category: Case Management
provider: RSAsecurity
sectionorder:
- Connect
- Collect
commonfields:
  id: RSA Archer v2
  version: -1
configuration:
- additionalinfo: 'For example: https://192.168.0.1/rsaarcher, https://192.168.0.1/, or https://192.168.0.1/archer.'
  display: Server URL
  name: url
  required: true
  section: Connect
  type: 0
- additionalinfo: Change only if using another API endpoint.
  defaultvalue: api
  display: 'API Endpoint'
  name: api_endpoint
  section: Connect
  advanced: true
  type: 0
  required: false
- display: Instance name
  name: instanceName
  required: true
  section: Connect
  type: 0
- display: Username
  name: credentials
  section: Connect
  type: 9
  required: true
- display: User domain
  name: userDomain
  section: Connect
  type: 0
  required: false
- display: Fetch incidents
  name: isFetch
  section: Collect
  type: 8
  required: false
- display: Incident type
  name: incidentType
  section: Collect
  type: 13
  required: false
- display: Application ID for fetch
  name: applicationId
  section: Collect
  required: true
  type: 0
- defaultvalue: Date/Time Occurred
  display: Application date field for fetch
  name: applicationDateField
  required: true
  section: Collect
  type: 0
  additionalinfo: The value should be the field name.
- defaultvalue: '10'
  display: Maximum number of incidents to pull per fetch
  name: fetch_limit
  section: Collect
  type: 0
  required: false
- defaultvalue: 3 days
  additionalinfo: 'Time from which to begin fetching incidents in the <number> <time unit> format. For example: 12 hours, 7 days, 3 months, 1 year.'
  display: First fetch timestamp
  name: fetch_time
  section: Collect
  type: 0
  required: false
- additionalinfo: 'A comma-separated list of application field names. For example: "Date/Time Occurred,Days Open".'
  display: List of fields from the application to get into the incident
  name: fields_to_fetch
  section: Collect
  type: 0
  required: false
- additionalinfo: 'Additional XML condition element(s) to use when fetching. Using a "DateComparisonFilterCondition" element is not supported. For more information, check the "Limitations" section of the documentation.'
  display: XML for fetch filtering
  name: fetch_xml
  section: Collect
  advanced: true
  type: 12  # long text block
  required: false
- additionalinfo: Request timeout value in seconds.
  defaultvalue: '400'
  display: Timeout
  name: timeout
  section: Connect
  advanced: true
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  section: Connect
  advanced: true
  type: 8
  required: false
- display: Use system proxy settings
  section: Connect
  advanced: true
  name: proxy
  type: 8
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  section: Collect
  advanced: true
  type: 19
  required: false
description: The RSA Archer GRC platform provides a common foundation for managing policies, controls, risks, assessments, and deficiencies across lines of business.
display: RSA Archer v2
name: RSA Archer v2
script:
  commands:
  - arguments:
    - description: The application ID to get details for. Leave empty to get a list of all applications.
      name: applicationId
    - defaultValue: '20'
      description: The maximum number of applications to return.
      name: limit
    description: Gets application details or a list of all applications.
    name: archer-search-applications
    outputs:
    - contextPath: Archer.Application.Guid
      description: The application GUID.
      type: String
    - contextPath: Archer.Application.Id
      description: The unique ID of the application.
      type: Number
    - contextPath: Archer.Application.Status
      description: The application status.
      type: Number
    - contextPath: Archer.Application.Type
      description: The application type.
      type: Number
    - contextPath: Archer.Application.Name
      description: The application name.
      type: String
  - arguments:
    - description: The application ID to get the application fields for.
      name: applicationId
      required: true
    description: Gets all application fields by application ID.
    name: archer-get-application-fields
    outputs:
    - contextPath: Archer.ApplicationField.FieldId
      description: The unique ID of the field.
      type: Number
    - contextPath: Archer.ApplicationField.FieldName
      description: The field name.
      type: String
    - contextPath: Archer.ApplicationField.FieldType
      description: The field type.
      type: String
    - contextPath: Archer.ApplicationField.LevelID
      description: The field level ID.
      type: Number
  - arguments:
    - description: The ID of the field.
      name: fieldID
      required: true
    description: Returns a mapping from list value name to list value ID.
    name: archer-get-field
    outputs:
    - contextPath: Archer.ApplicationField.FieldId
      description: The unique ID of the field.
      type: Number
    - contextPath: Archer.ApplicationField.FieldName
      description: The field name.
      type: String
    - contextPath: Archer.ApplicationField.FieldType
      description: The field type.
      type: String
    - contextPath: Archer.ApplicationField.LevelID
      description: The field level ID.
      type: Number
  - arguments:
    - description: The ID of the level.
      name: level
      required: true
    description: Returns a mapping of fields by level ID.
    name: archer-get-mapping-by-level
    outputs:
    - contextPath: Archer.LevelMapping.Id
      description: The unique ID of the field.
      type: Number
    - contextPath: Archer.LevelMapping.Name
      description: The field name.
      type: String
    - contextPath: Archer.LevelMapping.Type
      description: The field type.
      type: String
    - contextPath: Archer.LevelMapping.LevelId
      description: The field level ID.
      type: Number
  - arguments:
    - description: In case of nesting, to which level to go in the depth of the recursion.
      name: depth
      defaultValue: 3
    - description: The record ID.
      name: contentId
      required: true
    - description: The application ID.
      name: applicationId
      required: true
    description: Gets information about a content record in the given application.
    name: archer-get-record
    outputs:
    - contextPath: Archer.Record.Id
      description: The unique ID of the record.
      type: Number
  - arguments:
    - description: The application ID.
      name: applicationId
      required: true
    - description: 'Record fields in JSON format: { "Name1": Value1, "Name2": Value2 }. Field names are case sensitive.'
      name: fieldsToValues
      required: true
    - description: The Level ID to use to create the record. If empty, the command by default takes the first level ID.
      name: levelId
    description: Creates a new content record in the given application.
    name: archer-create-record
    outputs:
    - contextPath: Archer.Record.Id
      description: The unique ID of the record.
      type: Number
  - arguments:
    - description: The ID of the record to delete.
      name: contentId
      required: true
    description: Deletes an existing content record in the given application.
    name: archer-delete-record
  - arguments:
    - description: The application ID.
      name: applicationId
      required: true
    - description: 'Record fields in JSON format: { "Name1": Value1, "Name2": Value2 }. Field names are case sensitive.'
      name: fieldsToValues
      required: true
    - description: The ID of the record to update.
      name: contentId
      required: true
    - description: The Level ID to use to update the record. If empty, the command by default takes the first level ID.
      name: levelId
    - description: In case of nesting, to which level to go in the depth of the recursion.
      name: depth
      defaultValue: 0
    description: Updates an existing content record in the given application.
    name: archer-update-record
  - arguments:
    - description: The report GUID.
      name: reportGuid
      required: true
    - defaultValue: '100'
      description: Maximum number of pages for the reports.
      name: maxResults
      required: true
    description: Performs a statistic search by report GUID.
    name: archer-execute-statistic-search-by-report
  - arguments: []
    description: Gets all reports from Archer.
    name: archer-get-reports
  - arguments:
    - description: The report GUID.
      name: reportGuid
      required: true
    description: Returns search criteria by report GUID.
    name: archer-get-search-options-by-guid
  - arguments: []
    description: Resets Archer's integration cache. Run this command if you change the fields of your Archer application.
    name: archer-reset-cache
  - arguments:
    - description: The field ID.
      name: fieldID
      required: true
    - description: In case of nesting, to which level to go in the depth of the recursion.
      name: depth
      defaultValue: 0
    description: Returns a list of values for a specified field, for example, fieldID=16114. This command is applicable only to value list fields (type 4) and will attempt to fetch the list from the internal integration instance cache. To ensure an up-to-date response, execute the `archer-reset-cache` command beforehand to clear the cache and force a new request to the API.
    name: archer-get-valuelist
    outputs:
    - contextPath: Archer.ApplicationField.ValuesList.Id
      description: The field value ID.
      type: Number
    - contextPath: Archer.ApplicationField.ValuesList.IsSelectable
      description: Specifies whether you can select the field value.
      type: Boolean
    - contextPath: Archer.ApplicationField.ValuesList.Name
      description: The field value name.
      type: String
    - contextPath: Archer.ApplicationField.ValuesList.Parent
      description: The field value parent.
      type: String
    - contextPath: Archer.ApplicationField.ValuesList.Depth
      description: The field value depth.
      type: Number
  - arguments:
    - description: A comma seperated list of entry IDs of the files in Cortex XSOAR context.
      name: entryId
      required: true
    - description: ID of the application to upload the file to.
      name: applicationId
    - description: The content (record) ID to update.
      name: contentId
    - defaultValue: Supporting Documentation
      description: Archer field name to associate the file with.
      name: associatedField
    description: Uploads a file to Archer.
    name: archer-upload-file
  - arguments:
    - description: The file ID.
      name: fileId
      required: true
    description: Downloads a file from Archer to Cortex XSOAR context.
    name: archer-get-file
    outputs:
    - contextPath: File
      description: The file details command results.
      type: Unknown
    - contextPath: File.Name
      description: The full file name (including the file extension).
      type: String
    - contextPath: File.EntryID
      description: The ID for locating the file in the War Room.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Extension
      description: 'The file extension. For example: "xls".'
      type: String
    - contextPath: File.Type
      description: The file type as determined by libmagic (same as displayed in file entries).
      type: String
  - arguments:
    - description: The ID of the user to get details for. Leave empty to get a list of all users.
      name: userId
    description: Gets details for a user or a list of all users.
    name: archer-list-users
    outputs:
    - contextPath: Archer.User.AccountStatus
      description: The account status of the user.
      type: String
    - contextPath: Archer.User.DisplayName
      description: The display name of the user.
      type: String
    - contextPath: Archer.User.FirstName
      description: The first name of the user.
      type: String
    - contextPath: Archer.User.Id
      description: The unique ID of the user.
      type: Number
    - contextPath: Archer.User.LastLoginDate
      description: The last login date of user.
      type: Date
    - contextPath: Archer.User.LastName
      description: The last name of the user.
      type: String
    - contextPath: Archer.User.MiddleName
      description: The middle name of the user.
      type: String
    - contextPath: Archer.User.UserName
      description: The username associated with the account.
      type: String
  - arguments:
    - description: The ID of the application in which to search for records.
      name: applicationId
      required: true
    - description: The name of the field on which to search. Leave empty to search on all fields.
      name: fieldToSearchOn
    - description: The name of the primary Id field on which to search. Used instead of the fieldToSearchOn argument for searching by the application primary field.
      name: fieldToSearchById
    - description: Search value. Leave empty to search for all.
      name: searchValue
    - defaultValue: '10'
      description: Maximum number of results to return from the search.
      name: maxResults
    - description: Fields to display in the search results (in array format). For example "Title,Incident Summary".
      name: fieldsToDisplay
    - auto: PREDEFINED
      description: Numeric search operator. Can be "Equals", "NotEqual", "GreaterThan", or "LessThan".
      name: numericOperator
      predefined:
      - Equals
      - NotEqual
      - GreaterThan
      - LessThan
    - auto: PREDEFINED
      description: Date search operator. Can be "Equals", "DoesNotEqual", "GreaterThan", or "LessThan".
      name: dateOperator
      predefined:
      - Equals
      - DoesNotEqual
      - GreaterThan
      - LessThan
    - description: Fields to fetch from the application.
      name: fieldsToGet
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Whether to get extended responses with all of the data regarding this search. For example, "fullData=true".
      name: fullData
      predefined:
      - 'True'
      - 'False'
      required: true
    - auto: PREDEFINED
      description: Whether to order by descending order.
      name: isDescending
      predefined:
      - 'true'
      - 'false'
    - description: The Level ID to use for searching. This argument is relevant when fullData is True. If empty, the command by default takes the first level ID.
      name: levelId
    - description: 'The raw XML filter condition. For example: "DateComparisonFilterCondition" or "TextFilterCondition" XML element.'
      name: xmlForFiltering
    description: Searches for records in the given application.
    name: archer-search-records
    outputs:
    - contextPath: Archer.Record
      description: The content object.
      type: Unknown
    - contextPath: Archer.Record.Id
      description: The content ID.
      type: Number
  - arguments:
    - description: The report GUID.
      name: reportGuid
      required: true
    description: Searches records by report GUID.
    name: archer-search-records-by-report
    outputs:
    - contextPath: Archer.SearchByReport.ReportGUID
      description: The report GUID.
      type: String
    - contextPath: Archer.SearchByReport.RecordsAmount
      description: The number of records found by the search.
      type: Number
    - contextPath: Archer.SearchByReport.Record
      description: The records found by the search.
      type: Unknown
  - arguments: []
    description: Prints the Archer's integration cache.
    name: archer-print-cache
  dockerimage: demisto/python3-deb:3.12.13.10116658
  isfetch: true
  script: ''
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- Archer v2 - Test