commonfields:
  id: Logz.io
  version: -1
name: Logz.io
display: Logz.io
category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: Logz.io
description: Fetch & remediate security incidents identified by Logz.io Cloud SIEM.
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: API token for Logz.io Security account
  name: security_api_token
  type: 4
  required: false
  section: Connect
- display: API token for Logz.io Operations account
  name: operational_api_token
  type: 4
  required: false
  section: Connect
- display: Region code of your Logz.io account
  name: region
  defaultvalue: us
  type: 15
  options:
  - us
  - eu
  - wa
  - nl
  - ca
  - au
  required: false
  section: Connect
- display: Filter by rule name
  name: search
  type: 0
  required: false
  section: Collect
- display: Filter by rule severity
  name: severities
  type: 16
  options:
  - SEVERE
  - HIGH
  - MEDIUM
  - LOW
  - INFO
  required: false
  section: Collect
- display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
  name: fetch_time
  defaultvalue: 1 hour
  type: 0
  required: false
  section: Collect
- display: Max. number of incidents fetched per run
  name: fetch_count
  defaultvalue: '50'
  type: 0
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  script: ''
  type: python
  commands:
  - name: logzio-search-logs
    arguments:
    - name: query
      required: true
      default: true
      description: A string specifying the search query, written in Apache Lucene syntax e.g. 'fname:John AND sname:Smith' (limited to 2 days range).
      defaultValue: '*'
    - name: size
      description: An integer specifying the maximum number of results to return.
    - name: from_time
      description: Specifies the earliest timestamp to be returned by the query.
    - name: to_time
      description: Specifies the latest timestamp to be returned by the query.
    - name: timeout
      description: Timeout in seconds.
      defaultValue: '2'
    outputs:
    - contextPath: Logzio.Result
      description: An array of search results.
      type: Unknown
    - contextPath: Logzio.Result.type
      description: Log type in the index.
      type: string
    - contextPath: Logzio.Result.timestamp
      description: The log's timestamp.
      type: date
    description: Runs an Apache Lucene query on your Logz.io Operations account.
  - name: logzio-get-logs-by-event-id
    arguments:
    - name: id
      required: true
      description: Logz.io Alert Event ID (found under Incident details).
    - name: size
      default: true
      description: An integer specifying the maximum number of results to return.
      defaultValue: '100'
    - name: timeout
      description: Timeout in seconds.
      defaultValue: '2'
    outputs:
    - contextPath: Logzio.Result
      description: An array of search results.
      type: Unknown
    - contextPath: Logzio.Result.type
      description: Log type in the index.
      type: string
    - contextPath: Logzio.Result.timestamp
      description: The log's timestamp.
      type: date
    description: Fetches the logs that triggered a security event in Logz.io Cloud SIEM.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  subtype: python3
fromversion: 5.0.0
tests:
- No Tests