category: Network Security provider: Gatewatcher sectionorder: - Connect - Collect commonfields: id: GCenter 103 version: -1 configuration: - display: GCenter IP address or FQDN name: ip required: true type: 0 section: Connect additionalinfo: The IP address or the Fully Qualified Domain Name of the GCenter from where the events will be fetched. - displaypassword: GCenter API token name: token required: false hiddenusername: true type: 9 section: Connect - display: "GCenter account" name: credentials required: false type: 9 section: Connect - display: GCenter Version name: version required: false type: 0 section: Connect defaultvalue: 2.5.3.103 - display: Check the TLS certificate name: check_cert required: false type: 8 section: Collect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - name: fetch_type display: Fetch incidents from type defaultvalue: Alerts type: 15 options: - Alerts - Metadata - Both required: false section: Collect - name: engine_selection display: Engine alerts selection type: 16 options: - malcore - malcore_retroanalyzer - shellcode_detect - malicious_powershell_detect - sigflow_alert - dga_detect - active_cti - retrohunt - ransomware_detect - beacon_detect required: false section: Collect - display: First fetch name: first_fetch type: 0 additionalinfo: This value represents how far the first fetch will grab the events stored in the GCenter e.g. 2 days section: Collect required: false - defaultvalue: 200 display: Fetch limit name: max_fetch type: 0 additionalinfo: This value represents the maximum events fetched by instruction, this integration can handle up to 10000. The default value is 200 and is the optimum for Cortex XSOAR. section: Collect required: false - display: Incident type name: incidentType type: 13 section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true description: This integration fetch events generated by the GCenter appliance. display: GCenter 103 name: GCenter 103 script: runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 isfetch: true commands: - arguments: - description: Starting date filter. ISO-8601 date format. name: date_from - description: Ending data filter. ISO-8601 date format. name: date_to - auto: PREDEFINED description: Not compatible with date_from and date_to parameters. name: since predefined: - 15d - yesterday - description: A comma-separated list of alert IDs. name: ids isArray: true - description: A comma-separated list of alert IDs to exclude. name: excluded_ids isArray: true - auto: PREDEFINED description: Whether to filter on the acknowledgement status. name: acknowledged predefined: - "true" - "false" - description: Comma-separated list of GCap IDs. First GCap has ID 1. name: gcap_id isArray: true - description: Comma-separated list of IP addresses of the alerts. name: ip isArray: true - description: Comma-separated list of source IP addresses of the alerts. name: src_ip isArray: true - description: Comma-separated list of destination IP addresses of the alerts. name: dest_ip isArray: true - description: Minimal risk value. name: risk_min - description: Maximal risk value. name: risk_max - description: Filter on alert signature. Comma-separated list of signatures. name: name isArray: true - description: Filter alerts on their description. name: description - description: Filter on alerts containing tags. Comma-separated list of tag names. name: tag isArray: true - auto: PREDEFINED description: Whether to include users with no tags. name: no_tag predefined: - "true" - "false" - description: Filter out alerts containing tags. Comma-separated list of tags. Logical OR between the tags. name: excluded_tags isArray: true - auto: PREDEFINED description: The filter by which to sort the results. name: sort_by predefined: - date - -date - risk - -risk - name - -name - auto: PREDEFINED description: The type by which to filter alerts on engines. name: type predefined: - active_cti - beacon_detect - dga_detect - malcore - malcore_retroanalyzer - malicious_powershell_detect - ransomware_detect - retrohunt - shellcode_detect - sigflow_alert - auto: PREDEFINED description: Filter alert by MITRE tactic name. name: mitre_tactic_name predefined: - Collection - Collection (ICS) - Collection (Mobile) - Command and Control - Command and Control (ICS) - Command and Control (Mobile) - Credential Access - Credential Access (Mobile) - Defense Evasion - Defense Evasion (Mobile) - Discovery, Discovery (ICS) - Discovery (Mobile) - Evasion - Execution - Execution (ICS) - Execution (Mobile) - Exfiltration - Exfiltration (Mobile) - Impact - Impact (ICS) - Impact (Mobile) - Impair Process Control - Inhibit Response Function - Initial Access - Initial Access (ICS) - Initial Access (Mobile) - Lateral Movement - Lateral Movement (ICS) - Lateral Movement (Mobile) - Persistence - Persistence (ICS) - Persistence (Mobile) - Privilege Escalation - Privilege Escalation (ICS) - Privilege Escalation (Mobile) - Reconnaissance - Resource Development - description: Comma-separated list of hostnames. name: hostname isArray: true - description: Comma-separated list of source hostnames. name: src_hostname isArray: true - description: Comma-separated list of destination hostnames. name: dest_hostname isArray: true - description: Comma-separated list of usernames. name: username isArray: true - description: User note content. name: note - auto: PREDEFINED description: Filter alerts on their state. name: state predefined: - closed - mute - open - description: A search term. name: search - description: A page to select in the results set. name: page - description: Number of results per page. name: page_size name: gcenter103-alerts-list description: List all alerts. deprecated: false outputs: - contextPath: Gatewatcher.Alerts.List.uuid description: Alert UUIDs. type: string - arguments: - description: UUID or GCenter ID of the alert. name: uuid required: true name: gcenter103-alerts-get description: Get an alert with its UUID (corresponds to event.id field) or the GCenter ID of the alert. deprecated: false outputs: - contextPath: Gatewatcher.Alerts.Get.uuid description: The UUID of the alert fetched. type: string - arguments: - description: The note to set on the alert. name: note required: true - description: The UUID of the alert to set the note on (corresponds to event.id field). name: uuid required: true - auto: PREDEFINED description: Whether to overwrite the note. name: overwrite required: true predefined: - "true" - "false" name: gcenter103-alerts-note-add description: Add or update a note to an alert. deprecated: false outputs: - contextPath: Gatewatcher.Alerts.Note.Add.note description: The note added to the alert. type: string - arguments: - description: The UUID of the alert to delete the note on (corresponds to event.id field). name: uuid required: true name: gcenter103-alerts-note-remove description: Delete the note of an alert. deprecated: false outputs: - contextPath: Gatewatcher.Alerts.Note.Remove.uuid description: The UUID of the alert whose note was removed. type: string - arguments: - description: The UUID of the alert to get tags (corresponds to event.id field). name: uuid required: true name: gcenter103-alerts-tags-get description: Get the tags of an alert. deprecated: false outputs: - contextPath: Gatewatcher.Alerts.Tags.Get.tags description: The tags of the alert. type: string - contextPath: Gatewatcher.Alerts.Tags.Get.uuid description: The UUID of the alert having these tags. type: string - arguments: - description: The UUID of the alert to add tags (corresponds to event.id field). name: uuid required: true - description: A comma-separated list of tag names to add to the alert. name: tags required: true isArray: true name: gcenter103-alerts-tags-add description: Add or update tags of an alert. deprecated: false outputs: - contextPath: Gatewatcher.Alerts.Tags.Add.tags description: The tags added to the alert. type: string - contextPath: Gatewatcher.Alerts.Tags.Add.uuid description: The UUID of the alert where the tags were added. type: string - arguments: - description: The UUID of the alert from which to remove tags (corresponds to event.id field). name: uuid required: true - description: A comma-separated list of tag names to remove to the alert. name: tags required: true isArray: true name: gcenter103-alerts-tags-remove description: Remove tags from an alert. deprecated: false outputs: - contextPath: Gatewatcher.Alerts.Tags.Remove description: The tags present in the alert. type: string - arguments: - description: A note to add/update. name: note_u - description: Tags to add/update. name: tag_u isArray: true - description: Starting date filter. ISO-8601 date format. name: date_from - description: Ending data filter. ISO-8601 date format. name: date_to - auto: PREDEFINED description: Not compatible with date_from and date_to parameters. name: since predefined: - 15d - yesterday - description: UUID of the alert to perform action (corresponds to event.id field). name: uuid required: true - auto: PREDEFINED description: Whether to filter on the acknowledgement status. name: acknowledged predefined: - "true" - "false" - description: Comma-separated list of GCap IDs. First GCap has ID 1. name: gcap_id isArray: true - description: Comma-separated list of IP addresses of the alerts. name: ip isArray: true - description: Comma-separated list of source IP addresses of the alerts. name: src_ip isArray: true - description: Comma-separated list of destination IP addresses of the alerts. name: dest_ip isArray: true - description: Minimal risk value. name: risk_min - description: Maximal risk value. name: risk_max - description: Filter on alert signature. Comma-separated list of signatures. name: name isArray: true - description: Filter alerts on their description. name: description - description: Filter on alerts containing tags. Comma-separated list of tag names. name: tag isArray: true - auto: PREDEFINED description: Whether to include users with no tags. name: no_tag predefined: - "true" - "false" - description: Filter out alerts containing tags. Comma-separated list of tags. Logical OR between the tags. name: excluded_tags isArray: true - auto: PREDEFINED description: The filter by which to sort the results. name: sort_by predefined: - date - -date - risk - -risk - name - -name - auto: PREDEFINED description: The type by which to filter alerts on engines. name: type predefined: - active_cti - beacon_detect - dga_detect - malcore - malcore_retroanalyzer - malicious_powershell_detect - ransomware_detect - retrohunt - shellcode_detect - sigflow_alert - auto: PREDEFINED description: Filter alert by MITRE tactic name. name: mitre_tactic_name predefined: - Collection - Collection (ICS) - Collection (Mobile) - Command and Control - Command and Control (ICS) - Command and Control (Mobile) - Credential Access - Credential Access (Mobile) - Defense Evasion - Defense Evasion (Mobile) - Discovery, Discovery (ICS) - Discovery (Mobile) - Evasion - Execution - Execution (ICS) - Execution (Mobile) - Exfiltration - Exfiltration (Mobile) - Impact - Impact (ICS) - Impact (Mobile) - Impair Process Control - Inhibit Response Function - Initial Access - Initial Access (ICS) - Initial Access (Mobile) - Lateral Movement - Lateral Movement (ICS) - Lateral Movement (Mobile) - Persistence - Persistence (ICS) - Persistence (Mobile) - Privilege Escalation - Privilege Escalation (ICS) - Privilege Escalation (Mobile) - Reconnaissance - Resource Development - description: Comma-separated list of hostnames. name: hostname isArray: true - description: Comma-separated list of source hostnames. name: src_hostname isArray: true - description: Comma-separated list of destination hostnames. name: dest_hostname isArray: true - description: Comma-separated list of usernames. name: username isArray: true - description: User note content. name: note - auto: PREDEFINED description: Filter alerts on their state. name: state predefined: - closed - mute - open - description: A search term. name: search - auto: PREDEFINED description: The action to perform on the alerts. name: action predefined: - acknowledge - open - tag - untag - note - open_related - close_related - mute_signature - unmute_signature required: true name: gcenter103-alerts-status-update description: Update status of an alert. deprecated: false outputs: - contextPath: Gatewatcher.Alerts.Status.Update description: The updated status of the alerts. type: string - arguments: - description: UUID of the alert to fetch (corresponds to event.id field). name: uuid required: true name: gcenter103-raw-alerts-get description: Get a raw alert with its UUID. deprecated: false outputs: - contextPath: Gatewatcher.Raw.Alerts.Get description: The alert content. type: string - arguments: - description: UUID of the alert to fetch (corresponds to event.id field). name: uuid required: true name: gcenter103-raw-alerts-file-get description: Get a file attached to an alert with its UUID. deprecated: false outputs: - contextPath: Gatewatcher.Raw.Alerts.File.Get description: The zip file. type: string - arguments: - auto: PREDEFINED description: Engine that will scan the file. name: engine required: true predefined: - malcore - powershell - shellcode - description: Entry ID of the file to scan. name: entryID required: true name: gcenter103-file-scan description: Scan a file on a selected engine. You must upload the file to scan before execution. deprecated: false outputs: - contextPath: Gatewatcher.File.Scan description: Results of the scan. type: string - arguments: - description: ID of a previous file scan. name: id required: true name: gcenter103-file-scan-result-get description: Retrieve previous scan by its ID. deprecated: false outputs: - contextPath: Gatewatcher.File.Scan.Result.Get description: Result of the file scan. type: string - arguments: - description: Starting date filter. ISO-8601 date format. name: date_from - description: Ending data filter. ISO-8601 date format. name: date_to - auto: PREDEFINED description: Not compatible with date_from and date_to parameters. name: since predefined: - 15d - yesterday - description: Comma-separated list of GCap IDs. First GCap has ID 1. name: gcap_id isArray: true - description: Comma-separated list of IP addresses of the alerts. name: ip isArray: true - description: Minimal risk value. name: risk_min - description: Maximal risk value. name: risk_max - description: Comma-separated list of hostnames of the asset. name: name isArray: true - description: Filter on assets containing tags. Comma-separated list of tag names. name: tag isArray: true - auto: PREDEFINED description: Whether to include users with no tags. name: no_tag predefined: - "true" - "false" - auto: PREDEFINED description: The filter by which to sort the results. name: sort_by predefined: - risk - -risk - name - -name - auto: PREDEFINED description: Asset type. name: type predefined: - Smartphone - IoT - Laptop - Videogame - TV - Other - Firewall - Hypervisor - IPBX - Printer - Proxy - Router - Server - Storage - Virtual Machine - WAF - WiFi - unknown - description: Asset note content. name: note - description: A search term. name: search - description: A page to select in the results set. name: page - description: Number of results per page. name: page_size - auto: PREDEFINED description: The fast mode uses cached data to present faster results. Disabled by default. name: fast predefined: - "true" - "false" - description: OS/Firwmare of the asset. name: os_firmware - description: Asset MAC addresses. name: mac_address name: gcenter103-assets-list description: List all assets. deprecated: false outputs: - contextPath: Gatewatcher.Assets.List description: List of assets. type: string - arguments: - description: Starting date filter. ISO-8601 date format. name: date_from - description: Ending data filter. ISO-8601 date format. name: date_to - auto: PREDEFINED description: Not compatible with date_from and date_to parameters. name: since predefined: - 15d - yesterday - description: A comma-separated list of alert IDs. name: ids isArray: true - description: A comma-separated list of alert IDs to exclude. name: excluded_ids isArray: true - auto: PREDEFINED description: Whether to filter on the acknowledgement status. name: acknowledged predefined: - "true" - "false" - description: Comma-separated list of GCap IDs. First GCap has ID 1. name: gcap_id isArray: true - description: Comma-separated list of IP addresses of the alerts. name: ip isArray: true - description: Comma-separated list of source IP addresses of the alerts. name: src_ip isArray: true - description: Comma-separated list of destination IP addresses of the alerts. name: dest_ip isArray: true - description: Minimal risk value. name: risk_min - description: Maximal risk value. name: risk_max - description: Filter on alert signature. Comma-separated list of signatures. name: name isArray: true - description: Filter alerts on their description. name: description - description: Filter on alerts containing tags. Comma-separated list of tag names. name: tag isArray: true - auto: PREDEFINED description: Whether to include users with no tags. name: no_tag predefined: - "true" - "false" - description: Filter out alerts containing tags. Comma-separated list of tags. Logical OR between the tags. name: excluded_tags isArray: true - auto: PREDEFINED description: The filter by which to sort the results. name: sort_by predefined: - date - -date - risk - -risk - name - -name - auto: PREDEFINED description: The type by which to filter alerts on engines. name: type predefined: - active_cti - beacon_detect - dga_detect - malcore - malcore_retroanalyzer - malicious_powershell_detect - ransomware_detect - retrohunt - shellcode_detect - sigflow_alert - auto: PREDEFINED description: Filter alert by MITRE tactic name. name: mitre_tactic_name predefined: - Collection - Collection (ICS) - Collection (Mobile) - Command and Control - Command and Control (ICS) - Command and Control (Mobile) - Credential Access - Credential Access (Mobile) - Defense Evasion - Defense Evasion (Mobile) - Discovery, Discovery (ICS) - Discovery (Mobile) - Evasion - Execution - Execution (ICS) - Execution (Mobile) - Exfiltration - Exfiltration (Mobile) - Impact - Impact (ICS) - Impact (Mobile) - Impair Process Control - Inhibit Response Function - Initial Access - Initial Access (ICS) - Initial Access (Mobile) - Lateral Movement - Lateral Movement (ICS) - Lateral Movement (Mobile) - Persistence - Persistence (ICS) - Persistence (Mobile) - Privilege Escalation - Privilege Escalation (ICS) - Privilege Escalation (Mobile) - Reconnaissance - Resource Development - description: Comma-separated list of hostnames. name: hostname isArray: true - description: Comma-separated list of source hostnames. name: src_hostname isArray: true - description: Comma-separated list of destination hostnames. name: dest_hostname isArray: true - description: Comma-separated list of usernames. name: username isArray: true - description: User note content. name: note - auto: PREDEFINED description: Filter alerts on their state. name: state predefined: - closed - mute - open - description: A page number within the results pages. name: page - description: Number of results per page. name: page_size - description: Name of the asset. name: asset_name required: true name: gcenter103-assets-alerts-get description: Retrieve alerts of a given asset. deprecated: false outputs: - contextPath: Gatewatcher.Assets.Alerts.Get description: Get alerts for an asset. type: string - arguments: - description: Starting date filter. ISO-8601 date format. name: date_from - description: Ending data filter. ISO-8601 date format. name: date_to - auto: PREDEFINED description: Not compatible with date_from and date_to parameters. name: since predefined: - 15d - yesterday - auto: PREDEFINED description: The fast mode uses cached data to present faster results. Disabled by default. name: fast predefined: - "true" - "false" - description: Asset name. name: asset_name required: true name: gcenter103-assets-get description: Retrieve specific asset data. deprecated: false outputs: - contextPath: Gatewatcher.Assets.Get description: Asset data. type: string - arguments: - description: Asset name. name: asset_name required: true - description: Note to update. name: note required: true - auto: PREDEFINED description: Whether to overwrite the note. name: overwrite required: true predefined: - "true" - "false" name: gcenter103-assets-note-add description: Add or update a note to an asset. deprecated: false outputs: - contextPath: Gatewatcher.Assets.Note.Add description: The note added or updated. type: string - arguments: - description: Asset name. name: asset_name required: true name: gcenter103-assets-note-remove description: Remove a note from an asset. deprecated: false outputs: - contextPath: Gatewatcher.Assets.Note.Remove description: The request response code. type: string - arguments: - description: Asset name. name: asset_name required: true name: gcenter103-assets-tags-get description: Get the tags of an asset. deprecated: false outputs: - contextPath: Gatewatcher.Assets.Tags.Get description: The tags of the asset. type: string - arguments: - description: Asset name. name: asset_name required: true - description: A comma-separated list of tag names to add to the asset. name: tags isArray: true required: true name: gcenter103-assets-tags-add description: Add or update the tags of an asset. deprecated: false outputs: - contextPath: Gatewatcher.Assets.Tags.Add description: Added or updated tags of the asset. type: string - arguments: - description: Asset name. name: asset_name required: true - description: A comma-separated list of tag names to remove to the asset. name: tags isArray: true required: true name: gcenter103-assets-tags-remove description: Remove tags of an asset. deprecated: false outputs: - contextPath: Gatewatcher.Assets.Tags.Remove description: Removed tags of the asset. type: string - arguments: - description: A search term. name: search - description: A page to select in the results set. name: page - description: Number of results per page. name: page_size - description: Starting date filter. ISO-8601 date format. name: date_from - description: Ending data filter. ISO-8601 date format. name: date_to - auto: PREDEFINED description: Not compatible with date_from and date_to parameters. name: since predefined: - 15d - yesterday - auto: PREDEFINED description: The fast mode uses cached data to present faster results. Disabled by default. name: fast predefined: - "true" - "false" - description: Comma-separated list of GCap IDs. First GCap has ID 1. name: gcap_id - auto: PREDEFINED description: The filter by which to sort the results. name: sort_by predefined: - risk - -risk - name - -name - description: Minimal risk value. name: risk_min - description: Maximal risk value. name: risk_max - description: Comma-separated list of usernames. name: username isArray: true - description: Comma-separated list of IP addresses of the alerts. name: ip isArray: true - description: Comma-separated list of hostnames. name: hostname isArray: true - description: Filter on users containing tags. Comma-separated list of tag names. name: tag isArray: true - description: User note content. name: note - auto: PREDEFINED description: Whether to include users with no tags. name: no_tag predefined: - "true" - "false" name: gcenter103-users-list description: Retrieves a list of Kerberos users. deprecated: false outputs: - contextPath: Gatewatcher.Users.List description: The list of Kerberos users. type: string - arguments: - description: Starting date filter. ISO-8601 date format. name: date_from - description: Ending data filter. ISO-8601 date format. name: date_to - auto: PREDEFINED description: Not compatible with date_from and date_to parameters. name: since predefined: - 15d - yesterday - description: A comma-separated list of alert IDs. name: ids isArray: true - description: A comma-separated list of alert IDs to exclude. name: excluded_ids isArray: true - auto: PREDEFINED description: Whether to filter on the acknowledgement status. name: acknowledged predefined: - "true" - "false" - description: Comma-separated list of GCap IDs. First GCap has ID 1. name: gcap_id isArray: true - description: Comma-separated list of IP addresses of the alerts. name: ip isArray: true - description: Comma-separated list of source IP addresses of the alerts. name: src_ip isArray: true - description: Comma-separated list of destination IP addresses of the alerts. name: dest_ip isArray: true - description: Minimal risk value. name: risk_min - description: Maximal risk value. name: risk_max - description: Filter on alert signature. Comma-separated list of signatures. name: name isArray: true - description: Filter alerts on their description. name: description - description: Filter on users containing tags. Comma-separated list of tag names. name: tag isArray: true - auto: PREDEFINED description: Whether to include users with no tags. name: no_tag predefined: - "true" - "false" - description: Filter out alerts containing tags. Comma-separated list of tags. Logical OR between the tags. name: excluded_tags isArray: true - auto: PREDEFINED description: The filter by which to sort the results. name: sort_by predefined: - date - -date - risk - -risk - name - -name - auto: PREDEFINED description: The type by which to filter alerts on engines. name: type predefined: - active_cti - beacon_detect - dga_detect - malcore - malcore_retroanalyzer - malicious_powershell_detect - ransomware_detect - retrohunt - shellcode_detect - sigflow_alert - auto: PREDEFINED description: Filter alert by MITRE tactic name. name: mitre_tactic_name predefined: - Collection - Collection (ICS) - Collection (Mobile) - Command and Control - Command and Control (ICS) - Command and Control (Mobile) - Credential Access - Credential Access (Mobile) - Defense Evasion - Defense Evasion (Mobile) - Discovery, Discovery (ICS) - Discovery (Mobile) - Evasion - Execution - Execution (ICS) - Execution (Mobile) - Exfiltration - Exfiltration (Mobile) - Impact - Impact (ICS) - Impact (Mobile) - Impair Process Control - Inhibit Response Function - Initial Access - Initial Access (ICS) - Initial Access (Mobile) - Lateral Movement - Lateral Movement (ICS) - Lateral Movement (Mobile) - Persistence - Persistence (ICS) - Persistence (Mobile) - Privilege Escalation - Privilege Escalation (ICS) - Privilege Escalation (Mobile) - Reconnaissance - Resource Development - description: Comma-separated list of hostnames. name: hostname isArray: true - description: Comma-separated list of source hostnames. name: src_hostname isArray: true - description: Comma-separated list of destination hostnames. name: dest_hostname isArray: true - description: Comma-separated list of usernames. name: username isArray: true - description: User note content. name: note - auto: PREDEFINED description: Filter alerts on their state. name: state predefined: - closed - mute - open - description: A page number within the results pages. name: page - description: Number of results per page. name: page_size - description: Alerts of this Kerberos user name. name: kuser_name required: true name: gcenter103-users-alerts-get description: Retrieves a list of the alerts of a Kerberos user. deprecated: false outputs: - contextPath: Gatewatcher.Users.Alerts.Get description: The list of alerts of a Kerberos user. type: string - arguments: - description: Starting date filter. ISO-8601 date format. name: date_from - description: Ending data filter. ISO-8601 date format. name: date_to - auto: PREDEFINED description: Not compatible with date_from and date_to parameters. name: since predefined: - 15d - yesterday - auto: PREDEFINED description: The fast mode uses cached data to present faster results. Disabled by default. name: fast predefined: - "true" - "false" - description: Alerts of this Kerberos user name. name: kuser_name required: true name: gcenter103-users-get description: Retrieves Kerberos user data. deprecated: false outputs: - contextPath: Gatewatcher.Users.Get description: Get information of a Kerberos user. type: string - arguments: - description: Note content to add/update. name: note required: true - description: Kerberos user name. name: kuser_name required: true - auto: PREDEFINED description: Whether to overwrite the note. name: overwrite required: true predefined: - "true" - "false" name: gcenter103-users-note-add description: Add or update the note of a Kerberos user. deprecated: false outputs: - contextPath: Gatewatcher.Users.Note.Add description: Added/updated note. type: string - arguments: - description: Kerberos user name. name: kuser_name required: true name: gcenter103-users-note-remove description: Remove the note of a Kerberos user. deprecated: false outputs: - contextPath: Gatewatcher.Users.Note.Remove description: Request response code. type: string - arguments: - description: Kerberos user name to get tags of. name: kuser_name required: true name: gcenter103-users-tags-get description: Get the tags of a Kerberos user. deprecated: false outputs: - contextPath: Gatewatcher.Users.Tags.Get description: The tags associated to the Kerberos user. type: string - arguments: - description: A comma-separated list of tags to add to the Kerberos user. name: tags required: true isArray: true - description: Kerberos user name to add tags of. name: kuser_name required: true name: gcenter103-users-tags-add description: Add or update the tags of a Kerberos user. deprecated: false outputs: - contextPath: Gatewatcher.Users.Tags.Add description: Added/updated tags associated to the Kerberos user. type: string - arguments: - description: A comma-separated list of tag names to remove to the Kerberos user. name: tags required: true isArray: true - description: Kerberos user name to remove tags from. name: kuser_name required: true name: gcenter103-users-tags-remove description: Remove tags of a Kerberos user. deprecated: false outputs: - contextPath: Gatewatcher.Users.Tags.Remove description: Tags of the Kerberos user. type: string - arguments: - auto: PREDEFINED description: Export state. name: export predefined: - "true" - "false" name: gcenter103-yara-rules-get description: Get YARA settings. deprecated: false outputs: - contextPath: Gatewatcher.Yara.Rules.Get description: The YARA settings. type: string - arguments: - auto: PREDEFINED description: Set if YARA is enabled or not. name: enabled required: true predefined: - "true" - "false" - description: Name of the YARA ruleset. name: name required: true - description: EntryID of the YARA file. name: entryID required: true name: gcenter103-yara-rules-add description: Add YARA rules to Malcore. You must upload the YARA file before execution. deprecated: false outputs: - contextPath: Gatewatcher.Yara.Rules.Add description: The updated YARA settings. type: string - arguments: - auto: PREDEFINED description: The order by which the results should be sorted. name: ordering predefined: - created - sha256 - user - -created - -sha256 - -user - description: A page to select in the results set. name: page - auto: PREDEFINED description: The type of list given. name: list_type predefined: - white - black required: true name: gcenter103-malcore-fingerprints-get description: Get fingerprints of the white or black list of Malcore. deprecated: false outputs: - contextPath: Gatewatcher.Malcore.Fingerprints.Get description: Hash list informations. type: string - arguments: - description: The SHA256 to add. name: sha256 required: true - description: An attached comment (200 chars max). name: comment required: true - description: Name of the threat for reference (100 chars max). name: threat required: true - auto: PREDEFINED description: The type of list given. name: list_type required: true predefined: - white - black name: gcenter103-malcore-fingerprints-add description: Add fingerprints to white or black list to Malcore. deprecated: false outputs: - contextPath: Gatewatcher.Malcore.Fingerprints.Add description: Hash list informations. type: string - arguments: - description: The SHA256 to remove. name: sha256 required: true - auto: PREDEFINED description: The type of list to remove from. name: list_type predefined: - white - black required: true name: gcenter103-malcore-fingerprints-remove description: Remove fingerprints to white or black list to Malcore. deprecated: false outputs: - contextPath: Gatewatcher.Malcore.Fingerprints.Remove description: Hash list informations. type: string fromversion: 6.5.0 defaultclassifier: Gatewatcher Incidents Classifier defaultmapperin: Gatewatcher Mapper Incoming tests: - No tests