category: Endpoint
provider: Permira
commonfields:
  id: Code42
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: console.us.code42.com
  display: Code42 Console URL for your Code42 environment
  name: console_url
  required: false
  type: 0
  section: Connect
  hidden: true
- defaultvalue: api.us.code42.com
  display: API Gateway URL for your Code42 environment
  name: api_url
  required: true
  type: 0
  section: Connect
- display: API Client ID
  name: credentials
  required: true
  type: 9
  displaypassword: API Client Secret
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Alert severities to fetch when fetching incidents
  name: alert_severity
  options:
  - Critical
  - High
  - Moderate
  - Low
  type: 16
  required: false
  section: Collect
- defaultvalue: 24 hours
  display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
  name: fetch_time
  type: 0
  required: false
  section: Collect
- defaultvalue: '5'
  display: Alerts to fetch per run; note that increasing this value may result in slow performance if too many results are returned at once
  name: fetch_limit
  type: 0
  required: false
  section: Collect
- defaultvalue: 'false'
  display: Include the list of files in returned incidents.
  name: include_files
  type: 8
  required: false
  section: Collect
- name: incidentFetchInterval
  display: Incidents Fetch Interval
  defaultvalue: '3'
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
description: Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.
display: Code42
name: Code42
script:
  commands:
  - arguments:
    - description: Add results to context at 'Code42.FileEvents'. If 'false', the search will only display results as a markdown table.
      name: add-to-context
      defaultValue: false
    - description: Raw JSON file event query to be used for search.
      name: json
    - description: The number of file events to return. Defaults to 50.
      name: results
      defaultValue: 50
    - defaultValue: "1"
      description: Filter results by minimum risk score.
      name: min_risk_score
    - description: MD5 or SHA256 hash of the file to search for.
      name: hash
    - description: Username to search for.
      name: username
    - description: Hostname to search for.
      name: hostname
    description: Search for Code42 Incydr File Events.
    name: code42-file-events-search
    outputs:
    - contextPath: Code42.FileEvents.timestamp
      description: The timestamp when the event occurred.
      type: date
    - contextPath: Code42.FileEvents.event
      description: Summary information about the event, including date observed, event type, and event source.
    - contextPath: Code42.FileEvents.user
      description: Details about the user associated with the event (if any).
    - contextPath: Code42.FileEvents.destination
      description: Details about the destination target of the event (if any).
    - contextPath: Code42.FileEvents.process
      description: Details about the CPU process involved in the event (if any).
    - contextPath: Code42.FileEvents.risk
      description: Details overall risk severity for the event and lists all associated risk indicators.
    - contextPath: Code42.FileEvents.git
      description: Details about git repository involved in event (if any).
    - contextPath: Code42.FileEvents.report
      description: Details about Salesforce reports involved in the event (if any).
    - contextPath: Code42.FileEvents.file
      description: Details about file metadata for file involved in the event (if any).
    - contextPath: Code42.FileEvents.source
      description: Info about the origin of a file involved in the event (if any).
  - arguments:
    - description: The alert session ID to retrieve. Alert IDs are associated with alerts that are fetched via fetch-incidents.
      name: id
      required: true
    description: Retrieve alert details by alert ID.
    name: code42-alert-get
    outputs:
    - contextPath: Code42.SecurityAlert.Username
      description: The username associated with the alert.
      type: string
    - contextPath: Code42.SecurityAlert.Occurred
      description: The timestamp when the session began.
      type: date
    - contextPath: Code42.SecurityAlert.Description
      description: The rule names of the alerts included in the session.
      type: string
    - contextPath: Code42.SecurityAlert.ID
      description: The alert session ID.
      type: string
    - contextPath: Code42.SecurityAlert.Name
      description: The description of the events that comprise the session.
      type: string
    - contextPath: Code42.SecurityAlert.State
      description: The alert session state.
      type: string
    - contextPath: Code42.SecurityAlert.Severity
      description: The severity of the alerts in the session.
      type: string
  - arguments:
    - description: The alert session ID to resolve. Alert session IDs are associated with alerts that are fetched via fetch-incidents.
      name: id
      required: true
    - description: The desired state for the alert session. Possible states are OPEN, CLOSED_TP (true positive), CLOSED_FP (false positive), and CLOSED_TP_BENIGN (benign).
      name: state
      auto: PREDEFINED
      predefined:
      - OPEN
      - CLOSED_TP
      - CLOSED_FP
      - CLOSED_TP_BENIGN
      required: true
    description: Changes the state of an Incydr alert session.
    name: code42-alert-update
    outputs:
    - contextPath: Code42.SecurityAlert.ID
      description: The alert ID of the resolved alert.
      type: string
  - arguments:
    - description: The alert session ID to resolve. Alert session IDs are associated with alerts that are fetched via fetch-incidents.
      name: id
      required: true
    description: DEPRECATED. Use code42-alert-update instead.
    deprecated: true
    name: code42-alert-resolve
    outputs:
    - contextPath: Code42.SecurityAlert.ID
      description: The alert ID of the resolved alert.
      type: string
  - arguments:
    - description: The name of the Code42 organization from which to add the user.
      name: orgname
      required: true
    - description: The username to give to the user.
      name: username
      required: true
    - defaultValue: The email to give to the user.
      description: The email of the user to create.
      name: email
      required: true
    deprecated: true
    description: DEPRECATED. Use the Incydr console to create users.
    name: code42-user-create
    outputs:
    - contextPath: Code42.User.Username
      description: A username for a Code42 user.
      type: String
    - contextPath: Code42.User.Email
      description: An email for a Code42 user.
      type: String
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - description: The username of the user to block.
      name: username
      required: true
    deprecated: true
    description: DEPRECATED. Use the Incydr console to block users.
    name: code42-user-block
    outputs:
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - description: The username of the user to deactivate.
      name: username
      required: true
    description: Deactivate a user in Code42; signing them out of their devices. Backups discontinue for a deactivated user, and their archives go to cold storage.
    name: code42-user-deactivate
    outputs:
    - contextPath: Code42.User.UserID
      description: The ID of a Code42 User.
      type: String
  - arguments:
    - description: The username of the user to unblock.
      name: username
      required: true
    deprecated: true
    description: DEPRECATED. Use the Incydr console to unblock users.
    name: code42-user-unblock
    outputs:
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - description: The username of the user to reactivate.
      name: username
      required: true
    description: Reactivates the user with the given username.
    name: code42-user-reactivate
    outputs:
    - contextPath: Code42.User.UserID
      description: The ID of a Code42 User.
      type: String
  - arguments:
    - description: The username of the user to add to the given legal hold matter.
      name: username
      required: true
    - description: The name of the legal hold matter to which the user will be added.
      name: mattername
      required: true
    description: Adds a Code42 user to a legal hold matter.
    name: code42-legalhold-add-user
    outputs:
    - contextPath: Code42.LegalHold.UserID
      description: The ID of a Code42 user.
      type: Unknown
    - contextPath: Code42.LegalHold.MatterID
      description: The ID of a Code42 legal hold matter.
      type: String
    - contextPath: Code42.LegalHold.Username
      description: A username for a Code42 user.
      type: String
    - contextPath: Code42.LegalHold.MatterName
      description: A name for a Code42 legal hold matter.
      type: String
  - arguments:
    - description: The username of the user to release from the given legal hold matter.
      name: username
      required: true
    - description: The name of the legal hold matter from which the user will be released.
      name: mattername
      required: true
    description: Removes a Code42 user from a legal hold matter.
    name: code42-legalhold-remove-user
    outputs:
    - contextPath: Code42.LegalHold.UserID
      description: The ID of a Code42 user.
      type: Unknown
    - contextPath: Code42.LegalHold.MatterID
      description: The ID of a Code42 legal hold matter.
      type: String
    - contextPath: Code42.LegalHold.Username
      description: A username for a Code42 user.
      type: String
    - contextPath: Code42.LegalHold.MatterName
      description: A name for a Code42 legal hold matter.
      type: String
  - arguments:
    - description: Either the SHA256 or MD5 hash of the file.
      name: hash
      required: true
    - description: The filename to save the file as.
      name: filename
    description: Downloads a file from Code42.
    name: code42-download-file
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  - name: code42-download-file-by-xfc-id
    description: Downloads a file from Incydr using the XFC Event ID.
    arguments:
    - description: The XFC Event ID of the file to download.
      name: xfc_id
      required: true
    - description: The filename to save the file as.
      name: filename
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  - name: code42-watchlists-list
    description: List all existing watchlists in your environment.
    outputs:
    - contextPath: Code42.Watchlists.ListType
      description: The Type of Watchlist.
      type: string
    - contextPath: Code42.Watchlists.Id
      description: The ID of the Watchlist.
      type: string
    - contextPath: Code42.Watchlists.IncludedUserCount
      description: The count of included users on the Watchlist.
      type: integer
  - name: code42-watchlists-add-user
    description: Add a user to a watchlist.
    arguments:
    - name: username
      required: true
      description: Email id of the user to add to Watchlist.
    - name: watchlist
      required: true
      description: WatchlistID or WatchlistType to add user to.
    outputs:
    - contextPath: Code42.UsersAddedToWatchlists.Watchlist
      description: The ID/Type of the watchlist user was added to.
      type: string
    - contextPath: Code42.UsersAddedToWatchlists.Username
      description: The username added to watchlist.
      type: string
    - contextPath: Code42.UsersAddedToWatchlists.Success
      description: If the user was added successfully.
      type: boolean
    compliantpolicies:
    - User Soft Remediation
  - name: code42-watchlists-remove-user
    description: Remove a user from a watchlist.
    arguments:
    - name: username
      description: Email id of the user to add to Watchlist.
      required: true
    - name: watchlist
      required: true
      description: WatchlistID or WatchlistType to remove user from.
    outputs:
    - contextPath: Code42.UsersRemovedFromWatchlists.Watchlist
      description: The ID/Type of the watchlist user was removed from.
      type: string
    - contextPath: Code42.UsersRemovedFromWatchlists.Username
      description: The username removed from watchlist.
      type: string
    - contextPath: Code42.UsersRemovedFromWatchlists.Success
      description: If the user was removed successfully.
      type: boolean
  - name: code42-watchlists-list-included-users
    description: List all users who have been explicitly added to a given watchlist.
    arguments:
    - name: watchlist
      description: The WatchlistID or WatchlistType to get a list of included users for.
      required: true
    outputs:
    - contextPath: Code42.WatchlistUsers.WatchlistID
      description: The ID of the Watchlist.
      type: string
    - contextPath: Code42.WatchlistUsers.Username
      description: The username on the watchlist.
      type: string
    - contextPath: Code42.WatchlistUsers.AddedTime
      description: The datetime the user was added to the watchlist.
      type: datetime
  - name: code42-user-get-risk-profile
    description: Get the risk profile details for a given user.
    arguments:
    - name: username
      description: The user to get risk profile for.
      required: true
    outputs:
    - contextPath: Code42.UserRiskProfiles.Username
      description: The username.
      type: string
    - contextPath: Code42.UserRiskProfiles.StartDate
      description: The startDate value of the UserRiskProfile.
      type: date
    - contextPath: Code42.UserRiskProfiles.EndDate
      description: The startDate value of the UserRiskProfile.
      type: date
    - contextPath: Code42.UserRiskProfiles.Notes
      description: The notes value of the UserRiskProfile.
      type: string
  - name: code42-user-update-risk-profile
    description: Update a user's risk profile.
    arguments:
    - name: username
      description: The user to update.
      required: true
    - name: start_date
      description: The user's start date (useful for New Employee Watchlist).
    - name: end_date
      description: The user's end date (useful for Departing Employee Watchlist).
    - name: notes
      description: Risk profile notes.
    outputs:
    - contextPath: Code42.UpdatedUserRiskProfiles.Username
      description: The user that was updated.
      type: string
    - contextPath: Code42.UpdatedUserRiskProfiles.StartDate
      description: The startDate value of the UserRiskProfile after the update.
      type: date
    - contextPath: Code42.UpdatedUserRiskProfiles.EndDate
      description: The startDate value of the UserRiskProfile after the update.
      type: date
    - contextPath: Code42.UpdatedUserRiskProfiles.Notes
      description: The notes value of the UserRiskProfile after the update.
      type: string
    - contextPath: Code42.UpdatedUserRiskProfiles.Success
      description: If the risk profile update was successful.
      type: boolean
    compliantpolicies:
    - User Soft Remediation
  - name: code42-file-events-table
    description: Render Code42 file events from the context as a markdown table.
    arguments:
    - name: include
      description: |
        Select which events to include in the table.
        - 'incident' only displays the events that originally triggered the Code42 Alert.
        - 'searches' only displays events that have been added to the context from 'code42-file-events-search' commands.
        - 'all' will include all events in the table.
      defaultValue: all
      predefined:
      - all
      - incident
      - searches
  dockerimage: demisto/py42:1.0.0.10758190
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
defaultclassifier: Code42 - Classifier
defaultmapperin: Code42 - Mapping
tests:
- No tests (auto formatted)