display: Ironscales Event Collector
name: Ironscales Event Collector
category: Email
provider: Ironscales
sectionorder:
- Connect
- Collect
commonfields:
  id: Ironscales Event Collector
  version: -1
configuration:
- defaultvalue: https://appapi.ironscales.com
  display: Server URL (e.g., https://appapi.ironscales.com)
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  name: apikey
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Company ID
  name: company_id
  required: true
  type: 0
  section: Connect
- display: Scopes (e.g., "company.all")
  name: scopes
  required: true
  type: 0
  section: Connect
- defaultvalue: '1000'
  display: Maximum number of events per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 3 days
  display: First fetch
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Collect all events
  name: collect_all_events
  type: 8
  section: Collect
  required: false
  additionalinfo: Fetch all events instead of only open events.
- display: Fetch mailbox mitigation details
  name: mailbox_enrichment
  defaultvalue: 'false'
  type: 8
  section: Collect
  required: false
  additionalinfo: Whether to fetch the affected mailbox mitigation details as part of the event data.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Use this integration to fetch email security incidents from Ironscales as XSIAM events.
script:
  commands:
  - arguments:
    - description: The number of events to return.
      name: limit
      defaultValue: 10
    - defaultValue: 3 days
      description: The start time by which to filter events. Date format will be the same as in the first_fetch parameter.
      name: since_time
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to include the affected mailboxes mitigation details in the event data.
      name: mailbox_enrichment
      predefined:
      - 'true'
      - 'false'
      required: false
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    description: Gets events from Ironscales. This command is intended for development and debugging purposes and is to be used with caution as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism.
    name: ironscales-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  script: ''
  subtype: python3
  type: python
fromversion: 8.2.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam