category: Network Security provider: Gatewatcher sectionorder: - Connect - Collect commonfields: id: GCenter version: -1 configuration: - display: GCenter IP address name: ip type: 0 required: true section: Connect - display: GCenter Version name: version type: 0 defaultvalue: 2.5.3.102 required: false section: Connect - display: GCenter API token name: token type: 4 additionalinfo: You must provide either an API token or a username and a password. required: false section: Connect - display: GCenter username displaypassword: GCenter password name: credentials type: 9 required: false section: Connect - display: Check the TLS certificate name: check_cert type: 8 required: false section: Connect description: This integration allows, via about twenty commands, to interact with the GCenter appliance via its API. display: GCenter name: GCenter script: commands: - name: gw-list-alerts description: List all alerts (Deprecated. use gw-es-wrapper command instead). deprecated: true outputs: - contextPath: GCenter.Alert.List.sha256 description: The 256 Shasum Of The File. type: String - contextPath: GCenter.Alert.List.id description: The Id Of The Inspectra Alert. type: String - contextPath: GCenter.Alert.List.flow_id description: The Flow Id Of The Alert. type: Number - contextPath: GCenter.Alert.List.severity description: The Severity Of The Alert. type: Number - contextPath: GCenter.Alert.List.src_ip description: The Ip Address Of The Alert'S Source. type: String - contextPath: GCenter.Alert.List.dest_ip description: The Ip Address Of The Alert'S Target. type: String - contextPath: GCenter.Alert.List.src_port description: The Port Of The Alert'S Source. type: Number - contextPath: GCenter.Alert.List.dest_port description: The Port Of The Alert'S Target. type: Number - contextPath: GCenter.Alert.List.gcap description: The Gcap That Raised The Alert. type: String - contextPath: GCenter.Alert.List.type description: Which Type Of Alert (Sigflow, Codebreaker...) type: String - contextPath: GCenter.Alert.List.proto description: The Protocol Used. type: String - contextPath: GCenter.Alert.List.host description: The Host Where The Alert Was Found. type: String - contextPath: GCenter.Alert.List.app_proto description: The Malware Application Prototype. type: String - contextPath: GCenter.Alert.List.alert_type description: Which Event It Is ? type: String - contextPath: GCenter.Alert.List.state description: The State Of The Alert. type: String - contextPath: GCenter.Alert.List.matched_event description: Value Of The Id Of An Other Alert That Matched (Allows The Correlation Between Alerts). type: String - contextPath: GCenter.Alert.List.domain_name description: For Dga Alerts Only. type: String - contextPath: GCenter.Alert.List.probability description: The Severity Probability. type: Number - contextPath: GCenter.Alert.List.timestamp_detected description: When The Alert Was Detected. type: Date - contextPath: GCenter.Alert.List.timestamp_analyzed description: When The Alert Was Analysed. type: Date - contextPath: GCenter.Alert.List.retrohunt.timestamp_package description: Utc Date When The Ioc Was Added To The Lastinfosec Update Package. type: String - contextPath: GCenter.Alert.List.retrohunt.ioc_creation_date description: The Ioc Creation Date. type: Date - contextPath: GCenter.Alert.List.retrohunt.ioc_updated_date description: The Ioc Updated Date. type: Date - contextPath: GCenter.Alert.List.retrohunt.description description: The Alert Description. type: String - contextPath: GCenter.Alert.List.retrohunt.ioc_type description: Host, Md5, Sha1, Sha256, Url. type: String - contextPath: GCenter.Alert.List.retrohunt.ioc_value description: Characteristic Value Of The Ioc. type: String - contextPath: GCenter.Alert.List.retrohunt.matched_app_proto description: The Sigflow Protocol That Contains This Ioc. type: String - contextPath: GCenter.Alert.List.retrohunt.matched_event_type description: The Sigflow Event Type That Contains This Ioc. type: String - contextPath: GCenter.Alert.List.retrohunt.case_id description: Uuid Of The Box To Which The Ioc Belongs. type: String - contextPath: GCenter.Alert.List.retrohunt.ioc_id description: Uuid Of The Ioc. type: String - contextPath: GCenter.Alert.List.retrohunt.risk description: Suspicious, High Suspicious, Malicious. type: String - contextPath: GCenter.Alert.List.retrohunt.usage_mode description: Usage Mode. type: String - contextPath: GCenter.Alert.List.retrohunt.tlp description: Tlp. type: String - contextPath: GCenter.Alert.List.powershell.file_id description: The File Id. type: String - contextPath: GCenter.Alert.List.powershell.scores.proba_obfuscated description: The Probability It Is Obfuscated. type: Number - contextPath: GCenter.Alert.List.powershell.scores.analysis description: The Powershell Analysis Score. type: Number - contextPath: GCenter.Alert.List.shellcode.file_id description: The File Id. type: String - contextPath: GCenter.Alert.List.shellcode.encodings.name description: The Name Of The Encoding. type: String - contextPath: GCenter.Alert.List.shellcode.encodings.count description: The Number Of The Encoding Elements. type: Number - contextPath: GCenter.Alert.List.shellcode.calls.call description: The Name Of The Call Of The Alert. type: String - contextPath: GCenter.Alert.List.shellcode.calls.args description: The Argument Used For The Call. type: String - contextPath: GCenter.Alert.List.shellcode.calls.ret description: The Retention Of The Call. type: String - contextPath: GCenter.Alert.List.shellcode.calls.index description: The Call Index. type: Number - contextPath: GCenter.Alert.List.malware.analyzed_clean description: Number Of Engines That Returned A Clean Status. type: Number - contextPath: GCenter.Alert.List.malware.analyzed_infected description: Number Of Engines That Returned An Infected Status. type: Number - contextPath: GCenter.Alert.List.malware.analyzed_suspicious description: Number Of Engines That Returned A Suspicious Status. type: Number - contextPath: GCenter.Alert.List.malware.analyzed_other description: Number Of Engines That Returned Other Statuses. type: Number - contextPath: GCenter.Alert.List.malware.analyzed_error description: Number Of Engines That Failed To Analyze The File. type: Number - contextPath: GCenter.Alert.List.malware.code description: The Global Code Result. type: Number - contextPath: GCenter.Alert.List.malware.def_time description: 'When The Last Engines Have Ended The Scan.' type: Date - contextPath: GCenter.Alert.List.malware.scan_time description: The Scan Time In Ms. type: Number - contextPath: GCenter.Alert.List.malware.threats_found description: The Threats Found By The Engines. type: String - contextPath: GCenter.Alert.List.malware.reporting_token description: The Reporting Token Returned By The Gbox. type: String - contextPath: GCenter.Alert.List.malware.engines_report.0.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.0.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.0.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.1.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.1.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.1.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.2.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.2.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.2.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.3.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.3.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.3.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.4.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.4.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.4.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.5.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.5.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.5.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.6.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.6.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.6.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.7.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.7.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.7.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.8.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.8.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.8.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.9.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.9.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.9.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.10.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.10.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.10.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.11.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.11.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.11.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.12.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.12.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.12.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.13.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.13.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.13.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.14.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.14.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.14.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.engines_report.15.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.15.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.List.malware.engines_report.15.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.List.malware.magic_details description: The File Magic. type: String - contextPath: GCenter.Alert.List.malware.total_found description: The Malcore Number Of Engines That Found The File Suspicious / The Total Number Of Engines. type: String - contextPath: GCenter.Alert.List.sigflow.alert.action description: Action. type: String - contextPath: GCenter.Alert.List.sigflow.alert.signature_id description: Signature Id. type: String - contextPath: GCenter.Alert.List.sigflow.alert.gid description: Gid. type: String - contextPath: GCenter.Alert.List.sigflow.alert.category description: Category. type: String - contextPath: GCenter.Alert.List.sigflow.packet description: Packet. type: String - contextPath: GCenter.Alert.List.sigflow.in_iface description: In Which Interface The Alert Occurred. type: String - contextPath: GCenter.Alert.List.sigflow.stream description: Is It Streaming (!= 0). type: Number - contextPath: GCenter.Alert.List.sigflow.payload description: Payload. type: String - contextPath: GCenter.Alert.List.sigflow.payload_printable description: Payload Printable. type: String - name: gw-get-alert description: Get an alert by it's uid. arguments: - name: uid required: true description: Alert identifier. outputs: - contextPath: GCenter.Alert.Single.sha256 description: The 256 Shasum Of The File. type: String - contextPath: GCenter.Alert.Single.id description: The Id Of The Inspectra Alert. type: String - contextPath: GCenter.Alert.Single.flow_id description: The Flow Id Of The Alert. type: Number - contextPath: GCenter.Alert.Single.severity description: The Severity Of The Alert. type: Number - contextPath: GCenter.Alert.Single.src_ip description: The Ip Address Of The Alert'S Source. type: String - contextPath: GCenter.Alert.Single.dest_ip description: The Ip Address Of The Alert'S Target. type: String - contextPath: GCenter.Alert.Single.src_port description: The Port Of The Alert'S Source. type: Number - contextPath: GCenter.Alert.Single.dest_port description: The Port Of The Alert'S Target. type: Number - contextPath: GCenter.Alert.Single.gcap description: The Gcap That Raised The Alert. type: String - contextPath: GCenter.Alert.Single.type description: Which Type Of Alert (Sigflow, Codebreaker...) type: String - contextPath: GCenter.Alert.Single.proto description: The Protocol Used. type: String - contextPath: GCenter.Alert.Single.host description: The Host Where The Alert Was Found. type: String - contextPath: GCenter.Alert.Single.app_proto description: The Malware Application Prototype. type: String - contextPath: GCenter.Alert.Single.alert_type description: Which Event It Is ? type: String - contextPath: GCenter.Alert.Single.state description: The State Of The Alert. type: String - contextPath: GCenter.Alert.Single.matched_event description: Value Of The Id Of An Other Alert That Matched (Allows The Correlation Between Alerts). type: String - contextPath: GCenter.Alert.Single.domain_name description: For Dga Alerts Only. type: String - contextPath: GCenter.Alert.Single.probability description: The Severity Probability. type: Number - contextPath: GCenter.Alert.Single.timestamp_detected description: When The Alert Was Detected. type: Date - contextPath: GCenter.Alert.Single.timestamp_analyzed description: When The Alert Was Analysed. type: Date - contextPath: GCenter.Alert.Single.retrohunt.timestamp_package description: Utc Date When The Ioc Was Added To The Lastinfosec Update Package. type: String - contextPath: GCenter.Alert.Single.retrohunt.ioc_creation_date description: The Ioc Creation Date. type: Date - contextPath: GCenter.Alert.Single.retrohunt.ioc_updated_date description: The Ioc Updated Date. type: Date - contextPath: GCenter.Alert.Single.retrohunt.description description: The Alert Description. type: String - contextPath: GCenter.Alert.Single.retrohunt.ioc_type description: Host, Md5, Sha1, Sha256, Url. type: String - contextPath: GCenter.Alert.Single.retrohunt.ioc_value description: Characteristic Value Of The Ioc. type: String - contextPath: GCenter.Alert.Single.retrohunt.matched_app_proto description: The Sigflow Protocol That Contains This Ioc. type: String - contextPath: GCenter.Alert.Single.retrohunt.matched_event_type description: The Sigflow Event Type That Contains This Ioc. type: String - contextPath: GCenter.Alert.Single.retrohunt.case_id description: Uuid Of The Box To Which The Ioc Belongs. type: String - contextPath: GCenter.Alert.Single.retrohunt.ioc_id description: Uuid Of The Ioc. type: String - contextPath: GCenter.Alert.Single.retrohunt.risk description: Suspicious, High Suspicious, Malicious. type: String - contextPath: GCenter.Alert.Single.retrohunt.usage_mode description: Usage Mode. type: String - contextPath: GCenter.Alert.Single.retrohunt.tlp description: Tlp. type: String - contextPath: GCenter.Alert.Single.powershell.file_id description: The File Id. type: String - contextPath: GCenter.Alert.Single.powershell.scores.proba_obfuscated description: The Probability It Is Obfuscated. type: Number - contextPath: GCenter.Alert.Single.powershell.scores.analysis description: The Powershell Analysis Score. type: Number - contextPath: GCenter.Alert.Single.shellcode.file_id description: The File Id. type: String - contextPath: GCenter.Alert.Single.shellcode.encodings.name description: The Name Of The Encoding. type: String - contextPath: GCenter.Alert.Single.shellcode.encodings.count description: The Number Of The Encoding Elements. type: Number - contextPath: GCenter.Alert.Single.shellcode.calls.call description: The Name Of The Call Of The Alert. type: String - contextPath: GCenter.Alert.Single.shellcode.calls.args description: The Argument Used For The Call. type: String - contextPath: GCenter.Alert.Single.shellcode.calls.ret description: The Retention Of The Call. type: String - contextPath: GCenter.Alert.Single.shellcode.calls.index description: The Call Index. type: Number - contextPath: GCenter.Alert.Single.malware.analyzed_clean description: Number Of Engines That Returned A Clean Status. type: Number - contextPath: GCenter.Alert.Single.malware.analyzed_infected description: Number Of Engines That Returned An Infected Status. type: Number - contextPath: GCenter.Alert.Single.malware.analyzed_suspicious description: Number Of Engines That Returned A Suspicious Status. type: Number - contextPath: GCenter.Alert.Single.malware.analyzed_other description: Number Of Engines That Returned Other Statuses. type: Number - contextPath: GCenter.Alert.Single.malware.analyzed_error description: Number Of Engines That Failed To Analyze The File. type: Number - contextPath: GCenter.Alert.Single.malware.code description: The Global Code Result. type: Number - contextPath: GCenter.Alert.Single.malware.def_time description: 'When The Last Engines Have Ended The Scan.' type: Date - contextPath: GCenter.Alert.Single.malware.scan_time description: The Scan Time In Ms. type: Number - contextPath: GCenter.Alert.Single.malware.threats_found description: The Threats Found By The Engines. type: String - contextPath: GCenter.Alert.Single.malware.reporting_token description: The Reporting Token Returned By The Gbox. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.0.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.0.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.0.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.1.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.1.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.1.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.2.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.2.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.2.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.3.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.3.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.3.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.4.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.4.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.4.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.5.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.5.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.5.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.6.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.6.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.6.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.7.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.7.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.7.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.8.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.8.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.8.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.9.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.9.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.9.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.10.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.10.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.10.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.11.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.11.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.11.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.12.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.12.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.12.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.13.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.13.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.13.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.14.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.14.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.14.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.15.id description: The Hash Pf The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.15.threat_details description: The Threat Found By The Engine. type: String - contextPath: GCenter.Alert.Single.malware.engines_report.15.scan_result description: Analysis Result. type: String - contextPath: GCenter.Alert.Single.malware.magic_details description: The File Magic. type: String - contextPath: GCenter.Alert.Single.malware.total_found description: The Malcore Number Of Engines That Found The File Suspicious / The Total Number Of Engines. type: String - contextPath: GCenter.Alert.Single.sigflow.alert.action description: Action. type: String - contextPath: GCenter.Alert.Single.sigflow.alert.signature_id description: Signature Id. type: String - contextPath: GCenter.Alert.Single.sigflow.alert.gid description: Gid. type: String - contextPath: GCenter.Alert.Single.sigflow.alert.category description: Category. type: String - contextPath: GCenter.Alert.Single.sigflow.packet description: Packet. type: String - contextPath: GCenter.Alert.Single.sigflow.in_iface description: In Which Interface The Alert Occurred. type: String - contextPath: GCenter.Alert.Single.sigflow.stream description: Is It Streaming (!= 0). type: Number - contextPath: GCenter.Alert.Single.sigflow.payload description: Payload. type: String - contextPath: GCenter.Alert.Single.sigflow.payload_printable description: Payload Printable. type: String - name: gw-es-query description: Get Elasticsearch data. arguments: - name: index auto: PREDEFINED predefined: - suricata - malware - codebreaker - netdata - syslog - machine_learning - retrohunt - iocs description: Index to be queried. defaultValue: suricata - name: query description: Elaticsearch query. defaultValue: '{}' - name: gw-add-malcore-list-entry description: Add malcore whitelist/blacklist entry. arguments: - name: type required: true auto: PREDEFINED predefined: - white - black description: List type. - name: sha256 required: true description: SHA256 to be added. - name: comment description: Comment to be added. - name: threat description: Comment to be added. outputs: - contextPath: GCenter.Malcore.sha256 description: Sha256. type: String - contextPath: GCenter.Malcore.created description: Created. type: Date - contextPath: GCenter.Malcore.comment description: Comment. type: String - contextPath: GCenter.Malcore.threat description: Name Of Threat For Reference. type: String - name: gw-del-malcore-list-entry description: Delete malcore whitelist/blacklist entry. arguments: - name: type required: true auto: PREDEFINED predefined: - white - black description: List type. - name: sha256 required: true description: SHA256 to be deleted. - name: gw-add-dga-list-entry description: Add dga whitelist/blacklist entry. arguments: - name: type required: true auto: PREDEFINED predefined: - white - black description: List type. - name: domain required: true description: Domain name to be added. - name: comment description: Comment to be added. outputs: - contextPath: GCenter.Dga.domain_name description: Domain Name. type: String - contextPath: GCenter.Dga.created description: Created. type: Date - contextPath: GCenter.Dga.comment description: Comment. type: String - contextPath: GCenter.Dga.is_wildcard description: Is Wildcard. type: Boolean - name: gw-del-dga-list-entry description: Delete dga whitelist/blacklist entry. arguments: - name: type required: true auto: PREDEFINED predefined: - white - black description: List type. - name: domain required: true description: Domain name to be deleted. - name: gw-add-ignore-asset-name description: Ignore asset name. arguments: - name: name required: true description: Name to be ignored. - name: start required: true description: Will be ignored if they start with this name. defaultValue: false - name: end required: true description: Will be ignored if they end with this name. defaultValue: false outputs: - contextPath: GCenter.Ignore.AssetName.id description: Id. type: String - contextPath: GCenter.Ignore.AssetName.created_at description: Created At. type: Date - contextPath: GCenter.Ignore.AssetName.created_by description: Created By. type: String - contextPath: GCenter.Ignore.AssetName.name description: Ignored Name For The Assets (Hostnames). Case Insensitive. type: String - contextPath: GCenter.Ignore.AssetName.is_startswith_pattern description: Should The Assets (Hostnames) Be Ignored If They Start With This Name ? type: Boolean - contextPath: GCenter.Ignore.AssetName.is_endswith_pattern description: Should The Assets (Hostnames) Be Ignored If They End With This Name ? type: Boolean - name: gw-add-ignore-kuser-ip description: Ignore kuser IP. arguments: - name: ip required: true description: IP to be ignored. outputs: - contextPath: GCenter.Ignore.KuserIP.id description: Id. type: String - contextPath: GCenter.Ignore.KuserIP.created_at description: Created At. type: Date - contextPath: GCenter.Ignore.KuserIP.created_by description: Created By. type: String - contextPath: GCenter.Ignore.KuserIP.ip description: Ignored Ip For The Kerberos Users. type: String - name: gw-add-ignore-kuser-name description: Ignore kuser name. arguments: - name: name required: true description: Name to be ignored. - name: start required: true description: Will be ignored if they start with this name. defaultValue: false - name: end required: true description: Will be ignored if they end with this name. defaultValue: false outputs: - contextPath: GCenter.Ignore.KuserName.id description: Id. type: String - contextPath: GCenter.Ignore.KuserName.created_at description: Created At. type: Date - contextPath: GCenter.Ignore.KuserName.created_by description: Created By. type: String - contextPath: GCenter.Ignore.KuserName.name description: Ignored Name For The Kerberos Users. Case Insensitive. type: String - contextPath: GCenter.Ignore.KuserName.is_startswith_pattern description: Should The Kerberos Users Be Ignored If They Start With This Name ? type: Boolean - contextPath: GCenter.Ignore.KuserName.is_endswith_pattern description: Should The Kerberos Users Be Ignored If They End With This Name ? type: Boolean - name: gw-add-ignore-mac-address description: Ignore mac address. arguments: - name: mac required: true description: MAC address to be ignored. - name: start required: true description: Will be ignored if they start with this name. defaultValue: false outputs: - contextPath: GCenter.Ignore.MacAddress.id description: Id. type: String - contextPath: GCenter.Ignore.MacAddress.created_at description: Created At. type: Date - contextPath: GCenter.Ignore.MacAddress.created_by description: Created By. type: String - contextPath: GCenter.Ignore.MacAddress.address description: Address. type: String - contextPath: GCenter.Ignore.MacAddress.is_startswith_pattern description: Should The Mac Addresses Be Ignored If They Start With This Address Value ? type: Boolean - name: gw-del-ignore-asset-name description: Delete an ignore asset ID. arguments: - name: ignore_id required: true description: Ignore asset ID. - name: gw-del-ignore-kuser-ip description: Delete an ignore kuser IP ID. arguments: - name: ignore_id required: true description: Ignore kuser IP ID. - name: gw-del-ignore-kuser-name description: Delete an ignore kuser name ID. arguments: - name: ignore_id required: true description: Ignore kuser name ID. - name: gw-del-ignore-mac-address description: Delete an ignore mac address ID. arguments: - name: ignore_id required: true description: Ignore mac address ID. - name: gw-send-malware description: Send malware. arguments: - name: filename required: true description: Filename. - name: file_id required: true description: File entry id. outputs: - contextPath: GCenter.Gscan.Malware.id description: The Id Of The Gscan History Message. type: String - contextPath: GCenter.Gscan.Malware.created description: Date Of Creation. type: Date - contextPath: GCenter.Gscan.Malware.username description: The User'S Username Who Uploaded The File. type: String - contextPath: GCenter.Gscan.Malware.user_agent description: The Client'S User-Agent. type: String - contextPath: GCenter.Gscan.Malware.ip_address description: The Ip Address Of The User Who Uploaded The File. type: String - contextPath: GCenter.Gscan.Malware.file_name description: Original File Name. type: String - contextPath: GCenter.Gscan.Malware.sha256 description: Sha256. type: String - contextPath: GCenter.Gscan.Malware.is_clean description: Clean. type: Unknown - contextPath: GCenter.Gscan.Malware.is_analysis_successful description: Scan Succes. type: Boolean - contextPath: GCenter.Gscan.Malware.malcore_code_result description: Malcore Code Result. type: String - contextPath: GCenter.Gscan.Malware.threat_name description: Threat Name. type: String - contextPath: GCenter.Gscan.Malware.nb_alerts description: Number Or Malcore Alerts. type: Number - contextPath: GCenter.Gscan.Malware.nb_engines description: Number Or Malcore Engines. type: Number - contextPath: GCenter.Gscan.Malware.is_whiteblack_listed description: Is White Or Black Listed? type: Boolean - contextPath: GCenter.Gscan.Malware.malcore_code_result_name description: Malcore Code Result Name. type: String - contextPath: GCenter.Gscan.Malware.status description: The Malcore Status. type: String - name: gw-send-powershell description: Send powershell. arguments: - name: filename required: true description: Filename. - name: file_id required: true description: File entry id. outputs: - contextPath: GCenter.Gscan.Powershell.id description: The Id Of The Gscan History Message. type: String - contextPath: GCenter.Gscan.Powershell.created description: Date Of Creation. type: Date - contextPath: GCenter.Gscan.Powershell.username description: The User'S Username Who Uploaded The File. type: String - contextPath: GCenter.Gscan.Powershell.user_agent description: The Client'S User-Agent. type: String - contextPath: GCenter.Gscan.Powershell.ip_address description: The Ip Address Of The User Who Uploaded The File. type: String - contextPath: GCenter.Gscan.Powershell.file_name description: Original File Name. type: String - contextPath: GCenter.Gscan.Powershell.sha256 description: Sha256. type: String - contextPath: GCenter.Gscan.Powershell.is_clean description: Clean. type: Boolean - contextPath: GCenter.Gscan.Powershell.is_analysis_successful description: Scan Succes. type: Boolean - contextPath: GCenter.Gscan.Powershell.status description: Status. type: String - contextPath: GCenter.Gscan.Powershell.proba_obfuscated description: Proba_Obfuscated. type: Number - contextPath: GCenter.Gscan.Powershell.analysis_score description: Analysis_Score. type: Number - contextPath: GCenter.Gscan.Powershell.is_whiteblack_listed description: Is White Or Black Listed? type: Boolean - name: gw-send-shellcode description: Send shellcode. arguments: - name: filename required: true description: Filename. - name: file_id required: true description: File entry id. - name: deep description: Deep scan. defaultValue: false - name: timeout description: Deep scan timeout. defaultValue: 120 outputs: - contextPath: GCenter.Gscan.Shellcode.id description: The Id Of The Gscan History Message. type: String - contextPath: GCenter.Gscan.Shellcode.created description: Date Of Creation. type: Date - contextPath: GCenter.Gscan.Shellcode.username description: The User'S Username Who Uploaded The File. type: String - contextPath: GCenter.Gscan.Shellcode.user_agent description: The Client'S User-Agent. type: String - contextPath: GCenter.Gscan.Shellcode.ip_address description: The Ip Address Of The User Who Uploaded The File. type: String - contextPath: GCenter.Gscan.Shellcode.file_name description: Original File Name. type: String - contextPath: GCenter.Gscan.Shellcode.sha256 description: Sha256. type: String - contextPath: GCenter.Gscan.Shellcode.is_clean description: Clean. type: Boolean - contextPath: GCenter.Gscan.Shellcode.is_analysis_successful description: Scan Succes. type: Boolean - contextPath: GCenter.Gscan.Shellcode.status description: Status. type: String - contextPath: GCenter.Gscan.Shellcode.architecture description: Architecture. type: Unknown - contextPath: GCenter.Gscan.Shellcode.is_whiteblack_listed description: Is White Or Black Listed? type: Boolean - arguments: - auto: PREDEFINED default: true description: index. name: index predefined: - suricata - codebreaker - malware - netdata - syslog - machine_learning - retrohunt - iocs required: true - auto: PREDEFINED description: |- List and count each distinct values of a document field using the terms aggregation If aggs_term is empty list hits value Exemple : "src_ip,dest_ip". isArray: true name: aggs_term predefined: - src_ip - dest_ip - http.hostname - tls.sni - SHA256 - description: |- Filter document that match the value using the term query Exemple : "alert.severity=1,app_proto=http". name: must_match - description: |- Filter document with existing key using the exists query Exemple : "http.hostname,http.url". name: must_exists - defaultValue: '24' description: Set the lower timerange in hour based on the now keyword. name: timerange - auto: PREDEFINED defaultValue: 'True' description: True to get the list of aggregation value False to get entire response. name: formatted predefined: - 'True' - 'False' - defaultValue: '100' description: Set the number of aggregate or hits value that can be returned. name: size description: Get Elasticsearch data using a wrapper. name: gw-es-wrapper - arguments: - auto: PREDEFINED description: List type. name: type predefined: - white - black required: true description: Get the malcore whitelist/blacklist. name: gw-get-malcore-list-entry outputs: - contextPath: GCenter.Malcore.List.sha256 description: Sha256. type: String - contextPath: GCenter.Malcore.List.created description: Created. type: Date - contextPath: GCenter.Malcore.List.comment description: Comment. type: String - contextPath: GCenter.Malcore.List.threat description: Name Of Threat For Reference. type: String - arguments: - auto: PREDEFINED description: List type. name: type predefined: - white - black required: true description: Get the dga whitelist/blacklist. name: gw-get-dga-list-entry outputs: - contextPath: GCenter.Dga.List.domain_name description: Domain Name. type: String - contextPath: GCenter.Dga.List.created description: Created. type: Date - contextPath: GCenter.Dga.List.comment description: Comment. type: String - contextPath: GCenter.Dga.List.is_wildcard description: Is Wildcard. type: Boolean - description: Get all the ignored asset names. name: gw-get-ignore-asset-name outputs: - contextPath: GCenter.Ignore.AssetName.List.id description: Id. type: String - contextPath: GCenter.Ignore.AssetName.List.created_at description: Created At. type: Date - contextPath: GCenter.Ignore.AssetName.List.created_by description: Created By. type: String - contextPath: GCenter.Ignore.AssetName.List.name description: Ignored Name For The Assets (Hostnames). Case Insensitive. type: String - contextPath: GCenter.Ignore.AssetName.List.is_startswith_pattern description: Should The Assets (Hostnames) Be Ignored If They Start With This Name ? type: Boolean - contextPath: GCenter.Ignore.AssetName.List.is_endswith_pattern description: Should The Assets (Hostnames) Be Ignored If They End With This Name ? type: Boolean - description: Get all the ignored kuser IP. name: gw-get-ignore-kuser-ip outputs: - contextPath: GCenter.Ignore.KuserIP.List.id description: Id. type: String - contextPath: GCenter.Ignore.KuserIP.List.created_at description: Created At. type: Date - contextPath: GCenter.Ignore.KuserIP.List.created_by description: Created By. type: String - contextPath: GCenter.Ignore.KuserIP.List.ip description: Ignored Ip For The Kerberos Users. type: String - description: Get all the ignored kuser name. name: gw-get-ignore-kuser-name outputs: - contextPath: GCenter.Ignore.KuserName.List.id description: Id. type: String - contextPath: GCenter.Ignore.KuserName.List.created_at description: Created At. type: Date - contextPath: GCenter.Ignore.KuserName.List.created_by description: Created By. type: String - contextPath: GCenter.Ignore.KuserName.List.name description: Ignored Name For The Kerberos Users. Case Insensitive. type: String - contextPath: GCenter.Ignore.KuserName.List.is_startswith_pattern description: Should The Kerberos Users Be Ignored If They Start With This Name ? type: Boolean - contextPath: GCenter.Ignore.KuserName.List.is_endswith_pattern description: Should The Kerberos Users Be Ignored If They End With This Name ? type: Boolean - description: Get all the ignored mac addresses. name: gw-get-ignore-mac-address outputs: - contextPath: GCenter.Ignore.MacAddress.List.id description: Id. type: String - contextPath: GCenter.Ignore.MacAddress.List.created_at description: Created At. type: Date - contextPath: GCenter.Ignore.MacAddress.List.created_by description: Created By. type: String - contextPath: GCenter.Ignore.MacAddress.List.address description: Address. type: String - contextPath: GCenter.Ignore.MacAddress.List.is_startswith_pattern description: Should The Mac Addresses Be Ignored If They Start With This Address Value ? type: Boolean - arguments: - description: 'Set the lower timerange in minute based on the now keyword when uuid is not given Default value to 60 minutes.' name: timerange - description: 'Set the number of aggregate value that can be returned when uuid is not given Get all the values by default.' name: size - description: The uuid of the file to get. name: uuid - description: 'The state of the files to get, in list, when uuid is not given Default value to Infected,Suspicious.' name: state predefined: - '' description: 'Get a file from an uuid. If there is no uuid, get all the files infected from a time interval.' name: gw-get-file-infected outputs: - contextPath: Gcenter.File.Infected description: File infected. type: String runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.8.3296088 fromversion: 6.2.0 tests: - Gcenter Test Playbook