category: Vulnerability Management provider: AttackIQ commonfields: id: AttackIQFireDrill version: -1 configuration: - display: Server URL (e.g. https://example.net) name: url required: true type: 0 - display: API Token name: token type: 4 hidden: true required: false - name: token_creds type: 9 displaypassword: API Token hiddenusername: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: An attack simulation platform that provides validations for security controls, responses, and remediation exercises. display: AttackIQ Platform name: AttackIQFireDrill script: commands: - arguments: - default: true description: The ID of the assessment to return. name: assessment_id required: true description: Returns all assessments by its ID in the AttackIQ FireDrill platform. name: attackiq-get-assessment-by-id outputs: - contextPath: AttackIQ.Assessment.Id description: The ID of the assessment. type: String - contextPath: AttackIQ.Assessment.Name description: The name of the assessment name. type: String - contextPath: AttackIQ.Assessment.Description description: The description of the assessment. type: String - contextPath: AttackIQ.Assessment.StartDate description: The start date of the assessment. type: Date - contextPath: AttackIQ.Assessment.EndDate description: The end date of the assessment. type: Date - contextPath: AttackIQ.Assessment.AssessmentState description: The state of the assessment. Can be Active or Inactive. type: String - contextPath: AttackIQ.Assessment.DefaultSchedule description: The default schedule timing (cron) of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateId description: The template ID of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateName description: The template name of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateDescription description: The template description of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateDefaultSchedule description: The assessment's template default schedule timing (cron). type: Unknown - contextPath: AttackIQ.Assessment.AssessmentTemplateCompany description: The owner of the template. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateCreated description: The date that the template was created. type: Date - contextPath: AttackIQ.Assessment.AssessmentTemplateModified description: The date the template was last modified. type: Date - contextPath: AttackIQ.Assessment.Creator description: The user who created the assessment. type: String - contextPath: AttackIQ.Assessment.Owner description: The user who owns the assessment. type: String - contextPath: AttackIQ.Assessment.User description: The user who ran the assessment. type: String - contextPath: AttackIQ.Assessment.Created description: The time that the assessment was created. type: String - contextPath: AttackIQ.Assessment.Modified description: The time that the assessment was last modified. type: String - contextPath: AttackIQ.Assessment.Users description: The user IDs that can access the assessment. type: String - contextPath: AttackIQ.Assessment.Groups description: The user groups who can access the assessment. type: String - contextPath: AttackIQ.Assessment.DefaultAssetCount description: The number of machines (assets) that are connected to the assessment. type: Number - contextPath: AttackIQ.Assessment.DefaultAssetGroupCount description: The number of asset groups that are connected to the assessment. type: Number - contextPath: AttackIQ.Assessment.MasterJobCount description: The number of tests that ran in the assessment. type: Number - contextPath: AttackIQ.Assessment.Count description: The total number of assessments. type: Number - contextPath: AttackIQ.Assessment.RemainingPages description: The number of remaining pages to return. For example, if the total number of pages is 6, and the last fetch was page 5, the value is 1. type: Number - arguments: - defaultValue: '1' description: The page number to return. name: page_number - description: The maximum page size of the results. name: page_size description: Returns all assessments in a page. name: attackiq-list-assessments outputs: - contextPath: AttackIQ.Assessment.Id description: The ID of the assessment. type: String - contextPath: AttackIQ.Assessment.Name description: The name of the assessment. type: String - contextPath: AttackIQ.Assessment.Description description: The description of the assessment. type: String - contextPath: AttackIQ.Assessment.StartDate description: The start date of the assessment. type: Date - contextPath: AttackIQ.Assessment.EndDate description: The end date of the assessment. type: Date - contextPath: AttackIQ.Assessment.AssessmentState description: The state of the assessment. Can be Active or Inactive. type: String - contextPath: AttackIQ.Assessment.DefaultSchedule description: The default schedule timing (cron) of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateId description: The template ID of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateName description: The template name of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateDescription description: The template description of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateDefaultSchedule description: The default schedule timing (cron) of the template assessment. type: Unknown - contextPath: AttackIQ.Assessment.AssessmentTemplateCompany description: The owner of the template. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateCreated description: The date that the template was created. type: Date - contextPath: AttackIQ.Assessment.AssessmentTemplateModified description: The date the template was last modified. type: Date - contextPath: AttackIQ.Assessment.Creator description: The user who created the assessment. type: String - contextPath: AttackIQ.Assessment.Owner description: The user who owned the assessment. type: String - contextPath: AttackIQ.Assessment.User description: The user that ran the assessment. type: String - contextPath: AttackIQ.Assessment.Created description: The date that the assessment was created. type: String - contextPath: AttackIQ.Assessment.Modified description: The date that the assessment was last modified. type: String - contextPath: AttackIQ.Assessment.Users description: The User IDs that can access the assessment. type: String - contextPath: AttackIQ.Assessment.Groups description: The user groups that can access the assessment. type: String - contextPath: AttackIQ.Assessment.DefaultAssetCount description: The number of machines (assets) that are connected to the assessment. type: Number - contextPath: AttackIQ.Assessment.DefaultAssetGroupCount description: The number of asset groups that are connected to the assessment. type: Number - contextPath: AttackIQ.Assessment.MasterJobCount description: The number of tests that ran in the assessment. type: Number - arguments: - default: true description: ID of the assessment to activate. name: assessment_id required: true deprecated: true description: Deprecated, without available replacement. Activates the assessment, which is required for execution. name: attackiq-activate-assessment - arguments: - description: The ID of the assessment. name: assessment_id required: true - auto: PREDEFINED description: Runs only on-demand tests in the assessment. If true, executes tests in the assessment that are not scheduled to run. If false, executes all tests in the assessment including scheduled tests. Default is false. name: on_demand_only predefined: - 'True' - 'False' description: Runs all tests in the assessment. name: attackiq-run-all-tests-in-assessment - arguments: - default: true description: The assessment for which to check the status. name: assessment_id required: true description: Returns an assessment execution status when running an on-demand execution only. name: attackiq-get-assessment-execution-status outputs: - contextPath: AttackIQ.Assessment.Running description: Whether the assessment is running. type: Boolean - contextPath: AttackIQ.Assessment.Id description: The ID of the assessment. type: String - arguments: - default: true description: The ID of the test. name: test_id required: true description: Returns the status of the test. name: attackiq-get-test-execution-status outputs: - contextPath: AttackIQTest.Detected description: The number of detections in the test. type: Number - contextPath: AttackIQTest.Failed description: The number of failures in the test. type: Number - contextPath: AttackIQTest.Finished description: Whether the test is finished. type: Boolean - contextPath: AttackIQTest.Passed description: The number of passed tests. type: Number - contextPath: AttackIQTest.Errored description: The number of tests that returned errors. type: Number - contextPath: AttackIQTest.Total description: The total number of tests that were run. type: Number - contextPath: AttackIQTest.Id description: The ID of the assessment test. type: String - arguments: - default: true description: The ID of the assessment that contains the tests. name: assessment_id required: true - description: The Maximum page size for the results. name: page_size - defaultValue: '1' description: The page number to return. name: page_number description: Returns a list of tests by an assessment. name: attackiq-list-tests-by-assessment outputs: - contextPath: AttackIQTest.Id description: ID of the test. type: String - contextPath: AttackIQTest.Name description: The name of the test. type: String - contextPath: AttackIQTest.Description description: The description of the test. type: String - contextPath: AttackIQTest.Scenarios.Id description: The ID of the test scenario. type: String - contextPath: AttackIQTest.Scenarios.Name description: The name of the test scenario. type: String - contextPath: AttackIQTest.Assets.Id description: The ID of the test asset. type: String - contextPath: AttackIQTest.Assets.Ipv4Address description: The IPv4 address of the test asset. type: String - contextPath: AttackIQTest.Assets.Hostname description: The host name of the test asset. type: String - contextPath: AttackIQTest.Assets.ProductName description: The product name of the test asset. type: String - contextPath: AttackIQTest.Assets.Modified description: The last modified date of the test asset. type: String - contextPath: AttackIQTest.Assets.Status description: The status of the test asset. Can be Active or Inactive. type: Date - contextPath: AttackIQTest.TotalAssetCount description: The number of assets in which the test ran. type: Number - contextPath: AttackIQTest.CronExpression description: The Cron expression of the test. type: String - contextPath: AttackIQTest.Runnable description: Whether the test can run. type: Boolean - contextPath: AttackIQTest.LastResult description: The last result of the test. type: String - contextPath: AttackIQTest.User description: The name of the user that ran the test in the assessment. type: String - contextPath: AttackIQTest.Created description: The date that the test was created. type: Date - contextPath: AttackIQTest.Modified description: The date that the test was last modified. type: Date - contextPath: AttackIQTest.LatestInstanceId description: The ID of the most recent run of the test. type: Number - contextPath: AttackIQTest.UsingDefaultAssets description: Whether the test uses default assets. type: Boolean - contextPath: AttackIQTest.UsingDefaultSchedule description: Whether the test uses the default schedule. type: Boolean - contextPath: AttackIQTest.RemainingPages description: The number of remaining pages to return. For example, if the total number of pages is 6, and the last fetch was page 5, the value is 1. type: Number - contextPath: AttackIQTest.Count description: The total number of tests. type: Number - arguments: - description: ID of the test in which to show results. name: test_id required: true - auto: PREDEFINED defaultValue: 'False' description: Shows the last result. If true, shows the last result. Default is false. name: show_last_result predefined: - 'True' - 'False' - defaultValue: '1' description: The page number of the test results. name: page_number - description: The maximum page size of the results. name: page_size - auto: PREDEFINED description: Filters results according to user choice. If set to Passed, will return only passed tests. If set to Failed, will return only failed tests. name: outcome_filter predefined: - Passed - Failed description: Returns the test results of an assessment. name: attackiq-get-test-results outputs: - contextPath: AttackIQTestResult.Id description: ID of the test result. type: String - contextPath: AttackIQTestResult.Modified description: The date the test result was last modified. type: Date - contextPath: AttackIQTestResult.Assessment.Id description: The ID of the test assessment. type: String - contextPath: AttackIQTestResult.Assessment.Name description: The name of the test assessment. type: String - contextPath: AttackIQTestResult.LastResult description: The result of the test's last run. type: String - contextPath: AttackIQTestResult.Scenario.Id description: The scenario ID of the test results. type: String - contextPath: AttackIQTestResult.Scenario.Name description: The scenario name of the test results. type: String - contextPath: AttackIQTestResult.Scenario.Description description: The scenario description of the test results. type: String - contextPath: AttackIQTestResult.Asset.Id description: The ID of the test results asset. type: String - contextPath: AttackIQTestResult.Asset.Ipv4Address description: The IP address of the test results scenario asset. type: String - contextPath: AttackIQTestResult.Asset.Hostname description: The host name of the test results asset. type: String - contextPath: AttackIQTestResult.Asset.ProductName description: The product name of the test results asset. type: String - contextPath: AttackIQTestResult.Asset.Modified description: The date that the asset was last modified. type: Date - contextPath: AttackIQTestResult.AssetGroup description: The asset group of the test. type: String - contextPath: AttackIQTestResult.JobState description: The state of the job. type: String - contextPath: AttackIQTestResult.Outcome description: The result outcome of the test. type: String - contextPath: AttackIQTestResult.RemainingPages description: The number of remaining pages to return. For example, if the total number pages is 6, and the last fetch was page 5, the value is 1. type: Number - contextPath: AttackIQTestResult.Count description: The total number of tests. type: Number - description: List all available assessment templates. name: attackiq-list-assessment-templates outputs: - contextPath: AttackIQ.Template.ID description: 'The template ID. ' type: String - contextPath: AttackIQ.Template.Name description: The template name. type: String - contextPath: AttackIQ.Template.ProjectName description: The name of the project the templete is in. type: String - contextPath: AttackIQ.Template.Description description: The description of the template. type: String - contextPath: AttackIQ.Template.ProjectDescription description: The description of the project the template is in. type: String - contextPath: AttackIQ.Template.Hidden description: Whether the template is hidden. type: Boolean - description: List all assets. name: attackiq-list-assets outputs: - contextPath: AttackIQ.Asset.ID description: The asset ID. type: String - contextPath: AttackIQ.Asset.Description description: The description of the asset. type: String - contextPath: AttackIQ.Asset.IPv4 description: The IPv4 address of the asset. type: String - contextPath: AttackIQ.Asset.IPv6 description: The IPv6 address of the asset. type: String - contextPath: AttackIQ.Asset.MacAddress description: The MAC address of the asset. type: String - contextPath: AttackIQ.Asset.ProcessorArch description: The processor arch of the asset. type: String - contextPath: AttackIQ.Asset.ProductName description: The name of the asset. type: String - contextPath: AttackIQ.Asset.Hostname description: The hostname of the asset. type: String - contextPath: AttackIQ.Asset.Domain description: The domain of the asset. type: String - contextPath: AttackIQ.Asset.User description: The user of the asset. type: String - contextPath: AttackIQ.Asset.Status description: Status of the asset. type: String - contextPath: AttackIQ.Asset.Groups.ID description: The ID of the asset's group. type: String - contextPath: AttackIQ.Asset.Groups.Name description: The name of the asset's group. type: String - arguments: - description: The name of the new assesment. name: name required: true - description: The ID of the template from which to create the assesment. name: template_id required: true description: Creates a new assesment. name: attackiq-create-assessment outputs: - contextPath: AttackIQ.Assessment.Id description: The ID of the assessment. type: String - contextPath: AttackIQ.Assessment.Name description: The name of the assessment name. type: String - contextPath: AttackIQ.Assessment.Description description: The description of the assessment. type: String - contextPath: AttackIQ.Assessment.StartDate description: The start date of the assessment. type: Date - contextPath: AttackIQ.Assessment.EndDate description: The end date of the assessment. type: Date - contextPath: AttackIQ.Assessment.AssessmentState description: The state of the assessment. Can be Active or Inactive. type: String - contextPath: AttackIQ.Assessment.DefaultSchedule description: The default schedule timing (cron) of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateId description: The template ID of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateName description: The template name of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateDescription description: The template description of the assessment. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateDefaultSchedule description: The assessment's template default schedule timing (cron). type: Unknown - contextPath: AttackIQ.Assessment.AssessmentTemplateCompany description: The owner of the template. type: String - contextPath: AttackIQ.Assessment.AssessmentTemplateCreated description: The date that the template was created. type: Date - contextPath: AttackIQ.Assessment.AssessmentTemplateModified description: The date that the template was last modified. type: Date - contextPath: AttackIQ.Assessment.Creator description: The user who created the assessment. type: String - contextPath: AttackIQ.Assessment.Owner description: The user who owns the assessment. type: String - contextPath: AttackIQ.Assessment.User description: The user who ran the assessment. type: String - contextPath: AttackIQ.Assessment.Created description: The date that the assessment was created. type: String - contextPath: AttackIQ.Assessment.Modified description: The date that the assessment was last modified. type: String - contextPath: AttackIQ.Assessment.Users description: The user IDs that can access the assessment. type: String - contextPath: AttackIQ.Assessment.Groups description: The user groups that can access the assessment. type: String - contextPath: AttackIQ.Assessment.DefaultAssetCount description: The number of machines (assets) that are connected to the assessment. type: Number - contextPath: AttackIQ.Assessment.DefaultAssetGroupCount description: The number of asset groups that are connected to the assessment. type: Number - contextPath: AttackIQ.Assessment.MasterJobCount description: The number of tests that ran in the assessment. type: Number - contextPath: AttackIQ.Assessment.Count description: The total number of assessments. type: Number - contextPath: AttackIQ.Assessment.RemainingPages description: The number of remaining pages to return. For example, if the total number of pages is 6, and the last fetch was page 5, the value is 1. type: Number - arguments: - description: A comma-seperated list of asset IDs. isArray: true name: assets - description: A comma-seperated list of asset group IDs. isArray: true name: asset_groups - description: The ID of the assessment to which the assets will be added. name: assessment_id required: true description: Adds assets or asset groups to an assesment. name: attackiq-add-assets-to-assessment - arguments: - description: The ID of the assessment to delete. name: assessment_id required: true description: Deletes an assessment. name: attackiq-delete-assessment dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' type: python subtype: python3 tests: - AttackIQ - Test fromversion: 5.0.0