category: Data Enrichment & Threat Intelligence
provider: AT&T Cybersecurity
sectionorder:
- Connect
- Collect
commonfields:
  id: AlienVault USM Anywhere
  version: -1
configuration:
- defaultvalue: https://www.example.com
  display: Server URL (e.g., https://www.example.com)
  name: url
  required: true
  type: 0
  section: Connect
- display: Client ID
  name: client_id
  type: 0
  hidden: true
  required: false
  section: Connect
- display: Client Secret
  name: client_secret
  type: 4
  hidden: true
  required: false
  section: Connect
- display: Client ID
  name: client_id_creds
  type: 9
  displaypassword: Client Secret
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: '3 days'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  required: false
  section: Collect
- defaultvalue: '10'
  display: Fetch Limit
  name: fetch_limit
  section: Collect
  type: 0
  required: false
- defaultvalue: auto-discovery
  display: Time Format e.g. %Y-%m-%dT%H:%M:%SZ. Select "auto-discovery" to try to automatically determine the format.
  name: time_format
  type: 0
  section: Collect
  required: false
description: Searches for and monitors alarms and events from AlienVault USM Anywhere.
display: AlienVault USM Anywhere
name: AlienVault USM Anywhere
script:
  commands:
  - arguments:
    - defaultValue: '100'
      description: The maximum number of alarms to return.
      name: limit
    - description: The alarm status by which to filter the results.
      name: status
    - description: The alarm priority by which to filter the results.
      name: priority
    - auto: PREDEFINED
      description: Whether to include suppressed alarms in the search. Can be "true" or "false".
      name: show_suppressed
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'The time frame by which to filter the results, for example: Last 48 Hours.'
      name: time_frame
      predefined:
      - Today
      - Yesterday
      - Last 7 Days
      - Last Hour
      - Last 24 Hours
      - Last 48 Hours
      - Last 30 Days
      - Custom
    - description: 'If the value of the time_frame argument is "Custom", specify the start time for the time range, for example: 2017-06-01T12:48:16Z.'
      name: start_time
    - description: 'If the value of the time_frame argument is "Custom", specify the end time for the time range, for example: 2017-06-01T12:48:16Z.'
      name: end_time
    - description: The rule intention by which to filter the results.
      name: rule_intent
      predefined:
      - ''
    - description: The rule method by which to filter the results.
      name: rule_method
    - description: The rule strategy by which to filter the results.
      name: rule_strategy
      predefined:
      - ''
    description: Retrieves alarms from AlienVault.
    name: alienvault-search-alarms
    outputs:
    - contextPath: AlienVault.Alarm.ID
      description: The alarm ID.
      type: String
    - contextPath: AlienVault.Alarm.Priority
      description: The alarm priority.
      type: String
    - contextPath: AlienVault.Alarm.OccurredTime
      description: The time that the alarm occurred.
      type: Date
    - contextPath: AlienVault.Alarm.ReceivedTime
      description: The time that the alarm was received.
      type: Date
    - contextPath: AlienVault.Alarm.Source
      description: The alarm source object.
      type: Unknown
    - contextPath: AlienVault.Alarm.Source.IPAddress
      description: The alarm source IP address.
      type: String
    - contextPath: AlienVault.Alarm.Source.Organization
      description: The source organization.
      type: String
    - contextPath: AlienVault.Alarm.Source.Country
      description: The source country.
      type: String
    - contextPath: AlienVault.Alarm.Destination
      description: The alarm destination object.
      type: Unknown
    - contextPath: AlienVault.Alarm.Destination.IPAddress
      description: The alarm destination IP address.
      type: String
    - contextPath: AlienVault.Alarm.RuleAttackID
      description: The rule attack ID.
      type: String
    - contextPath: AlienVault.Alarm.RuleStrategy
      description: The rule strategy.
      type: String
    - contextPath: AlienVault.Alarm.RuleIntent
      description: The rule intent.
      type: String
    - contextPath: AlienVault.Alarm.RuleID
      description: The rule ID.
      type: String
    - contextPath: AlienVault.Alarm.RuleDictionary
      description: The rule dictionary.
      type: String
    - contextPath: AlienVault.Alarm.RuleMethod
      description: The rule method.
      type: String
    - contextPath: AlienVault.Alarm.RuleAttackTactic
      description: The rule attack tactic.
      type: Unknown
    - contextPath: AlienVault.Alarm.RuleAttackTechnique
      description: The rule attack technique.
      type: String
    - contextPath: AlienVault.Alarm.Status
      description: The alarm status.
      type: String
  - arguments:
    - default: true
      description: The alarm ID. Can be obtained by running the `alienvault-search-alarms` command.
      name: alarm_id
      required: true
    description: Retrieves details for an alarm.
    name: alienvault-get-alarm
    outputs:
    - contextPath: AlienVault.Alarm.ID
      description: The alarm ID.
      type: String
    - contextPath: AlienVault.Alarm.Priority
      description: The alarm priority.
      type: String
    - contextPath: AlienVault.Alarm.OccurredTime
      description: The time that the alarm occurred.
      type: Date
    - contextPath: AlienVault.Alarm.ReceivedTime
      description: The time that the alarm was received.
      type: Date
    - contextPath: AlienVault.Alarm.Source
      description: The alarm source object.
      type: Unknown
    - contextPath: AlienVault.Alarm.Source.IPAddress
      description: The alarm source IP address.
      type: String
    - contextPath: AlienVault.Alarm.Source.Organization
      description: The source organization.
      type: String
    - contextPath: AlienVault.Alarm.Source.Country
      description: The source country.
      type: String
    - contextPath: AlienVault.Alarm.Destination
      description: The alarm destination object.
      type: Unknown
    - contextPath: AlienVault.Alarm.Destination.IPAddress
      description: The alarm destination IP address.
      type: String
    - contextPath: AlienVault.Alarm.RuleAttackID
      description: The rule attack ID.
      type: String
    - contextPath: AlienVault.Alarm.RuleStrategy
      description: The rule strategy.
      type: String
    - contextPath: AlienVault.Alarm.RuleIntent
      description: The rule intent.
      type: String
    - contextPath: AlienVault.Alarm.RuleID
      description: The rule ID.
      type: String
    - contextPath: AlienVault.Alarm.RuleDictionary
      description: The rule dictionary.
      type: String
    - contextPath: AlienVault.Alarm.RuleMethod
      description: The rule method.
      type: String
    - contextPath: AlienVault.Alarm.RuleAttackTactic
      description: The rule attack tactic.
      type: Unknown
    - contextPath: AlienVault.Alarm.RuleAttackTechnique
      description: The rule attack technique.
      type: String
    - contextPath: AlienVault.Alarm.Status
      description: The alarm status.
      type: String
  - arguments:
    - defaultValue: '100'
      description: The maximum number of alarms to return.
      name: limit
    - description: The account name.
      name: account_name
    - description: The event name.
      name: event_name
    - description: The source name.
      name: source_name
    - auto: PREDEFINED
      description: 'The time frame by which to filter the results, for example: Last 48 Hours.'
      name: time_frame
      predefined:
      - Today
      - Yesterday
      - Last 7 Days
      - Last Hour
      - Last 24 Hours
      - Last 48 Hours
      - Last 30 Days
      - Custom
    - description: 'If the value of the time_frame argument is "Custom", specify the start time for the time range, for example: 2017-06-01T12:48:16Z.'
      name: start_time
    - description: 'If the value of the time_frame argument is "Custom", specify the end time for the time range, for example: 2017-06-01T12:48:16Z.'
      name: end_time
    description: Searches for events in AlienVault USM Anywhere.
    name: alienvault-search-events
    outputs:
    - contextPath: AlienVault.Event.Category
      description: The event category.
      type: String
    - contextPath: AlienVault.Event.Source.IPAddress
      description: The source IP address.
      type: String
    - contextPath: AlienVault.Event.Source.Port
      description: The source port.
      type: Number
    - contextPath: AlienVault.Event.Destination.IPAddress
      description: The destination IP address.
      type: String
    - contextPath: AlienVault.Event.Destination.Port
      description: The destination port.
      type: Number
    - contextPath: AlienVault.Event.Severity
      description: The event severity.
      type: String
    - contextPath: AlienVault.Event.OccurredTime
      description: The time that the event occurred.
      type: String
    - contextPath: AlienVault.Event.ReceivedTime
      description: The time that the event was received.
      type: String
    - contextPath: AlienVault.Event.AccessControlOutcome
      description: The access control outcome.
      type: String
    - contextPath: AlienVault.Event.Suppressed
      description: Whether the event is suppressed.
      type: Bool
    - contextPath: AlienVault.Event.ID
      description: The event ID.
      type: String
    - contextPath: AlienVault.Event.Name
      description: The event name.
      type: String
    - contextPath: AlienVault.Event.Subcategory
      description: The event subcategory.
      type: String
  - arguments:
    - default: true
      description: The ID of the alarm for which to get events. Can be obtained by running the `alienvault-search-alarms` command.
      name: alarm_id
      required: true
    description: Retrieves events associated with the specified alarm.
    name: alienvault-get-events-by-alarm
    outputs:
    - contextPath: AlienVault.Event.Category
      description: The event category.
      type: String
    - contextPath: AlienVault.Event.Source.IPAddress
      description: The source IP address.
      type: String
    - contextPath: AlienVault.Event.Source.Port
      description: The source port.
      type: Number
    - contextPath: AlienVault.Event.Destination.IPAddress
      description: The destination IP address.
      type: String
    - contextPath: AlienVault.Event.Destination.Port
      description: The destination port.
      type: Number
    - contextPath: AlienVault.Event.Severity
      description: The event severity.
      type: String
    - contextPath: AlienVault.Event.OccurredTime
      description: The time that the event occurred.
      type: String
    - contextPath: AlienVault.Event.ReceivedTime
      description: The time that the event was received.
      type: String
    - contextPath: AlienVault.Event.AccessControlOutcome
      description: The access control outcome.
      type: String
    - contextPath: AlienVault.Event.Suppressed
      description: Whether the event is suppressed.
      type: Bool
    - contextPath: AlienVault.Event.ID
      description: The event ID.
      type: String
    - contextPath: AlienVault.Event.Name
      description: The event name.
      type: String
    - contextPath: AlienVault.Event.Subcategory
      description: The event subcategory.
      type: String
  dockerimage: demisto/python3:3.12.13.10404775
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
fromversion: 5.0.0
tests:
- No tests (auto formatted)