category: Data Enrichment & Threat Intelligence
sectionorder:
- Connect
- Collect
provider: Coralogix
commonfields:
  id: Coralogix
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- additionalinfo: The Coralogix WebAPI endpoint for your account - Do not modify unless instructed to by Coralogix Customer Success
  defaultvalue: https://webapi.coralogix.com
  display: Coralogix WebAPI Endpoint URL
  name: webapi_url
  required: true
  type: 0
  section: Connect
- additionalinfo: Your Coralogix account private key. Can be found in Coralogix under Settings > Send your logs
  display: Private Key
  name: privatekey
  required: true
  type: 4
  section: Connect
- additionalinfo: This is the Coralogix Application Name that will be used when creating tags in Coralogix by using the coralogix-tag command
  defaultvalue: Demisto
  display: Application Name (for tags)
  name: app_name
  required: true
  type: 0
  section: Connect
- additionalinfo: This is the Coralogix Subsystem Name that will be used when creating tags in Coralogix by using the coralogix-tag command
  defaultvalue: Demisto
  display: Subsystem Name (for tags)
  name: subsystem_name
  required: true
  type: 0
  section: Connect
- additionalinfo: The Coralogix ES-API endpoint for your account - Do not modify unless instructed to by Coralogix Customer Success
  defaultvalue: https://coralogix-esapi.coralogix.com:9443
  display: Coralogix ES-API Endpoint URL
  name: esapi_url
  required: true
  type: 0
  section: Connect
- additionalinfo: Sets the query for retrieving incidents for Coralogix. If not set, the incidents fetch will retrieve all alerts that were sent to the Demisto/Cortex XSOAR webhook in Coralogix
  display: Basic incidents query
  name: incidents_query
  type: 0
  required: false
  section: Collect
- additionalinfo: Narrows the incidents search to a specific Application Name. If not set, the incidents fetch will retrieve all alerts that were sent to the Demisto/Cortex XSOAR webhook in Coralogix
  display: Incidents Application Name
  name: incidents_application_name
  type: 0
  required: false
  section: Collect
- additionalinfo: Narrow the incidents search to a specific severity level. If not set, the incidents fetch will retrieve all alerts that were sent to the Demisto/Cortex XSOAR webhook in Coralogix
  display: Incidents Severity
  name: incidents_severity
  type: 0
  required: false
  section: Collect
- additionalinfo: Sets the field in Coralogix response that will be used as the incident's name in Demisto/Cortex XSOAR. If not set will use the field 'alert_name'
  display: Incidents Name Field
  name: incident_description_field
  type: 0
  required: false
  section: Collect
- additionalinfo: Narrows the incidents search to a specific Subsystem Name. If not set, the incidents fetch will retrieve all alerts that were sent to the Demisto/Cortex XSOAR webhook in Coralogix
  display: Incidents Subsystem Name
  name: incidents_subsystem_name
  type: 0
  required: false
  section: Collect
- additionalinfo: Normally, when the Coralogix fetches incidents it will fetch incidents detected since the last time it fetched them. This value sets the time period (in days) to look for incidents on the first fetch. The default value is 3 days. This value cannot exceed the maximum allowed query range limit for the Coralogix account used.
  defaultvalue: '3'
  display: First fetch timestamp in days
  name: incidents_first_fetch_range
  type: 0
  required: false
  section: Collect
- additionalinfo: Maximum number of incidents to fetch at a single call to avoid overloading Cortex XSOAR
  defaultvalue: '50'
  display: Maximum number of incidents to fetch at a single call
  name: incidents_max_fetch
  type: 0
  required: false
  section: Collect
description: Fetch incidents, search for supporting data and tag interesting datapoints in/from your Coralogix account.
display: Coralogix
name: Coralogix
script:
  commands:
  - arguments:
    - description: The name of the tag.
      name: name
      required: true
    - description: The point in time to tag in Coralogix.
      name: timestamp
    - description: A link to an icon file (png, jpeg, SVG) that will be used as the tag image in Coralogix. Cannot exceed 50KB.
      name: icon_url
    description: Tag timestamp in Coralogix.
    name: coralogix-tag
  - arguments:
    - description: A Coralogix Lucene query.
      name: query
      required: true
    - description: Narrows the search to the specified Coralogix Application name.
      name: app_name
    - description: Narrows the search to the specified Coralogix Subsystem name.
      name: subsystem_name
    - description: Narrows the search to the specified Coralogix severity value.
      name: severity
    - description: Limit the search to the data that arrived after a certain timestamp. If not set will search for all the data matching the query.
      name: since_timestamp
    - description: Limit the search to data that arrived until a certain timestamp.If not set will search for all the data matching the query.
      name: to_timestamp
    - defaultValue: '50'
      description: The maximum number of events to retrieve per query.
      name: max_items_to_retrieve
      required: true
    description: Query Coralogix for information.
    name: coralogix-search
  dockerimage: demisto/python3:3.12.8.3296088
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- No tests