commonfields:
  id: Menlo Security
  version: -1
name: Menlo Security
display: Menlo Security
category: Network Security
provider: Menlo Security
sectionorder:
- Connect
- Collect
description: Collects web, email, audit, SMTP, attachment, DLP, HEAT, firewall, bandwidth, auth flows, and Menlo Security Client logs from the Menlo Security Isolation Platform (MSIP).
configuration:
- display: Server URL
  name: url
  type: 0
  defaultvalue: https://logs.menlosecurity.com
  required: true
  section: Connect
- displaypassword: Auth Token
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Token type
  name: token_type
  type: 15
  required: true
  defaultvalue: Admin Token
  options:
  - Admin Token
  - Token
  section: Connect
  additionalinfo: 'Select "Admin Token" for tokens generated from the Admin UI (recommended, uses the v2 API). Select "Token" for legacy CSV-based tokens (uses the v1 API).'
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Log types
  name: log_types
  type: 16
  required: true
  defaultvalue: web,safemail,audit,auth_flows,smtp,attachment,bandwidth,heat,firewall,dlp,ms_client_logs
  options:
  - web
  - safemail
  - audit
  - auth_flows
  - smtp
  - attachment
  - bandwidth
  - heat
  - firewall
  - dlp
  - ms_client_logs
  section: Collect
  additionalinfo: 'Select the log types to collect. Note: "heat" replaces the deprecated "isoc" log type.'
- display: Fetch events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
- display: Maximum number of events per fetch per log type
  name: max_events_per_fetch_per_type
  type: 0
  defaultvalue: "10000"
  required: false
  section: Collect
  additionalinfo: "The maximum number of events to fetch per log type per fetch cycle."
script:
  script: ""
  type: python
  commands:
  - name: menlo-security-get-events
    description: Manually fetch events from the Menlo Security Isolation Platform. Use this command to test the integration or retrieve events on demand.
    arguments:
    - name: start_time
      description: Start time for the event query (e.g. "1 hour", "2021-01-01T00:00:00Z"). Defaults to 1 hour ago.
      required: false
      defaultValue: "1 hour"
    - name: end_time
      description: End time for the event query (e.g. "now", "2021-01-02T00:00:00Z"). Defaults to now.
      required: false
      defaultValue: "now"
    - name: log_types
      description: 'Comma-separated list of log types to fetch. Options: web,safemail,audit,auth_flows,smtp,attachment,bandwidth,heat,firewall,dlp, ms_client_logs. Defaults to all configured log types.'
      required: false
      isArray: true
    - name: limit
      description: Maximum number of events to return per log type.
      required: false
      defaultValue: "100"
    - name: should_push_events
      description: Set to True to push the fetched events to XSIAM. Set to False to only display them.
      required: true
      defaultValue: "False"
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
  dockerimage: demisto/fastapi:0.125.0.10158186
  isfetchevents: true
  subtype: python3
fromversion: 8.2.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests