commonfields:
  id: BeyondTrust Privilege Management Cloud
  version: -1
sectionorder:
- Connect
- Collect
name: BeyondTrust Privilege Management Cloud
display: BeyondTrust Privilege Management Cloud
category: Endpoint
provider: BeyondTrust
description: BeyondTrust Privilege Management Cloud (PM Cloud) integration for retrieving audit events and activity logs.
configuration:
- display: Server URL
  name: url
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
  additionalinfo: "The server URL, e.g. https://[yourProductionSub-domainName]-services.pm.beyondtrustcloud.com"
- display: Client ID
  displaypassword: Client Secret
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Events types to fetch
  name: events_types_to_fetch
  defaultvalue: Activity Audits,Events
  type: 16
  required: false
  section: Connect
  options:
  - Activity Audits
  - Events
  - Activity Audits,Events
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Fetch events
  name: isFetch
  defaultvalue: "false"
  type: 8
  required: false
  section: Collect
- display: Maximum number of events (per type)
  name: max_fetch
  defaultvalue: "5000"
  type: 0
  required: false
  section: Collect
  additionalinfo: Maximum number of events to fetch per fetch cycle.
- display: First fetch timestamp
  name: first_fetch
  defaultvalue: "1 minute"
  type: 0
  required: false
  section: Collect
  additionalinfo: "The time from which to start fetching events on first run. Defaults to 1 minute ago to fetch only new events. Use values like '3 days', '1 week' for historical data if needed."
script:
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  commands:
  - name: beyondtrust-pm-cloud-get-events
    arguments:
    - name: event_type
      required: false
      description: "The type of events to retrieve."
      defaultValue: "Events"
      auto: PREDEFINED
      predefined:
      - "Events"
      - "Activity Audits"
    - name: start_date
      required: false
      description: "Start Date(UTC) to search events from (Elastic Ingestion Timestamp in UTC). Example: 2022-08-12T17:34:28.694Z. If not provided, defaults to 1 hour ago."
    - name: limit
      required: false
      description: "Maximum records that can be returned. For Events: max 1000. For Activity Audits: max 200."
      defaultValue: "50"
    - name: should_push_events
      required: false
      description: "Set to true to push events to XSIAM. Used for debugging."
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    description: "This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding. Retrieves events or activity audits from BeyondTrust PM Cloud."
    outputs:
    - contextPath: BeyondTrust.Event.id
      description: The ID of the event.
      type: String
    - contextPath: BeyondTrust.Event.created
      description: The creation time of the event.
      type: Date
    - contextPath: BeyondTrust.Event.@timestamp
      description: The timestamp of the event.
      type: Date
    - contextPath: BeyondTrust.Event.auditType
      description: Audit type name (Activity Audits only).
      type: String
    - contextPath: BeyondTrust.Event.details
      description: Details of the activity (Activity Audits only).
      type: String
    - contextPath: BeyondTrust.Event.entity
      description: Name of Activity Audit entity (Activity Audits only).
      type: String
    - contextPath: BeyondTrust.Event.user
      description: Initiated user email or API client identifier (Activity Audits only).
      type: String
    - contextPath: BeyondTrust.Event.changedBy
      description: Audit ChangedBy - API or Portal (Activity Audits only).
      type: String
fromversion: 6.10.0
tests:
- No tests (auto formatted)