category: Network Security
sectionorder:
- Connect
- Collect
provider: Skyview Capital
commonfields:
  id: Fidelis Elevate Network
  version: -1
configuration:
- display: Server URL
  name: server_url
  required: true
  type: 0
  section: Connect
- display: Credentials
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: fetch_time
  type: 0
  required: false
  section: Collect
description: Automate Detection and Response to Network Threats and data leakage in your organization with Fidelis Elevate Network Integration.
display: Fidelis Elevate Network
name: Fidelis Elevate Network
script:
  commands:
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    description: Gets alert details from Fidelis Elevate.
    name: fidelis-get-alert
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: Fidelis.Alert.ThreatScore
      description: Alert threat score.
      type: number
    - contextPath: Fidelis.Alert.Time
      description: Alert time.
      type: date
    - contextPath: Fidelis.Alert.RuleID
      description: Related rule ID.
      type: string
    - contextPath: Fidelis.Alert.RuleName
      description: Related rule name.
      type: string
    - contextPath: Fidelis.Alert.Summary
      description: Alert summary.
      type: string
    - contextPath: Fidelis.Alert.PolicyName
      description: Related policy name.
      type: string
    - contextPath: Fidelis.Alert.Severity
      description: Alert severity.
      type: string
    - contextPath: Fidelis.Alert.Protocol
      description: Protocol involved in the alert.
      type: string
    - contextPath: Fidelis.Alert.Type
      description: Alert type.
      type: string
    - contextPath: Fidelis.Alert.AssignedUser
      description: Assigned user ID.
      type: string
  - arguments:
    - description: ID of the alert to delete.
      isArray: true
      name: alert_id
      required: true
    description: Deletes an alert from Fidelis Elevate.
    name: fidelis-delete-alert
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    description: Retrieves malware data related to a "Malware" type alert.
    name: fidelis-get-malware-data
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: Fidelis.Alert.Malware.Name
      description: Malware name.
      type: string
    - contextPath: Fidelis.Alert.Malware.Type
      description: Malware type.
      type: string
    - contextPath: Fidelis.Alert.Malware.Behavior
      description: Malware behavior.
      type: string
    - contextPath: Fidelis.Alert.Malware.Platform
      description: Malware platform.
      type: string
    - contextPath: Fidelis.Alert.Malware.DetailName
      description: Malware detail name from Fidelis Elevate.
      type: string
    - contextPath: Fidelis.Alert.Malware.Variant
      description: Malware variant.
      type: string
    - contextPath: Fidelis.Alert.Malware.Description
      description: Malware description from Fidelis Elevate.
      type: string
  - arguments:
    - description: ID of the alert for which to get the PCAP file.
      name: alert_id
      required: true
    deprecated: true
    description: Retrieves the alert PCAP from Fidelis Elevate.
    name: fidelis-get-alert-pcap
  - arguments:
    - description: Alert ID of the alert for which to download a PDF report.
      name: alert_id
      required: true
    description: Downloads a PDF report for a specified alert.
    name: fidelis-get-alert-report
  - arguments:
    - description: The file or URL to upload to Fidelis Elevate for analysis.
      name: upload_item
      required: true
    deprecated: true
    description: Uploads a file or a URL for sandbox analysis in Fidelis Elevate.
    name: fidelis-sandbox-upload
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: Alert ID generated from the upload.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: Filter alerts by time frame, for example, Last 48 Hours.
      name: time_frame
      predefined:
      - Today
      - Yesterday
      - Last 7 Days
      - Last Hour
      - Last 24 Hours
      - Last 48 Hours
      - Last 30 Days
      - Custom
    - description: If the time_frame value is Custom, specify the start time for the time range, for example, 2017-06-01T12:48:16.734.
      name: start_time
    - description: If the time_frame value is Custom, specify the end time for the time range, for example, 2017-06-01T12:48:16.734.
      name: end_time
    - auto: PREDEFINED
      description: Filter alerts by alert severity.
      name: severity
      predefined:
      - Low
      - Medium
      - High
      - Critical
    - auto: PREDEFINED
      description: Filter alerts by alert type.
      name: type
      predefined:
      - Endpoint
      - DSI
      - DPI
      - DNS
      - Malware
      - Mail
      - File Upload
      - Collector Feed
      - Analytics
    - description: Filter alerts by alert threat score threshold (higher than).
      name: threat_score
    - description: Filter alerts that are related to a specified IOC.
      name: ioc
    description: Returns a list of open alerts from Fidelis Elevate.
    name: fidelis-list-alerts
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: Fidelis.Alert.Time
      description: Alert time.
      type: date
    - contextPath: Fidelis.Alert.Summary
      description: Alert summary.
      type: string
    - contextPath: Fidelis.Alert.Severity
      description: Alert severity.
      type: string
    - contextPath: Fidelis.Alert.Type
      description: Alert type.
      type: string
  - arguments:
    - description: Component IP address.
      name: component_ip
      required: true
    - description: War Room entry ID of the PCAP file, for example, "3245@6".
      name: entry_id
      required: true
    description: Uploads a PCAP file to Fidelis Elevate for analysis.
    name: fidelis-upload-pcap
  - description: Gets PCAP components.
    name: fidelis-list-pcap-components
    outputs:
    - contextPath: Fidelis.Component.Name
      description: Component name.
      type: string
    - contextPath: Fidelis.Component.IP
      description: Component IP address.
      type: string
  - arguments:
    - description: Component IP address. Run the 'fidelis-list-pcap-components' command to get this value.
      name: component_ip
      required: true
    - description: CSV list of PCAP file names in Fidelis Elevate.
      name: files
      required: true
    description: Runs PCAP file analysis in Fidelis Elevate.
    name: fidelis-run-pcap
  - arguments:
    - description: The UUID of the alert.
      name: alert_uuid
      required: true
    description: Returns an alert, by UUID.
    name: fidelis-get-alert-by-uuid
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: Alert ID.
      type: Number
    - contextPath: Fidelis.Alert.Severity
      description: Alert severity.
      type: String
    - contextPath: Fidelis.Alert.Summary
      description: Alert summary.
      type: String
    - contextPath: Fidelis.Alert.Time
      description: Alert time.
      type: Date
    - contextPath: Fidelis.Alert.Type
      description: Alert type.
      type: String
    - contextPath: Fidelis.Alert.UUID
      description: Alert UUID.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: Filter alerts by time frame, for example, Last 48 Hours.
      name: time_frame
      predefined:
      - Today
      - Yesterday
      - Last 7 Days
      - Last Hour
      - Last 24 Hours
      - Last 48 Hours
      - Last 30 Days
      - Custom
    - auto: PREDEFINED
      description: If the time_frame value is Custom, specify the start time for the time range, for example, 2017-06-01T12:48:16.734.
      name: start_time
      predefined:
      - ''
    - description: If the time_frame value is Custom, specify the end time for the time range, for example,2017-06-01T12:48:16.734.
      name: end_time
    - description: Filter alerts by client IP.
      name: client_ip
    - description: Filter alerts by server IP address.
      name: server_ip
    - auto: PREDEFINED
      description: Direction of the request. Can be "s2c" (server to client) or "c2s" (client to server).
      name: request_direction
      predefined:
      - s2c
      - c2s
    description: Returns a metadata list.
    name: fidelis-list-metadata
    outputs:
    - contextPath: Fidelis.Metadata.MalwareName
      description: Malware name.
      type: String
    - contextPath: Fidelis.Metadata.ServerPort
      description: Server port number.
      type: Number
    - contextPath: Fidelis.Metadata.SHA256
      description: SHA256 hash of the file.
      type: String
    - contextPath: Fidelis.Metadata.FileName
      description: File name.
      type: String
    - contextPath: Fidelis.Metadata.PcapFilename
      description: PCAP file name.
      type: String
    - contextPath: Fidelis.Metadata.SessionDuration
      description: The event session duration.
      type: String
    - contextPath: Fidelis.Metadata.ServerIP
      description: The server IP address.
      type: String
    - contextPath: Fidelis.Metadata.ClientCountry
      description: The client country.
      type: String
    - contextPath: Fidelis.Metadata.ClientPort
      description: The client port number.
      type: Number
    - contextPath: Fidelis.Metadata.SessionStart
      description: The date/time that the session started.
      type: Date
    - contextPath: Fidelis.Metadata.MalwareType
      description: The malware type.
      type: String
    - contextPath: Fidelis.Metadata.URL
      description: Request URL.
      type: String
    - contextPath: Fidelis.Metadata.RequestDirection
      description: 'Request direction (s2c or c2s). '
      type: String
    - contextPath: Fidelis.Metadata.MalwareSeverity
      description: The severity of the malware.
      type: String
    - contextPath: Fidelis.Metadata.ClientIP
      description: The client IP address.
      type: String
    - contextPath: Fidelis.Metadata.ServerCountry
      description: The country of the server.
      type: String
    - contextPath: Fidelis.Metadata.PcapTimestamp
      description: PCAP timestamp.
      type: Date
    - contextPath: Fidelis.Metadata.SensorUUID
      description: Sensor UUID.
      type: String
    - contextPath: Fidelis.Metadata.Timestamp
      description: Timestamp of the event.
      type: Date
    - contextPath: Fidelis.Metadata.FileType
      description: File type.
      type: String
    - contextPath: Fidelis.Metadata.Protocol
      description: Event protocol.
      type: String
    - contextPath: Fidelis.Metadata.UserAgent
      description: User agent of the request.
      type: String
    - contextPath: Fidelis.Metadata.Type
      description: Type of the event.
      type: String
    - contextPath: Fidelis.Metadata.FileSize
      description: The size of the file.
      type: Number
    - contextPath: Fidelis.Metadata.MD5
      description: MD5 hash of the file.
      type: String
  - arguments:
    - description: Today,Yesterday,Last 7 Days,Last Hour,Last 24 Hours,Last 48 Hours,Last 30 Days,Custom.
      name: time_frame
    - description: If the time_frame value is Custom, specify the start time for the time range, for example, 2017-06-01T12:48:16.734.
      name: start_time
    - description: If the time_frame value is Custom, specify the start time for the time range, for example, 2017-06-01T12:48:16.734.
      name: end_time
    - description: Filter alerts by the source IP.
      name: src_ip
    - description: Filter alerts by the destination IP address.
      name: dest_ip
    description: Returns a list of alerts, by source IP address or destination IP address.
    name: fidelis-list-alerts-by-ip
    outputs:
    - contextPath: Fidelis.Alert.SourceIP
      description: 'The alert source IP address. '
      type: String
    - contextPath: Fidelis.Alert.UserRating
      description: User rating.
      type: String
    - contextPath: Fidelis.Alert.DestinationCountry
      description: Destination country of the alert.
      type: String
    - contextPath: Fidelis.Alert.AssetID
      description: The ID of the asset.
      type: Number
    - contextPath: Fidelis.Alert.Time
      description: Date/time that the alert started.
      type: Date
    - contextPath: Fidelis.Alert.HostIP
      description: The host IP address of the alert.
      type: String
    - contextPath: Fidelis.Alert.DistributedAlertID
      description: Alert distributed ID.
      type: String
    - contextPath: Fidelis.Alert.DestinationIP
      description: Alert destination IP address.
      type: String
    - contextPath: Fidelis.Alert.AlertUUID
      description: The alert UUID.
      type: String
    - contextPath: Fidelis.Alert.Type
      description: The alert type.
      type: String
    - contextPath: Fidelis.Alert.ID
      description: Alert ID.
      type: Number
    - contextPath: Fidelis.Alert.SourceCountry
      description: Alert source country.
      type: String
  - arguments:
    - description: ID of the alert from which to download the file.
      name: alert_id
      required: true
    description: Downloads a malware file from a specified alert.
    name: fidelis-download-malware-file
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.Extension
      description: 'The file extension. '
      type: String
    - contextPath: File.Info
      description: Information about the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: String
    - contextPath: File.SSDeep
      description: SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: File entry ID.
      type: String
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: String
  - arguments:
    - description: The ID of the alert from which to download the file.
      name: alert_id
      required: true
    description: Downloads the PCAP file from a specified alert.
    name: fidelis-download-pcap-file
    outputs:
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Name
      description: Name of the file.
      type: String
    - contextPath: File.Size
      description: File size.
      type: Number
    - contextPath: File.Type
      description: File type.
      type: String
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: String
    - contextPath: File.SSDeep
      description: SSDeep hash of the file.
      type: String
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: String
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    description: Return the session information related to an alert.
    name: fidelis-get-alert-session-data
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: Alert ID.
      type: Number
    - contextPath: Fidelis.Alert.SessionData.RecordingState
      description: The alert's recording state.
      type: String
    - contextPath: Fidelis.Alert.SessionData.ClientPackets
      description: The client packets.
      type: String
    - contextPath: Fidelis.Alert.SessionData.ServerSize
      description: The server size.
      type: String
    - contextPath: Fidelis.Alert.SessionData.ServerPort
      description: The server port.
      type: Number
    - contextPath: Fidelis.Alert.SessionData.ServerDataComplete
      description: Is the server data complete.
      type: Boolean
    - contextPath: Fidelis.Alert.SessionData.ServerPackets
      description: The server packets.
      type: String
    - contextPath: Fidelis.Alert.SessionData.EndTime
      description: The end time.
      type: String
    - contextPath: Fidelis.Alert.SessionData.ServerIp
      description: The server IP.
      type: String
    - contextPath: Fidelis.Alert.SessionData.ClientSize
      description: The client size.
      type: String
    - contextPath: Fidelis.Alert.SessionData.ClientPort
      description: The client port.
      type: Number
    - contextPath: Fidelis.Alert.SessionData.ServerData
      description: The server data.
      type: String
    - contextPath: Fidelis.Alert.SessionData.BinaryServerData
      description: The binary server data.
      type: Unknown
    - contextPath: Fidelis.Alert.SessionData.ClientDataComplete
      description: Is the client data complete.
      type: Boolean
    - contextPath: Fidelis.Alert.SessionData.ServerDataSize
      description: The server data size.
      type: Number
    - contextPath: Fidelis.Alert.SessionData.RecordedObject
      description: The recorded object.
      type: Boolean
    - contextPath: Fidelis.Alert.SessionData.StartTime
      description: The start time.
      type: String
    - contextPath: Fidelis.Alert.SessionData.ClientDomainName
      description: The client domain name.
      type: String
    - contextPath: Fidelis.Alert.SessionData.TcpState
      description: The TCP state.
      type: String
    - contextPath: Fidelis.Alert.SessionData.ShowingDataSize
      description: Showing the data size.
      type: Number
    - contextPath: Fidelis.Alert.SessionData.ClientIp
      description: The client IP.
      type: String
    - contextPath: Fidelis.Alert.SessionData.Duration
      description: The session data duration.
      type: Number
    - contextPath: Fidelis.Alert.SessionData.ClientData
      description: The client data.
      type: String
    - contextPath: Fidelis.Alert.SessionData.BinaryClientData
      description: The binary client data.
      type: Unknown
    - contextPath: Fidelis.Alert.SessionData.ClientDataSize
      description: The client data size.
      type: Number
    - contextPath: Fidelis.Alert.SessionData.NoForensics
      description: Are there no forensics.
      type: Boolean
    - contextPath: Fidelis.Alert.SessionData.Exist
      description: Does the sesison data exist.
      type: Boolean
    - contextPath: Fidelis.Alert.SessionData.TimeZone
      description: The time zone.
      type: String
    - contextPath: Fidelis.Alert.SessionData.Highlights
      description: Highlights in the session data.
      type: Unknown
    - contextPath: Fidelis.Alert.SessionData.ServerDomainName
      description: The server domain name.
      type: String
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    description: Get the exectution forensics for an alert.
    name: fidelis-get-alert-execution-forensics
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: The alert ID.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.EFEnabled
      description: Is the alert execution forensics enabled.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Size
      description: The execution forensics size.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.SubmitTime
      description: The submission time.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.SandBoxOn
      description: Is the sandbox on.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.TgReport
      description: The TG report.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.FileName
      description: The file name.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.DnsFeed
      description: Is there a DNS feed.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.RecordingComplete
      description: Is the recording complete.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.PcapUrl
      description: The PCAP URL.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.AlertFlagsXeNonsubmit
      description: The alert flag xe-nonsubmit.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Bit9Server
      description: The bit 9 server.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.DecodingPath
      description: The execution forensics decoding path.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.FileCheckAlert
      description: The file check alert.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Status
      description: The execution forensics status.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.Submitable
      description: Is the execution forensics submitable.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Score
      description: The execution forensics score.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.SubmitId
      description: The execution forensics submit ID.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.VideoUrl
      description: The video URL.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.StatusMessage
      description: The execution forensics status message.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.FileType
      description: The file type.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.AlertId
      description: The alert ID.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.Type
      description: The type.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.ReportUrl
      description: The report URL.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.JsSubmitable
      description: Is the execution forensics JS submitable.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Uuid
      description: The UUID.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.JsonReport
      description: The JSON report.
      type: Unknown
    - contextPath: Fidelis.Alert.ExecutionForensics.FileSize
      description: The file size.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.Md5
      description: The file's MD5 hash.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.ThreatGridOn
      description: Is the threat grid on.
      type: Boolean
  - arguments:
    - description: The alert ID.
      name: alert_id
      required: true
    description: Get the text of the forensic data.
    name: fidelis-get-alert-forensic-text
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: The alert ID.
      type: Number
    - contextPath: Fidelis.Alert.ForensicText
      description: The alert's forensic text.
      type: String
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    description: Get the alert's decoding path.
    name: fidelis-get-alert-decoding-path
    outputs:
    - contextPath: Fidelis.Alert.ID
      description: The alert ID.
      type: Number
    - contextPath: Fidelis.Alert.DecodingPath.ClickableDpaths
      description: The clickable decoding paths.
      type: Unknown
    - contextPath: Fidelis.Alert.DecodingPath.CommandpostIp
      description: The command post IP.
      type: String
    - contextPath: Fidelis.Alert.DecodingPath.DecodingPaths
      description: The decoding path info.
      type: Unknown
    - contextPath: Fidelis.Alert.DecodingPath.OriginalAttributes
      description: The original attribute.
      type: String
    - contextPath: Fidelis.Alert.DecodingPath.OriginalDPath
      description: The original path.
      type: String
    - contextPath: Fidelis.Alert.DecodingPath.AttributeMap
      description: The attribute map.
      type: Unknown
    - contextPath: Fidelis.Alert.DecodingPath.AttributeMapHighLights
      description: The attribute map highlights.
      type: Unknown
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: The new alert status.
      name: status
      predefined:
      - False Positive
      - Not Interesting
      - Interesting
      - Actionable
      required: true
    description: Update alert status
    name: fidelis-update-alert-status
  - arguments:
    - description: The alert ID.
      name: alert_id
      required: true
    description: Submit an excutable file to the fidelis sandbox.
    name: fidelis-alert-execution-forensics-submission
    outputs:
    - contextPath: Fidelis.Alert.ExecutionForensics.EFEnabled
      description: Is the alert execution forensics enabled.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.Size
      description: The execution forensics size.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.SubmitTime
      description: The submission time.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.SandBoxOn
      description: Is the sandbox on.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.TgReport
      description: The TG report.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.FileName
      description: The file name.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.DnsFeed
      description: Is there a DNS feed.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.RecordingComplete
      description: Is the recording complete.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.PcapUrl
      description: The PCAP URL.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.AlertFlagsXeNonsubmit
      description: The alert flag xe-nonsubmit.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Bit9Server
      description: The bit 9 server.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.DecodingPath
      description: The execution forensics decoding path.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.FileCheckAlert
      description: The file check alert.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Status
      description: The execution forensics status.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.Submitable
      description: Is the execution forensics submitable.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Score
      description: The execution forensics score.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.SubmitId
      description: The execution forensics submit ID.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.VideoUrl
      description: The video URL.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.StatusMessage
      description: The execution forensics status message.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.FileType
      description: The file type.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.AlertId
      description: The alert ID.
      type: Number
    - contextPath: Fidelis.Alert.ExecutionForensics.Type
      description: The type.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.ReportUrl
      description: The report URL.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.JsSubmitable
      description: Is the execution forensics JS submitable.
      type: Boolean
    - contextPath: Fidelis.Alert.ExecutionForensics.Uuid
      description: The UUID.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.JsonReport
      description: The JSON report.
      type: Unknown
    - contextPath: Fidelis.Alert.ExecutionForensics.FileSize
      description: The file size.
      type: Unknown
    - contextPath: Fidelis.Alert.ExecutionForensics.Md5
      description: The file's MD5 hash.
      type: String
    - contextPath: Fidelis.Alert.ExecutionForensics.ThreatGridOn
      description: Is the threat grid on.
      type: Unknown
    - contextPath: Fidelis.Alert.ID
      description: The alert ID.
      type: Number
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    - description: Comment.
      name: comment
      required: true
    description: Adds a comment to an alert.
    name: fidelis-add-alert-comment
  - arguments:
    - description: The alert conclusion ID.
      name: conclusion_id
      required: true
    - description: Add a comment to the alert.
      name: comment
    - description: The user to assign.
      name: assign_user
      required: true
    description: Assign a user to an alert.
    name: fidelis-assign-user-to-alert
    outputs:
    - contextPath: Fidelis.Alert.AssignedUser
      description: Assigned user ID.
      type: String
    - contextPath: Fidelis.Alert.ConclusionID
      description: The alert conclusion ID.
      type: Number
  - arguments:
    - description: The conclusion ID.
      name: conclusion_id
      required: true
    - auto: PREDEFINED
      description: The alert resolution.
      name: resolution
      predefined:
      - Action Taken
      - Not Interesting
      - Duplicate
      - False Positive
      required: true
    - description: Add a comment to the alert.
      name: comment
    description: Closes a fidelis alert and can assign a user.
    name: fidelis-close-alert
    outputs:
    - contextPath: Fidelis.Alert.ConclusionID
      description: The conclusion ID.
      type: Number
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    - description: The label to add.
      name: label
      required: true
    - auto: PREDEFINED
      description: What action should be taken.
      name: action
      predefined:
      - Add
      - Remove
      required: true
    description: Adds a label to an alert.
    name: fidelis-manage-alert-label
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  type: python
tests:
- Fidelis-Test
fromversion: 5.0.0