commonfields: id: Deep Instinct version: -1 name: Deep Instinct display: Deep Instinct category: Network Security sectionorder: - Connect - Collect provider: Deep Instinct description: The Deep Learning cybersecurity platform, for zero time prevention. configuration: - display: Base server URL name: base_url defaultvalue: "https://my-deep-instinct-path.deepinstinctweb.com" type: 0 required: true section: Connect - display: API Key name: apikey defaultvalue: "" type: 4 required: true section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 advanced: true section: Collect - display: First event ID to fetch from name: first_fetch_id defaultvalue: "0" type: 0 required: false section: Collect script: commands: - name: deepinstinct-get-device arguments: - name: device_id required: true description: The device ID. outputs: - contextPath: DeepInstinct.devices.ID description: Device ID. type: number - contextPath: DeepInstinct.devices.os description: Device OS. type: string - contextPath: DeepInstinct.devices.osv description: Device OS version. type: string - contextPath: DeepInstinct.devices.ip_address description: Device IP address. type: string - contextPath: DeepInstinct.devices.mac_address description: Device mac address. type: string - contextPath: DeepInstinct.devices.hostname description: Device hostname. type: string - contextPath: DeepInstinct.devices.domain description: Device domain. type: string - contextPath: DeepInstinct.devices.scanned_files description: Num of device scanned files. type: number - contextPath: DeepInstinct.devices.tag description: Device tag. type: string - contextPath: DeepInstinct.devices.connectivity_status description: Device connectivity status. type: string - contextPath: DeepInstinct.devices.deployment_status description: Device deployment status. type: string - contextPath: DeepInstinct.devices.last_registration description: Device last registration datetime. type: string - contextPath: DeepInstinct.devices.last_contact description: Device last contact datetime. type: string - contextPath: DeepInstinct.devices.distinguished_name description: Device distinguished name. type: string - contextPath: DeepInstinct.devices.group_name description: Device group name. type: string - contextPath: DeepInstinct.devices.group_id description: Device group ID. type: number - contextPath: DeepInstinct.devices.policy_name description: Device policy name. type: string - contextPath: DeepInstinct.devices.policy_id description: Device policy ID. type: number - contextPath: DeepInstinct.devices.log_status description: Device log status. type: string - contextPath: DeepInstinct.devices.agent_version description: Device agent version. type: string - contextPath: DeepInstinct.devices.brain_version description: Device brain version. type: string - contextPath: DeepInstinct.devices.msp_name description: Device msp name. type: string - contextPath: DeepInstinct.devices.msp_id description: Device msp ID. type: number - contextPath: DeepInstinct.devices.tenant_name description: Device tenant name. type: string - contextPath: DeepInstinct.devices.tenant_id description: Device tenant ID. type: number description: get specific device by ID. - name: deepinstinct-get-events arguments: - name: first_event_id description: First event id to get as max events in response can be 50. defaultValue: "0" outputs: - contextPath: DeepInstinct.Events.events.ID description: event ID. type: number - contextPath: DeepInstinct.Events.events.device_id description: event device ID. type: number - contextPath: DeepInstinct.Events.events.file_hash description: event file hash. type: string - contextPath: DeepInstinct.Events.events.file_type description: event file type. type: string - contextPath: DeepInstinct.Events.events.file_archive_hash description: event file archive hash. type: string - contextPath: DeepInstinct.Events.events.path description: event file path. - contextPath: DeepInstinct.Events.events.file_size description: event file size. type: number - contextPath: DeepInstinct.Events.events.threat_severity description: event threat severity. type: string - contextPath: DeepInstinct.Events.events.deep_classification description: Deep Instinct classification. type: string - contextPath: DeepInstinct.Events.events.file_status description: event file status. type: string - contextPath: sandbox_statusDeepInstinct.Events.events. description: event sandbox status. type: string - contextPath: DeepInstinct.Events.events.model description: event model. type: string - contextPath: DeepInstinct.Events.events.type description: event type. type: string - contextPath: DeepInstinct.Events.events.trigger description: event trigger. type: string - contextPath: DeepInstinct.Events.events.action description: event action. type: string - contextPath: DeepInstinct.Events.events.tenant_id description: event tenant id. type: number - contextPath: DeepInstinct.Events.events.msp_id description: event msp id. type: number - contextPath: DeepInstinct.Events.events.status description: event status. type: string - contextPath: DeepInstinct.Events.events.close_trigger description: event close trigger. type: string - contextPath: DeepInstinct.Events.events.reoccurrence_count description: event reoccurrence_count. type: number description: Get all events. Max events in response can be 50, use first_event_id parameter to define first event id to get. - name: deepinstinct-get-all-groups arguments: [] outputs: - contextPath: DeepInstinct.Groups.ID description: group id. type: number - contextPath: DeepInstinct.Groups.os description: group operation system. type: string - contextPath: DeepInstinct.Groups.name description: group name. type: string - contextPath: DeepInstinct.Groups.policy_id description: group policy ID. type: number - contextPath: DeepInstinct.Groups.is_default_group description: True if group is a default group, false otherwise. type: boolean - contextPath: DeepInstinct.Groups.msp_name description: msp name. type: string - contextPath: DeepInstinct.Groups.msp_id description: msp ID. type: number description: get all groups. - name: deepinstinct-get-all-policies arguments: [] outputs: - contextPath: DeepInstinct.Policies.ID description: policy ID. type: number - contextPath: DeepInstinct.Policies.name description: policy name. type: string - contextPath: DeepInstinct.Policies.os description: policy operating system. type: string - contextPath: DeepInstinct.Policies.is_default_policy description: True if policy is a default policy, False otherwise. type: boolean - contextPath: DeepInstinct.Policies.msp_id description: msp ID. type: number - contextPath: DeepInstinct.Policies.msp_name description: msp name. type: string description: get all policies. - name: deepinstinct-add-hash-to-blacklist arguments: - name: policy_id required: true description: policy ID. - name: file_hash required: true description: file hash. - name: comment description: Optional, add comment to hash field. defaultValue: '' description: add file hash to block list. - name: deepinstinct-add-hash-to-whitelist arguments: - name: policy_id required: true description: policy ID. - name: file_hash required: true description: file hash. - name: comment description: Optional, add comment to hash field. defaultValue: '' description: add file hash to allow list. - name: deepinstinct-remove-hash-from-blacklist arguments: - name: policy_id required: true description: policy ID. - name: file_hash required: true description: file hash. description: remove file hash from block list. - name: deepinstinct-remove-hash-from-whitelist arguments: - name: policy_id required: true description: policy ID. - name: file_hash required: true description: file hash. description: remove file hash from allow list. - name: deepinstinct-add-devices-to-group arguments: - name: group_id required: true description: group ID. - name: device_ids required: true description: comma separated devices ids. isArray: true description: add multiple devices to group. - name: deepinstinct-remove-devices-from-group arguments: - name: group_id required: true description: group ID to remove from. - name: device_ids required: true description: comma separeted list of device ids to remove. isArray: true description: remove list of devices from group. - name: deepinstinct-delete-files-remotely arguments: - name: event_ids required: true description: comma separeted list of event ids. isArray: true description: delete multiple files remotely. - name: deepinstinct-terminate-processes arguments: - name: event_ids required: true description: comma separeted list of event ids. isArray: true description: terminate list of processes. - name: deepinstinct-close-events arguments: - name: event_ids required: true description: comma separeted list of event ids. isArray: true description: close list of events. dockerimage: demisto/python3:3.12.8.3296088 isfetch: true script: '-' type: python subtype: python3 fromversion: 5.0.0 tests: - No tests (auto formatted)