commonfields:
  id: LogRhythmRest V2
  version: -1
name: LogRhythmRest V2
display: LogRhythmRest v2
fromversion: 5.5.0
category: Analytics & SIEM
provider: Exabeam
description: LogRhythm security intelligence.
configuration:
- name: url
  display: Server URL
  type: 0
  required: true
- displaypassword: API Token
  name: credentials
  type: 9
  required: true
  hiddenusername: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- defaultvalue: '100'
  display: Alarms max fetch
  name: alarmsMaxFetch
  type: 0
  required: false
- defaultvalue: '100'
  display: Cases max fetch
  name: casesMaxFetch
  type: 0
  required: false
- display: Fetch incidents from type
  name: fetchType
  defaultvalue: Both
  type: 15
  required: true
  options:
  - Alarms
  - Cases
  - Both
- display: Alarm status filter
  name: alarm_status_filter
  type: 15
  options:
  - New
  - Opened
  - Working
  - Escalated
  - Closed
  - Closed_FalseAlarm
  - Closed_Resolved
  - Closed_Unresolved
  - Closed_Reported
  - Closed_Monitor
  required: false
- display: Alarm rule name filter
  name: alarm_rule_name_filter
  defaultvalue: ''
  type: 0
  required: false
- display: Case tags filter
  name: case_tags_filter
  defaultvalue: ''
  type: 0
  required: false
- display: Case status filter
  name: case_status_filter
  type: 15
  options:
  - Created
  - Completed
  - Incident
  - Mitigated
  - Resolved
  required: false
- display: Case priority filter
  name: case_priority_filter
  type: 15
  options:
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  required: false
- display: Fetch case evidences
  name: fetch_case_evidences
  type: 8
  required: false
- name: proxy
  display: Use system proxy settings
  type: 8
  required: false
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  required: false
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  commands:
  - name: lr-alarms-list
    description: 'Gets the details of the alarms using the filter criteria.'
    arguments:
    - name: alarm_status
      description: 'The alarm status. Possible values: "New", "Opened", "Working", "Escalated", Closed, "Closed_FalseAlarm", "Closed_Resolved", "Closed_Unresolved", "Closed_Reported", "Closed_Monitor".'
      auto: PREDEFINED
      predefined:
      - New
      - Opened
      - Working
      - Escalated
      - Closed
      - Closed_FalseAlarm
      - Closed_Resolved
      - Closed_Unresolved
      - Closed_Reported
      - Closed_Monitor
    - name: offset
      defaultValue: "0"
      description: 'The number of alarms to skip before starting to collect the result set.'
    - name: count
      defaultValue: "50"
      description: 'The numbers of alarms to return.'
    - name: alarm_rule_name
      description: 'Filter by alarm rule name.'
    - name: entity_name
      description: 'Filter by entity name.'
    - name: alarm_id
      description: 'Filter by alarm ID.'
    - name: case_association
      description: 'Filter by case ID.'
    outputs:
    - type: Number
      contextPath: LogRhythm.Alarm.alarmId
      description: 'The alarm ID.'
    - type: String
      contextPath: LogRhythm.Alarm.alarmDataCached
      description: 'A flag indicating whether the alarm data is cached.'
    - type: String
      contextPath: LogRhythm.Alarm.alarmRuleName
      description: 'The alarm rule name.'
    - type: String
      contextPath: LogRhythm.Alarm.alarmStatus
      description: 'The alarm status.'
    - type: Date
      contextPath: LogRhythm.Alarm.dateInserted
      description: 'The alarm date inserted.'
    - type: String
      contextPath: LogRhythm.Alarm.entityName
      description: 'The alarm entity name.'
    - type: String
      contextPath: LogRhythm.Alarm.associatedCases
      description: 'The alarm associated cases.'
  - name: lr-alarm-update
    description: 'Updates the alarm status and RBP based on the alarm ID supplied. alarm_status or rbp are required.'
    arguments:
    - name: alarm_id
      description: 'The alarm ID.'
      required: true
    - name: alarm_status
      description: 'The alarm status. Possible values: "New", "Opened", "Working", "Escalated", Closed, "Closed_FalseAlarm", "Closed_Resolved", "Closed_Unresolved", "Closed_Reported", "Closed_Monitor".'
      auto: PREDEFINED
      predefined:
      - New
      - Opened
      - Working
      - Escalated
      - Closed
      - Closed_FalseAlarm
      - Closed_Resolved
      - Closed_Unresolved
      - Closed_Reported
      - Closed_Monitor
    - name: rbp
      description: 'The alarm rbp.'
    outputs: []
  - name: lr-alarm-add-comment
    description: 'Updates the Alarm History table with comments in the Comments column based on the alarm ID supplied.'
    arguments:
    - name: alarm_id
      description: 'The alarm ID.'
      required: true
    - name: alarm_comment
      description: 'The alarm comment.'
      required: true
    outputs: []
  - name: lr-alarm-history-list
    description: 'Gets the alarm history details by ID and filter criteria.'
    arguments:
    - name: alarm_id
      description: 'The alarm ID.'
      required: true
    - name: person_id
      description: 'Filter by person ID.'
    - name: date_updated
      description: 'Filter by when the alarm was updated. The returned value will be greater than or equal to the given date.'
    - name: type
      description: 'Filter by history type. Possible type: "comment", "status", and "rbp".'
      auto: PREDEFINED
      predefined:
      - comment
      - status
      - rbp
    - name: offset
      defaultValue: "0"
      description: 'The number of items to skip before starting to collect the result set.'
    - name: count
      defaultValue: "50"
      description: 'The numbers of items to return.'
    outputs:
    - type: Number
      contextPath: LogRhythm.AlarmHistory.alarmId
      description: 'The alarm ID.'
    - type: Number
      contextPath: LogRhythm.AlarmHistory.personId
      description: The ID of the person who edited the alarm (changed status/ added comment, etc.).
    - type: String
      contextPath: LogRhythm.AlarmHistory.comments
      description: 'The alarm comments.'
    - type: Date
      contextPath: LogRhythm.AlarmHistory.dateInserted
      description: 'The date when the alarm was inserted.'
    - type: Date
      contextPath: LogRhythm.AlarmHistory.dateUpdated
      description: 'The date when the alarm was updated.'
  - name: lr-alarm-events-list
    description: 'Gets a list of events for the specified alarm ID.'
    arguments:
    - name: alarm_id
      description: 'The alarm ID.'
      required: true
    outputs:
    - type: Number
      contextPath: LogRhythm.AlarmEvents.alarmId
      description: 'The alarm ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.account
      description: 'The alarm event account.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.action
      description: 'The alarm event action.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.amount
      description: The number of events related to the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.bytesIn
      description: The number of bytes received or input from a device, system, or process.
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.bytesOut
      description: The number of bytes sent from a device, system, or process.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.classificationId
      description: 'The alarm event classification ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.classificationName
      description: 'The alarm event classification name.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.classificationTypeName
      description: 'The alarm event classification type.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.command
      description: The specific command executed that was recorded in the log message.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.commonEventId
      description: 'The common event name.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.cve
      description: 'The alarm event CVE.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.commonEventName
      description: 'The alarm event name.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.count
      description: The number of alarm events.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.directionId
      description: The direction by ID of the activity between a log’s origin and impacted zones.
    - type: String
      contextPath: LogRhythm.AlarmEvents.directionName
      description: The direction by name of the activity between a log’s origin and impacted zones. Values can be Internal, External, Outbound, Local, or Unknown.
    - type: String
      contextPath: LogRhythm.AlarmEvents.domain
      description: 'The alarm event domain.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.duration
      description: 'The alarm event duration.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.entityId
      description: 'The alarm event entity ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.entityName
      description: 'The alarm event entity name.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.group
      description: 'The alarm event group.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedEntityId
      description: The ID of the entity that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedEntityName
      description: The name of the entity that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedHostId
      description: The ID of the host that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedHostName
      description: The name of the host that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedInterface
      description: The interface that was impacted by the alarm.
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.impactedIP
      description: The IP address that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedLocation.countryCode
      description: The country code of the location that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedLocation.name
      description: The country name of the location that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedLocation.latitude
      description: The latitude of the location that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedLocation.locationId
      description: The ID of the location that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedLocation.locationKey
      description: The key of the location that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedLocation.longitude
      description: The longitude of the location that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedLocation.parentLocationId
      description: The parent location ID of the location that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedLocation.recordStatus
      description: The record status of the location that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedLocation.regionCode
      description: The region code of the location that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedLocation.type
      description: The type of the location that was impacted by the alarm.
    - type: Date
      contextPath: LogRhythm.AlarmEvents.impactedLocation.dateUpdated
      description: 'The date the impacted location was last updated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedMAC
      description: The MAC that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedName
      description: The name of the event that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNATIP
      description: The NAT IP address that was impacted by the alarm.
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.impactedNATPort
      description: The NAT port that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.beginIPRange.value
      description: 'The beginning of the IP range for the network that was impacted by the alarm.'
    - type: Date
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.dateUpdated
      description: 'The date the impacted network was last updated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.riskThreshold
      description: The risk threshold of the network impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.endIPRange.value
      description: 'The end of the IP range for the network that was impacted by the alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.entityId
      description: The ID of the entity for the network that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.hostZone
      description: The host zone for the network that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.locationId
      description: The location ID of the network that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.longDesc
      description: The long description of the network that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.name
      description: The name of the network that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.networkId
      description: The ID of the network that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.recordStatus
      description: The status of the record of the network that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedNetwork.shortDesc
      description: The short description of the network that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.impactedPort
      description: The port that was impacted by the alarm.
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedZone
      description: The zone that was impacted by the alarm.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.itemsPacketsIn
      description: Items such as packets received or input from a device, system, or process.
    - type: Number
      contextPath: LogRhythm.AlarmEvents.itemsPacketsOut
      description: Items such as packets sent from a device, system, or process.
    - type: Date
      contextPath: LogRhythm.AlarmEvents.logDate
      description: 'The event log date.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.login
      description: The user associated with the log activity.
    - type: String
      contextPath: LogRhythm.AlarmEvents.logMessage
      description: 'The event log message.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.logSourceHostId
      description: 'The host ID of the log source of the event.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.logSourceHostName
      description: 'The log source host name.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.logSourceName
      description: 'The log source name.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.logSourceTypeName
      description: 'The log source type.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.messageId
      description: 'The event message ID.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.mpeRuleId
      description: 'The event MPE rule ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.mpeRuleName
      description: 'The event MPE rule name.'
    - type: Date
      contextPath: LogRhythm.AlarmEvents.normalDateMax
      description: If the message is aggregated, the maximum creation date contained in the group of logs. It can be in UTC or user-selected time zone.
    - type: String
      contextPath: LogRhythm.AlarmEvents.objectName
      description: 'The object name of the event.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.objectType
      description: 'The object type of the event.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originEntityId
      description: 'The origin entity ID of the event.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originEntityName
      description: 'The origin entity name of the event.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originHostId
      description: 'The host ID of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originHostName
      description: 'The host name of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originInterface
      description: 'The interface of where the event originated.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.originIP
      description: 'The IP address of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originLocation.countryCode
      description: 'The country code of the  location of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originLocation.name
      description: 'The name of the location of where the event originated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originLocation.latitude
      description: 'The latitude of the location of where the event originated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originLocation.locationId
      description: 'The location ID of the location of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originLocation.locationKey
      description: 'The location key of where the event originated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originLocation.longitude
      description: 'The longitude of the location of where the event originated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originLocation.parentLocationId
      description: 'The parent location ID of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originLocation.recordStatus
      description: 'The record status of the location of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originLocation.regionCode
      description: 'The region code of the location of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originLocation.type
      description: 'The type of location of where the event originated.'
    - type: Date
      contextPath: LogRhythm.AlarmEvents.originLocation.dateUpdated
      description: 'The date the location of where the event originated was last updated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originMAC
      description: 'The MAC address of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originName
      description: 'The name of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNATIP
      description: 'The NAT IP address of where the event originated.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.originNATPort
      description: 'The NAT port of where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNetwork.beginIPRange.value
      description: 'The beginning address of the IP range of the network where the event originated.'
    - type: Date
      contextPath: LogRhythm.AlarmEvents.originNetwork.dateUpdated
      description: 'The date of the network when the event originate was last updated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNetwork.riskThreshold
      description: 'The risk threshold of the network where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNetwork.endIPRange.value
      description: 'The end of the IP range for the network where the event originated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originNetwork.entityId
      description: 'The entity ID of the network where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNetwork.hostZone
      description: 'The host zone of the network where the event originated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originNetwork.locationId
      description: 'The ID of the location of the network where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNetwork.longDesc
      description: 'The long description of the network where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNetwork.name
      description: 'The name of the network where the event originated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originNetwork.networkId
      description: 'The ID of the network where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNetwork.recordStatus
      description: 'The record status of the network where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originNetwork.shortDesc
      description: 'The short description of the network where the event originated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.originPort
      description: 'The port where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originZone
      description: 'The zone where the event originated.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.parentProcessId
      description: 'The parent process ID of the event.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.parentProcessName
      description: 'The parent process name of the event.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.parentProcessPath
      description: 'The parent process path of the event.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.policy
      description: 'The event policy.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.priority
      description: 'The event priority.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.process
      description: 'The event process.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.processId
      description: 'The event process ID.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.protocolId
      description: 'The event protocol ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.protocolName
      description: 'The event protocol name.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.quantity
      description: 'The event quantity.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.rate
      description: 'The event rate.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.reason
      description: 'The event reason.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.recipient
      description: 'The event recipient.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.result
      description: 'The event result.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.responseCode
      description: 'The event response code.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.sender
      description: 'The event sender.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.session
      description: 'The event session.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.sessionType
      description: 'The event session type.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.serialNumber
      description: 'The event serial number.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.serviceId
      description: 'The event service ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.serviceName
      description: 'The event service name.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.severity
      description: 'The event severity.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.status
      description: 'The event status.'
    - type: Number
      contextPath: LogRhythm.AlarmEvents.size
      description: 'The event size.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.subject
      description: 'The event subject.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.threatId
      description: 'The event threat ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.threatName
      description: 'The event threat name.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.url
      description: 'The event URL.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.userAgent
      description: 'The event user agent.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.vendorInfo
      description: 'The event vendor info.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.vendorMsgId
      description: 'The event vendor message ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.version
      description: 'The alarm event version.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.originUserIdentityName
      description: 'The event origin user identity.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.impactedUserIdentityName
      description: 'The event impacted user identity.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.originUserIdentityId
      description: 'The event origin user identity ID.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.impactedUserIdentityId
      description: 'The event impacted user identity ID.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.senderIdentityId
      description: 'The event sender identity ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.senderIdentityName
      description: 'The event sender identity name.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvents.recipientIdentityId
      description: 'The event recipient identity ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvents.recipientIdentityName
      description: 'The event recipient identity.'
  - name: lr-alarm-summary
    description: 'Get the alarm summary by the specified alarm ID.'
    arguments:
    - name: alarm_id
      description: 'Numeric ID of the alarm to get.'
      required: true
    outputs:
    - type: Date
      contextPath: LogRhythm.AlarmSummary.dateInserted
      description: 'The date the alarm was inserted.'
    - type: Number
      contextPath: LogRhythm.AlarmSummary.rbpMax
      description: 'The alarm rbp max.'
    - type: Number
      contextPath: LogRhythm.AlarmSummary.rbpAvg
      description: 'The alarm rbp average.'
    - type: Number
      contextPath: LogRhythm.AlarmSummary.alarmRuleId
      description: 'The alarm rule ID.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmRuleGroup
      description: 'The alarm rule group.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.briefDescription
      description: 'The alarm brief description.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.additionalDetails
      description: 'The alarm additional details.'
    - type: Number
      contextPath: LogRhythm.AlarmSummary.alarmId
      description: 'The alarm ID.'
    - type: Number
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.msgClassId
      description: 'The alarm summary message class ID.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.msgClassName
      description: 'The alarm summary message class name.'
    - type: Number
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.commonEventId
      description: 'The alarm summary common event ID.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.commonEventName
      description: 'The alarm summary common event name.'
    - type: Number
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.originHostId
      description: 'The alarm summary origin host ID.'
    - type: Number
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.impactedHostId
      description: 'The alarm summary impacted host ID.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.originUser
      description: 'The alarm summary origin user.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.impactedUser
      description: 'The alarm summary impacted user.'
    - type: Unknown
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.originUserIdentityId
      description: 'The alarm summary origin user identity ID.'
    - type: Unknown
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.impactedUserIdentityId
      description: 'The alarm summary impacted user identity ID.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.originUserIdentityName
      description: 'The alarm summary origin user identity name.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.impactedUserIdentityName
      description: 'The alarm summary impacted user identity name.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.originEntityName
      description: 'The alarm summary origin entity name.'
    - type: String
      contextPath: LogRhythm.AlarmSummary.alarmEventSummary.impactedEntityName
      description: 'The alarm summary impacted entity name.'
  - name: lr-get-alarm-details
    description: 'Get the details of an alarm by the specified alarm ID.'
    arguments:
    - name: alarm_id
      description: 'Numeric ID of the alarm to get.'
      required: true
    outputs:
    - type: Number
      contextPath: LogRhythm.AlarmDetails.alarmId
      description: 'The alarm ID.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.personId
      description: 'The person ID.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.entityId
      description: 'The entity ID.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.entityName
      description: 'The name of the entity.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.alarmDate
      description: 'The date in UTC of the alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.alarmRuleID
      description: 'The Rule ID of the rule which triggered the alarm.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.alarmRuleName
      description: 'The name of the rule which triggered the alarm.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.alarmStatus
      description: 'The status of the alarm.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.alarmStatusName
      description: 'The name for the status of the alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.lastUpdatedID
      description: 'The ID of the last person to update the alarm.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.lastUpdatedName
      description: 'The name of the last person to update the alarm.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.dateInserted
      description: 'The date in UTC, that the alarm was inserted.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.dateUpdated
      description: 'The date in UTC, that the alarm was updated.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.associatedCases
      description: 'The cases associated with this alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.lastPersonID
      description: 'The ID of the last person to edit this alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.eventCount
      description: 'The amount of events that triggered this alarm.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.eventDateFirst
      description: 'The date in UTC of the first event to trigger this alarm.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.eventDateLast
      description: 'The date in UTC of the last event to trigger this alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.rBPMax
      description: 'The maximum Risk Based Priority for this alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.rBPAvg
      description: 'The average Risk Based Priority for this alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDetails.executionTarget
      description: 'The target which the alarm was executed against.'
    - type: String
      contextPath: LogRhythm.AlarmDetails.alarmDataCached
      description: 'The cached alarm data.'
  - name: lr-alarm-drilldown
    description: 'Gets the drill-down logs per rule block for a specific alarm Id that fired associated with an AIE alarm.'
    arguments:
    - name: alarm_id
      description: 'Numeric ID of the alarm to get.'
      required: true
    outputs:
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.AlarmID
      description: 'The alarm ID.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.AIERuleID
      description: 'The alarm AIE rule ID.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.Status.value
      description: 'The value of the drilldown request.'
    - type: String
      contextPath: LogRhythm.AlarmDrilldown.Status.name
      description: 'The name of the drilldown request.'
    - type: String
      contextPath: LogRhythm.AlarmDrilldown.Status.description
      description: 'The description of the drilldown request.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.RetryCount
      description: 'The number of times the Data Indexer is queried for the drill-down results.'
    - type: Date
      contextPath: LogRhythm.AlarmDrilldown.LastDxTimestamp
      description: 'The timestamp, in UTC, at which the Data Indexer was queried to obtain the drill-down results.'
    - type: Date
      contextPath: LogRhythm.AlarmDrilldown.DateInserted
      description: 'The timestamp, in UTC, when the Alarm was added to the cache.'
    - type: String
      contextPath: LogRhythm.AlarmDrilldown.AlarmGuid
      description: 'The unique identification of the Alarm GUID.'
    - type: String
      contextPath: LogRhythm.AlarmDrilldown.WebConsoleId
      description: 'The unique identification of the Web Console ID.'
    - type: Boolean
      contextPath: LogRhythm.AlarmDrilldown.NotificationSent
      description: 'The unique identification of the Alarm GUID.'
    - type: String
      contextPath: LogRhythm.AlarmDrilldown.AIEMsgXml
      description: 'The message XML associated with the event that triggered by the AI Engine.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.EventID
      description: 'The event ID associated with the AI Engine alarm.'
    - type: Date
      contextPath: LogRhythm.AlarmDrilldown.NormalMessageDate
      description: 'The date, in UTC, that specifies the time of occurrence of the log.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.RuleBlockID
      description: 'The Rule Block Id associated with the AI Engine rule that triggered the alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.RuleBlockTypeID
      description: 'The type of rule block as specified in the Events Msg XML.'
    - type: String
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.DrillDownLogs
      description: 'Logs that triggered the AI Engine rule associated with the rule block.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.AIECount
      description: 'The number of logs identified by the AI Engine that triggered the alarm.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.DXCount
      description: 'The number of logs stored in the Data Indexer that matched the drill-down criteria.'
    - type: Date
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDate
      description: 'The date, in UTC, that specifies the time of occurence of the log.'
    - type: Date
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDateUpper
      description: 'The date, in UTC, that specifies the upper bound for the rule block triggered.'
    - type: Date
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDateLower
      description: 'The date, in UTC, that specifies the lower bound for the rule block triggered.'
    - type: Number
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.SummaryFieldType
      description: 'The Summary Field type selected for the rule block.'
    - type: String
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.DrillDownSummaries
      description: 'The aggregate of the Summary Field type as found in the drill-down logs associated with the alarm.'
    - type: String
      contextPath: LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.DefaultValue
      description: 'The value populated from the ARM when an alarm is added to the cache.'
  - name: lr-cases-list
    description: 'Get cases details using filter criteria.'
    arguments:
    - name: case_id
      description: 'The case ID by which to filter the results.'
    - name: timestamp_filter_type
      description: 'The type by which to filter case results combined with the argument timestamp. Possible values: "updatedAfter", "updatedBefore", "createdAfter", and "createdBefore".'
      auto: PREDEFINED
      predefined:
      - updatedAfter
      - updatedBefore
      - createdAfter
      - createdBefore
    - name: timestamp
      description: 'The timestamp by which to filter case results combined with the argument timestamp_filter_type.'
    - name: priority
      description: 'The priority by which to filter the results. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority.'
      auto: PREDEFINED
      predefined:
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
    - name: status
      description: 'The status by which to filter the results. Possible values are "1", (created), "2" (completed), "3" (incident), "4" (mitigated), and "5" (resolved).'
      auto: PREDEFINED
      predefined:
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
    - name: owners
      description: A comma-separated list of owner numbers.
      isArray: true
    - name: tags
      description: A comma-separated list of  tag numbers.
      isArray: true
    - name: text
      description: 'Filter results that have a case number or name that contains the specified value.'
    - name: evidence_type
      description: 'Filter results that have evidence of the specified type. Possible values: "alarm", "userEvents", "log", no"te, and "file".'
      auto: PREDEFINED
      predefined:
      - alarm
      - userEvents
      - log
      - note
      - file
    - name: reference_id
      description: 'Filter results that have evidence with the given reference identifier. For example, an alarm ID.'
    - name: external_id
      description: 'Filter results that have the specified, unique, external identifier.'
    - name: offset
      defaultValue: "0"
      description: 'The number of cases to skip before starting to collect the result set.'
    - name: count
      defaultValue: "50"
      description: 'The number of cases to return.'
    outputs:
    - type: String
      contextPath: LogRhythm.Case.id
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.Case.number
      description: 'The case number.'
    - type: String
      contextPath: LogRhythm.Case.externalId
      description: 'The case external ID.'
    - type: Date
      contextPath: LogRhythm.Case.dateCreated
      description: 'The date the case was created.'
    - type: Date
      contextPath: LogRhythm.Case.dateUpdated
      description: 'The date the case was updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.dateClosed
      description: 'The date the case was closed.'
    - type: Number
      contextPath: LogRhythm.Case.owner.number
      description: 'The ID of the case owner.'
    - type: String
      contextPath: LogRhythm.Case.owner.name
      description: 'The name of the case owner.'
    - type: Boolean
      contextPath: LogRhythm.Case.owner.disabled
      description: 'Whether the case owner is disabled.'
    - type: Number
      contextPath: LogRhythm.Case.lastUpdatedBy.number
      description: 'The ID of the user who last updated the case.'
    - type: String
      contextPath: LogRhythm.Case.lastUpdatedBy.name
      description: 'The name of the user who last updated the case.'
    - type: Boolean
      contextPath: LogRhythm.Case.lastUpdatedBy.disabled
      description: 'Whether the user who last updated the case is disabled.'
    - type: String
      contextPath: LogRhythm.Case.name
      description: 'The case name.'
    - type: String
      contextPath: LogRhythm.Case.status.name
      description: 'The case status.'
    - type: Number
      contextPath: LogRhythm.Case.status.number
      description: 'The case status number.'
    - type: Number
      contextPath: LogRhythm.Case.priority
      description: 'The case priority.'
    - type: Date
      contextPath: LogRhythm.Case.dueDate
      description: ' The datetime the case is due.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolution
      description: 'The case resolution.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionDateUpdated
      description: 'The date the case resolution was last updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionLastUpdatedBy
      description: 'The user who last updated the case resolution.'
    - type: String
      contextPath: LogRhythm.Case.summary
      description: 'The case summary.'
    - type: Number
      contextPath: LogRhythm.Case.entity.number
      description: 'The case entity number.'
    - type: String
      contextPath: LogRhythm.Case.entity.name
      description: 'The case entity name.'
    - type: String
      contextPath: LogRhythm.Case.entity.fullName
      description: 'The case entity full name.'
    - type: Number
      contextPath: LogRhythm.Case.collaborators.number
      description: 'The case collaborator number.'
    - type: String
      contextPath: LogRhythm.Case.collaborators.name
      description: 'The case collaborator name.'
    - type: Boolean
      contextPath: LogRhythm.Case.collaborators.disabled
      description: 'Whether the case collaborator is disabled.'
    - type: String
      contextPath: LogRhythm.Case.tags.text
      description: 'The case tag name.'
    - type: Number
      contextPath: LogRhythm.Case.tags.number
      description: 'The case tag number.'
  - name: lr-case-create
    description: 'Create a new case.'
    arguments:
    - name: name
      description: 'Name of the case.'
      required: true
    - name: priority
      description: 'The priority by which to filter the results. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority.'
      required: true
      auto: PREDEFINED
      predefined:
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
    - name: external_id
      description: 'Externally defined identifier for the case.'
    - name: due_date
      description: 'The timedate of when the case is due, as an RFC 3339 formatted string. E.g., 2020-04-20T14:15:22Z.'
    - name: summary
      description: 'Note summarizing the case.'
    outputs:
    - type: String
      contextPath: LogRhythm.Case.id
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.Case.number
      description: 'The case number.'
    - type: String
      contextPath: LogRhythm.Case.externalId
      description: 'The case external ID.'
    - type: Date
      contextPath: LogRhythm.Case.dateCreated
      description: 'The date the case was created.'
    - type: Date
      contextPath: LogRhythm.Case.dateUpdated
      description: 'The date the case was updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.dateClosed
      description: 'The date the case was closed.'
    - type: Number
      contextPath: LogRhythm.Case.owner.number
      description: 'The ID of the case owner.'
    - type: String
      contextPath: LogRhythm.Case.owner.name
      description: 'The name of the case owner.'
    - type: Boolean
      contextPath: LogRhythm.Case.owner.disabled
      description: 'Whether the owner is disabled.'
    - type: Number
      contextPath: LogRhythm.Case.lastUpdatedBy.number
      description: 'The ID of the user who last updated the case.'
    - type: String
      contextPath: LogRhythm.Case.lastUpdatedBy.name
      description: 'The name of the user who last updated the case.'
    - type: Boolean
      contextPath: LogRhythm.Case.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the case is disabled.'
    - type: String
      contextPath: LogRhythm.Case.name
      description: 'The case name.'
    - type: String
      contextPath: LogRhythm.Case.status.name
      description: 'The case status.'
    - type: Number
      contextPath: LogRhythm.Case.status.number
      description: 'The case status number.'
    - type: Number
      contextPath: LogRhythm.Case.priority
      description: 'The case priority.'
    - type: Date
      contextPath: LogRhythm.Case.dueDate
      description: ' The datetime the case is due.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolution
      description: 'The case resolution.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionDateUpdated
      description: 'The date the case resolution was last updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionLastUpdatedBy
      description: 'The user who last updated the case resolution.'
    - type: String
      contextPath: LogRhythm.Case.summary
      description: 'The case summary.'
    - type: Number
      contextPath: LogRhythm.Case.entity.number
      description: 'The case entity number.'
    - type: String
      contextPath: LogRhythm.Case.entity.name
      description: 'The case entity name.'
    - type: String
      contextPath: LogRhythm.Case.entity.fullName
      description: 'The case entity full name.'
    - type: Number
      contextPath: LogRhythm.Case.collaborators.number
      description: 'The case collaborator number.'
    - type: String
      contextPath: LogRhythm.Case.collaborators.name
      description: 'The case collaborator name.'
    - type: Boolean
      contextPath: LogRhythm.Case.collaborators.disabled
      description: 'Whether the case collaborator is disabled.'
    - type: String
      contextPath: LogRhythm.Case.tags.text
      description: 'The case tag name.'
    - type: Number
      contextPath: LogRhythm.Case.tags.number
      description: 'The case tag number.'
  - name: lr-case-update
    description: 'Update case information. For example, the case name, priority, and due date.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: name
      description: 'Name of the case.'
    - name: priority
      description: 'The priority of the case. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority.'
      auto: PREDEFINED
      predefined:
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
    - name: external_id
      description: 'Externally defined identifier for the case.'
    - name: due_date
      description: 'The timedate of when the case is due, as an RFC 3339 formatted string. E.g., 2020-04-20T14:15:22Z.'
    - name: summary
      description: 'Note summarizing the case.'
    - name: entity_id
      description: 'Entity to assign to the case.'
    - name: resolution
      description: 'Description of how the case was resolved.'
    outputs:
    - type: String
      contextPath: LogRhythm.Case.id
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.Case.number
      description: 'The case number.'
    - type: String
      contextPath: LogRhythm.Case.externalId
      description: 'The case external ID.'
    - type: Date
      contextPath: LogRhythm.Case.dateCreated
      description: 'The date the case was created.'
    - type: Date
      contextPath: LogRhythm.Case.dateUpdated
      description: 'The date the case was updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.dateClosed
      description: 'The date the case was closed.'
    - type: Number
      contextPath: LogRhythm.Case.owner.number
      description: 'The ID of the case owner.'
    - type: String
      contextPath: LogRhythm.Case.owner.name
      description: 'The name of the case owner.'
    - type: Boolean
      contextPath: LogRhythm.Case.owner.disabled
      description: 'Whether the owner is disabled.'
    - type: Number
      contextPath: LogRhythm.Case.lastUpdatedBy.number
      description: 'The ID of the user who last updated the case.'
    - type: String
      contextPath: LogRhythm.Case.lastUpdatedBy.name
      description: 'The name of the user who last updated the case.'
    - type: Boolean
      contextPath: LogRhythm.Case.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the case is disabled.'
    - type: String
      contextPath: LogRhythm.Case.name
      description: 'The case name.'
    - type: String
      contextPath: LogRhythm.Case.status.name
      description: 'The case status.'
    - type: Number
      contextPath: LogRhythm.Case.status.number
      description: 'The case status number.'
    - type: Number
      contextPath: LogRhythm.Case.priority
      description: 'The case priority.'
    - type: Date
      contextPath: LogRhythm.Case.dueDate
      description: ' The datetime the case is due.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolution
      description: 'The case resolution.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionDateUpdated
      description: 'The date the case resolution was last updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionLastUpdatedBy
      description: 'The user who last updated the case resolution.'
    - type: String
      contextPath: LogRhythm.Case.summary
      description: 'The case summary.'
    - type: Number
      contextPath: LogRhythm.Case.entity.number
      description: 'The case entity number.'
    - type: String
      contextPath: LogRhythm.Case.entity.name
      description: 'The case entity name.'
    - type: String
      contextPath: LogRhythm.Case.entity.fullName
      description: 'The case entity full name.'
    - type: Number
      contextPath: LogRhythm.Case.collaborators.number
      description: 'The case collaborator number.'
    - type: String
      contextPath: LogRhythm.Case.collaborators.name
      description: 'The case collaborator name.'
    - type: Boolean
      contextPath: LogRhythm.Case.collaborators.disabled
      description: 'Whether the case collaborator is disabled.'
    - type: String
      contextPath: LogRhythm.Case.tags.text
      description: 'The case tag name.'
    - type: Number
      contextPath: LogRhythm.Case.tags.number
      description: 'The case tag number.'
  - name: lr-case-status-change
    description: 'Update the status of a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: status
      description: 'The case status. Possible values: "Created", "Completed", "Incident", "Mitigated", and "Resolved".'
      required: true
      auto: PREDEFINED
      predefined:
      - Created
      - Completed
      - Incident
      - Mitigated
      - Resolved
    outputs:
    - type: String
      contextPath: LogRhythm.Case.id
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.Case.number
      description: 'The case number.'
    - type: String
      contextPath: LogRhythm.Case.externalId
      description: 'The case external ID.'
    - type: Date
      contextPath: LogRhythm.Case.dateCreated
      description: 'The date the case was created.'
    - type: Date
      contextPath: LogRhythm.Case.dateUpdated
      description: 'The date the case was updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.dateClosed
      description: 'The date the case was closed.'
    - type: Number
      contextPath: LogRhythm.Case.owner.number
      description: 'The ID of the case owner.'
    - type: String
      contextPath: LogRhythm.Case.owner.name
      description: 'The name of the case owner.'
    - type: Boolean
      contextPath: LogRhythm.Case.owner.disabled
      description: 'Whether the owner is disabled.'
    - type: Number
      contextPath: LogRhythm.Case.lastUpdatedBy.number
      description: 'The ID of the user who last updated the case.'
    - type: String
      contextPath: LogRhythm.Case.lastUpdatedBy.name
      description: 'The name of the user who last updated the case.'
    - type: Boolean
      contextPath: LogRhythm.Case.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the case is disabled.'
    - type: String
      contextPath: LogRhythm.Case.name
      description: 'The case name.'
    - type: String
      contextPath: LogRhythm.Case.status.name
      description: 'The case status.'
    - type: Number
      contextPath: LogRhythm.Case.status.number
      description: 'The case status number.'
    - type: Number
      contextPath: LogRhythm.Case.priority
      description: 'The case priority.'
    - type: Date
      contextPath: LogRhythm.Case.dueDate
      description: ' The datetime the case is due.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolution
      description: 'The case resolution.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionDateUpdated
      description: 'The date the case resolution was last updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionLastUpdatedBy
      description: 'The user who last updated the case resolution.'
    - type: String
      contextPath: LogRhythm.Case.summary
      description: 'The case summary.'
    - type: Number
      contextPath: LogRhythm.Case.entity.number
      description: 'The case entity number.'
    - type: String
      contextPath: LogRhythm.Case.entity.name
      description: 'The case entity name.'
    - type: String
      contextPath: LogRhythm.Case.entity.fullName
      description: 'The case entity full name.'
    - type: Number
      contextPath: LogRhythm.Case.collaborators.number
      description: 'The case collaborator number.'
    - type: String
      contextPath: LogRhythm.Case.collaborators.name
      description: 'The case collaborator name.'
    - type: Boolean
      contextPath: LogRhythm.Case.collaborators.disabled
      description: 'Whether the case collaborator is disabled.'
    - type: String
      contextPath: LogRhythm.Case.tags.text
      description: 'The case tag name.'
    - type: Number
      contextPath: LogRhythm.Case.tags.number
      description: 'The case tag number.'
  - name: lr-case-evidence-list
    description: 'Return a list of evidence summaries for a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: evidence_type
      description: 'Filter results that have evidence of the specified type. Possible values are: "alarm", "userEvents", "log", "note", and "file".'
      auto: PREDEFINED
      predefined:
      - alarm
      - userEvents
      - log
      - note
      - file
    - name: status
      description: 'Filter results that have a specific evidence status. Possible values: "pending", "completed", and "failed".'
      auto: PREDEFINED
      predefined:
      - pending
      - completed
      - failed
    - name: evidence_number
      description: 'Filter results by evidence number.'
    outputs:
    - type: String
      contextPath: LogRhythm.CaseEvidence.CaseID
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.CaseEvidence.Evidences.number
      description: 'The evidence number.'
    - type: Date
      contextPath: LogRhythm.CaseEvidence.Evidences.dateCreated
      description: 'The date the evidence was created.'
    - type: Date
      contextPath: LogRhythm.CaseEvidence.Evidences.dateUpdated
      description: 'The date the evidence was updated.'
    - type: Number
      contextPath: LogRhythm.CaseEvidence.Evidences.createdBy.number
      description: 'The ID of the user who created the evidence.'
    - type: String
      contextPath: LogRhythm.CaseEvidence.Evidences.createdBy.name
      description: 'The name of the user who created the evidence.'
    - type: Boolean
      contextPath: LogRhythm.CaseEvidence.Evidences.createdBy.disabled
      description: 'Whether the user is disabled.'
    - type: Number
      contextPath: LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.number
      description: 'The ID of the user who last updated the case evidence.'
    - type: String
      contextPath: LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.name
      description: 'The name of the user who last updated the case evidence.'
    - type: Boolean
      contextPath: LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the case evidence is disabled.'
    - type: String
      contextPath: LogRhythm.CaseEvidence.Evidences.type
      description: 'The evidence type.'
    - type: String
      contextPath: LogRhythm.CaseEvidence.Evidences.status
      description: 'The evidence status.'
    - type: Unknown
      contextPath: LogRhythm.CaseEvidence.Evidences.statusMessage
      description: 'The evidence status message.'
    - type: String
      contextPath: LogRhythm.CaseEvidence.Evidences.text
      description: 'The evidence text.'
    - type: Boolean
      contextPath: LogRhythm.CaseEvidence.Evidences.pinned
      description: 'Whether the evidence is pinned.'
    - type: Unknown
      contextPath: LogRhythm.CaseEvidence.Evidences.datePinned
      description: 'The date the evidence was pinned.'
  - name: lr-case-alarm-evidence-add
    description: 'Add multiple alarms as evidence on a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: alarm_numbers
      description: 'A comma-separated list of alarm IDs.'
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: LogRhythm.AlarmEvidence.CaseID
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.AlarmEvidence.Evidences.number
      description: 'The evidence number.'
    - type: Date
      contextPath: LogRhythm.AlarmEvidence.Evidences.dateCreated
      description: 'The date the evidence was created.'
    - type: Date
      contextPath: LogRhythm.AlarmEvidence.Evidences.dateUpdated
      description: 'The date the evidence was updated.'
    - type: Number
      contextPath: LogRhythm.AlarmEvidence.Evidences.createdBy.number
      description: 'The ID of the user who created the evidence.'
    - type: String
      contextPath: LogRhythm.AlarmEvidence.Evidences.createdBy.name
      description: 'The name of the user who created the evidence.'
    - type: Boolean
      contextPath: LogRhythm.AlarmEvidence.Evidences.createdBy.disabled
      description: 'Whether the user is disabled.'
    - type: Number
      contextPath: LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.number
      description: 'The ID of the user who last updated the alarm evidence.'
    - type: String
      contextPath: LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.name
      description: 'The name of the user who last updated the alarm evidence.'
    - type: Boolean
      contextPath: LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the alarm evidence is disabled.'
    - type: String
      contextPath: LogRhythm.AlarmEvidence.Evidences.type
      description: 'The evidence type.'
    - type: String
      contextPath: LogRhythm.AlarmEvidence.Evidences.status
      description: 'The evidence status.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvidence.Evidences.statusMessage
      description: 'The evidence status message.'
    - type: String
      contextPath: LogRhythm.AlarmEvidence.Evidences.text
      description: 'The evidence text.'
    - type: Boolean
      contextPath: LogRhythm.AlarmEvidence.Evidences.pinned
      description: 'Whether the evidence is pinned.'
    - type: Unknown
      contextPath: LogRhythm.AlarmEvidence.Evidences.datePinned
      description: 'The date the evidence was pinned.'
    - type: Number
      contextPath: LogRhythm.AlarmEvidence.Evidences.alarm.alarmId
      description: 'The alarm ID.'
    - type: Date
      contextPath: LogRhythm.AlarmEvidence.Evidences.alarm.alarmDate
      description: 'The alarm date.'
    - type: Number
      contextPath: LogRhythm.AlarmEvidence.Evidences.alarm.alarmRuleId
      description: 'The alarm rule ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvidence.Evidences.alarm.alarmRuleName
      description: 'The alarm rule name.'
    - type: Date
      contextPath: LogRhythm.AlarmEvidence.Evidences.alarm.dateInserted
      description: 'The date the alarm was inserted.'
    - type: Number
      contextPath: LogRhythm.AlarmEvidence.Evidences.alarm.entityId
      description: 'The alarm entity ID.'
    - type: String
      contextPath: LogRhythm.AlarmEvidence.Evidences.alarm.entityName
      description: 'The alarm entity name.'
    - type: Number
      contextPath: LogRhythm.AlarmEvidence.Evidences.alarm.riskBasedPriorityMax
      description: 'The maximum Risk Based Priority (RBP) threshold of events to monitor.'
  - name: lr-case-note-evidence-add
    description: 'Add a note as evidence on a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: note
      description: 'Note text.'
      required: true
    outputs:
    - type: String
      contextPath: LogRhythm.NoteEvidence.CaseID
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.NoteEvidence.Evidences.number
      description: 'The evidence number.'
    - type: Date
      contextPath: LogRhythm.NoteEvidence.Evidences.dateCreated
      description: 'The date the evidence was created.'
    - type: Date
      contextPath: LogRhythm.NoteEvidence.Evidences.dateUpdated
      description: 'The date the evidence was updated.'
    - type: Number
      contextPath: LogRhythm.NoteEvidence.Evidences.createdBy.number
      description: 'The ID of the user who created the evidence.'
    - type: String
      contextPath: LogRhythm.NoteEvidence.Evidences.createdBy.name
      description: 'The name of the user who created the evidence.'
    - type: Boolean
      contextPath: LogRhythm.NoteEvidence.Evidences.createdBy.disabled
      description: 'Whether the user is disabled.'
    - type: Number
      contextPath: LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.number
      description: 'The ID of the user who last updated the evidence.'
    - type: String
      contextPath: LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.name
      description: 'The name of the user who last updated the evidence.'
    - type: Boolean
      contextPath: LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the evidence is disabled.'
    - type: String
      contextPath: LogRhythm.NoteEvidence.Evidences.type
      description: 'The evidence type.'
    - type: String
      contextPath: LogRhythm.NoteEvidence.Evidences.status
      description: 'The evidence status.'
    - type: Unknown
      contextPath: LogRhythm.NoteEvidence.Evidences.statusMessage
      description: 'The evidence status message.'
    - type: String
      contextPath: LogRhythm.NoteEvidence.Evidences.text
      description: 'The evidence text.'
    - type: Boolean
      contextPath: LogRhythm.NoteEvidence.Evidences.pinned
      description: 'Whether the evidence is pinned.'
    - type: Unknown
      contextPath: LogRhythm.NoteEvidence.Evidences.datePinned
      description: 'The date the evidence was pinned.'
  - name: lr-case-file-evidence-add
    description: 'Upload a file as evidence on a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: entryId
      description: 'The entry ID of the file to attach.'
      required: true
    outputs:
    - type: String
      contextPath: LogRhythm.FileEvidence.CaseID
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.FileEvidence.Evidences.number
      description: 'The evidence number.'
    - type: Date
      contextPath: LogRhythm.FileEvidence.Evidences.dateCreated
      description: 'The date the evidence was created.'
    - type: Date
      contextPath: LogRhythm.FileEvidence.Evidences.dateUpdated
      description: 'The date the evidence was updated.'
    - type: Number
      contextPath: LogRhythm.FileEvidence.Evidences.createdBy.number
      description: 'The ID of the user who created the evidence.'
    - type: String
      contextPath: LogRhythm.FileEvidence.Evidences.createdBy.name
      description: 'The name of the user who created the evidence.'
    - type: Boolean
      contextPath: LogRhythm.FileEvidence.Evidences.createdBy.disabled
      description: 'Whether the user is disabled.'
    - type: Number
      contextPath: LogRhythm.FileEvidence.Evidences.lastUpdatedBy.number
      description: 'The ID of the user who last updated the evidence.'
    - type: String
      contextPath: LogRhythm.FileEvidence.Evidences.lastUpdatedBy.name
      description: 'The name of the user who last updated the evidence.'
    - type: Boolean
      contextPath: LogRhythm.FileEvidence.Evidences.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the evidence is disabled.'
    - type: String
      contextPath: LogRhythm.FileEvidence.Evidences.type
      description: 'The evidence type.'
    - type: String
      contextPath: LogRhythm.FileEvidence.Evidences.status
      description: 'The evidence status.'
    - type: Unknown
      contextPath: LogRhythm.FileEvidence.Evidences.statusMessage
      description: 'The evidence status message.'
    - type: String
      contextPath: LogRhythm.FileEvidence.Evidences.text
      description: 'The evidence text.'
    - type: Boolean
      contextPath: LogRhythm.FileEvidence.Evidences.pinned
      description: 'Whether the evidence is pinned.'
    - type: Unknown
      contextPath: LogRhythm.FileEvidence.Evidences.datePinned
      description: 'The date the evidence was pinned.'
  - name: lr-case-evidence-delete
    description: 'Remove evidence from a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: evidence_number
      description: 'Unique, numeric identifier for the evidence to remove.'
      required: true
  - name: lr-case-file-evidence-download
    description: 'Download an item of file evidence from a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: evidence_number
      description: 'Unique, numeric identifier for the evidence.'
      required: true
  - name: lr-case-tags-add
    description: 'Add tags to a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: tag_numbers
      description: 'A comma-separated list of tag numbers to add.'
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: LogRhythm.Case.id
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.Case.number
      description: 'The case number.'
    - type: String
      contextPath: LogRhythm.Case.externalId
      description: 'The case external ID.'
    - type: Date
      contextPath: LogRhythm.Case.dateCreated
      description: 'The date the case was created.'
    - type: Date
      contextPath: LogRhythm.Case.dateUpdated
      description: 'The date the case was updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.dateClosed
      description: 'The date the case was closed.'
    - type: Number
      contextPath: LogRhythm.Case.owner.number
      description: 'The ID of the case owner.'
    - type: String
      contextPath: LogRhythm.Case.owner.name
      description: 'The name of the case owner.'
    - type: Boolean
      contextPath: LogRhythm.Case.owner.disabled
      description: 'Whether the owner is disabled or not.'
    - type: Number
      contextPath: LogRhythm.Case.lastUpdatedBy.number
      description: 'The ID of the user who last updated the case.'
    - type: String
      contextPath: LogRhythm.Case.lastUpdatedBy.name
      description: 'The name of the user who last updated the case.'
    - type: Boolean
      contextPath: LogRhythm.Case.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the case is disabled.'
    - type: String
      contextPath: LogRhythm.Case.name
      description: 'The case name.'
    - type: String
      contextPath: LogRhythm.Case.status.name
      description: 'The case status.'
    - type: Number
      contextPath: LogRhythm.Case.status.number
      description: 'The case status number.'
    - type: Number
      contextPath: LogRhythm.Case.priority
      description: 'The case priority.'
    - type: Date
      contextPath: LogRhythm.Case.dueDate
      description: ' The datetime the case is due.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolution
      description: 'The case resolution.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionDateUpdated
      description: 'The date the case resolution was last updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionLastUpdatedBy
      description: 'The user who last updated the case resolution.'
    - type: String
      contextPath: LogRhythm.Case.summary
      description: 'The case summary.'
    - type: Number
      contextPath: LogRhythm.Case.entity.number
      description: 'The case entity number.'
    - type: String
      contextPath: LogRhythm.Case.entity.name
      description: 'The case entity name.'
    - type: String
      contextPath: LogRhythm.Case.entity.fullName
      description: 'The case entity full name.'
    - type: Number
      contextPath: LogRhythm.Case.collaborators.number
      description: 'The case collaborator number.'
    - type: String
      contextPath: LogRhythm.Case.collaborators.name
      description: 'The case collaborator name.'
    - type: Boolean
      contextPath: LogRhythm.Case.collaborators.disabled
      description: 'Whether the case collaborator is disabled.'
    - type: String
      contextPath: LogRhythm.Case.tags.text
      description: 'The case tag name.'
    - type: Number
      contextPath: LogRhythm.Case.tags.number
      description: 'The case tag number.'
  - name: lr-case-tags-remove
    description: 'Remove tags from a case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: tag_numbers
      description: 'A comma-separated list of tag numbers to remove.'
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: LogRhythm.Case.id
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.Case.number
      description: 'The case number.'
    - type: String
      contextPath: LogRhythm.Case.externalId
      description: 'The case external ID.'
    - type: Date
      contextPath: LogRhythm.Case.dateCreated
      description: 'The date the case was created.'
    - type: Date
      contextPath: LogRhythm.Case.dateUpdated
      description: 'The date the case was updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.dateClosed
      description: 'The date the case was closed.'
    - type: Number
      contextPath: LogRhythm.Case.owner.number
      description: 'The ID of the case owner.'
    - type: String
      contextPath: LogRhythm.Case.owner.name
      description: 'The name of the case owner.'
    - type: Boolean
      contextPath: LogRhythm.Case.owner.disabled
      description: 'Whether the owner is disabled or not.'
    - type: Number
      contextPath: LogRhythm.Case.lastUpdatedBy.number
      description: 'The ID of the user who last updated the case.'
    - type: String
      contextPath: LogRhythm.Case.lastUpdatedBy.name
      description: 'The name of the user who last updated the case.'
    - type: Boolean
      contextPath: LogRhythm.Case.lastUpdatedBy.disabled
      description: 'Whether the last user who updated the case is disabled.'
    - type: String
      contextPath: LogRhythm.Case.name
      description: 'The case name.'
    - type: String
      contextPath: LogRhythm.Case.status.name
      description: 'The case status.'
    - type: Number
      contextPath: LogRhythm.Case.status.number
      description: 'The case status number.'
    - type: Number
      contextPath: LogRhythm.Case.priority
      description: 'The case priority.'
    - type: Date
      contextPath: LogRhythm.Case.dueDate
      description: ' The datetime the case is due.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolution
      description: 'The case resolution.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionDateUpdated
      description: 'The date the case resolution was last updated.'
    - type: Unknown
      contextPath: LogRhythm.Case.resolutionLastUpdatedBy
      description: 'The user who last updated the case resolution.'
    - type: String
      contextPath: LogRhythm.Case.summary
      description: 'The case summary.'
    - type: Number
      contextPath: LogRhythm.Case.entity.number
      description: 'The case entity number.'
    - type: String
      contextPath: LogRhythm.Case.entity.name
      description: 'The case entity name.'
    - type: String
      contextPath: LogRhythm.Case.entity.fullName
      description: 'The case entity full name.'
    - type: Number
      contextPath: LogRhythm.Case.collaborators.number
      description: 'The case collaborator number.'
    - type: String
      contextPath: LogRhythm.Case.collaborators.name
      description: 'The case collaborator name.'
    - type: Boolean
      contextPath: LogRhythm.Case.collaborators.disabled
      description: 'Whether the case collaborator is disabled.'
    - type: String
      contextPath: LogRhythm.Case.tags.text
      description: 'The case tag name.'
    - type: Number
      contextPath: LogRhythm.Case.tags.number
      description: 'The case tag number.'
  - name: lr-tags-list
    description: 'Return a list of tags using filter criteria.'
    arguments:
    - name: tag_name
      description: 'Filter results that have a tag name that contains the specified value.'
    - name: offset
      defaultValue: "0"
      description: 'The number of tags to skip before starting to collect the result set.'
    - name: count
      defaultValue: "50"
      description: 'The numbers of tags to return.'
    outputs:
    - type: Number
      contextPath: LogRhythm.Tag.number
      description: 'The tag number.'
    - type: String
      contextPath: LogRhythm.Tag.text
      description: 'The tag text.'
    - type: Date
      contextPath: LogRhythm.Tag.dateCreated
      description: 'The date the tag was created.'
    - type: Number
      contextPath: LogRhythm.Tag.createdBy.number
      description: 'The ID of the user who created the tag.'
    - type: String
      contextPath: LogRhythm.Tag.createdBy.name
      description: 'The name of the user who created the tag.'
    - type: Boolean
      contextPath: LogRhythm.Tag.createdBy.disabled
      description: 'Whether the user is disabled.'
  - name: lr-case-collaborators-list
    description: 'Returns the owner and a list of collaborators associated with a specific case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    outputs:
    - type: String
      contextPath: LogRhythm.CaseCollaborator.CaseID
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.CaseCollaborator.owner.number
      description: 'The ID of the case owner.'
    - type: String
      contextPath: LogRhythm.CaseCollaborator.owner.name
      description: 'The name of the case owner.'
    - type: Boolean
      contextPath: LogRhythm.CaseCollaborator.owner.disabled
      description: 'Whether the owner is disabled.'
    - type: Number
      contextPath: LogRhythm.CaseCollaborator.collaborators.number
      description: 'The case collaborator number.'
    - type: String
      contextPath: LogRhythm.CaseCollaborator.collaborators.name
      description: 'The case collaborator name.'
    - type: Boolean
      contextPath: LogRhythm.CaseCollaborator.collaborators.disabled
      description: 'Whether the case collaborator is disabled.'
  - name: lr-case-collaborators-update
    description: 'Updates the owner and collaborators associated with a specific case.'
    arguments:
    - name: case_id
      description: 'Unique identifier for the case.'
      required: true
    - name: owner
      description: 'Unique, numeric identifier for the person.'
      required: true
    - name: collaborators
      description: 'A comma-separated list of user IDs.'
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: LogRhythm.CaseCollaborator.CaseID
      description: 'The case ID.'
    - type: Number
      contextPath: LogRhythm.CaseCollaborator.owner.number
      description: 'The ID of the case owner.'
    - type: String
      contextPath: LogRhythm.CaseCollaborator.owner.name
      description: 'The name of the case owner.'
    - type: Boolean
      contextPath: LogRhythm.CaseCollaborator.owner.disabled
      description: 'Whether the owner is disabled.'
    - type: Number
      contextPath: LogRhythm.CaseCollaborator.collaborators.number
      description: 'The case collaborator ID.'
    - type: String
      contextPath: LogRhythm.CaseCollaborator.collaborators.name
      description: 'The case collaborator name.'
    - type: Boolean
      contextPath: LogRhythm.CaseCollaborator.collaborators.disabled
      description: 'Whether the case collaborator is disabled.'
  - name: lr-entities-list
    description: 'Returns all Entities that match the specified criteria.'
    arguments:
    - name: parent_entity_id
      description: 'Filter by the object parent entity ID.'
    - name: entity_id
      description: 'Filter by the entity ID.'
    - name: offset
      defaultValue: "0"
      description: 'The number of entities to skip before starting to collect the result set.'
    - name: count
      defaultValue: "50"
      description: 'The number of entities to return.'
    outputs:
    - type: Number
      contextPath: LogRhythm.Entity.id
      description: 'The entity ID.'
    - type: String
      contextPath: LogRhythm.Entity.name
      description: 'The entity name.'
    - type: String
      contextPath: LogRhythm.Entity.fullName
      description: 'The entity full name.'
    - type: String
      contextPath: LogRhythm.Entity.recordStatusName
      description: 'The entity record status.'
    - type: String
      contextPath: LogRhythm.Entity.shortDesc
      description: 'The entity short description.'
    - type: Date
      contextPath: LogRhythm.Entity.dateUpdated
      description: 'The date the entity was updated.'
  - name: lr-hosts-list
    description: 'Returns all hosts that match the specified criteria.'
    arguments:
    - name: host_id
      description: 'Filter by host ID.'
    - name: host_name
      description: 'Filter by host name.'
    - name: entity_name
      description: 'Filter by entity name.'
    - name: record_status
      description: 'Filter by record status. Possible values: "all", "active", "retired".'
      auto: PREDEFINED
      predefined:
      - all
      - active
      - retired
    - name: offset
      defaultValue: "0"
      description: 'The number of hosts to skip before starting to collect the result set.'
    - name: count
      defaultValue: "50"
      description: 'The number of hosts to return.'
    outputs:
    - type: Number
      contextPath: LogRhythm.Host.id
      description: 'The host ID.'
    - type: Number
      contextPath: LogRhythm.Host.entity.id
      description: 'The host entity ID.'
    - type: String
      contextPath: LogRhythm.Host.entity.name
      description: 'The host entity name.'
    - type: String
      contextPath: LogRhythm.Host.name
      description: 'The host name.'
    - type: String
      contextPath: LogRhythm.Host.riskLevel
      description: 'The host risk level.'
    - type: String
      contextPath: LogRhythm.Host.threatLevel
      description: 'The host threat level.'
    - type: String
      contextPath: LogRhythm.Host.threatLevelComments
      description: 'The threat level comments.'
    - type: String
      contextPath: LogRhythm.Host.recordStatusName
      description: 'The host record status name.'
    - type: String
      contextPath: LogRhythm.Host.hostZone
      description: 'The host zone.'
    - type: Number
      contextPath: LogRhythm.Host.location.id
      description: 'The host location ID.'
    - type: String
      contextPath: LogRhythm.Host.os
      description: 'The operating system type supported by LogRhythm.'
    - type: Boolean
      contextPath: LogRhythm.Host.useEventlogCredentials
      description: 'Whether to use the event log credentials.'
    - type: String
      contextPath: LogRhythm.Host.osType
      description: 'The agent server type on which the operating system is installed.'
    - type: Date
      contextPath: LogRhythm.Host.dateUpdated
      description: 'The date the host was updated.'
    - type: String
      contextPath: LogRhythm.Host.shortDesc
      description: 'The host short description.'
    - type: String
      contextPath: LogRhythm.Host.osVersion
      description: 'The host operation system version.'
    - type: String
      contextPath: LogRhythm.Host.hostIdentifiers.type
      description: 'The host identifier type.'
    - type: String
      contextPath: LogRhythm.Host.hostIdentifiers.value
      description: 'The host identifier value.'
    - type: Date
      contextPath: LogRhythm.Host.hostIdentifiers.dateAssigned
      description: 'The date the host identifier was assigned.'
    - type: String
      contextPath: LogRhythm.Host.eventlogPassword
      description: 'The event log password.'
  - name: lr-users-list
    description: 'Returns user records based on the permissions of the currently logged in user and the specified criteria.'
    arguments:
    - name: user_ids
      description: 'A comma-separated list of user IDs.'
      isArray: true
    - name: entity_ids
      description: 'A comma-separated list of entity IDs.'
      isArray: true
    - name: user_status
      description: 'Filter by user status. Possible values: "Active" and "Retired".'
      auto: PREDEFINED
      predefined:
      - Active
      - Retired
    - name: offset
      defaultValue: "0"
      description: 'The ID of users to skip before starting to collect the result set.'
    - name: count
      defaultValue: "50"
      description: 'The IDs of the users to return.'
    outputs:
    - contextPath: LogRhythm.User.firstName
      description: 'The user first name.'
      type: String
    - contextPath: LogRhythm.User.lastName
      description: 'The user last name.'
      type: String
    - contextPath: LogRhythm.User.userType
      description: 'The user type.'
      type: String
    - contextPath: LogRhythm.User.fullName
      description: 'The user full name.'
      type: String
    - contextPath: LogRhythm.User.objectPermissions.readAccess
      description: 'The user read access permissions.'
      type: String
    - contextPath: LogRhythm.User.objectPermissions.writeAccess
      description: 'The user write access permissions.'
      type: String
    - contextPath: LogRhythm.User.objectPermissions.entity.id
      description: 'The user permissions entity ID.'
      type: Number
    - contextPath: LogRhythm.User.objectPermissions.entity.name
      description: 'The user permissions entity name.'
      type: String
    - contextPath: LogRhythm.User.objectPermissions.owner.id
      description: 'The user permissions owner ID.'
      type: Number
    - contextPath: LogRhythm.User.objectPermissions.owner.name
      description: 'The user permissions owner.'
      type: String
    - contextPath: LogRhythm.User.id
      description: 'The user ID.'
      type: Number
    - contextPath: LogRhythm.User.recordStatusName
      description: 'The user record status.'
      type: String
    - contextPath: LogRhythm.User.dateUpdated
      description: 'The date the user was updated.'
      type: Date
  - name: lr-lists-get
    description: 'Returns list details using the filter criteria.'
    arguments:
    - name: list_type
      description: 'The list type. Possible values: "None", "Application", "Classification", "CommonEvent", "Host", "Location", "MsgSource", "MsgSourceType", "MPERule", "Network", "User", "GeneralValue", "Entity", "RootEntity", "IP", "IPRange", and "Identity".'
      auto: PREDEFINED
      predefined:
      - None
      - Application
      - Classification
      - CommonEvent
      - Host
      - Location
      - MsgSource
      - MsgSourceType
      - MPERule
      - Network
      - User
      - GeneralValue
      - Entity
      - RootEntity
      - IP
      - IPRange
      - Identity
    - name: list_name
      description: 'The name of the object or regex match.'
    - name: can_edit
      description: 'Specifies if Write Only (true) or Read Only (false) lists are required for a user. Possible values: "true" and "false".'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    outputs:
    - type: String
      contextPath: LogRhythm.List.listType
      description: 'The list type.'
    - type: String
      contextPath: LogRhythm.List.status
      description: 'The list status.'
    - type: String
      contextPath: LogRhythm.List.name
      description: 'The list name.'
    - type: String
      contextPath: LogRhythm.List.shortDescription
      description: 'The list short description.'
    - type: String
      contextPath: LogRhythm.List.useContext
      description: 'The use context type.'
    - type: Boolean
      contextPath: LogRhythm.List.autoImportOption.enabled
      description: 'Whether the list auto import is enabled.'
    - type: Boolean
      contextPath: LogRhythm.List.autoImportOption.usePatterns
      description: 'Whether the auto import use patterns is enabled.'
    - type: Boolean
      contextPath: LogRhythm.List.autoImportOption.replaceExisting
      description: 'Whether the auto import replace existing is enabled.'
    - type: Number
      contextPath: LogRhythm.List.id
      description: 'The list ID.'
    - type: String
      contextPath: LogRhythm.List.guid
      description: 'The list GUID.'
    - type: Date
      contextPath: LogRhythm.List.dateCreated
      description: 'The date the list was created.'
    - type: Date
      contextPath: LogRhythm.List.dateUpdated
      description: 'The date the list was updated.'
    - type: String
      contextPath: LogRhythm.List.readAccess
      description: 'The read permission level.'
    - type: String
      contextPath: LogRhythm.List.writeAccess
      description: 'The write permission level.'
    - type: Boolean
      contextPath: LogRhythm.List.restrictedRead
      description: 'Whether the list is read restricted.'
    - type: String
      contextPath: LogRhythm.List.entityName
      description: 'The list entity name.'
    - type: Number
      contextPath: LogRhythm.List.entryCount
      description: 'The list entry count.'
    - type: Boolean
      contextPath: LogRhythm.List.needToNotify
      description: 'Whether the list will notify the user when updated.'
    - type: Boolean
      contextPath: LogRhythm.List.doesExpire
      description: 'Whether the list expires.'
    - type: Number
      contextPath: LogRhythm.List.owner
      description: 'The ID of the list owner.'
    - type: String
      contextPath: LogRhythm.List.longDescription
      description: 'The list long description.'
    - type: Number
      contextPath: LogRhythm.List.timeToLiveSeconds
      description: 'The list time for the list to live in seconds.'
    - type: Date
      contextPath: LogRhythm.List.revisitDate
      description: 'The list revisit date.'
  - name: lr-list-summary-create-update
    description: 'Updates a list summary based on the GUID and other required details. Searches the system for existing list summaries by GUID. Creates a new list summary if the GUID does not exist. Otherwise, updates the list summary.'
    arguments:
    - name: list_type
      description: 'The list type. Possible values: "None", "Application", "Classification", "CommonEvent", "Host", "Location", "MsgSource", "MsgSourceType", "MPERule", "Network", "User", "GeneralValue", "Entity", "RootEntity", "IP", "IPRange", and "Identity".'
      required: true
      auto: PREDEFINED
      predefined:
      - None
      - Application
      - Classification
      - CommonEvent
      - Host
      - Location
      - MsgSource
      - MsgSourceType
      - MPERule
      - Network
      - User
      - GeneralValue
      - Entity
      - RootEntity
      - IP
      - IPRange
      - Identity
    - name: name
      description: 'The list name.'
      required: true
    - name: enabled
      description: 'Whether the list auto import is enabled. Possible values: "true" and "false".'
      required: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: use_patterns
      description: 'Whether the auto import use patterns is enabled. Possible values: "true" and "false".'
      required: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: replace_existing
      description: 'Whether the auto import replace existing is enabled. Possible values: "true" and "false".'
      required: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: read_access
      description: 'The read permission level. Possible values: "Private", "PublicAll", "PublicGlobalAdmin", "PublicGlobalAnalyst", "PublicRestrictedAnalyst", "PublicRestrictedAdmin".'
      required: true
      auto: PREDEFINED
      predefined:
      - Private
      - PublicAll
      - PublicGlobalAdmin
      - PublicGlobalAnalyst
      - PublicRestrictedAnalyst
      - PublicRestrictedAdmin
    - name: write_access
      description: 'The write permission level. Possible values: "Private", "PublicAll", "PublicGlobalAdmin", "PublicGlobalAnalyst", "PublicRestrictedAnalyst", "PublicRestrictedAdmin".'
      required: true
      auto: PREDEFINED
      predefined:
      - Private
      - PublicAll
      - PublicGlobalAdmin
      - PublicGlobalAnalyst
      - PublicRestrictedAnalyst
      - PublicRestrictedAdmin
    - name: restricted_read
      description: 'Whether the list is read restricted. Possible values: "true" and "false".'
      required: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: entity_name
      description: 'The entity name.'
      required: true
    - name: need_to_notify
      description: 'Whether the list need to notify. Possible values: "true" and "false".'
      required: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: does_expire
      description: 'Whether the list expires. Possible values: "true" and "false".'
      required: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: owner
      description: 'The ID of the owner.'
    outputs:
    - contextPath: LogRhythm.List.listType
      description: 'The list type.'
      type: String
    - contextPath: LogRhythm.List.status
      description: 'The list status.'
      type: String
    - contextPath: LogRhythm.List.name
      description: 'The list name.'
      type: String
    - contextPath: LogRhythm.List.useContext
      description: 'The use context type.'
      type: String
    - contextPath: LogRhythm.List.autoImportOption.enabled
      description: 'Whether the list auto import is enabled.'
      type: Boolean
    - contextPath: LogRhythm.List.autoImportOption.usePatterns
      description: 'Whether the auto import use patterns is enabled.'
      type: Boolean
    - contextPath: LogRhythm.List.autoImportOption.replaceExisting
      description: 'Whether the auto import replace existing is enabled.'
      type: Boolean
    - contextPath: LogRhythm.List.id
      description: 'The list ID.'
      type: Number
    - contextPath: LogRhythm.List.guid
      description: 'The list GUID.'
      type: String
    - contextPath: LogRhythm.List.dateCreated
      description: 'The date the list was created.'
      type: Date
    - contextPath: LogRhythm.List.dateUpdated
      description: 'The date the list was updated.'
      type: Date
    - contextPath: LogRhythm.List.readAccess
      description: 'The read permission level.'
      type: String
    - contextPath: LogRhythm.List.writeAccess
      description: 'The write permission level.'
      type: String
    - contextPath: LogRhythm.List.restrictedRead
      description: 'Whether the list is read restricted.'
      type: Boolean
    - contextPath: LogRhythm.List.entityName
      description: 'The list entity name.'
      type: String
    - contextPath: LogRhythm.List.entryCount
      description: 'The list entry count.'
      type: Number
    - contextPath: LogRhythm.List.needToNotify
      description: 'Whether the list will notify the user when updated.'
      type: Boolean
    - contextPath: LogRhythm.List.doesExpire
      description: 'Whether the list expires.'
      type: Boolean
    - contextPath: LogRhythm.List.owner
      description: 'The ID of the list owner.'
      type: Number
  - name: lr-list-details-and-items-get
    description: 'Returns list details and list items based on the list GUID.'
    arguments:
    - name: list_guid
      description: 'The GUID stored in the database.'
      required: true
    - name: max_items
      defaultValue: "100"
      description: 'The maximum number of items that can be returned in a single request.'
    outputs:
    - type: String
      contextPath: LogRhythm.ListDetails.listType
      description: 'The list type.'
    - type: String
      contextPath: LogRhythm.ListDetails.status
      description: 'The list status.'
    - type: String
      contextPath: LogRhythm.ListDetails.name
      description: 'The list name.'
    - type: String
      contextPath: LogRhythm.ListDetails.useContext
      description: 'The use context type.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.autoImportOption.enabled
      description: 'Whether the list auto import is enabled.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.autoImportOption.usePatterns
      description: 'Whether the auto import use patterns is enabled.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.autoImportOption.replaceExisting
      description: 'Whether the auto import replace existing is enabled.'
    - type: Number
      contextPath: LogRhythm.ListDetails.id
      description: 'The list ID.'
    - type: String
      contextPath: LogRhythm.ListDetails.guid
      description: 'The list GUID.'
    - type: Date
      contextPath: LogRhythm.ListDetails.dateCreated
      description: 'The date the list was created.'
    - type: Date
      contextPath: LogRhythm.ListDetails.dateUpdated
      description: 'The date the list was updated.'
    - type: Date
      contextPath: LogRhythm.ListDetails.revisitDate
      description: 'The date the list was revisited.'
    - type: String
      contextPath: LogRhythm.ListDetails.readAccess
      description: 'The read permission level.'
    - type: String
      contextPath: LogRhythm.ListDetails.writeAccess
      description: 'The write permission level.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.restrictedRead
      description: 'Whether the list is read restricted.'
    - type: String
      contextPath: LogRhythm.ListDetails.entityName
      description: 'The list entity name.'
    - type: Number
      contextPath: LogRhythm.ListDetails.entryCount
      description: 'The list entry count.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.needToNotify
      description: 'Whether the list will notify the user when updated.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.doesExpire
      description: 'Whether the list expires.'
    - type: Number
      contextPath: LogRhythm.ListDetails.owner
      description: 'The ID of the list owner.'
    - type: Number
      contextPath: LogRhythm.ListDetails.listItemsCount
      description: 'The list items count.'
    - type: String
      contextPath: LogRhythm.ListDetails.items.displayValue
      description: 'The list items value.'
    - type: Unknown
      contextPath: LogRhythm.ListDetails.items.expirationDate
      description: 'The list item expiration date.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.items.isExpired
      description: 'Whether the item is expired.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.items.isListItem
      description: 'Whether the item is a list item.'
    - type: Boolean
      contextPath: LogRhythm.ListDetails.items.isPattern
      description: 'Whether the item is a pattern.'
    - type: String
      contextPath: LogRhythm.ListDetails.items.listItemDataType
      description: 'The item data type.'
    - type: String
      contextPath: LogRhythm.ListDetails.items.listItemType
      description: 'The item type.'
    - type: String
      contextPath: LogRhythm.ListDetails.items.value
      description: 'The item value.'
  - name: lr-list-items-add
    description: 'Adds more items to an existing list.'
    arguments:
    - name: list_guid
      description: 'The GUID stored in the database.'
      required: true
    - name: items
      description: 'The body of the list item so that the list can be updated with new items (JSON format).'
      required: true
    outputs:
    - type: String
      contextPath: LogRhythm.ListItemsAdd.listType
      description: 'The list type.'
    - type: String
      contextPath: LogRhythm.ListItemsAdd.status
      description: 'The list status.'
    - type: String
      contextPath: LogRhythm.ListItemsAdd.name
      description: 'The list name.'
    - type: String
      contextPath: LogRhythm.ListItemsAdd.useContext
      description: 'The use context type.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsAdd.autoImportOption.enabled
      description: 'Whether the list auto import is enabled.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsAdd.autoImportOption.usePatterns
      description: 'Whether the auto import use patterns is enabled.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsAdd.autoImportOption.replaceExisting
      description: 'Whether the auto import replace existing is enabled.'
    - type: Number
      contextPath: LogRhythm.ListItemsAdd.id
      description: 'The list ID.'
    - type: String
      contextPath: LogRhythm.ListItemsAdd.guid
      description: 'The list GUID.'
    - type: Date
      contextPath: LogRhythm.ListItemsAdd.dateCreated
      description: 'The date the list was created.'
    - type: Date
      contextPath: LogRhythm.ListItemsAdd.dateUpdated
      description: 'The date the list was updated.'
    - type: Date
      contextPath: LogRhythm.ListItemsAdd.revisitDate
      description: 'The list revisit date.'
    - type: String
      contextPath: LogRhythm.ListItemsAdd.readAccess
      description: 'The read permission level.'
    - type: String
      contextPath: LogRhythm.ListItemsAdd.writeAccess
      description: 'The write permission level.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsAdd.restrictedRead
      description: 'Whether the list is read restricted.'
    - type: String
      contextPath: LogRhythm.ListItemsAdd.entityName
      description: 'The list entity name.'
    - type: Number
      contextPath: LogRhythm.ListItemsAdd.entryCount
      description: 'The list entry count.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsAdd.needToNotify
      description: 'Whether the list will notify the user when updated.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsAdd.doesExpire
      description: 'Whether the list expires.'
    - type: Number
      contextPath: LogRhythm.ListItemsAdd.owner
      description: 'The ID of the list owner.'
    - type: Number
      contextPath: LogRhythm.ListItemsAdd.listItemsCount
      description: 'The list items count.'
  - name: lr-list-items-remove
    description: 'Removes items from an existing list.'
    arguments:
    - name: list_guid
      description: 'The GUID stored in the database.'
      required: true
    - name: items
      description: 'Body of the list items to be removed from the list (JSON format).'
      required: true
    outputs:
    - type: String
      contextPath: LogRhythm.ListItemsRemove.listType
      description: 'The list type.'
    - type: String
      contextPath: LogRhythm.ListItemsRemove.status
      description: 'The list status.'
    - type: String
      contextPath: LogRhythm.ListItemsRemove.name
      description: 'The list name.'
    - type: String
      contextPath: LogRhythm.ListItemsRemove.useContext
      description: 'The use context type.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsRemove.autoImportOption.enabled
      description: 'Whether the list auto import is enabled.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsRemove.autoImportOption.usePatterns
      description: 'Whether the auto import use patterns is enabled.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsRemove.autoImportOption.replaceExisting
      description: 'Whether the auto import replace existing is enabled.'
    - type: Number
      contextPath: LogRhythm.ListItemsRemove.id
      description: 'The list ID.'
    - type: String
      contextPath: LogRhythm.ListItemsRemove.guid
      description: 'The list GUID.'
    - type: Date
      contextPath: LogRhythm.ListItemsRemove.dateCreated
      description: 'The date the list was created.'
    - type: Date
      contextPath: LogRhythm.ListItemsRemove.dateUpdated
      description: 'The date the list was updated.'
    - type: Date
      contextPath: LogRhythm.ListItemsRemove.revisitDate
      description: 'The list revisit date.'
    - type: String
      contextPath: LogRhythm.ListItemsRemove.readAccess
      description: 'The read permission level.'
    - type: String
      contextPath: LogRhythm.ListItemsRemove.writeAccess
      description: 'The write permission level.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsRemove.restrictedRead
      description: 'Whether the list is read restricted.'
    - type: String
      contextPath: LogRhythm.ListItemsRemove.entityName
      description: 'The list entity name.'
    - type: Number
      contextPath: LogRhythm.ListItemsRemove.entryCount
      description: 'The list entry count.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsRemove.needToNotify
      description: 'Whether the list will notify the user when updated.'
    - type: Boolean
      contextPath: LogRhythm.ListItemsRemove.doesExpire
      description: 'Whether the list expires.'
    - type: Number
      contextPath: LogRhythm.ListItemsRemove.owner
      description: 'The ID of the list owner.'
    - type: Number
      contextPath: LogRhythm.ListItemsRemove.listItemsCount
      description: 'The list items count.'
  - name: lr-execute-search-query
    polling: true
    description: 'Execute a search query on the LogRhythm log database.'
    arguments:
    - name: number_of_days
      description: 'Number of days to search.'
      required: true
    - name: search_name
      description: 'Name of the search.'
    - name: source_type
      description: 'Log source type.'
      auto: PREDEFINED
      predefined:
      - all
      - API_-_AWS_CloudTrail
      - API_-_AWS_CloudWatch_Alarm
      - API_-_AWS_Config_Event
      - API_-_AWS_S3_Flat_File
      - API_-_AWS_S3_Server_Access_Event
      - API_-_BeyondTrust_Retina_Vulnerability_Management
      - API_-_Box_Event
      - API_-_Cisco_IDS/IPS
      - API_-_Cradlepoint_ECM
      - API_-_IP360_Vulnerability_Scanner
      - API_-_Metasploit_Penetration_Scanner
      - API_-_Nessus_Vulnerability_Scanner
      - API_-_NetApp_CIFS_Security_Audit_Event_Log
      - API_-_NeXpose_Vulnerability_Scanner
      - API_-_Office_365_Management_Activity
      - API_-_Office_365_Message_Tracking
      - API_-_Okta_Event
      - API_-_Qualys_Vulnerability_Scanner
      - API_-_Salesforce_EventLogFile
      - API_-_Sourcefire_eStreamer
      - API_-_Tenable_SecurityCenter
      - API_-_Tenable.io_Scanner
      - Flat_File_-_ActivIdentity_CMS
      - Flat_File_-_Airwatch_MDM
      - Flat_File_-_Alfresco
      - Flat_File_-_AllScripts
      - Flat_File_-_Apache_Access_Log
      - Flat_File_-_Apache_Error_Log
      - Flat_File_-_Apache_SSL_Access_Log
      - Flat_File_-_Apache_SSL_Error_Log
      - Flat_File_-_Apache_Tomcat_Access_Log
      - Flat_File_-_Apache_Tomcat_Console_Log
      - Flat_File_-_Avaya_Secure_Access_Link_Remote_Access_Log
      - Flat_File_-_Avaya_Voice_Mail_Log
      - Flat_File_-_Axway_SFTP
      - Flat_File_-_Beacon_Endpoint_Profiler
      - Flat_File_-_Bind_9
      - Flat_File_-_BlackBerry_Enterprise_Server
      - Flat_File_-_Blue_Coat_Proxy_BCREPORTERMAIN_Format
      - Flat_File_-_Blue_Coat_Proxy_CSV_Format
      - Flat_File_-_Blue_Coat_Proxy_SQUID-1_Format
      - Flat_File_-_Blue_Coat_Proxy_W3C_Format
      - Flat_File_-_Bro_IDS_Critical_Stack_Intel_Log
      - Flat_File_-_Broadcom_SiteMinder
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTDS
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTEL
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTJL
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTLL
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTNV
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTOM
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTPW
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTRL
      - Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTRV
      - Flat_File_-_CA_ControlMinder
      - Flat_File_-_Cerberus_FTP_Server
      - Flat_File_-_Cerner
      - Flat_File_-_Cisco_AMP_for_Endpoints
      - Flat_File_-_Cisco_Email_Security_Appliance
      - Flat_File_-_Cisco_LMS_(cwcli)
      - Flat_File_-_Cisco_LMS_(Syslog)
      - Flat_File_-_Cisco_NGFW
      - Flat_File_-_Cisco_Secure_ACS_CSV_File
      - Flat_File_-_Cisco_Security_Agent
      - Flat_File_-_Cisco_Umbrella_DNS
      - Flat_File_-_Cisco_Web_Security_aclog
      - Flat_File_-_Citrix_Access_Gateway_IIS_Format
      - Flat_File_-_Citrix_Access_Gateway_NCSA_Common_Format
      - Flat_File_-_Citrix_Access_Gateway_W3C_Format
      - Flat_File_-_Citrix_Presentation_Server
      - Flat_File_-_Citrix_Secure_Gateway
      - Flat_File_-_ClamAV_Anti-Virus
      - Flat_File_-_ColdFusion_Application_Log
      - Flat_File_-_ColdFusion_Exception_Log
      - Flat_File_-_ColdFusion_Mail_Log
      - Flat_File_-_ColdFusion_Mailsent_Log
      - Flat_File_-_ColdFusion_Server_Log
      - Flat_File_-_Cornerstone_Managed_File_Transfer
      - Flat_File_-_Coyote_Point_Equalizer
      - Flat_File_-_DB2_Audit_Log
      - Flat_File_-_DB2_via_BMC_Log_Master
      - Flat_File_-_Defender_Server
      - Flat_File_-_DocWorks
      - Flat_File_-_eClinicalWorks_Audit_Log
      - Flat_File_-_EMC_Isilon
      - Flat_File_-_Epicor_Coalition
      - Flat_File_-_FairWarning_Ready-For-Healthcare
      - Flat_File_-_FileZilla_System_Log
      - Flat_File_-_FireEye_Web_MPS
      - Flat_File_-_Forcepoint_Web_Security_CEF_Cloud_Format
      - Flat_File_-_Forescout_CounterACT
      - Flat_File_-_FoxT_BoKS_Server_Access_Control
      - Flat_File_-_FundsXpress
      - Flat_File_-_Gene6_FTP
      - Flat_File_-_GlobalSCAPE_EFT
      - Flat_File_-_Hadoop
      - Flat_File_-_HMC
      - Flat_File_-_HP-UX_Audit_Log
      - Flat_File_-_IBM_4690_POS
      - Flat_File_-_IBM_Informix_Application_Log
      - Flat_File_-_IBM_Informix_Audit_Log
      - Flat_File_-_IBM_Tivoli_Storage_Manager
      - Flat_File_-_IBM_WebSphere_App_Server_v7_Audit_Log
      - Flat_File_-_IBM_WebSphere_Cast_Iron_Cloud_Integration
      - Flat_File_-_IBM_ZOS_Batch_Decryption_Log
      - Flat_File_-_IBM_ZOS_CICS_Decryption_Log
      - Flat_File_-_IBM_ZOS_RACF_Access_Log
      - Flat_File_-_IBM_ZOS_RACF_SMF_Type_80
      - Flat_File_-_IPSwitch_WS_FTP
      - Flat_File_-_Irix_Audit_Logs
      - Flat_File_-_IT-CUBE_AgileSI
      - Flat_File_-_JBoss_Log_File
      - Flat_File_-_Juniper_Steel_Belted_Radius_Server
      - Flat_File_-_Kerio_Mail_Server
      - Flat_File_-_KERISYS_Doors_Event_Export_Format
      - Flat_File_-_Kippo_Honeypot
      - Flat_File_-_Linux_Audit_ASCII
      - Flat_File_-_Linux_Audit_Log
      - Flat_File_-_Linux_Host_Secure_Log
      - Flat_File_-_LOGbinder_EX
      - Flat_File_-_LogRhythm_Alarm_Reingest
      - Flat_File_-_LogRhythm_Data_Indexer_Monitor
      - Flat_File_-_LogRhythm_Oracle_Log
      - Flat_File_-_LogRhythm_System_Monitor
      - Flat_File_-_LogRhythm_System_Monitor_Log_File
      - Flat_File_-_LogRhythm_Trebek_Log
      - Flat_File_-_LogRhythm_Zeus_Log
      - Flat_File_-_Lotus_Domino_Client_Log
      - Flat_File_-_McAfee_Cloud_Proxy_do_not_use
      - Flat_File_-_McAfee_ePO_HIPS
      - Flat_File_-_McAfee_Foundstone
      - Flat_File_-_McAfee_Proxy_Cloud
      - Flat_File_-_McAfee_SaaS_Web_Protection
      - Flat_File_-_McAfee_Web_Gateway_Audit_Log
      - Flat_File_-_Merak
      - Flat_File_-_Meridian
      - Flat_File_-_Microsoft_ActiveSync_2010
      - Flat_File_-_Microsoft_CRM
      - Flat_File_-_Microsoft_DHCP_Server_Log
      - Flat_File_-_Microsoft_Forefront_TMG
      - Flat_File_-_Microsoft_Forefront_TMG_Web_Proxy
      - Flat_File_-_Microsoft_IIS_(IIS_Format)_File
      - Flat_File_-_Microsoft_IIS_7.x_W3C_Extended_Format
      - Flat_File_-_Microsoft_IIS_Error_Log_V6
      - Flat_File_-_Microsoft_IIS_FTP_IIS_Log_File_Format
      - Flat_File_-_Microsoft_IIS_FTP_W3C_Extended_Format
      - Flat_File_-_Microsoft_IIS_NCSA_Common_Format_File
      - Flat_File_-_Microsoft_IIS_SMTP_W3C_Format
      - Flat_File_-_Microsoft_IIS_URL_Scan_Log
      - Flat_File_-_Microsoft_IIS_W3C_File
      - Flat_File_-_Microsoft_ISA_Server_2004
      - Flat_File_-_Microsoft_ISA_Server_W3C_File
      - Flat_File_-_Microsoft_Netlogon
      - Flat_File_-_Microsoft_Port_Reporter_PR-PORTS_Log
      - Flat_File_-_Microsoft_Semantic_Logging
      - Flat_File_-_Microsoft_SQL_Server_2000_Error_Log
      - Flat_File_-_Microsoft_SQL_Server_2005_Error_Log
      - Flat_File_-_Microsoft_SQL_Server_2008_Error_Log
      - Flat_File_-_Microsoft_SQL_Server_2012_Error_Log
      - Flat_File_-_Microsoft_SQL_Server_2014_Error_Log
      - Flat_File_-_Microsoft_Windows_2003_DNS
      - Flat_File_-_Microsoft_Windows_2008_DNS
      - Flat_File_-_Microsoft_Windows_2012_DNS
      - Flat_File_-_Microsoft_Windows_Firewall
      - Flat_File_-_MicroStrategy
      - Flat_File_-_Mimecast_Audit
      - Flat_File_-_Mimecast_Email
      - Flat_File_-_Monetra
      - Flat_File_-_MongoDB
      - Flat_File_-_MS_Exchange_2003_Message_Tracking_Log
      - Flat_File_-_MS_Exchange_2007_Message_Tracking_Log
      - Flat_File_-_MS_Exchange_2010_Message_Tracking_Log
      - Flat_File_-_MS_Exchange_2013_Message_Tracking_Log
      - Flat_File_-_MS_Exchange_2016_Message_Tracking_Log
      - Flat_File_-_MS_Exchange_RPC_Client_Access
      - Flat_File_-_MS_IAS/RAS_Server_NPS_DB_Log_Format
      - Flat_File_-_MS_IAS/RAS_Server_Standard_Log_Format
      - Flat_File_-_MS_ISA_Server_2006_ISA_All_Fields
      - Flat_File_-_MS_ISA_Server_2006_W3C_All_Fields
      - Flat_File_-_MS_SQL_Server_Reporting_Services_2008
      - Flat_File_-_MySQL
      - Flat_File_-_MySQL_error.log
      - Flat_File_-_MySQL_mysql.log
      - Flat_File_-_MySQL_mysql-slow.log
      - Flat_File_-_Nessus_System_Log
      - Flat_File_-_NetApp_Cluster
      - Flat_File_-_Nginx_Log
      - Flat_File_-_Novell_Audit
      - Flat_File_-_Novell_GroupWise
      - Flat_File_-_Novell_LDAP
      - Flat_File_-_ObserveIT_Enterprise
      - Flat_File_-_Office_365_Message_Tracking
      - Flat_File_-_OpenDJ
      - Flat_File_-_OpenVMS
      - Flat_File_-_OpenVPN
      - Flat_File_-_Oracle_11g_Fine_Grained_Audit_Trail
      - Flat_File_-_Oracle_9i
      - Flat_File_-_Oracle_BRM_CM_Log
      - Flat_File_-_Oracle_BRM_DM_Log
      - Flat_File_-_Oracle_Listener_Audit_Trail
      - Flat_File_-_Oracle_SunOne_Directory_Server
      - Flat_File_-_Oracle_SunOne_Web_Server_Access_Log
      - Flat_File_-_Oracle_Virtual_Directory
      - Flat_File_-_Oracle_WebLogic_11g_Access_Log
      - Flat_File_-_Other
      - Flat_File_-_PeopleSoft
      - Flat_File_-_PhpMyAdmin_Honeypot
      - Flat_File_-_Postfix
      - Flat_File_-_PowerBroker_Servers
      - Flat_File_-_Princeton_Card_Secure
      - Flat_File_-_ProFTPD
      - Flat_File_-_PureMessage_For_Exchange_SMTP_Log
      - Flat_File_-_PureMessage_For_UNIX_Blocklist_Log
      - Flat_File_-_PureMessage_For_UNIX_Message_Log
      - Flat_File_-_RACF_(SMF)
      - Flat_File_-_Radmin
      - Flat_File_-_Restic_Backup_Log
      - Flat_File_-_RL_Patient_Feedback
      - Flat_File_-_RSA_Adaptive_Authentication
      - Flat_File_-_RSA_Authentication_Manager_6.1
      - Flat_File_-_S2_Badge_Reader
      - Flat_File_-_Safenet
      - Flat_File_-_Sendmail_File
      - Flat_File_-_Sharepoint_ULS
      - Flat_File_-_ShoreTel_VOIP
      - Flat_File_-_Siemens_Radiology_Information_System
      - Flat_File_-_Snort_Fast_Alert_File
      - Flat_File_-_Solaris_-_Sulog
      - Flat_File_-_Solaris_Audit_Log
      - Flat_File_-_SpamAssassin
      - Flat_File_-_Squid_Proxy
      - Flat_File_-_Subversion
      - Flat_File_-_Sudo.Log
      - Flat_File_-_Swift_Alliance
      - Flat_File_-_Symantec_Antivirus_10.x_Corporate_Edtn
      - Flat_File_-_Symantec_Antivirus_12.x_Corporate_Edtn
      - Flat_File_-_Symitar_Episys_Console_Log
      - Flat_File_-_Symitar_Episys_Sysevent_Log
      - Flat_File_-_Tandem_EMSOUT_Log_File
      - Flat_File_-_Tandem_XYGATE
      - Flat_File_-_Tectia_SSH_Server
      - Flat_File_-_Trade_Innovations_CSCS
      - Flat_File_-_Trend_Micro_IMSS
      - Flat_File_-_Trend_Micro_Office_Scan
      - Flat_File_-_Tumbleweed_Mailgate_Server
      - Flat_File_-_Verint_Audit_Trail_File
      - Flat_File_-_VMWare_Virtual_Machine
      - Flat_File_-_Voltage_Securemail
      - Flat_File_-_Vormetric_Log_File
      - Flat_File_-_vsFTP_Daemon_Log
      - Flat_File_-_Vyatta_Firewall_Kernel_Log
      - Flat_File_-_WordPot_Honeypot
      - Flat_File_-_X-NetStat_Log
      - Flat_File_-_XPient_POS_CCA_Manager
      - Flat_File_-_XPIENT_POS_POSLOG
      - Flat_File_-_XPIENT_POS_Shell_Log
      - IPFIX_-_IP_Flow_Information_Export
      - J-Flow_-_Juniper_J-Flow_Version_5
      - J-Flow_-_Juniper_J-Flow_Version_9
      - LogRhythm_CloudAI
      - LogRhythm_Data_Loss_Defender
      - LogRhythm_Demo_File_-_Application_Server_Log
      - LogRhythm_Demo_File_-_Content_Inspection_Log
      - LogRhythm_Demo_File_-_Database_Audit_Log
      - LogRhythm_Demo_File_-_Ecom_Server_Log
      - LogRhythm_Demo_File_-_File_Server_Log
      - LogRhythm_Demo_File_-_Firewall_Log
      - LogRhythm_Demo_File_-_FTP_Log
      - LogRhythm_Demo_File_-_IDS_Alarms_Log
      - LogRhythm_Demo_File_-_Mail_Server_Log
      - LogRhythm_Demo_File_-_Netflow_Log
      - LogRhythm_Demo_File_-_Network_Device_Log
      - LogRhythm_Demo_File_-_Network_Server_Log
      - LogRhythm_Demo_File_-_VPN_Log
      - LogRhythm_Demo_File_-_Web_Access_Log
      - LogRhythm_File_Monitor_(AIX)
      - LogRhythm_File_Monitor_(HP-UX)
      - LogRhythm_File_Monitor_(Linux)
      - LogRhythm_File_Monitor_(Solaris)
      - LogRhythm_File_Monitor_(Windows)
      - LogRhythm_Filter
      - LogRhythm_Network_Connection_Monitor_(AIX)
      - LogRhythm_Network_Connection_Monitor_(HP-UX)
      - LogRhythm_Network_Connection_Monitor_(Linux)
      - LogRhythm_Network_Connection_Monitor_(Solaris)
      - LogRhythm_Network_Connection_Monitor_(Windows)
      - LogRhythm_Process_Monitor_(AIX)
      - LogRhythm_Process_Monitor_(HP-UX)
      - LogRhythm_Process_Monitor_(Linux)
      - LogRhythm_Process_Monitor_(Solaris)
      - LogRhythm_Process_Monitor_(Windows)
      - LogRhythm_Registry_Integrity_Monitor
      - LogRhythm_SQL_Server_2000_C2_Audit_Log
      - LogRhythm_SQL_Server_2005_C2_Audit_Log
      - LogRhythm_SQL_Server_2008_C2_Audit_Log
      - LogRhythm_SQL_Server_2012+_C2_Audit_Log
      - LogRhythm_User_Activity_Monitor_(AIX)
      - LogRhythm_User_Activity_Monitor_(HP-UX)
      - LogRhythm_User_Activity_Monitor_(Linux)
      - LogRhythm_User_Activity_Monitor_(Solaris)
      - LogRhythm_User_Activity_Monitor_(Windows)
      - MS_Event_Log_for_XP/2000/2003_-_Application
      - MS_Event_Log_for_XP/2000/2003_-_Application_-_Espaniol
      - MS_Event_Log_for_XP/2000/2003_-_BioPassword
      - MS_Event_Log_for_XP/2000/2003_-_DFS
      - MS_Event_Log_for_XP/2000/2003_-_Directory_Service
      - MS_Event_Log_for_XP/2000/2003_-_DNS
      - MS_Event_Log_for_XP/2000/2003_-_DotDefender
      - MS_Event_Log_for_XP/2000/2003_-_EMC_Celerra_NAS
      - MS_Event_Log_for_XP/2000/2003_-_File_Rep_Service
      - MS_Event_Log_for_XP/2000/2003_-_HA
      - MS_Event_Log_for_XP/2000/2003_-_Kaspersky
      - MS_Event_Log_for_XP/2000/2003_-_Micros_POS
      - MS_Event_Log_for_XP/2000/2003_-_PatchLink
      - MS_Event_Log_for_XP/2000/2003_-_SafeWord_2008
      - MS_Event_Log_for_XP/2000/2003_-_SCE
      - MS_Event_Log_for_XP/2000/2003_-_Security
      - MS_Event_Log_for_XP/2000/2003_-_Security_-_Espaniol
      - MS_Event_Log_for_XP/2000/2003_-_SMS_2003
      - MS_Event_Log_for_XP/2000/2003_-_System
      - MS_Event_Log_for_XP/2000/2003_-_System_-_Espaniol
      - MS_Event_Log_for_XP/2000/2003_-_Virtual_Server
      - MS_Windows_Event_Logging_-_ADFS_Admin
      - MS_Windows_Event_Logging_-_Application
      - MS_Windows_Event_Logging_-_AppLockerApp
      - MS_Windows_Event_Logging_-_Backup
      - MS_Windows_Event_Logging_-_Citrix_Delivery_Services
      - MS_Windows_Event_Logging_-_Citrix_XenApp
      - MS_Windows_Event_Logging_-_DFS
      - MS_Windows_Event_Logging_-_DHCP_Admin
      - MS_Windows_Event_Logging_-_DHCP_Operational
      - MS_Windows_Event_Logging_-_Diagnosis-PLA
      - MS_Windows_Event_Logging_-_Digital_Persona
      - MS_Windows_Event_Logging_-_Dir_Service
      - MS_Windows_Event_Logging_-_DNS
      - MS_Windows_Event_Logging_-_Dot_Defender
      - MS_Windows_Event_Logging_-_ESD_Data_Flow_Track
      - MS_Windows_Event_Logging_-_Exchange_Mailbox_DB_Failures
      - MS_Windows_Event_Logging_-_FailoverClustering/Operational
      - MS_Windows_Event_Logging_-_Firewall_With_Advanced_Security
      - MS_Windows_Event_Logging_-_Forefront_AV
      - MS_Windows_Event_Logging_-_Group_Policy_Operational
      - MS_Windows_Event_Logging_-_Hyper-V_Hvisor
      - MS_Windows_Event_Logging_-_Hyper-V_IMS
      - MS_Windows_Event_Logging_-_Hyper-V_Network
      - MS_Windows_Event_Logging_-_Hyper-V_SynthSt
      - MS_Windows_Event_Logging_-_Hyper-V_VMMS
      - MS_Windows_Event_Logging_-_Hyper-V_Worker
      - MS_Windows_Event_Logging_-_Kaspersky
      - MS_Windows_Event_Logging_-_Kernel_PnP_Configuration
      - MS_Windows_Event_Logging_-_Lync_Server
      - MS_Windows_Event_Logging_-_MSExchange_Management
      - MS_Windows_Event_Logging_-_Operations_Manager
      - MS_Windows_Event_Logging_-_PowerShell
      - MS_Windows_Event_Logging_-_Print_Services
      - MS_Windows_Event_Logging_-_Quest_ActiveRoles_EDM_Server
      - MS_Windows_Event_Logging_-_Replication
      - MS_Windows_Event_Logging_-_SafeWord_2008
      - MS_Windows_Event_Logging_-_Security
      - MS_Windows_Event_Logging_-_Setup
      - MS_Windows_Event_Logging_-_Sysmon
      - MS_Windows_Event_Logging_-_System
      - MS_Windows_Event_Logging_-_Task_Scheduler
      - MS_Windows_Event_Logging_-_TS_Gateway
      - MS_Windows_Event_Logging_-_TS_Licensing
      - MS_Windows_Event_Logging_-_TS_Local_Session_Manager
      - MS_Windows_Event_Logging_-_TS_Remote_Connection_Manager
      - MS_Windows_Event_Logging_-_TS_Session_Broker
      - MS_Windows_Event_Logging_-_TS_Session_Broker_Client
      - MS_Windows_Event_Logging_-_VisualSVN
      - MS_Windows_Event_Logging_:_Deutsch_-_Security
      - MS_Windows_Event_Logging_:_Espaniol_-_Application
      - MS_Windows_Event_Logging_:_Espaniol_-_Security
      - MS_Windows_Event_Logging_:_Espaniol_-_System
      - MS_Windows_Event_Logging_:_Francais_-_System
      - MS_Windows_Event_Logging_:_Francais_-_Security
      - MS_Windows_Event_Logging_XML_-_ADFS
      - MS_Windows_Event_Logging_XML_-_Application
      - MS_Windows_Event_Logging_XML_-_Forwarded_Events
      - MS_Windows_Event_Logging_XML_-_Generic
      - MS_Windows_Event_Logging_XML_-_Security
      - MS_Windows_Event_Logging_XML_-_Sysmon
      - MS_Windows_Event_Logging_XML_-_Sysmon_7.01
      - MS_Windows_Event_Logging_XML_-_Sysmon_8/9/10
      - MS_Windows_Event_Logging_XML_-_System
      - MS_Windows_Event_Logging_XML_-_Unisys_Stealth
      - MS_Windows_Event_Logging_XML_-_Windows_Defender
      - Netflow_-_Cisco_Netflow_Version_1
      - Netflow_-_Cisco_Netflow_Version_5
      - Netflow_-_Cisco_Netflow_Version_9
      - Netflow_-_Palo_Alto_Version_9
      - Netflow_-_SonicWALL_Version_5
      - Netflow_-_SonicWALL_Version_9
      - OPSEC_LEA_-_Checkpoint_Firewall
      - OPSEC_LEA_-_Checkpoint_Firewall_Audit_Log
      - OPSEC_LEA_-_Checkpoint_For_LR_7.4.1+
      - OPSEC_LEA_-_Checkpoint_Log_Server
      - sFlow_-_Version_5
      - SNMP_Trap_-_Audiolog
      - SNMP_Trap_-_Autoregistered
      - SNMP_Trap_-_Brocade_Switch
      - SNMP_Trap_-_Cisco_5508_Wireless_Controller
      - SNMP_Trap_-_Cisco_IP_SLA
      - SNMP_Trap_-_Cisco_Prime
      - SNMP_Trap_-_Cisco_Router-Switch
      - SNMP_Trap_-_CyberArk
      - SNMP_Trap_-_Dell_OpenManage
      - SNMP_Trap_-_HP_Network_Node_Manager
      - SNMP_Trap_-_IBM_TS3000_Series_Tape_Drive
      - SNMP_Trap_-_Riverbed_SteelCentral_NetShark
      - SNMP_Trap_-_RSA_Authentication_Manager
      - SNMP_Trap_-_Swift_Alliance
      - SNMP_Trap_-_Trend_Micro_Control_Manager
      - Syslog_-_3Com_Switch
      - Syslog_-_A10_Networks_AX1000_Load_Balancer
      - Syslog_-_A10_Networks_Web_Application_Firewall
      - Syslog_-_Accellion_Secure_File_Transfer_Application
      - Syslog_-_Active_Scout_IPS
      - Syslog_-_Adallom
      - Syslog_-_Adtran_Switch
      - Syslog_-_Aerohive_Access_Point
      - Syslog_-_Aerohive_Firewall
      - Syslog_-_AIMIA_Tomcat
      - Syslog_-_AirDefense_Enterprise
      - Syslog_-_Airmagnet_Wireless_IDS
      - Syslog_-_AirTight_IDS/IPS
      - Syslog_-_AirWatch_MDM
      - Syslog_-_Airwave_Management_System_Log
      - Syslog_-_AIX_Host
      - Syslog_-_Alcatel-Lucent_Switch
      - Syslog_-_Alcatel-Lucent_Wireless_Controller
      - Syslog_-_AlertLogic
      - Syslog_-_AMX_AV_Controller
      - Syslog_-_Apache_Access_Log
      - Syslog_-_Apache_Error_Log
      - Syslog_-_Apache_Tomcat_Request_Parameters
      - Syslog_-_Apache_Tomcat_Service_Clients_Log
      - Syslog_-_APC_ATS
      - Syslog_-_APC_NetBotz_Environmental_Monitoring
      - Syslog_-_APC_PDU
      - Syslog_-_APC_UPS
      - Syslog_-_Apcon_Network_Monitor
      - Syslog_-_Apex_One
      - Syslog_-_Arbor_Networks_Peakflow
      - Syslog_-_Arbor_Networks_Spectrum
      - Syslog_-_Arbor_Pravail_APS
      - Syslog_-_Arista_Switch
      - Syslog_-_Array_TMX_Load_Balancer
      - Syslog_-_Arris_CMTS
      - Syslog_-_Aruba_Clear_Pass
      - Syslog_-_Aruba_Mobility_Controller
      - Syslog_-_Aruba_Wireless_Access_Point
      - Syslog_-_AS/400_via_Powertech_Interact
      - Syslog_-_Asus_WRT_Router
      - Syslog_-_Avatier_Identity_Management_Suite_(AIMS)
      - Syslog_-_Avaya_Communications_Manager
      - Syslog_-_Avaya_Ethernet_Routing_Switch
      - Syslog_-_Avaya_G450_Media_Gateway
      - Syslog_-_Avaya_Router
      - Syslog_-_Aventail_SSL/VPN
      - Syslog_-_Avocent_Cyclades_Terminal_Server
      - Syslog_-_Azul_Java_Appliance
      - Syslog_-_Barracuda_Load_Balancer
      - Syslog_-_Barracuda_Mail_Archiver
      - Syslog_-_Barracuda_NG_Firewall
      - Syslog_-_Barracuda_NG_Firewall_6.x
      - Syslog_-_Barracuda_Spam_Firewall
      - Syslog_-_Barracuda_Web_Application_Firewall
      - Syslog_-_Barracuda_Webfilter
      - Syslog_-_BeyondTrust_BeyondInsight_LEEF
      - Syslog_-_Bind_DNS
      - Syslog_-_Bit9_Parity_Suite
      - Syslog_-_Bit9_Security_Platform_CEF
      - Syslog_-_Bit9+Carbon_Black_(Deprecated)
      - Syslog_-_BitDefender
      - Syslog_-_Black_Diamond_Switch
      - Syslog_-_Blue_Coat_CAS
      - Syslog_-_Blue_Coat_Forward_Proxy
      - Syslog_-_Blue_Coat_PacketShaper
      - Syslog_-_Blue_Coat_ProxyAV_ISA_W3C_Format
      - Syslog_-_Blue_Coat_ProxyAV_MS_Proxy_2.0_Format
      - Syslog_-_Blue_Coat_ProxySG
      - Syslog_-_Blue_Socket_Wireless_Controller
      - Syslog_-_Bluecat_Adonis
      - Syslog_-_BlueCedar
      - Syslog_-_BluVector
      - Syslog_-_Bomgar
      - Syslog_-_Bradford_Networks_NAC
      - Syslog_-_Bradford_Remediation_&_Registration_Svr
      - Syslog_-_Bro_IDS
      - Syslog_-_Brocade_Switch
      - Syslog_-_Bromium_vSentry_CEF
      - Syslog_-_BSD_Host
      - Syslog_-_CA_Privileged_Access_Manager
      - Syslog_-_Cb_Defense_CEF
      - Syslog_-_Cb_Protection_CEF
      - Syslog_-_Cb_Response_LEEF
      - Syslog_-_Cell_Relay
      - Syslog_-_Certes_Networks_CEP
      - Syslog_-_Check_Point_Log_Exporter
      - Syslog_-_Checkpoint_Site-to-Site_VPN
      - Syslog_-_Cisco_ACS
      - Syslog_-_Cisco_Aironet_WAP
      - Syslog_-_Cisco_APIC
      - Syslog_-_Cisco_Application_Control_Engine
      - Syslog_-_Cisco_ASA
      - Syslog_-_Cisco_Clean_Access_(CCA)_Appliance
      - Syslog_-_Cisco_CSS_Load_Balancer
      - Syslog_-_Cisco_Email_Security_Appliance
      - Syslog_-_Cisco_FirePOWER
      - Syslog_-_Cisco_Firepower_Threat_Defense
      - Syslog_-_Cisco_FireSIGHT
      - Syslog_-_Cisco_FWSM
      - Syslog_-_Cisco_Global_Site_Selector
      - Syslog_-_Cisco_ISE
      - Syslog_-_Cisco_Meraki
      - Syslog_-_Cisco_Nexus_Switch
      - Syslog_-_Cisco_PIX
      - Syslog_-_Cisco_Prime_Infrastructure
      - Syslog_-_Cisco_Router
      - Syslog_-_Cisco_Secure_ACS_5
      - Syslog_-_Cisco_Session_Border_Controller
      - Syslog_-_Cisco_Switch
      - Syslog_-_Cisco_Telepresence_Video_Communications_Server
      - Syslog_-_Cisco_UCS
      - Syslog_-_Cisco_Unified_Comm_Mgr_(Call_Mgr)
      - Syslog_-_Cisco_VPN_Concentrator
      - Syslog_-_Cisco_WAAS
      - Syslog_-_Cisco_Web_Security
      - Syslog_-_Cisco_Wireless_Access_Point
      - Syslog_-_Cisco_Wireless_Control_System
      - Syslog_-_CiscoWorks
      - Syslog_-_Citrix_Access_Gateway_Server
      - Syslog_-_Citrix_Netscaler
      - Syslog_-_Citrix_XenServer
      - Syslog_-_Claroty_CTD_CEF
      - Syslog_-_Clearswift_Secure_Email_Gateway
      - Syslog_-_CloudLock
      - Syslog_-_CodeGreen_Data_Loss_Prevention
      - Syslog_-_Cofense_Triage_CEF
      - Syslog_-_Consentry_NAC
      - Syslog_-_Corero_IPS
      - Syslog_-_Corero_SmartWall_DDoS
      - Syslog_-_CoyotePoint_Equalizer
      - Syslog_-_Crowdstrike_Falconhost_CEF
      - Syslog_-_CyberArk
      - Syslog_-_CyberArk_Privileged_Threat_Analytics
      - Syslog_-_Cylance_CEF
      - Syslog_-_CylancePROTECT
      - Syslog_-_DarkTrace_CEF
      - Syslog_-_Dell_Force_10
      - Syslog_-_Dell_PowerConnect_Switch
      - Syslog_-_Dell_Remote_Access_Controller
      - Syslog_-_Dell_SecureWorks_iSensor_IPS
      - Syslog_-_Dialogic_Media_Gateway
      - Syslog_-_Digital_Guardian_CEF
      - Syslog_-_D-Link_Switch
      - Syslog_-_Don_not_use
      - Syslog_-_Dragos_Platform_CEF
      - Syslog_-_Ecessa_ShieldLink
      - Syslog_-_EfficientIP
      - Syslog_-_EMC_Avamar
      - Syslog_-_EMC_Centera
      - Syslog_-_EMC_Data_Domain
      - Syslog_-_EMC_Isilon
      - Syslog_-_EMC_Unity_Array
      - Syslog_-_EMC_VNX
      - Syslog_-_Ensilo_NGAV
      - Syslog_-_Enterasys_Dragon_IDS
      - Syslog_-_Enterasys_Router
      - Syslog_-_Enterasys_Switch
      - Syslog_-_Entrust_Entelligence_Messaging_Server
      - Syslog_-_Entrust_IdentityGuard
      - Syslog_-_Epic_Hyperspace_CEF
      - Syslog_-_EqualLogic_SAN
      - Syslog_-_eSafe_Email_Security
      - Syslog_-_ESET_Remote_Administrator_(ERA)_LEEF
      - Syslog_-_Event_Reporter_(Win_2000/XP/2003)
      - Syslog_-_Exabeam
      - Syslog_-_Exchange_Message_Tracking
      - Syslog_-_ExtraHop
      - Syslog_-_Extreme_Wireless_LAN
      - Syslog_-_ExtremeWare
      - Syslog_-_ExtremeXOS
      - Syslog_-_F5_BIG-IP_Access_Policy_Manager
      - Syslog_-_F5_BIG-IP_AFM
      - Syslog_-_F5_BIG-IP_ASM
      - Syslog_-_F5_BIG-IP_ASM_Key-Value_Pairs
      - Syslog_-_F5_BIG-IP_ASM_v12
      - Syslog_-_F5_Big-IP_GTM_&_DNS
      - Syslog_-_F5_Big-IP_LTM
      - Syslog_-_F5_FirePass_Firewall
      - Syslog_-_F5_Silverline_DDoS_Protection
      - Syslog_-_Fargo_HDP_Card_Printer_and_Encoder
      - Syslog_-_Fat_Pipe_Load_Balancer
      - Syslog_-_Fidelis_XPS
      - Syslog_-_FireEye_E-Mail_MPS
      - Syslog_-_FireEye_EX
      - Syslog_-_FireEye_Web_MPS/CMS/ETP/HX
      - Syslog_-_Forcepoint_DLP
      - Syslog_-_Forcepoint_Email_Security_Gateway
      - Syslog_-_Forcepoint_Stonesoft_NGFW
      - Syslog_-_Forcepoint_SureView_Insider_Threat
      - Syslog_-_Forcepoint_Web_Security
      - Syslog_-_Forcepoint_Web_Security_CEF_Format
      - Syslog_-_Forescout_CounterACT_NAC
      - Syslog_-_Fortinet_FortiAnalyzer
      - Syslog_-_Fortinet_FortiAuthenticator
      - Syslog_-_Fortinet_FortiDDoS
      - Syslog_-_Fortinet_FortiGate
      - Syslog_-_Fortinet_FortiGate_v4.0
      - Syslog_-_Fortinet_FortiGate_v5.0
      - Syslog_-_Fortinet_FortiGate_v5.2
      - Syslog_-_Fortinet_FortiGate_v5.4/v5.6
      - Syslog_-_Fortinet_FortiGate_v5.6_CEF
      - Syslog_-_Fortinet_Fortigate_v6.0
      - Syslog_-_Fortinet_FortiMail
      - Syslog_-_Fortinet_FortiWeb
      - Syslog_-_Foundry_Switch
      - Syslog_-_Gene6_FTP
      - Syslog_-_Generic_CEF
      - Syslog_-_Generic_ISC_DHCP
      - Syslog_-_Generic_LEEF
      - Syslog_-_Guardium_Database_Activity_Monitor
      - Syslog_-_H3C_Router
      - Syslog_-_Hitachi_Universal_Storage_Platform
      - Syslog_-_HP_BladeSystem
      - Syslog_-_HP_iLO
      - Syslog_-_HP_Procurve_Switch
      - Syslog_-_HP_Router
      - Syslog_-_HP_Switch
      - Syslog_-_HP_Unix_Tru64
      - Syslog_-_HP_Virtual_Connect_Switch
      - Syslog_-_HP-UX_Host
      - Syslog_-_Huawei_Access_Router
      - Syslog_-_IBM_Blade_Center
      - Syslog_-_IBM_Security_Network_Protection
      - Syslog_-_IBM_Virtual_Tape_Library_Server
      - Syslog_-_IBM_WebSphere_DataPower_Integration
      - Syslog_-_IBM_zSecure_Alert_for_ACF2_2.1.0
      - Syslog_-_IceWarp_Server
      - Syslog_-_Imperva_Incapsula_CEF
      - Syslog_-_Imperva_SecureSphere
      - Syslog_-_Imprivata_OneSign_SSO
      - Syslog_-_InfoBlox
      - Syslog_-_Invincea_(LEEF)
      - Syslog_-_iPrism_Proxy_Log
      - Syslog_-_IPSWITCH_MOVEit_Server
      - Syslog_-_IPTables
      - Syslog_-_IRIX_Host
      - Syslog_-_iSeries_via_Powertech_Interact
      - Syslog_-_Ivanti_FileDirector
      - Syslog_-_JetNexus_Load_Balancer
      - Syslog_-_Juniper_DX_Application_Accelerator
      - Syslog_-_Juniper_Firewall
      - Syslog_-_Juniper_Firewall_3400
      - Syslog_-_Juniper_Host_Checker
      - Syslog_-_Juniper_IDP
      - Syslog_-_Juniper_NSM
      - Syslog_-_Juniper_Router
      - Syslog_-_Juniper_SSL_VPN
      - Syslog_-_Juniper_SSL_VPN_WELF_Format
      - Syslog_-_Juniper_Switch
      - Syslog_-_Juniper_Trapeze
      - Syslog_-_Juniper_vGW_Virtual_Gateway
      - Syslog_-_Kaspersky_Security_Center
      - Syslog_-_Kea_DHCP_Server
      - Syslog_-_Kemp_Load_Balancer
      - Syslog_-_KFSensor_Honeypot
      - Syslog_-_KFSensor_Honeypot_CEF
      - Syslog_-_Lancope_StealthWatch
      - Syslog_-_Lancope_StealthWatch_CEF
      - Syslog_-_Layer_7_SecureSpan_SOA_Gateway
      - Syslog_-_Legacy_Checkpoint_Firewall_(Not_Log_Exporter)
      - Syslog_-_Legacy_Checkpoint_IPS_(Not_Log_Exporter)
      - Syslog_-_Lieberman_Enterprise_Random_Password_Manager
      - Syslog_-_Linux_Audit
      - Syslog_-_Linux_Host
      - Syslog_-_Linux_TACACS_Plus
      - Syslog_-_LOGbinder_EX
      - Syslog_-_LOGbinder_SP
      - Syslog_-_LOGbinder_SQL
      - Syslog_-_LogRhythm_Data_Indexer_Monitor
      - Syslog_-_LogRhythm_Inter_Deployment_Data_Sharing
      - Syslog_-_LogRhythm_Log_Distribution_Services
      - Syslog_-_LogRhythm_Network_Monitor
      - Syslog_-_LogRhythm_Syslog_Generator
      - Syslog_-_Lumension
      - Syslog_-_MacOS_X
      - Syslog_-_Malwarebytes_Endpoint_Security_CEF
      - Syslog_-_Mandiant_MIR
      - Syslog_-_McAfee_Advanced_Threat_Defense
      - Syslog_-_McAfee_Email_And_Web_Security
      - Syslog_-_McAfee_ePO
      - Syslog_-_McAfee_Firewall_Enterprise
      - Syslog_-_McAfee_Network_Security_Manager
      - Syslog_-_McAfee_Secure_Internet_Gateway
      - Syslog_-_McAfee_SecureMail
      - Syslog_-_McAfee_Skyhigh_for_Shadow_IT_LEEF
      - Syslog_-_McAfee_Web_Gateway
      - Syslog_-_mGuard_Firewall
      - Syslog_-_Microsoft_Advanced_Threat_Analytics_(ATA)_CEF
      - Syslog_-_Microsoft_Azure_Log_Integration
      - Syslog_-_Microsoft_Azure_MFA
      - Syslog_-_Microsoft_Forefront_UAG
      - Syslog_-_Mirapoint
      - Syslog_-_MobileIron
      - Syslog_-_Motorola_Access_Point
      - Syslog_-_MS_IIS_Web_Log_W3C_Format_(Snare)
      - Syslog_-_MS_Windows_Event_Logging_XML_-_Application
      - Syslog_-_MS_Windows_Event_Logging_XML_-_Security
      - Syslog_-_MS_Windows_Event_Logging_XML_-_System
      - Syslog_-_Nagios
      - Syslog_-_nCircle_Configuration_Compliance_Manager
      - Syslog_-_NetApp_Filer
      - Syslog_-_NETASQ_Firewall
      - Syslog_-_NetGate_Router
      - Syslog_-_NetMotion_VPN
      - Syslog_-_Netscout_nGenius_InfiniStream
      - Syslog_-_NetScreen_Firewall
      - Syslog_-_Netskope
      - Syslog_-_Netskope_CEF
      - Syslog_-_Network_Chemistry_RFprotect
      - Syslog_-_Nginx_Web_Log
      - Syslog_-_Nimble_Storage
      - Syslog_-_Nortel_8600_Switch
      - Syslog_-_Nortel_BayStack_Switch
      - Syslog_-_Nortel_Contivity
      - Syslog_-_Nortel_Firewall
      - Syslog_-_Nortel_IP_1220
      - Syslog_-_Nortel_Passport_Switch
      - Syslog_-_Nozomi_Networks_Guardian_CEF
      - Syslog_-_NuSecure_Gateway
      - Syslog_-_Nutanix
      - Syslog_-_Open_Collector
      - Syslog_-_Open_Collector_-_AWS_CloudTrail
      - Syslog_-_Open_Collector_-_AWS_CloudWatch
      - Syslog_-_Open_Collector_-_AWS_Config_Events
      - Syslog_-_Open_Collector_-_AWS_Guard_Duty
      - Syslog_-_Open_Collector_-_AWS_S3
      - Syslog_-_Open_Collector_-_Azure_Event_Hub
      - Syslog_-_Open_Collector_-_Carbon_Black_Cloud
      - Syslog_-_Open_Collector_-_CarbonBlackBeat_Heartbeat
      - Syslog_-_Open_Collector_-_Cisco_AMP
      - Syslog_-_Open_Collector_-_Cisco_Umbrella
      - Syslog_-_Open_Collector_-_CiscoAMPBeat_Heartbeat
      - Syslog_-_Open_Collector_-_Duo_Authentication_Security
      - Syslog_-_Open_Collector_-_DuoBeat_Heartbeat
      - Syslog_-_Open_Collector_-_EventHubBeat_Heartbeat
      - Syslog_-_Open_Collector_-_GCP_Audit
      - Syslog_-_Open_Collector_-_GCP_Cloud_Key_Management_Service
      - Syslog_-_Open_Collector_-_GCP_Http_Load_Balancer
      - Syslog_-_Open_Collector_-_GCP_Pub_Sub
      - Syslog_-_Open_Collector_-_GCP_Security_Command_Center
      - Syslog_-_Open_Collector_-_GCP_Virtual_Private_Cloud
      - Syslog_-_Open_Collector_-_Gmail_Message_Tracking
      - Syslog_-_Open_Collector_-_GMTBeat_Heartbeat
      - Syslog_-_Open_Collector_-_GSuite
      - Syslog_-_Open_Collector_-_GSuiteBeat_Heartbeat
      - Syslog_-_Open_Collector_-_Metricbeat
      - Syslog_-_Open_Collector_-_Okta_System_Log
      - Syslog_-_Open_Collector_-_OktaSystemLogBeat_Heartbeat
      - Syslog_-_Open_Collector_-_PubSubBeat_Heartbeat
      - Syslog_-_Open_Collector_-_S3Beat_Heartbeat
      - Syslog_-_Open_Collector_-_Sophos_Central
      - Syslog_-_Open_Collector_-_SophosCentralBeat_Heartbeat
      - Syslog_-_Open_Collector_-_Webhook
      - Syslog_-_Open_Collector_-_Webhook_OneLogin
      - Syslog_-_Open_Collector_-_Webhook_Zoom
      - Syslog_-_Open_Collector_-_WebhookBeat_Heartbeat
      - Syslog_-_Opengear_Console
      - Syslog_-_OpenLDAP
      - Syslog_-_Oracle_10g_Audit_Trail
      - Syslog_-_Oracle_11g_Audit_Trail
      - Syslog_-_OSSEC_Alerts
      - Syslog_-_Other
      - Syslog_-_Outpost24
      - Syslog_-_Palo_Alto_Cortex_XDR
      - Syslog_-_Palo_Alto_Custom_Pipe
      - Syslog_-_Palo_Alto_Firewall
      - Syslog_-_Palo_Alto_Traps_CEF
      - Syslog_-_Palo_Alto_Traps_Management_Service
      - Syslog_-_Password_Manager_Pro
      - Syslog_-_pfSense_Firewall
      - Syslog_-_PingFederate_7.2
      - Syslog_-_PingFederate_CEF
      - Syslog_-_Polycom
      - Syslog_-_Postfix
      - Syslog_-_Procera_PacketLogic
      - Syslog_-_Proofpoint_Spam_Firewall
      - Syslog_-_Protegrity_Defiance_DPS
      - Syslog_-_QLogic_Infiniband_Switch
      - Syslog_-_Quest_Defender
      - Syslog_-_Radiator_Radius
      - Syslog_-_RADiFlow_3180_Switch
      - Syslog_-_Radware_Alteon_Load_Balancer
      - Syslog_-_Radware_DefensePro
      - Syslog_-_Radware_Web_Server_Director_Audit_Log
      - Syslog_-_Raritan_KVM
      - Syslog_-_Raz-Lee
      - Syslog_-_RedSeal
      - Syslog_-_Riverbed
      - Syslog_-_RSA_ACE
      - Syslog_-_RSA_Authentication_Manager_v7.1
      - Syslog_-_RSA_Authentication_Manager_v8.x
      - Syslog_-_RSA_Web_Threat_Detection
      - Syslog_-_RSA_Web_Threat_Detection_5.1
      - Syslog_-_RuggedRouter
      - Syslog_-_Safenet
      - Syslog_-_Sailpoint
      - Syslog_-_Sauce_Labs
      - Syslog_-_SecureAuth_IdP
      - Syslog_-_SecureAuth_IdP_v9
      - Syslog_-_SecureLink
      - Syslog_-_SecureTrack
      - Syslog_-_SEL_3610_Port_Switch
      - Syslog_-_SEL_3620_Ethernet_Security_Gateway
      - Syslog_-_Sentinel_IPS
      - Syslog_-_SentinelOne_CEF
      - Syslog_-_Sguil
      - Syslog_-_Siemens_Scalance_X400
      - Syslog_-_Smoothwall_Firewall
      - Syslog_-_SnapGear_Firewall
      - Syslog_-_Snare_Windows_2003_Event_Log
      - Syslog_-_Snare_Windows_2008_Event_Log
      - Syslog_-_Snort_IDS
      - Syslog_-_Solaris_(Snare)
      - Syslog_-_Solaris_Host
      - Syslog_-_SonicWALL
      - Syslog_-_SonicWALL_SSL-VPN
      - Syslog_-_Sophos_Email_Encryption_Appliance
      - Syslog_-_Sophos_UTM
      - Syslog_-_Sophos_Web_Proxy
      - Syslog_-_Sophos_XG_Firewall
      - Syslog_-_Sourcefire_IDS_3D
      - Syslog_-_Sourcefire_RNA
      - Syslog_-_Spectracom_Network_Time_Server
      - Syslog_-_Splunk_API_-_Checkpoint_Firewall
      - Syslog_-_Splunk_API_-_Cisco_Netflow_V9
      - Syslog_-_Splunk_API_-_Nessus_Vulnerability_Scanner
      - Syslog_-_Squid_Proxy
      - Syslog_-_StealthBits_Activity_Monitor
      - Syslog_-_STEALTHbits_StealthINTERCEPT
      - Syslog_-_StoneGate_Firewall
      - Syslog_-_Stonesoft_IPS
      - Syslog_-_Stormshield_Network_Security_Firewall
      - Syslog_-_Sycamore_Networks_DNX-88
      - Syslog_-_Sygate_Firewall
      - Syslog_-_Symantec_Advanced_Threat_Protection_(ATP)_CEF
      - Syslog_-_Symantec_DLP_CEF
      - Syslog_-_Symantec_Endpoint_Server
      - Syslog_-_Symantec_Messaging_Gateway
      - Syslog_-_Symantec_PGP_Gateway
      - Syslog_-_Symbol_Wireless_Access_Point
      - Syslog_-_Tanium
      - Syslog_-_Temporary_LST-2
      - Syslog_-_Tenable_SecurityCenter
      - Syslog_-_Thycotic_Secret_Server
      - Syslog_-_Tipping_Point_IPS
      - Syslog_-_Tipping_Point_SSL_Reverse_Proxy
      - Syslog_-_Top_Layer_IPS
      - Syslog_-_Townsend_Alliance_LogAgent
      - Syslog_-_Trend_Micro_Control_Manager_CEF
      - Syslog_-_Trend_Micro_Deep_Discovery_Inspector
      - Syslog_-_Trend_Micro_Deep_Security_CEF
      - Syslog_-_Trend_Micro_Deep_Security_LEEF
      - Syslog_-_Trend_Micro_IWSVA
      - Syslog_-_Trend_Micro_Vulnerability_Protection_Manager
      - Syslog_-_Tripwire
      - Syslog_-_Trustwave_NAC
      - Syslog_-_Trustwave_Secure_Web_Gateway
      - Syslog_-_Trustwave_Web_Application_Firewall
      - Syslog_-_Tufin
      - Syslog_-_Tumbleweed_Mailgate_Server
      - Syslog_-_Ubiquiti_UniFi_Security_Gateway
      - Syslog_-_Ubiquiti_UniFi_Switch
      - Syslog_-_Ubiquiti_UniFi_WAP
      - Syslog_-_Untangle
      - Syslog_-_Vamsoft_ORF
      - Syslog_-_Vanguard_Active_Alerts
      - Syslog_-_Varonis_DatAlert
      - Syslog_-_Vasco_Digipass_Identikey_Server
      - Syslog_-_Vectra_Networks
      - Syslog_-_Versa_Networks_SD-WAN
      - Syslog_-_VMWare_ESX/ESXi_Server
      - Syslog_-_VMware_Horizon_View
      - Syslog_-_VMWare_NSX/NSX-T
      - Syslog_-_VMWare_Unified_Access_Gateway
      - Syslog_-_VMWare_vCenter_Server
      - Syslog_-_VMWare_vShield
      - Syslog_-_Voltage_Securemail
      - Syslog_-_Vormetric_CoreGuard
      - Syslog_-_Vormetric_Data_Security_Manager
      - Syslog_-_WALLIX_Bastion
      - Syslog_-_Watchguard_FireBox
      - Syslog_-_WS2000_Wireless_Access_Point
      - Syslog_-_Wurldtech_SmartFirewall
      - Syslog_-_Xirrus_Wireless_Array
      - Syslog_-_Zimbra_System_Log
      - Syslog_-_Zix_E-mail_Encryption
      - Syslog_-_Zscaler_Nano_Streaming_Service
      - Syslog_-_ZXT_Load_Balancer
      - Syslog_-_ZyWALL_VPN_Firewall
      - Syslog_Avaya_G450_Media_Gateway
      - Syslog_File_-_AIX_Host
      - Syslog_File_-_BSD_Format
      - Syslog_File_-_HP-UX_Host
      - Syslog_File_-_IRIX_Host
      - Syslog_File_-_Linux_Host
      - Syslog_File_-_LogRhythm_Syslog_Generator
      - Syslog_File_-_MS_2003_Event_Log_(Snare)
      - Syslog_File_-_Oracle_10g_Audit_Trail
      - Syslog_File_-_Oracle_11g_Audit_Trail
      - Syslog_File_-_Solaris_Host
      - UDLA_-_CA_Single_Sign-On
      - UDLA_-_Deepnet_DualShield
      - UDLA_-_Drupal
      - UDLA_-_Finacle_Core
      - UDLA_-_Finacle_Treasury_Logs
      - UDLA_-_Forcepoint
      - UDLA_-_Gallagher_Command_Centre
      - UDLA_-_iManage_Worksite
      - UDLA_-_ISS_Proventia_SiteProtector_-_IPS
      - UDLA_-_LogRhythm_Enterprise_Monitoring_Solution
      - UDLA_-_LREnhancedAudit
      - UDLA_-_McAfee_ePolicy_Orchestrator_-_Universal_ePOEvents
      - UDLA_-_McAfee_ePolicy_Orchestrator_3.6_-_Events
      - UDLA_-_McAfee_ePolicy_Orchestrator_4.0_-_ePOEvents
      - UDLA_-_McAfee_ePolicy_Orchestrator_4.5_-_ePOEvents
      - UDLA_-_McAfee_ePolicy_Orchestrator_5.0_-_ePOEvents
      - UDLA_-_McAfee_ePolicy_Orchestrator_5.1_-_ePOEvents
      - UDLA_-_McAfee_ePolicy_Orchestrator_5.3_-_ePOEvents
      - UDLA_-_McAfee_ePolicy_Orchestrator_5.9_-_ePOEvents
      - UDLA_-_McAfee_Network_Access_Control
      - UDLA_-_McAfee_Network_Security_Manager
      - UDLA_-_Microsoft_System_Center_2012_Endpoint_Protection
      - UDLA_-_ObserveIT
      - UDLA_-_Oracle_10g_Audit_Trail
      - UDLA_-_Oracle_11g_Audit_Trail
      - UDLA_-_Oracle_12C_Unified_Auditing
      - UDLA_-_Oracle_9i_Audit_Trail
      - UDLA_-_Other
      - UDLA_-_SEL_3530_RTAC
      - UDLA_-_SharePoint_2007_AuditData
      - UDLA_-_SharePoint_2010_EventData
      - UDLA_-_SharePoint_2013_EventData
      - UDLA_-_Siemens_Invision
      - UDLA_-_Sophos_Anti-Virus
      - UDLA_-_Sophos_Endpoint_Security_and_Control
      - UDLA_-_Symantec_CSP
      - UDLA_-_Symantec_SEP
      - UDLA_-_Symmetry_Access_Control
      - UDLA_-_VMWare_vCenter_Server
      - UDLA_-_VMWare_vCloud
      - VLS_-_Syslog_-_Infoblox_-_DNS_RPZ
      - VLS_-_Syslog_-_Infoblox_-_Threat_Protection
    - name: host_name
      description: 'Impacted host name.'
    - name: username
      description: 'Username.'
    - name: subject
      description: 'Email subject.'
    - name: sender
      description: 'Email sender.'
    - name: recipient
      description: 'Email recipient.'
    - name: hash
      description: 'Hash code of the event.'
    - name: url
      description: 'URL of the event.'
    - name: process_name
      description: 'Process name.'
    - name: object
      description: 'Log object.'
    - name: ip_address
      description: 'IP address of the endpoint.'
    - name: max_message
      description: 'Maximum number of log messages to query.'
      defaultValue: "100"
    - name: query_timeout
      description: 'The query timeout in seconds.'
      defaultValue: "60"
    - name: entity_id
      description: 'Entity ID.'
    - description: 'Interval in seconds between each poll.'
      name: interval_in_seconds
    - name: page_size
      description: 'Page size.'
      defaultValue: "50"
    outputs:
    - type: String
      contextPath: LogRhythm.Search.TaskId
      description: 'The task ID returned from the database for the current search. This is actually the search GUID.'
    - type: String
      contextPath: LogRhythm.Search.StatusMessage
      description: 'The task status returned from the database for the current search.'
    - type: String
      contextPath: LogRhythm.Search.SearchName
      description: 'The name of the search query in Cortex XSOAR.'
    - contextPath: LogRhythm.Search.TaskStatus
      description: 'Task status.'
      type: String
    - contextPath: LogRhythm.Search.Results.originEntityId
      description: 'Entity ID.'
      type: Number
    - contextPath: LogRhythm.Search.Results.impactedIp
      description: 'Impacted IP address.'
      type: String
    - contextPath: LogRhythm.Search.Results.classificationTypeName
      description: 'Classification name.'
      type: String
    - contextPath: LogRhythm.Search.Results.logSourceName
      description: 'Log source name.'
      type: String
    - contextPath: LogRhythm.Search.Results.entityName
      description: 'Entity name.'
      type: String
    - contextPath: LogRhythm.Search.Results.normalDate
      description: 'Date.'
      type: Date
    - contextPath: LogRhythm.Search.Results.vendorMessageId
      description: 'Vendor log message.'
      type: String
    - contextPath: LogRhythm.Search.Results.priority
      description: 'Log priority.'
      type: Number
    - contextPath: LogRhythm.Search.Results.sequenceNumber
      description: 'Sequence number.'
      type: String
    - contextPath: LogRhythm.Search.Results.originHostId
      description: 'Origin host ID.'
      type: Number
    - contextPath: LogRhythm.Search.Results.mpeRuleId
      description: 'Logrhythm rule ID.'
      type: Number
    - contextPath: LogRhythm.Search.Results.originIp
      description: 'Origin IP address.'
      type: String
    - contextPath: LogRhythm.Search.Results.mpeRuleName
      description: 'Logrhythm rule name.'
      type: String
    - contextPath: LogRhythm.Search.Results.logSourceHostId
      description: 'Log source host ID.'
      type: Number
    - contextPath: LogRhythm.Search.Results.originHost
      description: 'Origin host.'
      type: String
    - contextPath: LogRhythm.Search.Results.logDate
      description: 'Log date.'
      type: Date
    - contextPath: LogRhythm.Search.Results.classificationName
      description: 'Log classification name.'
      type: String
  - name: lr-get-query-result
    description: 'Get the search query result for the specified task ID. The task ID can be retrieved from the lr-execute-search-query command.'
    arguments:
    - name: task_id
      description: 'The task ID. The task ID can be retrieved from the lr-execute-search-query command.'
      required: true
    - name: page_size
      description: 'Page size.'
      defaultValue: "50"
    outputs:
    - contextPath: LogRhythm.Search.TaskStatus
      description: 'Task status.'
      type: String
    - contextPath: LogRhythm.Search.TaskId
      description: 'Task ID.'
      type: String
    - contextPath: LogRhythm.Search.Results.originEntityId
      description: 'Entity ID.'
      type: Number
    - contextPath: LogRhythm.Search.Results.impactedIp
      description: 'Impacted IP address.'
      type: String
    - contextPath: LogRhythm.Search.Results.classificationTypeName
      description: 'Classification name.'
      type: String
    - contextPath: LogRhythm.Search.Results.logSourceName
      description: 'Log source name.'
      type: String
    - contextPath: LogRhythm.Search.Results.entityName
      description: 'Entity name.'
      type: String
    - contextPath: LogRhythm.Search.Results.normalDate
      description: 'Date.'
      type: Date
    - contextPath: LogRhythm.Search.Results.vendorMessageId
      description: 'Vendor log message.'
      type: String
    - contextPath: LogRhythm.Search.Results.priority
      description: 'Log priority.'
      type: Number
    - contextPath: LogRhythm.Search.Results.sequenceNumber
      description: 'Sequence number.'
      type: String
    - contextPath: LogRhythm.Search.Results.originHostId
      description: 'Origin host ID.'
      type: Number
    - contextPath: LogRhythm.Search.Results.mpeRuleId
      description: 'Logrhythm rule ID.'
      type: Number
    - contextPath: LogRhythm.Search.Results.originIp
      description: 'Origin IP address.'
      type: String
    - contextPath: LogRhythm.Search.Results.mpeRuleName
      description: 'Logrhythm rule name.'
      type: String
    - contextPath: LogRhythm.Search.Results.logSourceHostId
      description: 'Log source host ID.'
      type: Number
    - contextPath: LogRhythm.Search.Results.originHost
      description: 'Origin host.'
      type: String
    - contextPath: LogRhythm.Search.Results.logDate
      description: 'Log date.'
      type: Date
    - contextPath: LogRhythm.Search.Results.classificationName
      description: 'Log classification name.'
      type: String
  - name: lr-add-host
    description: 'Add a new host to an entity.'
    arguments:
    - name: entity-id
      description: 'The entity ID for the host.'
    - name: entity-name
      description: 'The entity name for the host.'
      required: true
    - name: name
      description: 'The name of the host.'
      required: true
    - name: short-description
      description: 'A brief description of the component.'
    - name: long-description
      description: 'A full description of the component.'
    - name: risk-level
      description: 'The host risk level. Possible values: "None", "Low-Low", "Low-Medium", "Low-High", "Medium-Low", "Medium-Medium", "Medium-High", "High-Low", "High-Medium", and "High-High".'
      required: true
      auto: PREDEFINED
      predefined:
      - None
      - Low-Low
      - Low-Medium
      - Low-High
      - Medium-Low
      - Medium-Medium
      - Medium-High
      - High-Low
      - High-Medium
      - High-High
    - name: threat-level
      description: 'The host threat level. Possible values: "None", "Low-Low", "Low-Medium", "Low-High", "Medium-Low", "Medium-Medium", "Medium-High", "High-Low", "High-Medium", and "High-High".'
      auto: PREDEFINED
      predefined:
      - None
      - Low-Low
      - Low-Medium
      - Low-High
      - Medium-Low
      - Medium-Medium
      - Medium-High
      - High-Low
      - High-Medium
      - High-High
    - name: threat-level-comments
      description: 'Comments for the host threat level.'
    - name: host-status
      description: 'The host status. Possible values: "Retired" and "Active".'
      required: true
      auto: PREDEFINED
      predefined:
      - Retired
      - Active
    - name: host-zone
      description: 'The host zone. Possible values: "External", "DMZ", and "Internal".'
      required: true
      auto: PREDEFINED
      predefined:
      - External
      - DMZ
      - Internal
    - name: use-eventlog-credentials
      description: 'Whether to use the event log credentials. Possible values: "true" and "false".'
      required: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: os-type
      description: 'The Agent server type on which the operating system is installed. Possible values: "None", "Server", and "Desktop".'
      auto: PREDEFINED
      predefined:
      - None
      - Server
      - Desktop
    - name: os
      description: 'The operating system type supported by LogRhythm. Possible values: "Unknown", "Other", "WindowsNT4","Windows2000Professional", "Windows2000Server", "Windows2003Standard", "Windows2003Enterprise", "Windows95", "WindowsXP", "WindowsVista", "Linux", "Solaris", "AIX", "HPUX", and "Windows".'
      required: true
      auto: PREDEFINED
      predefined:
      - Unknown
      - Other
      - WindowsNT4
      - Windows2000Professional
      - Windows2000Server
      - Windows2003Standard
      - Windows2003Enterprise
      - Windows95
      - WindowsXP
      - WindowsVista
      - Linux
      - Solaris
      - AIX
      - HPUX
      - Windows
    outputs:
    - type: Number
      contextPath: LogRhythm.Host.id
      description: 'The host ID.'
    - type: Number
      contextPath: LogRhythm.Host.entity.id
      description: 'The host entity ID.'
    - type: String
      contextPath: LogRhythm.Host.entity.name
      description: 'The host entity name.'
    - type: String
      contextPath: LogRhythm.Host.name
      description: 'The host name.'
    - type: String
      contextPath: LogRhythm.Host.riskLevel
      description: 'The host risk level.'
    - type: String
      contextPath: LogRhythm.Host.threatLevel
      description: 'The host threat level.'
    - type: String
      contextPath: LogRhythm.Host.threatLevelComments
      description: 'The threat level comments.'
    - type: String
      contextPath: LogRhythm.Host.recordStatusName
      description: 'The host record status name.'
    - type: String
      contextPath: LogRhythm.Host.hostZone
      description: 'The host zone.'
    - type: Number
      contextPath: LogRhythm.Host.location.id
      description: 'The host location ID.'
    - type: String
      contextPath: LogRhythm.Host.os
      description: 'The operating system type supported by LogRhythm.'
    - type: Boolean
      contextPath: LogRhythm.Host.useEventlogCredentials
      description: 'Whether to use the event log credentials.'
    - type: String
      contextPath: LogRhythm.Host.osType
      description: 'The agent server type on which the operating system is installed.'
    - type: Date
      contextPath: LogRhythm.Host.dateUpdated
      description: 'The date the host was updated.'
  - name: endpoint
    description: 'Returns information about an endpoint.'
    arguments:
    - name: id
      description: 'The endpoint ID.'
    - name: hostname
      description: 'The endpoint hostname.'
    outputs:
    - contextPath: Endpoint.Hostname
      description: The endpoint's hostname.
      type: String
    - contextPath: Endpoint.ID
      description: The endpoint's ID.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The endpoint's IP address.
      type: String
  - name: lr-hosts-status-update
    description: 'Updates the status of a host to retire or active.'
    arguments:
    - name: host_id
      description: 'The host ID.'
      required: true
    - name: host_status
      description: 'The host status. Possible values: "Retired" and "Active".'
      required: true
      auto: PREDEFINED
      predefined:
      - Retired
      - Active
    outputs: []
  - name: lr-networks-list
    description: 'Returns all networks that match the specified criteria.'
    arguments:
    - name: network_id
      description: 'Filter by network ID.'
    - name: name
      description: 'Filter by name.'
    - name: record_status
      description: 'Filter by object record status. Possible values: "all", "retired", "active".'
      auto: PREDEFINED
      predefined:
      - all
      - retired
      - active
    - name: bip
      description: 'The starting IP address to allow records to be filtered on a specified IP address, e.g., 127.0.0.1.'
    - name: eip
      description: 'The ending IP address to allow records to be filtered on a specified IP address, e.g., 127.0.0.1.'
    - name: count
      defaultValue: "50"
      description: 'The numbers of networks to return.'
    - name: offset
      defaultValue: "0"
      description: 'The number of networks to skip before starting to collect the result set.'
    outputs:
    - contextPath: LogRhythm.Network.entity.id
      description: 'The network entity ID.'
      type: Number
    - contextPath: LogRhythm.Network.entity.name
      description: 'The network entity name.'
      type: String
    - contextPath: LogRhythm.Network.name
      description: 'The network name.'
      type: String
    - contextPath: LogRhythm.Network.shortDesc
      description: 'The network short description.'
      type: String
    - contextPath: LogRhythm.Network.longDesc
      description: 'The network long description.'
      type: String
    - contextPath: LogRhythm.Network.riskLevel
      description: 'The network risk level.'
      type: String
    - contextPath: LogRhythm.Network.threatLevel
      description: 'The network threat level.'
      type: String
    - contextPath: LogRhythm.Network.threatLevelComment
      description: 'The threat level comments.'
      type: String
    - contextPath: LogRhythm.Network.recordStatusName
      description: 'The network record status name.'
      type: String
    - contextPath: LogRhythm.Network.hostZone
      description: 'The network zone.'
      type: String
    - contextPath: LogRhythm.Network.location.id
      description: 'The network location ID.'
      type: Number
    - contextPath: LogRhythm.Network.location.name
      description: 'The network location name.'
      type: String
    - contextPath: LogRhythm.Network.bip
      description: 'Starting IP address.'
      type: String
    - contextPath: LogRhythm.Network.eip
      description: 'Ending IP address.'
      type: String
    - contextPath: LogRhythm.Network.dateUpdated
      description: 'The date the network was last updated.'
      type: Date
    - contextPath: LogRhythm.Network.id
      description: 'The network ID.'
      type: Number
defaultclassifier: LogRhythm Classifier
defaultmapperin: LogRhythm Mapper
tests:
- LogRhythmRestV2-test