category: Endpoint
provider: Field Effect Software Inc
commonfields:
  id: Covalence Managed Security
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Credentials
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: When fetching incidents for the first time, this parameter specifies in days how far the integration looks for incidents. For instance if set to "2", it will pull all alerts in Covalence for the last 2 days and will create corresponding incidents.
  defaultvalue: '1'
  display: First run time range
  name: first_run_time_range
  type: 0
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: The maximum number of incidents to fetch
  defaultvalue: '50'
  display: Fetch Limit
  name: max_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: https://HOST:8443
  additionalinfo: Broker Server URL (Optional).  Required to use Broker commands.
  display: Broker Server URL
  name: broker_url
  required: false
  type: 0
  section: Connect
description: Triggers by triaged alerts from endpoint, cloud, and network security monitoring. Contains event details and easy-to-follow mitigation steps.
display: Covalence Managed Security
name: Covalence Managed Security
script:
  commands:
  - arguments:
    - description: if details=true, will return the complete response from Covalence API.
      name: details
      default: false
      isArray: false
      required: false
      secret: false
    - description: "Portal query, for example: \"resolution=Unresolved&type=Recommendation\"\nAvailable Keys to filter on:\n- id; eg: \"id=<ARO_id>\n- status; eg: \"status=In Triage\" or \"status=Open\" or \"status=Closed\"\n- resolution; eg: \"resolution=Unresolved\" or \"resolution=Resolved\" or \"resolution=Help Requested\" or \"resolution=Dismissed\"\n- type; eg: \"type=Action\" or \"type=Recommendation\" or \"type=Observation\"\n- org; eg: \"org=<organization_name>\"\n- since; eg: \"since=2021-01-31 14:00:00\"\n- until; eg: \"until=2021-01-31 14:00:00\"."
      name: query
      required: true
      default: false
      isArray: false
      secret: false
    description: Query FES Portal for ARO.
    name: cov-mgsec-get-aro
    outputs:
    - contextPath: FESPortal.Aro.ID
      description: ID.
      type: String
    - contextPath: FESPortal.Aro.alert_key
      description: Alert_key.
      type: String
    - contextPath: FESPortal.Aro.analyst_notes
      description: Analyst_notes.
      type: String
    - contextPath: FESPortal.Aro.count
      description: Count.
      type: Number
    - contextPath: FESPortal.Aro.creation_time
      description: Creation_time.
      type: Date
    - contextPath: FESPortal.Aro.details
      description: Details.
      type: String
    - contextPath: FESPortal.Aro.details_markdown
      description: Details_markdown.
      type: String
    - contextPath: FESPortal.Aro.display_url
      description: Display_url.
      type: String
    - contextPath: FESPortal.Aro.external_bug_id
      description: External_bug_id.
      type: String
    - contextPath: FESPortal.Aro.last_updated_time
      description: Last_updated_time.
      type: Date
    - contextPath: FESPortal.Aro.notes
      description: Notes.
      type: String
    - contextPath: FESPortal.Aro.organization.ID
      description: ID.
      type: String
    - contextPath: FESPortal.Aro.organization.email
      description: Email.
      type: String
    - contextPath: FESPortal.Aro.organization.name
      description: Name.
      type: String
    - contextPath: FESPortal.Aro.resolution
      description: Resolution.
      type: String
    - contextPath: FESPortal.Aro.serial_id
      description: Serial_id.
      type: String
    - contextPath: FESPortal.Aro.severity
      description: Severity.
      type: String
    - contextPath: FESPortal.Aro.status
      description: Status.
      type: String
    - contextPath: FESPortal.Aro.steps.ID
      description: ID.
      type: String
    - contextPath: FESPortal.Aro.steps.completed
      description: Completed.
      type: Boolean
    - contextPath: FESPortal.Aro.steps.label
      description: Label.
      type: String
    - contextPath: FESPortal.Aro.steps.last_updated_time
      description: Last_updated_time.
      type: Date
    - contextPath: FESPortal.Aro.template_id
      description: Template_id.
      type: String
    - contextPath: FESPortal.Aro.title
      description: Title.
      type: String
    - contextPath: FESPortal.Aro.triage_id
      description: Triage_id.
      type: String
    - contextPath: FESPortal.Aro.type
      description: Type.
      type: String
    deprecated: false
    execution: false
  - description: List organizations.
    name: cov-mgsec-list-org
    outputs:
    - contextPath: FESPortal.Org.ID
      description: ID.
      type: String
    - contextPath: FESPortal.Org.email
      description: Email.
      type: String
    - contextPath: FESPortal.Org.email_aro_details
      description: Email_aro_details.
      type: Boolean
    - contextPath: FESPortal.Org.name
      description: Name.
      type: String
    deprecated: false
    execution: false
  - name: cov-mgsec-list-escalation-contacts
    description: Get the escalation contact list for a given organization.
    arguments:
    - name: org_id
      required: true
      description: Organization ID (eg. "00000000-1111-2222-3333-444444444444").
    outputs:
    - contextPath: FESPortal.Org.priority
      description: Priority.
      type: String
    - contextPath: FESPortal.Org.first_name
      description: First Name.
      type: String
    - contextPath: FESPortal.Org.last_name
      description: Last Name.
      type: String
    - contextPath: FESPortal.Org.job_title
      description: Job Title.
      type: String
    - contextPath: FESPortal.Org.phone_number
      description: Phone Number.
      type: String
    - contextPath: FESPortal.Org.secondary_phone
      description: Secondary Phone Number.
      type: String
    - contextPath: FESPortal.Org.email
      description: Email.
      type: String
    - contextPath: FESPortal.Org.notes
      description: Notes.
      type: String
  - name: cov-mgsec-list-key-contacts
    arguments:
    - name: org_id
      required: true
      description: Organization ID (eg. "00000000-1111-2222-3333-444444444444").
    description: Get the key contact list for a given organization.
    outputs:
    - contextPath: FESPortal.Org.first_name
      description: 'First Name.'
      type: String
    - contextPath: FESPortal.Org.last_name
      description: Last Name.
      type: String
    - contextPath: FESPortal.Org.phone_number
      description: Phone Number.
      type: String
    - contextPath: FESPortal.Org.email
      description: Email.
      type: String
    - contextPath: FESPortal.Org.type
      description: Contact Type.
      type: String
  - name: cov-mgsec-list-language
    arguments:
    - name: org_id
      required: true
      description: Organization ID (eg. "00000000-1111-2222-3333-444444444444").
    description: Get the default language for a given organization.
    outputs:
    - contextPath: FESPortal.Org.default_language
      description: 'Default Language.'
      type: String
  - name: cov-mgsec-transition-aro
    description: Transition an ARO.
    arguments:
    - name: aro_id
      required: true
      default: false
      isArray: false
      secret: false
      description: The ARO ID to transition.
    - name: resolution
      required: true
      description: 'Resolution to transition the ARO to.'
      auto: PREDEFINED
      predefined:
      - Unresolved
      - Help Requested
      - Resolved
      - Dismissed
    - name: comment
      required: false
      default: false
      isArray: false
      secret: false
      description: Optional comment to leave on the ARO.
    - name: is_comment_sensitive
      required: false
      default: false
      isArray: false
      secret: false
      description: Optionally mark the comment as sensitive.
    outputs:
    - contextPath: FESPortal.Aro.ID
      description: ID.
      type: String
    - contextPath: FESPortal.Aro.alert_key
      description: Alert_key.
      type: String
    - contextPath: FESPortal.Aro.analyst_notes
      description: Analyst_notes.
      type: String
    - contextPath: FESPortal.Aro.count
      description: Count.
      type: Number
    - contextPath: FESPortal.Aro.creation_time
      description: Creation_time.
      type: Date
    - contextPath: FESPortal.Aro.details
      description: Details.
      type: String
    - contextPath: FESPortal.Aro.details_markdown
      description: Details_markdown.
      type: String
    - contextPath: FESPortal.Aro.display_url
      description: Display_url.
      type: String
    - contextPath: FESPortal.Aro.external_bug_id
      description: External_bug_id.
      type: String
    - contextPath: FESPortal.Aro.last_updated_time
      description: Last_updated_time.
      type: Date
    - contextPath: FESPortal.Aro.notes
      description: Notes.
      type: String
    - contextPath: FESPortal.Aro.organization.ID
      description: ID.
      type: String
    - contextPath: FESPortal.Aro.organization.email
      description: Email.
      type: String
    - contextPath: FESPortal.Aro.organization.name
      description: Name.
      type: String
    - contextPath: FESPortal.Aro.resolution
      description: Resolution.
      type: String
    - contextPath: FESPortal.Aro.serial_id
      description: Serial_id.
      type: String
    - contextPath: FESPortal.Aro.severity
      description: Severity.
      type: String
    - contextPath: FESPortal.Aro.status
      description: Status.
      type: String
    - contextPath: FESPortal.Aro.steps.ID
      description: ID.
      type: String
    - contextPath: FESPortal.Aro.steps.completed
      description: Completed.
      type: Boolean
    - contextPath: FESPortal.Aro.steps.label
      description: Label.
      type: String
    - contextPath: FESPortal.Aro.steps.last_updated_time
      description: Last_updated_time.
      type: Date
    - contextPath: FESPortal.Aro.template_id
      description: Template_id.
      type: String
    - contextPath: FESPortal.Aro.title
      description: Title.
      type: String
    - contextPath: FESPortal.Aro.triage_id
      description: Triage_id.
      type: String
    - contextPath: FESPortal.Aro.type
      description: Type.
      type: String
  - name: cov-mgsec-comment-aro
    arguments:
    - name: aro_id
      required: true
      default: false
      isArray: false
      secret: false
      description: The ARO ID to comment on.
    - name: comment
      required: true
      default: false
      isArray: false
      secret: false
      description: Comment to leave on the ARO.
    - name: is_comment_sensitive
      required: false
      default: false
      isArray: false
      secret: false
      description: Optionally mark the comment as sensitive.
    description: Comment on an ARO.
    outputs:
    - contextPath: FESPortal.Aro.ID
      description: 'ID.'
      type: String
    - contextPath: FESPortal.Aro.acknowledged
      description: Acknowledged.
      type: Boolean
    - contextPath: FESPortal.Aro.acknowledged_by.ID
      description: Acknowledged By ID.
      type: String
    - contextPath: FESPortal.Aro.acknowledged_by.avatar_file_url
      description: Acknowledged By.
      type: String
    - contextPath: FESPortal.Aro.acknowledged_by.email
      description: Acknowledged By Email.
      type: String
    - contextPath: FESPortal.Aro.acknowledged_by.first_name
      description: Acknowledged By First Name.
      type: String
    - contextPath: FESPortal.Aro.acknowledged_by.last_name
      description: Acknowledged By Last Name.
      type: String
    - contextPath: FESPortal.Aro.acknowledged_time
      description: Acknowledged Time.
      type: Date
    - contextPath: FESPortal.Aro.aro_id
      description: ARO ID.
      type: String
    - contextPath: FESPortal.Aro.author.ID
      description: Author ID.
      type: String
    - contextPath: FESPortal.Aro.author.avatar_file_url
      description: Author Avatar File URL.
      type: String
    - contextPath: FESPortal.Aro.author.email
      description: Author Email.
      type: String
    - contextPath: FESPortal.Aro.author.first_name
      description: Author First Name.
      type: String
    - contextPath: FESPortal.Aro.author.last_name
      description: Author Last Name.
      type: String
    - contextPath: FESPortal.Aro.author_organization.ID
      description: Author Organization ID.
      type: String
    - contextPath: FESPortal.Aro.author_organization.email
      description: Author Organization Email.
      type: String
    - contextPath: FESPortal.Aro.author_organization.name
      description: Author Organization Name.
      type: String
    - contextPath: FESPortal.Aro.author_organization_type
      description: Author Organization Type.
      type: String
    - contextPath: FESPortal.Aro.available_only_to_organization_id
      description: ARO Comment Available Only to Organization ID.
      type: String
    - contextPath: FESPortal.Aro.available_only_to_provider_id
      description: ARO Comment Available Only to Provider ID.
      type: String
    - contextPath: FESPortal.Aro.created_time
      description: ARO Created Time.
      type: Date
    - contextPath: FESPortal.Aro.id
      description: ARO Comment ID.
      type: String
    - contextPath: FESPortal.Aro.last_updated_time
      description: ARO Comment Last Updated Time.
      type: Date
    - contextPath: FESPortal.Aro.sensitive
      description: ARO Comment Sensitive.
      type: Boolean
    - contextPath: FESPortal.Aro.source
      description: ARO Comment Source.
      type: String
    - contextPath: FESPortal.Aro.text
      description: ARO Comment Text.
      type: String
    - contextPath: FESPortal.Aro.type
      description: ARO Comment Type.
      type: String
    - contextPath: FESPortal.Aro.visible_to.ID
      description: ARO Comment Visible to ID.
      type: String
    - contextPath: FESPortal.Aro.visible_to.email
      description: ARO Comment Visible to Email.
      type: String
    - contextPath: FESPortal.Aro.visible_to.name
      description: ARO Comment Visible to Name.
      type: String
  - name: cov-mgsec-broker-ping
    arguments: []
    description: Broker - Test connectivity to the Broker service.
    outputs:
    - contextPath: FESBroker.APIStatus
      description: 'API Status.'
      type: String
  - name: cov-mgsec-broker-list-org
    description: Broker - List organizations.
    arguments: []
    outputs:
    - contextPath: FESBroker.ID
      description: 'Organization ID.'
      type: String
    - contextPath: FESBroker.name
      description: 'Organization Name.'
      type: String
    - contextPath: FESBroker.client_id
      description: 'Client ID.'
      type: String
  - name: cov-mgsec-broker-endpoint-action-by-host
    description: Broker - Endpoint Action By Host.
    arguments:
    - name: action_type
      required: true
      auto: PREDEFINED
      predefined:
      - ISOLATE
      - UNISOLATE
      - SHUTDOWN
      - RESTART
      - DEFENDER_QUICK_SCAN
      - DEFENDER_FULL_SCAN
      - DEFENDER_SIGNATURE_UPDATE
      description: Action to send to Host.
      type: unknown
    - name: org_id
      required: true
      description: Organization ID (eg. "00000000-1111-2222-3333-444444444444").
    - name: host_identifier
      required: true
      description: Hostname.
    outputs:
    - contextPath: FESBroker.host_identifier
      description: 'Host Identifier.'
      type: String
    - contextPath: FESBroker.agent_uuid
      description: 'Agent UUID.'
      type: String
    - contextPath: FESBroker.covalence_appliance
      description: 'Covalence Appliance ID.'
      type: String
    - contextPath: FESBroker.task_id
      description: 'Endpoint Action Task ID.'
      type: Number
  - name: cov-mgsec-broker-endpoint-action-by-aro
    description: Broker - Endpoint Action By ARO.
    arguments:
    - name: action_type
      required: true
      auto: PREDEFINED
      predefined:
      - ISOLATE
      - UNISOLATE
      - SHUTDOWN
      - RESTART
      - DEFENDER_QUICK_SCAN
      - DEFENDER_FULL_SCAN
      - DEFENDER_SIGNATURE_UPDATE
      description: Action to send to Host.
      type: unknown
    - name: aro_id
      required: true
      description: ARO ID (eg. "00000000-1111-2222-3333-444444444444").
    outputs:
    - contextPath: FESBroker.host_identifier
      description: 'Host Identifier.'
      type: String
    - contextPath: FESBroker.agent_uuid
      description: 'Agent UUID.'
      type: String
    - contextPath: FESBroker.covalence_appliance
      description: 'Covalence Appliance ID.'
      type: String
    - contextPath: FESBroker.task_id
      description: 'Endpoint Action Task ID.'
      type: Number
  - name: cov-mgsec-broker-cloud-action-by-aro
    description: Broker - Cloud Action By ARO.
    arguments:
    - name: action_type
      required: true
      auto: PREDEFINED
      predefined:
      - DISABLE_USER
      - ENABLE_USER
      - REVOKE_SESSIONS
      description: Action to perform.
      type: unknown
    - name: aro_id
      required: true
      description: ARO ID (eg. "00000000-1111-2222-3333-444444444444").
    outputs:
    - contextPath: FESBroker.action_id
      description: Action ID.
      type: String
    - contextPath: FESBroker.action_type
      description: Action Type.
      type: String
    - contextPath: FESBroker.action_params
      description: Action Parameters.
      type: Unknown
    - contextPath: FESBroker.created_time
      description: Created Time.
      type: String
    - contextPath: FESBroker.status
      description: Status.
      type: String
    - contextPath: FESBroker.result
      description: Result.
      type: String
  dockerimage: demisto/python3:3.12.12.7090913
  isfetch: true
  runonce: false
  script: ''
  subtype: python3
  type: python
  feed: false
  longRunning: false
  longRunningPort: false
tests:
- No tests (auto formatted)
fromversion: 5.0.0
beta: false