name: CohesityHelios
display: CohesityHelios
sectionorder:
- Connect
- Collect
category: Vulnerability Management
provider: Cohesity
commonfields:
  id: CohesityHelios
  version: -1
configuration:
- defaultvalue: https://helios.cohesity.com
  display: Your server URL
  name: url
  section: Connect
  required: true
  type: 0
- display: API Key
  additionalinfo: The API Key to use for connection
  name: apikey
  section: Connect
  required: true
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  section: Connect
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  section: Connect
  type: 8
  required: false
- display: Incident type
  name: incidentType
  section: Connect
  defaultvalue: Cohesity Helios Ransomware Incident
  type: 13
  required: false
- defaultvalue: '200'
  display: Maximum number of incidents to fetch every time
  name: max_fetch
  section: Collect
  required: true
  type: 0
- defaultvalue: 7 days
  display: First fetch timestamp
  name: first_fetch
  section: Collect
  type: 0
  required: false
- display: Fetch incidents
  name: isFetch
  section: Collect
  defaultvalue: 'true'
  type: 8
  required: false
- defaultvalue: "15"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  section: Collect
  type: 19
  required: false
description: 'Integrate with Cohesity Helios services to fetch alerts and take remedial action.'
script:
  commands:
  - arguments:
    - name: created_after
      description: Returns only alerts created after the provided timestamp (ISO8601 format YYYY-MM-DDTHH:MM:SSZ).
    - name: created_before
      description: Returns only alerts created before the provided timestamp (ISO8601 format YYYY-MM-DDTHH:MM:SSZ).
    - name: limit
      defaultValue: 200
      description: Limits the number of alerts to return.
    - description: List of comma-separated alert identifiers to filter alerts.
      isArray: true
      name: alert_id_list
    - description: List of comma-separated cluster identifiers to filter alerts.
      isArray: true
      name: cluster_id_list
    - description: List of comma-separated region identifiers to filter alerts.
      isArray: true
      name: region_id_list
    - auto: PREDEFINED
      defaultValue: kOpen
      description: One or more state values.
      isArray: true
      name: alert_state_list
      predefined:
      - kOpen
      - kSuppressed
      - kResolved
      - kNote
    - auto: PREDEFINED
      default: true
      defaultValue: kCritical,kWarning
      description: One or more severity levels.
      isArray: true
      name: alert_severity_list
      predefined:
      - kCritical
      - kWarning
      - kInfo
    description: Get Cohesity Helios ransomware alerts.
    name: cohesity-helios-get-ransomware-alerts
    outputs:
    - contextPath: CohesityHelios.RansomwareAlert.alert_id
      description: The identifier for the ransomware alert.
      type: String
    - contextPath: CohesityHelios.RansomwareAlert.occurrence_time
      description: The timestamp when the alert occurred (for example, 2020-01-01T00:11:22Z).
      type: Date
    - contextPath: CohesityHelios.RansomwareAlert.severity
      description: The severity of the ransomware alert.
      type: String
    - contextPath: CohesityHelios.RansomwareAlert.alert_description
      description: The description for the ransomware alert.
      type: String
    - contextPath: CohesityHelios.RansomwareAlert.alert_cause
      description: The cause for the ransomware alert.
      type: String
    - contextPath: CohesityHelios.RansomwareAlert.cluster_id
      description: The cluster ID where the alert originated.
      type: Number
    - contextPath: CohesityHelios.RansomwareAlert.cluster_name
      description: The cluster name where the alert originated.
      type: String
    - contextPath: CohesityHelios.RansomwareAlert.entity_id
      description: The entity ID (object ID) from the alert propertyList.
      type: String
    - contextPath: CohesityHelios.RansomwareAlert.job_id
      description: The job ID from the alert propertyList.
      type: String
  - arguments:
    - description: The alert ID to suppress.
      name: alert_id
      required: true
    description: Ignore detected anomalous object by suppressing the alert.
    name: cohesity-helios-ignore-anomalous-object
  - arguments:
    - description: The alert ID to restore the latest clean snapshot for.
      name: alert_id
      required: true
    description: Restore the latest clean snapshot for the given object using incidence details.
    name: cohesity-helios-restore-latest-clean-snapshot
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- xsoar
- marketplacev2
- platform
fromversion: 6.0.0
tests:
- No tests (auto formatted)
defaultmapperin: Cohesity Helios Incoming mapper