category: Analytics & SIEM sectionorder: - Connect - Collect provider: Fortinet commonfields: id: Lacework version: -1 configuration: - display: 'Lacework Account Name (i.e. Sub-Domain of the URL: .lacework.net)' name: lacework_account required: true type: 0 section: Connect - display: Lacework Sub-Account Name (If Required) name: lacework_subaccount type: 0 required: false section: Connect - display: Lacework API Key name: lacework_api_key required: true type: 4 section: Connect - display: Lacework API Secret name: lacework_api_secret required: true type: 4 section: Connect - defaultvalue: high display: Lacework Alert Severity Threshold name: lacework_event_severity options: - critical - high - medium - low - informational required: true type: 15 section: Collect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 advanced: true section: Collect - defaultvalue: '7' display: Lacework Alert History to Import (in days) name: lacework_event_history options: - '1' - '2' - '3' - '4' - '5' - '6' - '7' type: 15 required: false section: Collect description: Lacework provides end-to-end cloud security automation for AWS, Azure, and GCP with a comprehensive view of risks across cloud workloads and containers. display: Lacework name: Lacework script: commands: - arguments: - description: The Lacework Alert ID to be retrieved. name: alert_id required: true - auto: PREDEFINED defaultValue: Details description: The scope of data to retrieve from Lacework for the specified Alert ID. name: scope predefined: - Details - Investigation - Events - RelatedAlerts - Integrations - Timeline description: Fetch details for a specific Alert in Lacework. name: lw-get-alert-details outputs: - contextPath: Lacework.Alert.startTime description: The start time of the alert. type: Date - contextPath: Lacework.Alert.endTime description: The end time of the alert. type: Date - contextPath: Lacework.Alert.alertType description: The type of the alert. type: String - contextPath: Lacework.Alert.alertName description: The name of the alert. type: String - contextPath: Lacework.Alert.alertId description: The ID of the alert. type: String - contextPath: Lacework.Alert.severity description: The severity of the alert. type: String - contextPath: Lacework.Alert.status description: The status of the alert. type: String - contextPath: Lacework.Alert.alertInfo.description description: The alert description provides why the potential threat occurred. type: String - contextPath: Lacework.Alert.alertInfo.subject description: The alert subject. In some cases, the alert subject can be the same as the alert name. type: String - contextPath: Lacework.Alert.entityMap description: The entity map for the alert. type: Unknown - arguments: - description: The AWS Account ID to use when fetching compliance data. name: account_id required: true - auto: PREDEFINED defaultValue: AWS_CIS_S3 description: The Report Type to fetch from Lacework. name: report_type predefined: - AWS_CIS_S3 - HIPAA - ISO_2700 - NIST_800-53_Rev4 - NIST_800-171_Rev2 - PCI - SOC - description: Setting the 'rec_id' will filter compliance results for the specified Recommendation ID. name: rec_id description: Fetch the latest AWS compliance data from Lacework. name: lw-get-aws-compliance-assessment outputs: - contextPath: Lacework.Compliance.reportType description: The Type of the compliance report. type: String - contextPath: Lacework.Compliance.reportTitle description: The Title of the compliance report. type: String - contextPath: Lacework.Compliance.recommendations.SUPPRESSIONS description: The suppressions for the current recommendation. type: String - contextPath: Lacework.Compliance.recommendations.INFO_LINK description: The URL to the compliance violation information. type: String - contextPath: Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT description: The number of assessed resources for the violation. type: Number - contextPath: Lacework.Compliance.recommendations.STATUS description: The status of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.REC_ID description: The ID of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.CATEGORY description: The category of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.SERVICE description: The service associated with the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.TITLE description: The title of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.region description: The region of the violating resource. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.reasons description: The reason for the violation. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.resource description: The resource causing the violation. type: String - contextPath: Lacework.Compliance.recommendations.RESOURCE_COUNT description: The number of resources associated with the compliance failure. type: Number - contextPath: Lacework.Compliance.recommendations.SEVERITY description: The severity of the compliance failure. type: Number - contextPath: Lacework.Compliance.summary.NUM_RECOMMENDATIONS description: The number of recommendations contained in the report. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE description: The number of Severity 2 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE description: The number of Severity 4 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE description: The number of severity 1 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_COMPLIANT description: The number of compliant resources. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE description: The number of severity 3 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT description: The number of assessed resources. type: Number - contextPath: Lacework.Compliance.summary.NUM_SUPPRESSED description: The number of suppressed alerts. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE description: The number of severity 5 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_NOT_COMPLIANT description: The number of resources not in compliance. type: Number - contextPath: Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT description: The number of resources violating compliance. type: Number - contextPath: Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT description: The number of resources with suppressed violations. type: Number - contextPath: Lacework.Compliance.accountId description: The AWS account ID. type: String - contextPath: Lacework.Compliance.accountAlias description: The AWS account alias. type: String - contextPath: Lacework.Compliance.tenantId description: The Azure tenant ID. type: String - contextPath: Lacework.Compliance.tenantName description: The Azure tenant name. type: String - contextPath: Lacework.Compliance.subscriptionId description: The Azure subscription ID. type: String - contextPath: Lacework.Compliance.subscriptionName description: The Azure subscription name. type: String - contextPath: Lacework.Compliance.projectId description: The GCP project ID. type: String - contextPath: Lacework.Compliance.projectName description: The GCP project name. type: String - contextPath: Lacework.Compliance.organizationId description: The GCP organization ID. type: String - contextPath: Lacework.Compliance.organizationName description: The GCP organization name. type: String - contextPath: Lacework.Compliance.reportTime description: The time the report completed. type: String - arguments: - description: The Azure Tenant ID to use when fetching compliance data. name: tenant_id required: true - description: The Azure Subscription ID to use when fetching compliance data. name: subscription_id required: true - auto: PREDEFINED defaultValue: AZURE_CIS description: The Report Type to fetch from Lacework. name: report_type predefined: - AZURE_CIS - AZURE_PCI - AZURE_SOC - description: Setting the 'rec_id' will filter compliance results for the specified Recommendation ID. name: rec_id description: Fetch the latest Azure compliance data from Lacework. name: lw-get-azure-compliance-assessment outputs: - contextPath: Lacework.Compliance.reportType description: The Type of the compliance report. type: String - contextPath: Lacework.Compliance.reportTitle description: The Title of the compliance report. type: String - contextPath: Lacework.Compliance.recommendations.SUPPRESSIONS description: The suppressions for the current recommendation. type: String - contextPath: Lacework.Compliance.recommendations.INFO_LINK description: The URL to the compliance violation information. type: String - contextPath: Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT description: The number of assessed resources for the violation. type: Number - contextPath: Lacework.Compliance.recommendations.STATUS description: The status of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.REC_ID description: The ID of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.CATEGORY description: The category of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.SERVICE description: The service associated with the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.TITLE description: The title of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.region description: The region of the violating resource. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.reasons description: The reason for the violation. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.resource description: The resource causing the violation. type: String - contextPath: Lacework.Compliance.recommendations.RESOURCE_COUNT description: The number of resources associated with the compliance failure. type: Number - contextPath: Lacework.Compliance.recommendations.SEVERITY description: The severity of the compliance failure. type: Number - contextPath: Lacework.Compliance.summary.NUM_RECOMMENDATIONS description: The number of recommendations contained in the report. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE description: The number of Severity 2 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE description: The number of Severity 4 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE description: The number of severity 1 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_COMPLIANT description: The number of compliant resources. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE description: The number of severity 3 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT description: The number of assessed resources. type: Number - contextPath: Lacework.Compliance.summary.NUM_SUPPRESSED description: The number of suppressed alerts. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE description: The number of severity 5 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_NOT_COMPLIANT description: The number of resources not in compliance. type: Number - contextPath: Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT description: The number of resources violating compliance. type: Number - contextPath: Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT description: The number of resources with suppressed violations. type: Number - contextPath: Lacework.Compliance.accountId description: The AWS account ID. type: String - contextPath: Lacework.Compliance.accountAlias description: The AWS account alias. type: String - contextPath: Lacework.Compliance.tenantId description: The Azure tenant ID. type: String - contextPath: Lacework.Compliance.tenantName description: The Azure tenant name. type: String - contextPath: Lacework.Compliance.subscriptionId description: The Azure subscription ID. type: String - contextPath: Lacework.Compliance.subscriptionName description: The Azure subscription name. type: String - contextPath: Lacework.Compliance.projectId description: The GCP project ID. type: String - contextPath: Lacework.Compliance.projectName description: The GCP project name. type: String - contextPath: Lacework.Compliance.organizationId description: The GCP organization ID. type: String - contextPath: Lacework.Compliance.organizationName description: The GCP organization name. type: String - contextPath: Lacework.Compliance.reportTime description: The time the report completed. type: String - arguments: - description: The GCP Project ID to use when fetching compliance data. name: project_id required: true - auto: PREDEFINED defaultValue: GCP_CIS description: The Report Type to fetch from Lacework. name: report_type predefined: - GCP_CIS - GCP_PCI - GCP_SOC - description: Setting the 'rec_id' will filter compliance results for the specified Recommendation ID. name: rec_id description: Fetch the latest GCP compliance data from Lacework. name: lw-get-gcp-compliance-assessment outputs: - contextPath: Lacework.Compliance.reportType description: The Type of the compliance report. type: String - contextPath: Lacework.Compliance.reportTitle description: The Title of the compliance report. type: String - contextPath: Lacework.Compliance.recommendations.SUPPRESSIONS description: The suppressions for the current recommendation. type: String - contextPath: Lacework.Compliance.recommendations.INFO_LINK description: The URL to the compliance violation information. type: String - contextPath: Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT description: The number of assessed resources for the violation. type: Number - contextPath: Lacework.Compliance.recommendations.STATUS description: The status of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.REC_ID description: The ID of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.CATEGORY description: The category of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.SERVICE description: The service associated with the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.TITLE description: The title of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.region description: The region of the violating resource. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.reasons description: The reason for the violation. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.resource description: The resource causing the violation. type: String - contextPath: Lacework.Compliance.recommendations.RESOURCE_COUNT description: The number of resources associated with the compliance failure. type: Number - contextPath: Lacework.Compliance.recommendations.SEVERITY description: The severity of the compliance failure. type: Number - contextPath: Lacework.Compliance.summary.NUM_RECOMMENDATIONS description: The number of recommendations contained in the report. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE description: The number of Severity 2 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE description: The number of Severity 4 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE description: The number of severity 1 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_COMPLIANT description: The number of compliant resources. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE description: The number of severity 3 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT description: The number of assessed resources. type: Number - contextPath: Lacework.Compliance.summary.NUM_SUPPRESSED description: The number of suppressed alerts. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE description: The number of severity 5 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_NOT_COMPLIANT description: The number of resources not in compliance. type: Number - contextPath: Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT description: The number of resources violating compliance. type: Number - contextPath: Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT description: The number of resources with suppressed violations. type: Number - contextPath: Lacework.Compliance.accountId description: The AWS account ID. type: String - contextPath: Lacework.Compliance.accountAlias description: The AWS account alias. type: String - contextPath: Lacework.Compliance.tenantId description: The Azure tenant ID. type: String - contextPath: Lacework.Compliance.tenantName description: The Azure tenant name. type: String - contextPath: Lacework.Compliance.subscriptionId description: The Azure subscription ID. type: String - contextPath: Lacework.Compliance.subscriptionName description: The Azure subscription name. type: String - contextPath: Lacework.Compliance.projectId description: The GCP project ID. type: String - contextPath: Lacework.Compliance.projectName description: The GCP project name. type: String - contextPath: Lacework.Compliance.organizationId description: The GCP organization ID. type: String - contextPath: Lacework.Compliance.organizationName description: The GCP organization name. type: String - contextPath: Lacework.Compliance.reportTime description: The time the report completed. type: String - arguments: - description: The GCP Organization ID to use when fetching projects data. name: organization_id required: true description: Fetch a list of GCP projects that are under an organization. name: lw-get-gcp-projects-by-organization outputs: - contextPath: Lacework.GCP.organization description: The GCP Organization. type: String - contextPath: Lacework.GCP.projects description: The GCP Projects associated to the Organization. type: String - arguments: - description: The primary ID that is used to fetch the report; for example, AWS Account ID or Azure Tenant ID. name: primary_query_id - description: The secondary ID that is used to fetch the report; for example, GCP Project ID or Azure Subscription ID. name: secondary_query_id - description: The report definition's name that is used when generating the report. name: report_name - auto: PREDEFINED defaultValue: LW_AWS_SEC_ADD_1_0 description: The report's notification type; for example, AZURE_NIST_CSF. name: report_type predefined: - AZURE_CIS - AZURE_CIS_131 - AZURE_SOC - AZURE_SOC_Rev2 - AZURE_PCI - AZURE_PCI_Rev2 - AZURE_ISO_27001 - AZURE_NIST_CSF - AZURE_NIST_800_53_REV5 - AZURE_NIST_800_171_REV2 - AZURE_HIPAA - AWS_CIS_S3 - NIST_800-53_Rev4 - NIST_800-171_Rev2 - ISO_2700 - HIPAA - SOC - AWS_SOC_Rev2 - GCP_HIPAA - PCI - GCP_CIS - GCP_SOC - GCP_CIS12 - GCP_K8S - GCP_PCI_Rev2 - GCP_SOC_Rev2 - GCP_HIPAA_Rev2 - GCP_ISO_27001 - GCP_NIST_CSF - GCP_NIST_800_53_REV4 - GCP_NIST_800_171_REV2 - GCP_PCI - AWS_CIS_14 - GCP_CIS13 - AWS_CMMC_1.02 - AWS_HIPAA - AWS_ISO_27001:2013 - AWS_NIST_CSF - AWS_NIST_800-171_rev2 - AWS_NIST_800-53_rev5 - AWS_PCI_DSS_3.2.1 - AWS_SOC_2 - LW_AWS_SEC_ADD_1_0 - defaultValue: Default description: The template's name that is used for the report; for example, Default. name: template_name required: true - description: Setting the 'rec_id' will filter compliance results for the specified Recommendation ID. name: rec_id description: Fetch a specified compliance report from Lacework. name: lw-get-compliance-report outputs: - contextPath: Lacework.Compliance.reportType description: The Type of the compliance report. type: String - contextPath: Lacework.Compliance.reportTitle description: The Title of the compliance report. type: String - contextPath: Lacework.Compliance.recommendations.SUPPRESSIONS description: The suppressions for the current recommendation. type: String - contextPath: Lacework.Compliance.recommendations.INFO_LINK description: The URL to the compliance violation information. type: String - contextPath: Lacework.Compliance.recommendations.ASSESSED_RESOURCE_COUNT description: The number of assessed resources for the violation. type: Number - contextPath: Lacework.Compliance.recommendations.STATUS description: The status of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.REC_ID description: The ID of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.CATEGORY description: The category of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.SERVICE description: The service associated with the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.TITLE description: The title of the recommendation. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.region description: The region of the violating resource. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.reasons description: The reason for the violation. type: String - contextPath: Lacework.Compliance.recommendations.VIOLATIONS.resource description: The resource causing the violation. type: String - contextPath: Lacework.Compliance.recommendations.RESOURCE_COUNT description: The number of resources associated with the compliance failure. type: Number - contextPath: Lacework.Compliance.recommendations.SEVERITY description: The severity of the compliance failure. type: Number - contextPath: Lacework.Compliance.summary.NUM_RECOMMENDATIONS description: The number of recommendations contained in the report. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_2_NON_COMPLIANCE description: The number of Severity 2 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_4_NON_COMPLIANCE description: The number of Severity 4 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_1_NON_COMPLIANCE description: The number of severity 1 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_COMPLIANT description: The number of compliant resources. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_3_NON_COMPLIANCE description: The number of severity 3 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.ASSESSED_RESOURCE_COUNT description: The number of assessed resources. type: Number - contextPath: Lacework.Compliance.summary.NUM_SUPPRESSED description: The number of suppressed alerts. type: Number - contextPath: Lacework.Compliance.summary.NUM_SEVERITY_5_NON_COMPLIANCE description: The number of severity 5 compliance violations. type: Number - contextPath: Lacework.Compliance.summary.NUM_NOT_COMPLIANT description: The number of resources not in compliance. type: Number - contextPath: Lacework.Compliance.summary.VIOLATED_RESOURCE_COUNT description: The number of resources violating compliance. type: Number - contextPath: Lacework.Compliance.summary.SUPPRESSED_RESOURCE_COUNT description: The number of resources with suppressed violations. type: Number - contextPath: Lacework.Compliance.accountId description: The AWS account ID. type: String - contextPath: Lacework.Compliance.accountAlias description: The AWS account alias. type: String - contextPath: Lacework.Compliance.tenantId description: The Azure tenant ID. type: String - contextPath: Lacework.Compliance.tenantName description: The Azure tenant name. type: String - contextPath: Lacework.Compliance.subscriptionId description: The Azure subscription ID. type: String - contextPath: Lacework.Compliance.subscriptionName description: The Azure subscription name. type: String - contextPath: Lacework.Compliance.projectId description: The GCP project ID. type: String - contextPath: Lacework.Compliance.projectName description: The GCP project name. type: String - contextPath: Lacework.Compliance.organizationId description: The GCP organization ID. type: String - contextPath: Lacework.Compliance.organizationName description: The GCP organization name. type: String - contextPath: Lacework.Compliance.reportTime description: The time the report completed. type: String - arguments: - description: A "%Y-%m-%dT%H:%M:%SZ" structured timestamp to begin from. (ex. "2020-01-01T01:10:00Z"). name: start_time - description: A "%Y-%m-%dT%H:%M:%SZ" structured timestamp to end at. (ex. "2020-01-01T01:10:00Z"). name: end_time - description: An array of objects to add information to refine your search results. name: filters - description: An array of strings to specify which top-level fields of the response schema you want to receive. name: returns - description: An integer representing a limit on the number or results to return. name: limit description: Fetch container vulnerability information from Lacework. name: lw-get-container-vulnerabilities outputs: - contextPath: Lacework.Vulnerability.Container.evalCtx.exception_props description: The exception properties that were applied in the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.evalCtx.image_info description: The image information for the container scanned in the evaluation. type: Date - contextPath: Lacework.Vulnerability.Container.evalCtx.integration_props description: The properties of the integration that performed the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.evalCtx.is_reeval description: A boolean representing whether the evaluation was a re-evaluation. type: Boolean - contextPath: Lacework.Vulnerability.Container.evalCtx.request_source description: The source of the evaluation request. type: String - contextPath: Lacework.Vulnerability.Container.evalCtx.scan_batch_id description: The scan batch ID for the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.evalCtx.scan_request_props description: The scan request properties for the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.evalCtx.vuln_batch_id description: The vulnerability batch ID for the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.evalCtx.vuln_created_time description: The time at which the vulnerability was created. type: Date - contextPath: Lacework.Vulnerability.Container.featureKey.name description: The name of the package identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.featureKey.namespace description: The namespace of the package identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.featureKey.version description: The version of the package identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.featureProps.feed description: The type of data feed used in the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.featureProps.introduced_in description: The Dockerfile command which introduced the vulnerability. type: String - contextPath: Lacework.Vulnerability.Container.featureProps.layer description: The SHA256 hash of the layer which introduced the vulnerability. type: String - contextPath: Lacework.Vulnerability.Container.featureProps.src description: The path within the container identifying the source of the vulnerability data. type: String - contextPath: Lacework.Vulnerability.Container.featureProps.version_format description: The format of the version data for the vulnerable package. type: String - contextPath: Lacework.Vulnerability.Container.fixInfo.fix_available description: An integer representing whether a fix is available for the vulnerability. type: Number - contextPath: Lacework.Vulnerability.Container.fixInfo.fixed_version description: The version in which the vulnerability is fixed for the CVE and package. type: String - contextPath: Lacework.Vulnerability.Container.imageId description: The image ID of the container identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.severity description: The severity of the vulnerability identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.startTime description: The start time for the vulnerability evaluation. type: Date - contextPath: Lacework.Vulnerability.Container.status description: The status of the vulnerability identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Container.vulnId description: The vulnerability ID (CVE, ALAS, etc.) type: String - contextPath: Lacework.Vulnerability.Container.vulnHash description: A unique hash of all data contained in the vulnerability. type: String - arguments: - description: A "%Y-%m-%dT%H:%M:%SZ" structured timestamp to begin from. (ex. "2020-01-01T01:10:00Z"). name: start_time - description: A "%Y-%m-%dT%H:%M:%SZ" structured timestamp to end at. (ex. "2020-01-01T01:10:00Z"). name: end_time - description: An array of objects to add information to refine your search results. name: filters - description: An array of strings to specify which top-level fields of the response schema you want to receive. name: returns - description: An integer representing a limit on the number or results to return. name: limit description: Fetch host vulnerability information from Lacework. name: lw-get-host-vulnerabilities outputs: - contextPath: Lacework.Vulnerability.Host.cveProps.description description: The CVE Properties description. type: String - contextPath: Lacework.Vulnerability.Host.cveProps.link description: The CVE Properties description URL. type: String - contextPath: Lacework.Vulnerability.Host.endTime description: The end time for the vulnerability evaluation period. type: Date - contextPath: Lacework.Vulnerability.Host.evalCtx.exception_props.status description: The status of any exception properties for the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.evalCtx.hostname description: The hostname of the host assessed in the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.evalCtx.mc_eval_guid description: The GUID for the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.featureKey.name description: The name of the package identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.featureKey.namespace description: The namespace of the package identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.featureKey.package_active description: An integer representing whether the package is Active on the host. type: Number - contextPath: Lacework.Vulnerability.Host.featureKey.version_installed description: The version of the package identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.fixInfo.fix_available description: An integer representing whether a fix is available for the vulnerability. type: String - contextPath: Lacework.Vulnerability.Host.fixInfo.fixed_version description: The version in which the vulnerability is fixed for the CVE and package. type: String - contextPath: Lacework.Vulnerability.Host.machineTags description: A string representing the machine tags in key/value pairs. type: String - contextPath: Lacework.Vulnerability.Host.mid description: The machine ID for the host identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.severity description: The severity of the vulnerability identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.startTime description: The start time for the vulnerability evaluation period. type: Date - contextPath: Lacework.Vulnerability.Host.status description: The status of the vulnerability identified in the evaluation. type: String - contextPath: Lacework.Vulnerability.Host.vulnId description: The vulnerability ID (CVE, ALAS, etc.) type: String - contextPath: Lacework.Vulnerability.Host.vulnHash description: A unique hash of all data contained in the vulnerability. type: String dockerimage: demisto/lacework:1.0.0.10133006 isfetch: true runonce: false script: '-' subtype: python3 type: python tests: - No Tests defaultmapperin: Lacework - Incoming Mapper defaultclassifier: Lacework - Classifier fromversion: 5.0.0