category: Analytics & SIEM
provider: Exabeam
sectionorder:
- Connect
- Collect
commonfields:
  id: Exabeam
  version: -1
configuration:
- display: Server URL (e.g https://100.24.16.156:8484)
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  type: 9
  required: false
  section: Connect
- additionalinfo: Cluster Authentication Token
  display: Username
  displaypassword: API Token
  name: api_token
  type: 9
  hiddenusername: true
  required: false
  section: Connect
- defaultvalue: "generic,abnormalAuth,accountManipulation,accountTampering,ueba,bruteForce,compromisedCredentials, cryptomining,dataAccessAbuse,dataExfiltration,dlp,departedEmployee,dataDestruction,evasion,lateralMovement,alertTriage, malware,phishing,privilegeAbuse,physicalSecurity,privilegeEscalation,privilegedActivity,ransomware,workforceProtection"
  display: Exabeam Incident Type
  name: incident_type
  options:
  - generic
  - abnormalAuth
  - accountManipulation
  - accountTampering
  - ueba
  - bruteForce
  - compromisedCredentials
  - cryptomining
  - dataAccessAbuse
  - dataExfiltration
  - dlp
  - departedEmployee
  - dataDestruction
  - evasion
  - lateralMovement
  - alertTriage
  - malware
  - phishing
  - privilegeAbuse
  - physicalSecurity
  - privilegeEscalation
  - privilegedActivity
  - ransomware
  - workforceProtection
  type: 16
  required: false
  section: Collect
  advanced: true
- defaultvalue: low,medium,high,critical
  display: Priority
  name: priority
  options:
  - low
  - medium
  - high
  - critical
  type: 16
  required: false
  section: Collect
  advanced: true
- defaultvalue: closed,closedFalsePositive,inprogress,new,pending,resolved
  display: Status
  section: Connect
  name: status
  options:
  - closed
  - closedFalsePositive
  - inprogress
  - new
  - pending
  - resolved
  type: 16
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  advanced: true
- defaultvalue: '50'
  display: Max incidents per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: 'Advanced: Minutes to look back when fetching'
  name: look_back
  type: 0
  section: Connect
  required: false
  defaultvalue: 1
  additionalinfo: Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created.
- display: Incident type
  name: incidentType
  section: Connect
  type: 13
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Fetch Type
  defaultvalue: Exabeam Incident
  name: fetch_type
  type: 16
  options:
  - Exabeam Incident
  - Exabeam Notable User
  section: Collect
- display: Max Users Per Fetch
  name: max_fetch_users
  additionalinfo: Applies only when the Fetch Type is set to Exabeam Notable User.
  type: 0
  section: Collect
  defaultvalue: 50
- display: Notable Users Fetch Interval
  name: notable_users_fetch_interval
  additionalinfo: The interval, in whole hours, between consecutive fetch operations.
  defaultvalue: "60"
  type: 19
  section: Collect
  advanced: true
- defaultvalue: 3 months
  display: Notable Users First Fetch Timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: notable_users_first_fetch
  type: 0
  section: Collect
  advanced: true
- display: Minimum Risk Score To Fetch Users
  name: minimum_risk_score_to_fetch_users
  type: 0
  section: Collect
  advanced: true
  defaultvalue: 90
description: The Exabeam Security Management Platform provides end-to-end detection, User Event Behavioral Analytics, and SOAR.
display: Exabeam Advanced Analytics
name: Exabeam
script:
  commands:
  - arguments:
    - description: The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on.
      isArray: true
      name: time_period
      required: true
    - defaultValue: '10'
      description: The maximum number of returned results.
      name: limit
      required: true
    deprecated: true
    description: Returns notable users in a period of time.
    name: get-notable-users
    outputs:
    - contextPath: Exabeam.User.RiskScore
      description: The risk score of the notable user.
      type: Number
    - contextPath: Exabeam.User.UserFullName
      description: The full name of the user.
      type: String
    - contextPath: Exabeam.User.AverageRiskScore
      description: The average risk score of the user.
      type: Number
    - contextPath: Exabeam.User.FirstSeen
      description: The date the user was first seen.
      type: Date
    - contextPath: Exabeam.User.NotableSessionIds
      description: The ID of the notable session.
      type: String
    - contextPath: Exabeam.User.AccountsNumber
      description: The number of accounts.
      type: Number
    - contextPath: Exabeam.User.LastSeen
      description: The date the user was last seen.
      type: Date
    - contextPath: Exabeam.User.Location
      description: The location of the user.
      type: String
    - contextPath: Exabeam.User.UserName
      description: The name of the user.
      type: String
    - contextPath: Exabeam.User.Labels
      description: The labels of the user.
      type: String
    - contextPath: Exabeam.User.LastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.User.NotableUser
      description: Whether the user is a notable user.
      type: Boolean
  - arguments:
    - description: The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on.
      isArray: true
      name: time_period
      required: true
    - defaultValue: '10'
      description: The maximum number of returned results.
      name: limit
      required: true
    description: Returns notable users in a period of time.
    name: exabeam-get-notable-users
    outputs:
    - contextPath: Exabeam.User.RiskScore
      description: The risk score of the notable user.
      type: Number
    - contextPath: Exabeam.User.UserFullName
      description: The full name of the user.
      type: String
    - contextPath: Exabeam.User.AverageRiskScore
      description: The average risk score of the user.
      type: Number
    - contextPath: Exabeam.User.FirstSeen
      description: The date the user was first seen.
      type: Date
    - contextPath: Exabeam.User.NotableSessionIds
      description: The ID of the notable session.
      type: String
    - contextPath: Exabeam.User.AccountsNumber
      description: The number of accounts.
      type: Number
    - contextPath: Exabeam.User.LastSeen
      description: The date the user was last seen.
      type: Date
    - contextPath: Exabeam.User.Location
      description: The location of the user.
      type: String
    - contextPath: Exabeam.User.UserName
      description: The name of the user.
      type: String
    - contextPath: Exabeam.User.Labels
      description: The labels of the user.
      type: String
    - contextPath: Exabeam.User.LastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.User.NotableUser
      description: Whether the user is a notable user.
      type: Boolean
  - deprecated: true
    description: Returns all watchlist IDs and titles.
    name: get-watchlists
    outputs:
    - contextPath: Exabeam.Watchlist.Category
      description: The watchlist category.
      type: String
    - contextPath: Exabeam.Watchlist.Title
      description: The watchlist title.
      type: String
    - contextPath: Exabeam.Watchlist.WatchlistID
      description: The watchlist ID.
      type: String
  - description: Returns all watchlist IDs and titles.
    name: exabeam-get-watchlists
    outputs:
    - contextPath: Exabeam.Watchlist.Category
      description: The watchlist category.
      type: String
    - contextPath: Exabeam.Watchlist.Title
      description: The watchlist title.
      type: String
    - contextPath: Exabeam.Watchlist.WatchlistID
      description: The watchlist ID.
      type: String
  - deprecated: true
    description: Returns all peer groups.
    name: get-peer-groups
    outputs:
    - contextPath: Exabeam.PeerGroup.Name
      description: The name of the peer group.
      type: String
  - description: Returns all peer groups.
    name: exabeam-get-peer-groups
    outputs:
    - contextPath: Exabeam.PeerGroup.Name
      description: The name of the peer group.
      type: String
  - arguments:
    - description: The username of the user to fetch.
      name: username
      required: true
    deprecated: true
    description: Returns user information data for the username.
    name: get-user-info
    outputs:
    - contextPath: Exabeam.User.RiskScore
      description: The risk score of the user.
      type: Number
    - contextPath: Exabeam.User.AverageRiskScore
      description: The average risk score.
      type: Number
    - contextPath: Exabeam.User.PeerGroupFieldName
      description: The field name of the peer group.
      type: String
    - contextPath: Exabeam.User.FirstSeen
      description: The date when the user was first seen.
      type: Date
    - contextPath: Exabeam.User.PeerGroupDisplayName
      description: The display name of the Peer group.
      type: String
    - contextPath: Exabeam.User.LastSeen
      description: The date the user was last seen.
      type: Date
    - contextPath: Exabeam.User.PeerGroupFieldValue
      description: The field value of the peer group.
      type: String
    - contextPath: Exabeam.User.Label
      description: The labels of the user.
      type: String
    - contextPath: Exabeam.User.Username
      description: The name of the user.
      type: String
    - contextPath: Exabeam.User.PeerGroupType
      description: The type of the peer group.
      type: String
    - contextPath: Exabeam.User.LastSessionID
      description: The last session ID of the user.
      type: String
    - contextPath: Exabeam.User.LastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.User.AccountNames
      description: The account name of the user.
      type: String
  - arguments:
    - description: The username of the user to fetch.
      name: username
      required: true
    description: Returns user information data for the username.
    name: exabeam-get-user-info
    outputs:
    - contextPath: Exabeam.User.RiskScore
      description: The risk score of the user.
      type: Number
    - contextPath: Exabeam.User.AverageRiskScore
      description: The average risk score.
      type: Number
    - contextPath: Exabeam.User.PeerGroupFieldName
      description: The field name of the peer group.
      type: String
    - contextPath: Exabeam.User.FirstSeen
      description: The date when the user was first seen.
      type: Date
    - contextPath: Exabeam.User.PeerGroupDisplayName
      description: The display name of the Peer group.
      type: String
    - contextPath: Exabeam.User.LastSeen
      description: The date the user was last seen.
      type: Date
    - contextPath: Exabeam.User.PeerGroupFieldValue
      description: The field value of the peer group.
      type: String
    - contextPath: Exabeam.User.Label
      description: The labels of the user.
      type: String
    - contextPath: Exabeam.User.Username
      description: The name of the user.
      type: String
    - contextPath: Exabeam.User.PeerGroupType
      description: The type of the peer group.
      type: String
    - contextPath: Exabeam.User.LastSessionID
      description: The last session ID of the user.
      type: String
    - contextPath: Exabeam.User.LastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.User.AccountNames
      description: The account name of the user.
      type: String
  - deprecated: true
    description: Returns all labels of the user.
    name: get-user-labels
    outputs:
    - contextPath: Exabeam.UserLabel.Label
      description: The label of the user.
      type: String
  - description: Returns all labels of the user.
    name: exabeam-get-user-labels
    outputs:
    - contextPath: Exabeam.UserLabel.Label
      description: The label of the user.
      type: String
  - arguments:
    - description: The username for which to fetch data.
      name: username
      required: true
    - description: The Start time of the time range. For example, 2018-08-01T11:50:16).
      name: start_time
    - description: The end time of the time range. For example, 2018-08-01T11:50:16.
      name: end_time
    deprecated: true
    description: Returns sessions for the given username and time range.
    name: get-user-sessions
    outputs:
    - contextPath: Exabeam.User.Session.EndTime
      description: The end time of the session.
      type: Date
    - contextPath: Exabeam.User.Session.InitialRiskScore
      description: The initial risk score of the session.
      type: Number
    - contextPath: Exabeam.User.Session.Label
      description: The label of the session.
      type: String
    - contextPath: Exabeam.User.Session.LoginHost
      description: The login host.
      type: String
    - contextPath: Exabeam.User.Session.RiskScore
      description: The risk score of the session.
      type: Number
    - contextPath: Exabeam.User.Session.SessionID
      description: The ID of the session.
      type: String
    - contextPath: Exabeam.User.Session.StartTime
      description: The start time of the session.
      type: Date
    - contextPath: Exabeam.User.Username
      description: The username of the session.
      type: String
  - arguments:
    - description: The username for which to fetch data.
      name: username
      required: true
    - description: The start time of the time range. For example, 2018-08-01T11:50:16 or "30 days ago".
      name: start_time
    - description: The end time of the time range. For example, 2018-08-01T11:50:16 or "1 week ago".
      name: end_time
    description: Returns sessions for the given username and time range.
    name: exabeam-get-user-sessions
    outputs:
    - contextPath: Exabeam.User.Session.EndTime
      description: The end time of the session.
      type: Date
    - contextPath: Exabeam.User.Session.InitialRiskScore
      description: The initial risk score of the session.
      type: Number
    - contextPath: Exabeam.User.Session.Label
      description: The label of the session.
      type: String
    - contextPath: Exabeam.User.Session.LoginHost
      description: The login host.
      type: String
    - contextPath: Exabeam.User.Session.RiskScore
      description: The risk score of the session.
      type: Number
    - contextPath: Exabeam.User.Session.SessionID
      description: The ID of the session.
      type: String
    - contextPath: Exabeam.User.Session.StartTime
      description: The start time of the session.
      type: Date
    - contextPath: Exabeam.User.Username
      description: The username of the session.
      type: String
  - arguments:
    - description: The watchlist ID.
      name: watchlist_id
      required: true
    description: Deletes a watchlist.
    name: exabeam-delete-watchlist
  - arguments:
    - description: The name of the asset.
      name: asset_name
      required: true
    description: Returns asset data.
    name: exabeam-get-asset-data
    outputs:
    - contextPath: Exabeam.Asset.HostName
      description: The host name of the asset.
      type: String
    - contextPath: Exabeam.Asset.IPAddress
      description: The IP address of the asset.
      type: String
    - contextPath: Exabeam.Asset.AssetType
      description: Thr type of the asset.
      type: String
    - contextPath: Exabeam.Asset.FirstSeen
      description: The date the asset was first seen.
      type: Date
    - contextPath: Exabeam.Asset.LastSeen
      description: The date the asset was last seen.
      type: String
  - arguments:
    - description: ID of the session to fetch data for.
      name: session_id
      required: true
    description: Returns session info data for the given ID.
    name: exabeam-get-session-info-by-id
    outputs:
    - contextPath: Exabeam.SessionInfo.sessionId
      description: ID of the session.
      type: String
    - contextPath: Exabeam.SessionInfo.username
      description: Username of the session.
      type: String
    - contextPath: Exabeam.SessionInfo.startTime
      description: Start time of the session.
      type: Date
    - contextPath: Exabeam.SessionInfo.endTime
      description: End time of the session.
      type: Date
    - contextPath: Exabeam.SessionInfo.initialRiskScore
      description: Initial risk score of the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.riskScore
      description: Risk score of the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfReasons
      description: Number of rules in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.loginHost
      description: The host from which the user was logged in.
      type: String
    - contextPath: Exabeam.SessionInfo.label
      description: Label of the session.
      type: String
    - contextPath: Exabeam.SessionInfo.accounts
      description: Accounts in the session.
      type: String
    - contextPath: Exabeam.SessionInfo.numOfAccounts
      description: Number of accounts in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfZones
      description: Number of zones in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfAssets
      description: Number of assets in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfEvents
      description: Number of events in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfSecurityEvents
      description: Number of alerts in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.zones
      description: Zones information of the session.
      type: Unknown
  - arguments:
    - description: ID of the sequence.
      name: sequence_id
      required: true
    - description: Type of the sequence.
      name: sequence_type
      required: true
    description: List top domains of a sequence.
    name: exabeam-list-top-domains
    outputs:
    - contextPath: Exabeam.DataFeed.topDomains
      description: Top domains information.
      type: Unknown
    - contextPath: Exabeam.DataFeed.sequenceId
      description: ID of the sequence.
      type: String
    - contextPath: Exabeam.DataFeed.sequenceType
      description: Type of the sequence.
      type: String
  - arguments:
    - description: ID of the sequence to fetch data for.
      name: sequence_id
      required: true
    - description: Type of the sequence to fetch data for.
      name: sequence_type
      required: true
    description: Gets all the triggered rules of a sequence.
    name: exabeam-list-triggered-rules
    outputs:
    - contextPath: Exabeam.TriggeredRule._Id
      description: UUID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.ruleId
      description: ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.ruleType
      description: Type of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.eventId
      description: Event ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.sessionId
      description: Session ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.lockoutId
      description: Lockout ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.sequenceId
      description: Sequence ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.username
      description: Username of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.eType
      description: Event type of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.triggeringTime
      description: Time when the rule was triggered.
      type: Date
    - contextPath: Exabeam.TriggeredRule.riskScore
      description: Risk score of the rule.
      type: Number
    - contextPath: Exabeam.TriggeredRule.anchorScore
      description: Anchor score of the rule.
      type: Number
    - contextPath: Exabeam.TriggeredRule.anomalyFactor
      description: Anomaly factor of the rule.
      type: Number
    - contextPath: Exabeam.TriggeredRule.ruleData
      description: Data insight of the rule.
      type: Unknown
    - contextPath: Exabeam.TriggeredRule.createdTime
      description: Time when the rule was created.
      type: Date
    - contextPath: Exabeam.TriggeredRule.scoreData
      description: Score data of the rule.
      type: Unknown
    - contextPath: Exabeam.TriggeredRule.multiPeerGroupData
      description: Multi-peer group data of the triggered rule.
      type: Unknown
  - arguments:
    - description: ID of the asset to fetch info for.
      name: asset_id
      required: true
    - defaultValue: '50'
      description: The maximal number of users.
      name: max_users_number
    description: Returns asset information for given asset ID (hostname or IP address).
    name: exabeam-get-asset-info
    outputs:
    - contextPath: Exabeam.AssetInfo.assetId
      description: ID of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.hostName
      description: Host of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.ipAddress
      description: IP address of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.assetType
      description: Type of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.firstSeen
      description: Time when the asset was first seen.
      type: Date
    - contextPath: Exabeam.AssetInfo.lastSeen
      description: Time when the asset was last seen.
      type: Date
    - contextPath: Exabeam.AssetInfo.riskScore
      description: Risk score of the asset.
      type: Number
    - contextPath: Exabeam.AssetInfo.riskState
      description: Risk state of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.zone
      description: Zone of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.assetGroup
      description: Group of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.latestSequenceId
      description: ID of the latest seqence of the asset.
      type: String
  - arguments:
    - description: ID of the asset.
      name: asset_id
      required: true
    - description: The event time, e.g. "2 years ago" or "2019-02-27".
      name: event_time
      required: true
    - defaultValue: '50'
      description: Preffered number of events.
      name: number_of_events
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to return only anomaly events.
      name: anomaly_only
      predefined:
      - 'true'
      - 'false'
    - description: A comma-separated list of event types.
      name: event_types
    - auto: PREDEFINED
      defaultValue: exclude
      description: Whether or not to include the specified event types.
      name: event_types_operator
      predefined:
      - include
      - exclude
    - description: A comma-separated list of sequence types.
      name: sequence_types
      required: true
    - description: A comma-separated list of event categories.
      name: event_categories
    description: Gets next events for a given asset.
    name: exabeam-list-asset-timeline-next-events
    outputs:
    - contextPath: Exabeam.AssetEvent.event_id
      description: Event ID of the asset.
      type: String
    - contextPath: Exabeam.AssetEvent.event_type
      description: Type of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.event_category
      description: Category of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.time
      description: Time when the event occurred.
      type: Date
    - contextPath: Exabeam.AssetEvent.rawlog_time
      description: Raw log time of the event.
      type: Date
    - contextPath: Exabeam.AssetEvent.session_id
      description: Session ID of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.session_order
      description: Session order of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.src_host
      description: Source host of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.src_ip
      description: Source IP of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.src_zone
      description: Source zone of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.dest_host
      description: Destination host of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.dest_ip
      description: Destination IP of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.dest_zone
      description: Destination of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.user
      description: User of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.host
      description: Host of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.domain
      description: Domain of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.account
      description: Account of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.hash
      description: Hash of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.entity_asset_id
      description: Entity asset ID of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.source
      description: Source of the event.
      type: String
  - arguments:
    - description: ID of the asset to fetch info for.
      name: asset_id
      required: true
    - auto: PREDEFINED
      defaultValue: date
      description: The key to sort results by.
      name: sort_by
      predefined:
      - date
      - riskScore
    - auto: PREDEFINED
      defaultValue: desc
      description: The results order (ascending or descending).
      name: sort_order
      predefined:
      - asc
      - desc
    - defaultValue: '50'
      description: Maximal number of results.
      name: limit
    description: Gets security alerts for a given asset.
    name: exabeam-list-security-alerts-by-asset
    outputs:
    - contextPath: Exabeam.AssetSecurityAlert.process
      description: Process of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.process_name
      description: Process name of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.alert_name
      description: Name of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.alert_type
      description: Type of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.alert_severity
      description: Severity of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.malware_url
      description: Malware URL of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.event_id
      description: Event ID of the asset.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.event_type
      description: Type of the event.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.time
      description: Time when the event occurred.
      type: Date
    - contextPath: Exabeam.AssetSecurityAlert.rawlog_time
      description: Raw log time of the security alert.
      type: Date
    - contextPath: Exabeam.AssetSecurityAlert.session_id
      description: Session ID of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.session_order
      description: Session order of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.src_host
      description: Source host of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.src_ip
      description: Source IP of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.src_port
      description: Source port of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.dest_host
      description: Destination host of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.dest_ip
      description: Destination IP of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.dest_port
      description: Destination port of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.user
      description: User of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.host
      description: Host of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.domain
      description: Domain of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.account
      description: Account of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.hash
      description: Hash of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.MD5
      description: MD5 of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.entity_asset_id
      description: Entity asset ID of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.source
      description: Source of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.vendor
      description: Vendor of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.sensor_id
      description: Sensor ID of the alert.
      type: Boolean
    - contextPath: Exabeam.AssetSecurityAlert.local_asset
      description: Local asset of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.additional_info
      description: Additional information about the security alert.
      type: String
  - arguments:
    - description: The search keyword.
      name: keyword
      required: true
    - description: The search filter.
      name: filter
    - defaultValue: '50'
      description: Maximal number of rules to retrieve.
      name: limit
    - defaultValue: '0'
      description: Results page number.
      name: page
    description: Searches for rules by a keyword.
    name: exabeam-search-rules
    outputs:
    - contextPath: Exabeam.Rule.categoryId
      description: Category ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.categoryDisplayName
      description: Category display name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleId
      description: ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleName
      description: Name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleDescription
      description: Description of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.reasonTemplate
      description: Reason template of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.aggregateReasonTemplate
      description: Aggregate reason template of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleType
      description: Type of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.classifyIf
      description: Classification definition of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleEventTypes
      description: Event types of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.disabled
      description: Whether or not the rule is disabled.
      type: Boolean
    - contextPath: Exabeam.Rule.ruleDef.modelName
      description: Model name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.factFeatureName
      description: Fact feature name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.hasDynamicScore
      description: Whether or not the rule has a dynamic score.
      type: Boolean
    - contextPath: Exabeam.Rule.ruleDef.score
      description: Score of the rule.
      type: Number
    - contextPath: Exabeam.Rule.ruleDef.percentileThreshold
      description: Percentile threshold of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleExpression
      description: The rule expression.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.dependencyExpression
      description: The rule dependency expression.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleCategory
      description: The category of the rule.
      type: String
    - contextPath: Exabeam.Rule.disabled
      description: Whether or not the rule is disabled.
      type: Boolean
    - contextPath: Exabeam.Rule.effective
      description: True if the rule is effective, false otherwise.
      type: Boolean
    - contextPath: Exabeam.Rule.state
      description: State of the rule (DefaultExabeam, ModifiedExabeam or CustomerCreated).
      type: String
    - contextPath: Exabeam.Rule.canSimpleEdit
      description: Whether or not it is possible to use the simple editor on this rule.
      type: Boolean
  - arguments:
    - description: The ID of the rule.
      name: rule_id
      required: true
    description: Gets a rule's information as a string.
    name: exabeam-get-rule-string
    outputs:
    - contextPath: Exabeam.Rule.ruleId
      description: The ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleString
      description: The rule string.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: all
      description: The type of the rules to retrieve.
      name: filter_by
      predefined:
      - all
      - custom
      - default
    - defaultValue: '0'
      description: Which page of results to return.
      name: page
    - defaultValue: '50'
      description: Maximal number of results.
      name: limit
    description: Gets all rules.
    name: exabeam-fetch-rules
    outputs:
    - contextPath: Exabeam.Rule.categoryId
      description: Category ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.categoryDisplayName
      description: Category display name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleId
      description: ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleName
      description: Name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleDescription
      description: Description of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.reasonTemplate
      description: Reason template of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.aggregateReasonTemplate
      description: Aggregate reason template of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleType
      description: Type of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.classifyIf
      description: Classification expression definition of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleEventTypes
      description: Event types of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.disabled
      description: Whether or not the rule is disabled.
      type: Boolean
    - contextPath: Exabeam.Rule.ruleDef.modelName
      description: Model name that the rule references.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.factFeatureName
      description: The name of a feature used for fact based rules.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.hasDynamicScore
      description: Whether or not the rule has a dynamic score.
      type: Boolean
    - contextPath: Exabeam.Rule.ruleDef.score
      description: Score of the rule.
      type: Number
    - contextPath: Exabeam.Rule.ruleDef.percentileThreshold
      description: Indicates which observations are considered anomalous based on the histogram.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleExpression
      description: A boolean expression that the rule engine uses to determine if a particular rule will trigger.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.dependencyExpression
      description: The rule dependency expression.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleCategory
      description: The category of the rule.
      type: String
    - contextPath: Exabeam.Rule.disabled
      description: Whether or not the rule is disabled.
      type: Boolean
    - contextPath: Exabeam.Rule.effective
      description: True if the rule is effective, false otherwise.
      type: Boolean
    - contextPath: Exabeam.Rule.state
      description: State of the rule (DefaultExabeam, ModifiedExabeam or CustomerCreated).
      type: String
    - contextPath: Exabeam.Rule.canSimpleEdit
      description: Whether or not it is possible to use the simple editor on this rule.
      type: Boolean
  - arguments:
    - description: The name of the model.
      name: model_name
      required: true
    description: Gets a rule model definition by name.
    name: exabeam-get-rules-model-definition
    outputs:
    - contextPath: Exabeam.Model.alpha
      description: Alpha value of the model.
      type: String
    - contextPath: Exabeam.Model.name
      description: Name of the model.
      type: String
    - contextPath: Exabeam.Model.feature
      description: Feature of the model.
      type: String
    - contextPath: Exabeam.Model.cutOff
      description: Cut off value of the model.
      type: String
    - contextPath: Exabeam.Model.histogramEventTypes
      description: Histogram event types of the model.
      type: String
    - contextPath: Exabeam.Model.featureName
      description: Feature name of the model.
      type: String
    - contextPath: Exabeam.Model.description
      description: Description of the model.
      type: String
    - contextPath: Exabeam.Model.trainIf
      description: Train if expression definition of the model.
      type: String
    - contextPath: Exabeam.Model.featureType
      description: Feature type of the model.
      type: String
    - contextPath: Exabeam.Model.modelTemplate
      description: The model template.
      type: String
    - contextPath: Exabeam.Model.convergenceFilter
      description: Convergence filter of the model.
      type: String
    - contextPath: Exabeam.Model.iconName
      description: Icon name of the model.
      type: String
    - contextPath: Exabeam.Model.modelType
      description: Type of the model.
      type: String
    - contextPath: Exabeam.Model.binWidth
      description: The bin width.
      type: String
    - contextPath: Exabeam.Model.maxNumberOfBins
      description: The maximal number of bins.
      type: String
    - contextPath: Exabeam.Model.scopeType
      description: The scope type of the model.
      type: String
    - contextPath: Exabeam.Model.agingWindow
      description: Aging window of the model.
      type: String
    - contextPath: Exabeam.Model.category
      description: The model category.
      type: String
    - contextPath: Exabeam.Model.disabled
      description: TRUE if the model is disabled, FALSE otherwise.
      type: String
    - contextPath: Exabeam.Model.scopeValue
      description: The scope value of the model.
      type: String
  - arguments:
    - description: The watchlist ID.
      name: watchlist_id
      required: true
    - description: A comma-separated list of the items to add.
      name: items
    - description: The entry ID of the CSV file.
      name: csv_entry_id
    - defaultValue: '50'
      description: Number of days until asset is automatically removed from the watchlist.
      name: watch_until_days
    - auto: PREDEFINED
      description: The item category.
      name: category
      predefined:
      - Anomalies
      - Assets
      - Events
      - Sessions
      - Users
      required: true
    description: Add watchlist items by their names or from a CSV file.
    name: exabeam-watchlist-add-items
  - arguments:
    - description: A keyword to search.
      name: keyword
      required: true
    - description: The watchlist ID.
      name: watchlist_id
      required: true
    - defaultValue: '30'
      description: Maximum nmber of results to retrieve.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether or not the item is exclusive on watchlist.
      name: is_exclusive
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether or not to search the item by its IP.
      name: search_by_ip
      predefined:
      - 'true'
      - 'false'
    description: Gets the assets of a specified watchlist according to a keyword.
    name: exabeam-watchlist-asset-search
    outputs:
    - contextPath: Exabeam.AssetInfo.hostName
      description: Host of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.ipAddress
      description: IP address of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.assetType
      description: Type of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.firstSeen
      description: Time when the asset was first seen.
      type: Date
    - contextPath: Exabeam.AssetInfo.lastSeen
      description: Time when the asset was last seen.
      type: Date
    - contextPath: Exabeam.AssetInfo.riskScore
      description: Risk score of the asset.
      type: Number
    - contextPath: Exabeam.AssetInfo.riskState
      description: Risk state of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.zone
      description: Zone of the asset.
      type: String
  - arguments:
    - description: The watchlist ID.
      name: watchlist_id
      required: true
    - description: A comma-separated list of the items to remove.
      isArray: true
      name: items
      required: true
    - auto: PREDEFINED
      description: The category of the items to remove.
      name: category
      predefined:
      - Anomalies
      - Assets
      - Events
      - Sessions
      - Users
      required: true
    description: Removes items from a watchlist.
    name: exabeam-watchlist-remove-items
  - arguments:
    - description: The name of the context table.
      name: context_table_name
      required: true
    - defaultValue: '50'
      description: Maximum number of results to return.
      name: limit
    - defaultValue: '1'
      description: The offset number to begin (starts from 1).
      name: offset
    description: Returns a list of a context table records.
    name: exabeam-list-context-table-records
    outputs:
    - contextPath: Exabeam.ContextTable.Name
      description: Name of the context table.
      type: String
    - contextPath: Exabeam.ContextTable.Record.key
      description: The key of the record.
      type: String
    - contextPath: Exabeam.ContextTable.Record.id
      description: The ID of the record.
      type: String
    - contextPath: Exabeam.ContextTable.Record.sourceType
      description: The source type of the record.
      type: String
    - contextPath: Exabeam.ContextTable.Record.position
      description: The position of the record.
      type: Number
    - contextPath: Exabeam.ContextTable.Record.value
      description: Value of the record.
      type: String
  - arguments:
    - description: The name of the context table.
      name: context_table_name
      required: true
    - description: 'A comma-separated list of records to add, for example: k1,k2. If context_table_type argument is set to key_value, every record should be in "key:values" format, where "values" is a semi-colon separated list of values. For example: k1:v1;v2,k2:v3,k3:,k4:v4.'
      name: records
      required: true
    - description: The ID of update session. If not specified, a new session is created.
      name: session_id
    - auto: PREDEFINED
      description: The context table type.
      name: context_table_type
      predefined:
      - key_only
      - key_value
      required: true
    description: Add records to the context table.
    name: exabeam-add-context-table-records
    outputs:
    - contextPath: Exabeam.ContextTableUpdate.contextTableName
      description: The context table name.
      type: String
    - contextPath: Exabeam.ContextTableUpdate.sessionId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeType
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.key
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.value
      description: The raw data of the context table update.
      type: Unknown
  - arguments:
    - description: The name of the context table.
      name: context_table_name
      required: true
    - description: The ID of update session. If not specified, a new session is created.
      name: session_id
    - description: 'A comma-separated list of records to update. If context_table_type argument is set to key_only, each record should be in the following format: id:key. Otherwise it''s a key_value type and then the format of a record is id:key:values, where the values are separated by semi-colons.'
      name: records
      required: true
    - auto: PREDEFINED
      description: Type of the context table.
      name: context_table_type
      predefined:
      - key_only
      - key_value
      required: true
    description: Updates records of a context table.
    name: exabeam-update-context-table-records
    outputs:
    - contextPath: Exabeam.ContextTableUpdate.contextTableName
      description: The context table name.
      type: String
    - contextPath: Exabeam.ContextTableUpdate.sessionId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeType
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.key
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.value
      description: The raw data of the context table update.
      type: Unknown
  - arguments:
    - description: Name of the context table.
      name: context_table_name
      required: true
    description: Export a context table to CSV.
    name: exabeam-get-context-table-in-csv
  - arguments:
    - description: Name of the context table.
      name: context_table_name
      required: true
    - description: The ID of the context table session. If not specified, a new session is created.
      name: session_id
    - auto: PREDEFINED
      description: Indicates whether the file has a header.
      name: has_header
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The entry ID of the CSV file from which records will be added.
      name: file_entry_id
      required: true
    - auto: PREDEFINED
      defaultValue: append
      description: Whether to replace or append the records from the CSV file.
      name: append_or_replace
      predefined:
      - append
      - replace
    description: Add context table records from CSV file in a specific modification session.
    name: exabeam-add-context-table-records-from-csv
  - arguments:
    - description: Name of the context table.
      name: context_table_name
      required: true
    - description: A comma-separated list of the records' keys to delete.
      name: records
      required: true
    - description: The ID of update session. If not specified, a new session is created.
      name: session_id
    description: Delete records from a context table.
    name: exabeam-delete-context-table-records
    outputs:
    - contextPath: Exabeam.ContextTableUpdate.contextTableName
      description: The context table name.
      type: String
    - contextPath: Exabeam.ContextTableUpdate.sessionId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeType
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.key
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.value
      description: The raw data of the context table update.
      type: Unknown
  - arguments:
    - description: The maximum number of returned results.
      name: limit
      required: true
    - description: The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on.
      isArray: true
      name: time_period
      required: true
    description: Returns notable assets.
    name: exabeam-get-notable-assets
    outputs:
    - contextPath: Exabeam.NotableAsset.HostName
      description: The notable asset host name.
      type: String
    - contextPath: Exabeam.NotableAsset.IPAddress
      description: The notable asset IP address.
      type: String
    - contextPath: Exabeam.NotableAsset.AssetType
      description: The notable asset type.
      type: String
    - contextPath: Exabeam.NotableAsset.FirstSeen
      description: Time when the asset was first seen.
      type: Date
    - contextPath: Exabeam.NotableAsset.LastSeen
      description: Time when the asset was last seen.
      type: Date
    - contextPath: Exabeam.NotableAsset.highestRiskScore
      description: The highest risk score of the asset.
      type: Number
    - contextPath: Exabeam.NotableAsset.id
      description: The notable asset ID.
      type: String
    - contextPath: Exabeam.NotableAsset.entityName
      description: The entity name of the asset.
      type: String
    - contextPath: Exabeam.NotableAsset.entityValue
      description: The entity value of the asset.
      type: String
    - contextPath: Exabeam.NotableAsset.day
      description: The notable asset date.
      type: Date
    - contextPath: Exabeam.NotableAsset.triggeredRuleCountOpt
      description: The number that asset triggered rule count opt.
      type: Number
    - contextPath: Exabeam.NotableAsset.riskScoreOpt
      description: Risk score opt of the asset.
      type: Number
    - contextPath: Exabeam.NotableAsset.incidentIds
      description: The incident IDs of the notable asset.
      type: Unknown
    - contextPath: Exabeam.NotableAsset.commentId
      description: The comment ID of the notable asset.
      type: String
    - contextPath: Exabeam.NotableAsset.commentType
      description: The comment type of the notable asset.
      type: String
    - contextPath: Exabeam.NotableAsset.commentObjectId
      description: The comment object ID of the notable asset.
      type: String
    - contextPath: Exabeam.NotableAsset.text
      description: The notable asset text.
      type: String
    - contextPath: Exabeam.NotableAsset.exaUser
      description: The notable asset exaUser.
      type: String
    - contextPath: Exabeam.NotableAsset.exaUserFullname
      description: The notable asset exaUser fullname.
      type: String
    - contextPath: Exabeam.NotableAsset.createTime
      description: Time when the asset was created.
      type: Date
    - contextPath: Exabeam.NotableAsset.updateTime
      description: Time when the asset was updated.
      type: Date
    - contextPath: Exabeam.NotableAsset.edited
      description: Whether or not the notable asset is edited.
      type: Boolean
    - contextPath: Exabeam.NotableAsset.zone
      description: The number that asset triggered rule count opt.
      type: String
  - arguments:
    - description: ID of the asset to fetch info for.
      name: asset_id
      required: true
    - auto: PREDEFINED
      defaultValue: date
      description: The key to sort results by.
      name: sort_by
      predefined:
      - date
      - riskScore
    - auto: PREDEFINED
      defaultValue: desc
      description: The order of the results (ascending or descending).
      name: sort_order
      predefined:
      - asc
      - desc
    - defaultValue: '50'
      description: Maximum number of results.
      name: limit
    description: Returns notable session details.
    name: exabeam-get-notable-session-details
    outputs:
    - contextPath: Exabeam.NotableSession.users.UserName
      description: The notable session user name.
      type: String
    - contextPath: Exabeam.NotableSession.users.RiskScore
      description: The notable session risk score.
      type: number
    - contextPath: Exabeam.NotableSession.users.AverageRiskScore
      description: The average risk score of the notable session.
      type: number
    - contextPath: Exabeam.NotableSession.users.FirstSeen
      description: Time when the notable session was first seen.
      type: Date
    - contextPath: Exabeam.NotableSession.users.LastSeen
      description: Time when the notable session was last seen.
      type: Date
    - contextPath: Exabeam.NotableSession.users.lastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Labels
      description: The labels of the user.
      type: Unknown
    - contextPath: Exabeam.NotableSession.users.LastSessionID
      description: The last session ID of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.EmployeeType
      description: The employee type of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Department
      description: The department of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Title
      description: The role of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Location
      description: The location of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Email
      description: The email of the user.
      type: String
    - contextPath: Exabeam.NotableSession.sessions.SessionID
      description: The Session ID.
      type: String
    - contextPath: Exabeam.NotableSession.sessions.InitialRiskScore
      description: Initial risk score of the session.
      type: Number
    - contextPath: Exabeam.NotableSession.sessions.LoginHost
      description: The host from which the user was logged in.
      type: String
    - contextPath: Exabeam.NotableSession.sessions.Accounts
      description: Accounts in the session.
      type: String
    - contextPath: Exabeam.NotableSession.executiveUserFlags
      description: Whether the user is a executive user.
      type: Unknown
  - arguments:
    - description: The asset ID for which to fetch data.
      name: asset_id
      required: true
    - description: The Start time of the time range. For example, 2018-08-01T11:50:16.
      name: start_time
    - description: The end time of the time range. For example, 2018-08-01T11:50:16.
      name: end_time
    - defaultValue: '50'
      description: Maximum number of rules to retrieve.
      name: limit
    - defaultValue: '0'
      description: Results page number.
      name: page
    description: Returns sequence details for the given asset ID and time range.
    name: exabeam-get-notable-sequence-details
    outputs:
    - contextPath: Exabeam.Sequence.sequenceId
      description: The ID of the sequence.
      type: String
    - contextPath: Exabeam.Sequence.isWhitelisted
      description: Whether or not the sequence is on allow list.
      type: Boolean
    - contextPath: Exabeam.Sequence.areAllTriggeredRulesWhiteListed
      description: Whether or not the sequence are all triggered rules allow listed.
      type: Boolean
    - contextPath: Exabeam.Sequence.hasBeenPartiallyWhiteListed
      description: Whether or not the sequence has been partially allow listed.
      type: Boolean
    - contextPath: Exabeam.Sequence.riskScore
      description: The sequence risk score.
      type: Number
    - contextPath: Exabeam.Sequence.startTime
      description: Start time of the sequence.
      type: Date
    - contextPath: Exabeam.Sequence.endTime
      description: End time of the sequence.
      type: Date
    - contextPath: Exabeam.Sequence.numOfReasons
      description: Number of reasons in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfEvents
      description: Number of events in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfUsers
      description: Number of users in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfSecurityEvents
      description: Number of security events in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfZones
      description: Number of zones in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfAssets
      description: Number of assets in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.assetId
      description: The asset ID of the sequence.
      type: String
  - arguments:
    - description: The asset sequence ID.
      name: asset_sequence_id
      required: true
    - description: String to search for inside display name.
      name: search_str
    - defaultValue: '50'
      description: Maximum number of rules to retrieve.
      name: limit
    - defaultValue: '0'
      description: Results page number.
      name: page
    description: Returns sequence event types for the given asset sequence ID and time range.
    name: exabeam-get-sequence-eventtypes
    outputs:
    - contextPath: Exabeam.SequenceEventTypes.eventType
      description: The sequence event type.
      type: String
    - contextPath: Exabeam.SequenceEventTypes.displayName
      description: The sequence display name.
      type: String
    - contextPath: Exabeam.SequenceEventTypes.count
      description: The number of the sequences.
      type: Number
    - contextPath: Exabeam.SequenceEventTypes.sequenceId
      description: The sequence ID.
      type: String
  - arguments:
    - description: The incident ID.
      isArray: true
      name: incident_id
    - description: |
        The query string that will be used to filter incidents in Exabeam
        For example:
        - simple query: incidentType:generic,
        - OR query: "status:new OR status:closedFalsePositive",
        - AND query:  "status:new AND priority:high".
      name: query
    - auto: PREDEFINED
      description: Incident type to filter in Exabeam.
      predefined:
      - "generic"
      - "abnormalAuth"
      - "accountManipulation"
      - "accountTampering"
      - "ueba"
      - "bruteForce"
      - "compromisedCredentials"
      - "cryptomining"
      - "dataAccessAbuse"
      - "dataExfiltration"
      - "dlp"
      - "departedEmployee"
      - "dataDestruction"
      - "evasion"
      - "lateralMovement"
      - "alertTriage"
      - "malware"
      - "phishing"
      - "privilegeAbuse"
      - "physicalSecurity"
      - "privilegeEscalation"
      - "privilegedActivity"
      - "ransomware"
      - "workforceProtection"
      name: incident_type
    - auto: PREDEFINED
      description: Incident priority to filter in Exabeam.
      predefined:
      - "low"
      - "medium"
      - "high"
      - "critical"
      name: priority
    - auto: PREDEFINED
      description: Incident status to filter in Exabeam.
      predefined:
      - "closed"
      - "closedFalsePositive"
      - "inprogress"
      - "new"
      - "pending"
      - "resolved"
      name: status
    - description: Number of total results to query. Default is 50.
      name: limit
    - description: Specific page to query.
      name: page_number
    - description: Number of total results in each page. Default is 25.
      name: page_size
    - description: When the instance is configure by an API key, it must be used with the username argument.
      name: username
    description: Returns incidents from Exabeam.
    name: exabeam-list-incident
    outputs:
    - contextPath: Exabeam.incidents.incidentId
      description: The incident ID.
      type: String
    - contextPath: Exabeam.incidents.name
      description: The incident name.
      type: String
    - contextPath: Exabeam.incidents.fields.startedDate
      description: The starting date of the incident.
      type: String
    - contextPath: Exabeam.incidents.fields.closedDate
      description: The closing date of the incident.
      type: String
    - contextPath: Exabeam.incidents.fields.createdAt
      description: The creation date of the incident.
      type: String
    - contextPath: Exabeam.incidents.fields.owner
      description: The incident owner.
      type: String
    - contextPath: Exabeam.incidents.fields.status
      description: The incident status.
      type: String
    - contextPath: Exabeam.incidents.fields.incidentType
      description: The incident type.
      type: String
    - contextPath: Exabeam.incidents.fields.source
      description: The incident source.
      type: String
    - contextPath: Exabeam.incidents.fields.priority
      description: The incident priority.
      type: String
    - contextPath: Exabeam.incidents.fields.queue
      description: The queue of the incident.
      type: String
    - contextPath: Exabeam.incidents.fields.description
      description: The incident description.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Exabeam - Test
fromversion: 5.0.0
defaultclassifier: "Exabeam Classifier"
defaultmapperin: "Exabeam mapping"