category: Analytics & SIEM provider: Admin By Request sectionorder: - Connect - Collect commonfields: id: AdminByRequest version: -1 configuration: - defaultvalue: https://dc2api.adminbyrequest.com/ display: Server URL name: url required: true type: 0 section: Connect - displaypassword: API Key additionalinfo: The API Key allows you to interacts with the AdminByRequest API service. name: credentials required: true hiddenusername: true type: 9 section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - display: Fetch events name: isFetchEvents type: 8 section: Collect required: false hidden: - xsoar defaultvalue: "true" - display: Event types to fetch name: event_types_to_fetch section: Collect required: true type: 16 additionalinfo: Which records the integration should fetch from the AdminByRequest API. Available for Auditlogs, Events, and Requests. defaultvalue: Auditlog,Events,Requests options: - Auditlog - Events - Requests hidden: - xsoar supportedModules: - xsiam - additionalinfo: 'Maximum number of audit log entries to retrieve per fetch cycle. Applies only if the "Auditlog" event type is enabled for fetching.' defaultvalue: "50000" display: Maximum number of Auditlog per fetch name: max_auditlog_per_fetch required: false type: 0 section: Collect advanced: true hidden: - xsoar supportedModules: - xsiam - additionalinfo: 'Maximum number of event entries to retrieve per fetch cycle. Applies only if the "Events" event type is enabled for fetching.' defaultvalue: "50000" display: Maximum number of Events per fetch name: max_events_per_fetch required: false type: 0 section: Collect advanced: true hidden: - xsoar supportedModules: - xsiam - additionalinfo: 'Maximum number of request entries to retrieve per fetch cycle. Applies only if the "Requests" event type is enabled for fetching.' defaultvalue: "5000" display: Maximum number of Requests per fetch name: max_requests_per_fetch required: false type: 0 supportedModules: - xsiam section: Collect advanced: true hidden: - xsoar description: 'AdminByRequest is a Privileged Access Management (PAM) solution that enables secure, temporary elevation to local admin rights.' display: Admin By Request name: AdminByRequest supportlevelheader: xsoar script: commands: - name: adminbyrequest-get-events description: Retrieves a list of entry log events from the AdminByRequest instance. arguments: - auto: PREDEFINED defaultValue: 'false' description: Set this argument to true to create events, otherwise it only displays them. name: should_push_events predefined: - 'true' - 'false' required: true - auto: PREDEFINED defaultValue: 'Auditlog' description: The type of event to fetch. name: event_type predefined: - 'Auditlog' - 'Events' - 'Requests' required: false - description: Returns no more than the specified number of events (for entries of type 'Requests' the default value is 5000). name: limit required: false - description: "The UTC date or relative timestamp from which to start fetching events. **Note**: For event type 'Requests', you can set a start date. Supported formats: N days, N weeks, N months, N years, yyyy-mm-dd." name: first_fetch required: false - name: adminbyrequest-list-requests description: Lists requests from AdminByRequest. arguments: - name: request_id description: The ID of a specific request to retrieve. required: false - name: status description: Filters requests by status. required: false auto: PREDEFINED predefined: - "Pending" - "Open" - "Approved" - "Denied" - "Quarantined" - name: want_scan_details description: Set to true to include scan details in the response. required: false auto: PREDEFINED predefined: - "true" - "false" - name: limit description: The maximum number of requests to return. Default is 50. required: false - name: all_results description: Set to true to fetch all available results, up to 100,000, overriding the limit. required: false auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: AdminByRequest.Request.id description: The ID of the request. type: Number - contextPath: AdminByRequest.Request.type description: The type of the request. type: String - contextPath: AdminByRequest.Request.settingsName description: The name of the settings. type: String - contextPath: AdminByRequest.Request.application.name description: The name of the application. type: String - contextPath: AdminByRequest.Request.application.scanResult description: The scan result of the application. type: String - contextPath: AdminByRequest.Request.user description: The user associated with the request. type: Unknown - contextPath: AdminByRequest.Request.computer.name description: The name of the computer. type: String - contextPath: AdminByRequest.Request.status description: The status of the request. type: String - contextPath: AdminByRequest.Request.reason description: The reason for the request. type: String - contextPath: AdminByRequest.Request.approvedBy description: The user who approved the request. type: String - contextPath: AdminByRequest.Request.approvedByEmail description: The email of the user who approved the request. type: String - contextPath: AdminByRequest.Request.deniedReason description: The reason for denying the request. type: String - contextPath: AdminByRequest.Request.deniedBy description: The user who denied the request. type: String - contextPath: AdminByRequest.Request.deniedByEmail description: The email of the user who denied the request. type: String - contextPath: AdminByRequest.Request.requestTime description: The time the request was made. type: Date - contextPath: AdminByRequest.Request.startTime description: The start time of the request. type: Date - contextPath: AdminByRequest.Request.eventText description: The text of the request. type: String - contextPath: AdminByRequest.Request.eventTime description: The time the request occurred. type: Date - name: adminbyrequest-request-approve description: Approves a request in AdminByRequest. arguments: - name: request_id description: The ID of the request to approve. required: true - name: approved_by description: Has to be an email address that matches a portal user, otherwise it will be ignored. required: false - name: adminbyrequest-request-deny description: Denies a request in AdminByRequest. arguments: - name: request_id description: The ID of the request to deny. required: true - name: denied_by description: Has to be an email address that matches a portal user, otherwise it will be ignored. required: false - name: reason description: The reason for denying the request. required: false isfetch: false runonce: false script: '-' type: python subtype: python3 isfetchevents: true isfetchevents:xsoar: false dockerimage: demisto/python3:3.12.13.10116658 fromversion: 6.10.0 marketplaces: - marketplacev2 - platform - xsoar tests: - No tests (auto formatted)