category: Network Security provider: Claroty sectionorder: - Connect - Collect fromversion: 5.0.0 commonfields: id: Claroty version: -1 configuration: - display: CTD Server URL (e.g. https://:5000) name: url required: true type: 0 section: Connect - display: Username name: credentials required: true type: 9 section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect required: false - display: Use system proxy settings name: proxy type: 8 section: Connect required: false - display: Incident type name: incidentType type: 13 section: Collect required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - display: Fetch incidents name: isFetch type: 8 section: Collect required: false - defaultvalue: 7 days display: The initial time to fetch from name: fetch_time type: 0 section: Collect required: false - display: Max per page name: max_fetch type: 0 section: Collect defaultvalue: '10' required: false - display: Minimal severity to fetch by name: severity type: 15 section: Collect options: - Low - Medium - High - Critical required: false - display: Site ID to fetch by name: site_id type: 0 section: Collect additionalinfo: All sites if none selected required: false - display: Fetch by alert type name: alert_type type: 0 section: Collect required: false - display: Exclude resolved alerts name: exclude_resolved_alerts type: 8 section: Collect required: false - display: Include only ARR completed alerts name: include_only_arr_completed_alerts type: 8 section: Collect additionalinfo: Includes only alerts that have completed their initial Automated Resolution Rules flow defaultvalue: 'false' required: false description: Use the Claroty CTD integration to manage assets and alerts. display: Claroty name: Claroty script: commands: - arguments: - auto: PREDEFINED defaultValue: all description: Asset fields to return. The default value is "all". name: fields predefined: - all - id - name - insight_names - vendor - criticality - asset_type - last_seen - ipv4 - mac - virtual_zone_name - class_type - site_name - project_parsed - risk_level - firmware_version - site_id - auto: PREDEFINED description: Returns assets with this criticality. Can be "Low", "Medium", or "High". name: criticality predefined: - Low - Medium - High - description: Get assets with that include the given insight name. name: insight_name predefined: - '' - auto: PREDEFINED defaultValue: 'False' description: Add aditional value for the asset CVEs. name: should_enrich_assets predefined: - 'True' - 'False' - defaultValue: '10' description: Maximal value of assets to query at once. name: asset_limit - description: Get all assets seen last from the given date. Format - YYYY-MM-DDThh:mm:ssZ. Example - 2020-02-02T01:02:03Z. name: assets_last_seen description: Gets all assets from CTD. You can apply one or more filters. name: claroty-get-assets outputs: - contextPath: Claroty.Asset.AssetID description: The ID of the asset. type: Number - contextPath: Claroty.Asset.AssetType description: The asset type. type: String - contextPath: Claroty.Asset.CVE.CVSS description: CVE Score. type: String - contextPath: Claroty.Asset.CVE.Description description: CVE Description. type: String - contextPath: Claroty.Asset.CVE.ID description: CVE ID. type: String - contextPath: Claroty.Asset.CVE.Modified description: CVE modification date. type: Date - contextPath: Claroty.Asset.CVE.Published description: CVE publish date. type: Date - contextPath: CVE.CVSS description: CVE Score. type: String - contextPath: CVE.Description description: CVE Description. type: String - contextPath: CVE.ID description: CVE ID. type: String - contextPath: CVE.Modified description: CVE modification date. type: Date - contextPath: CVE.Published description: CVE publish date. type: Date - contextPath: Claroty.Asset.ClassType description: The OT/IT class type. type: String - contextPath: Claroty.Asset.Criticality description: The criticality of the asset, according to the Purdue model. type: String - contextPath: Claroty.Asset.FirmwareVersion description: The FM version of the asset. type: String - contextPath: Claroty.Asset.HighestCVEScore description: Highest CVE Score for the Asset. type: Number - contextPath: Claroty.Asset.IP description: The IPv4 address of the asset. type: String - contextPath: Claroty.Asset.InsightName description: The asset insight names generated by CTD. type: String - contextPath: Claroty.Asset.LastSeen description: The date the asset was last seen. type: Date - contextPath: Claroty.Asset.MAC description: The MAC address of the asset. type: String - contextPath: Claroty.Asset.Name description: The asset name. type: String - contextPath: Claroty.Asset.ResourceID description: The asset RID (AssetID-SiteID). type: String - contextPath: Claroty.Asset.RiskLevel description: The risk indicator. type: Number - contextPath: Claroty.Asset.SiteID description: The site ID of the asset. type: Number - contextPath: Claroty.Asset.SiteName description: The site name of the asset. type: String - contextPath: Claroty.Asset.Vendor description: The vendor of the asset. type: String - contextPath: Claroty.Asset.VirtualZone description: The virtual zone of the asset. type: String - contextPath: Claroty.Asset.WasParsed description: Whether the project was parsed. type: String - arguments: - auto: PREDEFINED defaultValue: all description: Alert fields to return. name: fields predefined: - all - resource_id - type - severity - network_id - resolved - description - alert_indicators - actionable_assets - category - initial_arr_flow_completed - auto: PREDEFINED defaultValue: timestamp description: |- The field by which to sort the results. The default value is "timestamp". Default sort order is ascending. name: sort_by predefined: - resource_id - type - severity - network_id - resolved - description - alert_indicators - actionable_assets - id - timestamp - description: Returns alerts that match this alert type. name: type - description: The start date from which to get alerts. Format - YYYY-MM-DDThh:mm:ssZ. Example - 2020-02-02T01:02:03Z. name: date_from - auto: PREDEFINED defaultValue: asc description: The sorting order of the alerts - descending or ascending. name: sort_order predefined: - asc - desc - description: The maximum number of alerts to query. name: alert_limit - auto: PREDEFINED description: Set minimal severity to query by. name: minimal_severity predefined: - Low - Medium - High - Critical - description: Returns only unresloved alerts. name: exclude_resolved_alerts - auto: PREDEFINED defaultValue: 'False' description: Includes only alerts that have completed their initial Automated Resolution Rules flow. name: include_only_arr_completed_alerts predefined: - 'True' - 'False' description: Gets alerts from CTD. name: claroty-query-alerts outputs: - contextPath: Claroty.Alert.AlertType description: The alert type. type: String - contextPath: Claroty.Alert.AlertTypeID description: The alert type int value. type: Number - contextPath: Claroty.Alert.Description description: The alert description. type: String - contextPath: Claroty.Alert.Indicator description: The alert indicators. type: String - contextPath: Claroty.Alert.NetworkID description: The network ID. type: Number - contextPath: Claroty.Alert.RelatedAssets description: Assets related to the alert. type: String - contextPath: Claroty.Alert.RelatedAssets.AssetID description: The ID of the asset. type: Number - contextPath: Claroty.Alert.RelatedAssets.AssetType description: The asset type. type: String - contextPath: Claroty.Alert.RelatedAssets.ClassType description: The OT/IT class type. type: String - contextPath: Claroty.Alert.RelatedAssets.Criticality description: The criticality of the asset, according to the Purdue model. type: String - contextPath: Claroty.Alert.RelatedAssets.FirmwareVersion description: The FM version of the asset. type: String - contextPath: Claroty.Alert.RelatedAssets.IP description: The IPv4 address of the asset. type: String - contextPath: Claroty.Alert.RelatedAssets.InsightName description: The asset insight names generated by CTD. type: String - contextPath: Claroty.Alert.RelatedAssets.LastSeen description: The date the asset was last seen. type: Date - contextPath: Claroty.Alert.RelatedAssets.MAC description: The MAC address of the asset. type: String - contextPath: Claroty.Alert.RelatedAssets.Name description: The asset name. type: String - contextPath: Claroty.Alert.RelatedAssets.ResourceID description: The asset RID (AssetID-SiteID). type: String - contextPath: Claroty.Alert.RelatedAssets.RiskLevel description: The risk indicator. type: Number - contextPath: Claroty.Alert.RelatedAssets.SiteID description: The site ID of the asset. type: Number - contextPath: Claroty.Alert.RelatedAssets.SiteName description: The site name of the asset. type: String - contextPath: Claroty.Alert.RelatedAssets.Vendor description: The vendor of the asset. type: String - contextPath: Claroty.Alert.RelatedAssets.VirtualZone description: The virtual zone of the asset. type: String - contextPath: Claroty.Alert.RelatedAssets.WasParsed description: Whether the project was parsed. type: String - contextPath: Claroty.Alert.Resolved description: The resolve status of the alert. type: Number - contextPath: Claroty.Alert.ResourceID description: The alert resource ID (AlertID-SiteID). type: String - contextPath: Claroty.Alert.Severity description: The alert severity. type: String - contextPath: Claroty.Alert.Category description: The alert category. type: String - contextPath: Claroty.Alert.InitialArrFlowCompleted description: Whether the alert has completed its initial Automated Resolution Rules flow. type: Boolean - arguments: - description: The ResourceId of the Alerts to resolve (in - format). name: selected_alerts required: true - auto: PREDEFINED defaultValue: resolve description: How to resolve the alert. Can be "archive" or "resolve". The default value is "resolve". name: resolve_as predefined: - archive - resolve - defaultValue: Resolved by Demisto description: A comment to add when resolving an alert. name: resolve_comment description: Resolves alerts. execution: true name: claroty-resolve-alert outputs: - contextPath: Claroty.Resolve_out.success description: Success output of alert resolving. type: String - arguments: - auto: PREDEFINED defaultValue: all description: Asset fields to return. The default value is "all". name: fields predefined: - all - resource_id - type - severity - network_id - resolved - description - alert_indicators - actionable_assets - description: Resource ID of the desired alert. Expected value - -. name: alert_rid required: true description: Get a single alert from CTD. name: claroty-get-single-alert outputs: - contextPath: Claroty.Alert.AlertType description: The alert type. type: String - contextPath: Claroty.Alert.AlertTypeID description: The alert type int value. type: Number - contextPath: Claroty.Alert.Description description: The alert description. type: String - contextPath: Claroty.Alert.Indicator description: The alert indicators. type: String - contextPath: Claroty.Alert.NetworkID description: The network ID. type: Number - contextPath: Claroty.Alert.RelatedAssets description: Assets related to the alert. type: String - contextPath: Claroty.Alert.Resolved description: The resolve status of the alert. type: Number - contextPath: Claroty.Alert.ResourceID description: The alert resource ID (AlertID-SiteID). type: String - contextPath: Claroty.Alert.Severity description: The alert severity. type: String dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '-' subtype: python3 type: python autoUpdateDockerImage: true defaultclassifier: Claroty defaultmapperin: Claroty-mapper tests: - No tests (auto formatted)