category: Authentication & Identity Management
provider: CyberArk
sectionorder:
- Connect
- Collect
commonfields:
  id: CyberArkPAS
  version: -1
configuration:
- display: Server URL (e.g., https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- defaultvalue: '50'
  display: Max fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: fetch_time
  type: 0
  section: Collect
  required: false
- defaultvalue: '0'
  display: CyberArk PAM score (0.0-100.0)
  name: score
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Use the CyberArk Privileged Access Management (PAM) solution to manage users, safes, vaults, and accounts from Cortex XSOAR.
display: CyberArk PAM
name: CyberArkPAS
script:
  commands:
  - arguments:
    - description: The name of the user.
      name: username
      required: true
    - description: The user type according to the license.
      name: user_type
    - description: The CyberArkPAM interfaces that this user is not authorized to use, e.g., - "PSM", "PSMP".
      isArray: true
      name: non_authorized_interfaces
    - description: The location in the vault where the user will be created. Must begin with "\\".  If just "\\", the vault is in the root.
      name: location
    - description: 'The date when the user credentials expire. Must be in the following timestamp format: (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year).'
      name: expiry_date
    - description: The password that the user will use to log in for the first time.
      name: password
      required: true
      secret: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether or not the user must change the user password from the second log in onward. Can be 'true' or 'false'. Default is 'true'.
      name: change_password_on_the_next_logon
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether the user’s password will not expire unless they decide to change it. Can be 'true' or 'false'. Default is 'false'.
      name: password_never_expires
      predefined:
      - 'true'
      - 'false'
    - description: 'A comma-separated list of user permissions. Valid values are: AuditUsers, AddUpdateUsers, ResetUsersPasswords, ActivateUsers, AddNetworkAreas, ManageDirectoryMapping, ManageServerFileCategories, BackupAllSafes, RestoreAllSafes e.g., AddSafes,AuditUsers.'
      isArray: true
      name: vault_authorization
    - description: Notes and comments.
      name: description
    - description: The email address of the user.
      name: email
    - description: The first name of the user.
      name: first_name
    - description: The last name of the user.
      name: last_name
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether the user will be enabled upon creation. Can be 'true' or 'false'. Default is 'true'.
      name: enable_user
      predefined:
      - 'true'
      - 'false'
    - description: The distinguished name of the user. The usage is for PKI authentication. This will match the certificate subject name or domain name.
      name: distinguished_name
    - description: The profession of the user.
      name: profession
    description: Add a new user to the vault.
    name: cyberark-pas-user-add
    outputs:
    - contextPath: CyberArkPAS.Users.id
      description: The unique ID of the user.
      type: Number
    - contextPath: CyberArkPAS.Users.authenticationMethod
      description: The authentication method of the user.
      type: String
    - contextPath: CyberArkPAS.Users.changePassOnNextLogon
      description: Whether or not the user must change the user password.
      type: Boolean
    - contextPath: CyberArkPAS.Users.description
      description: Description of the user.
      type: String
    - contextPath: CyberArkPAS.Users.enableUser
      description: Whether or not the user is enabled.
      type: Boolean
    - contextPath: CyberArkPAS.Users.expiryDate
      description: The expiry date of the user credentials.
      type: Number
    - contextPath: CyberArkPAS.Users.internet.businessEmail
      description: The email address of the user.
      type: String
    - contextPath: CyberArkPAS.Users.lastSuccessfulLoginDate
      description: The last successful login date of the user.
      type: Number
    - contextPath: CyberArkPAS.Users.location
      description: The location in the vault where the user will be created.
      type: String
    - contextPath: CyberArkPAS.Users.personalDetails.profession
      description: The profession of the user.
      type: String
    - contextPath: CyberArkPAS.Users.suspended
      description: Whether or not the user is suspended.
      type: Boolean
    - contextPath: CyberArkPAS.Users.userType
      description: The type of the user.
      type: String
    - contextPath: CyberArkPAS.Users.username
      description: The name of the user.
      type: String
    - contextPath: CyberArkPAS.Users.vaultAuthorization
      description: The permissions of the user.
      type: String
  - arguments:
    - description: The name of the user.
      name: username
    - description: User type according to the license.
      name: user_type
    - description: The CyberArkPAM interfaces that this user is not authorized to use, e.g., "PSM", "PSMP".
      isArray: true
      name: non_authorized_interfaces
    - description: The location in the vault where the user will be created. Must begin with "\\". If just "\\", the vault is in the root.
      name: location
    - description: 'The date when the user expires. Must be in the following timestamp format: (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year).'
      name: expiry_date
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether or not the user must change their password from the second log on onward. Can be 'true' or 'false'. Default is 'true'.
      name: change_password_on_the_next_logon
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether the user’s password will not expire unless they decide to change it. Can be 'true' or 'false'. Default is 'false'.
      name: password_never_expires
      predefined:
      - 'true'
      - 'false'
    - description: 'A comma-separated list of user permissions. Valid values are: AddSafes, AuditUsers, AddUpdateUsers, ResetUsersPasswords, ActivateUsers, AddNetworkAreas, ManageDirectoryMapping, ManageServerFileCategories, BackupAllSafes, RestoreAllSafes e.g., AddSafes,AuditUsers.'
      isArray: true
      name: vault_authorization
    - description: Notes and comments.
      name: description
    - description: The email addresses of the user.
      name: email
    - description: The first name of the user.
      name: first_name
    - description: The last name of the user.
      name: last_name
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether the user will be enabled upon creation. Can be 'true' or 'false'. Default is 'true'.
      name: enable_user
      predefined:
      - 'true'
      - 'false'
    - description: The distinguished name of the user. The usage is for PKI authentication. This will match the certificate subject name or domain name.
      name: distinguished_name
    - description: The profession of the user.
      name: profession
    - description: The ID of the user to update.
      name: user_id
      required: true
    description: Update an existing vault user.
    name: cyberark-pas-user-update
    outputs:
    - contextPath: CyberArkPAS.Users.id
      description: The unique ID of the user.
      type: Number
    - contextPath: CyberArkPAS.Users.authenticationMethod
      description: The authentication method for the user.
      type: String
    - contextPath: CyberArkPAS.Users.changePassOnNextLogon
      description: Whether or not the user must change the user password.
      type: Boolean
    - contextPath: CyberArkPAS.Users.description
      description: Description of the user.
      type: String
    - contextPath: CyberArkPAS.Users.enableUser
      description: Whether or not the user is enabled.
      type: Boolean
    - contextPath: CyberArkPAS.Users.expiryDate
      description: The expiry date of the user.
      type: Number
    - contextPath: CyberArkPAS.Users.internet.businessEmail
      description: The email address of the user.
      type: String
    - contextPath: CyberArkPAS.Users.lastSuccessfulLoginDate
      description: The last successful login date of the user.
      type: Number
    - contextPath: CyberArkPAS.Users.location
      description: The location in the vault where the user will be created.
      type: String
    - contextPath: CyberArkPAS.Users.personalDetails.profession
      description: The profession of the user.
      type: String
    - contextPath: CyberArkPAS.Users.suspended
      description: Whether or not the user is suspended.
      type: Boolean
    - contextPath: CyberArkPAS.Users.userType
      description: The type of the user.
      type: String
    - contextPath: CyberArkPAS.Users.username
      description: The name of the user.
      type: String
    - contextPath: CyberArkPAS.Users.vaultAuthorization
      description: The permissions of the user.
      type: String
  - arguments:
    - description: The ID of the user to delete.
      name: user_id
      required: true
    description: Delete a specific user in the vault.
    name: cyberark-pas-user-delete
    outputs:
    - contextPath: CyberArkPAS.Users.Deleted
      description: Whether the user was deleted.
      type: Boolean
  - arguments:
    - description: 'Retrieve users using filters. Valid values: userType, componentUser.'
      name: filter
    - description: 'Search by the following values: username, first name, last name.'
      name: search
    description: Return a list of all existing users in the vault that meet the filter and search criteria.
    name: cyberark-pas-users-list
    outputs:
    - contextPath: CyberArkPAS.Users.id
      description: The unique IDs of the users.
      type: Number
    - contextPath: CyberArkPAS.Users.username
      description: The names of the users.
      type: String
    - contextPath: CyberArkPAS.Users.source
      description: The sources of the users.
      type: String
    - contextPath: CyberArkPAS.Users.userType
      description: The types of the users.
      type: String
    - contextPath: CyberArkPAS.Users.componentUser
      description: Whether the users are component users.
      type: Boolean
    - contextPath: CyberArkPAS.Users.location
      description: The locations in the vault where the users were created.
      type: String
    - contextPath: CyberArkPAS.Users.personalDetails.firstName
      description: The first name of the users.
      type: String
    - contextPath: CyberArkPAS.Users.personalDetails.middleName
      description: The middle name of the users.
      type: String
    - contextPath: CyberArkPAS.Users.personalDetails.lastName
      description: The last name of the users.
      type: String
    - contextPath: CyberArkPAS.Users.vaultAuthorization
      description: The permissions of the users.
      type: String
  - arguments:
    - description: The ID of the user to activate.
      name: user_id
      required: true
    description: Activate an existing vault user who was suspended after entering incorrect credentials multiple times.
    name: cyberark-pas-user-activate
  - description: Return information about all of the user’s safes in the vault.
    name: cyberark-pas-safes-list
    outputs:
    - contextPath: CyberArkPAS.Safes.SafeName
      description: The names of the safes.
      type: String
    - contextPath: CyberArkPAS.Safes.Description
      description: The descriptions of the safes.
      type: String
    - contextPath: CyberArkPAS.Safes.Location
      description: The locations of the safes.
      type: String
    - contextPath: CyberArkPAS.Safes.ManagingCPM
      description: The name of the Central Policy Manager (CPM) user who will manage the safes.
      type: String
    - contextPath: CyberArkPAS.Safes.NumberOfDaysRetention
      description: The number of retained versions of every password that is stored in the safes.
      type: Number
    - contextPath: CyberArkPAS.Safes.NumberOfVersionsRetention
      description: The number of days for which password versions are saved in the safes.
      type: Number
    - contextPath: CyberArkPAS.Safes.OLACEnabled
      description: Whether or not to enable Object Level Access Control (OLAC) for the safes.
      type: Boolean
  - arguments:
    - description: The name of the safe about which information is returned.
      name: safe_name
      required: true
    description: Return information about a specific safe in the vault.
    name: cyberark-pas-safe-get-by-name
    outputs:
    - contextPath: CyberArkPAS.Safes.SafeName
      description: The name of the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.Description
      description: The description of the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.Location
      description: The location of the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.ManagingCPM
      description: The name of the Central Policy Manager (CPM) user who will manage the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.NumberOfDaysRetention
      description: The number of retained versions of every password that is stored in the safe.
      type: Number
    - contextPath: CyberArkPAS.Safes.NumberOfVersionsRetention
      description: The number of days for which password versions are saved in the safe.
      type: Number
    - contextPath: CyberArkPAS.Safes.OLACEnabled
      description: Whether or not to enable Object Level Access Control (OLAC) for the safe.
      type: Boolean
  - arguments:
    - description: Name of a safe to create.
      name: safe_name
      required: true
    - description: Description of the new safe.
      name: description
    - auto: PREDEFINED
      description: |-
        Whether or not to enable Object Level Access Control (OLAC) for the new
        safe. Valid values are: 'true' or 'false'. Default is 'true'.
      defaultValue: 'true'
      name: OLAC_enabled
      predefined:
      - 'true'
      - 'false'
    - description: The name of the Central Policy Manager (CPM) user who will manage the new safe.
      name: managing_cpm
    - description: The number of retained versions of every password that is stored in the safe.
      name: number_of_versions_retention
    - description: The number of days for which password versions are saved in the safe.
      name: number_of_days_retention
    - description: The location of the new safe.
      name: location
    description: Add a new safe to the vault.
    name: cyberark-pas-safe-add
    outputs:
    - contextPath: CyberArkPAS.Safes.SafeName
      description: The name of the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.Description
      description: The description of the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.Location
      description: The location of the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.ManagingCPM
      description: The name of the Central Policy Manager (CPM) user who will manage the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.NumberOfDaysRetention
      description: The number of retained versions of every password that is stored in the safe.
      type: Number
    - contextPath: CyberArkPAS.Safes.NumberOfVersionsRetention
      description: The number of days for which password versions are saved in the safe.
      type: Number
    - contextPath: CyberArkPAS.Safes.OLACEnabled
      description: Whether or not to enable Object Level Access Control (OLAC) for the safe.
      type: Boolean
  - arguments:
    - description: The name of the safe that will be updated.
      name: safe_name
      required: true
    - description: The description of the updated safe.
      name: description
    - auto: PREDEFINED
      description: |-
        Whether or not to enable Object Level Access Control (OLAC) for the updated
        safe. Valid values are: 'true' or 'false'. Default is 'true'.
      defaultValue: 'true'
      name: OLAC_enabled
      predefined:
      - 'true'
      - 'false'
    - description: The name of the Central Policy Manager (CPM) user who will manage the updated safe.
      name: managing_cpm
    - description: The number of retained versions of every password that is stored in the updated safe.
      name: number_of_versions_retention
    - description: The number of days for which password versions are saved in the updated safe.
      name: number_of_days_retention
    - description: The new name of the safe.
      name: safe_new_name
    - description: The location of the updated safe.
      name: location
    description: Update a single safe in the vault.
    name: cyberark-pas-safe-update
    outputs:
    - contextPath: CyberArkPAS.Safes.SafeName
      description: The name of the updated safe.
      type: String
    - contextPath: CyberArkPAS.Safes.Description
      description: The description of the updated safe.
      type: String
    - contextPath: CyberArkPAS.Safes.Location
      description: The location of the updated safe.
      type: String
    - contextPath: CyberArkPAS.Safes.ManagingCPM
      description: The name of the Central Policy Manager (CPM) user who will manage the safe.
      type: String
    - contextPath: CyberArkPAS.Safes.NumberOfDaysRetention
      description: The number of retained versions of every password that is stored in the updated safe.
      type: Number
    - contextPath: CyberArkPAS.Safes.NumberOfVersionsRetention
      description: The number of days for which password versions are saved in the updated safe.
      type: Number
    - contextPath: CyberArkPAS.Safes.OLACEnabled
      description: Whether or not to enable Object Level Access Control (OLAC) for the updated safe.
      type: Boolean
  - arguments:
    - description: The name of the safe that will be deleted.
      name: safe_name
      required: true
    description: Delete a safe from the vault.
    name: cyberark-pas-safe-delete
    outputs:
    - contextPath: CyberArkPAS.Safes.Deleted
      description: Whether the safe was deleted.
      type: Boolean
  - arguments:
    - description: The name of the safe whose safe members will be listed.
      name: safe_name
      required: true
    description: Return a list of the members of the safe.
    name: cyberark-pas-safe-members-list
    outputs:
    - contextPath: CyberArkPAS.Safes.Members.MemberName
      description: The names of the safe members.
      type: String
    - contextPath: CyberArkPAS.Safes.Members.MembershipExpirationDate
      description: The expiration dates of the safe members.
      type: Number
    - contextPath: CyberArkPAS.Safes.Members.Permissions
      description: The permissions of the safe members.
      type: Unknown
    - contextPath: CyberArkPAS.Safes.Members.SearchIn
      description: The vault or domain where the users or groups was found.
      type: String
  - arguments:
    - description: The name of the user to add as a safe member.
      name: member_name
      required: true
    - description: Search for the member in the vault or domain.
      name: search_in
    - description: The membership expiration date in the format MM\DD\YY. Leave empty if there is no expiration date.
      name: membership_expiration_date
    - description: |-
        The user’s permissions in the safe.
        Valid values: UseAccounts, RetrieveAccounts, ListAccounts, AddAccounts, UpdateAccountContent, UpdateAccountProperties, InitiateCPMAccountManagementOperations, InitiateCPMAccountManagementOperations, SpecifyNextAccountContent, RenameAccounts, DeleteAccounts, UnlockAccounts, ManageSafe, ManageSafeMembers, BackupSafe, ViewAuditLog, ViewAuditLog, ViewSafeMembers, AccessWithoutConfirmation, CreateFolders, DeleteFolders, MoveAccountsAndFolders
        e.g., UseAccounts,RetrieveAccounts.
      isArray: true
      name: permissions
    - description: The URL encoded name of the safe to add a member to.
      name: safe_name
      required: true
    - auto: PREDEFINED
      defaultValue: '0'
      description: |-
        The request authorization levels.
        0 – cannot authorize
        1 – authorization level 1
        2 – authorization level 2
        Default is '0'.
      name: requests_authorization_level
      predefined:
      - '0'
      - '1'
      - '2'
    description: Add an existing user as a safe member.
    name: cyberark-pas-safe-member-add
    outputs:
    - contextPath: CyberArkPAS.Safes.Members.MemberName
      description: The name of the safe member.
      type: String
    - contextPath: CyberArkPAS.Safes.Members.MembershipExpirationDate
      description: The expiration date of the safe member.
      type: Number
    - contextPath: CyberArkPAS.Safes.Members.Permissions
      description: The permissions of the safe member.
      type: Unknown
    - contextPath: CyberArkPAS.Safes.Members.SearchIn
      description: The vault or domain where the user or group was found.
      type: String
  - arguments:
    - description: The member name that will be updated.
      name: member_name
      required: true
    - description: The membership expiration date in the format MM\DD\YY. Leave empty if there is no expiration date.
      name: membership_expiration_date
    - description: |-
        The user’s permissions in the safe.
        Valid values are:
        UseAccounts, RetrieveAccounts, ListAccounts, AddAccounts, UpdateAccountContent, UpdateAccountProperties, InitiateCPMAccountManagementOperations, InitiateCPMAccountManagementOperations, SpecifyNextAccountContent, RenameAccounts, DeleteAccounts, UnlockAccounts, ManageSafe, ManageSafeMembers, BackupSafe, ViewAuditLog, ViewAuditLog, ViewSafeMembers, RequestsAuthorizationLevel, AccessWithoutConfirmation, CreateFolders, DeleteFolders, MoveAccountsAndFolders
        e.g., UseAccounts,RetrieveAccounts.
      isArray: true
      name: permissions
    - description: The URL encoded name of the safe to which the safe member belongs.
      name: safe_name
      required: true
    - auto: PREDEFINED
      defaultValue: '0'
      description: |-
        Request authorization levels.
        0 – cannot authorize
        1 – authorization level 1
        2 – authorization level 2
        Default is: '0'.
      name: requests_authorization_level
      predefined:
      - '0'
      - '1'
      - '2'
    description: Update an existing safe member.
    name: cyberark-pas-safe-member-update
    outputs:
    - contextPath: CyberArkPAS.Safes.Members.MemberName
      description: The name of the safe member.
      type: String
    - contextPath: CyberArkPAS.Safes.Members.MembershipExpirationDate
      description: The expiration date of the safe member.
      type: Number
    - contextPath: CyberArkPAS.Safes.Members.Permissions
      description: The permissions of the safe member.
      type: Unknown
    - contextPath: CyberArkPAS.Safes.Members.SearchIn
      description: The vault or domain where the user or group was found.
      type: String
  - arguments:
    - description: The URL encoded name of the safe to delete a member from.
      name: safe_name
      required: true
    - description: The name of the safe member to delete from the safe’s list of members.
      name: member_name
      required: true
    description: Remove a specific member from a safe.
    name: cyberark-pas-safe-member-delete
    outputs:
    - contextPath: CyberArkPAS.Safes.Members.Deleted
      description: Whether the safe member was deleted.
      type: Boolean
  - arguments:
    - description: The name of the account.
      name: account_name
      required: true
    - description: The name or address of the machine where the account will be used.
      name: address
      required: true
    - description: The platform assigned to this account.
      name: platform_id
      required: true
    - description: The name of the safe where the account will be created.
      name: safe_name
      required: true
    - auto: PREDEFINED
      defaultValue: password
      description: |-
        The type of password. Valid values are: 'password', 'key'. Default is 'password'.
      name: secret_type
      predefined:
      - password
      - key
    - description: The The user name of the account.
      name: username
      required: true
    - description: The password that the user will use to log on for the first time.
      name: password
      required: true
      secret: true
    - description: |-
        Object containing key-value pairs to associate with the account, as defined by the account platform.
        e.g., {"Location": "IT", "OwnerName": "MSSPAdmin"}.
      name: properties
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether the account secret is automatically managed by the Central Policy Manager (CPM). Can be 'true' or 'false'. Default is 'true'.
      name: automatic_management_enabled
      predefined:
      - 'true'
      - 'false'
    - description: The reason for disabling automatic secret management.
      name: manual_management_reason
    - description: |-
        List of remote machines, separated by semicolons.
        e.g., server1.cyberark.com;server2.cyberark.com
      name: remote_machines
    - auto: PREDEFINED
      defaultValue: 'true'
      description: |-
        Whether or not to restrict access to specified remote machines only. Can be 'true' or 'false'. Default is: 'true'.
      name: access_restricted_to_remote_machines
      predefined:
      - 'true'
      - 'false'
    description: Add a new privileged account or SSH key to the vault.
    name: cyberark-pas-account-add
    outputs:
    - contextPath: CyberArkPAS.Accounts.id
      description: The unique ID of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.categoryModificationTime
      description: The last modified date of the account.
      type: Number
    - contextPath: CyberArkPAS.Accounts.createdTime
      description: The date the account was created.
      type: Number
    - contextPath: CyberArkPAS.Accounts.name
      description: The name of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.platformId
      description: The platform assigned to this account.
      type: String
    - contextPath: CyberArkPAS.Accounts.safeName
      description: The safe where the account is created.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretManagement
      description: Whether the account secret is automatically managed by the CPM.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretType
      description: The type of password.
      type: String
    - contextPath: CyberArkPAS.Accounts.userName
      description: The name of the account user.
      type: String
    - contextPath: CyberArkPAS.Accounts.address
      description: The name or address of the machine where the account will be used.
      type: String
  - arguments:
    - description: The unique ID of the account to delete.
      name: account_id
      required: true
    description: Delete a specific account in the vault.
    name: cyberark-pas-account-delete
    outputs:
    - contextPath: CyberArkPAS.Accounts.id
      description: The unique ID of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretManagement
      description: Whether the account secret is automatically managed by the CPM.
      type: String
    - contextPath: CyberArkPAS.Accounts.address
      description: The name or address of the machine where the account will be used.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretType
      description: The type of password.
      type: String
    - contextPath: CyberArkPAS.Accounts.safeName
      description: The safe where the account was created.
      type: String
    - contextPath: CyberArkPAS.Accounts.userName
      description: The user name of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.Deleted
      description: Whether the account was deleted.
      type: Boolean
  - arguments:
    - description: The unique ID of the account to update.
      name: account_id
      required: true
    - description: The name of the account to update.
      name: account_name
    - description: The name or address of the machine where the account will be used.
      name: address
    - description: The platform assigned to this account.
      name: platform_id
    - description: The user name of the account.
      name: username
    description: Update the details of an existing account.
    name: cyberark-pas-account-update
    outputs:
    - contextPath: CyberArkPAS.Accounts.id
      description: The unique ID of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.categoryModificationTime
      description: The last modified date of the account.
      type: Number
    - contextPath: CyberArkPAS.Accounts.createdTime
      description: The date the account was created.
      type: Number
    - contextPath: CyberArkPAS.Accounts.name
      description: The name of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.platformId
      description: The platform assigned to this account.
      type: String
    - contextPath: CyberArkPAS.Accounts.safeName
      description: The safe where the account was created.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretManagement
      description: Whether the account secret is automatically managed by the CPM.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretType
      description: The type of password.
      type: String
    - contextPath: CyberArkPAS.Accounts.userName
      description: The user name of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.address
      description: The name or address of the machine where the account will be used.
      type: String
  - arguments:
    - description: |-
        List of keywords to search for in the accounts.
        Separated with a space, e.g,. Windows admin.
      name: search
    - description: |-
        Property or properties by which to sort the returned accounts.
        The properties are followed by a comma and then 'asc' (default) or 'desc' to control the sort direction,
        e.g., Windows,asc.
      name: sort
    - defaultValue: '0'
      description: The offset of the first account that is returned in the collection of results. Default is '0'.
      name: offset
    - defaultValue: '50'
      description: Maximum number of accounts in the returned list. Default is '50'.
      name: limit
    - description: |-
        Search for accounts filtered by a specific safe,
        e.g., safeName eq 'mySafe'.
      name: filter
    description: Return a list of all the accounts in the vault.
    name: cyberark-pas-accounts-list
    outputs:
    - contextPath: CyberArkPAS.Accounts.id
      description: The unique IDs of the accounts.
      type: String
    - contextPath: CyberArkPAS.Accounts.categoryModificationTime
      description: Last modified dates of the accounts.
      type: Number
    - contextPath: CyberArkPAS.Accounts.createdTime
      description: Date the account was created.
      type: Number
    - contextPath: CyberArkPAS.Accounts.name
      description: The names of the accounts.
      type: String
    - contextPath: CyberArkPAS.Accounts.platformId
      description: The platforms assigned to these accounts.
      type: String
    - contextPath: CyberArkPAS.Accounts.safeName
      description: The safes where the accounts were created.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretManagement
      description: Whether the accounts secrets were automatically managed by the CPM.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretType
      description: The type of passwords.
      type: String
    - contextPath: CyberArkPAS.Accounts.userName
      description: The user names of the accounts.
      type: String
    - contextPath: CyberArkPAS.Accounts.address
      description: The names or addresses of the machine where the accounts are used.
      type: String
  - arguments:
    - description: The ID of the account for which to retrieve information.
      name: account_id
      required: true
    description: Returns information for the specified account, identified by the account ID.
    name: cyberark-pas-account-get-details
    outputs:
    - contextPath: CyberArkPAS.Accounts.id
      description: The unique ID of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.categoryModificationTime
      description: The date the account was last modified.
      type: Number
    - contextPath: CyberArkPAS.Accounts.createdTime
      description: The date the account was created.
      type: Number
    - contextPath: CyberArkPAS.Accounts.name
      description: The name of the account.
      type: String
    - contextPath: CyberArkPAS.Accounts.platformId
      description: The platform assigned to this account.
      type: String
    - contextPath: CyberArkPAS.Accounts.safeName
      description: The safe where the account is created.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretManagement
      description: Whether the account secret is automatically managed by the CPM.
      type: String
    - contextPath: CyberArkPAS.Accounts.secretType
      description: The type of password.
      type: String
    - contextPath: CyberArkPAS.Accounts.userName
      description: The name of the account user.
      type: String
    - contextPath: CyberArkPAS.Accounts.address
      description: The name or address of the machine where the account will be used.
      type: String
  - arguments:
    - description: The ID of the account whose activities will be retrieved.
      name: account_id
      required: true
    description: Returns the activities of a specific account that is identified by its account ID.
    name: cyberark-pas-account-get-list-activity
    outputs:
    - contextPath: CyberArkPAS.Activities.Action
      description: The activity that was performed.
      type: String
    - contextPath: CyberArkPAS.Activities.ActionID
      description: The code identification of the specific activity.
      type: Number
    - contextPath: CyberArkPAS.Activities.Alert
      description: Whether or not the activity caused an alert.
      type: Boolean
    - contextPath: CyberArkPAS.Activities.ClientID
      description: The name of the account.
      type: String
    - contextPath: CyberArkPAS.Activities.Date
      description: The date the account was created.
      type: Number
    - contextPath: CyberArkPAS.Activities.MoreInfo
      description: More information about the activity.
      type: String
    - contextPath: CyberArkPAS.Activities.Reason
      description: The reason given by the user for the activity.
      type: String
    - contextPath: CyberArkPAS.Activities.User
      description: The user who performed the activity.
      type: String
  - arguments:
    - description: The unique ID of the account.
      name: account_id
      required: true
    - description: The new account credentials that will be allocated to the account in the vault.
      name: new_credentials
      required: true
    description: Enable users to set account credentials and change them in the vault.
    name: cyberark-pas-credentials-change-in-vault-only
  - arguments:
    - description: The unique ID of the account.
      name: account_id
      required: true
    description: Mark an account for verification by the Central Policy Manager (CPM).
    name: cyberark-pas-credentials-verify
  - arguments:
    - description: The unique ID of the account.
      name: account_id
      required: true
    description: Mark an account for automatic reconciliation by the Central Policy Manager (CPM).
    name: cyberark-pas-credentials-reconcile
  - arguments:
    - description: The unique ID of the account.
      name: account_id
      required: true
    description: Mark an account for an immediate credentials change by the CPM to a new random value.
    name: cyberark-pas-credentials-change-random-password
  - arguments:
    - description: The unique ID of the account.
      name: account_id
      required: true
    - description: The new account credentials that will be allocated to the account in the vault.
      name: new_credentials
      required: true
    description: Enable users to set the account's credentials to use for the next Central Policy Manager (CPM) change.
    name: cyberark-pas-credentials-change-set-new-password
    compliantpolicies:
    - User Soft Remediation
  - arguments:
    - description: |-
        The starting date to get the security events from. Must be in the following timestamp format:
        (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year).
      name: start_time
      required: true
    - defaultValue: '50'
      description: The number of events that will be shown, from newest to oldest. Default is '50'.
      name: limit
    description: Return all Privileged Threat Analytics (PTA) security events.
    name: cyberark-pas-security-events-get
    outputs:
    - contextPath: CyberArkPAS.SecurityEvents.id
      description: The unique ID of the security events.
      type: Number
    - contextPath: CyberArkPAS.SecurityEvents.additionalData
      description: Additional data about the security events.
      type: String
    - contextPath: CyberArkPAS.SecurityEvents.audits.createTime
      description: The time the security events were created.
      type: Number
    - contextPath: CyberArkPAS.SecurityEvents.lastUpdateTime
      description: The last update time of the security events.
      type: Number
    - contextPath: CyberArkPAS.SecurityEvents.mStatus
      description: The status of the security events.
      type: String
    - contextPath: CyberArkPAS.SecurityEvents.score
      description: The score of the security events.
      type: Number
    - contextPath: CyberArkPAS.SecurityEvents.type
      description: The type of the security events.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 5.0.0