category: Data Enrichment & Threat Intelligence
provider: CybelAngel
sectionorder:
- Connect
- Collect
commonfields:
  id: CybelAngel Event Collector
  version: -1
configuration:
- defaultvalue: https://platform.cybelangel.com
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Client ID
  displaypassword: Client Secret
  name: credentials
  type: 9
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  advanced: true
  required: false
  defaultvalue: 'false'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  required: false
  defaultvalue: '1'
  advanced: true
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Event Types To Fetch
  name: event_types_to_fetch
  section: Collect
  type: 16
  advanced: true
  required: false
  defaultvalue: Reports
  options:
  - Reports
  - Credential watchlist
  - Domain watchlist
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: The maximum number of reports per fetch
  name: max_fetch
  defaultvalue: "5000"
  advanced: true
  type: 0
  required: true
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: The maximum number of Credential watchlist events per fetch
  name: max_fetch_creds
  defaultvalue: "50"
  advanced: true
  type: 0
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: The maximum number of Domain watchlist events  per fetch
  name: max_fetch_domain
  defaultvalue: "500"
  advanced: true
  type: 0
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
description: 'CybelAngel collects reports from the CybelAngel platform, which specializes in external attack surface protection and management.'
display: CybelAngel
name: CybelAngel Event Collector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: false
    - description: 'Get events from a specific start date formatted with ISO 8601. Example: "2025-01-01T00:00:00.000.".'
      name: start_date
      required: false
    - description: 'Get events until a specific end date formatted with ISO 8601. Example: "2025-01-01T00:00:00.000Z".'
      name: end_date
      required: false
    - description: 'The maximum number of events to return.'
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: 'Which events to fetch.'
      name: events_type_to_fetch
      predefined:
      - 'Reports'
      - 'Credential watchlist'
      - 'Domain watchlist'
      defaultValue: 'Reports'
    description: 'Send events from CybelAngel to XSIAM. Used mainly for debugging.'
    name: cybelangel-get-events
    outputs: []
  - name: cybelangel-report-list
    description: 'Retrieve reports from CybelAngel.'
    arguments:
    - name: start_date
      description: 'Get reports from a specific start date formatted with ISO 8601, Example: "2025-01-14T10:22:45".'
      required: false
    - description: 'Get reports until a specific end date formatted with ISO 8601, Example: "2025-01-14T10:22:45.'
      name: end_date
      required: false
    outputs:
    - contextPath: CybelAngel.Report
      description: 'The retrieved reports.'
  - name: cybelangel-report-get
    description: 'Retrieve reports from CybelAngel.'
    arguments:
    - name: report_id
      description: 'The ID of the report to retrieve.'
      required: true
    - name: pdf
      description: 'If true, retrieves the report as a PDF file.'
      defaultValue: false
      required: false
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    outputs:
    - contextPath: CybelAngel.Report
      description: 'The retrieved reports.'
    - contextPath: InfoFile.EntryID
      description: 'Entry ID of the saved PDF file.'
      type: String
  - name: cybelangel-mirror-report-get
    description: 'Retrieve the mirror details for the specified report.'
    arguments:
    - name: report_id
      description: 'The ID of the report.'
      required: true
    - name: csv
      description: 'If true, retrieves the mirror report in CSV format.'
      defaultValue: false
      required: false
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    outputs:
    - contextPath: CybelAngel.ReportMirror
      description: 'Mirror details of the report.'
    - contextPath: InfoFile.EntryID
      description: 'Entry ID of the saved CSV file.'
  - name: cybelangel-archive-report-by-id-get
    description: 'Retrieve an archived report by ID as a ZIP file.'
    arguments:
    - name: report_id
      description: 'The ID of the archived report.'
      required: true
    outputs:
    - contextPath: InfoFile.EntryID
      description: 'Entry ID of the saved ZIP file.'
  - name: cybelangel-report-status-update
    description: 'Update the status of one or multiple reports.'
    arguments:
    - name: report_ids
      description: 'List of report IDs to update.'
      isArray: true
      required: true
    - auto: PREDEFINED
      name: status
      description: 'The new status of the reports.'
      required: true
      predefined:
      - 'draft'
      - 'open'
      - 'in_progress'
      - 'resolved'
      - 'discarded'
  - name: cybelangel-report-comments-get
    description: 'Retrieve comments from a report.'
    arguments:
    - name: report_id
      description: 'The ID of the report.'
      required: true
    outputs:
    - contextPath: CybelAngel.Report.Comment
      description: 'The list of comments for the report.'
  - name: cybelangel-report-comment-create
    description: 'Create a new comment on a report.'
    arguments:
    - name: discussion_id
      description: 'The discussion_id is made of report id and tenant id like uuid:uuid. Example: <report_id>:<your-tenant-id>.'
      required: true
    - name: content
      description: 'The content of the comment.'
      required: true
    - name: parent_id
      description: 'The ID of the parent comment (for replies).'
      required: false
    - name: assigned
      description: 'Specifies if the comment is assigned to analysts (true/false).'
      defaultValue: false
      required: false
  - name: cybelangel-report-attachment-get
    description: 'Retrieve an attachment from a report.'
    arguments:
    - name: report_id
      description: 'The ID of the report.'
      required: true
    - name: attachment_id
      description: 'The ID of the attachment.'
      required: true
    outputs:
    - contextPath: InfoFile.EntryID
      description: 'Entry ID of the retrieved file.'
  - name: cybelangel-report-remediation-request-create
    description: 'Create a remediation request for a report.'
    arguments:
    - name: report_id
      description: 'The ID of the report.'
      required: true
    - name: requestor_email
      description: 'Email of the requestor.'
      required: true
    - name: requestor_fullname
      description: 'Full name of the requestor.'
      required: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
fromversion: 8.0.0
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- CybelAngel Test Playbook
supportlevelheader: xsoar