category: Endpoint
provider: CyberArk
sectionorder:
- Connect
commonfields:
  id: CyberArkEPMSOCResponse
  version: -1
configuration:
- name: url
  display: EPM Region-based tenant URL
  required: true
  type: 0
  section: Connect
  additionalinfo: The tenant URL for EPM region (e.g., https://api-na.epm.cyberark.cloud).
- name: identity_url
  display: Identity URL
  required: true
  type: 0
  section: Connect
  defaultvalue: "identity_url"
  additionalinfo: The CyberArk Identity FQDN for OAuth2 authentication (e.g., https://abc1234.id.cyberark.cloud).
- name: web_app_id
  display: Web App ID
  required: true
  type: 0
  section: Connect
  defaultvalue: "my_web_app"
  additionalinfo: The Application ID of the OAuth2 Server web app configured in Identity Administration.
- name: client_id
  display: Client ID
  required: true
  type: 0
  section: Connect
  defaultvalue: "client_id"
  additionalinfo: Service username (configured as OAuth confidential client).
- name: credentials
  display: Client Secret (Service User Password)
  displaypassword: Client Secret
  required: true
  type: 9
  section: Connect
  hiddenusername: true
  additionalinfo: Service user password for OAuth2 authentication.
- name: application_id
  display: Application ID
  required: false
  type: 0
  section: Connect
  additionalinfo: (Deprecated) Required for local(EPM) authentication only. This parameter is deprecated and no longer used.
  advanced: true
description: Use the CyberArk EPM integration to activate and deactivate CyberArk EPM risk plans for specific endpoints.
display: CyberArk EPM SOC Response
name: CyberArkEPMSOCResponse
script:
  commands:
  - arguments:
    - description: The name of the risk plan to activate.
      name: risk_plan
      required: true
    - description: The name of the endpoint to target.
      name: endpoint_name
      required: true
    - description: Logged in user name.
      name: logged_in_user
      required: false
    - description: (Deprecated) The external IP address of the endpoint. This argument is deprecated and no longer used.
      name: external_ip
      required: false
      deprecated: true
    description: Activates a CyberArk EPM risk plan for a specified endpoint.
    name: cyberarkepm-activate-risk-plan
    outputs:
    - contextPath: CyberArkEPMSOCResponse.SetID
      description: The ID of the EPM set in which the endpoints were found.
      type: String
    - contextPath: CyberArkEPMSOCResponse.EndpointIDs
      description: The IDs of the endpoints added to the risk plan.
      type: String
    - contextPath: CyberArkEPMSOCResponse.RiskPlan
      description: The name of activated risk plan.
      type: String
    - contextPath: CyberArkEPMSOCResponse.Action
      description: The action performed on the risk plan (add/remove).
      type: String
    - contextPath: CyberArkEPMSOCResponse.GroupActionPerformed
      description: Whether the endpoint was successfully added to the risk plan group in this set.
      type: Boolean
  - arguments:
    - description: The name of the risk plan to deactivate.
      name: risk_plan
      required: true
    - description: The name of the endpoint to target.
      name: endpoint_name
      required: true
    - description: Logged in user name.
      name: logged_in_user
      required: false
    - description: (Deprecated) The external IP address of the endpoint. This argument is deprecated and no longer used.
      name: external_ip
      required: false
      deprecated: true
    description: Deactivates a CyberArk EPM risk plan for a specified endpoint.
    name: cyberarkepm-deactivate-risk-plan
    outputs:
    - contextPath: CyberArkEPMSOCResponse.SetID
      description: The ID of the EPM set in which the endpoints were found.
      type: String
    - contextPath: CyberArkEPMSOCResponse.EndpointIDs
      description: The IDs of the endpoints removed from the risk plan.
      type: String
    - contextPath: CyberArkEPMSOCResponse.RiskPlan
      description: The name of the deactivated risk plan.
      type: String
    - contextPath: CyberArkEPMSOCResponse.Action
      description: The action performed on the risk plan (add/remove).
      type: String
    - contextPath: CyberArkEPMSOCResponse.GroupActionPerformed
      description: Whether the endpoint was successfully removed from the risk plan group in this set.
      type: Boolean
  isfetch: false
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
- xsoar
fromversion: 6.10.0
tests:
- No tests (auto formatted)