commonfields:
  id: McAfeeDAM
  version: -1
name: McAfeeDAM
display: McAfee DAM
category: Database
sectionorder:
- Connect
- Collect
provider: STG
description: McAfee Database Activity Monitoring.
configuration:
- display: URL
  name: url
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: Credentials
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
  section: Connect
- display: Batch size for incident fetch
  name: batchSize
  defaultvalue: "10"
  type: 0
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Validate ceritifacte
  name: secure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Rule Name, If fetch incident is checked, this field is mandatory and will be used to get DAM alerts only triggered by this rule
  name: ruleName
  defaultvalue: ""
  type: 0
  required: false
  section: Collect
script:
  script: ''
  type: javascript
  commands:
  - name: dam-get-alert-by-id
    arguments:
    - name: id
      required: true
      default: true
      description: The alert ID.
    outputs:
    - contentPath: id
      contextPath: AlertId
      description: DAM alert ID.
    - contentPath: accessedObjects.object.name
      contextPath: alertAccessedObjects
      description: DAM accessed objects.
    - contentPath: execUser
      contextPath: dbUser
      description: DAM database user.
    - contentPath: osUser
      contextPath: Account.Username
      description: DAM OS user.
    - contentPath: database
      contextPath: database
      description: DAM database.
    - contentPath: identifyingSensor
      contextPath: sensor
      description: DAM sensor.
    - contentPath: rules
      contextPath: rules
      description: DAM rules.
    description: Gets a DAM alert from McAfee Database Activity Monitoring by alert ID.
  - name: dam-get-latest-by-rule
    arguments:
    - name: ruleName
      required: true
      default: true
      description: Name of the rule that triggered the alert.
    - name: count
      description: Number of alerts to retrieve. The default is 10.
    - name: timeBack
      description: Filter DAM alerts and import alerts that where created only in the last X minutes. The default is the last 10 minutes.
    outputs:
    - contentPath: id
      contextPath: AlertId
      description: DAM alert ID.
    - contentPath: accessedObjects.object.name
      contextPath: alertAccessedObjects
      description: DAM accessed objects.
    - contentPath: execUser
      contextPath: dbUser
      description: DAM database user.
    - contentPath: osUser
      contextPath: Account.Username
      description: DAM OS user.
    - contentPath: database
      contextPath: database
      description: DAM database.
    - contentPath: identifyingSensor
      contextPath: sensor
      description: DAM sensor.
    - contentPath: rules
      contextPath: rules
      description: DAM Rules.
    description: Gets the latest DAM alerts by rule name.
  isfetch: true
tests:
- No test
fromversion: 5.0.0