on an Elastic network interface. type: Dictionary - contextPath: AWS.EC2.Instances.NetworkInterfaces.Operator description: The service provider that manages the network interface. type: Dictionary - contextPath: AWS.EC2.Instances.OutpostArn description: The Amazon Resource Name (ARN) of the Outpost. type: String - contextPath: AWS.EC2.Instances.RootDeviceName description: The device name of the root device volume. type: String - contextPath: AWS.EC2.Instances.RootDeviceType description: The root device type used by the AMI. type: String - contextPath: AWS.EC2.Instances.SecurityGroups.GroupId description: The ID of the security group. type: String - contextPath: AWS.EC2.Instances.SecurityGroups.GroupName description: The name of the security group. type: String - contextPath: AWS.EC2.Instances.SourceDestCheck description: Indicates whether source/destination checking is enabled. type: Boolean - contextPath: AWS.EC2.Instances.SpotInstanceRequestId description: The ID of the request for a Spot Instance request. type: String - contextPath: AWS.EC2.Instances.SriovNetSupport description: Specifies whether enhanced networking with the Intel 82599 Virtual Function interface is enabled. type: String - contextPath: AWS.EC2.Instances.StateReason description: The reason for the most recent state transition. May be an empty string. type: Dictionary - contextPath: AWS.EC2.Instances.Tags.Key description: The key of the tag. type: String - contextPath: AWS.EC2.Instances.Tags.Value description: The value of the tag. type: String - contextPath: AWS.EC2.Instances.VirtualizationType description: The virtualization type of the instance. type: String - contextPath: AWS.EC2.Instances.CpuOptions description: The CPU options for the instance. type: Dictionary - contextPath: AWS.EC2.Instances.CapacityBlockId description: The ID of the Capacity Block. type: String - contextPath: AWS.EC2.Instances.CapacityReservationId description: The ID of the Capacity Reservation. type: String - contextPath: AWS.EC2.Instances.CapacityReservationSpecification description: Information about the Capacity Reservation targeting option. type: Dictionary - contextPath: AWS.EC2.Instances.HibernationOptions.Configured description: Indicates whether the instance is enabled for hibernation. type: Boolean - contextPath: AWS.EC2.Instances.Licenses.LicenseConfigurationArn description: The Amazon Resource Name (ARN) of the license configuration. type: String - contextPath: AWS.EC2.Instances.MetadataOptions description: The metadata options for the instance. type: Dictionary - contextPath: AWS.EC2.Instances.EnclaveOptions.Enabled description: Indicates whether the instance is enabled for Amazon Web Services Nitro Enclaves. type: Boolean - contextPath: AWS.EC2.Instances.BootMode description: The boot mode that was specified by the AMI. type: String - contextPath: AWS.EC2.Instances.PlatformDetails description: The platform details value for the instance. type: String - contextPath: AWS.EC2.Instances.UsageOperation description: The usage operation value for the instance. type: String - contextPath: AWS.EC2.Instances.UsageOperationUpdateTime description: The time that the usage operation was last updated. type: Date - contextPath: AWS.EC2.Instances.PrivateDnsNameOptions.HostnameType description: The type of hostname to assign to an instance. type: String - contextPath: AWS.EC2.Instances.PrivateDnsNameOptions.EnableResourceNameDnsARecord description: Indicates whether to respond to DNS queries for instance hostnames with DNS A records. type: Boolean - contextPath: AWS.EC2.Instances.PrivateDnsNameOptions.EnableResourceNameDnsAAAARecord description: Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. type: Boolean - contextPath: AWS.EC2.Instances.Ipv6Address description: The IPv6 address assigned to the instance. type: String - contextPath: AWS.EC2.Instances.TpmSupport description: If the instance is configured for NitroTPM support, the value is v2.0. type: String - contextPath: AWS.EC2.Instances.MaintenanceOptions.AutoRecovery description: Information on the current automatic recovery behavior of your instance. type: String - contextPath: AWS.EC2.Instances.MaintenanceOptions.RebootMigration description: Specifies whether to attempt reboot migration during a user-initiated reboot of an instance that has a scheduled system-reboot event. type: String - contextPath: AWS.EC2.Instances.CurrentInstanceBootMode description: The boot mode that is used to boot the instance at launch or start. type: String - contextPath: AWS.EC2.Instances.NetworkPerformanceOptions.BandwidthWeighting description: Contains settings for the network performance options for your instance. type: String - contextPath: AWS.EC2.Instances.Operator description: The service provider that manages the instance. type: Dictionary - contextPath: AWS.EC2.Instances.InstanceId description: The ID of the instance. type: String - contextPath: AWS.EC2.Instances.ImageId description: The ID of the AMI used to launch the instance. type: String - contextPath: AWS.EC2.Instances.State.Code description: The current state of the instance as a 16-bit unsigned integer. type: Number - contextPath: AWS.EC2.Instances.State.Name description: The current state of the instance. type: String - contextPath: AWS.EC2.Instances.PrivateDnsName description: The private DNS hostname name assigned to the instance. type: String - contextPath: AWS.EC2.Instances.PublicDnsName description: The public DNS name assigned to the instance. type: String - contextPath: AWS.EC2.Instances.StateTransitionReason description: The reason for the most recent state transition. May be an empty string. type: String - contextPath: AWS.EC2.Instances.KeyName description: The name of the key pair used when the instance was launched. type: String - contextPath: AWS.EC2.Instances.AmiLaunchIndex description: The AMI launch index, which can be used to find this instance in the launch group. type: Number - contextPath: AWS.EC2.Instances.ProductCodes description: The product codes attached to this instance, if applicable. type: Dictionary - contextPath: AWS.EC2.Instances.InstanceType description: The instance type. type: String - contextPath: AWS.EC2.Instances.LaunchTime description: The time the instance was launched. type: String - contextPath: AWS.EC2.Instances.Placement.AvailabilityZoneId description: The ID of the Availability Zone of the instance. type: String - contextPath: AWS.EC2.Instances.Placement.Affinity description: The affinity setting for the instance on the Dedicated Host. type: String - contextPath: AWS.EC2.Instances.Placement.GroupName description: The name of the placement group the instance is in. type: String - contextPath: AWS.EC2.Instances.Placement.PartitionNumber description: The number of the partition that the instance is in. type: Number - contextPath: AWS.EC2.Instances.Placement.HostId description: The ID of the Dedicated Host on which the instance resides. type: String - contextPath: AWS.EC2.Instances.Placement.Tenancy description: The tenancy of the instance. type: String - contextPath: AWS.EC2.Instances.Placement.HostResourceGroupArn description: The ARN of the host resource group in which to launch the instances. type: String - contextPath: AWS.EC2.Instances.Placement.GroupId description: The ID of the placement group that the instance is in. type: String - contextPath: AWS.EC2.Instances.Placement.AvailabilityZone description: The availability zone of the instance. type: String - contextPath: AWS.EC2.Instances.KernelId description: The kernel associated with this instance, if applicable. type: String - contextPath: AWS.EC2.Instances.RamdiskId description: The RAM disk associated with this instance, if applicable. type: String - contextPath: AWS.EC2.Instances.Platform description: The platform the instance uses. The value is Windows for Windows instances; otherwise, blank. type: String - contextPath: AWS.EC2.Instances.Monitoring.State description: Indicates whether detailed monitoring is enabled. type: String - contextPath: AWS.EC2.Instances.SubnetId description: The ID of the subnet in which the instance is running. type: String - contextPath: AWS.EC2.Instances.VpcId description: The ID of the VPC in which the instance is running. type: String - contextPath: AWS.EC2.Instances.PrivateIpAddress description: The private IPv4 address assigned to the instance. type: String - contextPath: AWS.EC2.Instances.PublicIpAddress description: The public IPv4 address assigned to the instance. type: String - name: aws-ec2-latest-ami-get description: "Retrieves the latest AMI. Required IAM permission: ec2:DescribeImages." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: executable_users description: Scopes the images by users with explicit launch permissions. - name: filters description: One or more filters. Filters must be separated by a semicolon (;) and specified using the format "key=key,values=val". Refer to the AWS documentation for detailed filter options. - name: owners description: Filters the images by the owner. Specify an AWS account ID, self (owner is the sender of the request), or an AWS owner alias (valid values are amazon | aws-marketplace | microsoft ). Omitting this option returns all images for which you have launch permissions, regardless of ownership. Separated by ','. - name: image_ids description: The image IDs separated by ','. - name: include_deprecated description: Specifies whether to include deprecated AMIs. auto: PREDEFINED predefined: - 'true' - 'false' - name: include_disabled description: Specifies whether to include disabled AMIs. auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.EC2.Images.Architecture description: The architecture of the image. type: string - contextPath: AWS.EC2.Images.CreationDate description: The date and time the image was created. type: date - contextPath: AWS.EC2.Images.ImageId description: The ID of the AMI. type: string - contextPath: AWS.EC2.Images.ImageLocation description: The location of the AMI. type: string - contextPath: AWS.EC2.Images.ImageType description: The type of image. type: string - contextPath: AWS.EC2.Images.Public description: Indicates whether the image has public launch permissions. The value is true if this image has public launch permissions or false if it has only implicit and explicit launch permissions. type: boolean - contextPath: AWS.EC2.Images.KernelId description: The kernel associated with the image, if any. Only applicable for machine images. type: string - contextPath: AWS.EC2.Images.OwnerId description: The AWS account ID of the image owner. type: string - contextPath: AWS.EC2.Images.Platform description: The value is Windows for Windows AMIs; otherwise blank. type: string - contextPath: AWS.EC2.Images.ProductCodes.ProductCodeId description: The product code. type: string - contextPath: AWS.EC2.Images.ProductCodes.ProductCodeType description: The type of product code. type: string - contextPath: AWS.EC2.Images.RamdiskId description: The RAM disk associated with the image, if any. Only applicable for machine images. type: string - contextPath: AWS.EC2.Images.State description: The current state of the AMI. If the state is available , the image is successfully registered and can be used to launch an instance. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.DeviceName description: The device name (for example, /dev/sdh or xvdh ). type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.VirtualName description: The virtual device name (ephemeral N). type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.Encrypted description: Indicates whether the EBS volume is encrypted. type: boolean - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.DeleteOnTermination description: Indicates whether the EBS volume is deleted on instance termination. type: boolean - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.Iops description: The number of I/O operations per second (IOPS) that the volume supports. type: number - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.KmsKeyId description: Identifier (key ID, key alias, ID ARN, or alias ARN) for a user-managed CMK under which the EBS volume is encrypted. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.SnapshotId description: The ID of the snapshot. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.VolumeSize description: The size of the volume, in GiB. type: number - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.VolumeType description: The volume type. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.NoDevice description: Suppresses the specified device included in the block device mapping of the AMI. type: string - contextPath: AWS.EC2.Images.Description description: The description of the AMI that was provided during image creation. type: string - contextPath: AWS.EC2.Images.EnaSupport description: Specifies whether enhanced networking with ENA is enabled. type: boolean - contextPath: AWS.EC2.Images.Hypervisor description: The hypervisor type of the image. type: string - contextPath: AWS.EC2.Images.ImageOwnerAlias description: The AWS account alias (for example, amazon , self ) or the AWS account ID of the AMI owner. type: string - contextPath: AWS.EC2.Images.Name description: The name of the AMI that was provided during image creation. type: string - contextPath: AWS.EC2.Images.RootDeviceName description: The device name of the root device volume (for example, /dev/sda1). type: string - contextPath: AWS.EC2.Images.RootDeviceType description: The type of root device used by the AMI. The AMI can use an EBS volume or an instance store volume. type: string - contextPath: AWS.EC2.Images.SriovNetSupport description: Specifies whether enhanced networking with the Intel 82599 Virtual Function interface is enabled. type: string - contextPath: AWS.EC2.Images.StateReason.Code description: The reason code for the state change. type: string - contextPath: AWS.EC2.Images.StateReason.Message description: The message for the state change. type: string - contextPath: AWS.EC2.Images.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Images.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.Images.VirtualizationType description: The type of virtualization of the AMI. type: string - contextPath: AWS.EC2.Images.AccountId description: The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided. type: string - name: aws-ec2-network-acl-create description: "Creates a network ACL in the defined VPC, providing an optional layer of security (in addition to security groups) for the instances in your VPC. Required IAM permission: ec2:CreateNetworkAcl." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: vpc_id description: The ID of the VPC. required: true - name: client_token description: Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. - name: tag_specifications description: The tags to assign to the network ACL. Must be separated by a semicolon (;) and specified using the format "key=key,values=val". outputs: - contextPath: AWS.EC2.VpcId.NetworkAcl.Associations.NetworkAclAssociationId description: The ID of the association between a network ACL and a subnet. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Associations.NetworkAclId description: The ID of the network ACL. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Associations.SubnetId description: The ID of the subnet. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.CidrBlock description: The IPv4 network range to allow or deny, in CIDR notation. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.Egress description: Indicates whether the rule is an egress rule (applied to traffic leaving the subnet). type: Boolean - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.IcmpTypeCode.Code description: The ICMP code. A value of -1 means all codes for the specified ICMP type. type: Number - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.IcmpTypeCode.Type description: The ICMP type. A value of -1 means all types. type: Number - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.Ipv6CidrBlock description: The IPv6 network range to allow or deny, in CIDR notation. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.PortRange.From description: The first port in the range. type: Number - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.PortRange.To description: The last port in the range. type: Number - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.Protocol description: The protocol number. A value of "-1" means all protocols. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.RuleAction description: Indicates whether to allow or deny the traffic that matches the rule. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Entries.RuleNumber description: The rule number for the entry. ACL entries are processed in ascending order by rule number. type: Number - contextPath: AWS.EC2.VpcId.NetworkAcl.NetworkAclId description: The ID of the network ACL. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Tags.Key description: The key of the tag. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.Tags.Value description: The value of the tag. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.VpcId description: The ID of the VPC for the network ACL. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.OwnerId description: The ID of the AWS account that owns the network ACL. type: String - contextPath: AWS.EC2.VpcId.NetworkAcl.AccountId description: The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided. type: string - name: aws-ec2-ipam-discovered-public-addresses-get description: "Retrieves the public IP addresses that have been discovered by IPAM, the Amazon VPC IP Address Manager. Required IAM permission: ec2:GetIpamDiscoveredPublicAddresses." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: ipam_resource_discovery_id description: An IPAM resource discovery ID. required: true - name: address_region description: The Amazon Web Services region for the IP address. required: true - name: filters description: One or more filters. Filters must be separated by a semicolon (;) and specified using the format "key=key,values=val". Refer to the AWS documentation for detailed filter options. - name: limit description: The maximum number of results to return in a single call. Specify a value between 1000 and 5000. - name: next_token description: The token for the next set of results. outputs: - contextPath: AWS.EC2.IpamDiscoveredPublicAddresses.Address description: IPAM discovered public addresses. type: String - contextPath: AWS.EC2.IpamDiscoveredPublicAddresses.AddressOwnerId description: The ID of the owner of the resource the IP address is assigned to. type: String - contextPath: AWS.EC2.IpamDiscoveredPublicAddresses.AddressType description: The IP address type. type: String - contextPath: AWS.EC2.IpamDiscoveredPublicAddresses.AssociationStatus description: The association status. type: String - contextPath: AWS.EC2.IpamDiscoveredPublicAddresses.InstanceId description: The instance ID of the instance the assigned IP address is assigned to. type: String - contextPath: AWS.EC2.IpamDiscoveredPublicAddresses.Tags description: Tags associated with the IP address. type: Unknown - contextPath: AWS.EC2.IpamDiscoveredPublicAddresses.AccountId description: The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided. type: string - name: aws-ec2-tags-create description: "Adds or overwrites one or more tags for specific Amazon EC2 resources. When you specify an existing tag key, the value is overwritten with the new value. Required IAM permission: ec2:CreateTags." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resources description: The IDs of one or more resources to tag, separated by a comma. For example, ami-1a2b3c4d. required: true - name: tags description: One or more tags. Must be separated by a semicolon (;) and specified using the format "key=abc,value=123;key=fed,value=456". required: true - name: aws-cloudtrail-trails-describe description: "Retrieves settings for a specific trail or returns information about all trails in the current AWS account. Required IAM permission: cloudtrail:DescribeTrails." arguments: - description: A comma-separated list of trail names or trail ARNs. If the list is empty, it returns information for the trail in the current region. name: trail_names - auto: PREDEFINED description: Include shadow trails in the response. A shadow trail is a replication in a region of a trail created in another region. name: include_shadow_trails predefined: - 'true' - 'false' defaultValue: 'true' - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 outputs: - contextPath: AWS.CloudTrail.Trails.Name description: The name of the trail, as set in CreateTrail. type: string - contextPath: AWS.CloudTrail.Trails.S3BucketName description: The name of the Amazon S3 bucket where CloudTrail delivers trail files. type: string - contextPath: AWS.CloudTrail.Trails.S3KeyPrefix description: The Amazon S3 key prefix appended to the bucket name designated for log file delivery. type: string - contextPath: AWS.CloudTrail.Trails.SnsTopicARN description: The ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered. type: string - contextPath: AWS.CloudTrail.Trails.IncludeGlobalServiceEvents description: Whether to include AWS API calls from AWS global services such as IAM. type: boolean - contextPath: AWS.CloudTrail.Trails.IsMultiRegionTrail description: Specifies whether the trail belongs only to one region or exists in all regions. type: boolean - contextPath: AWS.CloudTrail.Trails.HomeRegion description: The region where the trail was created. type: string - contextPath: AWS.CloudTrail.Trails.TrailARN description: The ARN of the trail. type: string - contextPath: AWS.CloudTrail.Trails.LogFileValidationEnabled description: Whether log file validation is enabled. type: boolean - contextPath: AWS.CloudTrail.Trails.CloudWatchLogsLogGroupArn description: The ARN of the CloudWatch log group to which CloudTrail logs are delivered. type: string - contextPath: AWS.CloudTrail.Trails.CloudWatchLogsRoleArn description: The role assumed by CloudTrail to write logs to the CloudWatch log group. type: string - contextPath: AWS.CloudTrail.Trails.KmsKeyId description: The KMS key ID that encrypts logs delivered by CloudTrail. type: string - contextPath: AWS.CloudTrail.Trails.HasCustomEventSelectors description: Specifies if the trail has custom event selectors. type: boolean - contextPath: AWS.CloudTrail.Trails.HasInsightSelectors description: Specifies whether a trail has insight types specified in an InsightSelector list. type: boolean - contextPath: AWS.CloudTrail.Trails.IsOrganizationTrail description: Specifies whether the trail is an organization trail. type: boolean - name: aws-s3-bucket-policy-delete description: "Deletes the bucket policy from an Amazon S3 bucket, removing all policy-based access controls from the bucket and potentially changing access permissions. Required IAM permission: s3:DeleteBucketPolicy." execution: true arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The name of the Amazon S3 bucket from which to delete the bucket policy. name: bucket required: true - name: aws-s3-public-access-block-get description: "Retrieves the public access block configuration for an Amazon S3 bucket. Shows the current settings that control public access to the bucket and its objects. Required IAM permission: s3:GetBucketPublicAccessBlock." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The name of the Amazon S3 bucket to retrieve public access block configuration from. name: bucket required: true - description: The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails. name: expected_bucket_owner outputs: - contextPath: AWS.S3.Buckets.BucketName description: The name of the S3 bucket. type: string - contextPath: AWS.S3.Buckets.PublicAccessBlock.BlockPublicAcls description: Whether Amazon S3 blocks public access control lists (ACLs) for this bucket and objects in this bucket. type: boolean - contextPath: AWS.S3.Buckets.PublicAccessBlock.IgnorePublicAcls description: Whether Amazon S3 ignores public ACLs for this bucket and objects in this bucket. type: boolean - contextPath: AWS.S3.Buckets.PublicAccessBlock.BlockPublicPolicy description: Whether Amazon S3 blocks public bucket policies for this bucket. type: boolean - contextPath: AWS.S3.Buckets.PublicAccessBlock.RestrictPublicBuckets description: Whether Amazon S3 restricts public bucket policies for this bucket. type: boolean - name: aws-ec2-images-describe description: "Describes the specified images (AMIs, AKIs, and ARIs) available to you or all of the images available to you. Required IAM Permission: ec2:DescribeImages." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options." required: false - name: image_ids description: "A comma-separated list of image IDs to describe." required: false isArray: true - name: owners description: "Filters the images by the owner. Specify an AWS account ID, self (owner is the sender of the request), or an AWS owner alias (valid values are amazon | aws-marketplace | microsoft). Omitting this option returns all images for which you have launch permissions, regardless of ownership. Separated by a comma." required: false isArray: true - name: executable_users description: "Scopes the images by users with explicit launch permissions. Specify an AWS account ID, self (the sender of the request), or all (public AMIs). Separated by a comma." required: false isArray: true - name: include_deprecated description: "Specifies whether to include deprecated AMIs. If not specified, the default behavior is determined by the AWS API." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: include_disabled description: "Specifies whether to include disabled AMIs. If not specified, the default behavior is determined by the AWS API." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: limit description: Maximum number of AMIs to be returned in response. required: false - name: next_token description: The token for the next set of AMIs to return. Use value from AWS.EC2.ImagesNextToken if available; otherwise, use the token from the output file header. required: false outputs: - contextPath: AWS.EC2.ImagesNextToken description: The token returned from a previous paginated request. type: string - contextPath: AWS.EC2.Images.Architecture description: The architecture of the image. type: string - contextPath: AWS.EC2.Images.CreationDate description: The date and time the image was created. type: date - contextPath: AWS.EC2.Images.ImageId description: The ID of the AMI. type: string - contextPath: AWS.EC2.Images.ImageLocation description: The location of the AMI. type: string - contextPath: AWS.EC2.Images.ImageType description: The type of image. type: string - contextPath: AWS.EC2.Images.Public description: Indicates whether the image has public launch permissions. type: boolean - contextPath: AWS.EC2.Images.KernelId description: The kernel associated with the image, if any. type: string - contextPath: AWS.EC2.Images.OwnerId description: The AWS account ID of the image owner. type: string - contextPath: AWS.EC2.Images.Platform description: The value is Windows for Windows AMIs; otherwise blank. type: string - contextPath: AWS.EC2.Images.ProductCodes.ProductCodeId description: The product code. type: string - contextPath: AWS.EC2.Images.ProductCodes.ProductCodeType description: The type of product code. type: string - contextPath: AWS.EC2.Images.RamdiskId description: The RAM disk associated with the image, if any. type: string - contextPath: AWS.EC2.Images.State description: The current state of the AMI. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.DeviceName description: The device name. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.VirtualName description: The virtual device name. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.Encrypted description: Indicates whether the EBS volume is encrypted. type: boolean - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.DeleteOnTermination description: Indicates whether the EBS volume is deleted upon instance termination. type: boolean - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.Iops description: The number of input/output operations per second (IOPS). type: number - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.KmsKeyId description: Identifier for a user-managed CMK under which the EBS volume is encrypted. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.SnapshotId description: The ID of the snapshot. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.VolumeSize description: The size of the EBS volume, in GiB. type: number - contextPath: AWS.EC2.Images.BlockDeviceMappings.Ebs.VolumeType description: The volume type. type: string - contextPath: AWS.EC2.Images.BlockDeviceMappings.NoDevice description: Suppresses the specified device included in the block device mapping. type: string - contextPath: AWS.EC2.Images.Description description: The description of the AMI. type: string - contextPath: AWS.EC2.Images.EnaSupport description: Specifies whether enhanced networking with ENA is enabled. type: boolean - contextPath: AWS.EC2.Images.Hypervisor description: The hypervisor type of the image. type: string - contextPath: AWS.EC2.Images.ImageOwnerAlias description: The AWS account alias or AWS account ID of the AMI owner. type: string - contextPath: AWS.EC2.Images.Name description: The name of the AMI. type: string - contextPath: AWS.EC2.Images.RootDeviceName description: The device name of the root device volume. type: string - contextPath: AWS.EC2.Images.RootDeviceType description: The type of root device used by the AMI. type: string - contextPath: AWS.EC2.Images.SriovNetSupport description: Indicates whether enhanced networking with the Intel 82599 VF interface is enabled. type: string - contextPath: AWS.EC2.Images.StateReason.Code description: The reason code for the state change. type: string - contextPath: AWS.EC2.Images.StateReason.Message description: The message for the state change. type: string - contextPath: AWS.EC2.Images.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Images.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.Images.VirtualizationType description: The type of virtualization of the AMI. type: string - contextPath: AWS.EC2.Images.BootMode description: The boot mode of the image. type: string - contextPath: AWS.EC2.Images.DeprecationTime description: The date and time to deprecate the AMI. type: string - contextPath: AWS.EC2.Images.ImdsSupport description: If v2.0, it indicates that IMDSv2 is specified in the AMI. type: string - contextPath: AWS.EC2.Images.SourceInstanceId description: The ID of the instance that the AMI was created from. type: string - contextPath: AWS.EC2.Images.AccountId description: The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided. type: string - name: aws-ec2-image-create description: "Creates an Amazon Machine Image (AMI) from an Amazon EBS-backed instance. The instance must be in the running or stopped state. Required IAM Permission: ec2:CreateImage." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: name description: A name for the new image. required: true - name: instance_id description: The ID of the instance. required: true - name: description description: A description for the new image. required: false - name: no_reboot description: By default, Amazon EC2 attempts to shut down and reboot the instance before creating the image. If the No Reboot option is set, Amazon EC2 doesn't shut down the instance before creating the image. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: block_device_mappings description: The block devices for the instance in JSON format. required: false - name: tag_specifications description: The tags to apply to the AMI and snapshots on creation. Must be separated by a semicolon (;) and specified using the format "key=key,value=val". required: false outputs: - contextPath: AWS.EC2.Images.ImageId description: The ID of the new AMI. type: string - contextPath: AWS.EC2.Images.Name description: The name of the new AMI. type: string - contextPath: AWS.EC2.Images.InstanceId description: The ID of the instance used to create the AMI. type: string - contextPath: AWS.EC2.Images.Region description: The AWS region where the AMI was created. type: string - name: aws-ec2-image-deregister description: "Deregisters the specified Amazon Machine Image (AMI). After you deregister an AMI, it can't be used to launch new instances. However, it doesn't affect any instances that you've already launched from the AMI. Required IAM Permission: ec2:DeregisterImage." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: image_id description: The ID of the AMI to deregister. required: true - name: aws-ec2-image-copy description: "Initiates the copy of an AMI from the specified source region to the current region. You can copy an AMI across regions to enable consistent global deployment. Required IAM Permission: ec2:CopyImage." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: name description: A name for the new AMI in the destination region. required: true - name: source_image_id description: The ID of the AMI to copy. required: true - name: source_region description: The name of the region that contains the AMI to copy. required: true - name: description description: A description for the new AMI in the destination region. required: false - name: encrypted description: Specifies whether the destination snapshots of the copied image should be encrypted. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: kms_key_id description: The identifier of the symmetric AWS KMS key to use when creating encrypted volumes. If this parameter is not specified, your AWS managed key for Amazon EBS is used. required: false - name: client_token description: Unique, case-sensitive identifier you provide to ensure idempotency of the request. required: false outputs: - contextPath: AWS.EC2.Images.ImageId description: The ID of the new AMI. type: string - contextPath: AWS.EC2.Images.Name description: The name of the new AMI. type: string - contextPath: AWS.EC2.Images.SourceImageId description: The ID of the source AMI. type: string - contextPath: AWS.EC2.Images.SourceRegion description: The source region from which the AMI was copied. type: string - contextPath: AWS.EC2.Images.Region description: The region to which the AMI was copied. type: string - name: aws-ec2-image-available-waiter description: "Waits until an AMI is in the 'available' state. This command polls the AMI status until it becomes available or the maximum wait time is reached. Required IAM Permission: ec2:DescribeImages." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options." required: false - name: image_ids description: "A comma-separated list of image IDs to wait for." required: false isArray: true - name: owners description: "Filters the images by the owner. Specify an AWS account ID, self (owner is the sender of the request), or an AWS owner alias (valid values are amazon | aws-marketplace | microsoft). Separated by a comma." required: false isArray: true - name: executable_users description: "Scopes the images by users with explicit launch permissions. Specify an AWS account ID, self (the sender of the request), or all (public AMIs). Separated by a comma." required: false isArray: true - name: waiter_delay description: "The amount of time in seconds to wait between attempts. Default is 15 seconds." required: false defaultValue: "15" - name: waiter_max_attempts description: "The maximum number of attempts to check the image status. Default is 40 attempts." required: false defaultValue: "40" - name: aws-ec2-snapshots-describe description: "Describes the EBS snapshots available to you or all snapshots accessible in your environment. Required IAM Permission: ec2:DescribeSnapshots." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. - name: limit description: The maximum number of snapshots to return for this request. This value can be between 5 and 1000. - name: next_token description: The token returned from the previous paginated request. Use it to continue retrieving results from where the last request ended. - name: owner_ids description: A comma-separated list of possible owners IDs. Scopes the results to snapshots with the specified owners. isArray: true - name: restorable_by_user_ids description: A comma-separated list of IDs of the AWS accounts that can create volumes from the snapshot. isArray: true - name: snapshot_ids description: A comma-separated list of snapshot IDs. isArray: true outputs: - contextPath: AWS.EC2.Snapshots.DataEncryptionKeyId description: The data encryption key identifier for the snapshot. type: string - contextPath: AWS.EC2.Snapshots.Description description: The description for the snapshot. type: string - contextPath: AWS.EC2.Snapshots.Encrypted description: Indicates whether the snapshot is encrypted. type: boolean - contextPath: AWS.EC2.Snapshots.KmsKeyId description: The Amazon Resource Name (ARN) of the AWS KMS key that was used to protect the volume encryption key for the parent volume. type: string - contextPath: AWS.EC2.Snapshots.OwnerId description: The ID of the AWS account that owns the EBS snapshot. type: string - contextPath: AWS.EC2.Snapshots.Progress description: The progress of the snapshot, as a percentage. type: string - contextPath: AWS.EC2.Snapshots.SnapshotId description: The ID of the snapshot. Each snapshot receives a unique identifier when it is created. type: string - contextPath: AWS.EC2.Snapshots.StartTime description: The time stamp when the snapshot was initiated. type: date - contextPath: AWS.EC2.Snapshots.State description: The snapshot state. type: string - contextPath: AWS.EC2.Snapshots.StateMessage description: Encrypted Amazon EBS snapshots are copied asynchronously. If a snapshot copy operation fails, this field displays error state details to help you diagnose why the error occurred. type: string - contextPath: AWS.EC2.Snapshots.VolumeId description: The ID of the volume that was used to create the snapshot. type: string - contextPath: AWS.EC2.Snapshots.VolumeSize description: The size of the volume, in GiB. type: number - contextPath: AWS.EC2.Snapshots.OwnerAlias description: The AWS owner alias, from an Amazon-maintained list (amazon). This is not the user-configured AWS account alias set using the IAM console. type: string - contextPath: AWS.EC2.Snapshots.OutpostArn description: The ARN of the Outpost on which the snapshot is stored. type: string - contextPath: AWS.EC2.Snapshots.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Snapshots.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.Snapshots.StorageTier description: The storage tier in which the snapshot is stored. type: string - contextPath: AWS.EC2.Snapshots.RestoreExpiryTime description: Only for archived snapshots that are temporarily restored. Indicates the date and time when a temporarily restored snapshot will be automatically re-archived. type: date - contextPath: AWS.EC2.Snapshots.SseType description: Reserved for future use. type: string - contextPath: AWS.EC2.SnapshotsNextToken description: Next page token for pagination. type: string - name: aws-ec2-snapshot-delete description: "Deletes the specified snapshot. Required IAM Permission: ec2:DeleteSnapshot." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: snapshot_id description: The ID of the EBS snapshot. required: true - name: aws-ec2-snapshot-copy description: "Copies a point-in-time snapshot of an EBS volume and stores it in Amazon S3. You can copy a snapshot within the same Region, from one Region to another, or from a Region to an Outpost. Required IAM Permission: ec2:CopySnapshot." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: source_snapshot_id description: The ID of the EBS snapshot to copy. required: true - name: source_region description: The ID of the Region that contains the snapshot to be copied. required: true - name: description description: A description for the EBS snapshot. - name: destination_outpost_arn description: The Amazon Resource Name (ARN) of the Outpost where the snapshot will be copied. - name: encrypted description: Use this parameter to encrypt a copy of an unencrypted snapshot when encryption-by-default is not enabled. Otherwise, omit it. auto: PREDEFINED predefined: - 'true' - 'false' - name: kms_key_id description: The identifier of the AWS KMS key to use for Amazon EBS encryption. If this parameter is not specified, your AWS managed key for Amazon EBS is used. - name: presigned_url description: When you copy an encrypted source snapshot using the Amazon EC2 Query API, you must supply a pre-signed URL. - name: tag_specifications description: The tags to apply to the new snapshot. The tags must be separated by a semicolon (;) and specified using the format "key=key,values=val". isArray: true outputs: - contextPath: AWS.EC2.Snapshots.SnapshotId description: The ID of the new snapshot. type: string - contextPath: AWS.EC2.Snapshots.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Snapshots.Tags.Value description: The value of the tag. type: string - name: aws-ec2-snapshot-completed-waiter description: "A waiter function that waits until the snapshot is complete. Required IAM Permission: ec2:DescribeSnapshots." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. - name: owner_ids description: A comma-separated list of possible owners IDs. Scopes the results to snapshots with the specified owners. isArray: true - name: restorable_by_user_ids description: A comma-separated list of IDs of the AWS accounts that can create volumes from the snapshot. isArray: true - name: snapshot_ids description: A comma-separated list of snapshot IDs. isArray: true - name: waiter_delay description: The amount of time in seconds to wait between attempts. Default 15. defaultValue: "15" - name: waiter_max_attempts description: The maximum number of attempts to be made. Default 40. defaultValue: "40" - name: aws-s3-bucket-encryption-get description: "Retrieves the default encryption configuration for an Amazon S3 bucket. Shows the server-side encryption settings that are applied to new objects stored in the bucket. Required IAM permission: s3:GetEncryptionConfiguration." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: Name of the S3 bucket to retrieve encryption configuration from. Must follow S3 naming conventions. name: bucket required: true outputs: - contextPath: AWS.S3.Buckets.BucketName description: The name of the S3 bucket. type: string - contextPath: AWS.S3.Buckets.ServerSideEncryptionConfiguration.Rules description: The container for information about a particular server-side encryption configuration rule. type: array - name: aws-s3-bucket-policy-get description: "Retrieves the bucket policy for an Amazon S3 bucket. Returns the policy document in JSON format if one exists. Required IAM permission: s3:GetBucketPolicy." arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The name of the S3 bucket whose policy you want to retrieve. Must follow S3 naming conventions. name: bucket required: true - description: The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails. name: expected_bucket_owner outputs: - contextPath: AWS.S3.Buckets.BucketName description: The name of the S3 bucket. type: string - contextPath: AWS.S3.Buckets.Policy.Version description: The version of the policy. type: string - contextPath: AWS.S3.Buckets.Policy.Id description: The id of the policy. type: string - contextPath: AWS.S3.Buckets.Policy.Statement.Sid description: The identifier of the policy statement. type: string - contextPath: AWS.S3.Buckets.Policy.Statement.Effect description: The specification of whether the statement results in an allow or an explicit deny. type: string - contextPath: AWS.S3.Buckets.Policy.Statement.Principal description: The principal that is allowed or denied access to a resource. type: Unknown - contextPath: AWS.S3.Buckets.Policy.Statement.Action description: The specific action or actions that will be allowed or denied. type: Unknown - contextPath: AWS.S3.Buckets.Policy.Statement.Resource description: The object or objects that the statement applies to. type: Unknown - contextPath: AWS.S3.Buckets.Policy.Statement.Condition description: The conditions for when a policy is in effect. type: string - name: aws-lambda-function-configuration-get arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name required: true description: Name, ARN, or qualified name of the Lambda function. - name: qualifier description: Version number or alias name. description: "Retrieves configuration information about a Lambda function. Required IAM permission: lambda:GetFunctionConfiguration." outputs: - contextPath: AWS.Lambda.FunctionConfig.FunctionName description: The name of the function. type: String - contextPath: AWS.Lambda.FunctionConfig.FunctionArn description: The function’s Amazon Resource Name (ARN). type: String - contextPath: AWS.Lambda.FunctionConfig.Runtime description: The identifier of the function’s runtime. type: String - contextPath: AWS.Lambda.FunctionConfig.Role description: The function’s execution role. type: String - contextPath: AWS.Lambda.FunctionConfig.Handler description: The function that Lambda calls to begin running your function. type: String - contextPath: AWS.Lambda.FunctionConfig.CodeSize description: The size of the function’s deployment package, in bytes. type: Number - contextPath: AWS.Lambda.FunctionConfig.Description description: The function’s description. type: String - contextPath: AWS.Lambda.FunctionConfig.Timeout description: The amount of time in seconds that Lambda allows a function to run before stopping it. type: Number - contextPath: AWS.Lambda.FunctionConfig.MemorySize description: The amount of memory available to the function at runtime. type: Number - contextPath: AWS.Lambda.FunctionConfig.LastModified description: The date and time that the function was last updated. type: String - contextPath: AWS.Lambda.FunctionConfig.CodeSha256 description: The SHA256 hash of the function’s deployment package. type: String - contextPath: AWS.Lambda.FunctionConfig.Version description: The version of the Lambda function. type: String - contextPath: AWS.Lambda.FunctionConfig.VpcConfig.SubnetIds description: A list of VPC subnet IDs. - contextPath: AWS.Lambda.FunctionConfig.VpcConfig.SecurityGroupIds description: A list of VPC security group IDs. - contextPath: AWS.Lambda.FunctionConfig.VpcConfig.VpcId description: The ID of the VPC. type: String - contextPath: AWS.Lambda.FunctionConfig.VpcConfig.Ipv6AllowedForDualStack description: Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets. type: Boolean - contextPath: AWS.Lambda.FunctionConfig.DeadLetterConfig.TargetArn description: The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic. type: String - contextPath: AWS.Lambda.FunctionConfig.Environment.Variables description: Environment variable key-value pairs. Omitted from CloudTrail logs. - contextPath: AWS.Lambda.FunctionConfig.Environment.Error.ErrorCode description: The error code. type: String - contextPath: AWS.Lambda.FunctionConfig.Environment.Error.Message description: The error message. type: String - contextPath: AWS.Lambda.FunctionConfig.KMSKeyArn description: The ARN of the Key Management Service (KMS). type: String - contextPath: AWS.Lambda.FunctionConfig.TracingConfig.Mode description: The tracing mode. type: String - contextPath: AWS.Lambda.FunctionConfig.MasterArn description: For Lambda@Edge functions, the ARN of the main function. type: String - contextPath: AWS.Lambda.FunctionConfig.RevisionId description: The latest updated revision of the function or alias. type: String - contextPath: AWS.Lambda.FunctionConfig.Layers.Arn description: The Amazon Resource Name (ARN) of the function layer. type: String - contextPath: AWS.Lambda.FunctionConfig.Layers.CodeSize description: The size of the layer archive in bytes. type: Number - contextPath: AWS.Lambda.FunctionConfig.Layers.SigningProfileVersionArn description: The Amazon Resource Name (ARN) for a signing profile version. type: String - contextPath: AWS.Lambda.FunctionConfig.Layers.SigningJobArn description: The Amazon Resource Name (ARN) of a signing job. type: String - contextPath: AWS.Lambda.FunctionConfig.State description: The current state of the function. type: String - contextPath: AWS.Lambda.FunctionConfig.StateReason description: The reason for the function’s current state. type: String - contextPath: AWS.Lambda.FunctionConfig.StateReasonCode description: The reason code for the function’s current state. type: String - contextPath: AWS.Lambda.FunctionConfig.LastUpdateStatus description: The status of the last update that was performed on the function. type: String - contextPath: AWS.Lambda.FunctionConfig.LastUpdateStatusReason description: The reason for the last update that was performed on the function. type: String - contextPath: AWS.Lambda.FunctionConfig.LastUpdateStatusReasonCode description: The reason code for the last update that was performed on the function. type: String - contextPath: AWS.Lambda.FunctionConfig.FileSystemConfigs.Arn description: The Amazon Resource Name (ARN) of the Amazon EFS access point that provides access to the file system. type: String - contextPath: AWS.Lambda.FunctionConfig.FileSystemConfigs.LocalMountPath description: The path where the function can access the file system, starting with /mnt/. type: String - contextPath: AWS.Lambda.FunctionConfig.PackageType description: The type of deployment package. type: String - contextPath: AWS.Lambda.FunctionConfig.ImageConfigResponse.ImageConfig.EntryPoint description: Specifies the entry point to their application, which is typically the location of the runtime executable. type: String - contextPath: AWS.Lambda.FunctionConfig.ImageConfigResponse.ImageConfig.Command description: Specifies parameters that you want to pass in with ENTRYPOINT. type: String - contextPath: AWS.Lambda.FunctionConfig.ImageConfigResponse.ImageConfig.WorkingDirectory description: Specifies the working directory. type: String - contextPath: AWS.Lambda.FunctionConfig.ImageConfigResponse.Error.ErrorCode description: Error code. type: String - contextPath: AWS.Lambda.FunctionConfig.ImageConfigResponse.Error.Message description: Error message. type: String - contextPath: AWS.Lambda.FunctionConfig.SigningProfileVersionArn description: The ARN of the signing profile version. type: String - contextPath: AWS.Lambda.FunctionConfig.SigningJobArn description: The ARN of the signing job. type: String - contextPath: AWS.Lambda.FunctionConfig.Architectures description: The size of the function’s /tmp directory in MB. type: String - contextPath: AWS.Lambda.FunctionConfig.EphemeralStorage.Size description: The size of the function’s /tmp directory. type: Number - contextPath: AWS.Lambda.FunctionConfig.SnapStart.ApplyOn description: When set to PublishedVersions, Lambda creates a snapshot of the execution environment when you publish a function version. type: String - contextPath: AWS.Lambda.FunctionConfig.SnapStart.OptimizationStatus description: When you provide a qualified Amazon Resource Name (ARN), this response element indicates whether SnapStart is activated for the specified function version. type: String - contextPath: AWS.Lambda.FunctionConfig.RuntimeVersionConfig.RuntimeVersionArn description: The ARN of the runtime version you want the function to use. type: String - contextPath: AWS.Lambda.FunctionConfig.RuntimeVersionConfig.Error.ErrorCode description: The error code. type: String - contextPath: AWS.Lambda.FunctionConfig.RuntimeVersionConfig.Error.Message description: The error message. type: String - contextPath: AWS.Lambda.FunctionConfig.LoggingConfig.LogFormat description: The format in which Lambda sends your function’s application and system logs to CloudWatch. type: String - contextPath: AWS.Lambda.FunctionConfig.LoggingConfig.ApplicationLogLevel description: Set this property to filter the application logs for your function that Lambda sends to CloudWatch. type: String - contextPath: AWS.Lambda.FunctionConfig.LoggingConfig.SystemLogLevel description: Set this property to filter the system logs for your function that Lambda sends to CloudWatch. type: String - contextPath: AWS.Lambda.FunctionConfig.LoggingConfig.LogGroup description: The name of the Amazon CloudWatch log group the function sends logs to. type: String - name: aws-lambda-function-url-config-get arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name required: true description: Name of the Lambda function. - name: qualifier description: The alias name or version number. description: "Returns the configuration for a Lambda function URL. Required IAM permission: lambda:GetFunctionUrlConfig." outputs: - contextPath: AWS.Lambda.FunctionURLConfig.FunctionUrl description: The HTTP URL endpoint for your function. type: String - contextPath: AWS.Lambda.FunctionURLConfig.FunctionArn description: The Amazon Resource Name (ARN) of your function. type: String - contextPath: AWS.Lambda.FunctionURLConfig.AuthType description: The type of authentication that your function URL uses. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.AllowCredentials description: Whether to allow cookies or other credentials in requests to your function URL. type: Boolean - contextPath: AWS.Lambda.FunctionURLConfig.Cors.AllowHeaders description: The HTTP headers that origins can include in requests to your function URL. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.AllowMethods description: The HTTP methods that are allowed when calling your function URL. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.AllowOrigins description: The origins that can access your function URL. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.ExposeHeaders description: The HTTP headers in your function response that you want to expose to origins that call your function URL. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.MaxAge description: The maximum amount of time, in seconds, that web browsers can cache results of a preflight request. type: Number - contextPath: AWS.Lambda.FunctionURLConfig.CreationTime description: When the function URL was created. type: String - contextPath: AWS.Lambda.FunctionURLConfig.LastModifiedTime description: When the function URL configuration was last updated. type: String - contextPath: AWS.Lambda.FunctionURLConfig.InvokeMode description: BUFFERED or RESPONSE_STREAM. type: String - name: aws-lambda-policy-get arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name required: true description: Name of the Lambda function, version, or alias. - name: qualifier description: Version or alias to get the policy for. description: "Returns the resource-based IAM policy for a Lambda function. Required IAM permission: lambda:GetPolicy." outputs: - contextPath: AWS.Lambda.Policy.Version description: The policy version. type: Date - contextPath: AWS.Lambda.Policy.Id description: The identifier of the policy. type: String - contextPath: AWS.Lambda.Policy.Statement.Sid description: Identifier of the policy statement. type: String - contextPath: AWS.Lambda.Policy.Statement.Effect description: Specifies whether the statement results in an allow or an explicit deny. type: String - contextPath: AWS.Lambda.Policy.Statement.Principal description: Specify the principal that is allowed or denied access to a resource. - contextPath: AWS.Lambda.Policy.Statement.Action description: Describes the specific action or actions that will be allowed or denied. - contextPath: AWS.Lambda.Policy.Statement.Resource description: Defines the object or objects that the statement applies to. - contextPath: AWS.Lambda.Policy.Statement.Condition description: Specify conditions for when a policy is in effect. type: String - contextPath: AWS.Lambda.Policy.RevisionId description: A unique identifier for the current revision of the policy. type: String - contextPath: AWS.Lambda.Policy.AccountId description: The AWS account ID. type: String - contextPath: AWS.Lambda.Policy.FunctionName description: The Function Name. type: String - contextPath: AWS.Lambda.Policy.Region description: The AWS Region. type: String - name: aws-lambda-invoke arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name required: true description: Name of the Lambda function to invoke. - name: invocation_type description: RequestResponse (sync), Event (async), or DryRun. Default is RequestResponse. defaultValue: RequestResponse auto: PREDEFINED predefined: - RequestResponse - Event - DryRun - name: log_type auto: PREDEFINED predefined: - None - Tail description: Set to Tail to include execution log in response. - name: client_context description: Base64-encoded client context data. - name: payload description: JSON input to provide to the Lambda function. - name: qualifier description: Version or alias to invoke. description: "Invokes a Lambda function. Define only the function name to invoke the latest version, or use the Qualifier parameter for a specific version or alias. Note: Synchronous calls may retry on timeout, potentially causing client disconnection. Asynchronous calls require idempotent functions to handle multiple possible invocations. Required IAM permission: lambda:InvokeFunction." execution: true outputs: - contextPath: AWS.Lambda.InvokedFunction.StatusCode description: The HTTP status code is in the 200 range for a successful request. type: Number - contextPath: AWS.Lambda.InvokedFunction.FunctionError description: If present, indicates that an error occurred during function execution. type: String - contextPath: AWS.Lambda.InvokedFunction.LogResult description: The last 4 KB of the execution log, which is base64-encoded. type: String - contextPath: AWS.Lambda.InvokedFunction.Payload description: The response from the function, or an error object. type: Unknown - contextPath: AWS.Lambda.InvokedFunction.ExecutedVersion description: The version of the function that executed. type: String - contextPath: AWS.Lambda.InvokedFunction.FunctionName description: The name of the Lambda function. type: string - name: aws-lambda-function-url-config-update arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name required: true description: Name of the Lambda function. - name: qualifier description: The alias name or version number. - name: auth_type description: AWS_IAM or NONE for authentication type. auto: PREDEFINED predefined: - "AWS_IAM" - "NONE" - name: cors_allow_credentials description: Allow credentials in CORS requests. auto: PREDEFINED predefined: - "true" - "false" - name: cors_allow_headers description: Comma-separated list of allowed headers. isArray: true - name: cors_allow_methods description: Comma-separated list of allowed HTTP methods. isArray: true - name: cors_allow_origins description: Comma-separated list of allowed origins. isArray: true - name: cors_expose_headers description: Comma-separated list of headers to expose. isArray: true - name: cors_max_age description: Maximum age for CORS preflight cache. - name: invoke_mode auto: PREDEFINED predefined: - "BUFFERED" - "RESPONSE_STREAM" description: BUFFERED or RESPONSE_STREAM. description: "Updates the configuration for a Lambda function URL. Required IAM permission: lambda:UpdateFunctionUrlConfig." outputs: - contextPath: AWS.Lambda.FunctionURLConfig.FunctionUrl description: The HTTP URL endpoint for your function. type: String - contextPath: AWS.Lambda.FunctionURLConfig.FunctionArn description: The Amazon Resource Name (ARN) of your function. type: String - contextPath: AWS.Lambda.FunctionURLConfig.AuthType description: The type of authentication that your function URL uses. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.AllowCredentials description: Whether to allow cookies or other credentials in requests to your function URL. type: Boolean - contextPath: AWS.Lambda.FunctionURLConfig.Cors.AllowHeaders description: The HTTP headers that origins can include in requests to your function URL. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.AllowMethods description: The HTTP methods that are allowed when calling your function URL. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.AllowOrigins description: The origins that can access your function URL. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.ExposeHeaders description: The HTTP headers in your function response that you want to expose to origins that call your function URL. type: String - contextPath: AWS.Lambda.FunctionURLConfig.Cors.MaxAge description: The maximum amount of time, in seconds, that web browsers can cache results of a preflight request. type: Number - contextPath: AWS.Lambda.FunctionURLConfig.CreationTime description: When the function URL was created. type: String - contextPath: AWS.Lambda.FunctionURLConfig.LastModifiedTime description: When the function URL configuration was last updated. type: String - contextPath: AWS.Lambda.FunctionURLConfig.InvokeMode description: BUFFERED or RESPONSE_STREAM. type: String # aws-lambda-function-get - name: aws-lambda-function-get arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name required: true description: The name of the Lambda function, version, or alias. - name: qualifier description: Specify a version or alias to get details about a published version of the function. description: "Returns information about the function or the specified version, including a link to download the deployment package (valid for 10 minutes). If a version is specified, only version-specific details are returned. Required IAM Permission: lambda:GetFunction." outputs: - contextPath: AWS.Lambda.Functions.Configuration.FunctionName description: The name of the function. type: string - contextPath: AWS.Lambda.Functions.Configuration.FunctionArn description: The function's Amazon Resource Name (ARN). type: string - contextPath: AWS.Lambda.Functions.Configuration.Runtime description: The identifier of the function's runtime. type: string - contextPath: AWS.Lambda.Functions.Configuration.Role description: The function's execution role. type: string - contextPath: AWS.Lambda.Functions.Configuration.Handler description: The function that Lambda calls to begin running your function. type: string - contextPath: AWS.Lambda.Functions.Configuration.CodeSize description: The size of the function's deployment package, in bytes. type: number - contextPath: AWS.Lambda.Functions.Configuration.Description description: The function's description. type: string - contextPath: AWS.Lambda.Functions.Configuration.Timeout description: The amount of time in seconds that Lambda allows a function to run before stopping it. type: number - contextPath: AWS.Lambda.Functions.Configuration.MemorySize description: The amount of memory available to the function at runtime. type: number - contextPath: AWS.Lambda.Functions.Configuration.LastModified description: The date and time that the function was last updated, in ISO-8601 format. type: string - contextPath: AWS.Lambda.Functions.Configuration.CodeSha256 description: The SHA256 hash of the function's deployment package. type: string - contextPath: AWS.Lambda.Functions.Configuration.Version description: The version of the Lambda function. type: string - contextPath: AWS.Lambda.Functions.Configuration.VpcConfig.SubnetIds description: A list of VPC subnet IDs. type: array - contextPath: AWS.Lambda.Functions.Configuration.VpcConfig.SecurityGroupIds description: A list of VPC security group IDs. type: array - contextPath: AWS.Lambda.Functions.Configuration.VpcConfig.VpcId description: The ID of the VPC. type: string - contextPath: AWS.Lambda.Functions.Code.RepositoryType description: The repository from which you can download the function. type: string - contextPath: AWS.Lambda.Functions.Code.Location description: The presigned URL you can use to download the function's .zip file. type: string - contextPath: AWS.Lambda.Functions.Tags description: The function's tags. type: object - contextPath: AWS.Lambda.Functions.Concurrency.ReservedConcurrentExecutions description: The number of concurrent executions that are reserved for this function. type: number - contextPath: AWS.Lambda.Functions.Region description: The AWS Region. type: string - name: aws-lambda-functions-list arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: limit description: "Maximum number of functions to return in a single request. Valid range is 1-50." defaultValue: "50" required: false - name: next_token description: "Token for pagination. Use the value from AWS.Lambda.FunctionsNextToken to retrieve the next page of results." required: false description: "Returns a list of your Lambda functions. For each function, the response includes the function configuration information. Required IAM Permission: lambda:ListFunctions." outputs: - contextPath: AWS.Lambda.Functions.FunctionName description: The name of the function. type: string - contextPath: AWS.Lambda.Functions.FunctionArn description: The function's Amazon Resource Name. type: string - contextPath: AWS.Lambda.Functions.Runtime description: The runtime environment for the Lambda function. type: string - contextPath: AWS.Lambda.Functions.Role description: The function's execution role. type: string - contextPath: AWS.Lambda.Functions.Handler description: The function Lambda calls to begin executing your function. type: string - contextPath: AWS.Lambda.Functions.CodeSize description: The size of the function's deployment package in bytes. type: number - contextPath: AWS.Lambda.Functions.Description description: The function's description. type: string - contextPath: AWS.Lambda.Functions.Timeout description: The amount of time that Lambda allows a function to run before terminating it. type: number - contextPath: AWS.Lambda.Functions.MemorySize description: The memory allocated to the function. type: number - contextPath: AWS.Lambda.Functions.LastModified description: The date and time that the function was last updated, in ISO-8601 format (YYYY-MM-DDThh:mm:ss.sTZD). type: date - contextPath: AWS.Lambda.Functions.CodeSha256 description: The SHA256 hash of the function's deployment package. type: string - contextPath: AWS.Lambda.Functions.Version description: The version of the Lambda function. type: string - contextPath: AWS.Lambda.Functions.VpcConfig.SubnetIds description: A list of VPC subnet IDs. type: string - contextPath: AWS.Lambda.Functions.VpcConfig.SecurityGroupIds description: A list of VPC security groups IDs. type: string - contextPath: AWS.Lambda.Functions.VpcConfig.VpcId description: The ID of the VPC. type: string - contextPath: AWS.Lambda.Functions.DeadLetterConfig.TargetArn description: The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic. type: string - contextPath: AWS.Lambda.Functions.Environment.Variables description: Environment variable key-value pairs. type: string - contextPath: AWS.Lambda.Functions.Environment.Error.ErrorCode description: The error code for environment variables that could not be applied. type: string - contextPath: AWS.Lambda.Functions.Environment.Error.Message description: The error message for environment variables that could not be applied. type: string - contextPath: AWS.Lambda.Functions.KMSKeyArn description: The KMS key used to encrypt the function's environment variables. Only returned if you've configured a customer managed CMK. type: string - contextPath: AWS.Lambda.Functions.TracingConfig.Mode description: The function's AWS X-Ray tracing configuration mode. type: string - contextPath: AWS.Lambda.Functions.MasterArn description: The ARN of the master function. type: string - contextPath: AWS.Lambda.Functions.RevisionId description: Represents the latest updated revision of the function or alias. type: string - contextPath: AWS.Lambda.Functions.LayerVersions.Arn description: The Amazon Resource Name (ARN) of the function layer. type: string - contextPath: AWS.Lambda.Functions.LayerVersions.CodeSize description: The size of the layer archive in bytes. type: string - contextPath: AWS.Lambda.Functions.Region description: The AWS Region. type: string - contextPath: AWS.Lambda.FunctionsNextToken description: Token to use for pagination in subsequent requests. type: string - name: aws-lambda-aliases-list arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The name of the Lambda function. name: function_name required: true - description: Specify a function version to only list aliases that invoke that version. name: function_version - description: The maximum number of aliases to return (default is 50, maximum is 10000). name: limit defaultValue: "50" - description: Specify the pagination token that was returned by a previous request to retrieve the next page of results. name: next_token description: "Returns a list of aliases created for a Lambda function. Required IAM Permission: lambda:ListAliases." outputs: - contextPath: AWS.Lambda.Aliases.AliasArn description: Lambda function ARN that is qualified using the alias name as the suffix. type: string - contextPath: AWS.Lambda.Aliases.Name description: Alias name. type: string - contextPath: AWS.Lambda.Aliases.FunctionVersion description: Function version to which the alias points. type: string - contextPath: AWS.Lambda.Aliases.Description description: Alias description. type: string - contextPath: AWS.Lambda.Aliases.RoutingConfig.AdditionalVersionWeights description: The name of the second alias, and the percentage of traffic that is routed to it. type: string - contextPath: AWS.Lambda.Aliases.RevisionId description: Represents the latest updated revision of the function or alias. type: string - contextPath: AWS.Lambda.AliasesNextToken description: The pagination token for the next set of aliases. - name: aws-lambda-account-settings-get arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 description: "Retrieves details about the account's limits and usage in an AWS Region. Required IAM Permission: lambda:GetAccountSettings." outputs: - contextPath: AWS.Lambda.AccountSettings.AccountLimit.TotalCodeSize description: The amount of storage space that you can use for all deployment packages and layer archives. type: number - contextPath: AWS.Lambda.AccountSettings.AccountLimit.CodeSizeUnzipped description: The maximum size of your function's code and layers when they're extracted. type: number - contextPath: AWS.Lambda.AccountSettings.AccountLimit.CodeSizeZipped description: The maximum size of a deployment package when it's uploaded directly to AWS Lambda. Use Amazon S3 for larger files. type: number - contextPath: AWS.Lambda.AccountSettings.AccountLimit.ConcurrentExecutions description: The maximum number of simultaneous function executions. type: number - contextPath: AWS.Lambda.AccountSettings.AccountLimit.UnreservedConcurrentExecutions description: The maximum number of simultaneous function executions, minus the capacity that's reserved for individual functions with PutFunctionConcurrency. type: number - contextPath: AWS.Lambda.AccountSettings.AccountUsage.TotalCodeSize description: The amount of storage space, in bytes, that's being used by deployment packages and layer archives. type: number - contextPath: AWS.Lambda.AccountSettings.AccountUsage.FunctionCount description: The number of Lambda functions. type: number - contextPath: AWS.Lambda.AccountSettings.Region description: The AWS Region. type: string - contextPath: AWS.Lambda.AccountSettings.AccountId description: The AWS account ID. type: string - name: aws-lambda-function-versions-list arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The name of the Lambda function. name: function_name required: true - description: Specify the pagination token that's returned by a previous request to retrieve the next page of results. name: next_token - description: The maximum number of versions to return. Note that the maximum limit is 50 items in each response. name: limit defaultValue: "50" description: "Returns a list of versions, with the version-specific configuration of each. Required IAM Permission: lambda:ListVersionsByFunction." outputs: - contextPath: AWS.Lambda.Functions.FunctionVersionsNextToken description: The pagination token that's included if more results are available. type: String - contextPath: AWS.Lambda.Functions.FunctionArn description: The function's Amazon Resource Name (ARN). type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.FunctionArn description: The function's Amazon Resource Name (ARN). type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.Runtime description: The identifier of the function's runtime. Runtime is required if the deployment package is a .zip file archive. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.Role description: The function's execution role. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.Handler description: The function that Lambda calls to begin running your function. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.CodeSize description: The size of the function's deployment package, in bytes. type: Number - contextPath: AWS.Lambda.Functions.FunctionVersions.Description description: The function's description. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.Timeout description: The amount of time in seconds that Lambda allows a function to run before stopping it. type: Number - contextPath: AWS.Lambda.Functions.FunctionVersions.MemorySize description: The amount of memory available to the function at runtime. type: Number - contextPath: AWS.Lambda.Functions.FunctionVersions.LastModified description: The date and time that the function was last updated, in ISO-8601 format (YYYY-MM-DDThh:mm:ss.sTZD). type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.CodeSha256 description: The SHA256 hash of the function's deployment package. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.Version description: The version of the Lambda function. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.VpcConfig.SubnetIds description: A list of VPC subnet IDs. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.VpcConfig.SecurityGroupIds description: A list of VPC security group IDs. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.VpcConfig.VpcId description: The ID of the VPC. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.DeadLetterConfig.TargetArn description: The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.Environment.Variables description: Environment variable key-value pairs. Omitted from CloudTrail logs. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.Environment.Error.ErrorCode description: The error code for environment variables that couldn't be applied. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.Environment.Error.Message description: The error message for environment variables that couldn't be applied. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.KMSKeyArn description: The ARN of the KMS key used to encrypt the function's environment variables. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.TracingConfig.Mode description: The tracing mode for the Lambda function. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.MasterArn description: The ARN of the main function for Lambda@Edge functions. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.State description: The current state of the function. When the state is Inactive, you can reactivate the function by invoking it. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.StateReason description: The reason for the function's current state. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.StateReasonCode description: The reason code for the current state of the function. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.LastUpdateStatus description: The status of the last update that was performed on the function. This is first set to Successful after function creation completes. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.LastUpdateStatusReason description: The reason for the last update that was performed on the function. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.LastUpdateStatusReasonCode description: The reason code for the last update operation status. type: String - contextPath: AWS.Lambda.Functions.FunctionVersions.PackageType description: The type of deployment package. Set to Image for container image and set Zip for .zip file archive. type: String - name: aws-lambda-function-url-config-delete arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - description: The name of the Lambda function. name: function_name required: true - description: The alias name or version number. name: qualifier description: "Deletes a Lambda function URL. When you delete a function URL, you can't recover it. Creating a new function URL results in a different URL address. Required IAM Permission: lambda:DeleteFunctionUrlConfig." execution: true - name: aws-lambda-function-create description: "Creates a Lambda function. To create a function, you need a deployment package and an execution role. Required IAM Permission: lambda:CreateFunction." execution: true arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name description: The name of the Lambda function. required: true - name: runtime description: The runtime environment for the function. required: true - name: handler description: "The name of the method within your code that Lambda calls to execute your function. Example: lambda_function.lambda_handler." required: true - name: role description: The Amazon Resource Name (ARN) of the function's execution role. required: true - name: code description: Entry ID of the uploaded base64-encoded contents of the deployment package. - name: s3_bucket description: An Amazon S3 bucket in the same Amazon Web Services Region as your function. The bucket can be in a different Amazon Web Services account. - name: description description: A description of the function. - name: function_timeout description: The amount of time (in seconds) that Lambda allows a function to run before stopping it. defaultValue: "3" - name: memory_size description: The amount of memory (in MB) available to the function at runtime. defaultValue: "128" - name: publish description: Set to true to publish the first version of the function during creation. auto: PREDEFINED predefined: - "true" - "false" - name: subnet_ids description: A comma-separated list of VPC subnet IDs. isArray: true - name: security_group_ids description: A comma-separated list of VPC security group IDs. isArray: true - name: ipv6_allowed_for_dual_stack description: Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets. auto: PREDEFINED predefined: - "true" - "false" - name: package_type description: The type of deployment package. auto: PREDEFINED predefined: - "Image" - "Zip" - name: environment description: The environment variables for the function. Must be separated by a semicolon (;) and specified using the format "key=DB_HOST,value=localhost;key=DEBUG,value=true". - name: tracing_config description: The tracing configuration for the function. Set to Active to sample and trace a subset of incoming requests with X-Ray. defaultValue: "Active" auto: PREDEFINED predefined: - "Active" - "PassThrough" - name: tags description: The list of tags to apply to the function. Must be separated by a semicolon (;) and specified using the format "key=abc,value=123;key=fed,value=456". - name: layers description: A list of function layers to add to the function's execution environment. isArray: true outputs: - contextPath: AWS.Lambda.Functions.FunctionName description: The name of the function. type: string - contextPath: AWS.Lambda.Functions.FunctionArn description: The function's Amazon Resource Name (ARN). type: string - contextPath: AWS.Lambda.Functions.Runtime description: The identifier of the function's runtime. type: string - contextPath: AWS.Lambda.Functions.Role description: The function's execution role. type: string - contextPath: AWS.Lambda.Functions.Handler description: The function that Lambda calls to begin running your function. type: string - contextPath: AWS.Lambda.Functions.CodeSize description: The size of the function's deployment package, in bytes. type: number - contextPath: AWS.Lambda.Functions.Description description: The function's description. type: string - contextPath: AWS.Lambda.Functions.Timeout description: The amount of time in seconds that Lambda allows a function to run before stopping it. type: number - contextPath: AWS.Lambda.Functions.MemorySize description: The amount of memory available to the function at runtime. type: number - contextPath: AWS.Lambda.Functions.Version description: The version of the Lambda function. type: string - contextPath: AWS.Lambda.Functions.VpcConfig.SubnetIds description: A list of VPC subnet IDs. type: array - contextPath: AWS.Lambda.Functions.VpcConfig.SecurityGroupIds description: A list of VPC security group IDs. type: array - contextPath: AWS.Lambda.Functions.VpcConfig.VpcId description: The ID of the VPC. type: string - contextPath: AWS.Lambda.Functions.VpcConfig.Ipv6AllowedForDualStack description: Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets. type: boolean - contextPath: AWS.Lambda.Functions.PackageType description: The type of deployment package. Set to Image for container image and set Zip for .zip file archive. type: string - contextPath: AWS.Lambda.Functions.LastModified description: The date and time that the function was last updated, in ISO-8601 format. type: string - contextPath: AWS.Lambda.Functions.Region description: The AWS Region. type: string - name: aws-lambda-layer-version-list description: "Lists the versions of an Lambda layer. Required IAM Permission: lambda:ListLayerVersions." arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: layer_name description: The name or Amazon Resource Name (ARN) of the layer. required: true - name: compatible_runtime description: A runtime identifier. For example, java21. - name: next_token description: A pagination token returned by a previous call. - name: limit description: The maximum number of versions to return. Note that the maximum limit is 50 items in each response. defaultValue: 50 - name: compatible_architecture description: The compatible instruction set architecture. outputs: - contextPath: AWS.Lambda.LayerVersions.LayerVersionsNextToken description: A pagination token returned when the response doesn't contain all versions. type: string - contextPath: AWS.Lambda.LayerVersions.LayerVersionArn description: The ARN of the layer version. type: string - contextPath: AWS.Lambda.LayerVersions.Version description: The version number. type: number - contextPath: AWS.Lambda.LayerVersions.Description description: The description of the version. type: string - contextPath: AWS.Lambda.LayerVersions.CreatedDate description: The date that the version was created, in ISO 8601 format. type: string - contextPath: AWS.Lambda.LayerVersions.CompatibleRuntimes description: The layer's compatible runtimes. type: array - contextPath: AWS.Lambda.LayerVersions.LicenseInfo description: The layer's open-source license. type: string - contextPath: AWS.Lambda.LayerVersions.CompatibleArchitectures description: A list of compatible instruction set architectures. type: array - name: aws-lambda-function-delete description: "Deletes a Lambda function. Required IAM Permission: lambda:DeleteFunction." execution: true arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name description: The name of the Lambda function or version. required: true - name: qualifier description: Specify a version to delete. You can't delete a version that an alias references. - name: aws-lambda-layer-version-delete description: "Deletes a version of a Lambda layer. Required IAM Permission: lambda:DeleteLayerVersion." execution: true arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: layer_name description: The name or Amazon Resource Name (ARN) of the layer. required: true - name: version_number description: The version number to delete. required: true - name: aws-lambda-layer-version-publish description: "Creates a Lambda layer from a ZIP archive. Required IAM Permission: lambda:PublishLayerVersion." arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: layer_name description: The name of the layer. required: true - name: description description: The description of the version. - name: zip_file description: The entry ID of the uploaded ZIP file containing the layer code. - name: s3_bucket description: The Amazon S3 bucket of the layer archive. - name: s3_key description: The Amazon S3 key of the layer archive. - name: s3_object_version description: For versioned objects, the version of the layer archive object to use. - name: compatible_runtimes description: A list of compatible function runtimes. isArray: true - name: compatible_architectures description: A list of compatible instruction set architectures. isArray: true outputs: - contextPath: AWS.Lambda.LayerVersions.LayerVersionArn description: The ARN of the layer version. type: string - contextPath: AWS.Lambda.LayerVersions.LayerArn description: The ARN of the layer. type: string - contextPath: AWS.Lambda.LayerVersions.Description description: The description of the version. type: string - contextPath: AWS.Lambda.LayerVersions.CreatedDate description: The date that the layer version was created, in ISO 8601 format. type: string - contextPath: AWS.Lambda.LayerVersions.Version description: The version number. type: number - contextPath: AWS.Lambda.LayerVersions.CompatibleRuntimes description: The layer's compatible runtimes. type: array - contextPath: AWS.Lambda.LayerVersions.CompatibleArchitectures description: A list of compatible instruction set architectures. type: array - contextPath: AWS.Lambda.LayerVersions.Region description: The AWS Region. type: string - name: aws-lambda-function-configuration-update description: "Updates the configuration for a Lambda function. Required IAM Permission: lambda:UpdateFunctionConfiguration." arguments: - name: account_id required: false required:platform: true description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: function_name required: true description: The name or ARN of the Lambda function. - name: role description: The Amazon Resource Name (ARN) of the function's execution role. - name: handler description: The name of the method within your code that Lambda calls to execute your function. - name: description description: A description of the function. - name: timeout description: The amount of time that Lambda allows a function to run before stopping it. - name: memory_size description: The amount of memory, in MB, that your function has access to. - name: subnet_ids description: A comma-separated list of VPC subnet IDs. - name: security_group_ids description: A comma-separated list of VPC security group IDs. - name: ipv6_allowed_for_dualstack description: Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets. auto: PREDEFINED predefined: - 'true' - 'false' - name: environment description: Environment variable key-value pairs. Must be separated by a semicolon (;) and specified using the format "key=DB_HOST,value=localhost;key=DEBUG,value=true". - name: runtime description: The identifier of the function's runtime. - name: target_arn description: The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic for the dead-letter queue configuration. - name: kms_key_arn description: The ARN of the AWS Key Management Service (KMS) key to use for encryption. - name: tracing_config_mode description: The tracing mode. Set Mode to Active to sample and trace a subset of incoming requests with X-Ray. auto: PREDEFINED predefined: - Active - PassThrough - name: revision_id description: A revision ID to update the function only if it matches. - name: layers description: A comma-separated list of function layers ARNs. isArray: true - name: file_system_configs description: An key-value pairs string for EFS file system configurations where the key is the Arn and the value is LocalMountPath. Arn is the Amazon Resource Name (ARN) of the Amazon EFS access point that provides access to the file system. The LocalMountPath is the path where the function can access the file system, starting with /mnt/. Must be separated by a semicolon (;) and specified using the format "key=DB_HOST,value=localhost;key=DEBUG,value=true". - name: image_config_entry_point description: A comma-separated list that specifies the entry point to their application, which is typically the location of the runtime executable. isArray: true - name: image_config_command description: Parameters that you want to pass in with ENTRYPOINT. - name: image_config_working_directory description: Specifies the working directory. - name: ephemeral_storage_size description: The size of the function’s /tmp directory. - name: snap_start_apply_on description: Set to PublishedVersions to create a snapshot of the initialized execution environment when you publish a function version. auto: PREDEFINED predefined: - PublishedVersions - None - name: log_format description: The format in which Lambda sends your function’s application and system logs to CloudWatch. auto: PREDEFINED predefined: - JSON - Text - name: application_log_level description: Set this property to filter the application logs for your function that Lambda sends to CloudWatch. auto: PREDEFINED predefined: - TRACE - DEBUG - INFO - WARN - ERROR - FATAL - name: system_log_level description: Set this property to filter the system logs for your function that Lambda sends to CloudWatch. auto: PREDEFINED predefined: - DEBUG - INFO - WARN - name: log_group description: The name of the Amazon CloudWatch log group the function sends logs to. By default, Lambda functions send logs to a default log group named /aws/lambda/. To use a different log group, enter an existing log group or enter a new log group name. - name: capacity_provider_arn description: The Amazon Resource Name (ARN) of the capacity provider. - name: per_execution_env_max_concurrency description: The maximum number of concurrent execution environments that can run on each compute instance. - name: execution_env_memory_per_cpu description: The amount of memory in GiB allocated per vCPU for execution environments. - name: durable_retention_period description: The number of days to retain execution history after a durable execution completes. After this period, execution history is no longer available through the GetDurableExecutionHistory API. For example, enter '4' for 4 days. - name: durable_execution_timeout description: The maximum time (in seconds) that a durable execution can run before timing out. This timeout applies to the entire durable execution, not individual function invocations. outputs: - contextPath: AWS.Lambda.FunctionConfig.FunctionName description: The name of the function. type: String - contextPath: AWS.Lambda.FunctionConfig.FunctionArn description: The function's Amazon Resource Name (ARN). type: String - contextPath: AWS.Lambda.FunctionConfig.Runtime description: The identifier of the function's runtime. type: String - contextPath: AWS.Lambda.FunctionConfig.Role description: The function's execution role. type: String - contextPath: AWS.Lambda.FunctionConfig.Handler description: The function that Lambda calls to begin running your function. type: String - contextPath: AWS.Lambda.FunctionConfig.CodeSize description: The size of the function's deployment package, in bytes. type: Number - contextPath: AWS.Lambda.FunctionConfig.Description description: The function's description. type: String - contextPath: AWS.Lambda.FunctionConfig.Timeout description: The amount of time in seconds that Lambda allows a function to run before stopping it. type: Number - contextPath: AWS.Lambda.FunctionConfig.MemorySize description: The amount of memory available to the function at runtime. type: Number - contextPath: AWS.Lambda.FunctionConfig.LastModified description: The date and time the function was last updated. type: String - contextPath: AWS.Lambda.FunctionConfig.CodeSha256 description: The SHA256 hash of the function's deployment package. type: String - contextPath: AWS.Lambda.FunctionConfig.Version description: The version of the Lambda function. type: String - contextPath: AWS.Lambda.FunctionConfig.VpcConfig description: The function's networking configuration. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.DeadLetterConfig description: The function's dead-letter queue. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.Environment description: The function's environment variables. type: String - contextPath: AWS.Lambda.FunctionConfig.KMSKeyArn description: The KMS key used to encrypt the function's environment variables. type: String - contextPath: AWS.Lambda.FunctionConfig.TracingConfig description: The function's X-Ray tracing configuration. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.MasterArn description: For Lambda@Edge functions, the ARN of the main function. type: String - contextPath: AWS.Lambda.FunctionConfig.RevisionId description: The latest updated revision of the function or alias. type: String - contextPath: AWS.Lambda.FunctionConfig.Layers description: The function's layers. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.State description: The current state of the function. type: String - contextPath: AWS.Lambda.FunctionConfig.StateReason description: The reason for the function's current state. type: String - contextPath: AWS.Lambda.FunctionConfig.StateReasonCode description: The reason code for the function's current state. type: String - contextPath: AWS.Lambda.FunctionConfig.LastUpdateStatus description: The status of the last update that was performed on the function. type: String - contextPath: AWS.Lambda.FunctionConfig.LastUpdateStatusReason description: The reason for the last update that was performed on the function. type: String - contextPath: AWS.Lambda.FunctionConfig.LastUpdateStatusReasonCode description: The reason code for the last update that was performed on the function. type: String - contextPath: AWS.Lambda.FunctionConfig.FileSystemConfigs description: The function's Amazon EFS file system configurations. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.PackageType description: The type of deployment package. type: String - contextPath: AWS.Lambda.FunctionConfig.ImageConfigResponse description: The function's image configuration values. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.SigningProfileVersionArn description: The ARN of the signing profile version. type: String - contextPath: AWS.Lambda.FunctionConfig.SigningJobArn description: The ARN of the signing job. type: String - contextPath: AWS.Lambda.FunctionConfig.Architectures description: The instruction set architecture that the function supports. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.EphemeralStorage description: The size of the function's /tmp directory. type: Number - contextPath: AWS.Lambda.FunctionConfig.SnapStart description: The function's SnapStart setting. type: String - contextPath: AWS.Lambda.FunctionConfig.RuntimeVersionConfig description: The ARN of the runtime and any errors that occurred. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.LoggingConfig description: The function's logging configuration. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.CapacityProviderConfig description: The configuration for Lambda-managed instances used by the capacity provider. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.ConfigSha256 description: The SHA256 hash of the function configuration. type: String - contextPath: AWS.Lambda.FunctionConfig.DurableConfig description: The function’s durable execution configuration settings, if the function is configured for durability. type: Unknown - contextPath: AWS.Lambda.FunctionConfig.TenancyConfig description: The function’s tenant isolation configuration settings. Determines whether the Lambda function runs on a shared or dedicated infrastructure per unique tenant. type: Unknown - arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: Entry ID of the file to upload. name: entryID required: true - description: Name of the S3 bucket containing the file. Must follow S3 naming conventions. name: bucket required: true - description: Key (path) where the file will be stored in the S3 bucket. name: key required: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 description: "Uploads a file to the S3 bucket. Required IAM permission: s3:PutObject." name: aws-s3-file-upload outputs: [] - arguments: - description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: account_id required: false required:platform: true - description: Name of the target S3 bucket. Must follow S3 naming conventions. name: bucket required: true - description: Key (path) of the file to download from the S3 bucket. name: key required: true - description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. name: region required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 description: "Downloads a file from the S3 bucket to the War Room. Required IAM permission: s3:GetObject." name: aws-s3-file-download outputs: - contextPath: File.Size description: The size of the file. type: Number - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file. type: String - contextPath: File.EntryID description: The entry ID of the file. type: String - contextPath: File.Info description: File information. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: The file extension. type: String - name: aws-billing-cost-usage-list description: "Retrieves actual cost and usage data for a given time range and optional service filter. Required IAM permission: ce:GetCostAndUsage." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: metrics description: Metrics to retrieve. Default - UsageQuantity. Valid values [AmortizedCost, BlendedCost, NetAmortizedCost, NetUnblendedCost, NormalizedUsageAmount, UnblendedCost, UsageQuantity]. isArray: true required: false - name: start_date description: Start date for the report (YYYY-MM-DD). Default - 7 days ago. required: false - name: end_date description: End date for the report (YYYY-MM-DD). Default - current day. required: false - name: granularity description: Granularity of the data. Default - Daily. Valid values [Daily, Monthly, Hourly]. required: false auto: PREDEFINED predefined: - Daily - Monthly - Hourly - name: aws_services description: Optional filter for retrieving data for specific AWS services. e.g. "AWSLambda". isArray: true required: false - name: next_page_token description: Next page token for pagination. Use value from AWS.Billing.UsageNextToken. required: false outputs: - contextPath: AWS.Billing.Usage description: Complete usage data from AWS Cost Explorer API. - contextPath: AWS.Billing.Usage.TimePeriod description: Time period for the usage data. - contextPath: AWS.Billing.Usage.TimePeriod.Start description: Start date of the time period. type: date - contextPath: AWS.Billing.Usage.TimePeriod.End description: End date of the time period. type: date - contextPath: AWS.Billing.Usage.Total description: Total cost and usage metrics for the time period. - contextPath: AWS.Billing.Usage.Total.AmortizedCost description: Amortized cost information. - contextPath: AWS.Billing.Usage.Total.AmortizedCost.Amount description: Amortized cost amount. type: string - contextPath: AWS.Billing.Usage.Total.AmortizedCost.Unit description: Amortized cost unit (e.g., USD). type: string - contextPath: AWS.Billing.Usage.Total.BlendedCost description: Blended cost information. - contextPath: AWS.Billing.Usage.Total.BlendedCost.Amount description: Blended cost amount. type: string - contextPath: AWS.Billing.Usage.Total.BlendedCost.Unit description: Blended cost unit (e.g., USD). type: string - contextPath: AWS.Billing.Usage.Total.NetAmortizedCost description: Net amortized cost information. - contextPath: AWS.Billing.Usage.Total.NetAmortizedCost.Amount description: Net amortized cost amount. type: string - contextPath: AWS.Billing.Usage.Total.NetAmortizedCost.Unit description: Net amortized cost unit (e.g., USD). type: string - contextPath: AWS.Billing.Usage.Total.NetUnblendedCost description: Net unblended cost information. - contextPath: AWS.Billing.Usage.Total.NetUnblendedCost.Amount description: Net unblended cost amount. type: string - contextPath: AWS.Billing.Usage.Total.NetUnblendedCost.Unit description: Net unblended cost unit (e.g., USD). type: string - contextPath: AWS.Billing.Usage.Total.NormalizedUsageAmount description: Normalized usage amount information. - contextPath: AWS.Billing.Usage.Total.NormalizedUsageAmount.Amount description: Normalized usage amount. type: string - contextPath: AWS.Billing.Usage.Total.NormalizedUsageAmount.Unit description: Normalized usage amount unit. type: string - contextPath: AWS.Billing.Usage.Total.UnblendedCost description: Unblended cost information. - contextPath: AWS.Billing.Usage.Total.UnblendedCost.Amount description: Unblended cost amount. type: string - contextPath: AWS.Billing.Usage.Total.UnblendedCost.Unit description: Unblended cost unit (e.g., USD). type: string - contextPath: AWS.Billing.Usage.Total.UsageQuantity description: Usage quantity information. - contextPath: AWS.Billing.Usage.Total.UsageQuantity.Amount description: Usage quantity amount. type: string - contextPath: AWS.Billing.Usage.Total.UsageQuantity.Unit description: Usage quantity unit (e.g., Hrs, GB). type: string - contextPath: AWS.Billing.Usage.Groups description: Usage data grouped by dimensions (when grouping is applied). - contextPath: AWS.Billing.Usage.Groups.Keys description: Group keys (dimension values). - contextPath: AWS.Billing.Usage.Groups.Metrics description: Metrics for the group. - contextPath: AWS.Billing.Usage.Estimated description: Whether the data is estimated. type: boolean - contextPath: AWS.Billing.UsageNextToken description: Next page token for pagination. type: string - name: aws-billing-forecast-list description: "Forecasts AWS spending over a given future time period using historical trends. Required IAM permission: ce:GetCostForecast." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: metric description: Metric to forecast. Valid values [AMORTIZED_COST, BLENDED_COST, NET_AMORTIZED_COST, NET_UNBLENDED_COST, UNBLENDED_COST]. required: false defaultValue: AMORTIZED_COST auto: PREDEFINED predefined: - AMORTIZED_COST - BLENDED_COST - NET_AMORTIZED_COST - NET_UNBLENDED_COST - UNBLENDED_COST - name: start_date description: Start date for the forecast (YYYY-MM-DD). Default - current day. required: false - name: end_date description: End date for the forecast (YYYY-MM-DD). Default - in 7 days. required: false - name: granularity description: Granularity of the forecast. Default - Daily. Valid values [Daily, Monthly, Hourly]. required: false auto: PREDEFINED predefined: - Daily - Monthly - Hourly - name: aws_services description: Optional filter for retrieving data for specific AWS services. isArray: true required: false - name: next_page_token description: Next page token for pagination. Use value from AWS.Billing.ForecastNextToken. required: false outputs: - contextPath: AWS.Billing.Forecast description: Complete forecast data from AWS Cost Explorer API. - contextPath: AWS.Billing.Forecast.Service description: AWS Service (if exists). type: string - contextPath: AWS.Billing.Forecast.StartDate description: Start date of the forecast. type: date - contextPath: AWS.Billing.Forecast.EndDate description: End date of the forecast. type: date - contextPath: AWS.Billing.Forecast.TotalAmount description: Total forecasted amount. type: string - contextPath: AWS.Billing.Forecast.TotalUnit description: Unit for the forecasted amount. type: string - contextPath: AWS.Billing.Forecast.ForecastResultsByTime description: Forecast results grouped by time period. - contextPath: AWS.Billing.Forecast.ForecastResultsByTime.TimePeriod description: Time period for the forecast. - contextPath: AWS.Billing.Forecast.ForecastResultsByTime.TimePeriod.Start description: Start date of the forecast period. type: date - contextPath: AWS.Billing.Forecast.ForecastResultsByTime.TimePeriod.End description: End date of the forecast period. type: date - contextPath: AWS.Billing.Forecast.ForecastResultsByTime.MeanValue description: Mean forecasted value for the time period. type: string - contextPath: AWS.Billing.Forecast.ForecastResultsByTime.PredictionIntervalLowerBound description: Lower bound of the prediction interval. type: string - contextPath: AWS.Billing.Forecast.ForecastResultsByTime.PredictionIntervalUpperBound description: Upper bound of the prediction interval. type: string - contextPath: AWS.Billing.Forecast.Total description: Total forecast information. - contextPath: AWS.Billing.Forecast.Total.Amount description: Total forecasted amount. type: string - contextPath: AWS.Billing.Forecast.Total.Unit description: Unit for the total forecasted amount. type: string - contextPath: AWS.Billing.ForecastNextToken description: Next page token for pagination. type: string - name: aws-billing-budgets-list description: "Lists configured budgets for a given AWS account. Required IAM permission: budgets:DescribeBudgets." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: max_result description: Maximum results to return. Default - 50, Max - 1000. required: false defaultValue: 50 - name: show_filter_expression defaultValue: 'false' auto: PREDEFINED predefined: - 'true' - 'false' description: Whether to show filter expression. Default - False. required: false - name: next_page_token description: Next page token for pagination. Use value from AWS.Billing.BudgetNextToken. required: false outputs: - contextPath: AWS.Billing.Budget description: Complete budget data from AWS Budgets API. - contextPath: AWS.Billing.Budget.BudgetName description: Budget name. type: string - contextPath: AWS.Billing.Budget.BudgetType description: Budget type (COST, USAGE, RI_UTILIZATION, RI_COVERAGE, SAVINGS_PLANS_UTILIZATION, SAVINGS_PLANS_COVERAGE). type: string - contextPath: AWS.Billing.Budget.TimeUnit description: Time unit for the budget (DAILY, MONTHLY, QUARTERLY, ANNUALLY). type: string - contextPath: AWS.Billing.Budget.TimePeriod description: Time period for the budget. - contextPath: AWS.Billing.Budget.TimePeriod.Start description: Start date of the budget time period. type: date - contextPath: AWS.Billing.Budget.TimePeriod.End description: End date of the budget time period. type: date - contextPath: AWS.Billing.Budget.BudgetLimit description: Budget limit configuration. - contextPath: AWS.Billing.Budget.BudgetLimit.Amount description: Budget limit amount. type: string - contextPath: AWS.Billing.Budget.BudgetLimit.Unit description: Budget limit unit (e.g., USD). type: string - contextPath: AWS.Billing.Budget.CostFilters description: Cost filters applied to the budget. - contextPath: AWS.Billing.Budget.TimeUnit description: Time unit for the budget period. type: string - contextPath: AWS.Billing.Budget.CalculatedSpend description: Calculated spend information. - contextPath: AWS.Billing.Budget.CalculatedSpend.ActualSpend description: Actual spend information. - contextPath: AWS.Billing.Budget.CalculatedSpend.ActualSpend.Amount description: Actual spend amount. type: string - contextPath: AWS.Billing.Budget.CalculatedSpend.ActualSpend.Unit description: Actual spend unit (e.g., USD). type: string - contextPath: AWS.Billing.Budget.CalculatedSpend.ForecastedSpend description: Forecasted spend information. - contextPath: AWS.Billing.Budget.CalculatedSpend.ForecastedSpend.Amount description: Forecasted spend amount. type: string - contextPath: AWS.Billing.Budget.CalculatedSpend.ForecastedSpend.Unit description: Forecasted spend unit (e.g., USD). type: string - contextPath: AWS.Billing.Budget.BudgetType description: Type of budget (COST, USAGE, etc.). type: string - contextPath: AWS.Billing.Budget.LastUpdatedTime description: Last time the budget was updated. type: date - contextPath: AWS.Billing.Budget.AutoAdjustData description: Auto-adjust data for the budget. - contextPath: AWS.Billing.Budget.PlannedBudgetLimits description: Planned budget limits for future periods. - contextPath: AWS.Billing.BudgetNextToken description: Next page token for pagination. type: string - name: aws-billing-budget-notification-list description: "Lists the notifications associated with a budget. Required IAM permission: budgets:DescribeNotificationsForBudget." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - name: budget_name description: Name of the budget. required: true - name: max_result description: Maximum results to return. Default - 50, Max - 100. required: false defaultValue: 50 - name: next_page_token description: Next page token for pagination. Use value from AWS.Billing.NotificationNextToken. required: false outputs: - contextPath: AWS.Billing.Budget.Notification description: Complete budget notification data from AWS Budgets API. - contextPath: AWS.Billing.Budget.Notification.Notification description: Notification configuration. - contextPath: AWS.Billing.Budget.Notification.Notification.NotificationType description: Type of notification (ACTUAL or FORECASTED). type: string - contextPath: AWS.Billing.Budget.Notification.Notification.ComparisonOperator description: Comparison operator for the notification (GREATER_THAN, LESS_THAN, EQUAL_TO). type: string - contextPath: AWS.Billing.Budget.Notification.Notification.Threshold description: Threshold value that triggers the notification. type: number - contextPath: AWS.Billing.Budget.Notification.Notification.ThresholdType description: Type of threshold (PERCENTAGE or ABSOLUTE_VALUE). type: string - contextPath: AWS.Billing.Budget.Notification.Notification.NotificationState description: Current state of the notification (OK or ALARM). type: string - contextPath: AWS.Billing.Budget.Notification.Subscribers description: List of subscribers for the notification. - contextPath: AWS.Billing.Budget.Notification.Subscribers.SubscriptionType description: Subscription type (EMAIL or SNS). type: string - contextPath: AWS.Billing.Budget.Notification.Subscribers.Address description: Email address or SNS topic ARN for the subscriber. type: string - contextPath: AWS.Billing.NotificationNextToken description: Next page token for pagination. type: string - name: aws-kms-key-rotation-enable description: "Enables automatic rotation for a symmetric customer-managed KMS key. Not supported for asymmetric/HMAC keys, keys with imported material, or custom key stores. Default is us-east-1. Required IAM permission: kms:EnableKeyRotation." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: key_id description: The key ARN to enable rotation for. required: true - name: rotation_period_in_days description: 'Key rotation period in days. Valid range: 90–2560. If omitted when enabling rotation for the first time, the default is 365 days. If rotation is already enabled and this field is not specified, the existing period remains unchanged.' required: false type: number outputs: [] - name: aws-elb-load-balancer-attributes-modify description: "Modifies attributes for a Classic Elastic Load Balancer. Required IAM permission: elasticloadbalancing:ModifyLoadBalancerAttributes." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: load_balancer_name description: The name of the Load Balancer. required: true - name: access_log_enabled description: Whether to enable access logs. (if enabled make sure to provide access_log_s3_bucket_name). required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: access_log_s3_bucket_name description: S3 bucket name for access logs (required if access_log_enabled=true). required: false - name: access_log_interval description: The interval for publishing the access logs. You can specify an interval of either 5 minutes or 60 minutes. If omitted when enabling logging for the first time, the default is 60 minutes. If logging is already enabled and this field is not specified, the existing period remains unchanged. required: false type: number auto: PREDEFINED predefined: - "5" - "60" - name: access_log_s3_bucket_prefix description: S3 key prefix (Path) for access logs. If the prefix is not provided, the log folder is placed at the root level of the bucket. required: false - name: connection_draining_enabled description: Whether connection draining is enabled for the load balancer. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: connection_draining_timeout description: 'The maximum time, in seconds, to keep the existing connections open before de-registering the instance. Valid Range: 1 - 3600.' required: false type: number - name: connection_settings_idle_timeout description: 'The load balancer allows the connections to remain idle (no data is sent over the connection) for this specific duration in seconds. Valid Range: 1 - 4000.' required: false type: number - name: cross_zone_load_balancing_enabled description: Whether to enable cross-zone load balancing. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: desync_mitigation_mode description: | Determines how the Classic Load Balancer handles HTTP requests that might pose a security risk to your application. This sets the 'elb.http.desyncmitigationmode' load balancer attribute. auto: PREDEFINED predefined: - monitor - defensive - strictest required: false type: string outputs: - contextPath: AWS.ELB.LoadBalancer.LoadBalancerName description: The name of the Classic Load Balancer. type: string - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.CrossZoneLoadBalancing.Enabled description: Whether cross-zone load balancing is enabled. type: boolean - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.ConnectionDraining.Enabled description: Whether connection draining is enabled. type: boolean - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.ConnectionDraining.Timeout description: Connection draining timeout in seconds. type: number - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.ConnectionSettings.IdleTimeout description: Idle connection timeout in seconds. type: number - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.AccessLog.Enabled description: Whether access logs are enabled. type: boolean - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.AccessLog.S3BucketName description: The S3 bucket name for access logs. type: string - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.AccessLog.EmitInterval description: Access log publish interval in minutes. type: number - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.AccessLog.S3BucketPrefix description: The S3 key prefix for access logs. type: string - contextPath: AWS.ELB.LoadBalancer.LoadBalancerAttributes.AdditionalAttributes description: Additional attributes returned by the API. type: unknown - name: aws-s3-public-access-block-quick-action description: "Blocks all public access to the S3 bucket. Required IAM permission: s3:PutBucketPublicAccessBlock." prettyname: Block S3 Public Access hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: bucket prettyname: Bucket Name description: The name of the Amazon S3 bucket. required: true defaultValue: Bucket Name prettypredefined: Bucket Name: ${asset.xdm.asset.name} - name: block_public_acls description: Wether Amazon S3 should block public access control lists (ACLs) for this bucket and objects in this bucket. defaultValue: 'true' hidden: true - name: ignore_public_acls description: Wether Amazon S3 should ignore public ACLs for this bucket and objects in this bucket. defaultValue: 'true' hidden: true - name: block_public_policy description: Wether Amazon S3 should block public bucket policies for this bucket. defaultValue: 'true' hidden: true - name: restrict_public_buckets description: Wether Amazon S3 should restrict public bucket policies for this bucket. defaultValue: 'true' hidden: true - name: aws-ec2-enable-imdsv2-quick-action description: "Enables instance metadata services v2.0 for the EC2 instance. Required IAM permission: ec2:ModifyInstanceMetadataOptions." prettyname: Enable IMDSv2 hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: instance_id prettyname: EC2 Instance ID description: The ID of the instance. required: true defaultValue: EC2 Instance ID prettypredefined: EC2 Instance ID: ${asset.xdm.asset.strong_id} - name: http_tokens description: Whether IMDSv2 is required. defaultValue: 'required' hidden: true - name: http_endpoint description: Enables or disables the HTTP metadata endpoint on your instances. defaultValue: 'enabled' hidden: true - name: aws-acm-certificate-options-update description: "Updates Certificate Transparency (CT) logging for an AWS Certificate Manager (ACM) certificate (ENABLED or DISABLED). Required IAM permission: acm:UpdateCertificateOptions." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: certificate_arn description: The ARN of the ACM certificate to update. required: true - name: transparency_logging_preference description: Whether the certificate is recorded in public CT logs. required: true auto: PREDEFINED predefined: - ENABLED - DISABLED outputs: [] - name: aws-ec2-network-interface-attribute-modify description: "Modifies a specific network interface attribute. You can specify only one attribute at a time. You can use this action to attach and detach security groups from an existing EC2 instance. Required IAM permission: ec2:ModifyNetworkInterfaceAttribute." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: network_interface_id description: The ID of the network interface. required: true - name: ena_srd_enabled description: Indicates whether ENA Express is enabled for the network interface. auto: PREDEFINED predefined: - 'true' - 'false' - name: ena_srd_udp_enabled description: Indicates whether UDP traffic to and from the instance uses ENA Express. To specify this setting, you must first enable ENA Express. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: enable_primary_ipv6 description: If you're modifying a network interface in a dual-stack or IPv6-only subnet, you have the option to assign a primary IPv6 IP address. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: tcp_established_timeout description: Timeout (in seconds) for idle TCP connections in an established state. Min is 60 seconds. Max is 432000 seconds. required: false - name: udp_stream_timeout description: Timeout (in seconds) for idle UDP flows classified as streams which have seen more than one request-response transaction. Min is 60 seconds. Max is 180 seconds. required: false - name: udp_timeout description: Timeout (in seconds) for idle UDP flows that have seen traffic only in a single direction or a single request-response transaction. Min is 30 seconds. Max is 60 seconds. required: false - name: associate_public_ip_address description: Indicates whether to assign a public IPv4 address to a network interface. This option can be enabled for any network interface but will only apply to the primary network interface (eth0). required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: associated_subnet_ids description: A list of comma-separated subnet IDs to associate with the network interface. required: false - name: description description: A description for the network interface. required: false - name: source_dest_check description: Enable or disable source/destination checks, which ensure that the instance is either the source or the destination of any traffic that it receives. If the value is true, source/destination checks are enabled; otherwise, they are disabled. The default value is true. You must disable source/destination checks if the instance runs services such as network address translation, routing, or firewalls. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: groups description: A comma-separated list of security groups IDs. Changes the security groups for the network interface. The new set of groups you specify replaces the current set. required: false - name: default_ena_queue_count description: Whether to use the default number of the ENA queues. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: ena_queue_count description: The number of ENA queues to be created with the instance. required: false - name: attachment_id description: The ID of the network interface attachment. If modifying the delete on termination attribute, you must specify the ID of the interface attachment. required: false - name: delete_on_termination description: Indicates whether the network interface is deleted when the instance is terminated. If modified, you must specify the ID of the interface attachment. required: false auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.EC2.NetworkInterfaces.Attribute.ModifyResponseMetadata description: The response metadata. type: Object - contextPath: AWS.EC2.NetworkInterfaces.NetworkInterfaceId description: The ID of the network interface. type: String - name: aws-ec2-regions-describe description: "Returns details for the regions enabled for your account, or for all regions. Required IAM permission: ec2:DescribeRegions." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: region_names description: The names of the Regions. You can specify any Regions, whether they are enabled and disabled for your account. required: false - name: all_regions description: Indicates whether to display all Regions, including Regions that are disabled for your account. required: false auto: PREDEFINED predefined: - 'true' - 'false' - description: One or more filters separated by ';' (for example, name=,values=;name=,values=). A filter name and value pair that is used to return a more specific list of results from a describe operation. Filters can be used to match a set of resources by specific criteria, such as tags, attributes, or IDs. Possible filters are endpoint, opt-in-status, region-name. name: filters outputs: - contextPath: AWS.EC2.Regions.Endpoint description: The region service endpoint. type: string - contextPath: AWS.EC2.Regions.RegionName description: The name of the region. type: string - contextPath: AWS.EC2.Regions.OptInStatus description: The Region opt-in status. The possible values are opt-in-not-required, opted-in, and not-opted-in. type: string - name: aws-s3-bucket-create description: "Creates a new S3 bucket. Required IAM permission: s3:CreateBucket." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: bucket_name description: The name of the bucket to create. For more information about bucket naming rules see https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html. required: true - name: acl description: The canned ACL to apply to the bucket. required: false auto: PREDEFINED predefined: - private - public-read - public-read-write - authenticated-read - name: location_constraint description: Specifies the Region where the bucket will be created. You might choose a Region to optimize latency, minimize costs, or address regulatory requirements. The default is the account region. required: false auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: grant_full_control description: Allows grantee the read, write, read ACP, and write ACP permissions on the bucket. required: false - name: grant_read description: Allows grantee to list the objects in the bucket. required: false - name: grant_read_acp description: Allows grantee to read the bucket ACL. required: false - name: grant_write description: Allows grantee to create new objects in the bucket. required: false - name: grant_write_acp description: Allows grantee to write the ACL for the applicable bucket. required: false outputs: - contextPath: AWS.S3.Buckets.BucketName description: The name of the bucket that was created. type: string - contextPath: AWS.S3.Buckets.Location description: The AWS Region the bucket was created. type: string - contextPath: AWS.S3.Buckets.BucketArn description: The Amazon Resource Name (ARN) of the S3 bucket. type: string - name: aws-s3-buckets-list description: "Returns a list of all buckets owned by the authenticated sender of the request. Required IAM permission: s3:ListAllMyBuckets." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: limit description: Maximum number of buckets to be returned in response. The maximum value is 10000. defaultValue: 50 required: false - name: next_token description: The token for the next set of items to return. Use value from AWS.S3.BucketsNextPageToken. required: false - name: prefix description: Limits the response to bucket names that begin with the specified bucket name prefix. required: false - name: filter_by_region description: A comma-separated list of regions that limits the response to buckets that are located in the specified Amazon Web Services Region. auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 outputs: - contextPath: AWS.S3.Buckets.BucketName description: The name of the bucket. type: string - contextPath: AWS.S3.Buckets.CreationDate description: Date the bucket was created. This date can change when making changes to your bucket, such as editing its bucket policy. type: string - contextPath: AWS.S3.Buckets.BucketRegion description: BucketRegion indicates the Amazon Web Services region where the bucket is located. type: string - contextPath: AWS.S3.Buckets.BucketArn description: The Amazon Resource Name (ARN) of the S3 bucket. type: string - contextPath: AWS.S3.BucketsOwner.DisplayName description: Container for the display name of the owner. type: string - contextPath: AWS.S3.BucketsOwner.ID description: Container for the ID of the owner. type: string - contextPath: AWS.S3.BucketsNextPageToken description: BucketsNextPageToken is included in the response when there are more buckets that can be listed with pagination. The next ListBuckets request to Amazon S3 can be continued with this BucketsNextPageToken. type: string - contextPath: AWS.S3.BucketsPrefix description: If Prefix was sent with the request, it is included in the response. type: string - name: aws-ssm-inventory-entries-list description: "Returns a list of inventory items. Required IAM permission: ssm:ListInventoryEntries." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_id description: The managed node ID for which you want inventory information. required: true - name: type_name description: The type of inventory item for which you want information. required: true - name: limit description: The maximum number of items to return for this call. The maximum value is 50. defaultValue: 50 required: false - description: "One or more filters separated by ';' (for example, key=,values=,type=;key=,values=,type=). Use a filter to return a more specific list of results. The value of type can be from the following closed list: Equal, NotEqual, BeginWith, LessThan, GreaterThan, Exists." name: filters required: false - name: next_token description: The token for the next set of items to return. Use AWS.SSM.Inventory.EntriesNextPageToken. required: false outputs: - contextPath: AWS.SSM.Inventory.TypeName description: The type of inventory item returned by the request. type: string - contextPath: AWS.SSM.Inventory.InstanceId description: The managed node ID targeted by the request to query inventory information. type: string - contextPath: AWS.SSM.Inventory.SchemaVersion description: The inventory schema version used by the managed nodes. type: string - contextPath: AWS.SSM.Inventory.CaptureTime description: The time that inventory information was collected for the managed nodes. type: string - contextPath: AWS.SSM.Inventory.Entries description: A list of inventory items on the managed nodes. type: object - contextPath: AWS.SSM.Inventory.EntriesNextPageToken description: The token to use when requesting the next set of items. type: object - name: aws-ssm-command-run description: "Runs commands on one or more managed nodes. Required IAM permission: ssm:SendCommand, ssm:ListCommands." polling: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: A comma-separated list of IDs of the managed nodes where the command should run. Maximum of 50 IDs. - name: targets description: "One or more targets separated by ';' (for example, key=,values=,;key=,values=,). An array of search criteria used to target managed nodes, where each criterion consists of a Key and a Value that you specify." - name: document_name description: The name of the Amazon Web Services Systems Manager document (SSM document) to run. This can be a public document or a custom document. To run a shared document belonging to another account, specify the document Amazon Resource Name (ARN). required: true - name: document_version description: The SSM document version to use in the request. You can specify $DEFAULT, $LATEST, or a specific version number. required: false - name: document_hash description: The Sha256 hash created by the system when the document was created. required: false - name: command_timeout description: If this time (in seconds) is reached and the command hasn’t already started running, it won’t run. Minimum value of 30. Maximum value of 2592000. required: false - name: comment description: User-specified information about the command, such as a brief description of what the command should do. required: false - name: parameters description: "The required and optional parameters specified in the document being run. The template is 'key=,values=,;key=,values=,'." required: false - name: output_s3_bucket_name description: The name of the S3 bucket where command execution responses should be stored. required: false - name: output_s3_key_prefix description: The directory structure within the S3 bucket where the responses should be stored. required: false - name: max_concurrency description: The maximum number of managed nodes that are allowed to run the command at the same time. You can specify a number such as 10 or a percentage such as 10%. required: false defaultValue: "50" - name: max_errors description: The maximum number of errors allowed without the command failing. When the command fails one more time beyond the value of MaxErrors, the systems stops sending the command to additional targets. You can specify a number like 10 or a percentage like 10%. defaultValue: "0" required: false - description: A unique identifier for this command. This is for the polling to work, not for the user. name: command_id hidden: true - description: The timeout in seconds until polling ends. name: polling_timeout defaultValue: '600' - description: Hide the polling message and only print the final status at the end. This argument is for the dev, not for the user. name: hide_polling_output hidden: true outputs: - contextPath: AWS.SSM.Command.CommandId description: A unique identifier for this command. type: String - contextPath: AWS.SSM.Command.DocumentName description: The name of the document requested for execution. type: String - contextPath: AWS.SSM.Command.DocumentVersion description: The Systems Manager document (SSM document) version. type: String - contextPath: AWS.SSM.Command.Comment description: User-specified information about the command, such as a brief description of what the command should do. type: String - contextPath: AWS.SSM.Command.ExpiresAfter description: If a command expires, it changes status to DeliveryTimedOut for all invocations that have the status InProgress, Pending, or Delayed. ExpiresAfter is calculated based on the total timeout for the overall command. type: String - contextPath: AWS.SSM.Command.Parameters description: The parameter values to be inserted in the document when running the command. type: Object - contextPath: AWS.SSM.Command.InstanceIds description: The managed node IDs against which this command was requested. type: Object - contextPath: AWS.SSM.Command.Targets description: An array of search criteria used to target managed nodes, where each criterion consists of a Key and a Value that you specify. type: Object - contextPath: AWS.SSM.Command.RequestedDateTime description: The date and time the command was requested. type: String - contextPath: AWS.SSM.Command.Status description: The status of the command. type: String - contextPath: AWS.SSM.Command.StatusDetails description: A detailed status of the command execution. StatusDetails includes more information than Status because it includes states resulting from error and concurrency control parameters. type: String - contextPath: AWS.SSM.Command.OutputS3BucketName description: The name of the S3 bucket where command execution responses should be stored. type: String - contextPath: AWS.SSM.Command.OutputS3KeyPrefix description: The directory structure within the S3 bucket where the responses should be stored. type: String - contextPath: AWS.SSM.Command.MaxConcurrency description: The maximum number of managed nodes that are allowed to run the command at the same time. type: String - contextPath: AWS.SSM.Command.MaxErrors description: The maximum number of errors allowed before the system stops sending the command to additional targets. type: String - contextPath: AWS.SSM.Command.TargetCount description: The number of targets for the command. type: Number - contextPath: AWS.SSM.Command.CompletedCount description: 'The number of targets for which the command invocation reached a terminal state. Terminal states include the following: Success, Failed, Execution Timed Out, Delivery Timed Out, Cancelled, Terminated, or Undeliverable.' type: Number - contextPath: AWS.SSM.Command.ErrorCount description: The number of targets for which the status is Failed or Execution Timed Out. type: Number - contextPath: AWS.SSM.Command.DeliveryTimedOutCount description: The number of targets for which the status is Delivery Timed Out. type: Number - contextPath: AWS.SSM.Command.ServiceRole description: The Identity and Access Management (IAM) service role that Run Command, a tool in Amazon Web Services Systems Manager, uses to act on your behalf when sending notifications about command status changes. type: String - contextPath: AWS.SSM.Command.NotificationConfig.NotificationArn description: An Amazon Resource Name (ARN) for an Amazon Simple Notification Service (Amazon SNS) topic. Run Command pushes notifications about command status changes to this topic. type: String - contextPath: AWS.SSM.Command.NotificationConfig.NotificationEvents description: The different events for which you can receive notifications. type: Object - contextPath: AWS.SSM.Command.NotificationConfig.NotificationType description: The type of notification. type: String - contextPath: AWS.SSM.Command.CloudWatchOutputConfig.CloudWatchLogGroupName description: The name of the CloudWatch Logs log group where you want to send command output. type: String - contextPath: AWS.SSM.Command.CloudWatchOutputConfig.CloudWatchOutputEnabled description: Enables Systems Manager to send command output to CloudWatch Logs. type: Boolean - contextPath: AWS.SSM.Command.TimeoutSeconds description: The TimeoutSeconds value specified for a command. type: Number - contextPath: AWS.SSM.Command.AlarmConfiguration.IgnorePollAlarmFailure description: When this value is true, your automation or command continues to run in cases where we can’t retrieve alarm status information from CloudWatch. In cases where we successfully retrieve an alarm status of OK or INSUFFICIENT_DATA, the automation or command continues to run, regardless of this value. type: String - contextPath: AWS.SSM.Command.AlarmConfiguration.Alarms.Name description: The name of your CloudWatch alarm. type: String - contextPath: AWS.SSM.Command.TriggeredAlarms.Name description: The name of your CloudWatch alarm. type: String - contextPath: AWS.SSM.Command.TriggeredAlarms.State description: The state of your CloudWatch alarm. type: String - name: aws-ec2-security-group-create execution: true description: "Creates a security group. Required IAM permission: ec2:CreateSecurityGroup." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: group_name description: The name of the security group. Up to 255 characters in length. Cannot start with sg-. Names are case-insensitive and must be unique within the VPC. required: true - name: description description: 'A description for the security group. This is informational only. Up to 255 characters in length. Valid characters: a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*.' required: true - name: vpc_id description: The ID of the VPC. Required for a nondefault VPC. required: false - name: aws-ec2-security-group-delete execution: true description: "Deletes a security group. Required IAM permission: ec2:DeleteSecurityGroup." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: group_id description: The ID of the security group to delete (e.g., sg-12345678). Required if group_name is not provided. - name: group_name description: The name of the security group to delete. Required if group_id is not provided. Note that you can’t reference a security group for EC2-VPC by name. - name: aws-ec2-security-groups-describe description: "Returns details for a specific security group or all of your security groups, including their rules, tags, and associated VPC information. Required IAM permission: ec2:DescribeSecurityGroups." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: group_ids description: Comma-separated list of security group IDs (e.g., sg-12345678,sg-87654321). isArray: true - name: group_names description: Comma-separated list of security group names. group_names is only supported for EC2-Classic and default VPC. isArray: true - name: filters description: "One or more custom filters to apply, separated by ';' (for example, name=;values=).You can specify up to 50 filters and up to 200 values per filter in a single request." isArray: true - name: limit defaultValue: "50" description: The maximum number of records to return. Valid range is 5-1000. - name: next_token description: The nextToken value returned from a previous paginated request, where maxResults was used and the results exceeded the value of that parameter. outputs: - contextPath: AWS.EC2.SecurityGroupsNextToken description: The nextToken value returned from a previous paginated request, where maxResults was used and the results exceeded the value of that parameter. type: string - contextPath: AWS.EC2.SecurityGroups.Description description: A description of the security group. type: string - contextPath: AWS.EC2.SecurityGroups.GroupName description: The name of the security group. type: string - contextPath: AWS.EC2.SecurityGroups.IpPermissions description: The inbound rules associated with the security group. - contextPath: AWS.EC2.SecurityGroups.OwnerId description: The AWS account ID of the owner of the security group. type: string - contextPath: AWS.EC2.SecurityGroups.GroupId description: The ID of the security group. type: string - contextPath: AWS.EC2.SecurityGroups.IpPermissionsEgress description: The outbound rules associated with the security group. type: array - contextPath: AWS.EC2.SecurityGroups.VpcId description: The ID of the VPC for the security group. type: string - contextPath: AWS.EC2.SecurityGroups.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.SecurityGroups.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.SecurityGroups.AccountId description: The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided. type: string - contextPath: AWS.EC2.SecurityGroups.SecurityGroupArn description: The ARN of the security group. type: string - name: aws-ec2-addresses-describe description: "Describes one or more of your Elastic IP addresses. Required IAM Permission: ec2:DescribeAddresses." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options." required: false - name: public_ips description: "One or more Elastic IP addresses, separated by commas." required: false isArray: true - name: allocation_ids description: "One or more allocation IDs, separated by commas." required: false isArray: true outputs: - contextPath: AWS.EC2.ElasticIPs.PublicIp description: The Elastic IP address. type: string - contextPath: AWS.EC2.ElasticIPs.AllocationId description: The ID representing the allocation of the address. type: string - contextPath: AWS.EC2.ElasticIPs.Domain description: The network (vpc or standard). type: string - contextPath: AWS.EC2.ElasticIPs.InstanceId description: The ID of the instance the address is associated with (if any). type: string - contextPath: AWS.EC2.ElasticIPs.AssociationId description: The ID representing the association of the address with an instance. type: string - contextPath: AWS.EC2.ElasticIPs.NetworkInterfaceId description: The ID of the network interface. type: string - contextPath: AWS.EC2.ElasticIPs.NetworkInterfaceOwnerId description: The ID of the AWS account that owns the network interface. type: string - contextPath: AWS.EC2.ElasticIPs.PrivateIpAddress description: The private IP address associated with the Elastic IP address. type: string - contextPath: AWS.EC2.ElasticIPs.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.ElasticIPs.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.ElasticIPs.PublicIpv4Pool description: The ID of an address pool. type: string - contextPath: AWS.EC2.ElasticIPs.NetworkBorderGroup description: The name of the unique set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses. type: string - contextPath: AWS.EC2.ElasticIPs.CustomerOwnedIp description: The customer-owned IP address. type: string - contextPath: AWS.EC2.ElasticIPs.CustomerOwnedIpv4Pool description: The ID of the customer-owned address pool. type: string - contextPath: AWS.EC2.ElasticIPs.CarrierIp description: The carrier IP address associated. type: string - name: aws-ec2-address-allocate description: "Allocates an Elastic IP address to your AWS account. After you allocate the Elastic IP address you can associate it with an instance or network interface. Required IAM Permission: ec2:AllocateAddress." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: address description: The Elastic IP address to recover or an IPv4 address from an address pool. required: false - name: public_ipv4_pool description: The ID of an address pool that you own. Use this parameter to let Amazon EC2 select an address from the address pool. required: false - name: network_border_group description: A unique set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses. required: false - name: customer_owned_ipv4_pool description: The ID of a customer-owned address pool. required: false - name: tag_specifications description: "The tags to assign to the Elastic IP address. Format: key=,value=;key=,value=." required: false outputs: - contextPath: AWS.EC2.ElasticIPs.PublicIp description: The Elastic IP address. type: string - contextPath: AWS.EC2.ElasticIPs.AllocationId description: The ID that represents the allocation of the Elastic IP address. type: string - contextPath: AWS.EC2.ElasticIPs.Domain description: The network (vpc or standard). type: string - contextPath: AWS.EC2.ElasticIPs.PublicIpv4Pool description: The ID of an address pool. type: string - contextPath: AWS.EC2.ElasticIPs.NetworkBorderGroup description: The name of the unique set of Availability Zones, Local Zones, or Wavelength Zones. type: string - contextPath: AWS.EC2.ElasticIPs.CustomerOwnedIp description: The customer-owned IP address. type: string - contextPath: AWS.EC2.ElasticIPs.CustomerOwnedIpv4Pool description: The ID of the customer-owned address pool. type: string - contextPath: AWS.EC2.ElasticIPs.CarrierIp description: The carrier IP address. type: string - name: aws-ec2-address-associate description: "Associates an Elastic IP address, or carrier IP address (for instances that are in subnets in Wavelength Zones) with an instance or a network interface. Required IAM Permission: ec2:AssociateAddress." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: allocation_id description: The allocation ID. required: true - name: instance_id description: The ID of the instance. The instance must have exactly one attached network interface. required: false - name: network_interface_id description: The ID of the network interface. required: false - name: private_ip_address description: The primary or secondary private IP address to associate with the Elastic IP address. required: false - name: allow_reassociation description: Whether to allow an Elastic IP address that is already associated with another network interface or instance to be reassociated with the specified instance or network interface. required: false auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.EC2.ElasticIPs.AllocationId description: The allocation ID. type: string - contextPath: AWS.EC2.ElasticIPs.AssociationId description: The ID that represents the association of the Elastic IP address with an instance. type: string - name: aws-ec2-address-disassociate description: "Disassociates an Elastic IP address from the instance or network interface it's associated with. Required IAM Permission: ec2:DisassociateAddress." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: association_id description: The association ID. Required for VPC. required: false - name: aws-ec2-address-release description: "Releases the specified Elastic IP address. After releasing an Elastic IP address, it is released to the IP address pool and might be unavailable to you. Required IAM Permission: ec2:ReleaseAddress." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: allocation_id description: The allocation ID. Required for VPC. required: false - name: network_border_group description: The set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses. required: false - name: aws-ec2-instances-monitor description: "Enables detailed monitoring on one or more running Amazon EC2 instances. Required IAM Permission: ec2:MonitorInstances." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: A comma-separated list of instance IDs to enable monitoring for. required: true isArray: true outputs: - contextPath: AWS.EC2.Instances.InstanceId description: The ID of the instance. type: String - contextPath: AWS.EC2.Instances.Monitoring.State description: The monitoring state (disabled | disabling | enabled | pending). type: String - name: aws-ec2-instances-unmonitor description: "Disables detailed monitoring for one or more running Amazon EC2 instances. Required IAM Permission: ec2:UnmonitorInstances." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: A comma-separated list of instance IDs to disable monitoring for. required: true isArray: true outputs: - contextPath: AWS.EC2.Instances.InstanceId description: The ID of the instance. type: String - contextPath: AWS.EC2.Instances.Monitoring.State description: The monitoring state (disabled | disabling | enabled | pending). type: String - name: aws-ec2-instances-reboot description: "Requests a reboot of one or more instances. This operation is asynchronous; it only queues a request to reboot the specified instances. Required IAM Permission: ec2:RebootInstances." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: A comma-separated list of instance IDs to reboot. required: true isArray: true - name: aws-ec2-instance-running-waiter description: "Waits until the specified EC2 instances reach the 'running' state. Checks the status every `waiter_delay` seconds until successful or until `waiter_max_attempts` is reached (default maximum attempts: `waiter_max_attempts`). Required IAM Permission: ec2:DescribeInstances." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: A comma-separated list of instance IDs to wait for. isArray: true - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). - name: waiter_delay description: The amount of time in seconds to wait between attempts. Default is 15. defaultValue: "15" - name: waiter_max_attempts description: The maximum number of attempts to be made. Default is 40. defaultValue: "40" - name: aws-ec2-instance-status-ok-waiter description: "Waits until EC2 instance status checks pass. Checks every `waiter_delay` seconds until successful or until the maximum number of attempts (`waiter_max_attempts`) is reached. Required IAM Permission: ec2:DescribeInstanceStatus." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: A comma-separated list of instance IDs to wait for. isArray: true - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). - name: waiter_delay description: The amount of time in seconds, to wait between attempts. Default is 15. defaultValue: "15" - name: waiter_max_attempts description: The maximum number of attempts to be made. Default is 40. defaultValue: "40" - name: include_all_instances description: When true, includes the health status for all instances. When false, includes the health status for running instances only. auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' - name: aws-ec2-instance-stopped-waiter description: "Waits until EC2 instances are in the 'stopped' state. Checks every `waiter_delay` seconds until successful or until the maximum number of attempts (`waiter_max_attempts`) is reached. Required IAM Permission: ec2:DescribeInstances." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: A comma-separated list of instance IDs to wait for. isArray: true - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). - name: waiter_delay description: The amount of time in seconds to wait between attempts. Default is 15. defaultValue: "15" - name: waiter_max_attempts description: The maximum number of attempts to be made. Default is 40. defaultValue: "40" - name: aws-ec2-instance-terminated-waiter description: "Waits until the specified EC2 instances reach the 'terminated' state. Checks every `waiter_delay` seconds until successful or until the maximum number of attempts (`waiter_max_attempts`) is reached. Required IAM Permission: ec2:DescribeInstances." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_ids description: A comma-separated list of instance IDs to wait for. isArray: true - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). - name: waiter_delay description: The amount of time in seconds to wait between attempts. Default is 15. defaultValue: "15" - name: waiter_max_attempts description: The maximum number of attempts to be made. Default is 40. defaultValue: "40" - name: aws-ec2-iam-instance-profile-associations-describe description: "Describes IAM instance profile associations. Required IAM Permission: ec2:DescribeIamInstanceProfileAssociations." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: association_ids description: A comma-separated list of IAM instance profile association IDs. isArray: true - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). - name: limit description: The maximum number of results to return. Minimum value of 5. Maximum value of 1000. defaultValue: 50 - name: next_token description: The token for the next set of results. outputs: - contextPath: AWS.EC2.IamInstanceProfileAssociations.AssociationId description: The ID of the association. type: String - contextPath: AWS.EC2.IamInstanceProfileAssociations.InstanceId description: The ID of the instance. type: String - contextPath: AWS.EC2.IamInstanceProfileAssociations.IamInstanceProfile.Arn description: The Amazon Resource Name (ARN) of the instance profile. type: String - contextPath: AWS.EC2.IamInstanceProfileAssociations.IamInstanceProfile.Id description: The ID of the instance profile. type: String - contextPath: AWS.EC2.IamInstanceProfileAssociations.State description: The state of the association. type: String - contextPath: AWS.EC2.IamInstanceProfileAssociationsNextToken description: The token for the next set of results. type: String - name: aws-ec2-password-data-get description: "Retrieves the encrypted administrator password for a running Windows instance. Required IAM Permission: ec2:GetPasswordData." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: instance_id description: The ID of the Windows instance. required: true outputs: - contextPath: AWS.EC2.Instances.PasswordData.InstanceId description: The ID of the instance. type: String - contextPath: AWS.EC2.Instances.PasswordData.PasswordData description: The password of the instance. Returns an empty string if the password is not available. type: String - contextPath: AWS.EC2.Instances.PasswordData.Timestamp description: The time the data was last updated. type: Date - contextPath: AWS.EC2.Instances.InstanceId description: The ID of the instance. type: String - name: aws-ec2-reserved-instances-describe description: "Describes one or more of the Reserved Instances that you purchased. Required IAM Permission: ec2:DescribeReservedInstances." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: reserved_instances_ids description: A comma-separated list of Reserved Instance IDs. isArray: true - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). - name: offering_class description: The offering class of the Reserved Instance. auto: PREDEFINED predefined: - standard - convertible - name: offering_type description: The Reserved Instance offering type. auto: PREDEFINED predefined: - Heavy Utilization - Medium Utilization - Light Utilization - No Upfront - Partial Upfront - All Upfront outputs: - contextPath: AWS.EC2.ReservedInstances.ReservedInstancesId description: The ID of the Reserved Instance. type: String - contextPath: AWS.EC2.ReservedInstances.InstanceType description: The instance type on which the Reserved Instance can be used. type: String - contextPath: AWS.EC2.ReservedInstances.AvailabilityZone description: The Availability Zone in which the Reserved Instance can be used. type: String - contextPath: AWS.EC2.ReservedInstances.Start description: The date and time the Reserved Instance started. type: Date - contextPath: AWS.EC2.ReservedInstances.End description: The time when the Reserved Instance expires. type: Date - contextPath: AWS.EC2.ReservedInstances.Duration description: The duration of the Reserved Instance, in seconds. type: Number - contextPath: AWS.EC2.ReservedInstances.UsagePrice description: The usage price of the Reserved Instance, per hour. type: Number - contextPath: AWS.EC2.ReservedInstances.FixedPrice description: The purchase price of the Reserved Instance. type: Number - contextPath: AWS.EC2.ReservedInstances.InstanceCount description: The number of reservations purchased. type: Number - contextPath: AWS.EC2.ReservedInstances.ProductDescription description: The Reserved Instance product platform description. type: String - contextPath: AWS.EC2.ReservedInstances.State description: The state of the Reserved Instance purchase. type: String - contextPath: AWS.EC2.ReservedInstances.CurrencyCode description: The currency of the Reserved Instance. type: String - contextPath: AWS.EC2.ReservedInstances.InstanceTenancy description: The tenancy of the instance. type: String - contextPath: AWS.EC2.ReservedInstances.OfferingClass description: The offering class of the Reserved Instance. type: String - contextPath: AWS.EC2.ReservedInstances.OfferingType description: The Reserved Instance offering type. type: String - contextPath: AWS.EC2.ReservedInstances.RecurringCharges.Amount description: The amount of the recurring charge. type: Number - contextPath: AWS.EC2.ReservedInstances.RecurringCharges.Frequency description: The frequency of the recurring charge. type: String - contextPath: AWS.EC2.ReservedInstances.Scope description: The scope of the Reserved Instance. type: String - contextPath: AWS.EC2.ReservedInstances.Tags.Key description: The key of the tag. type: String - contextPath: AWS.EC2.ReservedInstances.Tags.Value description: The value of the tag. type: String - name: aws-ec2-volumes-describe description: "Describes the specified EBS volumes or all of your EBS volumes. Required IAM Permission: ec2:DescribeVolumes." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. required: false - name: volume_ids description: A comma-separated list of volume IDs. required: false isArray: true - name: limit description: The maximum number of records to return. The valid range is 5-1000. - name: next_token description: The token returned from a previous paginated request. Pagination continues from the end of the items returned by the previous request. outputs: - contextPath: AWS.EC2.Volumes.Attachments.AttachTime description: The timestamp when the attachment was initiated. type: date - contextPath: AWS.EC2.Volumes.Attachments.Device description: The device name. type: string - contextPath: AWS.EC2.Volumes.Attachments.InstanceId description: The ID of the instance. type: string - contextPath: AWS.EC2.Volumes.Attachments.State description: The attachment state of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.DeleteOnTermination description: Indicates whether the EBS volume is deleted on instance termination. type: boolean - contextPath: AWS.EC2.Volumes.AvailabilityZone description: The Availability Zone for the volume. type: string - contextPath: AWS.EC2.Volumes.CreateTime description: The time stamp when volume creation was initiated. type: date - contextPath: AWS.EC2.Volumes.Encrypted description: Indicates whether the volume is encrypted. type: boolean - contextPath: AWS.EC2.Volumes.KmsKeyId description: The Amazon Resource Name (ARN) of the AWS Key Management Service (AWS KMS) customer master key (CMK) that was used to protect the volume encryption key for the volume. type: string - contextPath: AWS.EC2.Volumes.OutpostArn description: The Amazon Resource Name (ARN) of the Outpost. type: string - contextPath: AWS.EC2.Volumes.Size description: The size of the volume, in GiBs. type: number - contextPath: AWS.EC2.Volumes.SnapshotId description: The snapshot from which the volume was created, if applicable. type: string - contextPath: AWS.EC2.Volumes.State description: The volume state. type: string - contextPath: AWS.EC2.Volumes.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Iops description: The number of I/O operations per second (IOPS). type: number - contextPath: AWS.EC2.Volumes.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Volumes.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.Volumes.VolumeType description: The volume type. type: string - contextPath: AWS.EC2.Volumes.FastRestored description: Indicates whether the volume was created using fast snapshot restore. type: boolean - contextPath: AWS.EC2.Volumes.MultiAttachEnabled description: Indicates whether Amazon EBS Multi-Attach is enabled. type: boolean - contextPath: AWS.EC2.Volumes.Throughput description: The throughput that the volume supports, in MiB/s. type: number - contextPath: AWS.EC2.Volumes.SseType description: Reserved for future use. type: string - contextPath: AWS.EC2.VolumesNextToken description: Token to use for pagination in subsequent requests. type: String - name: aws-ec2-volume-modify description: "You can modify several parameters of an existing EBS volume, including volume size, volume type, and IOPS capacity. Required IAM Permission: ec2:ModifyVolume." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: volume_id description: The ID of the volume. required: true - name: size description: Target size in GiB of the volume to be modified. required: false - name: volume_type description: Target EBS volume type of the volume to be modified. The API does not support modifications for volume type standard. required: false auto: PREDEFINED predefined: - gp2 - gp3 - io1 - io2 - sc1 - st1 - name: iops description: Target IOPS rate of the volume to be modified. required: false - name: throughput description: Target throughput of the volume to be modified, in MiB/s. Valid only for gp3 volumes. required: false - name: multi_attach_enabled description: Specifies whether to enable Amazon EBS Multi-Attach. Valid only for io1 and io2 volumes. required: false auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.EC2.Volumes.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Modification.ModificationState description: The current modification state. type: string - contextPath: AWS.EC2.Volumes.Modification.StatusMessage description: A status message about the modification progress or failure. type: string - contextPath: AWS.EC2.Volumes.Size description: The target size of the volume, in GiB. type: number - contextPath: AWS.EC2.Volumes.Iops description: The target IOPS rate of the volume. type: number - contextPath: AWS.EC2.Volumes.VolumeType description: The target EBS volume type of the volume. type: string - contextPath: AWS.EC2.Volumes.Throughput description: The target throughput of the volume, in MiB/s. type: number - contextPath: AWS.EC2.Volumes.MultiAttachEnabled description: The target setting for Amazon EBS Multi-Attach. type: boolean - contextPath: AWS.EC2.Volumes.Modification.OriginalSize description: The original size of the volume, in GiB. type: number - contextPath: AWS.EC2.Volumes.Modification.OriginalIops description: The original IOPS rate of the volume. type: number - contextPath: AWS.EC2.Volumes.Modification.OriginalVolumeType description: The original EBS volume type of the volume. type: string - contextPath: AWS.EC2.Volumes.Modification.OriginalThroughput description: The original throughput of the volume, in MiB/s. type: number - contextPath: AWS.EC2.Volumes.Modification.OriginalMultiAttachEnabled description: The original setting for Amazon EBS Multi-Attach. type: boolean - contextPath: AWS.EC2.Volumes.Modification.Progress description: The modification progress, from 0 to 100 percent complete. type: number - contextPath: AWS.EC2.Volumes.Modification.StartTime description: The modification start time. type: date - contextPath: AWS.EC2.Volumes.Modification.EndTime description: The modification completion or failure time. type: date - name: aws-ec2-volume-create description: "Creates an EBS volume that can be attached to an instance in the same Availability Zone. Required IAM Permission: ec2:CreateVolume." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: availability_zone description: The Availability Zone in which to create the volume. required: true - name: encrypted description: Specifies whether the volume should be encrypted. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: iops description: The number of I/O operations per second (IOPS). For gp3, io1, and io2 volumes, this represents the number of IOPS that are provisioned for the volume. required: false - name: kms_key_id description: The identifier of the AWS KMS key to use for Amazon EBS encryption. If this parameter is not specified, your AWS managed key for Amazon EBS is used. required: false - name: outpost_arn description: The Amazon Resource Name (ARN) of the Outpost. required: false - name: size description: The size of the volume, in GiBs. You must specify either a snapshot ID or a volume size. required: false - name: snapshot_id description: The snapshot from which to create the volume. You must specify either a snapshot ID or a volume size. required: false - name: volume_type description: The volume type. required: false auto: PREDEFINED predefined: - standard - io1 - io2 - gp2 - gp3 - sc1 - st1 - name: throughput description: The throughput to provision for a volume, with a maximum of 1,000 MiB/s. This parameter is valid only for gp3 volumes. required: false - name: multi_attach_enabled description: Indicates whether to enable Amazon EBS Multi-Attach. If you enable Multi-Attach, you can attach the volume to up to 16 Nitro-based instances in the same Availability Zone. This parameter is supported with io1 and io2 volumes only. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: tags description: One or more tags. Example key=Name,value=test;key=Owner,value=Bob. required: false - name: client_token description: Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. required: false outputs: - contextPath: AWS.EC2.Volumes.Attachments.AttachTime description: The timestamp when the attachment was initiated. type: date - contextPath: AWS.EC2.Volumes.Attachments.Device description: The device name. type: string - contextPath: AWS.EC2.Volumes.Attachments.InstanceId description: The ID of the instance. type: string - contextPath: AWS.EC2.Volumes.Attachments.State description: The attachment state of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.DeleteOnTermination description: Indicates whether the EBS volume is deleted on instance termination. type: boolean - contextPath: AWS.EC2.Volumes.AvailabilityZone description: The Availability Zone for the volume. type: string - contextPath: AWS.EC2.Volumes.CreateTime description: The time stamp when volume creation was initiated. type: date - contextPath: AWS.EC2.Volumes.Encrypted description: Indicates whether the volume is encrypted. type: boolean - contextPath: AWS.EC2.Volumes.KmsKeyId description: The Amazon Resource Name (ARN) of the AWS Key Management Service (AWS KMS) customer master key (CMK) that was used to protect the volume encryption key for the volume. type: string - contextPath: AWS.EC2.Volumes.OutpostArn description: The Amazon Resource Name (ARN) of the Outpost. type: string - contextPath: AWS.EC2.Volumes.Size description: The size of the volume, in GiBs. type: number - contextPath: AWS.EC2.Volumes.SnapshotId description: The snapshot from which the volume was created, if applicable. type: string - contextPath: AWS.EC2.Volumes.State description: The volume state. type: string - contextPath: AWS.EC2.Volumes.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Iops description: The number of I/O operations per second (IOPS). type: number - contextPath: AWS.EC2.Volumes.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Volumes.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.Volumes.VolumeType description: The volume type. type: string - contextPath: AWS.EC2.Volumes.FastRestored description: Indicates whether the volume was created using fast snapshot restore. type: boolean - contextPath: AWS.EC2.Volumes.MultiAttachEnabled description: Indicates whether Amazon EBS Multi-Attach is enabled. type: boolean - contextPath: AWS.EC2.Volumes.Throughput description: The throughput that the volume supports, in MiB/s. type: number - contextPath: AWS.EC2.Volumes.SseType description: Reserved for future use. type: string - name: aws-ec2-volume-attach description: "Attaches an EBS volume to a running or stopped instance and exposes it to the instance with the specified device name. Required IAM Permission: ec2:AttachVolume." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: device description: The device name (for example, /dev/sdh or xvdh). required: true - name: instance_id description: The ID of the instance. required: true - name: volume_id description: The ID of the EBS volume. The volume and instance must be within the same Availability Zone. required: true outputs: - contextPath: AWS.EC2.Volumes.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.AttachTime description: The timestamp when the attachment was initiated. type: date - contextPath: AWS.EC2.Volumes.Attachments.Device description: The device name. type: string - contextPath: AWS.EC2.Volumes.Attachments.InstanceId description: The ID of the instance. type: string - contextPath: AWS.EC2.Volumes.Attachments.State description: The attachment state of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.DeleteOnTermination description: Indicates whether the EBS volume is deleted on instance termination. type: boolean - contextPath: AWS.EC2.Volumes.Attachments.AssociatedResource description: The ARN of the Amazon ECS or Fargate task to which the volume is attached. type: string - contextPath: AWS.EC2.Volumes.Attachments.InstanceOwningService description: The service principal of Amazon Web Services service that owns the underlying instance to which the volume is attached. type: string - name: aws-ec2-volume-detach description: "Detaches an EBS volume from an instance. Required IAM Permission: ec2:DetachVolume." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: volume_id description: The ID of the volume. required: true - name: force description: Forces detachment if the previous detachment attempt did not occur cleanly. This option can lead to data loss or a corrupted file system. Use this option only as a last resort to detach a volume from a failed instance. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: device description: The device name (for example, /dev/sdh or xvdh). required: false - name: instance_id description: The ID of the instance. If you are detaching a Multi-Attach enabled volume, you must specify an instance ID. required: false outputs: - contextPath: AWS.EC2.Volumes.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.AttachTime description: The timestamp when the attachment was initiated. type: date - contextPath: AWS.EC2.Volumes.Attachments.Device description: The device name. type: string - contextPath: AWS.EC2.Volumes.Attachments.InstanceId description: The ID of the instance. type: string - contextPath: AWS.EC2.Volumes.Attachments.State description: The attachment state of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.VolumeId description: The ID of the volume. type: string - contextPath: AWS.EC2.Volumes.Attachments.DeleteOnTermination description: Indicates whether the EBS volume is deleted on instance termination. type: boolean - contextPath: AWS.EC2.Volumes.Attachments.AssociatedResource description: The ARN of the Amazon ECS or Fargate task to which the volume is attached. type: string - contextPath: AWS.EC2.Volumes.Attachments.InstanceOwningService description: The AWS service principal that owns the instance to which the volume is attached. type: string - name: aws-ec2-volume-delete description: "Deletes the specified EBS volume. The volume must be in the available state (not attached to an instance). Required IAM Permission: ec2:DeleteVolume." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: volume_id description: The ID of the volume. required: true outputs: [ ] - name: aws-ec2-launch-templates-describe description: "Describes one or more launch templates. Required IAM Permission: ec2:DescribeLaunchTemplates." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options. required: false - name: launch_template_ids description: A comma-separated list of launch template IDs. required: false isArray: true - name: launch_template_names description: A comma-separated list of launch template names. required: false isArray: true - name: limit description: The maximum number of results to return in a single call. Maximum value of 200. required: false - name: next_token description: The token for the next set of results. required: false outputs: - contextPath: AWS.EC2.LaunchTemplatesNextToken description: Token to use for pagination in subsequent requests. type: String - contextPath: AWS.EC2.LaunchTemplates.LaunchTemplateId description: The ID of the launch template. type: string - contextPath: AWS.EC2.LaunchTemplates.LaunchTemplateName description: The name of the launch template. type: string - contextPath: AWS.EC2.LaunchTemplates.CreateTime description: The time launch template was created. type: date - contextPath: AWS.EC2.LaunchTemplates.CreatedBy description: The principal that created the launch template. type: string - contextPath: AWS.EC2.LaunchTemplates.DefaultVersionNumber description: The default version number of the launch template. type: number - contextPath: AWS.EC2.LaunchTemplates.LatestVersionNumber description: The latest version number of the launch template. type: number - contextPath: AWS.EC2.LaunchTemplates.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.LaunchTemplates.Tags.Value description: The value of the tag. type: string - name: aws-ec2-launch-template-create description: "Creates a launch template. A launch template contains the parameters to launch an instance. Required IAM Permission: ec2:CreateLaunchTemplate." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: launch_template_name description: A name for the launch template. required: true - name: version_description description: A description for the first version of the launch template. required: false - name: kernel_id description: The ID of the kernel. required: false - name: ebs_optimized description: Whether the instance is optimized for Amazon EBS I/O. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: iam_instance_profile_arn description: The Amazon Resource Name (ARN) of the instance profile. required: false - name: iam_instance_profile_name description: The name of the instance profile. required: false - name: image_id description: The ID of the AMI. required: false - name: instance_type description: The instance type. required: false - name: key_name description: The name of the key pair. required: false - name: monitoring description: Set to true to enable detailed monitoring. Set to false to enable basic monitoring. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: disable_api_termination description: If set to true, you can't terminate the instance using the Amazon EC2 console, CLI, or API. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: instance_initiated_shutdown_behavior description: Whether an instance stops or terminates when you initiate shutdown from the instance. required: false auto: PREDEFINED predefined: - stop - terminate - name: user_data description: The Base64-encoded user data to make available to the instance. required: false - name: security_group_ids description: A comma-separated list of security group IDs. required: false isArray: true - name: security_groups description: A comma-separated list of security group names. required: false isArray: true - name: device_name description: The device name (for example, /dev/sdh or xvdh). required: false - name: ebs_encrypted description: Indicates whether the EBS volume is encrypted. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: ebs_delete_on_termination description: Indicates whether the EBS volume is deleted on instance termination. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: ebs_iops description: The number of I/O operations per second (IOPS) that the volume supports. required: false - name: ebs_kms_key_id description: The ARN of the AWS Key Management Service (AWS KMS) CMK used for encryption. required: false - name: ebs_snapshot_id description: The ID of the snapshot. required: false - name: ebs_volume_size description: The size of the volume, in GiB. required: false - name: ebs_volume_type description: The volume type. required: false auto: PREDEFINED predefined: - standard - io1 - io2 - gp2 - gp3 - sc1 - st1 - name: ebs_card_index description: The index of the EBS card. Some instance types support multiple EBS cards. The default EBS card index is 0. required: false - name: ebs_throughput description: The throughput to provision for a gp3 volume, with a maximum of 2,000 MiB/s. The minimum value of 125, and maximum value of 2,000. required: false - name: ebs_initialization_rate description: Specifies the Amazon EBS Provisioned Rate for Volume Initialization (volume initialization rate), in MiB/s, at which to download the snapshot blocks from Amazon S3 to the volume. required: false - name: block_device_mappings_no_device description: To omit the device from the block device mapping, specify an empty string. required: false - name: block_device_mappings_virtual_name description: The virtual device name (ephemeralN). required: false - name: network_interfaces_associate_public_ip_address description: Associates a public IPv4 address with eth0 for a new network interface. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: network_interfaces_delete_on_termination description: Whether the network interface is deleted when the instance is terminated. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: network_interfaces_description description: A description for the network interface. required: false - name: network_interfaces_device_index description: The device index for the network interface attachment. required: false - name: network_interface_groups description: A comma-separated list of security group IDs. required: false isArray: true - name: subnet_id description: The ID of the subnet for the network interface. required: false - name: private_ip_address description: The primary private IPv4 address of the network interface. required: false - name: ipv6_address_count description: The number of IPv6 addresses to assign to a network interface. required: false - name: ipv6_addresses description: One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. required: false - name: network_interface_id description: The ID of the network interface. required: false - name: availability_zone description: The Availability Zone for the instance. required: false - name: placement_tenancy description: The tenancy of the instance. required: false auto: PREDEFINED predefined: - default - dedicated - host - name: ram_disk_id description: The ID of the RAM disk. required: false - name: tags description: "The tags to assign to the Elastic IP address. Format: key=,value=;key=,value=." required: false - name: market_type description: The market type. required: false auto: PREDEFINED predefined: - spot - capacity-block - interruptible-capacity-reservation - name: spot_options_instance_type description: The Spot Instance request type. required: false auto: PREDEFINED predefined: - one-time - persistent - name: spot_options_max_price description: The maximum hourly price you're willing to pay for the Spot Instances. required: false - name: spot_options_instance_interruption_behavior description: The behavior when a Spot Instance is interrupted. required: false auto: PREDEFINED predefined: - hibernate - stop - terminate outputs: - contextPath: AWS.EC2.LaunchTemplates.LaunchTemplateId description: The ID of the launch template. type: string - contextPath: AWS.EC2.LaunchTemplates.LaunchTemplateName description: The name of the launch template. type: string - contextPath: AWS.EC2.LaunchTemplates.CreateTime description: The time launch template was created. type: date - contextPath: AWS.EC2.LaunchTemplates.CreatedBy description: The principal that created the launch template. type: string - contextPath: AWS.EC2.LaunchTemplates.DefaultVersionNumber description: The default version number of the launch template. type: number - contextPath: AWS.EC2.LaunchTemplates.LatestVersionNumber description: The latest version number of the launch template. type: number - contextPath: AWS.EC2.LaunchTemplates.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.LaunchTemplates.Tags.Value description: The value of the tag. type: string - name: aws-ec2-launch-template-delete description: "Deletes a launch template. Deleting a launch template deletes all of its versions. Required IAM Permission: ec2:DeleteLaunchTemplate." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: launch_template_id description: The ID of the launch template. You must specify either the launch template ID or launch template name, but not both. required: false - name: launch_template_name description: The name of the launch template. You must specify either the launch template ID or launch template name, but not both. required: false outputs: - contextPath: AWS.EC2.DeletedLaunchTemplates.LaunchTemplateId description: The ID of the launch template. type: string - contextPath: AWS.EC2.DeletedLaunchTemplates.LaunchTemplateName description: The name of the launch template. type: string - contextPath: AWS.EC2.DeletedLaunchTemplates.CreateTime description: The time launch template was created. type: date - contextPath: AWS.EC2.DeletedLaunchTemplates.CreatedBy description: The principal that created the launch template. type: string - contextPath: AWS.EC2.DeletedLaunchTemplates.DefaultVersionNumber description: The default version number of the launch template. type: number - contextPath: AWS.EC2.DeletedLaunchTemplates.LatestVersionNumber description: The latest version number of the launch template. type: number - contextPath: AWS.EC2.DeletedLaunchTemplates.Operator description: The entity that manages the launch template. type: Object - contextPath: AWS.EC2.DeletedLaunchTemplates.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.DeletedLaunchTemplates.Tags.Value description: The value of the tag. type: string - name: aws-ec2-fleet-create description: "Launches an EC2 Fleet. Required IAM Permission: ec2:CreateFleet." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: spot_allocation_strategy description: Indicates how to allocate the target capacity across the Spot pools specified by the Spot Fleet request. required: false auto: PREDEFINED predefined: - lowest-price - diversified - capacity-optimized - capacity-optimized-prioritized - price-capacity-optimized - name: instance_interruption_behavior description: The behavior when a Spot Instance is interrupted. required: false auto: PREDEFINED predefined: - hibernate - stop - terminate - name: instance_pools_to_use_count description: The number of Spot pools across which to allocate your target Spot capacity. required: false - name: max_total_price description: The maximum amount per hour for Spot Instances that you are willing to pay. required: false - name: capacity_rebalance_replacement_strategy description: The replacement strategy to use. Only available for fleets of type maintain. required: false auto: PREDEFINED predefined: - launch - launch-before-terminate - name: capacity_rebalance_termination_delay description: The amount of time (in seconds) that Amazon EC2 waits before terminating the old Spot Instance after launching a new replacement Spot Instance. required: false - name: spot_single_instance_type description: Indicates that the fleet uses a single instance type to launch all Spot Instances in the fleet. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: single_availability_zone description: Indicates that the fleet launches all Spot Instances into a single Availability Zone. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: min_target_capacity description: The minimum target capacity for Spot Instances in the fleet. If the minimum target capacity is not reached, the fleet launches no instances. required: false - name: on_demand_allocation_strategy description: The launch template override order to use to fulfill on-demand capacity. required: false auto: PREDEFINED predefined: - lowest-price - prioritized - name: on_demand_single_instance_type description: Whether the fleet uses a single instance type to launch all on-demand instances in the fleet. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: on_demand_single_availability_zone description: Whether the fleet launches all on-demand instances into a single Availability Zone. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: on_demand_min_target_capacity description: The minimum target capacity for on-demand instances in the fleet. If the minimum target capacity is not reached, the fleet launches no instances. required: false - name: on_demand_max_total_price description: The maximum amount per hour you are willing to pay for on-demand instances. required: false - name: capacity_reservation_strategy description: Whether to use unused capacity reservations to fulfill on-demand capacity. required: false auto: PREDEFINED predefined: - use-capacity-reservations-first - name: excess_capacity_termination_policy description: Whether running instances should be terminated if the total target capacity of the EC2 Fleet is decreased below the current size of the EC2 Fleet. required: false auto: PREDEFINED predefined: - no-termination - termination - name: launch_template_id description: The ID of the launch template. required: false - name: launch_template_name description: The name of the launch template. required: false - name: launch_template_version description: The version number of the launch template. required: false defaultValue: "1" - name: availability_zone description: The Availability Zone in which to launch the instances. required: false - name: availability_zone_id description: The ID of the Availability Zone in which to launch the instances. required: false - name: image_id description: The ID of the AMI. required: false - name: instance_type description: The instance type. required: false - name: max_price description: The maximum price per unit hour that you are willing to pay for a Spot Instance. required: false - name: placement_group_id description: The ID of the placement group. required: false - name: placement_group_name description: The name of the placement group. required: false - name: priority description: The priority for the launch template override. The highest priority is launched first. required: false - name: subnet_id description: The ID of the subnet in which to launch the instances. required: false - name: weighted_capacity description: The number of units provided by the specified instance type. required: false - name: device_name description: "The device name (for example, /dev/sdh or xvdh)." required: false - name: ebs_encrypted description: "Whether the encryption state of an EBS volume is changed when restored from a backup snapshot." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: ebs_delete_on_termination description: "Whether the EBS volume is deleted on instance termination." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: ebs_iops description: "The number of I/O operations per second (IOPS)." required: false - name: ebs_kms_key_id description: "Identifier for a user-managed CMK under which the EBS volume is encrypted." required: false - name: ebs_snapshot_id description: "The ID of the snapshot." required: false - name: ebs_volume_size description: "The size of the volume, in GiBs." required: false - name: ebs_volume_type description: "The volume type." required: false auto: PREDEFINED predefined: - gp2 - gp3 - io1 - io2 - st1 - sc1 - standard - name: ebs_throughput description: "The throughput for the volume, in MiB/s. This parameter is valid only for gp3 volumes." required: false - name: block_device_mappings_no_device description: "Suppresses the specified device included in the block device mapping of the AMI." required: false - name: block_device_mappings_virtual_name description: "The virtual device name (ephemeralN)." required: false - name: total_target_capacity description: The number of units to request. required: true - name: on_demand_target_capacity description: The number of on-demand units to request. required: false - name: spot_target_capacity description: The number of Spot units to request. required: false - name: default_target_capacity_type description: The default TotalTargetCapacity, which is either Spot or on-demand. required: true auto: PREDEFINED predefined: - spot - on-demand - capacity-block - name: target_capacity_unit description: The unit for the target capacity. required: false auto: PREDEFINED predefined: - vcpu - memory-mib - units - name: terminate_instances_with_expiration description: Whether running instances should be terminated when the EC2 Fleet expires. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: type description: The request type. required: false auto: PREDEFINED predefined: - request - maintain - instant - name: valid_from description: The start date and time of the request, in UTC format (YYYY-MM-DDTHH:MM:SSZ). For example, 2024-01-15T10:30:00Z. required: false - name: valid_until description: The end date and time of the request, in UTC format (YYYY-MM-DDTHH:MM:SSZ). For example, 2024-01-15T10:30:00Z. required: false - name: replace_unhealthy_instances description: Whether the EC2 Fleet should replace unhealthy instances. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: tags description: "The tags to apply to the resource. Format: key=,value=;key=,value=." required: false outputs: - contextPath: AWS.EC2.Fleets.FleetId description: The ID of the EC2 Fleet. type: string - contextPath: AWS.EC2.Fleets.Errors.LaunchTemplateAndOverrides description: Information about the instances that could not be launched by the fleet. type: string - contextPath: AWS.EC2.Fleets.Instances.LaunchTemplateAndOverrides description: The launch templates and overrides that were used for launching the instances. The values that you specify in the Overrides replace the values in of the launch template. type: string - name: aws-ec2-fleet-delete description: "Deletes the specified EC2 Fleet. Required IAM Permission: ec2:DeleteFleets." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: fleet_ids description: A comma-separated list of EC2 Fleet IDs. required: true isArray: true - name: terminate_instances description: Whether to terminate instances for an EC2 Fleet if it is deleted successfully. required: true auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.EC2.DeletedFleets.SuccessfulFleetDeletions.CurrentFleetState description: The current state of the EC2 Fleet. type: string - contextPath: AWS.EC2.DeletedFleets.SuccessfulFleetDeletions.PreviousFleetState description: The previous state of the EC2 Fleet. type: string - contextPath: AWS.EC2.DeletedFleets.SuccessfulFleetDeletions.FleetId description: The ID of the EC2 Fleet. type: string - contextPath: AWS.EC2.DeletedFleets.UnsuccessfulFleetDeletions.Error description: Information about the EC2 Fleets that are not successfully deleted. type: string - contextPath: AWS.EC2.DeletedFleets.UnsuccessfulFleetDeletions.FleetId description: The ID of the EC2 Fleet. type: string - name: aws-ec2-fleets-describe description: "Describes one or more of your EC2 Fleets. Required IAM Permission: ec2:DescribeFleets." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options." required: false - name: fleet_ids description: A comma-separated list of EC2 Fleet IDs. required: false isArray: true - name: limit description: The maximum number of results to return in a single call. Specify a value between 1 and 1000. required: false - name: next_token description: The token for the next set of results. required: false outputs: - contextPath: AWS.EC2.FleetsNextToken description: The token for the next set of results. type: string - contextPath: AWS.EC2.Fleets.ActivityStatus description: The progress of the EC2 Fleet. If there is an error, the status is error. type: string - contextPath: AWS.EC2.Fleets.CreateTime description: The creation date and time of the EC2 Fleet. type: date - contextPath: AWS.EC2.Fleets.FleetId description: The ID of the EC2 Fleet. type: string - contextPath: AWS.EC2.Fleets.FleetState description: The state of the EC2 Fleet. type: string - contextPath: AWS.EC2.Fleets.ExcessCapacityTerminationPolicy description: Whether running instances should be terminated if the target capacity of the EC2 Fleet is decreased below the current size of the EC2 Fleet. type: string - contextPath: AWS.EC2.Fleets.FulfilledCapacity description: The number of units fulfilled by this request compared to the set target capacity. type: number - contextPath: AWS.EC2.Fleets.FulfilledOnDemandCapacity description: The number of units fulfilled by this request compared to the set target On-Demand capacity. type: number - contextPath: AWS.EC2.Fleets.LaunchTemplateConfigs.LaunchTemplateSpecification description: Describes a launch template and overrides. type: string - contextPath: AWS.EC2.Fleets.TargetCapacitySpecification.TotalTargetCapacity description: The number of units to request, filled using DefaultTargetCapacityType. type: number - contextPath: AWS.EC2.Fleets.TargetCapacitySpecification.OnDemandTargetCapacity description: The number of On-Demand units to request. type: number - contextPath: AWS.EC2.Fleets.TargetCapacitySpecification.SpotTargetCapacity description: The maximum number of Spot units to launch. type: number - contextPath: AWS.EC2.Fleets.TargetCapacitySpecification.DefaultTargetCapacityType description: The default TotalTargetCapacity, which is either Spot or On-Demand. type: string - contextPath: AWS.EC2.Fleets.TerminateInstancesWithExpiration description: Whether running instances should be terminated when the EC2 Fleet expires. type: boolean - contextPath: AWS.EC2.Fleets.Type description: The type of request. Indicates whether the EC2 Fleet only requests the target capacity, or also attempts to maintain it. type: string - contextPath: AWS.EC2.Fleets.ValidFrom description: The start date and time of the request, in UTC format. type: date - contextPath: AWS.EC2.Fleets.ValidUntil description: The end date and time of the request, in UTC format. type: date - contextPath: AWS.EC2.Fleets.ReplaceUnhealthyInstances description: Whether EC2 Fleet should replace unhealthy instances. type: boolean - contextPath: AWS.EC2.Fleets.SpotOptions.AllocationStrategy description: Indicates how to allocate the target capacity across the Spot pools specified by the Spot Fleet request. type: string - contextPath: AWS.EC2.Fleets.SpotOptions.InstanceInterruptionBehavior description: The behavior when a Spot Instance is interrupted. The default is terminate. type: string - contextPath: AWS.EC2.Fleets.SpotOptions.InstancePoolsToUseCount description: The number of Spot pools across which to allocate your target Spot capacity. type: number - contextPath: AWS.EC2.Fleets.SpotOptions.SingleInstanceType description: Whether the fleet uses a single instance type to launch all Spot Instances in the fleet. type: boolean - contextPath: AWS.EC2.Fleets.SpotOptions.SingleAvailabilityZone description: Whether the fleet launches all Spot Instances into a single Availability Zone. type: boolean - contextPath: AWS.EC2.Fleets.SpotOptions.MinTargetCapacity description: The minimum target capacity for Spot Instances in the fleet. type: number - contextPath: AWS.EC2.Fleets.OnDemandOptions.AllocationStrategy description: The order of the launch template overrides to use in fulfilling On-Demand capacity. type: string - contextPath: AWS.EC2.Fleets.OnDemandOptions.SingleInstanceType description: Whether the fleet uses a single instance type to launch all on-demand instances in the fleet. type: boolean - contextPath: AWS.EC2.Fleets.OnDemandOptions.SingleAvailabilityZone description: Whether the fleet launches all on-demand instances into a single Availability Zone. type: boolean - contextPath: AWS.EC2.Fleets.OnDemandOptions.MinTargetCapacity description: The minimum target capacity for on-demand instances in the fleet. type: number - contextPath: AWS.EC2.Fleets.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.Fleets.Tags.Value description: The value of the tag. type: string - name: aws-ec2-fleet-instances-describe description: "Describes the running instances for the specified EC2 Fleet. Required IAM Permission: ec2:DescribeFleetInstances." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options." required: false - name: fleet_id description: The ID of the EC2 Fleet. required: true - name: limit description: The maximum number of results to return in a single call. Specify a value between 1 and 1000. required: false - name: next_token description: The token for the next set of results. required: false outputs: - contextPath: AWS.EC2.Fleets.ActiveInstances.InstanceId description: The ID of the instance. type: string - contextPath: AWS.EC2.Fleets.ActiveInstances.InstanceType description: The instance type. type: string - contextPath: AWS.EC2.Fleets.ActiveInstances.SpotInstanceRequestId description: The ID of the Spot Instance request. type: string - contextPath: AWS.EC2.Fleets.ActiveInstances.InstanceHealth description: The health status of the instance. type: string - contextPath: AWS.EC2.Fleets.FleetInstancesNextToken description: The token for the next set of results. type: string - contextPath: AWS.EC2.Fleets.FleetId description: The ID of the EC2 Fleet. type: string - name: aws-ec2-fleet-modify description: "Modifies the specified EC2 Fleet. Required IAM Permission: ec2:ModifyFleet." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: fleet_id description: The ID of the EC2 Fleet. required: true - name: excess_capacity_termination_policy description: Whether running instances should be terminated if the total target capacity of the EC2 Fleet is decreased below the current size of the EC2 Fleet. required: false auto: PREDEFINED predefined: - no-termination - termination - name: launch_template_id description: The ID of the launch template. required: false - name: launch_template_name description: The name of the launch template. required: false - name: launch_template_version description: The version number of the launch template. required: false defaultValue: "1" - name: availability_zone description: The Availability Zone in which to launch the instances. required: false - name: availability_zone_id description: The ID of the Availability Zone in which to launch the instances. required: false - name: image_id description: The ID of the AMI. required: false - name: instance_type description: The instance type. required: false - name: max_price description: The maximum price per unit hour that you are willing to pay for a Spot Instance. required: false - name: placement_group_id description: The ID of the placement group. required: false - name: placement_group_name description: The name of the placement group. required: false - name: priority description: The priority for the launch template override. required: false - name: subnet_id description: The ID of the subnet in which to launch the instances. required: false - name: weighted_capacity description: The number of units provided by the specified instance type. required: false - name: device_name description: "The device name (for example, /dev/sdh or xvdh)." required: false - name: ebs_encrypted description: "Whether the encryption state of an EBS volume is changed when restored from a backup snapshot." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: ebs_delete_on_termination description: "Whether the EBS volume is deleted on instance termination." required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: ebs_iops description: "The number of I/O operations per second (IOPS). For gp3, io1, and io2 volumes, this represents the number of IOPS that are provisioned for the volume. For gp2 volumes, this represents the baseline performance of the volume and the rate at which the volume accumulates I/O credits for bursting. This parameter is required for io1 and io2 volumes. The default for gp3 volumes is 3,000 IOPS." required: false - name: ebs_kms_key_id description: "Identifier (key ID, key alias, ID ARN, or alias ARN) for a user-managed CMK under which the EBS volume is encrypted." required: false - name: ebs_snapshot_id description: "The ID of the snapshot." required: false - name: ebs_volume_size description: "The size of the volume, in GiBs. You must specify either an ebs_snapshot_id or an ebs_volume_size. If you specify a snapshot, the default is the snapshot size. You can specify a volume size that is equal to or larger than the snapshot size." required: false - name: ebs_volume_type description: "The volume type." required: false auto: PREDEFINED predefined: - gp2 - gp3 - io1 - io2 - st1 - sc1 - standard - name: ebs_throughput description: "The throughput for the volume, in MiB/s. This parameter is valid only for gp3 volumes." required: false - name: block_device_mappings_no_device description: "Suppresses the specified device included in the block device mapping of the AMI." required: false - name: block_device_mappings_virtual_name description: "The virtual device name (ephemeralN)." required: false - name: total_target_capacity description: The number of units to request, filled using DefaultTargetCapacityType. required: true - name: on_demand_target_capacity description: The number of On-Demand units to request. required: false - name: spot_target_capacity description: The number of Spot units to request. required: false - name: default_target_capacity_type description: The default TotalTargetCapacityType, which is either Spot or On-Demand. required: false auto: PREDEFINED predefined: - spot - on-demand - capacity-block - name: target_capacity_unit description: The unit for the target capacity. required: false auto: PREDEFINED predefined: - vcpu - memory-mib - units - name: aws-ec2-key-pairs-describe description: "Describes the specified key pairs or all of your key pairs. Required IAM Permission: ec2:DescribeKeyPairs." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: key_pair_ids description: A comma-separated list of key pair IDs. required: false isArray: true - name: key_names description: A comma-separated list of key pair names. required: false isArray: true - name: filters description: "One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for details & filter options." required: false - name: include_public_key description: If true, the public key material is included in the response. required: false auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.EC2.KeyPairs.KeyPairId description: The ID of the key pair. type: string - contextPath: AWS.EC2.KeyPairs.KeyName description: The name of the key pair. type: string - contextPath: AWS.EC2.KeyPairs.KeyType description: The type of key pair (rsa or ed25519). type: string - contextPath: AWS.EC2.KeyPairs.KeyFingerprint description: The SHA-1 digest of the DER encoded private key (CreateKeyPair) or MD5 public key fingerprint (ImportKeyPair). type: string - contextPath: AWS.EC2.KeyPairs.PublicKey description: The public key material. Present only when include_public_key=true. type: string - contextPath: AWS.EC2.KeyPairs.CreateTime description: The date and time the key pair was created. type: date - contextPath: AWS.EC2.KeyPairs.Tags description: Any tags applied to the key pair. type: array - name: aws-ec2-hosts-allocate description: "Allocates Dedicated Hosts to your account. Requires the instance type or family, the Availability Zone, and the quantity of hosts to allocate. Required IAM Permission: ec2:AllocateHosts." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: availability_zone description: The Availability Zone in which to allocate the Dedicated Host. required: true - name: availability_zone_id description: The ID of the Availability Zone. required: false - name: quantity description: The number of Dedicated Hosts with these parameters to allocate to your account. required: true - name: instance_type description: Specifies the instance type to be supported by the Dedicated Hosts. You cannot specify instance_type and instance_family in the same request. required: false - name: instance_family description: Specifies the instance family to be supported by the Dedicated Hosts. You cannot specify instance_type and instance_family in the same request. required: false - name: auto_placement description: Whether the host accepts untargeted instance launches matching its configuration or only accepts instance launches specifying its unique host ID. required: false auto: PREDEFINED predefined: - 'on' - 'off' - name: host_recovery description: Whether to enable or disable host recovery for the Dedicated Host. Host recovery is disabled by default. required: false auto: PREDEFINED predefined: - 'on' - 'off' - name: host_maintenance description: Whether to enable or disable host maintenance for the Dedicated Host. required: false auto: PREDEFINED predefined: - 'on' - 'off' - name: outpost_arn description: The Amazon Resource Name (ARN) of the Amazon Web Services Outpost on which to allocate the Dedicated Host. required: false - name: asset_ids description: A comma-separated list of IDs of the Outpost hardware assets on which to allocate the Dedicated Hosts. required: false isArray: true - name: tags description: "The tags to apply to the Dedicated Host during creation. Format: key=,value=;key=,value=." - name: client_token description: Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. required: false outputs: - contextPath: AWS.EC2.Hosts.HostIds description: The IDs of the allocated Dedicated Hosts. type: array - name: aws-ec2-hosts-release description: "Releases the specified Dedicated Hosts. Required IAM Permission: ec2:ReleaseHosts." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: host_ids description: A comma-separated list of IDs of the Dedicated Hosts to release. required: true isArray: true outputs: - contextPath: AWS.EC2.ReleasedHosts.Successful description: The IDs of the Dedicated Hosts that were successfully released. type: array - contextPath: AWS.EC2.ReleasedHosts.Unsuccessful description: The IDs of the Dedicated Hosts that could not be released, including an error message. type: array - name: aws-ec2-traffic-mirror-session-create description: "Creates a Traffic Mirror session. A Traffic Mirror session actively copies packets from a Traffic Mirror source to a Traffic Mirror target. Required IAM Permission: ec2:CreateTrafficMirrorSession." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: network_interface_id description: The ID of the source network interface. required: true - name: traffic_mirror_target_id description: The ID of the Traffic Mirror target. required: true - name: traffic_mirror_filter_id description: The ID of the Traffic Mirror filter. required: true - name: session_number description: The order in which sessions are evaluated when an interface is used by multiple sessions. Possible values are 1-32766. required: true - name: virtual_network_id description: The VXLAN ID for the Traffic Mirror session. If you do not specify a virtual_network_id, an account-wide unique ID is chosen at random. required: false - name: packet_length description: The number of bytes in each packet to mirror. These are bytes after the VXLAN header. Do not specify this parameter when you want to mirror the entire packet. required: false - name: description description: The description of the Traffic Mirror session. required: false - name: tags description: "The tags to assign to a Traffic Mirror session. Format: key=,value=;key=,value=." required: false - name: client_token description: Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. required: false outputs: - contextPath: AWS.EC2.TrafficMirrorSessions.TrafficMirrorSessionId description: The ID of the Traffic Mirror session. type: string - contextPath: AWS.EC2.TrafficMirrorSessions.TrafficMirrorTargetId description: The ID of the Traffic Mirror target. type: string - contextPath: AWS.EC2.TrafficMirrorSessions.TrafficMirrorFilterId description: The ID of the Traffic Mirror filter. type: string - contextPath: AWS.EC2.TrafficMirrorSessions.NetworkInterfaceId description: The ID of the Traffic Mirror session's network interface. type: string - contextPath: AWS.EC2.TrafficMirrorSessions.OwnerId description: The ID of the account that owns the Traffic Mirror session. type: string - contextPath: AWS.EC2.TrafficMirrorSessions.PacketLength description: The number of bytes in each packet to mirror. type: number - contextPath: AWS.EC2.TrafficMirrorSessions.SessionNumber description: The order in which sessions are evaluated when an interface is used by multiple sessions. type: number - contextPath: AWS.EC2.TrafficMirrorSessions.VirtualNetworkId description: The virtual network ID associated with the Traffic Mirror session. type: number - contextPath: AWS.EC2.TrafficMirrorSessions.Description description: The description of the Traffic Mirror session. type: string - contextPath: AWS.EC2.TrafficMirrorSessions.Tags description: The tags assigned to the Traffic Mirror session. type: array - name: aws-ec2-vpc-delete description: "Deletes a specified VPC. You must detach or delete all gateways and resources that are associated with the VPC before you can delete it. Required IAM Permission: ec2:DeleteVpc." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: vpc_id description: The ID of the VPC. required: true - name: aws-ec2-vpc-endpoint-create description: "Creates a VPC endpoint for a specified service. An endpoint enables you to create a private connection between your VPC and the service. Required IAM Permission: ec2:CreateVpcEndpoint." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: vpc_id description: The VPC ID where the endpoint is created. required: true - name: service_name description: "The service name. For AWS services, the service name is usually in the form com.amazonaws..." required: true - name: service_network_arn description: The service network Amazon Resource Name (ARN) to associate with the service-network VPC endpoint. - name: service_region description: The region where the service is hosted. Default is the current region. - name: vpc_endpoint_type description: The type of endpoint. required: false auto: PREDEFINED predefined: - Interface - Gateway - GatewayLoadBalancer - Resource - ServiceNetwork - name: policy_document description: A policy to attach to the endpoint that controls access to the service. The policy must be in valid JSON format. required: false - name: route_table_ids description: A comma-separated list of route table IDs. Applicable for Gateway endpoints only. required: false isArray: true - name: subnet_ids description: A comma-separated list of subnet IDs for an endpoint network interface. Applicable for Interface and GatewayLoadBalancer endpoints only. required: false isArray: true - name: security_group_ids description: A comma-separated list of security group IDs to associate with the endpoint network interface. Applicable for Interface and GatewayLoadBalancer endpoints only. required: false isArray: true - name: ip_address_type description: The IP address type for the endpoint. required: false auto: PREDEFINED predefined: - ipv4 - dualstack - ipv6 - name: dns_options_dns_record_ip_type description: The DNS records created for the endpoint. required: false auto: PREDEFINED predefined: - ipv4 - dualstack - ipv6 - service-defined - name: dns_options_private_dns_only_for_inbound_resolver_endpoint description: Whether to enable private DNS only for inbound endpoints. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: dns_options_private_dns_preference description: The preference for creating and associating private hosted zones with a specified VPC. required: false - name: dns_options_private_dns_specified_domains description: The private domains used for creating and associating private hosted zones with the VPC. required: false - name: subnet_configuration_ipv4 description: The IPv4 address to assign to the endpoint network interface in the subnet. required: false - name: subnet_configuration_ipv6 description: The IPv6 address to assign to the endpoint network interface in the subnet. required: false - name: subnet_configuration_subnet_id description: The ID of the subnet. required: false - name: private_dns_enabled description: Whether to associate a private hosted zone with the specified VPC. Applicable for Interface endpoints only. required: false auto: PREDEFINED predefined: - 'true' - 'false' - name: resource_configuration_arn description: The Amazon Resource Name (ARN) of a resource configuration that is associated with the VPC resource type endpoint. required: false - name: tags description: "The tags to apply to the VPC endpoint. Format key=,value=;key=,value=." required: false - name: client_token description: Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. required: false outputs: - contextPath: AWS.EC2.VpcEndpoints.VpcEndpointId description: The ID of the VPC endpoint. type: string - contextPath: AWS.EC2.VpcEndpoints.VpcEndpointType description: The type of endpoint. type: string - contextPath: AWS.EC2.VpcEndpoints.VpcId description: The ID of the VPC associated with the endpoint. type: string - contextPath: AWS.EC2.VpcEndpoints.ServiceName description: The name of the service associated with the endpoint. type: string - contextPath: AWS.EC2.VpcEndpoints.ServiceNetworkArn description: The Amazon Resource Name (ARN) of the service network. type: string - contextPath: AWS.EC2.VpcEndpoints.ServiceRegion description: The Region where the service is hosted. type: string - contextPath: AWS.EC2.VpcEndpoints.State description: The state of the VPC endpoint. type: string - contextPath: AWS.EC2.VpcEndpoints.PolicyDocument description: The policy document associated with the endpoint, if applicable. type: string - contextPath: AWS.EC2.VpcEndpoints.RouteTableIds description: One or more route tables associated with the endpoint. type: array - contextPath: AWS.EC2.VpcEndpoints.SubnetIds description: One or more subnets in which the endpoint is located. type: array - contextPath: AWS.EC2.VpcEndpoints.Groups.GroupId description: The ID of the security group. type: string - contextPath: AWS.EC2.VpcEndpoints.Groups.GroupName description: The name of the security group. type: string - contextPath: AWS.EC2.VpcEndpoints.IpAddressType description: The IP address type for the endpoint. type: string - contextPath: AWS.EC2.VpcEndpoints.DnsOptions.DnsRecordIpType description: The DNS records created for the endpoint. type: string - contextPath: AWS.EC2.VpcEndpoints.DnsOptions.PrivateDnsOnlyForInboundResolverEndpoint description: Whether to enable private DNS only for inbound endpoints. type: boolean - contextPath: AWS.EC2.VpcEndpoints.DnsOptions.PrivateDnsPreference description: The preference for which private domains have a private hosted zone created for and associated with the specified VPC. type: string - contextPath: AWS.EC2.VpcEndpoints.DnsOptions.PrivateDnsSpecifiedDomainSet description: Indicates which of the private domains to create private hosted zones for and associate with the specified VPC. type: array - contextPath: AWS.EC2.VpcEndpoints.PrivateDnsEnabled description: Whether the VPC is associated with a private hosted zone. type: boolean - contextPath: AWS.EC2.VpcEndpoints.RequesterManaged description: Whether the VPC endpoint is being managed by its service. type: boolean - contextPath: AWS.EC2.VpcEndpoints.NetworkInterfaceIds description: One or more network interfaces for the endpoint. type: array - contextPath: AWS.EC2.VpcEndpoints.DnsEntries.DnsName description: The DNS name. type: string - contextPath: AWS.EC2.VpcEndpoints.DnsEntries.HostedZoneId description: The ID of the private hosted zone. type: string - contextPath: AWS.EC2.VpcEndpoints.CreationTimestamp description: The date and time that the VPC endpoint was created. type: date - contextPath: AWS.EC2.VpcEndpoints.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.VpcEndpoints.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.VpcEndpoints.OwnerId description: The ID of the AWS account that owns the VPC endpoint. type: string - contextPath: AWS.EC2.VpcEndpoints.LastError.Message description: The VCP endpoint error message. type: string - contextPath: AWS.EC2.VpcEndpoints.LastError.Code description: The VCP endpoint error code. type: string - contextPath: AWS.EC2.VpcEndpoints.FailureReason description: Reason for the failure. type: string - contextPath: AWS.EC2.VpcEndpoints.Ipv4Prefixes.IpPrefixes description: Array of IPv4 prefixes. type: array - contextPath: AWS.EC2.VpcEndpoints.Ipv4Prefixes.SubnetId description: ID of the subnet. type: array - contextPath: AWS.EC2.VpcEndpoints.Ipv6Prefixes.IpPrefixes description: Array of IPv6 prefixes. type: array - contextPath: AWS.EC2.VpcEndpoints.Ipv6Prefixes.SubnetId description: ID of the subnet. type: array - contextPath: AWS.EC2.VpcEndpoints.ResourceConfigurationArn description: The Amazon Resource Name (ARN) of the resource configuration. type: array - name: aws-ec2-internet-gateway-describe description: "A description of one or more of your internet gateways. Required IAM Permission: ec2:DescribeInternetGateways." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' (for example, name=,values=;name=,values=). See AWS documentation for filter details and options." required: false - name: internet_gateway_ids description: A comma-separated list of internet gateway IDs. required: false isArray: true - name: limit description: The maximum number of results to return with a single call. Specify a value between 5 and 1000. required: false - name: next_token description: The token for the next page of results. required: false outputs: - contextPath: AWS.EC2.InternetGateways.InternetGatewayId description: The ID of the internet gateway. type: string - contextPath: AWS.EC2.InternetGateways.Attachments.State description: The current state of the attachment. type: string - contextPath: AWS.EC2.InternetGateways.Attachments.VpcId description: The ID of the VPC. type: string - contextPath: AWS.EC2.InternetGateways.Tags.Key description: The key of the tag. type: string - contextPath: AWS.EC2.InternetGateways.Tags.Value description: The value of the tag. type: string - contextPath: AWS.EC2.InternetGateways.OwnerId description: The ID of the AWS account that owns the internet gateway. type: string - contextPath: AWS.EC2.InternetGatewaysNextToken description: The token used to retrieve the next page of results. type: string - name: aws-ec2-internet-gateway-detach description: "Detaches an internet gateway from a VPC, disabling connectivity between the internet and the VPC. Required IAM Permission: ec2:DetachInternetGateway." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: internet_gateway_id description: The ID of the internet gateway. required: true - name: vpc_id description: The ID of the VPC. required: true - name: aws-ec2-internet-gateway-delete description: "Deletes the specified internet gateway. You must detach the internet gateway from the VPC before you can delete it. Required IAM Permission: ec2:DeleteInternetGateway." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: internet_gateway_id description: The ID of the internet gateway. required: true - name: aws-ec2-subnet-delete description: "Deletes the specified subnet. You must terminate all running instances in the subnet before you can delete the subnet. Required IAM Permission: ec2:DeleteSubnet." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: subnet_id description: The ID of the subnet. required: true - name: aws-ec2-network-acl-entry-create description: "Creates an entry (a rule) in a network ACL with the specified rule number. Required IAM Permission: ec2:CreateNetworkAclEntry." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: network_acl_id description: The ID of the network ACL. required: true - name: rule_number description: The rule number for the entry (Positive integer from 1 to 32766. The range 32767 to 65535 is reserved for internal use.). ACL entries are processed in ascending order by rule number. required: true - name: protocol description: The protocol number, where -1 or all specifies all protocols. Using all, -1, or any protocol other than tcp, udp, or icmp allows traffic on all ports, regardless other settings. required: true auto: PREDEFINED predefined: - tcp - udp - icmp - icmpv6 - '-1' - name: rule_action description: Whether to allow the traffic that matches the rule. required: true auto: PREDEFINED predefined: - allow - deny - name: egress description: Whether it is an egress rule (a rule applied to traffic leaving the subnet). required: true auto: PREDEFINED predefined: - 'true' - 'false' - name: cidr_block description: The IPv4 network range to allow or deny, in CIDR notation (for example, 172.16.0.0/24). You must specify either cidr_block or ipv6_cidr_block. required: false - name: ipv6_cidr_block description: The IPv6 network range to allow or deny, in CIDR notation (for example, 2001:db8:1234:1a00::/64). You must specify either cidr_block or ipv6_cidr_block. required: false - name: icmp_type_code_type description: The ICMP type. A value of -1 means all types. Required if specifying icmp or icmpv6 for the protocol parameter. required: false - name: icmp_type_code_code description: The ICMP code. A value of -1 means all codes for the specified ICMP type. Required if specifying icmp or icmpv6 for the protocol parameter. required: false - name: port_range_from description: The first port in the range. Required if specifying tcp or udp for the protocol parameter. required: false - name: port_range_to description: The last port in the range. Required if specifying tcp or udp for the protocol parameter. required: false - name: aws-logs-log-group-create description: "Creates a log group with the specified name. Required IAM permission: logs:CreateLogGroup." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. Log group names can be between 1 and 512 characters long. Allowed characters are a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), '/' (forward slash), '.' (period), and '#' (number sign). - name: kms_key_id description: The Amazon Resource Name (ARN) of the KMS key to use when encrypting log data. - name: log_group_class auto: PREDEFINED predefined: - STANDARD - INFREQUENT_ACCESS description: The class of the log group. If you omit this parameter, the default of STANDARD is used. INFREQUENT_ACCESS class log groups have a higher per-ingestion cost but lower per-GB storage cost. - name: tags description: "The key-value pairs to use for the tags. Must be separated by a semicolon (;) and specified using the format: key=abc,value=123;key=fed,value=456." - name: deletion_protection_enabled auto: PREDEFINED predefined: - "true" - "false" description: Whether to enable deletion protection for the log group. When deletion protection is enabled, the log group cannot be deleted. Default is false. - name: aws-logs-log-stream-create description: "Creates a log stream for the specified log group. Required IAM permission: logs:CreateLogStream." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. - name: log_stream_name required: true description: The name of the log stream. - name: aws-logs-log-group-delete description: "Deletes the specified log group and permanently deletes all the archived log events associated with the log group. Required IAM permission: logs:DeleteLogGroup." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. - name: aws-logs-log-stream-delete description: "Deletes the specified log stream and permanently deletes all the archived log events associated with the log stream. Required IAM permission: logs:DeleteLogStream." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. - name: log_stream_name required: true description: The name of the log stream. - name: aws-logs-log-events-filter description: "Lists log events from the specified log group. You can list all the log events or filter the results using a filter pattern, a time range, and the name of the log stream. Required IAM permission: logs:FilterLogEvents." arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group to search. Must include either logGroupName or logGroupIdentifier, but not both. - name: log_group_identifier description: Either the name or ARN of the log group to search. If the log group is in a source account and you are using a monitoring account, use the log group ARN. Must include either logGroupName or logGroupIdentifier, but not both. - name: log_stream_names description: A comma-separated list of log stream names to search within. Cannot be used together with log_stream_name_prefix. isArray: true - name: log_stream_name_prefix description: The prefix used to filter results to include only events from log streams with names starting with this value. Cannot be used together with log_stream_names. - name: start_time description: The start of the time range, expressed in Unix time (milliseconds after Jan 1 1970 00:00:00 UTC. For example, 1777536297198). Events with a timestamp before this time are not returned. - name: end_time description: The end of the time range, expressed in Unix time (milliseconds after Jan 1, 1970 00:00:00 UTC. For example, 1777536297198). Events with a timestamp later than this time are not returned. - name: filter_pattern description: The filter pattern to use. If not provided, all events are matched. For more information, see the AWS Filter and Pattern Syntax documentation. - name: limit description: The maximum number of events to return. - name: next_token description: The token for the next set of events to return. Use the value returned in the previous response as nextToken to get the next page of results. - name: unmask auto: PREDEFINED predefined: - "true" - "false" description: Whether to display the log event fields with all sensitive data unmasked and visible. This parameter is valid only if the log group has a data protection policy. Default is "false". outputs: - contextPath: AWS.CloudWatchLogs.Events.logStreamName description: The name of the log stream this event belongs to. type: string - contextPath: AWS.CloudWatchLogs.Events.timestamp description: The time the event occurred, expressed in Unix time (the number of milliseconds after Jan 1, 1970 00:00:00 UTC). type: date - contextPath: AWS.CloudWatchLogs.Events.message description: The data contained in the log event. type: string - contextPath: AWS.CloudWatchLogs.Events.ingestionTime description: The time the event was ingested, expressed in Unix time (the number of milliseconds after Jan 1, 1970 00:00:00 UTC). type: date - contextPath: AWS.CloudWatchLogs.Events.eventId description: The ID of the event. type: string - contextPath: AWS.CloudWatchLogs.EventsNextToken description: The nextToken value to include in a future request for pagination. The value is null when there are no more results. type: string - name: aws-logs-log-groups-describe description: "Lists the specified log groups. You can list all your log groups or filter the results by prefix. The results are ASCII-sorted by log group name. Required IAM permission: logs:DescribeLogGroups." arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name_prefix description: The prefix used to filter results. Cannot be used together with log_group_name_pattern. - name: log_group_name_pattern description: The case-sensitive substring used to filter log group names. Cannot be used together with log_group_name_prefix. - name: log_group_identifiers description: A comma-separated list of log group ARNs or names to describe. If you specify log group names, they must be from the same account and region. isArray: true - name: account_identifiers description: A comma-separated list of account IDs. When used with include_linked_accounts, returns log groups in the accounts listed. Used for cross-account querying. isArray: true - name: include_linked_accounts auto: PREDEFINED predefined: - "true" - "false" description: Whether to include log groups in the accounts specified by account_identifiers. If set to true and account_identifiers is empty, returns all log groups in the monitoring account and all linked source accounts. - name: log_group_class auto: PREDEFINED predefined: - STANDARD - INFREQUENT_ACCESS - DELIVERY description: The log group class for this log group. - name: limit description: The maximum number of items to return. Maximum value is 50. - name: next_token description: The token for the next set of items to return. Use the value returned in the previous response to get the next page of results. outputs: - contextPath: AWS.CloudWatchLogs.LogGroups.logGroupName description: The name of the log group. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.creationTime description: The creation time of the log group, expressed in Unix time (the number of milliseconds after Jan 1, 1970 00:00:00 UTC). type: number - contextPath: AWS.CloudWatchLogs.LogGroups.retentionInDays description: The number of days to retain the log events in the specified log group. type: number - contextPath: AWS.CloudWatchLogs.LogGroups.metricFilterCount description: The number of metric filters. type: number - contextPath: AWS.CloudWatchLogs.LogGroups.arn description: The Amazon Resource Name (ARN) of the log group. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.storedBytes description: The number of bytes stored. type: number - contextPath: AWS.CloudWatchLogs.LogGroups.kmsKeyId description: The Amazon Resource Name (ARN) of the CMK to use when encrypting log data. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.dataProtectionStatus description: Displays whether this log group has a protection policy, or whether it had one in the past. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.inheritedProperties description: Displays all the properties that this log group has inherited from account-level settings. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.logGroupClass description: This specifies the log group class for this log group. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.logGroupArn description: The Amazon Resource Name (ARN) of the log group. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.deletionProtectionEnabled description: Indicates whether deletion protection is enabled for this log group. type: Boolean - contextPath: AWS.CloudWatchLogs.LogGroups.bearerTokenAuthenticationEnabled description: Indicates whether bearer token authentication is enabled for this log group. type: Boolean - contextPath: AWS.CloudWatchLogs.LogGroupsNextToken description: The nextToken value to include in a future request for pagination. The value is null when there are no more results. type: string - name: aws-logs-log-streams-describe description: "Lists the log streams for the specified log group. You can list all the log streams or filter the results by prefix. You can also control how the results are ordered. Required IAM Permission: logs:DescribeLogStreams." arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name description: The name of the log group. Must include either log_group_name or log_group_identifier, but not both. - name: log_group_identifier description: Either the name or ARN of the log group. Must include either log_group_name or log_group_identifier, but not both. - name: log_stream_name_prefix description: The prefix used to filter results. Cannot be used when the orderBy argument is set to LastEventTime. - name: order_by auto: PREDEFINED predefined: - LogStreamName - LastEventTime description: The method used to order the results. Possible values are LogStreamName (results ordered by log stream name) or LastEventTime (results ordered by event time). Default is LogStreamName. - name: descending auto: PREDEFINED predefined: - "true" - "false" description: Whether to return results in descending order. If orderBy is not set, the default is false. If orderBy is LastEventTime, the default is true. - name: limit description: The maximum number of items to return. Maximum value is 50. - name: next_token description: The token for the next set of items to return. Use the value returned in the previous response to get the next page of results. outputs: - contextPath: AWS.CloudWatchLogs.LogGroups.logGroupName description: The name of the log group. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreams.logStreamName description: The name of the log stream. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreams.creationTime description: The creation time of the stream, expressed in Unix time (the number of milliseconds after Jan 1, 1970 00:00:00 UTC). type: number - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreams.arn description: The Amazon Resource Name (ARN) of the log stream. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreams.firstEventTimestamp description: The time of the first event, expressed in Unix time (the number of milliseconds after Jan 1, 1970 00:00:00 UTC). type: date - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreams.lastEventTimestamp description: The time of the most recent log event in the log stream in CloudWatch Logs. type: date - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreams.lastIngestionTime description: The ingestion time, expressed in Unix time (the number of milliseconds after Jan 1, 1970 00:00:00 UTC). type: date - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreams.uploadSequenceToken description: The sequence token. type: string - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreams.storedBytes description: The number of bytes stored. type: number - contextPath: AWS.CloudWatchLogs.LogGroups.LogStreamsNextToken description: The nextToken value to include in a future request for pagination. The value is null when there are no more results. type: string - name: aws-logs-retention-policy-put description: "Sets the retention of the specified log group. A retention policy allows you to configure the number of days for which to retain log events in the specified log group. Required IAM permission: logs:PutRetentionPolicy." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. - name: retention_in_days required: true auto: PREDEFINED predefined: - "1" - "3" - "5" - "7" - "14" - "30" - "60" - "90" - "120" - "150" - "180" - "365" - "400" - "545" - "731" - "1827" - "3653" description: The number of days to retain the log events in the specified log group. - name: aws-logs-retention-policy-delete description: "Deletes the specified retention policy. Log events do not expire if they belong to log groups without a retention policy. Required IAM permission: logs:DeleteRetentionPolicy." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. - name: aws-logs-log-event-put description: "Uploads a log event to the specified log stream. Required IAM permission: logs:PutLogEvents." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. - name: log_stream_name required: true description: The name of the log stream. - name: timestamp required: true description: The time the event occurred, expressed in Unix time (the number of milliseconds after Jan 1, 1970 00:00:00 UTC). - name: message required: true description: The raw event message. - name: key_attributes description: "The entity key attributes that identify the entity. Must be separated by a semicolon (;) and specified using the format: key=,value=;key=,value=. For example: key=Type,value=AWS::EC2::Instance;key=Name,value=my-instance." - name: attributes description: "The additional entity attributes that describe the entity. Must be separated by a semicolon (;) and specified using the format: key=,value=;key=,value=. For example: key=Environment,value=production;key=Team,value=platform." outputs: - contextPath: AWS.CloudWatchLogs.PutLogEvents.rejectedLogEventsInfo description: The information about rejected log events, including the reason for rejection. type: Unknown - contextPath: AWS.CloudWatchLogs.PutLogEvents.rejectedEntityInfo description: The information about the rejected entity, including the reason for rejection. type: Unknown - name: aws-logs-metric-filter-put description: "Creates or updates a metric filter and associates it with the specified log group. Metric filters allow you to configure rules to extract metric data from log events ingested through PutLogEvents. Required IAM permission: logs:PutMetricFilter." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. - name: filter_name required: true description: A name for the metric filter. - name: filter_pattern required: true description: A filter pattern for extracting metric data out of ingested log events. - name: metric_name required: true description: The name of the CloudWatch metric. - name: metric_namespace required: true description: The namespace of the CloudWatch metric. - name: metric_value required: true description: The value to publish to the CloudWatch metric when a filter pattern matches a log event. - name: default_value description: The value to emit when a filter pattern does not match a log event. This value can be null. - name: dimensions description: "The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions. Must be separated by a semicolon (;) and specified using the format: key=DimensionName,value=DimensionValueSource;key=DimensionName2,value=DimensionValueSource2." - name: unit auto: PREDEFINED predefined: - Seconds - Microseconds - Milliseconds - Bytes - Kilobytes - Megabytes - Gigabytes - Terabytes - Bits - Kilobits - Megabits - Gigabits - Terabits - Percent - Count - Bytes/Second - Kilobytes/Second - Megabytes/Second - Gigabytes/Second - Terabytes/Second - Bits/Second - Kilobits/Second - Megabits/Second - Gigabits/Second - Terabits/Second - Count/Second - None description: The unit to assign to the metric. If you omit this, the unit is set as None. - name: field_selection_criteria description: The filter expression used to specify which log events to process based on system fields, such as source account and source region. Uses selection criteria syntax with operators such as =, !=, AND, OR, IN, and NOT IN. Maximum length is 2000 characters. - name: emit_system_field_dimensions description: A comma-separated list of system fields to emit as additional dimensions in the generated metrics. Valid values are @aws.account and @aws.region. isArray: true - name: apply_on_transformed_logs auto: PREDEFINED predefined: - "true" - "false" description: Whether to apply the metric filter to results of CloudWatch Logs Insights queries or to log events that are ingested through a CloudWatch Logs Transformer. Default is false. - name: aws-logs-metric-filter-delete description: "Deletes the specified metric filter. Required IAM permission: logs:DeleteMetricFilter." execution: true arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name required: true description: The name of the log group. - name: filter_name required: true description: The name of the metric filter. - name: aws-logs-metric-filters-describe description: "Lists the specified metric filters. You can list all the metric filters or filter the results by log name, prefix, metric name, or metric namespace. Required IAM permission: logs:DescribeMetricFilters." arguments: - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: log_group_name description: The name of the log group. - name: filter_name_prefix description: The prefix to match. - name: metric_name description: The metric name used to filter results. If this argument is provided, the metric_namespace argument must also be provided. - name: metric_namespace description: The namespace used to filter results. If this argument is provided, the metric_name argument must also be provided. - name: limit description: The maximum number of items to return. Maximum value is 50. - name: next_token description: The token for the next set of items to return. Use the value returned in the previous response to get the next page of results. outputs: - contextPath: AWS.CloudWatchLogs.MetricFilters.filterName description: The name of the metric filter. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.filterPattern description: A symbolic description of how CloudWatch Logs should interpret the data in each log event. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.metricTransformations.metricName description: The name of the CloudWatch metric. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.metricTransformations.metricNamespace description: The namespace of the CloudWatch metric. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.metricTransformations.metricValue description: The value to publish to the CloudWatch metric when a filter pattern matches a log event. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.metricTransformations.defaultValue description: The value to emit when a filter pattern does not match a log event. This value can be null. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.metricTransformations.dimensions description: The fields to use as dimensions for the metric. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.metricTransformations.unit description: The unit to assign to the metric. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.creationTime description: The creation time of the metric filter, expressed in Unix time (the number of milliseconds after Jan 1, 1970 00:00:00 UTC). type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.logGroupName description: The name of the log group. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.applyOnTransformedLogs description: This parameter is valid only for log groups that have an active log transformer. type: Boolean - contextPath: AWS.CloudWatchLogs.MetricFilters.fieldSelectionCriteria description: The filter expression that specifies which log events are processed by this metric filter based on system fields. type: string - contextPath: AWS.CloudWatchLogs.MetricFilters.emitSystemFieldDimensions description: The list of system fields that are emitted as additional dimensions in the generated metrics. type: string - contextPath: AWS.CloudWatchLogs.MetricFiltersNextToken description: The nextToken value to include in a future request for pagination. The value is null when there are no more results. type: string - name: aws-ssm-association-versions-list description: "Retrieves all versions of an association for a specific association ID. Required IAM permission: ssm:ListAssociationVersions." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: association_id description: The association ID for which to view all versions. required: true - name: limit description: The maximum number of items to return for this call. The minimum is 1 and the maximum is 50. required: false defaultValue: '50' - name: next_token description: The token for the next set of items to return. Use AWS.SSM.Associations.AssociationVersionNextToken. required: false outputs: - contextPath: AWS.SSM.Associations.AssociationId description: The ID of the association. type: String - contextPath: AWS.SSM.Associations.Versions.AssociationId description: The ID created by the system when the association was created. type: String - contextPath: AWS.SSM.Associations.Versions.AssociationVersion description: The association version. type: String - contextPath: AWS.SSM.Associations.Versions.CreatedDate description: The date the association version was created. type: Date - contextPath: AWS.SSM.Associations.Versions.Name description: The name specified when the association was created. type: String - contextPath: AWS.SSM.Associations.Versions.AssociationDispatchAssumeRole description: A role used by association to take actions on your behalf. type: String - contextPath: AWS.SSM.Associations.Versions.AssociationName description: The name specified for the association version when the association version was created. type: String - contextPath: AWS.SSM.Associations.Versions.DocumentVersion description: The version of an SSM document used when the association version was created. type: String - contextPath: AWS.SSM.Associations.Versions.Duration description: The number of hours an association can run on specified targets. When the cutoff time is reached, running associations are canceled and no pending executions are started on the remaining targets. type: Number - contextPath: AWS.SSM.Associations.Versions.Parameters description: The parameters specified when the association version was created. type: Unknown - contextPath: AWS.SSM.Associations.Versions.Targets.Key description: The user-defined criteria for sending commands that target managed nodes. type: String - contextPath: AWS.SSM.Associations.Versions.Targets.Values description: The user-defined values that map to the key. type: String - contextPath: AWS.SSM.Associations.Versions.ScheduleExpression description: The cron or rate schedule specified for the association when the association version was created. type: String - contextPath: AWS.SSM.Associations.Versions.ScheduleOffset description: The number of days to wait after the scheduled day to run an association. type: Number - contextPath: AWS.SSM.Associations.Versions.OutputLocation.S3Location description: The S3 location object containing OutputS3Region, OutputS3BucketName, and OutputS3KeyPrefix. type: Unknown - contextPath: AWS.SSM.Associations.Versions.MaxErrors description: The number of errors allowed before the system stops sending requests to run the association on additional targets. type: String - contextPath: AWS.SSM.Associations.Versions.MaxConcurrency description: The maximum number of targets allowed to run the association at the same time. type: String - contextPath: AWS.SSM.Associations.Versions.ComplianceSeverity description: The severity level that is assigned to the association. type: String - contextPath: AWS.SSM.Associations.Versions.SyncCompliance description: The mode for generating association compliance. AUTO or MANUAL. type: String - contextPath: AWS.SSM.Associations.Versions.ApplyOnlyAtCronInterval description: When true, the association runs only according to the schedule and not immediately after creation. type: Boolean - contextPath: AWS.SSM.Associations.Versions.CalendarNames description: The names or ARNs of the Change Calendar type documents the associations are gated under. type: String - contextPath: AWS.SSM.Associations.Versions.TargetLocations description: The location object containing Accounts, Regions, TargetLocationMaxConcurrency, TargetLocationMaxErrors, ExecutionRoleName, and TargetLocationAlarmConfiguration. type: Unknown - contextPath: AWS.SSM.Associations.Versions.TargetMaps description: A key-value mapping of document parameters to target resources. type: List - contextPath: AWS.SSM.Associations.AssociationVersionNextToken description: The token to use when requesting the next set of items. type: String - name: aws-ssm-association-get description: "Describes the association for the specified target or managed node. Must provide either association_id, or both instance_id and document_name. Required IAM Permission: ssm:DescribeAssociation." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: association_id description: The association ID for which information is requested. required: false - name: instance_id description: The managed node ID. Required together with document_name if association_id is not provided. required: false - name: document_name description: The name of the SSM document. Required together with instance_id if association_id is not provided. required: false - name: association_version description: The association version to retrieve. To view the latest version, either specify $LATEST or omit this parameter. required: false outputs: - contextPath: AWS.SSM.Associations.Name description: The name of the SSM document. type: String - contextPath: AWS.SSM.Associations.AssociationId description: The association ID. type: String - contextPath: AWS.SSM.Associations.AssociationName description: The association name. type: String - contextPath: AWS.SSM.Associations.AssociationVersion description: The association version. type: String - contextPath: AWS.SSM.Associations.AssociationDispatchAssumeRole description: A role used by association to take actions on your behalf. type: String - contextPath: AWS.SSM.Associations.InstanceId description: The managed node ID. type: String - contextPath: AWS.SSM.Associations.DocumentVersion description: The document version. type: String - contextPath: AWS.SSM.Associations.Duration description: The number of hours an association can run on specified targets. When the cutoff time is reached, running associations are canceled and no pending executions are started on the remaining targets. type: Number - contextPath: AWS.SSM.Associations.AutomationTargetParameterName description: How the automation will branch out. Required for associations that use an Automation runbook with rate controls. type: String - contextPath: AWS.SSM.Associations.Parameters description: A description of the parameters for a document. type: Unknown - contextPath: AWS.SSM.Associations.Date description: The date when the association was made. type: Date - contextPath: AWS.SSM.Associations.LastUpdateAssociationDate description: The date when the association was last updated. type: Date - contextPath: AWS.SSM.Associations.LastExecutionDate description: The date on which the association was last run. type: Date - contextPath: AWS.SSM.Associations.LastSuccessfulExecutionDate description: The last date on which the association was successfully run. type: Date - contextPath: AWS.SSM.Associations.Status description: The status object containing Date, Name, Message, and AdditionalInfo fields. type: Unknown - contextPath: AWS.SSM.Associations.Overview.Status description: "The status of the association. Status can be: Pending, Success, or Failed." type: String - contextPath: AWS.SSM.Associations.Overview.DetailedStatus description: A detailed status of the association. type: String - contextPath: AWS.SSM.Associations.Overview.AssociationStatusAggregatedCount description: The number of targets for the association status. type: Unknown - contextPath: AWS.SSM.Associations.Targets.Key description: The user-defined criteria for sending commands that target managed nodes. type: String - contextPath: AWS.SSM.Associations.Targets.Values description: The user-defined values that map to the key. type: String - contextPath: AWS.SSM.Associations.ScheduleExpression description: A cron expression that specifies a schedule when the association runs. type: String - contextPath: AWS.SSM.Associations.ScheduleOffset description: The number of days to wait after the scheduled day to run an association. type: Number - contextPath: AWS.SSM.Associations.OutputLocation.S3Location description: The S3 location object containing OutputS3Region, OutputS3BucketName, and OutputS3KeyPrefix. type: Unknown - contextPath: AWS.SSM.Associations.MaxErrors description: The number of errors allowed before the system stops sending requests to run the association on additional targets. type: String - contextPath: AWS.SSM.Associations.MaxConcurrency description: The maximum number of targets allowed to run the association at the same time. type: String - contextPath: AWS.SSM.Associations.ComplianceSeverity description: The severity level that is assigned to the association. type: String - contextPath: AWS.SSM.Associations.SyncCompliance description: The mode for generating association compliance. AUTO or MANUAL. type: String - contextPath: AWS.SSM.Associations.ApplyOnlyAtCronInterval description: When true, the association runs only according to the schedule and not immediately after creation. type: Boolean - contextPath: AWS.SSM.Associations.CalendarNames description: The names or ARNs of the Change Calendar type documents the associations are gated under. type: String - contextPath: AWS.SSM.Associations.TargetLocations description: The location object containing Accounts, Regions, TargetLocationMaxConcurrency, TargetLocationMaxErrors, ExecutionRoleName, and TargetLocationAlarmConfiguration. type: Unknown - contextPath: AWS.SSM.Associations.TargetMaps description: A key-value mapping of document parameters to target resources. type: List - contextPath: AWS.SSM.Associations.AlarmConfiguration description: The alarm configuration object containing IgnorePollAlarmFailure and Alarms fields. type: Unknown - contextPath: AWS.SSM.Associations.TriggeredAlarms.Name description: The CloudWatch alarm that was invoked during the association. type: String - contextPath: AWS.SSM.Associations.TriggeredAlarms.State description: The state of the CloudWatch alarm. type: String - name: aws-ssm-associations-list description: "Returns all State Manager associations in the current AWS account and Region. An association is a binding between a document and a set of targets with a schedule. Required IAM Permission: ssm:ListAssociations." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' in the format key=,value=. Valid filter keys: AssociationId, AssociationStatusName, AssociationName, InstanceId, LastExecutedBefore, LastExecutedAfter, Name, ResourceGroupName. For example: key=AssociationStatusName,value=Success." required: false - name: limit description: The maximum number of items to return for this call. The minimum is 1 and the maximum is 50. required: false defaultValue: '50' - name: next_token description: The token for the next set of items to return. Use AWS.SSM.AssociationsNextToken. required: false outputs: - contextPath: AWS.SSM.Associations.Name description: The name of the SSM document. type: String - contextPath: AWS.SSM.Associations.AssociationId description: The ID created by the system when creating an association. type: String - contextPath: AWS.SSM.Associations.AssociationName description: The association name. type: String - contextPath: AWS.SSM.Associations.AssociationVersion description: The association version. type: String - contextPath: AWS.SSM.Associations.InstanceId description: The managed node ID. type: String - contextPath: AWS.SSM.Associations.DocumentVersion description: The version of the document used in the association. type: String - contextPath: AWS.SSM.Associations.Targets.Key description: The user-defined criteria for sending commands that target managed nodes. type: String - contextPath: AWS.SSM.Associations.Targets.Values description: The user-defined values that map to the key. type: String - contextPath: AWS.SSM.Associations.LastExecutionDate description: The date on which the association was last run. type: String - contextPath: AWS.SSM.Associations.Overview.Status description: "The status of the association. Status can be: Pending, Success, or Failed." type: String - contextPath: AWS.SSM.Associations.Overview.DetailedStatus description: A detailed status of the association. type: String - contextPath: AWS.SSM.Associations.Overview.AssociationStatusAggregatedCount description: The number of targets for the association status. type: Unknown - contextPath: AWS.SSM.Associations.ScheduleExpression description: A cron expression that specifies a schedule when the association runs. type: String - contextPath: AWS.SSM.Associations.ScheduleOffset description: The number of days to wait after the scheduled day to run an association. type: Number - contextPath: AWS.SSM.Associations.Duration description: The number of hours an association can run on specified targets. When the cutoff time is reached, running associations are canceled and no pending executions are started on the remaining targets. type: Number - contextPath: AWS.SSM.Associations.TargetMaps description: A key-value mapping of document parameters to target resources. Targets and TargetMaps cannot be specified together. type: Unknown - contextPath: AWS.SSM.AssociationsNextToken description: The token to use when requesting the next set of items. type: String - name: aws-ssm-inventory-list description: "Queries SSM inventory information for managed nodes. Required IAM Permission: ssm:GetInventory." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' in the format key=,values=,type=. The type must be one of: Equal, NotEqual, BeginWith, LessThan, GreaterThan, Exists. For example: key=AWS:InstanceInformation.PlatformType,values=Linux,type=Equal." required: false - name: result_attributes description: "A comma-separated list of inventory type names to return. For example: AWS:InstanceInformation,AWS:Application. If not specified, all inventory types are returned." required: false isArray: true - name: aggregator_expression description: "The inventory type name to aggregate inventory data by. For example: AWS:InstanceInformation.PlatformType." required: false - name: aggregator_groups description: "A JSON string specifying one or more groups to further refine aggregated inventory data within the aggregator_expression scope. Requires aggregator_expression. Cannot be combined with inventory_aggregator. Each group must have a Name and Filters. For example: [{\"Name\": \"WindowsGroup\", \"Filters\": [{\"Key\": \"AWS:InstanceInformation.PlatformType\", \"Type\": \"Equal\", \"Values\": [\"Windows\"]}]}]." required: false - name: inventory_aggregator description: "A nested aggregator expression to further group inventory data within the primary aggregator. For example: AWS:InstanceInformation.AgentType." required: false - name: limit description: The maximum number of items to return for this call. The minimum is 1 and the maximum is 50. required: false defaultValue: '50' - name: next_token description: The token for the next set of items to return. Use AWS.SSM.InventoryNextToken. required: false outputs: - contextPath: AWS.SSM.Inventory.Id description: The inventory result entity ID. For example, for managed node inventory it is the managed node ID. type: String - contextPath: AWS.SSM.Inventory.TypeName description: The name of the inventory result item type. type: String - contextPath: AWS.SSM.Inventory.SchemaVersion description: The schema version for the inventory result item. type: String - contextPath: AWS.SSM.Inventory.CaptureTime description: The time inventory item data was captured. type: String - contextPath: AWS.SSM.Inventory.Content.InstanceId description: The managed node ID. type: String - contextPath: AWS.SSM.Inventory.Content.ComputerName description: The fully qualified host name of the managed node. type: String - contextPath: AWS.SSM.Inventory.Content.PlatformType description: The operating system platform type. type: String - contextPath: AWS.SSM.Inventory.Content.PlatformName description: The name of the operating system platform running on the managed node. type: String - contextPath: AWS.SSM.Inventory.Content.PlatformVersion description: The version of the OS platform running on the managed node. type: String - contextPath: AWS.SSM.Inventory.Content.AgentType description: The type of SSM agent running on the instance. type: String - contextPath: AWS.SSM.Inventory.Content.AgentVersion description: The version of the SSM agent running on the instance. type: String - contextPath: AWS.SSM.Inventory.Content.IpAddress description: The IP address of the managed node. type: String - contextPath: AWS.SSM.Inventory.Content.ResourceType description: The type of instance. Instances are either EC2 instances or managed instances. type: String - contextPath: AWS.SSM.Inventory.Content.InstanceStatus description: The status of the managed node. type: String - contextPath: AWS.SSM.InventoryNextToken description: The token to use when requesting the next set of items. type: String - name: aws-ssm-tag-add description: "Adds or overwrites one or more tags for the specified resource. Required IAM Permission: ssm:AddTagsToResource." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_type description: The type of resource to tag. required: true auto: PREDEFINED predefined: - Association - Automation - Document - MaintenanceWindow - ManagedInstance - OpsItem - OpsMetadata - PatchBaseline - Parameter - name: resource_id description: The ID of the resource to tag. required: true - name: tags description: "A semicolon-separated list of tags in the format key=,value=. For example: key=Owner,value=SysAdmin;key=Env,value=Prod." required: true - name: aws-ssm-tags-list description: "Returns a list of the tags assigned to the specified resource. Required IAM Permission: ssm:ListTagsForResource." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_type description: The type of resource for which to list tags. required: true auto: PREDEFINED predefined: - Association - Automation - Document - MaintenanceWindow - ManagedInstance - OpsItem - OpsMetadata - PatchBaseline - Parameter - name: resource_id description: The ID of the resource for which to list tags. required: true outputs: - contextPath: AWS.SSM.Tags.ResourceId description: The ID of the resource. type: String - contextPath: AWS.SSM.Tags.TagList.Key description: The key of the tag. type: String - contextPath: AWS.SSM.Tags.TagList.Value description: The value of the tag. type: String - name: aws-ssm-documents-list description: "Returns all Systems Manager (SSM) documents in the current AWS account and Region. Required IAM Permission: ssm:ListDocuments." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "A semicolon-separated list of filters in the format name=,values=,. Valid filter keys: Name, Owner, PlatformTypes, DocumentType, TargetType, SchemaVersion, DocumentFormat. For example: name=Owner,values=Amazon;name=DocumentType,values=Command." - name: limit description: The maximum number of documents to return. Minimum 1, maximum 50. Default is 50. - name: next_token description: The token for the next set of items to return. Received from a previous call. Use AWS.SSM.DocumentsNextToken. outputs: - contextPath: AWS.SSM.Documents.Name description: The name of the SSM document. type: String - contextPath: AWS.SSM.Documents.CreatedDate description: The date the SSM document was created. type: String - contextPath: AWS.SSM.Documents.DisplayName description: An optional field specifying a user-defined, friendly name for the SSM document. type: String - contextPath: AWS.SSM.Documents.Owner description: The AWS user that created the document. type: String - contextPath: AWS.SSM.Documents.VersionName description: An optional field specifying the version of the artifact associated with the document. type: String - contextPath: AWS.SSM.Documents.PlatformTypes description: The operating system platform. type: String - contextPath: AWS.SSM.Documents.DocumentVersion description: The document version. type: String - contextPath: AWS.SSM.Documents.DocumentType description: The document type. type: String - contextPath: AWS.SSM.Documents.SchemaVersion description: The schema version. type: String - contextPath: AWS.SSM.Documents.Requires.Name description: The name of the required SSM document. The name can be an Amazon Resource Name (ARN). type: String - contextPath: AWS.SSM.Documents.Requires.RequireType description: The document type of the required SSM document. type: String - contextPath: AWS.SSM.Documents.Requires.Version description: The document version required by the current document. type: String - contextPath: AWS.SSM.Documents.Requires.VersionName description: An optional field specifying the version of the artifact associated with the document. type: String - contextPath: AWS.SSM.Documents.DocumentFormat description: The document format, either JSON or YAML. type: String - contextPath: AWS.SSM.Documents.TargetType description: The target type which defines the kinds of resources the document can run on. type: String - contextPath: AWS.SSM.Documents.Tags.Key description: The name of the tag. type: String - contextPath: AWS.SSM.Documents.Tags.Value description: The value of the tag. type: String - contextPath: AWS.SSM.Documents.ReviewStatus description: The current status of a document review. type: String - contextPath: AWS.SSM.Documents.Author description: The user in the organization who created the document. type: String - contextPath: AWS.SSM.DocumentsNextToken description: The token to use when requesting the next set of items. Empty string if no additional items exist. type: String - name: aws-ssm-document-describe description: "Describes the specified SSM document. Required IAM Permission: ssm:DescribeDocument." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: document_name description: The name of the SSM document. required: true - name: document_version description: The document version for which you want information. Can be a specific version or $DEFAULT or $LATEST. required: false - name: version_name description: An optional field specifying the version of the artifact associated with the document. required: false outputs: - contextPath: AWS.SSM.Documents.Name description: The name of the SSM document. type: String - contextPath: AWS.SSM.Documents.DisplayName description: An optional field specifying a user-defined, friendly name for the SSM document. type: String - contextPath: AWS.SSM.Documents.VersionName description: The version of the artifact associated with the document. type: String - contextPath: AWS.SSM.Documents.CreatedDate description: The date the document was created. type: String - contextPath: AWS.SSM.Documents.Status description: The status of the SSM document. type: String - contextPath: AWS.SSM.Documents.StatusInformation description: A message returned by AWS that explains the Status value. type: String - contextPath: AWS.SSM.Documents.DocumentVersion description: The document version. type: String - contextPath: AWS.SSM.Documents.DocumentType description: The type of document. type: String - contextPath: AWS.SSM.Documents.DocumentFormat description: The document format, either JSON or YAML. type: String - contextPath: AWS.SSM.Documents.ReviewStatus description: The current status of a document review. type: String - contextPath: AWS.SSM.Documents.Requires.Name description: The name of the required SSM document. The name can be an Amazon Resource Name (ARN). type: String - contextPath: AWS.SSM.Documents.Requires.RequireType description: The document type of the required SSM document. type: String - contextPath: AWS.SSM.Documents.Requires.Version description: The document version required by the current document. type: String - contextPath: AWS.SSM.Documents.Requires.VersionName description: An optional field specifying the version of the artifact associated with the document. type: String - contextPath: AWS.SSM.Documents.Owner description: The AWS user that created the document. type: String - contextPath: AWS.SSM.Documents.Author description: The user in your organization who created the document. type: String - contextPath: AWS.SSM.Documents.Description description: A description of the document. type: String - contextPath: AWS.SSM.Documents.Hash description: The Sha256 or Sha1 hash created by the system when the document was created. type: String - contextPath: AWS.SSM.Documents.HashType description: The hash type of the document. Valid values include Sha256 or Sha1. type: String - contextPath: AWS.SSM.Documents.SchemaVersion description: The schema version. type: String - contextPath: AWS.SSM.Documents.DefaultVersion description: The default version. type: String - contextPath: AWS.SSM.Documents.LatestVersion description: The latest version of the document. type: String - contextPath: AWS.SSM.Documents.ApprovedVersion description: The version of the document currently approved for use in the organization. type: String - contextPath: AWS.SSM.Documents.PendingReviewVersion description: The version of the document that is currently under review. type: String - contextPath: AWS.SSM.Documents.PlatformTypes description: A list of OS platforms compatible with this SSM document. type: Unknown - contextPath: AWS.SSM.Documents.TargetType description: The target type which defines the kinds of resources the document can run on. type: String - contextPath: AWS.SSM.Documents.Tags.Key description: The key of the tag. type: String - contextPath: AWS.SSM.Documents.Tags.Value description: The value of the tag. type: String - contextPath: AWS.SSM.Documents.AttachmentsInformation.Name description: The name of the attachment. type: String - contextPath: AWS.SSM.Documents.Parameters.Name description: The name of the parameter. type: String - contextPath: AWS.SSM.Documents.Parameters.Type description: The type of parameter. Valid values include String or StringList. type: String - contextPath: AWS.SSM.Documents.Parameters.Description description: A description of what the parameter does, how to use it, the default value, and whether or not the parameter is optional. type: String - contextPath: AWS.SSM.Documents.Parameters.DefaultValue description: If specified, the default values for the parameters. type: String - contextPath: AWS.SSM.Documents.ReviewInformation.ReviewedTime description: The time that the reviewer took action on the document review request. type: Date - contextPath: AWS.SSM.Documents.ReviewInformation.Reviewer description: The reviewer of the document. type: String - contextPath: AWS.SSM.Documents.ReviewInformation.Status description: The current status of the document review request. type: String - contextPath: AWS.SSM.Documents.Category description: The classification of a document to help you identify and categorize its use. type: Unknown - contextPath: AWS.SSM.Documents.CategoryEnum description: The value that identifies a document's category. type: Unknown - name: aws-ssm-automation-executions-list description: "Provides details about all active and terminated Automation executions. Required IAM Permission: ssm:DescribeAutomationExecutions." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: filters description: "One or more filters separated by ';' in the format name=,values=,. Valid filter keys: DocumentNamePrefix, ExecutionStatus, ExecutionId, ParentExecutionId, CurrentAction, StartTimeBefore, StartTimeAfter, AutomationType, TagKey." required: false - name: limit description: The maximum number of items to return for this call. The minimum is 1 and the maximum is 50. required: false defaultValue: '50' - name: next_token description: The token for the next set of items to return. Use AWS.SSM.AutomationExecutionsNextToken. required: false outputs: - contextPath: AWS.SSM.AutomationExecutions.AutomationExecutionId description: The execution ID. type: String - contextPath: AWS.SSM.AutomationExecutions.DocumentName description: The name of the Automation runbook used during execution. type: String - contextPath: AWS.SSM.AutomationExecutions.DocumentVersion description: The document version used during the execution. type: String - contextPath: AWS.SSM.AutomationExecutions.AutomationExecutionStatus description: The status of the execution. type: String - contextPath: AWS.SSM.AutomationExecutions.ExecutionStartTime description: The time the execution started. type: Date - contextPath: AWS.SSM.AutomationExecutions.ExecutionEndTime description: The time the execution finished. type: Date - contextPath: AWS.SSM.AutomationExecutions.ExecutedBy description: The IAM role ARN of the user who ran the Automation. type: String - contextPath: AWS.SSM.AutomationExecutions.LogFile description: An S3 bucket where execution information is stored. type: String - contextPath: AWS.SSM.AutomationExecutions.Outputs description: The list of execution outputs as defined in the Automation runbook. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.Mode description: The Automation execution mode. type: String - contextPath: AWS.SSM.AutomationExecutions.ParentAutomationExecutionId description: The execution ID of the parent automation. type: String - contextPath: AWS.SSM.AutomationExecutions.CurrentStepName description: The name of the step that is currently running. type: String - contextPath: AWS.SSM.AutomationExecutions.CurrentAction description: The action of the step that is currently running. type: String - contextPath: AWS.SSM.AutomationExecutions.FailureMessage description: A message describing why an execution has failed, if the status is set to Failed. type: String - contextPath: AWS.SSM.AutomationExecutions.TargetParameterName description: The parameter name used as the target resource for the rate-controlled execution. type: String - contextPath: AWS.SSM.AutomationExecutions.Targets.Key description: The user-defined criteria for sending commands that target managed nodes. type: String - contextPath: AWS.SSM.AutomationExecutions.Targets.Values description: The user-defined values that map to the key. type: String - contextPath: AWS.SSM.AutomationExecutions.ResolvedTargets description: A list of resolved targets in the rate control execution, containing ParameterValues and Truncated fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.MaxConcurrency description: The MaxConcurrency value specified by the user when starting the automation. type: String - contextPath: AWS.SSM.AutomationExecutions.MaxErrors description: The MaxErrors value specified by the user when starting the automation. type: String - contextPath: AWS.SSM.AutomationExecutions.Target description: The target of the execution. type: String - contextPath: AWS.SSM.AutomationExecutions.TargetLocationsURL description: A publicly accessible URL for a file that contains the TargetLocations body. type: String - contextPath: AWS.SSM.AutomationExecutions.TargetMaps description: A key-value mapping of document parameters to target resources. type: List - contextPath: AWS.SSM.AutomationExecutions.AutomationType description: Use this filter with DescribeAutomationExecutions. Specify either Local or CrossAccount. type: String - contextPath: AWS.SSM.AutomationExecutions.AlarmConfiguration description: The details for the CloudWatch alarm applied to your automation, containing IgnorePollAlarmFailure and Alarms fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.TriggeredAlarms description: The CloudWatch alarm that was invoked by the automation, containing Name and State fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.AutomationSubtype description: The subtype of the Automation operation. type: String - contextPath: AWS.SSM.AutomationExecutions.ScheduledTime description: The date and time the Automation operation is scheduled to start. type: Date - contextPath: AWS.SSM.AutomationExecutions.Runbooks description: Information about the Automation runbooks that are run during a runbook workflow, containing DocumentName, DocumentVersion, Parameters, TargetParameterName, Targets, TargetMaps, MaxConcurrency, MaxErrors, and TargetLocations fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.OpsItemId description: The ID of an OpsItem that is created to represent a Change Manager change request. type: String - contextPath: AWS.SSM.AutomationExecutions.AssociationId description: The ID of a State Manager association used in the Automation operation. type: String - contextPath: AWS.SSM.AutomationExecutions.ChangeRequestName description: The name of the Change Manager change request. type: String - contextPath: AWS.SSM.AutomationExecutionsNextToken description: The token to use when requesting the next set of items. type: String - name: aws-ssm-automation-execution-run description: "Initiates execution of an Automation runbook and polls until the execution reaches a terminal state. Required IAM Permissions: ssm:StartAutomationExecution, ssm:GetAutomationExecution." polling: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: document_name description: The name of the SSM Automation runbook to run. required: true - name: document_version description: The version of the Automation runbook to use in this execution. required: false - name: parameters description: "The key-value map of execution parameters in the format key=,values=,;key=,values=." required: false - name: mode description: The execution mode of the automation. Valid values are Auto and Interactive. required: false auto: PREDEFINED predefined: - Auto - Interactive defaultValue: Auto - name: client_token description: The unique, case-insensitive, user-provided idempotency token used to ensure the request is processed only once. The token must follow the UUID format and cannot be reused. required: false - name: max_concurrency description: The maximum number of targets allowed to run this task in parallel. You can specify a number, such as 10, or a percentage, such as 10%. required: false - name: max_errors description: The number of errors that are allowed before the system stops running the automation on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. required: false - name: target_parameter_name description: The name of the parameter used as the target resource for the rate-controlled execution. required: false - name: targets description: "A semicolon-separated list of key-value mapping to target resources in the format key=,values=,. For example: key=tag:Env,values=prod." required: false - name: target_locations description: "A semicolon-separated list of target location entries in the format key=,value=. Supported fields: Accounts, Regions, ExecutionRoleName, TargetLocationMaxConcurrency, TargetLocationMaxErrors. For example: key=Accounts,value=123456789012;key=Regions,value=us-east-1." required: false - name: target_locations_url description: A publicly accessible URL for a file that contains the TargetLocations body. Use this parameter if you want to specify a large number of targets without providing them inline. required: false - name: target_maps description: "A semicolon-separated list of key-value maps in the format key=,values=,;key=,values=. Each entry maps document parameters to target resources." required: false - name: alarm_names description: A comma-separated list of CloudWatch alarm names to apply to the automation execution. required: false isArray: true - name: alarm_ignore_poll_failure description: Whether the automation continues to run even if CloudWatch alarm status cannot be retrieved. required: false auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' - name: tags description: "A semicolon-separated list of optional metadata to assign to the execution in the format key=,value=." required: false - name: interval_in_seconds description: The interval in seconds between polling attempts. required: false defaultValue: '30' - name: polling_timeout description: The timeout in seconds until polling ends. required: false defaultValue: '600' - name: execution_id description: The automation execution ID. Used internally for polling. Do not set manually. hidden: true - name: hide_polling_output description: Hide the polling message and only print the final status at the end. hidden: true outputs: - contextPath: AWS.SSM.AutomationExecutions.AutomationExecutionId description: The execution ID. type: String - contextPath: AWS.SSM.AutomationExecutions.DocumentName description: The name of the Automation runbook used during execution. type: String - contextPath: AWS.SSM.AutomationExecutions.DocumentVersion description: The document version used during the execution. type: String - contextPath: AWS.SSM.AutomationExecutions.ExecutionStartTime description: The time the execution started. type: Date - contextPath: AWS.SSM.AutomationExecutions.ExecutionEndTime description: The time the execution finished. type: Date - contextPath: AWS.SSM.AutomationExecutions.AutomationExecutionStatus description: The status of the execution. type: String - contextPath: AWS.SSM.AutomationExecutions.StepExecutions description: A list of details about the current state of all steps that comprise an execution, containing StepName, Action, StepStatus, Inputs, Outputs, StepExecutionId, and other fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.StepExecutionsTruncated description: Whether the response contains the full list of the Automation step executions. type: Boolean - contextPath: AWS.SSM.AutomationExecutions.Parameters description: The key-value map of execution parameters supplied when calling StartAutomationExecution. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.Outputs description: The list of execution outputs as defined in the Automation runbook. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.FailureMessage description: A message describing why an execution has failed, if the status is set to Failed. type: String - contextPath: AWS.SSM.AutomationExecutions.Mode description: The Automation execution mode. type: String - contextPath: AWS.SSM.AutomationExecutions.ParentAutomationExecutionId description: The execution ID of the parent automation. type: String - contextPath: AWS.SSM.AutomationExecutions.ExecutedBy description: The IAM role ARN of the user who ran the Automation. type: String - contextPath: AWS.SSM.AutomationExecutions.CurrentStepName description: The name of the step that is currently running. type: String - contextPath: AWS.SSM.AutomationExecutions.CurrentAction description: The action of the step that is currently running. type: String - contextPath: AWS.SSM.AutomationExecutions.TargetParameterName description: The parameter name used as the target resource for the rate-controlled execution. type: String - contextPath: AWS.SSM.AutomationExecutions.Targets.Key description: The user-defined criteria for sending commands that target managed nodes. type: String - contextPath: AWS.SSM.AutomationExecutions.Targets.Values description: The user-defined values that map to the key. type: String - contextPath: AWS.SSM.AutomationExecutions.ResolvedTargets description: A list of resolved targets in the rate control execution, containing ParameterValues and Truncated fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.MaxConcurrency description: The MaxConcurrency value specified by the user when starting the automation. type: String - contextPath: AWS.SSM.AutomationExecutions.MaxErrors description: The MaxErrors value specified by the user when starting the automation. type: String - contextPath: AWS.SSM.AutomationExecutions.Target description: The target of the execution. type: String - contextPath: AWS.SSM.AutomationExecutions.TargetLocations description: The combination of AWS regions and/or AWS accounts where you want to run the Automation, containing Accounts, Regions, TargetLocationMaxConcurrency, TargetLocationMaxErrors, and ExecutionRoleName fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.ProgressCounters description: An aggregate of step execution statuses displayed in the AWS console for a multi-Region and multi-account Automation execution, containing TotalSteps, SuccessSteps, FailedSteps, CancelledSteps, and TimedOutSteps fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.TargetLocationsURL description: Specify a publicly accessible URL for a file that contains the TargetLocations body. Currently, only files in presigned Amazon S3 buckets are supported. type: String - contextPath: AWS.SSM.AutomationExecutions.AlarmConfiguration description: The details for the CloudWatch alarm applied to your automation, containing IgnorePollAlarmFailure and Alarms fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.TriggeredAlarms description: The CloudWatch alarm that was invoked by the automation, containing Name and State fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.AutomationSubtype description: The subtype of the Automation operation. type: String - contextPath: AWS.SSM.AutomationExecutions.ScheduledTime description: The date and time the Automation operation is scheduled to start. type: String - contextPath: AWS.SSM.AutomationExecutions.Runbooks description: The information about the Automation runbooks that are run during a runbook workflow, containing DocumentName, DocumentVersion, Parameters, TargetParameterName, Targets, TargetMaps, MaxConcurrency, MaxErrors, and TargetLocations fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.OpsItemId description: The ID of an OpsItem that is created to represent a Change Manager change request. type: String - contextPath: AWS.SSM.AutomationExecutions.AssociationId description: The ID of a State Manager association used in the Automation operation. type: String - contextPath: AWS.SSM.AutomationExecutions.ChangeRequestName description: The name of the Change Manager change request. type: String - name: aws-ssm-automation-execution-cancel description: "Stop an Automation that is currently running and polls until the cancellation is confirmed. Required IAM Permissions: ssm:StopAutomationExecution, ssm:GetAutomationExecution." polling: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: automation_execution_id description: The execution ID of the Automation to stop. required: true - name: type description: The stop request type. Valid values are Cancel and Complete. The default value is Cancel. required: false auto: PREDEFINED predefined: - Cancel - Complete defaultValue: Cancel - name: interval_in_seconds description: The interval in seconds between polling attempts. required: false defaultValue: '30' - name: polling_timeout description: The timeout in seconds until polling ends. required: false defaultValue: '600' - name: first_run description: Used internally for polling state. Do not set manually. hidden: true defaultValue: 'true' - name: hide_polling_output description: Hide the polling message and only print the final status at the end. hidden: true outputs: - contextPath: AWS.SSM.AutomationExecutions.AutomationExecutionId description: The execution ID. type: String - contextPath: AWS.SSM.AutomationExecutions.DocumentName description: The name of the Automation runbook used during execution. type: String - contextPath: AWS.SSM.AutomationExecutions.DocumentVersion description: The document version used during the execution. type: String - contextPath: AWS.SSM.AutomationExecutions.ExecutionStartTime description: The time the execution started. type: Date - contextPath: AWS.SSM.AutomationExecutions.ExecutionEndTime description: The time the execution finished. type: Date - contextPath: AWS.SSM.AutomationExecutions.AutomationExecutionStatus description: The status of the execution after cancellation. type: String - contextPath: AWS.SSM.AutomationExecutions.StepExecutions description: A list of details about the current state of all steps that comprise an execution, containing StepName, Action, StepStatus, Inputs, Outputs, StepExecutionId, and other fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.StepExecutionsTruncated description: Whether the response contains the full list of the Automation step executions. type: Boolean - contextPath: AWS.SSM.AutomationExecutions.Parameters description: The key-value map of execution parameters supplied when calling StartAutomationExecution. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.Outputs description: The list of execution outputs as defined in the Automation runbook. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.FailureMessage description: A message describing why an execution has failed, if the status is set to Failed. type: String - contextPath: AWS.SSM.AutomationExecutions.Mode description: The Automation execution mode. type: String - contextPath: AWS.SSM.AutomationExecutions.ExecutedBy description: The IAM role ARN of the user who ran the Automation. type: String - contextPath: AWS.SSM.AutomationExecutions.CurrentStepName description: The name of the step that is currently running. type: String - contextPath: AWS.SSM.AutomationExecutions.CurrentAction description: The action of the step that is currently running. type: String - contextPath: AWS.SSM.AutomationExecutions.TargetParameterName description: The parameter name used as the target resource for the rate-controlled execution. type: String - contextPath: AWS.SSM.AutomationExecutions.Targets.Key description: The user-defined criteria for sending commands that target managed nodes. type: String - contextPath: AWS.SSM.AutomationExecutions.Targets.Values description: The user-defined values that map to the key. type: String - contextPath: AWS.SSM.AutomationExecutions.MaxConcurrency description: The MaxConcurrency value specified by the user when starting the automation. type: String - contextPath: AWS.SSM.AutomationExecutions.MaxErrors description: The MaxErrors value specified by the user when starting the automation. type: String - contextPath: AWS.SSM.AutomationExecutions.Target description: The target of the execution. type: String - contextPath: AWS.SSM.AutomationExecutions.ProgressCounters description: An aggregate of step execution statuses displayed in the AWS console for a multi-Region and multi-account Automation execution, containing TotalSteps, SuccessSteps, FailedSteps, CancelledSteps, and TimedOutSteps fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.AlarmConfiguration description: The details for the CloudWatch alarm applied to your automation, containing IgnorePollAlarmFailure and Alarms fields. type: Unknown - contextPath: AWS.SSM.AutomationExecutions.TriggeredAlarms description: The CloudWatch alarm that was invoked by the automation, containing Name and State fields. type: Unknown - name: aws-ssm-commands-list description: "Lists the commands requested by users of the AWS account. Required IAM Permission: ssm:ListCommands." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: command_id description: If provided, lists only the specified command. required: false - name: instance_id description: Lists commands issued against this managed node ID. required: false - name: filters description: "A semicolon-separated list of filters in the format key=,value=. Valid filter keys: InvokedAfter, InvokedBefore, Status, ExecutionStage, DocumentName. For example: key=Status,value=Success." required: false - name: limit description: The maximum number of items to return for this call. The minimum is 1 and the maximum is 50. required: false defaultValue: '50' - name: next_token description: The token for the next set of items to return. Use AWS.SSM.CommandNextToken. required: false outputs: - contextPath: AWS.SSM.Command.CommandId description: A unique identifier for this command. type: String - contextPath: AWS.SSM.Command.DocumentName description: The name of the document requested for execution. type: String - contextPath: AWS.SSM.Command.DocumentVersion description: The Systems Manager document (SSM document) version. type: String - contextPath: AWS.SSM.Command.Comment description: User-specified information about the command, such as a brief description of what the command should do. type: String - contextPath: AWS.SSM.Command.ExpiresAfter description: The command expiration time, after which the status for all InProgress, Pending, or Delayed invocations changes to DeliveryTimedOut. type: Date - contextPath: AWS.SSM.Command.Parameters description: The parameter values to be inserted in the document when running the command. type: Unknown - contextPath: AWS.SSM.Command.InstanceIds description: The managed node IDs against which this command was requested. type: Unknown - contextPath: AWS.SSM.Command.Targets.Key description: The user-defined criteria for sending commands that target managed nodes. type: String - contextPath: AWS.SSM.Command.Targets.Values description: The user-defined values that map to the key. type: String - contextPath: AWS.SSM.Command.RequestedDateTime description: The date and time the command was requested. type: Date - contextPath: AWS.SSM.Command.Status description: The status of the command. type: String - contextPath: AWS.SSM.Command.StatusDetails description: A detailed status of the command execution. type: String - contextPath: AWS.SSM.Command.OutputS3Region description: The Amazon Web Services region of the S3 bucket. type: String - contextPath: AWS.SSM.Command.OutputS3BucketName description: The name of the S3 bucket where command execution responses should be stored. type: String - contextPath: AWS.SSM.Command.OutputS3KeyPrefix description: The directory structure within the S3 bucket where the responses should be stored. type: String - contextPath: AWS.SSM.Command.MaxConcurrency description: The maximum number of managed nodes that are allowed to run the command at the same time. type: String - contextPath: AWS.SSM.Command.MaxErrors description: The maximum number of errors allowed before the system stops sending the command to additional targets. type: String - contextPath: AWS.SSM.Command.TargetCount description: The number of targets for the command. type: Number - contextPath: AWS.SSM.Command.CompletedCount description: The number of targets for which the command invocation reached a terminal state. type: Number - contextPath: AWS.SSM.Command.ErrorCount description: The number of targets for which the status is Failed or Execution Timed Out. type: Number - contextPath: AWS.SSM.Command.DeliveryTimedOutCount description: The number of targets for which the status is Delivery Timed Out. type: Number - contextPath: AWS.SSM.Command.ServiceRole description: The IAM service role that run command uses to act on your behalf when sending notifications about command status changes. type: String - contextPath: AWS.SSM.Command.NotificationConfig description: The configurations for sending notifications about command status changes, containing NotificationArn, NotificationEvents, and NotificationType fields. type: Unknown - contextPath: AWS.SSM.Command.CloudWatchOutputConfig description: CloudWatch Logs configuration for the command, containing CloudWatchLogGroupName and CloudWatchOutputEnabled fields. type: Unknown - contextPath: AWS.SSM.Command.TimeoutSeconds description: The TimeoutSeconds value specified for a command. type: Number - contextPath: AWS.SSM.Command.AlarmConfiguration description: The details for the CloudWatch alarm applied to your command, containing IgnorePollAlarmFailure and Alarms fields. type: Unknown - contextPath: AWS.SSM.Command.TriggeredAlarms description: The CloudWatch alarm that was invoked by the command, containing Name and State fields. type: Unknown - contextPath: AWS.SSM.CommandNextToken description: The token to use when requesting the next set of items. type: String - name: aws-ssm-command-cancel description: "Attempts to cancel the command specified and optionally polls until the cancellation is confirmed. Required IAM Permissions: ssm:CancelCommand, ssm:ListCommands." polling: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: command_id description: The ID of the command you want to cancel. required: true - name: instance_ids description: A comma-separated list of managed node IDs on which you want to cancel the command. If not provided, the command is canceled on every node on which it was requested. required: false isArray: true - name: interval_in_seconds description: The interval in seconds between polling attempts. required: false defaultValue: '30' - name: polling_timeout description: The timeout in seconds until polling ends. required: false defaultValue: '600' - name: first_run description: Used internally for polling state. Do not set manually. hidden: true defaultValue: 'true' - name: hide_polling_output description: Hide the polling message and only print the final status at the end. hidden: true - name: aws-ssm-tag-remove description: "Removes tag keys from the specified resource. Required IAM Permission: ssm:RemoveTagsFromResource." execution: true arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_type description: The type of resource from which to remove tags. required: true auto: PREDEFINED predefined: - Association - Automation - Document - MaintenanceWindow - ManagedInstance - OpsItem - OpsMetadata - PatchBaseline - Parameter - name: resource_id description: The ID of the resource from which to remove tags. required: true - name: tag_keys description: A comma-separated list of tag keys to remove from the resource. required: true isArray: true - name: aws-network-firewall-firewall-describe description: "Returns the data objects for the specified firewall. Required permissions: network-firewall:DescribeFirewall." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: firewall_name description: The descriptive name of the firewall. Cannot be changed after creation. Required if the firewall ARN is not specified, though both can be provided. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. Required if the firewall name is not specified, though both can be provided. outputs: - contextPath: AWS.NetworkFirewall.Firewalls.FirewallName description: The descriptive name of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallArn description: The Amazon Resource Name (ARN) of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallPolicyArn description: The Amazon Resource Name (ARN) of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.Firewalls.VpcId description: The unique identifier of the VPC where the firewall is in use. type: String - contextPath: AWS.NetworkFirewall.Firewalls.Description description: The description of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallId description: The unique identifier for the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.UpdateToken description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. type: String - contextPath: AWS.NetworkFirewall.Firewalls.SubnetMappings.SubnetId description: The unique identifier for the subnet. type: String - contextPath: AWS.NetworkFirewall.Firewalls.SubnetMappings.IPAddressType description: The subnet's IP address type. type: String - contextPath: AWS.NetworkFirewall.Firewalls.DeleteProtection description: Whether it is possible to delete the firewall. type: Boolean - contextPath: AWS.NetworkFirewall.Firewalls.SubnetChangeProtection description: Whether the firewall is protected against changes to the subnet associations. type: Boolean - contextPath: AWS.NetworkFirewall.Firewalls.FirewallPolicyChangeProtection description: Whether the firewall is protected against a change to the firewall policy association. type: Boolean - contextPath: AWS.NetworkFirewall.Firewalls.Tags.Key description: The key of the tag. type: String - contextPath: AWS.NetworkFirewall.Firewalls.Tags.Value description: The value of the tag. type: String - contextPath: AWS.NetworkFirewall.Firewalls.EncryptionConfiguration.KeyId description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. type: String - contextPath: AWS.NetworkFirewall.Firewalls.EncryptionConfiguration.Type description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. type: String - contextPath: AWS.NetworkFirewall.Firewalls.NumberOfAssociations description: The number of associations. type: Number - contextPath: AWS.NetworkFirewall.Firewalls.EnabledAnalysisTypes description: The enabled analysis types. type: String - contextPath: AWS.NetworkFirewall.Firewalls.TransitGatewayId description: The unique identifier for the transit gateway. type: String - contextPath: AWS.NetworkFirewall.Firewalls.TransitGatewayOwnerAccountId description: The account ID of the transit gateway owner. type: String - contextPath: AWS.NetworkFirewall.Firewalls.AvailabilityZoneMappings.AvailabilityZone description: The Availability Zone. type: String - contextPath: AWS.NetworkFirewall.Firewalls.AvailabilityZoneChangeProtection description: Whether the firewall is protected against changes to the Availability Zone associations. type: Boolean - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.Status description: The readiness status of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.ConfigurationSyncStateSummary description: The configuration sync state for the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.SyncStates description: The status for the subnets configured in the firewall. type: Unknown - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.CapacityUsageSummary description: The capacity usage of the resources contained in a firewall’s reference sets. type: Unknown - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.TransitGatewayAttachmentSyncState description: The synchronization state of the transit gateway attachment. Indicates whether the firewall’s transit gateway configuration is properly synchronized and operational. type: Unknown - name: aws-network-firewall-firewalls-list description: "Retrieves the metadata for the firewalls that you have defined. Required permissions: network-firewall:ListFirewalls." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: limit defaultValue: '50' description: The maximum number of Network Firewall objects to return for this request. - name: next_token description: The NextToken value returned from a previous paginated ListFirewalls request. The next_token will be at AWS.NetworkFirewall.FirewallsNextToken. - name: vpc_ids description: A comma-separated list of unique identifiers of the VPCs that you want to retrieve the firewalls for. isArray: true outputs: - contextPath: AWS.NetworkFirewall.Firewalls.FirewallName description: The descriptive name of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallArn description: The Amazon Resource Name (ARN) of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.TransitGatewayAttachmentId description: The unique identifier of the transit gateway attachment associated with this firewall. This field is only present for transit gateway-attached firewalls. type: String - contextPath: AWS.NetworkFirewall.FirewallsNextToken description: The token used to request the next page of results when a limit is set. Provided in the response of a previous request when the number of remaining objects exceeds the maximum limit specified. type: String - name: aws-network-firewall-firewall-create description: "Creates an AWS Network Firewall firewall for your VPC. Required permissions: network-firewall:CreateFirewall, network-firewall:TagResource, ec2:DescribeSubnets, ec2:DescribeVpcs, network-firewall:DescribeFirewallPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: firewall_name required: true description: The descriptive name of the firewall. - name: firewall_policy_arn required: true description: The Amazon Resource Name (ARN) of the FirewallPolicy that you want to use for the firewall. - name: vpc_id description: The unique identifier of the VPC where Network Firewall should create the firewall. - name: subnet_mappings description: 'A JSON string specifying the public subnets to use for your Network Firewall firewalls. [{\"SubnetId\": \"string\", \"IPAddressType\": \"DUALSTACK\"}]. The possible values for the IPAddressType are DUALSTACK, IPV4 ,IPV6.' - name: delete_protection auto: PREDEFINED predefined: - "true" - "false" description: Whether the firewall is protected against deletion. If "true", deletion protection is enabled, preventing accidental deletion. If "false", the firewall can be deleted. Default is "true". - name: subnet_change_protection auto: PREDEFINED predefined: - "true" - "false" description: Whether the firewall is protected against changes to the subnet associations. If "true", configuration changes to subnet associations are blocked to prevent accidental modifications. If "false", subnet associations can be modified. Default is "true". - name: firewall_policy_change_protection auto: PREDEFINED predefined: - "true" - "false" description: Whether the firewall is protected against changes to the firewall policy association. If "true", changes to the firewall policy association are blocked to prevent accidental modifications. If "false", the firewall policy association can be modified. Default is "true". - name: description description: A description of the firewall. - name: tags description: 'The key:value pairs to associate with the resource. For example: key=abc,value=123;key=fed,value=456.' - name: encryption_config_id description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. - name: encryption_config_type description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. auto: PREDEFINED predefined: - CUSTOMER_KMS - AWS_OWNED_KMS_KEY - name: enabled_analysis_types description: "A comma-separated list of the enabled analysis types to enable on the firewall. Valid Values: TLS_SNI | HTTP_HOST." isArray: true - name: transit_gateway_id description: The unique identifier for the transit gateway. Required when creating a transit gateway-attached firewall. After creating the firewall, you cannot change the transit gateway association. To use a different transit gateway, you must create a new firewall. - name: availability_zone_mappings description: A comma-separated list of Availability Zones where you want to create firewall endpoints for a transit gateway-attached firewall. isArray: true - name: availability_zone_change_protection description: Whether the firewall is protected against changes to its Availability Zone configuration. auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: AWS.NetworkFirewall.Firewalls.FirewallName description: The descriptive name of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallArn description: The Amazon Resource Name (ARN) of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallPolicyArn description: The Amazon Resource Name (ARN) of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.Firewalls.VpcId description: The unique identifier of the VPC where the firewall is in use. type: String - contextPath: AWS.NetworkFirewall.Firewalls.SubnetMappings.SubnetId description: The unique identifier for the subnet. type: String - contextPath: AWS.NetworkFirewall.Firewalls.SubnetMappings.IPAddressType description: The subnet's IP address type. type: String - contextPath: AWS.NetworkFirewall.Firewalls.DeleteProtection description: Whether it is possible to delete the firewall. type: Boolean - contextPath: AWS.NetworkFirewall.Firewalls.SubnetChangeProtection description: Whether it is possible to change the associated subnet(s). type: Boolean - contextPath: AWS.NetworkFirewall.Firewalls.FirewallPolicyChangeProtection description: Whether it is possible to change the associated firewall policy. type: Boolean - contextPath: AWS.NetworkFirewall.Firewalls.Description description: The description of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallId description: The unique identifier for the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.Tags.Key description: The key of the tag. type: String - contextPath: AWS.NetworkFirewall.Firewalls.Tags.Value description: The value of the tag. type: String - contextPath: AWS.NetworkFirewall.Firewalls.EncryptionConfiguration.KeyId description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. type: String - contextPath: AWS.NetworkFirewall.Firewalls.EncryptionConfiguration.Type description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. type: String - contextPath: AWS.NetworkFirewall.Firewalls.NumberOfAssociations description: The number of VpcEndpointAssociation resources that use this firewall. type: Number - contextPath: AWS.NetworkFirewall.Firewalls.EnabledAnalysisTypes description: The enabled analysis types. type: String - contextPath: AWS.NetworkFirewall.Firewalls.TransitGatewayId description: The unique identifier of the transit gateway associated with this firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.TransitGatewayOwnerAccountId description: The Amazon Web Services account ID that owns the transit gateway. type: String - contextPath: AWS.NetworkFirewall.Firewalls.AvailabilityZoneMappings.AvailabilityZone description: The ID of the Availability Zone where the firewall endpoint is located. type: String - contextPath: AWS.NetworkFirewall.Firewalls.AvailabilityZoneChangeProtection description: Whether the firewall is protected against changes to its Availability Zone configuration. type: Boolean - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.Status description: The readiness status of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.ConfigurationSyncStateSummary description: The configuration sync state for the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.SyncStates description: The status for the subnets configured in the firewall. type: Unknown - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.CapacityUsageSummary description: The capacity usage of the resources contained in a firewall’s reference sets. type: Unknown - contextPath: AWS.NetworkFirewall.Firewalls.FirewallStatus.TransitGatewayAttachmentSyncState description: The synchronization state of the transit gateway attachment. Indicates whether the firewall’s transit gateway configuration is properly synchronized and operational. type: Unknown - name: aws-network-firewall-firewall-delete description: "Deletes the specified firewall and its status. Requires the firewall deletion protection flag to be 'false'. This operation is irreversible. Required permissions: network-firewall:DeleteFirewall." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: firewall_name description: The descriptive name of the firewall. Cannot be changed after creation. Required if the firewall ARN is not specified, though both can be provided. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. Required if the firewall name is not specified, though both can be provided. - name: aws-network-firewall-firewall-delete-protection-update description: "Modifies the flag, DeleteProtection, which indicates whether it is possible to delete the firewall. Requires permissions: network-firewall:UpdateFirewallDeleteProtection." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. - name: firewall_name description: The descriptive name of the firewall. Cannot be changed after creation. Required if the firewall ARN is not specified, though both can be provided. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. Required if the firewall name is not specified, though both can be provided. - name: delete_protection description: Whether the firewall is protected against deletion. If "true", deletion protection is enabled, preventing accidental deletion. If "false", the firewall can be deleted. Default is "true". required: true auto: PREDEFINED predefined: - "true" - "false" - name: aws-network-firewall-firewall-description-update description: "Modifies the description for the specified firewall. Required permissions: network-firewall:UpdateFirewallDescription." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. - name: firewall_name description: The descriptive name of the firewall. Cannot be changed after creation. Required if the firewall ARN is not specified, though both can be provided. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. Required if the firewall name is not specified, though both can be provided. - name: description description: The new description for the firewall. If you omit this setting, Network Firewall removes the description for the firewall. required: true type: String - name: aws-network-firewall-firewall-policies-list description: "Retrieves the metadata for the firewall policies that you have defined. Required permissions: network-firewall:ListFirewallPolicies." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: limit description: The maximum number of Network Firewall objects to return for this request. Default value is 50. - name: next_token description: The nextToken value returned from a previous paginated request. You can find it under AWS.NetworkFirewall.FirewallPoliciesNextToken. outputs: - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyName description: The descriptive name of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyArn description: The Amazon Resource Name (ARN) of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPoliciesNextToken description: The token used to retrieve the next set of results from Network Firewall. Returns a NextToken value when the number of available objects exceeds the requested limit. type: String - name: aws-network-firewall-firewall-policy-describe description: "Returns the data objects for the specified firewall policy. Required permissions: network-firewall:DescribeFirewallPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: firewall_policy_name description: The descriptive name of the firewall policy. You must specify the ARN or the name, and you can specify both. - name: firewall_policy_arn description: The Amazon Resource Name (ARN) of the firewall policy. You must specify the ARN or the name, and you can specify both. outputs: - contextPath: AWS.NetworkFirewall.FirewallPolicies.UpdateToken description: The token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyName description: The descriptive name of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyArn description: The Amazon Resource Name (ARN) of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyId description: The unique identifier for the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.Description description: The description of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyStatus description: The current status of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.Tags description: The key:value pairs to associate with the resource. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.ConsumedStatelessRuleCapacity description: The number of capacity units currently consumed by the policy's stateless rules. type: Number - contextPath: AWS.NetworkFirewall.FirewallPolicies.ConsumedStatefulRuleCapacity description: The number of capacity units currently consumed by the policy's stateful rules. type: Number - contextPath: AWS.NetworkFirewall.FirewallPolicies.ConsumedStatefulDomainCapacity description: The total number of domain name specifications across all domain list rule groups in the firewall policy that use the stateful-domain-rulegroup resource type. type: Number - contextPath: AWS.NetworkFirewall.FirewallPolicies.NumberOfAssociations description: The number of firewalls that are associated with this firewall policy. type: Number - contextPath: AWS.NetworkFirewall.FirewallPolicies.EncryptionConfiguration description: The complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall policy. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.LastModifiedTime description: The last time that the firewall policy was changed. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.StatelessRuleGroupReferences description: The references to the stateless rule groups that are used in the policy. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.StatelessDefaultActions description: The actions to take on a packet if it doesn't match any of the stateless rules in the policy. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.StatelessFragmentDefaultActions description: The actions to take on a fragmented UDP packet if it doesn't match any of the stateless rules in the policy. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.StatelessCustomActions description: The custom action definitions that are available for use in the firewall policy's stateless default actions setting. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.StatefulRuleGroupReferences description: The references to the stateful rule groups that are used in the policy. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.StatefulDefaultActions description: The default actions to take on a packet that doesn't match any stateful rules. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.StatefulEngineOptions description: The additional options governing how Network Firewall handles stateful rules. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.TLSInspectionConfigurationArn description: The Amazon Resource Name (ARN) of the TLS inspection configuration. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.PolicyVariables description: The variables that you can use to override default Suricata settings in your firewall policy. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.EnableTLSSessionHolding description: Whether TCP and TLS packets are prevented from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. type: Boolean - name: aws-network-firewall-firewall-policy-create description: "Creates the firewall policy for the firewall according to the specifications. You must specify at least one of the firewall policy characteristic arguments. Required permissions: network-firewall:CreateFirewallPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: firewall_policy_name description: The descriptive name of the firewall policy. You can't change the name of a firewall policy after you create it. required: true - name: stateless_rule_group_references description: The ResourceArn:Priority pairs, references to the stateless rule groups that are used in the policy. Format is ResourceArn=arn1,Priority=priority1;ResourceArn=arn1,Priority=priority2. - name: stateless_default_actions description: A comma-separated list of the actions to take on a packet if it doesn’t match any of the stateless rules in the policy. isArray: true - name: stateless_fragment_default_actions description: A comma-separated list of the actions to take on a fragmented UDP packet if it doesn’t match any of the stateless rules in the policy. isArray: true - name: stateless_custom_actions description: 'A JSON string specifying the custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting. For example: `[{"ActionName": "string", "ActionDefinition": {"PublishMetricAction": {"Dimensions":[{"Value": "string"}]}}}]`.' - name: stateful_rule_group_references description: 'A semicolon-separated list of stateful rule group references used in the policy. Each reference is a comma-separated list of fields where only ResourceArn is required; Priority, Override (the action) and DeepThreatInspection are optional. For example: ResourceArn=arn:aws:1,Priority=1,Override=DROP_TO_ALERT,DeepThreatInspection=True;ResourceArn=arn:aws:2,Priority=2.' - name: stateful_default_actions description: A comma-separated list of the default actions to take on a packet that doesn’t match any stateful rules. isArray: true - name: stateful_engine_options_rule_order description: The order of stateful rule evaluation for the policy. auto: PREDEFINED predefined: - DEFAULT_ACTION_ORDER - STRICT_ORDER - name: stateful_engine_options_stream_exception_policy description: The configuration of how Network Firewall processes traffic when a network connection breaks midstream. auto: PREDEFINED predefined: - DROP - CONTINUE - REJECT - name: stateful_engine_options_tcp_idle_timeout description: The number of seconds that can pass without any TCP traffic sent through the firewall before the firewall determines that the connection is idle. - name: tls_inspection_configuration_arn description: The Amazon Resource Name (ARN) of the TLS inspection configuration. - name: policy_rule_variables description: 'A JSON string specifying the IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable. For example: `{"string": {"Definition": ["string",]}}`.' - name: description description: The description of the firewall policy. - name: tags description: The key:value pairs to associate with the resource. Format is key=key1,value=value1;key=key2,value=value2. - name: enable_tls_session_holding description: Whether to prevent TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. Requires an associated TLS Inspection configuration. auto: PREDEFINED predefined: - "true" - "false" - name: encryption_configuration_key_id description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. - name: encryption_configuration_key_type description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. auto: PREDEFINED predefined: - CUSTOMER_KMS - AWS_OWNED_KMS_KEY outputs: - contextPath: AWS.NetworkFirewall.FirewallPolicies.UpdateToken description: The token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyName description: The descriptive name of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyArn description: The Amazon Resource Name (ARN) of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyId description: The unique identifier for the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.Description description: The description of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.FirewallPolicyStatus description: The current status of the firewall policy. type: String - contextPath: AWS.NetworkFirewall.FirewallPolicies.Tags description: The key:value pairs to associate with the resource. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.ConsumedStatelessRuleCapacity description: The number of capacity units currently consumed by the policy's stateless rules. type: Number - contextPath: AWS.NetworkFirewall.FirewallPolicies.ConsumedStatefulRuleCapacity description: The number of capacity units currently consumed by the policy's stateful rules. type: Number - contextPath: AWS.NetworkFirewall.FirewallPolicies.ConsumedStatefulDomainCapacity description: The total number of domain name specifications across all domain list rule groups in the firewall policy that use the stateful-domain-rulegroup resource type. type: Number - contextPath: AWS.NetworkFirewall.FirewallPolicies.NumberOfAssociations description: The number of firewalls that are associated with this firewall policy. type: Number - contextPath: AWS.NetworkFirewall.FirewallPolicies.EncryptionConfiguration description: The complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall policy. type: Unknown - contextPath: AWS.NetworkFirewall.FirewallPolicies.LastModifiedTime description: The last time that the firewall policy was changed. type: String - name: aws-network-firewall-firewall-policy-associate description: "Associates a firewall policy to a firewall. A firewall policy defines how to monitor and manage your VPC network traffic, using a collection of inspection rule groups and other settings. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls. Required permissions: network-firewall:AssociateFirewallPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. - name: firewall_name description: The descriptive name of the firewall. You can't change the name of a firewall after you create it. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. - name: firewall_policy_arn description: The Amazon Resource Name (ARN) of the firewall policy. required: true outputs: - contextPath: AWS.NetworkFirewall.Firewalls.FirewallArn description: The Amazon Resource Name (ARN) of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallName description: The descriptive name of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallPolicyArn description: The Amazon Resource Name (ARN) of the firewall policy that was associated with the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.UpdateToken description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. type: String - name: aws-network-firewall-firewall-policy-delete description: "Deletes the specified FirewallPolicy. Required permissions: network-firewall:DeleteFirewallPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: firewall_policy_name description: The descriptive name of the firewall policy. You must specify the ARN or the name, and you can specify both. - name: firewall_policy_arn description: The Amazon Resource Name (ARN) of the firewall policy. You must specify the ARN or the name, and you can specify both. - name: aws-network-firewall-firewall-policy-update description: "Updates the properties of the specified firewall policy. Required permissions: network-firewall:UpdateFirewallPolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-west-3 - eu-south-2 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: The token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request. required: true - name: firewall_policy_arn description: The Amazon Resource Name (ARN) of the firewall policy. You must specify the ARN or the name, and you can specify both. - name: firewall_policy_name description: The descriptive name of the firewall policy. You can't change the name of a firewall policy after you create it. You must specify the ARN or the name, and you can specify both. - name: stateless_rule_group_references description: The ResourceArn:Priority pairs, references to the stateless rule groups that are used in the policy. Format is ResourceArn=arn1,Priority=priority1;ResourceArn=arn1,Priority=priority2. - name: stateless_default_actions description: A comma-separated list of the actions to take on a packet if it doesn’t match any of the stateless rules in the policy. isArray: true - name: stateless_fragment_default_actions description: A comma-separated list of the actions to take on a fragmented UDP packet if it doesn’t match any of the stateless rules in the policy. isArray: true - name: stateless_custom_actions description: 'A JSON string specifying the custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting. For example: `[{"ActionName": "string", "ActionDefinition": {"PublishMetricAction": {"Dimensions":[{"Value": "string"}]}}}]`.' - name: stateful_rule_group_references description: 'A semicolon-separated list of stateful rule group references used in the policy. Each reference is a comma-separated list of fields where only ResourceArn is required; Priority, Override (the action) and DeepThreatInspection are optional. For example: `ResourceArn=arn:aws:1,Priority=1,Override=DROP_TO_ALERT,DeepThreatInspection=True;ResourceArn=arn:aws:2,Priority=2`.' - name: stateful_default_actions description: A comma-separated list of the default actions to take on a packet that doesn’t match any stateful rules. isArray: true - name: stateful_engine_options_rule_order description: The order of stateful rule evaluation for the policy. auto: PREDEFINED predefined: - DEFAULT_ACTION_ORDER - STRICT_ORDER - name: stateful_engine_options_stream_exception_policy description: The configuration of how Network Firewall processes traffic when a network connection breaks midstream. auto: PREDEFINED predefined: - DROP - CONTINUE - REJECT - name: stateful_engine_options_tcp_idle_timeout description: The number of seconds that can pass without any TCP traffic sent through the firewall before the firewall determines that the connection is idle. - name: tls_inspection_configuration_arn description: The Amazon Resource Name (ARN) of the TLS inspection configuration. - name: policy_rule_variables description: 'A JSON string specifying the IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable. For example: `{"string": {"Definition": ["string",]}}`.' - name: description description: The description of the firewall policy. - name: enable_tls_session_holding description: When true, prevents TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. Requires an associated TLS Inspection configuration. auto: PREDEFINED predefined: - 'true' - 'false' - name: encryption_configuration_key_id description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. - name: encryption_configuration_key_type description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. auto: PREDEFINED predefined: - CUSTOMER_KMS - AWS_OWNED_KMS_KEY - name: aws-network-firewall-firewall-policy-change-protection-update description: "Modifies the ChangeProtection flag, which indicates whether it is possible to change the firewall policy. Required permissions: network-firewall:UpdateFirewallPolicyChangeProtection." arguments: - name: account_id description: The AWS account ID. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex Platform (which includes Cortex XSIAM version >=3.0 and Cortex Cloud). Optional for Cortex XSOAR and Cortex XSIAM version < 3.0, where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request. - name: firewall_name description: The descriptive name of the firewall. You can't change the name of a firewall policy after you create it. You must specify the ARN or the name, and you can specify both. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. - name: firewall_policy_change_protection description: Whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE. required: true auto: PREDEFINED predefined: - "true" - "false" - name: aws-network-firewall-subnet-change-protection-update description: "Modifies the SubnetChangeProtection flag, which indicates whether it is possible to change the subnets associated with the firewall. Required permissions: network-firewall:UpdateSubnetChangeProtection." arguments: - name: account_id description: The AWS account ID. required: true - name: region description: The AWS region. required: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. - name: firewall_name description: The descriptive name of the firewall. Cannot be changed after creation. Required if the firewall ARN is not specified, though both can be provided. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. Required if the firewall name is not specified, though both can be provided. - name: subnet_change_protection description: Whether the firewall is protected against changes to the subnet associations. If "true", change protection is enabled, preventing changes to the subnets. If "false", the subnet associations can be changed. required: true auto: PREDEFINED predefined: - "true" - "false" - name: aws-network-firewall-subnets-associate description: "Associates the specified subnets in the Amazon VPC to the firewall. You can specify one subnet for each of the Availability Zones that the VPC spans. This is used to provide the firewall endpoints for the subnets. Required permissions: network-firewall:AssociateSubnets." arguments: - name: account_id description: The AWS account ID. required: true - name: region description: The AWS region. required: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. - name: firewall_name description: The descriptive name of the firewall. Cannot be changed after creation. Required if the firewall ARN is not specified, though both can be provided. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. Required if the firewall name is not specified, though both can be provided. - name: subnet_mappings description: 'The semicolon-separated list of subnet mappings to associate with the firewall. Each mapping is a comma-separated list of fields in the form ''SubnetId=,IPAddressType=''. SubnetId is required and IPAddressType (one of DUALSTACK, IPV4, IPV6) is optional. For example: SubnetId=subnet-1111,IPAddressType=IPV4;SubnetId=subnet-2222. You can specify one subnet for each of the Availability Zones that the VPC spans.' required: true outputs: - contextPath: AWS.NetworkFirewall.Firewalls.FirewallArn description: The Amazon Resource Name (ARN) of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallName description: The descriptive name of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.UpdateToken description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.SubnetMappings.SubnetId description: The unique identifier for the subnet. type: String - contextPath: AWS.NetworkFirewall.Firewalls.SubnetMappings.IPAddressType description: The subnet's IP address type. type: String - name: aws-network-firewall-subnets-disassociate description: "Disassociates the specified subnet associations from the firewall. This removes the firewall endpoints from the subnets and revokes any network filtering protections that the endpoints provided. Required permissions: network-firewall:DisassociateSubnets." arguments: - name: account_id description: The AWS account ID. required: true - name: region description: The AWS region. required: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. - name: firewall_name description: The descriptive name of the firewall. Cannot be changed after creation. Required if the firewall ARN is not specified, though both can be provided. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. Required if the firewall name is not specified, though both can be provided. - name: subnet_ids description: A comma-separated list of unique identifiers of the subnets that you want to disassociate from the firewall. required: true outputs: - contextPath: AWS.NetworkFirewall.Firewalls.FirewallArn description: The Amazon Resource Name (ARN) of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallName description: The descriptive name of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.UpdateToken description: The optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.SubnetMappings.SubnetId description: The unique identifier for the subnet. type: String - contextPath: AWS.NetworkFirewall.Firewalls.SubnetMappings.IPAddressType description: The subnet's IP address type. type: String - name: aws-network-firewall-rule-group-create description: "Creates a specified stateless or stateful rule group, which includes the rules for network traffic inspection, a capacity setting, and tags. You must provide either at least one of the rule group arguments (rules_source is required, and ip_sets, port_sets, ip_sets_references, and stateful_rule_options_rule_order are optional) or the rules argument. Required permissions: network-firewall:CreateRuleGroup, network-firewall:TagResource." arguments: - name: account_id description: The AWS account ID. required: true - name: region description: The AWS region. required: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: rule_group_name description: The descriptive name of the rule group. You can't change the name of a rule group after you create it. required: true - name: type description: The type of the rule group. Can be stateless or stateful. required: true auto: PREDEFINED predefined: - STATELESS - STATEFUL - STATEFUL_DOMAIN - name: capacity description: The maximum operating resources that the rule group can use. This value is fixed at creation and cannot be changed or exceeded in the firewall policy. required: true - name: ip_sets description: 'The JSON string specifying an object of IP addresses and address ranges in CIDR notation, used as part of RuleVariables. Example format: `{"string": {"Definition": ["string"]}}`.' - name: port_sets description: 'The JSON string specifying an object of port ranges, used as part of a RuleVariables. For example: `{"string": {"Definition": ["string"]}}`.' - name: ip_sets_references description: 'The JSON string specifying an object of IP set references. For example: `{"string": {"ReferenceArn": "string"}}`.' - name: rules_source description: 'The JSON string specifying the stateful rules or stateless rules for the rule group. Required if you choose to use the RuleGroup option. For example: `{"RulesString": "string", "RulesSourceList": {"Targets": ["string"]}}`.' - name: stateful_rule_options_rule_order description: The order of the rule evaluation for the rule group. auto: PREDEFINED predefined: - DEFAULT_ACTION_ORDER - STRICT_ORDER - name: rules description: 'The string containing stateful rule group rule specifications in Suricata flat format, with one rule per line (newline-separated). Use this to import existing Suricata compatible rule groups. Provide either this argument or at least one of the rule_group arguments (ip_sets, port_sets, ip_sets_references, rules_source, stateful_rule_options_rule_order), but not both. For example: `pass tcp 10.0.0.0/8 any -> any any (sid:1;)`.' - name: description description: The description of the rule group. - name: tags description: The key:value pairs to associate with the resource. Format is key=key1,value=value1;key=key2,value=value2. - name: encryption_configuration_key_id description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. - name: encryption_configuration_key_type description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. auto: PREDEFINED predefined: - CUSTOMER_KMS - AWS_OWNED_KMS_KEY - name: source_metadata_arn description: The Amazon Resource Name (ARN) of the rule group that your own rule group is copied from. - name: source_metadata_update_token description: The update token of the Amazon Web Services managed rule group that your own rule group is copied from. - name: analyze_rule_group description: Whether you want Network Firewall to analyze the stateless rules in the rule group for rule behavior such as asymmetric routing. If set to TRUE, Network Firewall runs the analysis and then creates the rule group for you. auto: PREDEFINED predefined: - 'true' - 'false' - name: summary_configuration_rule_options description: A comma-separated list of the rule options to include in the rule group summary. isArray: true outputs: - contextPath: AWS.NetworkFirewall.RuleGroups.UpdateToken description: The token used for optimistic locking, which tracks the state of the rule group resource at the time of the request. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupName description: The descriptive name of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupArn description: The Amazon Resource Name (ARN) of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupId description: The unique identifier for the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Description description: The description of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Type description: The type of the rule group. Can be stateless or stateful. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Capacity description: The maximum operating resources that this rule group can use. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupStatus description: The current status of a rule group, includes detailed information. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Tags description: The key:value pairs to associate with the resource. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.ConsumedCapacity description: The number of capacity units currently consumed by the rule group rules. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.NumberOfAssociations description: The number of firewall policies that use this rule group. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.EncryptionConfiguration description: The complex type that contains the Amazon Web Services KMS encryption configuration settings for your rule group. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.LastModifiedTime description: The last time that the rule group was changed. type: String - name: aws-network-firewall-rule-group-delete description: "Deletes the specified rule group. Required permissions: network-firewall:DeleteRuleGroup." arguments: - name: account_id description: The AWS account ID. required: true - name: region description: The AWS region. required: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: rule_group_name description: The descriptive name of the rule group. You must specify the ARN or the name, and you can specify both. - name: rule_group_arn description: The Amazon Resource Name (ARN) of the rule group. You must specify the ARN or the name, and you can specify both. - name: type description: The type of the rule group. Can be stateless or stateful. This setting is required for requests that do not include the rule_group_arn. auto: PREDEFINED predefined: - STATELESS - STATEFUL - STATEFUL_DOMAIN - name: aws-network-firewall-rule-group-describe description: "Returns the data objects for the specified rule group. Required permissions: network-firewall:DescribeRuleGroup." arguments: - name: account_id description: The AWS account ID. required: true - name: region description: The AWS region. required: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: rule_group_name description: The descriptive name of the rule group. You must specify the ARN or the name, and you can specify both. - name: rule_group_arn description: The Amazon Resource Name (ARN) of the rule group. You must specify the ARN or the name, and you can specify both. - name: type description: The type of the rule group. Can be stateless or stateful. This setting is required for requests that do not include the rule_group_arn. auto: PREDEFINED predefined: - STATELESS - STATEFUL - STATEFUL_DOMAIN - name: analyze_rule_group description: Whether you want Network Firewall to analyze the stateless rules in the rule group for rule behavior such as asymmetric routing. auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.NetworkFirewall.RuleGroups.UpdateToken description: The token used for optimistic locking, which tracks the state of the rule group resource at the time of the request. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupName description: The descriptive name of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupArn description: The Amazon Resource Name (ARN) of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupId description: The unique identifier for the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Description description: The description of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Type description: The type of the rule group. Can be stateless or stateful. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Capacity description: The maximum operating resources that this rule group can use. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupStatus description: The current status of a rule group, includes detailed information. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Tags description: The key:value pairs to associate with the resource. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.ConsumedCapacity description: The number of capacity units currently consumed by the rule group rules. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.NumberOfAssociations description: The number of firewall policies that use this rule group. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.EncryptionConfiguration description: The complex type that contains the Amazon Web Services KMS encryption configuration settings for your rule group. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.SourceMetadata description: The metadata for the rule group that your own rule group is copied from. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.SnsTopic description: The Amazon resource name (ARN) of the Amazon Simple Notification Service SNS topic that is used to record changes to the managed rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.LastModifiedTime description: The last time that the rule group was changed. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.AnalysisResults description: The list of analysis results for AnalyzeRuleGroup. If you set AnalyzeRuleGroup to TRUE in your request, the analysis results are returned in an AnalysisResult object alongside the rule group. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.SummaryConfiguration description: A complex type that contains the rule options that are used when summarizing the rules in the rule group. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.RuleVariables description: The rule settings that are available for use in the rule group. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.ReferenceSets description: The list of a rule group's reference sets. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.RulesSource description: The stateful rules or stateless rules for the rule group. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.StatefulRuleOptions description: Additional options governing how Network Firewall handles stateful rules. type: Unknown - name: aws-network-firewall-rule-groups-list description: "Retrieves metadata for defined rule groups. Depending on the max_results setting and the number of rule groups, a single call might not return the full list. Required permissions: network-firewall:ListRuleGroups." arguments: - name: account_id description: The AWS account ID. required: true - name: region description: The AWS region. required: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: limit description: The maximum number of Network Firewall objects to return for this request. defaultValue: "50" - name: next_token description: The nextToken value returned from a previous paginated request. You can find it under AWS.NetworkFirewall.RuleGroupsNextToken. - name: scope description: The scope of the request. The default setting of ACCOUNT or a setting of NULL returns all of the rule groups in your account. A setting of MANAGED returns all available managed rule groups. defaultValue: ACCOUNT auto: PREDEFINED predefined: - MANAGED - ACCOUNT - name: managed_type description: The general category of the Amazon Web Services managed rule group. auto: PREDEFINED predefined: - AWS_MANAGED_THREAT_SIGNATURES - AWS_MANAGED_DOMAIN_LISTS - ACTIVE_THREAT_DEFENSE - PARTNER_MANAGED - name: type description: The type of the rule group. Can be stateless or stateful. auto: PREDEFINED predefined: - STATELESS - STATEFUL - STATEFUL_DOMAIN outputs: - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupName description: The descriptive name of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupArn description: The Amazon Resource Name (ARN) of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.VendorName description: The name of the Amazon Web Services Marketplace seller that provides this rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroupsNextToken description: The token used to request the next page of results when a limit is set. Provided in the response of a previous request when the number of remaining objects exceeds the maximum limit specified. type: String - name: aws-network-firewall-rule-group-update description: "Updates the rule settings for the specified rule group. Modifying a rule group updates all firewall policies referencing it. You must provide either the rules argument or at least one of the rule_group arguments (rules_source, ip_sets, port_sets, ip_sets_references, stateful_rule_options_rule_order). Required permissions: network-firewall:UpdateRuleGroup." arguments: - name: account_id description: The AWS account ID. required: true - name: region description: The AWS region. required: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-southeast-7 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: update_token description: The token used for optimistic locking to ensure the rule group has not changed since it was last retrieved. The update token can be retrieved by running the aws-network-firewall-rule-group-describe command. required: true - name: rule_group_name description: The descriptive name of the rule group. You must specify the ARN or the name, and you can specify both. - name: rule_group_arn description: The Amazon Resource Name (ARN) of the rule group. You must specify the ARN or the name, and you can specify both. - name: type description: The type of the rule group. Can be stateless or stateful. This setting is required for requests that do not include the rule_group_arn. auto: PREDEFINED predefined: - STATELESS - STATEFUL - STATEFUL_DOMAIN - name: ip_sets description: 'The JSON string specifying an object of IP addresses and address ranges in CIDR notation, used as part of RuleVariables. Example format: `{"string": {"Definition": ["string"]}}`.' - name: port_sets description: 'The JSON string specifying an object of port ranges, used as part of a RuleVariables. `{"string": {"Definition": ["string"]}}`.' - name: ip_sets_references description: 'The JSON string specifying an object of IP set references. For example: `{"string": {"ReferenceArn": "string"}}`.' - name: rules_source description: 'The JSON string specifying the stateful rules or stateless rules for the rule group. For example: `{"RulesString": "string", "RulesSourceList": {"Targets": ["string"]}}`.' - name: stateful_rule_options_rule_order description: The order of the rule evaluation for the rule group. auto: PREDEFINED predefined: - DEFAULT_ACTION_ORDER - STRICT_ORDER - name: rules description: 'The string containing stateful rule group rule specifications in Suricata flat format, with one rule per line (newline-separated). Use this to import existing Suricata compatible rule groups. Provide either this argument or at least one of the rule_group arguments (ip_sets, port_sets, ip_sets_references, rules_source, stateful_rule_options_rule_order), but not both. For example: `pass tcp 10.0.0.0/8 any -> any any (sid:1;)`.' - name: description description: The description of the rule group. - name: encryption_configuration_key_id description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. - name: encryption_configuration_key_type description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. auto: PREDEFINED predefined: - CUSTOMER_KMS - AWS_OWNED_KMS_KEY - name: source_metadata_arn description: The Amazon Resource Name (ARN) of the rule group that your own rule group is copied from. - name: source_metadata_update_token description: The update token of the Amazon Web Services managed rule group that your own rule group is copied from. - name: analyze_rule_group description: Whether you want Network Firewall to analyze the stateless rules in the rule group for rule behavior such as asymmetric routing. If set to TRUE, Network Firewall runs the analysis and then updates the rule group for you. auto: PREDEFINED predefined: - 'true' - 'false' - name: summary_configuration_rule_options description: A comma-separated list of the rule options to include in the rule group summary. isArray: true outputs: - contextPath: AWS.NetworkFirewall.RuleGroups.UpdateToken description: The token used for optimistic locking, which tracks the state of the rule group resource at the time of the request. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupName description: The descriptive name of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupArn description: The Amazon Resource Name (ARN) of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupId description: The unique identifier for the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Description description: The description of the rule group. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Type description: The type of the rule group. Can be stateless or stateful. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Capacity description: The maximum operating resources that this rule group can use. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.RuleGroupStatus description: The current status of a rule group, includes detailed information. type: String - contextPath: AWS.NetworkFirewall.RuleGroups.Tags description: The key:value pairs to associate with the resource. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.ConsumedCapacity description: The number of capacity units currently consumed by the rule group rules. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.NumberOfAssociations description: The number of firewall policies that use this rule group. type: Number - contextPath: AWS.NetworkFirewall.RuleGroups.EncryptionConfiguration description: The complex type that contains the Amazon Web Services KMS encryption configuration settings for your rule group. type: Unknown - contextPath: AWS.NetworkFirewall.RuleGroups.LastModifiedTime description: The last time that the rule group was changed. type: String - name: aws-network-firewall-resource-policy-delete execution: true description: "Deletes a resource policy that you created in an aws-network-firewall-resource-policy-put request. Required permissions: network-firewall:DeleteResourcePolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_arn description: The Amazon Resource Name (ARN) of the rule group or firewall policy whose resource policy you want to delete. required: true - name: aws-network-firewall-resource-policy-put description: "Creates or updates an AWS Identity and Access Management policy for your rule group or firewall policy. Use this to share rule groups and firewall policies between accounts. Required permissions: network-firewall:PutResourcePolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_arn description: The Amazon Resource Name (ARN) of the account that you want to share your rule group or firewall policy with. required: true - name: policy description: The AWS Identity and Access Management policy statement that lists the accounts that you want to share your rule group or firewall policy with and the operations that you want the accounts to be able to perform. required: true - name: aws-network-firewall-resource-policy-describe description: "Retrieves a resource policy that you created in an aws-network-firewall-resource-policy-put request. Required permissions: network-firewall:DescribeResourcePolicy." arguments: - name: account_id description: The AWS account ID. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_arn description: The Amazon Resource Name (ARN) of the rule group or firewall policy whose resource policy you want to retrieve. required: true outputs: - contextPath: AWS.NetworkFirewall.ResourcePolicies.ResourceArn description: The Amazon Resource Name (ARN) of the rule group or firewall policy. type: String - contextPath: AWS.NetworkFirewall.ResourcePolicies.Policy description: The AWS Identity and Access Management policy for the resource. type: String - name: aws-network-firewall-tags-for-resource-list description: "Retrieves the tags associated with the specified resource. Tags are key:value pairs that you can use to categorize and manage your resources. Required permissions: network-firewall:ListTagsForResource." arguments: - name: account_id description: The AWS account ID. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_arn description: The Amazon Resource Name (ARN) of the resource. required: true - name: limit description: The maximum number of Network Firewall objects to return for this request. defaultValue: 50 - name: next_token description: The pagination token returned in a previous response, used to retrieve the next set of results. outputs: - contextPath: AWS.NetworkFirewall.Tags.ResourceArn description: The Amazon Resource Name (ARN) of the resource. type: String - contextPath: AWS.NetworkFirewall.Tags.Tags.Key description: The part of the key:value pair that defines a tag. type: String - contextPath: AWS.NetworkFirewall.Tags.Tags.Value description: The part of the key:value pair that defines a tag. type: String - contextPath: AWS.NetworkFirewall.Tags.TagsNextToken description: The token to use when requesting the next set of items. type: String - name: aws-network-firewall-resource-tag description: "Adds the specified tags to the specified resource. Tags are key:value pairs that you can use to categorize and manage your resources. Required permissions: network-firewall:TagResource." arguments: - name: account_id description: The AWS account ID. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_arn description: The Amazon Resource Name (ARN) of the resource. required: true - name: tags description: The tags to add to the resource. Must be separated by a semicolon (;) and specified using the format "key=abc,value=123;key=fed,value=456". required: true - name: aws-network-firewall-resource-untag execution: true description: "Removes the tags with the specified keys from the specified resource. Required permissions: network-firewall:UntagResource." arguments: - name: account_id description: The AWS account ID. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: resource_arn description: The Amazon Resource Name (ARN) of the resource. required: true - name: tag_keys description: A comma-separated list of tag keys to remove from the resource. required: true isArray: true - name: aws-network-firewall-logging-configuration-describe description: "Returns the logging configuration for the specified firewall. Required permissions: network-firewall:DescribeLoggingConfiguration." arguments: - name: account_id description: The AWS account ID. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: firewall_name description: The descriptive name of the firewall. You must specify the ARN or the name, and you can specify both. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. outputs: - contextPath: AWS.NetworkFirewall.Firewalls.FirewallArn description: The Amazon Resource Name (ARN) of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.LoggingConfiguration.LogDestinationConfigs description: The firewall log destination, containing LogType, LogDestinationType, and LogDestination fields. type: Unknown - contextPath: AWS.NetworkFirewall.Firewalls.EnableMonitoringDashboard description: Whether the monitoring dashboard is enabled for the firewall. type: Boolean - name: aws-network-firewall-logging-configuration-update description: "Sets the logging configuration for the specified firewall. To set a logging destination, provide the log_type, log_destination_type, log_destination_key, and log_destination_value arguments. To review the current configuration before updating, call aws-network-firewall-logging-configuration-describe. Required permissions: network-firewall:UpdateLoggingConfiguration, s3:PutBucketPolicy, s3:GetBucketPolicy, logs:CreateLogDelivery, logs:GetLogDelivery, logs:UpdateLogDelivery, logs:DeleteLogDelivery, logs:ListLogDeliveries, firehose:TagDeliveryStream, iam:CreateServiceLinkedRole." arguments: - name: account_id description: The AWS account ID. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true - name: region description: The AWS region. Required for Cortex XSIAM (version >= 3.0) and Cortex Cloud. Optional for Cortex XSOAR and Cortex XSIAM (version < 3.0), where it can be retrieved from the integration configuration. required: false required:platform: true auto: PREDEFINED predefined: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - af-south-1 - ap-east-1 - ap-south-2 - ap-southeast-3 - ap-southeast-5 - ap-southeast-4 - ap-south-1 - ap-northeast-3 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-northeast-1 - ca-central-1 - ca-west-1 - eu-central-1 - eu-west-1 - eu-west-2 - eu-south-1 - eu-south-2 - eu-west-3 - eu-north-1 - eu-central-2 - il-central-1 - mx-central-1 - me-south-1 - me-central-1 - sa-east-1 - us-gov-east-1 - us-gov-west-1 - name: firewall_name description: The descriptive name of the firewall. You must specify the ARN or the name, and you can specify both. - name: firewall_arn description: The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. - name: log_type description: The type of log to record. FLOW logs capture network traffic that passes through the firewall. ALERT logs report traffic that matches stateful rules with an action setting that sends an alert. TLS logs report on TLS handshake negotiation results. auto: PREDEFINED predefined: - FLOW - ALERT - TLS - name: log_destination_type description: The type of storage destination that the logs are sent to. auto: PREDEFINED predefined: - S3 - CloudWatchLogs - KinesisDataFirehose - name: log_destination_key description: 'The key for the logging destination, according to the log_destination_type. For example: `bucketName` for S3, `logGroup` for CloudWatchLogs, or `deliveryStream` for KinesisDataFirehose.' - name: log_destination_value description: 'The value for the logging destination, matching the log_destination_key. For example: the S3 bucket name, the CloudWatch Logs log group name, or the Kinesis Data Firehose delivery stream name.' - name: enable_monitoring_dashboard description: Whether to enable the detailed firewall monitoring dashboard on the firewall. auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: AWS.NetworkFirewall.Firewalls.FirewallArn description: The Amazon Resource Name (ARN) of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.FirewallName description: The descriptive name of the firewall. type: String - contextPath: AWS.NetworkFirewall.Firewalls.LoggingConfiguration.LogDestinationConfigs description: The firewall log destination, containing LogType, LogDestinationType, and LogDestination fields. type: Unknown - contextPath: AWS.NetworkFirewall.Firewalls.EnableMonitoringDashboard description: Whether the monitoring dashboard is enabled for the firewall. type: Boolean isfetch: false runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/boto3py3:1.0.0.10221838 supportsquickactions: true fromversion: 5.5.0 source: 'cooc' tests: - No test - No playbook part of this release. sectionorder: - Connect - Collect isCloudProviderIntegration: true internal: true