category: Endpoint provider: Palo Alto Networks defaultEnabled: true sectionorder: - Connect - Collect commonfields: id: Cortex Core - IR version: -1 configuration: - display: Server URL (copy URL from Core - click ? to see more info.) name: url type: 0 hidden: true required: false section: Connect - display: API Key ID name: apikey_id type: 4 hidden: true required: false section: Connect - display: API Key name: apikey type: 4 hidden: true required: false section: Connect - additionalinfo: The timeout of the HTTP requests sent to Cortex (in seconds). defaultvalue: '120' display: HTTP Timeout name: timeout type: 0 required: false section: Connect description: The Cortex Core IR integration uses the Cortex API for detection and response, by natively integrating network, endpoint, and cloud data to stop sophisticated attacks. display: Investigation & Response name: Cortex Core - IR script: commands: - arguments: - description: A date in the format 2019-12-31T23:59:00. Only incidents that were created on or before the specified date/time will be retrieved. name: lte_creation_time - description: A date in the format 2019-12-31T23:59:00. Only incidents that were created on or after the specified date/time will be retrieved. name: gte_creation_time - description: Filters returned incidents that were created on or before the specified date/time, in the format 2019-12-31T23:59:00. name: lte_modification_time - description: Filters returned incidents that were modified on or after the specified date/time, in the format 2019-12-31T23:59:00. name: gte_modification_time - description: An array or CSV string of incident IDs. isArray: true name: incident_id_list - description: Filters returned incidents that were created on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on. name: since_creation_time - description: Filters returned incidents that were modified on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on. name: since_modification_time - auto: PREDEFINED description: Sorts returned incidents by the date/time that the incident was last modified ("asc" - ascending, "desc" - descending). name: sort_by_modification_time predefined: - asc - desc - auto: PREDEFINED description: Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending). name: sort_by_creation_time predefined: - asc - desc - defaultValue: '0' description: Page number (for pagination). The default is 0 (the first page). name: page - defaultValue: '100' description: Maximum number of incidents to return per page. The default and maximum is 100. name: limit - description: 'Filters only incidents in the specified status. The options are: new, under_investigation, resolved_known_issue, resolved_false_positive, resolved_true_positive resolved_security_testing, resolved_other, resolved_auto.' name: status - auto: PREDEFINED description: 'Whether the incident is starred (Boolean value: true or false).' name: starred predefined: - 'true' - 'false' - description: Deprecated. Use gte_creation_time instead. defaultValue: 3 days name: starred_incidents_fetch_window deprecated: true description: |- Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created. If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported. name: core-get-incidents outputs: - contextPath: Core.Incident.incident_id description: Unique ID assigned to each returned incident. type: String - contextPath: Core.Incident.manual_severity description: Incident severity assigned by the user. This does not affect the calculated severity. Can be "low", "medium", "high". type: String - contextPath: Core.Incident.manual_description description: Incident description provided by the user. type: String - contextPath: Core.Incident.assigned_user_mail description: Email address of the assigned user. type: String - contextPath: Core.Incident.high_severity_alert_count description: Number of alerts with the severity HIGH. type: String - contextPath: Core.Incident.host_count description: Number of hosts involved in the incident. type: number - contextPath: Core.Incident.xdr_url description: A link to the incident view on Cortex XDR. type: String - contextPath: Core.Incident.assigned_user_pretty_name description: Full name of the user assigned to the incident. type: String - contextPath: Core.Incident.alert_count description: Total number of alerts in the incident. type: number - contextPath: Core.Incident.med_severity_alert_count description: Number of alerts with the severity MEDIUM. type: number - contextPath: Core.Incident.user_count description: Number of users involved in the incident. type: number - contextPath: Core.Incident.severity description: |- Calculated severity of the incident. Valid values are: "low","medium","high". type: String - contextPath: Core.Incident.low_severity_alert_count description: Number of alerts with the severity LOW. type: String - contextPath: Core.Incident.status description: | Current status of the incident. Valid values are: "new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing" or "resolved_other". type: String - contextPath: Core.Incident.description description: Dynamic calculated description of the incident. type: String - contextPath: Core.Incident.resolve_comment description: Comments entered by the user when the incident was resolved. type: String - contextPath: Core.Incident.notes description: Comments entered by the user regarding the incident. type: String - contextPath: Core.Incident.creation_time description: Date and time the incident was created on Cortex XDR. type: date - contextPath: Core.Incident.detection_time description: Date and time that the first alert occurred in the incident. type: date - contextPath: Core.Incident.modification_time description: Date and time that the incident was last modified. type: date - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds - description: For polling use. isArray: true name: action_id deprecated: true - description: The endpoint ID (string) to isolate. Retrieve the string from the core-get-endpoints command. name: endpoint_id required: true - auto: PREDEFINED defaultValue: 'false' description: Suppress an error when trying to isolate a disconnected endpoint. When set to false, an error is returned. name: suppress_disconnected_endpoint_error predefined: - 'true' - 'false' description: Isolates the specified endpoint. execution: true name: core-isolate-endpoint supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.Isolation.endpoint_id description: The endpoint ID. type: String compliantpolicies: - EndPoint Isolation - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds - description: For polling use. isArray: true name: action_id deprecated: true - description: The endpoint ID (string) to isolate. Retrieve the string from the core-get-endpoints command. name: endpoint_id required: true prettyname: Run action on prettypredefined: Issue initiator host: ${issue.xdmsourceagentidentifier} Issue remote host: ${issue.xdmtargetagentidentifier} - auto: PREDEFINED defaultValue: 'false' description: Suppress an error when trying to isolate a disconnected endpoint. When set to false, an error is returned. name: suppress_disconnected_endpoint_error predefined: - 'true' - 'false' description: Isolates the specified endpoint. This quick action is deprecated. Use the new built-in Isolate Endpoint quick action instead. execution: true name: core-isolate-endpoint-quick-action supportedModules: - cloud_runtime_security - edr - xsiam prettyname: Isolate Endpoint (deprecated) quickaction: true hidden: true polling: true outputs: - contextPath: Core.Isolation.endpoint_id description: The endpoint ID. type: String - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: The endpoint ID (string) to reverse the isolation. Retrieve it from the core-get-endpoints command. name: endpoint_id required: true - auto: PREDEFINED defaultValue: 'false' description: Suppress an error when trying to unisolate a disconnected endpoint. When set to false, an error is be returned. name: suppress_disconnected_endpoint_error predefined: - 'true' - 'false' - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Reverses the isolation of an endpoint. execution: true name: core-unisolate-endpoint supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.UnIsolation.endpoint_id description: Isolates the specified endpoint. type: String - arguments: - description: A comma-separated list of endpoint IDs. isArray: true name: endpoint_id_list - description: "A comma-separated list of distribution package names or installation package names. \nExample: dist_name1,dist_name2." isArray: true name: dist_name - description: |- A comma-separated list of private IP addresses. Example: 10.1.1.1,192.168.1.1. isArray: true name: ip_list - description: |- A comma-separated list of public IP addresses that correlate to the last IPv4 address from which the Cortex XDR agent connected (know as `Last Origin IP`). Example: 8.8.8.8,1.1.1.1. isArray: true name: public_ip_list - description: |- The group name to which the agent belongs. Example: group_name1,group_name2. isArray: true name: group_name - description: 'The endpoint platform. Valid values are\: "windows", "linux", "macos", or "android". ' isArray: true name: platform auto: PREDEFINED predefined: - windows - linux - macos - android - description: |- A comma-separated list of alias names. Examples: alias_name1,alias_name2. name: alias_name isArray: true - description: |- Specifies whether the endpoint was isolated or unisolated. name: isolate auto: PREDEFINED predefined: - isolated - unisolated - description: |- Hostname Example: hostname1,hostname2. name: hostname isArray: true - description: |- All the agents that were first seen after {first_seen_gte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: first_seen_gte - description: |- All the agents that were first seen before {first_seen_lte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: first_seen_lte - description: |- All the agents that were last seen before {last_seen_gte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: last_seen_gte - description: |- All the agents that were last seen before {last_seen_lte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: last_seen_lte - defaultValue: '0' description: Page number (for pagination). The default is 0 (the first page). name: page - description: Maximum number of endpoints to return per page. The default and maximum is 30. name: limit defaultValue: '30' - auto: PREDEFINED description: Specifies whether to sort endpoints by the first time or last time they were seen. Can be "first_seen" or "last_seen". name: sort_by predefined: - first_seen - last_seen - auto: PREDEFINED description: The order by which to sort results. Can be "asc" (ascending) or "desc" ( descending). Default set to asc. name: sort_order predefined: - asc - desc defaultValue: asc - name: status description: A comma-separated list of endpoints statuses to filter. isArray: true auto: PREDEFINED predefined: - connected - disconnected - lost - uninstalled - name: username description: The usernames to query for, accepts a single user, or comma-separated list of usernames. isArray: true - auto: PREDEFINED defaultValue: "false" description: Whether to return all endpoints. If true, will override the 'limit' and 'page' arguments. name: all_results predefined: - "false" - "true" - auto: PREDEFINED defaultValue: "false" description: Whether to return timestamp or date string values. name: convert_timestamp_to_datestring predefined: - "false" - "true" description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0). name: core-get-endpoints supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.Endpoint.endpoint_id description: The endpoint ID. type: String - contextPath: Core.Endpoint.endpoint_name description: The endpoint name. type: String - contextPath: Core.Endpoint.endpoint_type description: The endpoint type. type: String - contextPath: Core.Endpoint.endpoint_status description: The status of the endpoint. type: String - contextPath: Core.Endpoint.os_type description: The endpoint OS type. type: String - contextPath: Core.Endpoint.ip description: A list of IP addresses. type: Unknown - contextPath: Core.Endpoint.users description: A list of users. type: Unknown - contextPath: Core.Endpoint.domain description: The endpoint domain. type: String - contextPath: Core.Endpoint.alias description: The endpoint's aliases. type: String - contextPath: Core.Endpoint.first_seen description: First seen date/time in Epoch (milliseconds). type: Unknown - contextPath: Core.Endpoint.last_seen description: Last seen date/time in Epoch (milliseconds). type: Date - contextPath: Core.Endpoint.content_version description: Content version. type: String - contextPath: Core.Endpoint.installation_package description: Installation package. type: String - contextPath: Core.Endpoint.active_directory description: Active directory. type: String - contextPath: Core.Endpoint.install_date description: Install date in Epoch (milliseconds). type: Date - contextPath: Core.Endpoint.endpoint_version description: Endpoint version. type: String - contextPath: Core.Endpoint.is_isolated description: Whether the endpoint is isolated. type: String - contextPath: Core.Endpoint.group_name description: The name of the group to which the endpoint belongs. type: String - contextPath: Endpoint.Hostname description: The hostname that is mapped to this endpoint. type: String - contextPath: Endpoint.ID description: The unique ID within the tool retrieving the endpoint. type: String - contextPath: Endpoint.IPAddress description: The IP address of the endpoint. type: String - contextPath: Endpoint.Domain description: The domain of the endpoint. type: String - contextPath: Endpoint.OS description: The endpoint's operation system. type: String - contextPath: Account.Username description: The username in the relevant system. type: String - contextPath: Account.Domain description: The domain of the account. type: String - contextPath: Endpoint.Status description: The endpoint's status. type: String - contextPath: Endpoint.IsIsolated description: The endpoint's isolation status. type: String - contextPath: Endpoint.MACAddress description: The endpoint's MAC address. type: String - contextPath: Endpoint.Vendor description: The integration name of the endpoint vendor. type: String - arguments: - description: The status of the endpoint to use as a filter. name: status auto: PREDEFINED predefined: - connected - disconnected - description: A comma-separated list of endpoint IDs to use as a filter. isArray: true name: endpoint_id_list - description: |- A comma-separated list of distribution package names or installation package names to use as a filter. Example: dist_name1,dist_name2. isArray: true name: dist_name - description: |- A comma-separated list of IP addresses to use as a filter. Example: 8.8.8.8,1.1.1.1. isArray: true name: ip_list - description: A comma-separated list of group names to which the agent belongs to use as a filter. isArray: true name: group_name - description: The endpoint platform to use as a filter. isArray: true name: platform auto: PREDEFINED predefined: - windows - linux - macos - android - description: |- A comma-separated list of alias names to use as a filter. Examples: alias_name1,alias_name2. isArray: true name: alias_name - auto: PREDEFINED description: Specifies whether the endpoint was isolated or unisolated to use as a filter. name: isolate predefined: - isolated - unisolated - description: A comma-separated list of hostnames to use as a filter. isArray: true name: hostname - description: |- All the agents that were first seen after {first_seen_gte} to use as a filter. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: first_seen_gte - description: |- All the agents that were first seen before {first_seen_lte} to use as a filter. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: first_seen_lte - description: |- All the agents that were last seen after {last_seen_gte} to use as a filter. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: last_seen_gte - description: |- All the agents that were last seen before {last_seen_lte} to use as a filter. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: last_seen_lte - name: username description: The usernames to use as a filter. Accepts a single user, or comma-separated list of usernames. isArray: true - name: new_alias_name required: true description: |- The alias name to change to. Note: If you send an empty field, (e.g., new_alias_name=\"\") the current alias name is deleted. - name: scan_status description: The scan status of the endpoint to use as a filter. auto: PREDEFINED predefined: - none - pending - in_progress - canceled - aborted - pending_cancellation - success - error description: Gets a list of endpoints according to the passed filters, and changes their alias name. Filtering by multiple fields will be concatenated using the AND condition (OR is not supported). name: core-endpoint-alias-change - description: Gets a list of all the agent versions to use for creating a distribution list. name: core-get-distribution-versions outputs: - contextPath: Core.DistributionVersions.windows description: A list of Windows agent versions. type: Unknown - contextPath: Core.DistributionVersions.linux description: A list of Linux agent versions. type: Unknown - contextPath: Core.DistributionVersions.macos description: A list of Mac agent versions. type: Unknown - arguments: - description: A string representing the name of the installation package. name: name required: true - auto: PREDEFINED description: "String, valid values are:\n• windows \n• linux\n• macos \n• android." name: platform predefined: - windows - linux - macos - android required: true - auto: PREDEFINED description: |- A string representing the type of package to create. standalone - An installation for a new agent upgrade - An upgrade of an agent from ESM. name: package_type predefined: - standalone - upgrade required: true - description: agent_version returned from core-get-distribution-versions. Not required for Android platfoms. name: agent_version required: true - description: Information about the package. name: description description: Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API. name: core-create-distribution outputs: - contextPath: Core.Distribution.id description: The installation package ID. type: String - contextPath: Core.Distribution.name description: The name of the installation package. type: String - contextPath: Core.Distribution.platform description: The installation OS. type: String - contextPath: Core.Distribution.agent_version description: Agent version. type: String - contextPath: Core.Distribution.description description: Information about the package. type: String - arguments: - description: |- The ID of the installation package. Copy the distribution_id from the "id" field on Endpoints > Agent Installation page. name: distribution_id required: true - auto: PREDEFINED description: |- The installation package type. Valid values are: • upgrade • sh - For Linux • rpm - For Linux • deb - For Linux • pkg - For Mac • x86 - For Windows • x64 - For Windows. name: package_type predefined: - upgrade - sh - rpm - deb - pkg - x86 - x64 required: true - name: download_package auto: PREDEFINED predefined: - "false" - "true" description: Supported only for package_type x64 or x86. Whether to actually download the installation package file. defaultValue: "false" description: Gets the distribution URL for downloading the installation package. name: core-get-distribution-url outputs: - contextPath: Core.Distribution.id description: Distribution ID. type: String - contextPath: Core.Distribution.url description: URL for downloading the installation package. type: String - arguments: - description: Status of distribution IDs, in a comma-separated list. isArray: true name: distribution_ids required: true description: Gets the status of the installation package. name: core-get-create-distribution-status outputs: - contextPath: Core.Distribution.id description: Distribution ID. type: String - contextPath: Core.Distribution.status description: Installation package status. type: String - arguments: - description: User’s email address. name: email - auto: PREDEFINED description: The audit log type. name: type predefined: - REMOTE_TERMINAL - RULES - AUTH - RESPONSE - INCIDENT_MANAGEMENT - ENDPOINT_MANAGEMENT - ALERT_WHITELIST - PUBLIC_API - DISTRIBUTIONS - STARRED_INCIDENTS - POLICY_PROFILES - DEVICE_CONTROL_PROFILE - HOST_FIREWALL_PROFILE - POLICY_RULES - PROTECTION_POLICY - DEVICE_CONTROL_TEMP_EXCEPTIONS - DEVICE_CONTROL_GLOBAL_EXCEPTIONS - GLOBAL_EXCEPTIONS - MSSP - REPORTING - DASHBOARD - BROKER_VM - description: The audit log subtype. name: sub_type - auto: PREDEFINED description: Result type. name: result predefined: - SUCCESS - FAIL - PARTIAL - description: |- Return logs when the timestamp is after 'log_time_after'. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: timestamp_gte - description: |- Return logs when the timestamp is before the 'log_time_after'. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: timestamp_lte - defaultValue: '0' description: Page number (for pagination). The default is 0 (the first page). name: page - defaultValue: '30' description: Maximum number of audit logs to return per page. The default and maximum is 30. name: limit - auto: PREDEFINED description: Specifies the field by which to sort the results. By default the sort is defined as creation-time and descending. Can be "type", "sub_type", "result", or "timestamp". name: sort_by predefined: - type - sub_type - result - timestamp - auto: PREDEFINED defaultValue: desc description: The sort order. Can be "asc" (ascending) or "desc" (descending). Default set to "desc". name: sort_order predefined: - asc - desc description: Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0). name: core-get-audit-management-logs outputs: - contextPath: Core.AuditManagementLogs.AUDIT_ID description: Audit log ID. type: Number - contextPath: Core.AuditManagementLogs.AUDIT_OWNER_NAME description: Audit owner name. type: String - contextPath: Core.AuditManagementLogs.AUDIT_OWNER_EMAIL description: Audit owner email address. type: String - contextPath: Core.AuditManagementLogs.AUDIT_ASSET_JSON description: Asset JSON. type: String - contextPath: Core.AuditManagementLogs.AUDIT_ASSET_NAMES description: Audit asset names. type: String - contextPath: Core.AuditManagementLogs.AUDIT_HOSTNAME description: Host name. type: String - contextPath: Core.AuditManagementLogs.AUDIT_RESULT description: Audit result. type: String - contextPath: Core.AuditManagementLogs.AUDIT_REASON description: Audit reason. type: String - contextPath: Core.AuditManagementLogs.AUDIT_DESCRIPTION description: Description of the audit. type: String - contextPath: Core.AuditManagementLogs.AUDIT_ENTITY description: Audit entity (e.g., AUTH, DISTRIBUTIONS). type: String - contextPath: Core.AuditManagementLogs.AUDIT_ENTITY_SUBTYPE description: Entity subtype (e.g., Login, Create). type: String - contextPath: Core.AuditManagementLogs.AUDIT_CASE_ID description: Audit case ID. type: Number - contextPath: Core.AuditManagementLogs.AUDIT_INSERT_TIME description: Log's insert time. type: Date - arguments: - description: A comma-separated list of endpoint IDs. isArray: true name: endpoint_ids - description: A comma-separated list of endpoint names. isArray: true name: endpoint_names - auto: PREDEFINED description: The report type. Can be "Installation", "Policy", "Action", "Agent Service", "Agent Modules", or "Agent Status". isArray: true name: type predefined: - Installation - Policy - Action - Agent Service - Agent Modules - Agent Status - auto: PREDEFINED description: The report subtype. isArray: true name: sub_type predefined: - Install - Uninstall - Upgrade - Local Configuration - Content Update - Policy Update - Process Exception - Hash Exception - Scan - File Retrieval - File Scan - Terminate Process - Isolate - Cancel Isolation - Payload Execution - Quarantine - Restore - Stop - Start - Module Initialization - Local Analysis Model - Local Analysis Feature Extraction - Fully Protected - OS Incompatible - Software Incompatible - Kernel Driver Initialization - Kernel Extension Initialization - Proxy Communication - Quota Exceeded - Minimal Content - Reboot Eequired - Missing Disc Access - auto: PREDEFINED description: The result type. Can be "Success" or "Fail". If not passed, returns all event reports. isArray: true name: result predefined: - Success - Fail - description: |- Return logs that their timestamp is greater than 'log_time_after'. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: timestamp_gte - description: |- Return logs for which the timestamp is before the 'timestamp_lte'. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: timestamp_lte - defaultValue: '0' description: Page number (for pagination). The default is 0 (the first page). name: page - defaultValue: '30' description: The maximum number of reports to return. Default and maximum is 30. name: limit - auto: PREDEFINED description: The field by which to sort results. Can be "type", "category", "trapsversion", "timestamp", or "domain"). name: sort_by predefined: - type - category - trapsversion - timestamp - domain - auto: PREDEFINED defaultValue: asc description: The sort order. Can be "asc" (ascending) or "desc" (descending). Default is "asc". name: sort_order predefined: - asc - desc description: Gets agent event reports. You can filter by multiple fields, which are combined using an AND condition (OR is not supported). The maximum result set size is 100. The offset specifies the zero-based index of reports from the start of the result set (start by counting from 0). name: core-get-audit-agent-reports supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.AuditAgentReports.ENDPOINTID description: Endpoint ID. type: String - contextPath: Core.AuditAgentReports.ENDPOINTNAME description: Endpoint name. type: String - contextPath: Core.AuditAgentReports.DOMAIN description: Agent domain. type: String - contextPath: Core.AuditAgentReports.TRAPSVERSION description: Traps version. type: String - contextPath: Core.AuditAgentReports.RECEIVEDTIME description: Received time in Epoch time. type: Date - contextPath: Core.AuditAgentReports.TIMESTAMP description: Timestamp in Epoch time. type: Date - contextPath: Core.AuditAgentReports.CATEGORY description: Report category (e.g., Audit). type: String - contextPath: Core.AuditAgentReports.TYPE description: Report type (e.g., Action, Policy). type: String - contextPath: Core.AuditAgentReports.SUBTYPE description: Report subtype (e.g., Fully Protected,Policy Update,Cancel Isolation). type: String - contextPath: Core.AuditAgentReports.RESULT description: Report result. type: String - contextPath: Core.AuditAgentReports.REASON description: Report reason. type: String - contextPath: Core.AuditAgentReports.DESCRIPTION description: Agent report description. type: String - contextPath: Endpoint.ID description: The unique ID within the tool retrieving the endpoint. type: String - contextPath: Endpoint.Hostname description: The hostname that is mapped to this endpoint. type: String - contextPath: Endpoint.Domain description: The domain of the endpoint. type: String - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: String that represents a list of hashed files you want to block list. Must be a valid SHA256 hash. isArray: true name: hash_list required: true - description: String that represents additional information regarding the action. name: comment - auto: PREDEFINED defaultValue: 'false' description: Choose either regular response or detailed response. Default value = false, regular response. name: detailed_response predefined: - 'true' - 'false' description: Blocks requested files that are not already on the block list or the allow list. name: core-blocklist-files supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.blocklist.added_hashes description: Added file hash to the block list. type: Number - contextPath: Core.blocklist.excluded_hashes description: Added fileHash to blocklist. type: Number - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: String that represents a list of hashed files you want to add to allow lists. Must be a valid SHA256 hash. isArray: true name: hash_list required: true - description: String that represents additional information regarding the action. name: comment - auto: PREDEFINED defaultValue: 'false' description: Choose either regular response or detailed response. Default value = false, regular response. name: detailed_response predefined: - 'true' - 'false' description: Adds requested files to the allow list if they are not already on the block list or the allow list. name: core-allowlist-files supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.allowlist.added_hashes description: Added a file hash to the allow list. type: Number - contextPath: Core.allowlist.excluded_hashes description: Added fileHash to allowlist. type: Number - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: List of endpoint IDs. isArray: true name: endpoint_id_list required: true - description: String that represents the path of the file you want to quarantine. name: file_path required: true - description: String that represents the file’s hash. Must be a valid SHA256 hash. name: file_hash required: true - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints. name: core-quarantine-files supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown compliantpolicies: - Quarantine File - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: List of endpoint IDs. isArray: true name: endpoint_id_list prettyname: Run action on prettypredefined: Initiator host endpoint ID: ${issue.xdmsourceagentidentifier} Remote host endpoint ID: ${issue.xdmtargetagentidentifier} required: true - description: String that represents the path of the file you want to quarantine. name: file_path prettyname: File Path prettypredefined: File path from issue: ${issue.filepath} required: true - description: String that represents the file’s hash. Must be a valid SHA256 hash. name: file_hash prettyname: File Hash (SHA256) prettypredefined: File SHA256 from issue: ${issue.filesha256} required: true - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints. This quick action is deprecated. Use the new built-in Quarantine File quick action instead. name: core-quarantine-files-quick-action supportedModules: - cloud_runtime_security - edr - xsiam prettyname: Quarantine File (deprecated) quickaction: true hidden: true polling: true outputs: - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: String that represents the endpoint ID. name: endpoint_id required: true - description: String that represents the file hash. Must be a valid SHA256 hash. name: file_hash required: true - description: String that represents the file path. name: file_path required: true description: Retrieves the quarantine status of a selected file. name: core-get-quarantine-status supportedModules: - cloud_runtime_security - edr - xsiam - arguments: - description: Links a response action to the incident that triggered it. name: incident_id - description: String that represents the file in hash. Must be a valid SHA256 hash. name: file_hash required: true - description: String that represents the endpoint ID. If you do not enter a specific endpoint ID, the request will run restore on all endpoints which relate to the quarantined file you defined. name: endpoint_id - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Restores a quarantined file on the requested endpoints. name: core-restore-file supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: String that represents the file in hash. Must be a valid SHA256 hash. name: file_hash prettyname: File Hash (SHA256) prettypredefined: File SHA256 from issue: ${issue.filesha256} required: true - description: String that represents the endpoint ID. If you do not enter a specific endpoint ID, the request will run restore on all endpoints which relate to the quarantined file you defined. name: endpoint_id - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Restores a quarantined file on the requested endpoints. This quick action is deprecated. Use the new built-in Restore File From Quarantine quick action instead. name: core-restore-file-quick-action supportedModules: - cloud_runtime_security - edr - xsiam prettyname: Restore File From Quarantine (deprecated) quickaction: true hidden: true polling: true outputs: - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: List of endpoint IDs. isArray: true name: endpoint_id_list - description: Name of the distribution list. isArray: true name: dist_name - description: Epoch timestamp in milliseconds. name: gte_first_seen - description: Epoch timestamp in milliseconds. name: gte_last_seen - description: Epoch timestamp in milliseconds. name: lte_first_seen - description: Epoch timestamp in milliseconds. name: lte_last_seen - description: List of IP addresses. isArray: true name: ip_list - description: Name of the endpoint group. isArray: true name: group_name - auto: PREDEFINED description: Type of operating system. isArray: true name: platform predefined: - windows - linux - macos - android - description: Endpoint alias name. isArray: true name: alias - auto: PREDEFINED description: Choose if an endpoint has been isolated. Select "isolated" or "unisolated". name: isolate predefined: - isolated - unisolated - description: Name of the host. isArray: true name: hostname - auto: PREDEFINED defaultValue: 'false' description: Choose whether to scan all of the endpoints or not. Default is false. Scanning all of the endpoints may cause performance issues and latency. name: all predefined: - 'true' - 'false' - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Runs a scan on a selected endpoint. To scan all endpoints, use the argument all=true. Scanning all endpoints may affect performance and cause latency. execution: true name: core-endpoint-scan supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.endpointScan.actionId description: The action ID of the scan request. type: Number - contextPath: Core.endpointScan.aborted description: Was the scan aborted. type: Boolean - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the triggered incident. name: incident_id - description: List of endpoint IDs. isArray: true required: true name: endpoint_id_list prettyname: Run action on prettypredefined: Issue initiator host: ${issue.xdmsourceagentidentifier} Issue remote host: ${issue.xdmtargetagentidentifier} - description: Name of the distribution list. isArray: true name: dist_name - description: Epoch timestamp in milliseconds. name: gte_first_seen - description: Epoch timestamp in milliseconds. name: gte_last_seen - description: Epoch timestamp in milliseconds. name: lte_first_seen - description: Epoch timestamp in milliseconds. name: lte_last_seen - description: List of IP addresses. isArray: true name: ip_list - description: Name of the endpoint group. isArray: true name: group_name - auto: PREDEFINED description: Type of operating system. isArray: true name: platform predefined: - windows - linux - macos - android - description: Endpoint alias name. isArray: true name: alias - auto: PREDEFINED description: Choose if an endpoint has been isolated. Select "isolated" or "unisolated". name: isolate predefined: - isolated - unisolated - description: Name of the host. isArray: true name: hostname - auto: PREDEFINED defaultValue: 'false' description: Choose whether to scan all of the endpoints or not. Default is false. Scanning all of the endpoints may cause performance issues and latency. name: all predefined: - 'true' - 'false' - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Runs a scan on a selected endpoint. To scan all endpoints, run the command with the argument all=true. Scanning all endpoints may impact performance and cause latency. This quick action is deprecated. Use the new built-in Run Malware Scan quick action instead. execution: true name: core-endpoint-scan-quick-action supportedModules: - cloud_runtime_security - edr - xsiam prettyname: Run Malware Scan (deprecated) quickaction: true hidden: true polling: true outputs: - contextPath: Core.endpointScan.actionId description: The action ID of the scan request. type: Number - contextPath: Core.endpointScan.aborted description: Was the scan aborted. type: Boolean - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: List of endpoint IDs. isArray: true name: endpoint_id_list - description: Name of the distribution list. isArray: true name: dist_name - description: Epoch timestamp in milliseconds. name: gte_first_seen - description: Epoch timestamp in milliseconds. name: gte_last_seen - description: Epoch timestamp in milliseconds. name: lte_first_seen - description: Epoch timestamp in milliseconds. name: lte_last_seen - description: List of IP addresses. isArray: true name: ip_list - description: Name of the endpoint group. isArray: true name: group_name - auto: PREDEFINED description: Type of operating system. isArray: true name: platform predefined: - windows - linux - macos - android - description: Endpoint alias name. isArray: true name: alias - auto: PREDEFINED description: Choose whether an endpoint has been isolated. Select "isolated" or "unisolated". name: isolate predefined: - isolated - unisolated - description: Name of the host. isArray: true name: hostname - auto: PREDEFINED defaultValue: 'false' description: Whether to scan all of the endpoints or not. Default is false. Note that scanning all of the endpoints may cause performance issues and latency. name: all predefined: - 'true' - 'false' description: Cancels the scan on the selected endpoints. A scan can only be canceled if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Scanning all endpoints may impact performance and cause latency. execution: true name: core-endpoint-scan-abort supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.endpointScan.actionId description: The action ID of the abort scan request. type: Unknown - contextPath: Core.endpointScan.aborted description: Was the scan cancelled. type: Boolean - arguments: - description: The endpoint ID. Retrieve by running the core-get-endpoints command. name: endpoint_id required: true description: Gets the policy name for a specific endpoint. name: core-get-policy outputs: - contextPath: Core.Policy description: The policy allocated with the endpoint. type: string - contextPath: Core.Policy.policy_name description: Name of the policy allocated with the endpoint. type: string - contextPath: Core.Policy.endpoint_id description: Endpoint ID. type: string - arguments: - description: A comma-separated list of the script names. isArray: true name: script_name - description: A comma-separated list of the script descriptions. isArray: true name: description - description: A comma-separated list of the users who created the script. isArray: true name: created_by - description: The maximum number of scripts returned to the War Room. Default is 50. name: limit - description: (Int) Offset in the data set. Default is 0. name: offset - auto: PREDEFINED description: Choose to run the script on a Windows operating system. name: windows_supported predefined: - 'true' - 'false' - auto: PREDEFINED description: Choose to run the script on a Linux operating system. name: linux_supported predefined: - 'true' - 'false' - auto: PREDEFINED description: Choose to run the script on a Mac operating system. name: macos_supported predefined: - 'true' - 'false' - auto: PREDEFINED description: Choose if the script has a high-risk outcome. name: is_high_risk predefined: - 'true' - 'false' description: Gets a list of scripts available in the scripts library. name: core-get-scripts outputs: - contextPath: Core.Scripts description: The scripts command results. type: Unknown - contextPath: Core.Scripts.script_id description: Script ID. type: Unknown - contextPath: Core.Scripts.name description: Name of the script. type: string - contextPath: Core.Scripts.description description: Description of the script. type: string - contextPath: Core.Scripts.modification_date description: Timestamp of when the script was last modified. type: Unknown - contextPath: Core.Scripts.created_by description: Name of the user who created the script. type: string - contextPath: Core.Scripts.windows_supported description: Choose to run the script on a Windows operating system. type: boolean - contextPath: Core.Scripts.linux_supported description: Choose to run the script on a Linux operating system. type: boolean - contextPath: Core.Scripts.macos_supported description: Choose to run the script on a Mac operating system. type: boolean - contextPath: Core.Scripts.is_high_risk description: Choose if the script has a high-risk outcome. type: boolean - contextPath: Core.Scripts.script_uid description: Globally Unique Identifier of the script, used to identify the script when executing. type: string - arguments: - description: Comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the core-get-endpoints command. name: endpoint_ids required: true description: Deletes selected endpoints in the Cortex app. You can delete up to 1000 endpoints. name: core-delete-endpoints - arguments: - description: Comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the core-get-endpoints command. isArray: true name: endpoint_ids - auto: PREDEFINED description: 'Type of violation. Possible values are: "cd-rom", "disk drive", "floppy disk", and "portable device".' name: type predefined: - cd-rom - disk drive - floppy disk - portable device - description: 'Timestamp of the violation. Violations that are greater than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time).' name: timestamp_gte - description: 'Timestamp of the violation. Violations that are less than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time).' name: timestamp_lte - description: Comma-separated list of IP addresses. isArray: true name: ip_list - description: Name of the vendor. isArray: true name: vendor - description: Vendor ID. isArray: true name: vendor_id - description: Name of the product. isArray: true name: product - description: Product ID. isArray: true name: product_id - description: Serial number. isArray: true name: serial - description: Hostname. isArray: true name: hostname - description: Comma-separated list of violation IDs. isArray: true name: violation_id_list - description: Username. isArray: true name: username description: Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations. name: core-get-endpoint-device-control-violations outputs: - contextPath: Core.EndpointViolations description: Endpoint violations command results. type: Unknown - contextPath: Core.EndpointViolations.violations description: A list of violations. type: Unknown - contextPath: Core.EndpointViolations.violations.os_type description: Type of the operating system. type: string - contextPath: Core.EndpointViolations.violations.hostname description: Hostname of the violation. type: string - contextPath: Core.EndpointViolations.violations.username description: Username of the violation. type: string - contextPath: Core.EndpointViolations.violations.ip description: IP address of the violation. type: string - contextPath: Core.EndpointViolations.violations.timestamp description: Timestamp of the violation. type: number - contextPath: Core.EndpointViolations.violations.violation_id description: Violation ID. type: number - contextPath: Core.EndpointViolations.violations.type description: Type of violation. type: string - contextPath: Core.EndpointViolations.violations.vendor_id description: Vendor ID of the violation. type: string - contextPath: Core.EndpointViolations.violations.vendor description: Name of the vendor of the violation. type: string - contextPath: Core.EndpointViolations.violations.product_id description: Product ID of the violation. type: string - contextPath: Core.EndpointViolations.violations.product description: Name of the product of the violation. type: string - contextPath: Core.EndpointViolations.violations.serial description: Serial number of the violation. type: string - contextPath: Core.EndpointViolations.violations.endpoint_id description: Endpoint ID of the violation. type: string - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: Comma-separated list of endpoint IDs. isArray: true name: endpoint_ids required: true - description: A comma-separated list of file paths on the Windows platform. isArray: true name: windows_file_paths - description: A comma-separated list of file paths on the Linux platform. isArray: true name: linux_file_paths - description: A comma-separated list of file paths on the Mac platform. isArray: true name: mac_file_paths - description: A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parellel to the endpoints list order, therefore, the first file path in the list is related to the first endpoint and so on. isArray: true name: generic_file_path - description: 'The delimiter used to separate multiple file paths. Set to a different character (for example, ";") when a file path contains a comma.' name: paths_separator defaultValue: ',' - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Retrieves files from selected endpoints. You can retrieve up to 20 files from no more than 10 endpoints. At least one endpoint ID and one file path are required to run the command. After running the command, use the core-action-status-get command with the returned action_id to check the action status. name: core-retrieve-files supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.RetrievedFiles.action_id description: ID of the action to retrieve files from selected endpoints. type: string - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: Comma-separated list of endpoint IDs. isArray: true name: endpoint_ids required: true prettyname: Run action on prettypredefined: Issue initiator host: ${issue.xdmsourceagentidentifier} Remote host: ${issue.xdmtargetagentidentifier} - description: A comma-separated list of file paths on the Windows platform. isArray: true name: windows_file_paths - description: A comma-separated list of file paths on the Linux platform. isArray: true name: linux_file_paths - description: A comma-separated list of file paths on the Mac platform. isArray: true name: mac_file_paths - description: A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parellel to the endpoints list order, therefore, the first file path in the list is related to the first endpoint and so on. isArray: true name: generic_file_path prettyname: File to retrieve required: true prettypredefined: Issue initiator file: ${issue.initiatorpath} Issue CGO file path: ${issue.cgopath} - description: 'The delimiter used to separate multiple file paths. Set to a different character (for example, ";") when a file path contains a comma.' name: paths_separator defaultValue: ',' - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Retrieves files from selected endpoints. You can retrieve up to 20 files from no more than 10 endpoints. At least one endpoint ID and one file path are required to run the command. After running the command, use the core-action-status-get command with the returned action_id to check the action status. This quick action is deprecated. Use the new built-in Retrieve File quick action instead. name: core-retrieve-files-quick-action supportedModules: - cloud_runtime_security - edr - xsiam prettyname: Retrieve File (deprecated) quickaction: true hidden: true polling: true outputs: - contextPath: Core.RetrievedFiles.action_id description: ID of the action to retrieve files from selected endpoints. type: string - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Action ID retrieved from the core-retrieve-files command. isArray: true name: action_id required: true description: Views the file retrieved by the core-retrieve-files command using the action ID. Before running this command, use the core-action-status-get command to check if the action completed successfully. name: core-retrieve-file-details supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: File description: The file details returned by the command. type: Unknown - contextPath: File.Name description: The full file name (including the file extension). type: String - contextPath: File.EntryID description: The ID for locating the file in the War Room. type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Extension description: 'The file extension. For example: "xls".' type: String - contextPath: File.Type description: The file type, as determined by libmagic (same as displayed in file entries). type: String - arguments: - description: Unique identifier of the script, returned by the core-get-scripts command. name: script_uid required: true description: Gets the full definition of a specific script in the scripts library. name: core-get-script-metadata outputs: - contextPath: Core.ScriptMetadata description: The script metadata command results. type: Unknown - contextPath: Core.ScriptMetadata.script_id description: Script ID. type: number - contextPath: Core.ScriptMetadata.name description: Script name. type: string - contextPath: Core.ScriptMetadata.description description: Script description. type: string - contextPath: Core.ScriptMetadata.modification_date description: Timestamp of when the script was last modified. type: unknown - contextPath: Core.ScriptMetadata.created_by description: Name of the user who created the script. type: string - contextPath: Core.ScriptMetadata.is_high_risk description: Whether the script has a high-risk outcome. type: boolean - contextPath: Core.ScriptMetadata.windows_supported description: Choose to run the script on a Windows operating system. type: boolean - contextPath: Core.ScriptMetadata.linux_supported description: Choose to run the script on a Linux operating system. type: boolean - contextPath: Core.ScriptMetadata.macos_supported description: Choose to run the script on a Mac operating system. type: boolean - contextPath: Core.ScriptMetadata.entry_point description: Name of the entry point selected for the script. An empty string indicates the script defined as just run. type: string - contextPath: Core.ScriptMetadata.script_input description: Name and type for the specified entry point. type: string - contextPath: Core.ScriptMetadata.script_output_type description: Type of the output. type: string - contextPath: Core.ScriptMetadata.script_output_dictionary_definitions description: If the script_output_type is a dictionary, an array with friendly name, name, and type for each output. type: Unknown - arguments: - description: Unique identifier of the script, returned by the core-get-scripts command. name: script_uid required: true description: Gets the code of a specific script in the script library. name: core-get-script-code outputs: - contextPath: Core.ScriptCode description: The script code command results. type: Unknown - contextPath: Core.ScriptCode.code description: The code of a specific script in the script library. type: string - contextPath: Core.ScriptCode.script_uid description: Unique identifier of the script. type: string - arguments: - description: The action ID of the selected request. After performing an action, you will receive an action ID. isArray: true name: action_id required: true description: Retrieves the status of the requested actions using the action ID. name: core-action-status-get supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.GetActionStatus description: The results of the action status command. type: Unknown - contextPath: Core.GetActionStatus.endpoint_id description: Endpoint ID. type: string - contextPath: Core.GetActionStatus.status description: The status of the specific endpoint ID. type: string - contextPath: Core.GetActionStatus.action_id description: The specified action ID. type: number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: Comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. name: endpoint_ids required: true - description: Unique identifier of the script. Can be retrieved by running the core-get-scripts command. name: script_uid required: true - description: Dictionary contains the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}. name: parameters - defaultValue: '600' description: The timeout in seconds for this execution. name: timeout description: Deprecated. Use the core-script-run command instead. name: core-run-script supportedModules: - cloud_runtime_security - edr - xsiam deprecated: true outputs: - contextPath: Core.ScriptRun.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptRun.endpoints_count description: Number of endpoints the action was initiated on. type: Number - arguments: - description: Links the response action to the incident that triggered it. it. name: incident_id - description: Comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. name: endpoint_ids required: true - description: Section of a script you want to initiate on an endpoint, for example, print("7"). name: snippet_code required: true - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Initiates a new endpoint script execution using the provided snippet code. name: core-run-snippet-code-script supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.ScriptRun.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptRun.endpoints_count description: Number of endpoints the action was initiated on. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Action IDs retrieved from the core-run-script command. isArray: true name: action_id required: true description: Retrieves the status of a script execution. name: core-get-script-execution-status supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.ScriptStatus.general_status description: The general status of the action, based on the status of all endpoints. type: String - contextPath: Core.ScriptStatus.error_message description: Error message regarding permissions for running APIs or the action doesn’t exist. type: String - contextPath: Core.ScriptStatus.endpoints_timeout description: Number of endpoints in "timeout" status. type: Number - contextPath: Core.ScriptStatus.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptStatus.endpoints_pending_abort description: Number of endpoints in "pending abort" status. type: Number - contextPath: Core.ScriptStatus.endpoints_pending description: Number of endpoints in "pending" status. type: Number - contextPath: Core.ScriptStatus.endpoints_in_progress description: Number of endpoints in "in progress" status. type: Number - contextPath: Core.ScriptStatus.endpoints_failed description: Number of endpoints in "failed" status. type: Number - contextPath: Core.ScriptStatus.endpoints_expired description: Number of endpoints in "expired" status. type: Number - contextPath: Core.ScriptStatus.endpoints_completed_successfully description: Number of endpoints in "completed successfully" status. type: Number - contextPath: Core.ScriptStatus.endpoints_canceled description: Number of endpoints in "canceled" status. type: Number - contextPath: Core.ScriptStatus.endpoints_aborted description: Number of endpoints in "aborted" status. type: Number - arguments: - description: Action IDs retrieved from the core-run-script command. isArray: true name: action_id required: true description: Retrieve the results of a script execution. name: core-get-script-execution-results supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.ScriptResult.action_id description: The ID of the initiated action. type: Number - contextPath: Core.ScriptResult.results.retrieved_files description: Number of successfully retrieved files. type: Number - contextPath: Core.ScriptResult.results.endpoint_ip_address description: Endpoint IP address. type: String - contextPath: Core.ScriptResult.results.endpoint_name description: Number of successfully retrieved files. type: String - contextPath: Core.ScriptResult.results.failed_files description: Number of files failed to retrieve. type: Number - contextPath: Core.ScriptResult.results.endpoint_status description: Endpoint status. type: String - contextPath: Core.ScriptResult.results.domain description: Domain to which the endpoint belongs. type: String - contextPath: Core.ScriptResult.results.endpoint_id description: Endpoint ID. type: String - contextPath: Core.ScriptResult.results.execution_status description: Execution status of this endpoint. type: String - contextPath: Core.ScriptResult.results.return_value description: Value returned by the script in case the type is not a dictionary. type: String - contextPath: Core.ScriptResult.results.standard_output description: The STDOUT and the STDERR logged by the script during the execution. type: String - contextPath: Core.ScriptResult.results.retention_date description: Timestamp in which the retrieved files will be deleted from the server. type: Date - contextPath: Core.ScriptResult.results.command description: The command that was executed by the script. type: String - contextPath: Core.ScriptResult.results.command_output description: The output of the command executed by the script. type: array - arguments: - description: Action ID retrieved from the core-run-script command. isArray: true name: action_id required: true - description: Endpoint ID. Can be retrieved by running the core-get-endpoints command. isArray: true name: endpoint_id required: true description: Gets the files retrieved from a specific endpoint during a script execution. name: core-get-script-execution-result-files supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: File.Size description: The size of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file. type: String - contextPath: File.EntryID description: EntryID of the file. type: String - contextPath: File.Info description: Information about the file. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: The extension of the file. type: String - arguments: - description: Link the response action to triggered incident. name: incident_id - description: Comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. name: endpoint_ids required: true - description: Comma-separated list of shell commands to execute. Set the `is_raw_command` argument to `true` to prevent splitting by commas. (Useful when using `||`, `&&`, `;` separators for controlling the flow of multiple commands). name: commands required: true - description: Whether to pass the command as-is. When false, the command is split by commas and sent as a list of commands, that are run independently. name: is_raw_command type: Boolean required: false - description: Type of shell command. auto: PREDEFINED name: command_type predefined: - 'powershell' - 'native' required: false - defaultValue: '600' description: The timeout in seconds for this execution. name: timeout - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Initiates a new endpoint script execution of shell commands. name: core-run-script-execute-commands supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.ScriptRun.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptRun.endpoints_count description: Number of endpoints the action was initiated on. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: Comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. isArray: true name: endpoint_ids required: true - description: Paths of the files to delete, in a comma-separated list. Paths of the files to check for existence. All of the given file paths will run on all of the endpoints. isArray: true name: file_path required: true - defaultValue: '600' description: The timeout in seconds for this execution. name: timeout - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Initiates a new endpoint script execution to delete a specified file. name: core-run-script-delete-file supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.ScriptRun.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptRun.endpoints_count description: Number of endpoints the action was initiated on. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: Comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. isArray: true name: endpoint_ids required: true - description: Paths of the files to check for existence, in a comma-separated list. All of the given file paths will run on all of the endpoints. isArray: true name: file_path required: true - defaultValue: '600' description: The timeout in seconds for this execution. name: timeout - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Initiates a new endpoint script execution to check if a file exists. name: core-run-script-file-exists supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.ScriptRun.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptRun.endpoints_count description: Number of endpoints the action was initiated on. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: Comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. isArray: true name: endpoint_ids required: true - description: Names of processes to kill. Will kill all of the given processes on all of the endpoints. isArray: true name: process_name required: true - defaultValue: '600' description: The timeout in seconds for this execution. name: timeout - description: For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds description: Initiates a new endpoint script execution to kill a process. name: core-run-script-kill-process supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.ScriptRun.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptRun.endpoints_count description: Number of endpoints the action was initiated on. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: The endpoint ID. isArray: true name: id - default: true description: The endpoint IP address. isArray: true name: ip - description: The endpoint hostname. isArray: true name: hostname description: Returns information about an endpoint. name: endpoint supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Endpoint.Hostname description: The hostname of the endpoint. type: String - contextPath: Endpoint.OS description: The endpoint's operation system. type: String - contextPath: Endpoint.IPAddress description: The endpoint's IP address. type: String - contextPath: Endpoint.ID description: The endpoint's ID. type: String - contextPath: Endpoint.Status description: The endpoint's status. type: String - contextPath: Endpoint.IsIsolated description: The endpoint's isolation status. type: String - contextPath: Endpoint.MACAddress description: The endpoint's MAC address. type: String - contextPath: Endpoint.Vendor description: The integration name of the endpoint vendor. type: String - arguments: - description: String that represents the file’s hash. Must be a valid SHA256 hash. name: file_hash required: true - description: The new verdict of the file. 0 - benign, 1 - malware. predefined: - '0' - '1' name: new_verdict required: true - description: String that represents the reason of the report. name: reason required: true - description: User’s email address. name: email required: true description: Reports to WildFire about incorrect hash verdict through Cortex. execution: true name: core-report-incorrect-wildfire outputs: - contextPath: Core.WildFire.file_hash description: String that represents the file’s hash. type: Number - contextPath: Core.WildFire.new_verdict description: The new verdict of the file. type: Number - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: String that represents a list of hashed files you want to add to allow list. Must be a valid SHA256 hash. isArray: true name: hash_list required: true - description: String that represents additional information regarding the action. name: comment description: Removes the requested files from the allow list. name: core-remove-allowlist-files supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.allowlist.removed_hashes description: The removed file hash. type: Number - arguments: - description: Links the response action to the incident that triggered it. name: incident_id - description: String that represents a list of hashed files you want to add to allow list. Must be a valid SHA256 hash. isArray: true name: hash_list required: true - description: String that represents additional information regarding the action. name: comment description: Removes the requested files from the block list. name: core-remove-blocklist-files supportedModules: - cloud_runtime_security - edr - xsiam outputs: - contextPath: Core.blocklist.removed_hashes description: The removed file hash from the block list. type: Number - arguments: - description: Name of the exclusion. name: name required: true - description: 'Filter object for the exclusion. example: {"filter":{"AND":[{"SEARCH_FIELD":"alert_category","SEARCH_TYPE":"NEQ","SEARCH_VALUE":"Phishing"}]}}.' name: filterObject required: true - description: String that represents additional information regarding the action. name: comment - auto: PREDEFINED defaultValue: ENABLED description: Status of exclusion. default value = ENABLED. name: status predefined: - ENABLED - DISABLED description: Adds alert exclusion rule based on filterObject. name: core-add-exclusion outputs: - contextPath: Core.exclusion.rule_id description: Added exclusion rule id. type: Number - arguments: - description: The desired alert_exclusion_id to be removed. name: alert_exclusion_id required: true description: Delete an alert exclusion rule based on rule ID. name: core-delete-exclusion outputs: - contextPath: Core.deletedExclusion.rule_id description: Deleted exclusion rule id. type: Number - arguments: - description: Links the response action to the tenant that triggered it. name: tenant_ID - description: 'Filter object for the exclusion. Example: {"filter":{"AND":[{"SEARCH_FIELD":"alert_category","SEARCH_TYPE":"NEQ","SEARCH_VALUE":"Phishing"}]}}.' name: filterObject - description: Limit for the response. You will get the first "limit" exclusions. Default value is 20. name: limit defaultValue: '20' description: Get a list of the alerts exclusion. name: core-get-exclusion outputs: - contextPath: Core.exclusion.ALERT_WHITELIST_ID description: '' type: Number - contextPath: Core.exclusion.ALERT_WHITELIST_MODIFY_TIME description: '' type: Date - contextPath: Core.exclusion.ALERT_WHITELIST_NAME description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_INDICATOR_TEXT.pretty_name description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_INDICATOR_TEXT.data_type description: '' type: Unknown - contextPath: Core.exclusion.ALERT_WHITELIST_INDICATOR_TEXT.render_type description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_INDICATOR_TEXT.entity_map description: '' type: Unknown - contextPath: Core.exclusion.ALERT_WHITELIST_INDICATOR_TEXT.dml_type description: '' type: Unknown - contextPath: Core.exclusion.ALERT_WHITELIST_INDICATOR.filter.AND.SEARCH_FIELD description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_INDICATOR.filter.AND.SEARCH_TYPE description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_INDICATOR.filter.AND.SEARCH_VALUE description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_HITS description: '' type: Number - contextPath: Core.exclusion.ALERT_WHITELIST_COMMENT description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_USER description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_PRETTY_USER description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_STATUS description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_BACKWARDS_SCAN_STATUS description: '' type: String - contextPath: Core.exclusion.ALERT_WHITELIST_BACKWARDS_SCAN_TIMESTAMP description: '' type: Unknown - contextPath: Core.exclusion.ALERT_WHITELIST_MIGRATED_FROM_ANALYTICS description: '' type: Number - arguments: - description: A comma-separated list of alert IDs. isArray: true name: alert_ids required: true - description: Whether to return only a subset of the alert fields. Filtering the fields can reduce response size for large alerts. name: filter_alert_fields auto: PREDEFINED defaultValue: 'true' predefined: - 'true' - 'false' - description: Whether to return events_from_decider context output as a dictionary (the raw API response) or as a list (improved for playbook automation) - relevant only when filter_alert_fields is set to False. name: events_from_decider_format auto: PREDEFINED defaultValue: 'dict' predefined: - 'list' - 'dict' description: Returns information about each alert ID. name: core-get-cloud-original-alerts outputs: - contextPath: Core.OriginalAlert.event._time description: The timestamp of the occurence of the event. type: String - contextPath: Core.OriginalAlert.event.vendor description: Vendor name. type: String - contextPath: Core.OriginalAlert.event.event_timestamp description: Event timestamp. type: Number - contextPath: Core.OriginalAlert.event.event_type description: Event type (static 500). type: Number - contextPath: Core.OriginalAlert.event.cloud_provider description: The cloud provider - GCP, AZURE, or AWS. type: String - contextPath: Core.OriginalAlert.event.project description: The project in which the event occurred. type: String - contextPath: Core.OriginalAlert.event.cloud_provider_event_id description: The ID given to the event by the cloud provider, if the ID exists. type: String - contextPath: Core.OriginalAlert.event.cloud_correlation_id description: The ID the cloud provider is using to aggregate events that are part of the same general event. type: String - contextPath: Core.OriginalAlert.event.operation_name_orig description: The name of the operation that occurred, as supplied by the cloud provider. type: String - contextPath: Core.OriginalAlert.event.operation_name description: The normalized name of the operation performed by the event. type: String - contextPath: Core.OriginalAlert.event.identity_orig description: Contains the original identity related fields as provided by the cloud provider. type: String - contextPath: Core.OriginalAlert.event.identity_name description: The name of the identity that initiated the action. type: String - contextPath: Core.OriginalAlert.event.identity_uuid description: Same as identity_name but also contains the UUID of the identity if it exists. type: String - contextPath: Core.OriginalAlert.event.identity_type description: An enum representing the type of the identity. type: String - contextPath: Core.OriginalAlert.event.identity_sub_type description: An enum representing the sub-type of the identity, respective to its identity_type. type: String - contextPath: Core.OriginalAlert.event.identity_invoked_by_name description: The name of the identity that invoked the action as it appears in the log. type: String - contextPath: Core.OriginalAlert.event.identity_invoked_by_uuid description: The UUID of the identity that invoked the action as it appears in the log. type: String - contextPath: Core.OriginalAlert.event.identity_invoked_by_type description: An enum that represents the type of identity event that invoked the action. type: String - contextPath: Core.OriginalAlert.event.identity_invoked_by_sub_type description: An enum that represents the respective sub_type of the type of identity (identity_type) that has invoked the action. type: String - contextPath: Core.OriginalAlert.event.operation_status description: Status of whether the operation has succeed or failed, if provided. type: String - contextPath: Core.OriginalAlert.event.operation_status_orig description: The operation status code as it appears in the log, including lookup from code number to code name. type: String - contextPath: Core.OriginalAlert.event.operation_status_orig_code description: The operation status code as it appears in the log. type: String - contextPath: Core.OriginalAlert.event.operation_status_reason_provided description: Description of the error, if the log record indicates an error and the cloud provider supplied the reason. type: String - contextPath: Core.OriginalAlert.event.resource_type description: The normalized type of the service that emitted the log row. type: String - contextPath: Core.OriginalAlert.event.resource_type_orig description: The type of the service that omitted the log as provided by the cloud provider. type: String - contextPath: Core.OriginalAlert.event.resource_sub_type description: The sub-type respective to the resource_type field, normalized across all cloud providers. type: String - contextPath: Core.OriginalAlert.event.resource_sub_type_orig description: The sub-type of the service that emitted this log row as provided by the cloud provider. type: String - contextPath: Core.OriginalAlert.event.region description: The cloud region of the resource that emitted the log. type: String - contextPath: Core.OriginalAlert.event.zone description: The availability zone of the resource that emitted the log. type: String - contextPath: Core.OriginalAlert.event.referenced_resource description: The cloud resource referenced in the audit log. type: String - contextPath: Core.OriginalAlert.event.referenced_resource_name description: Same as referenced_resource but provides only the substring that represents the resource name instead of the full asset ID. type: String - contextPath: Core.OriginalAlert.event.referenced_resources_count description: The number of extracted resources referenced in this audit log. type: Number - contextPath: Core.OriginalAlert.event.user_agent description: The user agent provided in the call to the API of the cloud provider. type: String - contextPath: Core.OriginalAlert.event.caller_ip description: The IP of the caller that performed the action in the log. type: String - contextPath: Core.OriginalAlert.event.caller_ip_geolocation description: The geolocation associated with the caller_ip's value. type: String - contextPath: Core.OriginalAlert.event.caller_ip_asn description: The ASN of the caller_ip's value. type: Number - contextPath: Core.OriginalAlert.event.caller_project description: The project of the caller entity. type: String - contextPath: Core.OriginalAlert.event.raw_log description: The raw log that is being normalized. type: Unknown - contextPath: Core.OriginalAlert.event.log_name description: The name of the log that contains the log row. type: String - contextPath: Core.OriginalAlert.event.caller_ip_asn_org description: The organization associated with the ASN of the caller_ip's value. type: String - contextPath: Core.OriginalAlert.event.event_base_id description: Event base ID. type: String - contextPath: Core.OriginalAlert.event.ingestion_time description: Ingestion time. type: String - arguments: - description: A comma-separated list of alert IDs. isArray: true name: alert_ids required: true - description: Whether to return only a subset of the alert fields. Filtering the fields can reduce response size for large alerts. auto: PREDEFINED name: filter_alert_fields defaultValue: 'true' predefined: - 'true' - 'false' description: Returns dynamic analysis of each alert ID. name: core-get-dynamic-analysis outputs: - contextPath: Core.DynamicAnalysis.causalityId description: '' type: String - contextPath: Core.DynamicAnalysis.internals.name description: '' type: String - contextPath: Core.DynamicAnalysis.internals.factName description: '' type: String - contextPath: Core.DynamicAnalysis.internals.timestamp description: '' type: Date - contextPath: Core.DynamicAnalysis.internals.eventId description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.user_presence description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.shellcode_address description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.tid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.parent_pid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_sign description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.sync_action description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_remote_session description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.peb description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.process_image_path description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.command_line description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.scanned_buffer_crc32_stacktrace_allocation_base_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.page_base_shellcode_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.os_sig_status description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_info_legal_copyright description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.user_name description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_heavens_gate description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_impersonated description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.os_parent_instance_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_info_internal_name description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.stack_trace description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_injected description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.pid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.thread_context_eip_image_path description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.image_path_sha256 description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.montepi_err description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_info_company_name description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_info_original_name description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.instance_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.yara_file_scan_result description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_obj_flags description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.should_obfuscate description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_size description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_info_is_dot_net description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.call_region_shellcode_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.allocation_base_shellcode_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.signer_name description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.original_command_line description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.yara_rules_results_stacktrace_page_base_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.rpc_interface_uuid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.rpc_interface_minor_version description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.telem description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_trusted_signer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.thread_context_eip description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.requested_parent_instance_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_cgo description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.parent_cid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.enabled_privileges description: '' type: Date - contextPath: Core.DynamicAnalysis.internals.attributes.peb32 description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_embedded_sign description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.rpc_function_opnum description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.parent_thread_instance_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.remote_causality_actor_ip description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.canonized_process_image_path description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.scanned_buffer_crc32_stacktrace_call_region_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.yara_rules_results_stacktrace_allocation_base_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.entry_point_rva description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_stack_pivot description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.os_parent_pid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.image_path_md5 description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.causality_actor_type description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.timestamp description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.is_in_transaction description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.cid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.integrity_level description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.actor_type description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_info_description description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.chisq_prob description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.parent_tid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.rpc_interface_major_version description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.dse_internal description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.telem_bit_mask description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.process_image_name description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.parent_instance_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.entropy description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.call_region_base_address description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.yara_rules_results_stacktrace_call_region_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.scanned_buffer_crc32_stacktrace_page_base_buffer description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.image_base description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.sync_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.effective_user_sid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.requested_parent_pid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.event_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.rpc_protocol description: '' type: String - contextPath: Core.DynamicAnalysis.internals.processIdx description: '' type: Number - contextPath: Core.DynamicAnalysis.internals.instanceId description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.scriptblock_text description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.script_path description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.actor_pid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.actor_instance_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.actor_thread_instance_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.etw_event_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.actor_tid description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.suspicious_strings description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.suspicious_strings_context description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.content_version description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.script_hash description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.dotnet_callstack description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.hook_type description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.appdomain_id description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.ps_assembly_version description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.original_length description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.invoke_expression_count description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.file_path description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.content description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.edr_assembly_version description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.expression_tree_scan_result description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.content_length description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.local_analysis_verdict description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.clr_version description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.powershell_version description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.script_source description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.prio description: '' type: String - contextPath: Core.DynamicAnalysis.internals.attributes.build_timestamp description: '' type: Date - contextPath: Core.DynamicAnalysis.potentialPreventionActionOverride description: '' type: Boolean - contextPath: Core.DynamicAnalysis.isBiocRule description: '' type: Boolean - contextPath: Core.DynamicAnalysis.biocId description: '' type: Number - contextPath: Core.DynamicAnalysis.additionalData description: '' type: String - contextPath: Core.DynamicAnalysis.biocRuleName description: '' type: String - contextPath: Core.DynamicAnalysis.reachedMaxActivationsPerRule description: '' type: Boolean - contextPath: Core.DynamicAnalysis.syncActionStatus description: '' type: Number - contextPath: Core.DynamicAnalysis.spawnerImagePath description: '' type: String - contextPath: Core.DynamicAnalysis.spawnerCmdline description: '' type: String - contextPath: Core.DynamicAnalysis.spawnerSigner description: '' type: String - contextPath: Core.DynamicAnalysis.osSpawnerImagePath description: '' type: String - contextPath: Core.DynamicAnalysis.osSpawnerCmdline description: '' type: String - contextPath: Core.DynamicAnalysis.osSpawnerSigner description: '' type: String - arguments: - description: The sha256 of a file. isArray: true name: sha256 required: true description: Get the prevalence of a file, identified by sha256. name: core-get-hash-analytics-prevalence outputs: - contextPath: Core.AnalyticsPrevalence.Hash.value description: Whether the hash is prevalent or not. type: Boolean - contextPath: Core.AnalyticsPrevalence.Hash.data.global_prevalence.value description: The global prevalence of the hash. type: Number - contextPath: Core.AnalyticsPrevalence.Hash.data.local_prevalence.value description: The local prevalence of the hash. type: Number - contextPath: Core.AnalyticsPrevalence.Hash.data.prevalence.value description: The prevalence of the hash. type: Number - arguments: - description: The IP address. isArray: true name: ip_address required: true description: Get the prevalence of an ip, identified by ip_address. name: core-get-IP-analytics-prevalence outputs: - contextPath: Core.AnalyticsPrevalence.Ip.value description: Whether the IP address is prevalent or not. type: Boolean - contextPath: Core.AnalyticsPrevalence.Ip.data.global_prevalence.value description: The global prevalence of the IP. type: Number - contextPath: Core.AnalyticsPrevalence.Ip.data.local_prevalence.value description: The local prevalence of the IP. type: Number - contextPath: Core.AnalyticsPrevalence.Ip.data.prevalence.value description: The prevalence of the IP. type: Number - arguments: - description: The domain name. isArray: true name: domain_name required: true description: Get the prevalence of a domain, identified by domain_name. name: core-get-domain-analytics-prevalence outputs: - contextPath: Core.AnalyticsPrevalence.Domain.value description: Whether the domain is prevalent or not. type: Boolean - contextPath: Core.AnalyticsPrevalence.Domain.data.global_prevalence.value description: The global prevalence of the domain. type: Number - contextPath: Core.AnalyticsPrevalence.Domain.data.local_prevalence.value description: The local prevalence of the domain. type: Number - contextPath: Core.AnalyticsPrevalence.Domain.data.prevalence.value description: The prevalence of the domain. type: Number - arguments: - description: The process name. isArray: true name: process_name required: true description: Get the prevalence of a process, identified by process_name. name: core-get-process-analytics-prevalence outputs: - contextPath: Core.AnalyticsPrevalence.Process.value description: Whether the process is prevalent or not. type: Boolean - contextPath: Core.AnalyticsPrevalence.Process.data.global_prevalence.value description: The global prevalence of the process. type: Number - contextPath: Core.AnalyticsPrevalence.Process.data.local_prevalence.value description: The local prevalence of the process. type: Number - contextPath: Core.AnalyticsPrevalence.Process.data.prevalence.value description: The prevalence of the process. type: Number - arguments: - description: The key name of a registry path. isArray: true name: key_name required: true - description: The value name of a registry path. isArray: true name: value_name required: true description: Get the prevalence of a registry_path, identified by key_name, value_name. name: core-get-registry-analytics-prevalence outputs: - contextPath: Core.AnalyticsPrevalence.Registry.value description: Whether the registry is prevalent or not. type: Boolean - contextPath: Core.AnalyticsPrevalence.Registry.data.global_prevalence.value description: The global prevalence of the registry. type: Number - contextPath: Core.AnalyticsPrevalence.Registry.data.local_prevalence.value description: The local prevalence of the registry. type: Number - contextPath: Core.AnalyticsPrevalence.Registry.data.prevalence.value description: The prevalence of the registry. type: Number - arguments: - description: The process command line. isArray: true name: process_command_line required: true description: Get the prevalence of a process_command_line, identified by process_command_line. name: core-get-cmd-analytics-prevalence outputs: - contextPath: Core.AnalyticsPrevalence.Cmd.value description: Whether the CMD is prevalent or not. type: Boolean - contextPath: Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value description: The global prevalence of the CMD. type: Number - contextPath: Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value description: The local prevalence of the CDM. type: Number - contextPath: Core.AnalyticsPrevalence.Cmd.data.prevalence.value description: The prevalence of the Cmd. type: Number - arguments: - description: A comma-separated list of tenant IDs of the endpoint(s) for which you want to assign the tag. isArray: true name: endpoint_ids required: true - description: The tag name to assign to the endpoint(s). name: tag required: true - description: A comma-separated list of endpoint IDs by which to filter the results. isArray: true name: endpoint_id_list - description: "A comma-separated list of distribution package names or installation package names. \nExample: dist_name1,dist_name2." isArray: true name: dist_name - description: |- A comma-separated list of IP addresses. Example: 8.8.8.8,1.1.1.1. isArray: true name: ip_list - description: |- A comma-separated list of group name to which the agent belongs. Example: group_name1,group_name2. isArray: true name: group_name - auto: PREDEFINED description: The endpoint platform. isArray: true name: platform predefined: - windows - linux - macos - android - description: |- A comma-separated list of alias names. Examples: alias_name1,alias_name2. isArray: true name: alias_name - auto: PREDEFINED description: Specifies whether the endpoint was isolated or unisolated. name: isolate predefined: - isolated - unisolated - description: |- A comma-separated list of hostnames. Example: hostname1,hostname2. isArray: true name: hostname - description: |- All the agents that were first seen after {first_seen_gte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: first_seen_gte - description: |- All the agents that were first seen before {first_seen_lte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: first_seen_lte - description: |- All the agents that were last seen before {last_seen_gte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: last_seen_gte - description: |- All the agents that were last seen before {last_seen_lte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: last_seen_lte - auto: PREDEFINED description: The status of the endpoint to filter. name: status predefined: - connected - disconnected - lost - uninstalled description: Add a tag to one or more endpoints. name: core-add-endpoint-tag - arguments: - description: A comma-separated list of tenant IDs of the endpoint(s) for which you want to remove the tag. isArray: true name: endpoint_ids required: true - description: The tag name to remove from the endpoint(s). name: tag required: true - description: A comma-separated list of endpoint IDs to filter by them. isArray: true name: endpoint_id_list - description: "A comma-separated list of distribution package names or installation package names. \nExample: dist_name1,dist_name2." isArray: true name: dist_name - description: |- A comma-separated list of IP addresses. Example: 8.8.8.8,1.1.1.1. isArray: true name: ip_list - description: |- A comma-separated list of group names to which the agent belongs. Example: group_name1,group_name2. isArray: true name: group_name - auto: PREDEFINED description: The endpoint platform. isArray: true name: platform predefined: - windows - linux - macos - android - description: |- A comma-separated list of alias names. Examples: alias_name1,alias_name2. isArray: true name: alias_name - auto: PREDEFINED description: Specifies whether the endpoint was isolated or unisolated. name: isolate predefined: - isolated - unisolated - description: |- A comma-separated list of hostnames. Example: hostname1,hostname2. isArray: true name: hostname - description: |- All the agents that were first seen after {first_seen_gte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: first_seen_gte - description: |- All the agents that were first seen before {first_seen_lte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: first_seen_lte - description: |- All the agents that were last seen before {last_seen_gte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: last_seen_gte - description: |- All the agents that were last seen before {last_seen_lte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date). name: last_seen_lte - auto: PREDEFINED description: The status of the endpoint to filter. name: status predefined: - connected - disconnected - lost - uninstalled description: Remove a tag from one or more endpoints. name: core-remove-endpoint-tag - arguments: - description: A comma-separated list of endpoint IDs to update their tags. name: endpoint_ids required: true - description: A comma-separated list of tags to add to the endpoints. Either this arguemnt or tags_to_remove is requierd. name: tags_to_add - description: A comma-separated list of tags to remove from the endpoints. Either this arguemnt or tags_to_add is requierd. name: tags_to_remove hidden: true description: Update tags of one or more endpoints. name: core-update-endpoint-tags outputs: - contextPath: Core.EndpointTags.SuccessMessage description: The success message returned after updating endpoint tags. type: string - contextPath: Core.EndpointTags.FailureMessage description: The error message returned when endpoint tags failed to update. type: string - name: core-list-users description: Retrieve a list of the current users in your environment. arguments: [] outputs: - contextPath: Core.User.user_email description: Email address of the user. type: string - contextPath: Core.User.user_first_name description: First name of the user. type: string - contextPath: Core.User.user_last_name description: Last name of the user. type: string - contextPath: Core.User.role_name description: Role name associated with the user. type: string - contextPath: Core.User.last_logged_in description: Timestamp of when the user last logged in. type: Number - contextPath: Core.User.user_type description: Type of user. type: string - contextPath: Core.User.groups description: Name of user groups associated with the user, if applicable. type: array - contextPath: Core.User.scope description: Name of scope associated with the user, if applicable. type: array - arguments: - description: | Unique ID of a specific user. User ID could be either of the `foo/dummy` format, or just `dummy`. name: user_id - description: Limit the number of users that will appear in the list. (limit should be used when no specific host is requested). name: limit defaultValue: 10 name: core-list-risky-users description: Retrieve the risk score of a specific user or list of users with the highest risk score in the environment along with the reason affecting each score. outputs: - contextPath: Core.RiskyUser.type description: Form of identification element. type: String - contextPath: Core.RiskyUser.id description: Identification value of the type field. type: String - contextPath: Core.RiskyUser.score description: The score assigned to the user. type: Integer - contextPath: Core.RiskyUser.reasons.date created description: Date when the incident was created. type: String - contextPath: Core.RiskyUser.reasons.description description: Description of the incident. type: String - contextPath: Core.RiskyUser.reasons.severity description: The severity of the incident. type: String - contextPath: Core.RiskyUser.reasons.status description: The incident status. type: String - contextPath: Core.RiskyUser.reasons.points description: The score. type: Number - arguments: - description: The host name of a specific host. name: host_id - description: Limit the number of hosts that will appear in the list. (Use limit when no specific host is requested). name: limit defaultValue: 10 name: core-list-risky-hosts description: Retrieve the risk score of a specific host or list of hosts with the highest risk score in the environment along with the reason affecting each score. outputs: - contextPath: Core.RiskyHost.type description: Form of identification element. type: String - contextPath: Core.RiskyHost.id description: Identification value of the type field. type: String - contextPath: Core.RiskyHost.score description: The score assigned to the host. type: Integer - contextPath: Core.RiskyHost.reasons.date created description: Date when the incident was created. type: String - contextPath: Core.RiskyHost.reasons.description description: Description of the incident. type: String - contextPath: Core.RiskyHost.reasons.severity description: The severity of the incident. type: String - contextPath: Core.RiskyHost.reasons.status description: The incident status. type: String - contextPath: Core.RiskyHost.reasons.points description: The score. type: Number - arguments: - description: A comma-separated list of one or more user group names for which you want the associated users. name: group_names isArray: true required: true name: core-list-user-groups description: Retrieve a list of the current user emails associated with one or more user groups in your environment. outputs: - contextPath: Core.UserGroup.group_name description: Name of the user group. type: String - contextPath: Core.UserGroup.description description: Description of the user group, if available. type: String - contextPath: Core.UserGroup.pretty_name description: Name of the user group as it appears in the management console. type: String - contextPath: Core.UserGroup.insert_time description: Timestamp of when the user group was created. type: Number - contextPath: Core.UserGroup.update_time description: Timestamp of when the user group was last updated. type: Number - contextPath: Core.UserGroup.user_email description: List of email addresses belonging to the users associated with the user group. type: array - contextPath: Core.UserGroup.source description: Type of user group. type: String - arguments: - description: Allows linking the response action to the incident that triggered it. name: incident_id - description: A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. name: endpoint_ids required: true isArray: true - description: Unique identifier of the script. Can be retrieved by running the core-get-scripts command. name: script_uid required: true - description: Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}. name: parameters - defaultValue: '600' description: The timeout in seconds for this execution. name: timeout - description: Interval in seconds between each poll. defaultValue: '10' name: polling_interval_in_seconds - description: Polling timeout in seconds. name: polling_timeout_in_seconds defaultValue: '600' - description: The action ID for polling use. name: action_id hidden: true - name: hide_polling_output hidden: true description: Whether to hide the polling result (automatically filled by polling). - name: is_core hidden: true description: Is the command being called from a core pack. defaultValue: true description: Initiates a new endpoint script execution using a script from the script library and returns the results. name: core-script-run supportedModules: - cloud_runtime_security - edr - xsiam polling: true outputs: - contextPath: Core.ScriptResult.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptResult.results.retrieved_files description: Number of successfully retrieved files. type: Number - contextPath: Core.ScriptResult.results.endpoint_ip_address description: Endpoint IP address. type: String - contextPath: Core.ScriptResult.results.endpoint_name description: Name of successfully retrieved files. type: String - contextPath: Core.ScriptResult.results.failed_files description: Number of files failed to be retrieved. type: Number - contextPath: Core.ScriptResult.results.endpoint_status description: Endpoint status. type: String - contextPath: Core.ScriptResult.results.domain description: Domain to which the endpoint belongs. type: String - contextPath: Core.ScriptResult.results.endpoint_id description: Endpoint ID. type: String - contextPath: Core.ScriptResult.results.execution_status description: Execution status of this endpoint. type: String - contextPath: Core.ScriptResult.results.return_value description: Value returned by the script in case the type is not a dictionary. type: String - contextPath: Core.ScriptResult.results.standard_output description: The STDOUT and the STDERR logged by the script during the execution. type: String - contextPath: Core.ScriptResult.results.retention_date description: Timestamp in which the retrieved files will be deleted from the server. type: Date - arguments: - description: Allows linking the response action to the incident that triggered it. name: incident_id - description: A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. name: endpoint_ids required: true prettyname: Run action on prettypredefined: Initiator host: ${issue.xdmsourceagentidentifier} Remote host: ${issue.xdmtargetagentidentifier} - description: Unique identifier of the script. Can be retrieved by running the core-get-scripts command. name: script_uid required: true prettyname: Script - description: Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}. name: parameters - defaultValue: '600' description: The timeout in seconds for this execution. name: timeout - description: Interval in seconds between each poll. defaultValue: '10' name: polling_interval_in_seconds - description: Polling timeout in seconds. name: polling_timeout_in_seconds defaultValue: '600' - description: The action ID for polling use. name: action_id hidden: true - name: hide_polling_output hidden: true description: Whether to hide the polling result (automatically filled by polling). - name: is_core hidden: true description: Is the command being called from a core pack. defaultValue: true description: Initiates a new endpoint script execution using a script from the script library and returns the results. This quick action is deprecated. Use the new built-in Run Endpoint Script quick action instead. name: core-script-run-quick-action supportedModules: - cloud_runtime_security - edr - xsiam prettyname: Run Endpoint Script (deprecated) quickaction: true hidden: true polling: true outputs: - contextPath: Core.ScriptResult.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptResult.results.retrieved_files description: Number of successfully retrieved files. type: Number - contextPath: Core.ScriptResult.results.endpoint_ip_address description: Endpoint IP address. type: String - contextPath: Core.ScriptResult.results.endpoint_name description: Name of successfully retrieved files. type: String - contextPath: Core.ScriptResult.results.failed_files description: Number of files failed to be retrieved. type: Number - contextPath: Core.ScriptResult.results.endpoint_status description: Endpoint status. type: String - contextPath: Core.ScriptResult.results.domain description: Domain to which the endpoint belongs. type: String - contextPath: Core.ScriptResult.results.endpoint_id description: Endpoint ID. type: String - contextPath: Core.ScriptResult.results.execution_status description: Execution status of this endpoint. type: String - contextPath: Core.ScriptResult.results.return_value description: Value returned by the script in case the type is not a dictionary. type: String - contextPath: Core.ScriptResult.results.standard_output description: The STDOUT and the STDERR logged by the script during the execution. type: String - contextPath: Core.ScriptResult.results.retention_date description: Timestamp in which the retrieved files will be deleted from the server. type: Date - arguments: - description: The agent ID. name: agent_id isArray: false required: true - description: The instance ID. name: instance_id isArray: true required: true - description: The process name. name: process_name isArray: false required: false - description: The incident ID. name: incident_id isArray: false required: false - description: The action ID. For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds name: core-terminate-process supportedModules: - cloud_runtime_security - edr - xsiam description: Terminates a process by its instance ID. Available only for XSIAM 2.4 and above. polling: true outputs: - contextPath: Core.TerminateProcess.action_id description: The action ID. type: String - contextPath: Core.GetActionStatus description: The action status command results. type: Unknown - contextPath: Core.GetActionStatus.endpoint_id description: Endpoint ID. type: string - contextPath: Core.GetActionStatus.status description: The status of the specific endpoint ID. type: string - contextPath: Core.GetActionStatus.action_id description: The specified action ID. type: number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: The agent ID. name: agent_id isArray: false required: true - description: The causality ID. name: causality_id isArray: true required: true - description: The process name. name: process_name isArray: false required: false - description: The incident ID. name: incident_id isArray: false required: false - description: The action ID. For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: The polling timeout in seconds. name: timeout_in_seconds name: core-terminate-causality supportedModules: - cloud_runtime_security - edr - xsiam description: Terminates a process tree by its causality ID. Available only for XSIAM 2.4 and above. polling: true outputs: - contextPath: Core.TerminateCausality.action_id description: The action id. type: String - contextPath: Core.GetActionStatus description: The action status command results. type: Unknown - contextPath: Core.GetActionStatus.endpoint_id description: Endpoint ID. type: string - contextPath: Core.GetActionStatus.status description: The status of the specific endpoint ID. type: string - contextPath: Core.GetActionStatus.action_id description: The specified action ID. type: number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: The agent ID. name: agent_id prettyname: Run action on prettypredefined: Issue initiator host: ${issue.xdmsourceagentidentifier} isArray: false required: true - description: The causality ID. name: causality_id isArray: true required: true prettypredefined: CGO identifier: ${issue.cid} - description: The process name. name: process_name isArray: false required: false - description: The incident ID. name: incident_id isArray: false required: false - description: The action ID. For polling use. isArray: true name: action_id deprecated: true - description: Interval in seconds between each poll. name: interval_in_seconds - description: The polling timeout in seconds. name: timeout_in_seconds name: core-terminate-causality-quick-action supportedModules: - cloud_runtime_security - edr - xsiam prettyname: Terminate CGO (deprecated) quickaction: true hidden: true description: Terminate a process tree by its causality ID. Available only for Cortex XSIAM 2.4 and above. This quick action is deprecated. Use the new built-in Terminate CGO quick action instead. polling: true outputs: - contextPath: Core.TerminateCausality.action_id description: The action id. type: String - contextPath: Core.GetActionStatus description: The action status command results. type: Unknown - contextPath: Core.GetActionStatus.endpoint_id description: Endpoint ID. type: string - contextPath: Core.GetActionStatus.status description: The status of the specific endpoint ID. type: string - contextPath: Core.GetActionStatus.action_id description: The specified action ID. type: number - contextPath: Core.GetActionStatus.ErrorReasons.bucket description: The bucket in which the error occurred. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_name description: The name of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_path description: The path of the file that caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.file_size description: The size of the file that caused the error. type: Number - contextPath: Core.GetActionStatus.ErrorReasons.missing_files description: The missing files that caused the error. type: Unknown - contextPath: Core.GetActionStatus.ErrorReasons.errorData description: The error reason data. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminated_by description: The instance ID which terminated the action and caused the error. type: String - contextPath: Core.GetActionStatus.ErrorReasons.errorDescription description: The error reason description. type: String - contextPath: Core.GetActionStatus.ErrorReasons.terminate_result description: The error reason terminate result. type: Unknown - arguments: - description: Asset unique identifier. name: asset_id required: true name: core-get-asset-details deprecated:marketplacev2: false deprecated: true description: Get asset information. outputs: - contextPath: Core.CoreAsset description: Asset additional information. - contextPath: Core.CoreAsset.xdm__asset__provider description: The cloud provider or source responsible for the asset. - contextPath: Core.CoreAsset.xdm__asset__realm description: The realm or logical grouping of the asset. - contextPath: Core.CoreAsset.xdm__asset__last_observed description: The timestamp of when the asset was last observed, in ISO 8601 format. - contextPath: Core.CoreAsset.xdm__asset__type__id description: The unique identifier for the asset type. - contextPath: Core.CoreAsset.xdm__asset__first_observed description: The timestamp of when the asset was first observed, in ISO 8601 format. - contextPath: Core.CoreAsset.asset_hierarchy description: The hierarchy or structure representing the asset. - contextPath: Core.CoreAsset.xdm__asset__type__category description: The category type of the asset. - contextPath: Core.CoreAsset.xdm__cloud__region description: The cloud region where the asset resides. - contextPath: Core.CoreAsset.xdm__asset__module_unstructured_fields description: The unstructured fields or metadata associated with the asset module. - contextPath: Core.CoreAsset.xdm__asset__source description: The originating source of the asset's information. - contextPath: Core.CoreAsset.xdm__asset__id description: A unique identifier for the asset. - contextPath: Core.CoreAsset.xdm__asset__type__class description: The classification or type class of the asset. - contextPath: Core.CoreAsset.xdm__asset__type__name description: The specific name of the asset type. - contextPath: Core.CoreAsset.xdm__asset__strong_id description: The strong or immutable identifier for the asset. - contextPath: Core.CoreAsset.xdm__asset__name description: The name of the asset. - contextPath: Core.CoreAsset.xdm__asset__raw_fields description: The raw fields or unprocessed data related to the asset. - contextPath: Core.CoreAsset.xdm__asset__normalized_fields description: The normalized fields associated with the asset. - contextPath: Core.CoreAsset.all_sources description: A list of all sources providing information about the asset. - arguments: - description: The action ID for polling use. name: action_id hidden: true - description: Interval in seconds between each poll. defaultValue: '10' name: polling_interval_in_seconds - description: Polling timeout in seconds. name: polling_timeout_in_seconds defaultValue: '600' - name: hide_polling_output hidden: true description: Whether to hide the polling result (automatically filled by polling). - name: is_core hidden: true description: Is the command being called from a core pack. defaultValue: true - description: Unique identifier of the execute_commands script. name: script_uid hidden: true - description: Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}. name: parameters hidden: true - description: Comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. name: endpoint_ids required: true isArray: true type: String - description: List of shell commands to execute, separated by the defined command_separator argument. Set the is_raw_command argument to true to prevent splitting by the separator character. name: command required: true isArray: true type: String - description: The maximum running time of the command. name: timeout required: false isArray: false type: Integer defaultValue: 600 - description: Link the response action to the triggered incident. name: incident_id required: false isArray: false type: String - description: Whether to pass the command as-is. When false, the command is split by the chosen command_separator argument and sent as a list of commands that are run independently. name: is_raw_command required: false isArray: false type: Boolean - description: The separator used to split the command list. For example, using the default value (a comma), the string command1,command2 will be split into two separate commands, and each will be executed individually. name: command_separator required: false isArray: false type: String defaultValue: ',' auto: PREDEFINED predefined: - "," - "|" - "/" - description: Type of shell command. name: command_type auto: PREDEFINED required: false isArray: false type: String predefined: - "powershell" - "native" description: Run a shell command on a specific endpoint and return its result. name: core-execute-command polling: true outputs: - contextPath: Core.ScriptResult.action_id description: ID of the action initiated. type: Number - contextPath: Core.ScriptResult.results.retrieved_files description: Number of successfully retrieved files. type: Number - contextPath: Core.ScriptResult.results.endpoint_ip_address description: Endpoint IP address. type: String - contextPath: Core.ScriptResult.results.endpoint_name description: Endpoint name. type: String - contextPath: Core.ScriptResult.results.failed_files description: Number of files failed to retrieve. type: Number - contextPath: Core.ScriptResult.results.endpoint_status description: Endpoint status. type: String - contextPath: Core.ScriptResult.results.domain description: Domain to which the endpoint belongs. type: String - contextPath: Core.ScriptResult.results.endpoint_id description: Endpoint ID. type: String - contextPath: Core.ScriptResult.results.execution_status description: Execution status of this endpoint. type: String - contextPath: Core.ScriptResult.results.return_value description: Value returned by the script in case the type is not a dictionary. type: String - contextPath: Core.ScriptResult.results.standard_output description: The STDOUT and the STDERR logged by the script during the execution. type: String - contextPath: Core.ScriptResult.results.retention_date description: Timestamp in which the retrieved files will be deleted from the server. type: Date - contextPath: Core.ScriptResult.results.command description: The command that was executed by the script. type: String - arguments: - description: String that identifies the indicator you want to ingest into XSIAM. Required when the ioc_object is not in use. name: indicator required: false isArray: false type: String - auto: PREDEFINED description: The keyword identifying the type of indicator. Required when the ioc_object is not in use. name: type predefined: - 'HASH' - 'IP' - 'PATH' - 'DOMAIN_NAME' - 'FILENAME' required: false isArray: false type: String - auto: PREDEFINED description: The keyword identifying the indicator's severity. Required when the ioc_object is not in use. name: severity predefined: - 'INFO' - 'LOW' - 'MEDIUM' - 'HIGH' - 'CRITICAL' required: false isArray: false type: String - description: "Integer representing the indicator's expiration timestamp. This is a Unix epoch timestamp value, in milliseconds. Also valid is the UTC date or relative timestamp to set the IOC rule expiration date, for example: '7 Days', '12 hours'. Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. If this indicator has no expiration, use Never. If value is not given, the indicator receives the indicator's type default expiration date." name: expiration_date required: false isArray: false type: String - description: Comment string. name: comment required: false isArray: false type: String - auto: PREDEFINED description: Keyword representing the indicator's reputation. name: reputation predefined: - 'GOOD' - 'BAD' - 'SUSPICIOUS' - 'UNKNOWN' required: false isArray: false type: String - auto: PREDEFINED description: Character representing the indicator's reliability rating. Valid values are A-F. A is the most reliable, F is the least. name: reliability predefined: - 'A' - 'B' - 'C' - 'D' - 'E' - 'F' required: false isArray: false type: String - description: String representing the indicator class (for example, "Malware"). name: class required: false isArray: false type: String - description: String representing the name of the vendor who reported this indicator. name: vendor_name required: false isArray: false type: String - auto: PREDEFINED description: Keyword representing the vendor's reputation. Required when vendor_name is defined. name: vendor_reputation predefined: - 'GOOD' - 'BAD' - 'SUSPICIOUS' - 'UNKNOWN' required: false isArray: false type: String - auto: PREDEFINED description: The character representing the vendor's reliability rating. Valid values are A-F. A is the most reliable, F is the least. Required when vendor_reputation is defined. name: vendor_reliability predefined: - 'A' - 'B' - 'C' - 'D' - 'E' - 'F' required: false isArray: false type: String - auto: PREDEFINED description: The input format selected, which determines how parameters are sent to the XDR API. defaultValue: 'JSON' name: input_format predefined: - 'CSV' - 'JSON' required: false isArray: false type: String - description: "The JSON/CSV object contains the IOC details. Make sure a valid IOC object is passed." name: ioc_object required: false isArray: false type: String description: "Upload the IOC rules to XSIAM. When the ioc_object is defined, disregard any other provided arguments, as the ioc_object takes precedence. Validate the indicator parameters when ioc_object is used. If `vendor_name`, `vendor_reputation`, and `vendor_reliability` are used, only a single vendor is supported. For multiple vendors, utilize an `ioc_object` in JSON format. Adding a rule with the same indicator, but with different parameters, will update the existing rule." name: core-add-indicator-rule outputs: - contextPath: Core.Indicator.indicator description: String that identifies the indicator that was ingested into XSIAM. type: String - contextPath: Core.Indicator.type description: Keyword identifying the type of indicator. type: String - contextPath: Core.Indicator.severity description: Keyword identifying the indicator's severity. type: String - contextPath: Core.Indicator.expiration_date description: Integer representing the indicator's expiration timestamp. type: Number - contextPath: Core.Indicator.comment description: Comment string. type: String - contextPath: Core.Indicator.reputation description: Keyword representing the indicator's reputation. type: String - contextPath: Core.Indicator.reliability description: Keyword representing the indicator's reliability rating. type: String - contextPath: Core.Indicator.class description: String representing the indicator class. type: String - contextPath: Core.Indicator.vendors description: List representing the vendors who reported this indicator. type: List - arguments: - description: The alert ID's from where to retrieve the contributing events. isArray: true name: alert_ids required: true - defaultValue: '50' description: The maximum number of contributing events to retrieve. name: limit - defaultValue: '1' description: The page number to retrieve. Minimum is 1. name: page_number - defaultValue: '50' description: The page size. name: page_size description: Retrieves contributing events for a specific correlation alert. name: core-get-contributing-event outputs: - contextPath: Core.ContributingEvent.alertID description: The alert ID. type: String - contextPath: Core.ContributingEvent.events description: The contributing events. type: Unknown - arguments: - description: List of agent IDs that support the operation. name: endpoint_list required: true - description: List of IPv6 or IPv4 addresses to be added to the blocklist. name: addresses required: true - description: Number of minutes to block (Max 518,400). The default is 300. name: duration - description: The blocked IP address lists required for polling that are not visible to the user. name: blocked_list hidden: true polling: true name: core-block-ip description: Block malicious or suspicious IP addresses. outputs: - contextPath: Core.ip_block_results description: A list of Dictionaries, each containing ip_address, end_point, and reason (including status and error message). type: List runonce: false script: '-' subtype: python3 type: python dockerimage: demisto/google-cloud-storage:1.0.0.10120494 tests: - No tests supportsquickactions: true fromversion: 6.2.0 supportedModules: - exposure_management - cloud - cloud_runtime_security - cloud_posture - xsiam - edr