category: Analytics & SIEM
provider: IBM
sectionorder:
  - Connect
  - Collect
commonfields:
  id: IBMSecurityGuardium
  version: -1
configuration:
  - display: Server URL
    defaultvalue: https://guardium.security.ibm.com
    additionalinfo: Replace the default URL with your IBM Guardium instance URL.
    name: url
    required: true
    type: 0
    section: Connect
  - display: API Key
    displaypassword: API Secret
    name: credentials
    required: true
    type: 9
    section: Connect
  - display: Report ID
    name: report_id
    required: true
    type: 0
    section: Connect
  - display: Fetch events
    defaultvalue: "false"
    name: isFetchEvents
    required: false
    type: 8
    section: Collect
  - display: Maximum number of events to fetch
    defaultvalue: "10000"
    name: max_fetch
    required: false
    type: 0
    section: Collect
    additionalinfo: Recommended maximum is 10000.
  - display: Timestamp Field Name
    name: timestamp_field
    required: false
    type: 0
    section: Collect
    additionalinfo: The display name of the header in the report that contains the timestamp field, e.g., "Date created (local time)". Required when "Fetch events" is enabled.
  - display: Trust any certificate (not secure)
    name: insecure
    required: false
    type: 8
    section: Connect
  - display: Use system proxy settings
    name: proxy
    required: false
    type: 8
    section: Connect
description: Collect events from IBM Guardium Data Security Center.
display: IBM Security Guardium
name: IBMSecurityGuardium
script:
  commands:
    - arguments:
        - name: should_push_events
          auto: PREDEFINED
          defaultValue: "false"
          description: If true, the command creates events; otherwise, it only displays them.
          predefined:
            - "true"
            - "false"
          required: true
        - name: timestamp_field
          description: The name of the field in the event data that contains the timestamp. Required when should_push_events is true.
          required: false
        - name: limit
          description: Maximum number of results to return. Maximum allowed is 1000.
          required: false
          defaultValue: "50"
        - name: start_time
          description: Start time for fetching events. Supports ISO format ("2023-01-01T00:00:00") or natural language ("7 days ago", "yesterday", "1 week ago"). Defaults to 1 hour ago if not provided.
          required: false
        - name: end_time
          description: End time for fetching events. Supports ISO format ("2023-01-01T23:59:59") or natural language ("2 hours ago", "now"). If not provided, defaults to now.
          required: false
      description: Manual command to fetch and display events.
      name: ibm-guardium-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: "-"
  subtype: python3
  type: python
marketplaces:
  - marketplacev2
  - platform
fromversion: 6.10.0
supportedModules:
- xsiam
tests:
  - No tests (auto formatted)