category: Endpoint
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft Defender Advanced Threat Protection
  version: -1
configuration:
- defaultvalue: Worldwide
  display: Endpoint Type
  name: endpoint_type
  type: 15
  section: Connect
  additionalinfo: |-
    When selecting the Custom option, the Server URL parameter must be filled. More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-defender-advanced-threat-protection
  options:
  - Worldwide
  - EU Geo Proximity
  - UK Geo Proximity
  - US Geo Proximity
  - US GCC
  - US GCC-High
  - DoD
  - Custom
  advanced: true
  required: false
- displaypassword: ID
  name: _auth_id_encrypted
  type: 9
  hiddenusername: true
  section: Connect
  required: false
- displaypassword: Token
  name: _tenant_id_encrypted
  type: 9
  hiddenusername: true
  section: Connect
  required: false
- display: ID
  name: _auth_id
  type: 0
  section: Connect
  required: false
  hidden: true
- display: Token
  name: _tenant_id
  type: 0
  section: Connect
  required: false
  hidden: true
- displaypassword: Key
  section: Connect
  name: credentials
  type: 9
  hiddenusername: true
  required: false
- display: Certificate Thumbprint
  name: creds_certificate
  type: 9
  displaypassword: Private Key
  section: Connect
  advanced: true
  required: false
- additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  display: Private Key
  name: private_key
  type: 14
  hidden: true
  section: Connect
  advanced: true
  required: false
- additionalinfo: Type of authentication - either Authorization Code (recommended) or Client Credentials.
  display: Authentication Type
  name: auth_type
  defaultvalue: Client Credentials
  options:
  - Authorization Code
  - Client Credentials
  - Azure Managed Identities
  type: 15
  section: Connect
  advanced: true
  required: false
- display: Application redirect URI (for authorization code mode)
  name: redirect_uri
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Authorization code
  displaypassword: Authorization code
  additionalinfo: for user-auth mode - received from the authorization step. see Detailed Instructions section
  hiddenusername: true
  name: auth_code
  type: 9
  section: Connect
  advanced: true
  required: false
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- name: Reliability
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  section: Collect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: New
  display: 'Status for fetching alerts as incidents. Comma-separated lists are supported, e.g., New,Resolved.'
  name: fetch_status
  options:
  - New
  - InProgress
  - Resolved
  type: 16
  section: Collect
  advanced: true
  required: false
- display: 'DetectionSource to filter out alerts for fetching as incidents.'
  name: fetch_detectionsource
  options:
  - Antivirus
  - Automated investigation
  - Custom detection
  - Custom TI
  - EDR
  - Microsoft 365 Defender
  - Microsoft Defender for Office 365
  - Microsoft Defender Experts
  - SmartScreen
  - Third-party sensors
  type: 16
  section: Collect
  advanced: true
  required: false
- defaultvalue: Informational,Low,Medium,High
  display: 'Severity for fetching alerts as incidents. Comma-separated lists are supported, e.g., Medium,High.'
  name: fetch_severity
  type: 16
  options:
  - Informational
  - Low
  - Medium
  - High
  section: Collect
  advanced: true
  required: false
- defaultvalue: '50'
  display: Maximum number of incidents to fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Server URL (e.g., https://api.securitycenter.microsoft.com)
  name: url
  type: 0
  section: Connect
  advanced: true
  defaultvalue:
  additionalinfo: More information can be found on https://cortex.marketplace.pan.dev/marketplace/details/MicrosoftDefenderAdvancedThreatProtection/
  required: false
- additionalinfo: Select this checkbox if you are using a self-deployed Azure application.
  display: Use a self-deployed Azure Application
  name: self_deployed
  type: 8
  section: Connect
  advanced: false
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch alert evidence
  name: fetch_evidence
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: '3 days'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch_timestamp
  type: 0
  section: Collect
  required: false
- display: Using Microsoft GCC? (Deprecated)
  name: is_gcc
  type: 8
  hidden: true
  section: Connect
  advanced: true
  defaultvalue: 'false'
  required: false
- display: ID (received from the admin consent - see Detailed Instructions (?) section) (Deprecated)
  name: auth_id
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- display: Token (received from the admin consent - see Detailed Instructions (?) (Deprecated) section)
  name: tenant_id
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- display: Key (received from the admin consent - see Detailed Instructions (?) section) (Deprecated)
  name: enc_key
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
description: Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection (ATP)) is a unified platform for preventative protection, post-breach detection, automated investigation, and response.
display: Microsoft Defender for Endpoint
name: Microsoft Defender Advanced Threat Protection
script:
  commands:
  - description: Find Machines seen with the requested internal IP in the time range of 15 minutes prior and after a given timestamp.
    name: microsoft-atp-get-machine-by-ip
    arguments:
    - description: The endpoint IP address.
      name: ip
      required: true
    - name: timestamp
      description: The timestamp in witch the machines were seen with the internal ip address, 15 minutes before and after it. The given timestamp must be in the past 30 days. Timestamp format example- 2019-09-22T08:44:05Z.
      required: true
    - name: limit
      defaultValue: '50'
      description: Maximum number of results to return.
    - name: all_results
      description: Whether to retrieve all results. If true, the "limit" argument will be ignored.
      defaultValue: false
    outputs:
    - contextPath: MicrosoftATP.Machine.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.Machine.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.Machine.FirstSeen
      description: The first date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.LastSeen
      description: The last date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.Machine.OSVersion
      description: The operating system version.
      type: String
    - contextPath: MicrosoftATP.Machine.OSProcessor
      description: The operating system processor.
      type: String
    - contextPath: MicrosoftATP.Machine.LastIPAddress
      description: The last IP on the machine.
      type: String
    - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
      description: The last machine IP to access the internet.
      type: String
    - contextPath: MicrosoftATP.Machine.OSBuild
      description: The operating system build number.
      type: Number
    - contextPath: MicrosoftATP.Machine.HealthStatus
      description: The machine health status.
      type: String
    - contextPath: MicrosoftATP.Machine.RBACGroupID
      description: The machine RBAC group ID.
      type: Number
    - contextPath: MicrosoftATP.Machine.RBACGroupName
      description: The machine RBAC group name.
      type: String
    - contextPath: MicrosoftATP.Machine.RiskScore
      description: The machine risk score.
      type: String
    - contextPath: MicrosoftATP.Machine.ExposureLevel
      description: The machine exposure score.
      type: String
    - contextPath: MicrosoftATP.Machine.IsAADJoined
      description: True if machine is AAD joined, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.Machine.AADDeviceID
      description: The AAD Device ID.
      type: String
    - contextPath: MicrosoftATP.Machine.MachineTags
      description: Set of machine tags.
      type: String
    - contextPath: MicrosoftATP.Machine.IPAddresses.ipAddress
      description: The machine IP address.
      type: String
    - contextPath: MicrosoftATP.Machine.IPAddresses.MACAddress
      description: The machine MAC address.
      type: String
    - contextPath: MicrosoftATP.Machine.IPAddresses.operationalStatus
      description: The machine operational status.
      type: String
    - contextPath: MicrosoftATP.Machine.IPAddresses.type
      description: The machine IP address type.
      type: String
    - contextPath: MicrosoftATP.Machine.AgentVersion
      description: The machine Agent version.
      type: String
  - arguments:
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Tests connectivity to Microsoft Defender for Endpoint.
    name: microsoft-atp-test
    polling: true
  - arguments:
    - description: A comma-separated list of machine IDs to be used for isolation. e.g., 0a3250e0693a109f1affc9217be9459028aa8426,0a3250e0693a109f1affc9217be9459028aa8424.
      isArray: true
      name: machine_id
      required: true
      default: true
    - description: A comment to associate with the action.
      name: comment
      required: true
    - description: Full isolation or selective isolation. (Restrict only limited set of applications from accessing the network).
      name: isolation_type
      auto: PREDEFINED
      predefined:
      - Full
      - Selective
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Isolates a machine from accessing external networks.
    name: microsoft-atp-isolate-machine
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Type
      description: Type of the machine action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Scope
      description: Scope of the action.
      type: Unknown
    - contextPath: MicrosoftATP.MachineAction.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RequestorComment
      description: Comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
      description: The date and time when the action was created.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
      description: The last date and time when the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
      description: The file identifier.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
      description: 'The type of the file identifier. Possible values: "SHA1" ,"SHA256", and "MD5".'
      type: String
    execution: true
    polling: true
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: A comma-separated list of machine IDs to be used to stop the isolation. e.g., 0a3250e0693a109f1affc9217be9459028aa8426,0a3250e0693a109f1affc9217be9459028aa8424.
      isArray: true
      name: machine_id
      required: true
    - description: Comment to associate with the action.
      name: comment
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Undo an isolation of a machine.
    name: microsoft-atp-unisolate-machine
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Type
      description: Type of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Scope
      description: Scope of the action.
      type: Unknown
    - contextPath: MicrosoftATP.MachineAction.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RequestorComment
      description: The comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
      description: The date and time when the action was created.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
      description: The last date and time when the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
      description: The fileIdentifier.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
      description: 'The type of the file identifier. Possible values: "SHA1" ,"SHA256", and "MD5".'
      type: String
    polling: true
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: A comma-separated list of computer DNS name.
      isArray: true
      name: hostname
    - description: A comma-separated list of the last machine IPs to access the internet.
      name: ip
    - auto: PREDEFINED
      description: The machine risk score.
      isArray: true
      name: risk_score
      predefined:
      - Low
      - Medium
      - High
    - auto: PREDEFINED
      description: The machine health status.
      name: health_status
      predefined:
      - Active
      - Inactive
    - description: The machine's OS platform. Only a single platform can be added.
      name: os_platform
    - description: Number of machines to return in a page - must be lower or equal to 10,000.
      name: page_size
      defaultValue: '50'
    - description: The page number to retrieve.
      defaultValue: '1'
      name: page_num
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Retrieves a collection of machines that communicated with WDATP cloud in the last 30 days. Note - only IP or hostname can be a comma-separated list. If both are given as lists, an error will appear.
    name: microsoft-atp-get-machines
    outputs:
    - contextPath: MicrosoftATP.Machine.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.Machine.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.Machine.FirstSeen
      description: The first date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.LastSeen
      description: The last date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.Machine.OSVersion
      description: The operating system version.
      type: String
    - contextPath: MicrosoftATP.Machine.OSProcessor
      description: The operating system processor.
      type: String
    - contextPath: MicrosoftATP.Machine.LastIPAddress
      description: The last IP on the machine.
      type: String
    - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
      description: The last machine IP to access the internet.
      type: String
    - contextPath: MicrosoftATP.Machine.OSBuild
      description: The operating system build number.
      type: Number
    - contextPath: MicrosoftATP.Machine.HealthStatus
      description: The machine health status.
      type: String
    - contextPath: MicrosoftATP.Machine.RBACGroupID
      description: The machine RBAC group ID.
      type: Number
    - contextPath: MicrosoftATP.Machine.RBACGroupName
      description: The machine RBAC group name.
      type: String
    - contextPath: MicrosoftATP.Machine.RiskScore
      description: The machine risk score.
      type: String
    - contextPath: MicrosoftATP.Machine.ExposureLevel
      description: The machine exposure score.
      type: String
    - contextPath: MicrosoftATP.Machine.IsAADJoined
      description: True if machine is AAD joined, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.Machine.AADDeviceID
      description: The AAD Device ID.
      type: String
    - contextPath: MicrosoftATP.Machine.MachineTags
      description: Set of machine tags.
      type: String
    polling: true
  - arguments:
    - description: A comma-separated list of file SHA1 hashes to get the related machines.
      isArray: true
      name: file_hash
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Gets a collection of machines with a given file SHA1 hash.
    name: microsoft-atp-get-file-related-machines
    outputs:
    - contextPath: MicrosoftATP.FileMachine.Machines.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.FirstSeen
      description: The first date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.FileMachine.Machines.LastSeen
      description: The last date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.FileMachine.Machines.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.OSVersion
      description: The operating system version.
      type: String
    - contextPath: MicrosoftATP.Machine.OSProcessor
      description: The operating system processor.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.OSBuild
      description: Operating system build number.
      type: Number
    - contextPath: MicrosoftATP.FileMachine.Machines.LastIPAddress
      description: The last IP on the machine.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.LastExternalIPAddress
      description: The last machine IP to access the internet.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.HelathStatus
      description: The machine health status.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.RBACGroupID
      description: The machine RBAC group ID.
      type: Number
    - contextPath: MicrosoftATP.FileMachine.Machines.RBACGroupName
      description: The machine RBAC group name.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.RiskScore
      description: The machine risk score.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.ExposureLevel
      description: The machine exposure score.
      type: String
    - contextPath: MicrosoftATP.FileMachine.Machines.IsAADJoined
      description: True if machine is AAD joined, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.FileMachine.Machines.AADDeviceID
      description: The AAD Device ID.
      type: string
    - contextPath: MicrosoftATP.FileMachine.Machines.MachineTags
      description: Set of machine tags.
      type: String
    - contextPath: MicrosoftATP.FileMachine.File
      description: The machine related file hash.
      type: String
    polling: true
  - arguments:
    - description: A comma-separated list of machine IDs used to get the machine details, e.g., 0a3250e0693a109f1affc9217be9459028aa8426,0a3250e0693a109f1affc9217be9459028aa8424.
      isArray: true
      name: machine_id
      required: true
      default: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Get a machine's details by its identity.
    name: microsoft-atp-get-machine-details
    outputs:
    - contextPath: MicrosoftATP.Machine.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.Machine.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.Machine.FirstSeen
      description: The first date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.LastSeen
      description: The last date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.Machine.OSVersion
      description: The operating system version.
      type: String
    - contextPath: MicrosoftATP.Machine.OSProcessor
      description: The operating system processor.
      type: String
    - contextPath: MicrosoftATP.Machine.LastIPAddress
      description: The last IP on the machine.
      type: String
    - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
      description: The last machine IP to access the internet.
      type: String
    - contextPath: MicrosoftATP.Machine.OSBuild
      description: The operating system build number.
      type: Number
    - contextPath: MicrosoftATP.Machine.HealthStatus
      description: The machine health status.
      type: String
    - contextPath: MicrosoftATP.Machine.RBACGroupID
      description: 'The machine RBAC group ID.'
      type: Number
    - contextPath: MicrosoftATP.Machine.RBACGroupName
      description: The machine RBAC group name.
      type: String
    - contextPath: MicrosoftATP.Machine.RiskScore
      description: The machine risk score.
      type: String
    - contextPath: MicrosoftATP.Machine.ExposureLevel
      description: The machine exposure level.
      type: String
    - contextPath: MicrosoftATP.Machine.IsAADJoined
      description: True if machine is AAD joined, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.Machine.AADDeviceID
      description: The AAD Device ID.
      type: String
    - contextPath: MicrosoftATP.Machine.MachineTags
      description: Set of machine tags.
      type: String
    - contextPath: MicrosoftATP.Machine.NetworkInterfaces.MACAddress
      description: MAC Address for the network interface.
      type: String
    - contextPath: MicrosoftATP.Machine.NetworkInterfaces.IPAddresses
      description: IP Address(es) for the network interface.
      type: String
    - contextPath: MicrosoftATP.Machine.NetworkInterfaces.Type
      description: Type of the network interface (e.g. Ethernet).
      type: String
    - contextPath: MicrosoftATP.Machine.NetworkInterfaces.Status
      description: Status for the network interface (e.g. Up, Down).
      type: String
    polling: true
  - arguments:
    - description: A comma-separated list of machine IDs to run the scan on.
      name: machine_id
      isArray: true
      required: true
    - description: A comment to associate with the action.
      name: comment
      required: true
    - description: Defines the scan type.
      name: scan_type
      auto: PREDEFINED
      predefined:
      - Quick
      - Full
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Initiate a Microsoft Defender Antivirus scan on a machine.
    name: microsoft-atp-run-antivirus-scan
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Type
      description: The type of action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Scope
      description: The scope of the action.
      type: Unknown
    - contextPath: MicrosoftATP.MachineAction.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RequestorComment
      description: The comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
      description: The date and time the action was created.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
      description: The last date and time the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
      description: The file identifier.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
      description: 'The type of the file identifier. Possible values: "SHA1" ,"SHA256", and "MD5".'
      type: String
    polling: true
  - arguments:
    - description: Alert severity.
      name: severity
      auto: PREDEFINED
      predefined:
      - High
      - Medium
      - Low
      - Informational
    - auto: PREDEFINED
      description: Alert status.
      name: status
      predefined:
      - New
      - InProgress
      - Resolved
    - description: Alert category; only one can be added.
      name: category
    - description: Maximum number of files to display.
      name: limit
      defaultValue: '50'
    - description: The creation timestamp from which to get alerts (<number> <time unit>, e.g., 12 hours, 7 days).
      name: creation_time
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Deprecated. Use the 'msg-search-alerts' command in the 'Microsoft Graph Security' integration instead.
    name: microsoft-atp-list-alerts
    outputs:
    - contextPath: MicrosoftATP.Alert.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.Alert.IncidentID
      description: The incident ID of the alert.
      type: Number
    - contextPath: MicrosoftATP.Alert.InvestigationID
      description: The investigation ID related to the alert.
      type: Number
    - contextPath: MicrosoftATP.Alert.InvestigationState
      description: The current state of the investigation.
      type: String
    - contextPath: MicrosoftATP.Alert.AssignedTo
      description: The owner of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Severity
      description: The severity of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Status
      description: The current status of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.Alert.Determination
      description: The determination of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.DetectionSource
      description: The detection source.
      type: String
    - contextPath: MicrosoftATP.Alert.Category
      description: The category of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ThreatFamilyName
      description: The threat family.
      type: String
    - contextPath: MicrosoftATP.Alert.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.Alert.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.Alert.AlertCreationTime
      description: The date and time the alert was created.
      type: Date
    - contextPath: MicrosoftATP.Alert.FirstEventTime
      description: The first event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.Alert.LastEventTime
      description: The last event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.Alert.LastUpdateTime
      description: The UTC time of the last update.
      type: Date
    - contextPath: MicrosoftATP.Alert.ResolvedTime
      description: The date and time the alert status changed to 'Resolved'.
      type: Date
    - contextPath: MicrosoftATP.Alert.MachineID
      description: The machine ID associated with the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.Alert.AADTenantID
      description: The AAD tenant ID.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.Comment
      description: The alert comment string.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.CreatedBy
      description: The alert comment created by string.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.CreatedTime
      description: The alert comment created time date.
      type: Date
    - contextPath: MicrosoftATP.Alert.Evidence
      description: Evidence related to the alert.
      type: Unknown
    - contextPath: MicrosoftATP.Alert.DetectorID
      description: The ID of the detector that triggered the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ThreatName
      description: The threat name.
      type: String
    - contextPath: MicrosoftATP.Alert.RelatedUser
      description: Details of the user related to a specific alert.
      type: String
    - contextPath: MicrosoftATP.Alert.MitreTechniques
      description: MITRE Enterprise technique ID.
      type: String
    - contextPath: MicrosoftATP.Alert.RBACGroupName
      description: The device RBAC group name.
      type: String
    polling: true
    deprecated: true
  - arguments:
    - description: Alert ID to update.
      name: alert_id
      required: true
    - description: Alert status to update.
      name: status
      auto: PREDEFINED
      predefined:
      - New
      - InProgress
      - Resolved
    - name: assigned_to
      description: Owner of the alert.
    - description: The specification of the alert.
      name: classification
      auto: PREDEFINED
      predefined:
      - Unknown
      - FalsePositive
      - TruePositive
      - InformationalExpectedActivity
    - description: |-
        The determination of the alert.
      name: determination
      auto: PREDEFINED
      predefined:
      - NotAvailable
      - Malware
      - SecurityTesting
      - UnwantedSoftware
      - MultiStagedAttack
      - MaliciousUserActivity
      - CompromisedAccount
      - Phishing
      - LineOfBusinessApplication
      - ConfirmedActivity
      - NotMalicious
      - Other
    - description: Comment to be added to the alert.
      name: comment
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: "Deprecated. Use the 'msg-update-alert' command in the 'Microsoft Graph Security' integration instead."
    name: microsoft-atp-update-alert
    outputs:
    - contextPath: MicrosoftATP.Alert.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.Alert.IncidentID
      description: The incident ID of the alert.
      type: Number
    - contextPath: MicrosoftATP.Alert.InvestigationID
      description: The investigation ID related to the alert.
      type: Number
    - contextPath: MicrosoftATP.Alert.InvestigationState
      description: The current state of the investigation.
      type: String
    - contextPath: MicrosoftATP.Alert.AssignedTo
      description: The owner of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Severity
      description: The severity of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Status
      description: The current status of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.Alert.Determination
      description: The determination of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.DetectionSource
      description: The detection source.
      type: String
    - contextPath: MicrosoftATP.Alert.Category
      description: The category of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ThreatFamilyName
      description: The threat family.
      type: String
    - contextPath: MicrosoftATP.Alert.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.Alert.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.Alert.AlertCreationTime
      description: The date and time the alert was created.
      type: Date
    - contextPath: MicrosoftATP.Alert.FirstEventTime
      description: The first event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.Alert.LastEventTime
      description: The last event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.Alert.LastUpdateTime
      description: The UTC time of the last update.
      type: Date
    - contextPath: MicrosoftATP.Alert.ResolvedTime
      description: The date and time the alert status changed to 'Resolved'.
      type: Date
    - contextPath: MicrosoftATP.Alert.MachineID
      description: The machine ID associated with the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.Alert.AADTenantID
      description: The AAD tenant ID.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.Comment
      description: The alert comment string.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.CreatedBy
      description: The alert comment created by string.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.CreatedTime
      description: The alert comment created time date.
      type: Date
    polling: true
    deprecated: true
  - arguments:
    - description: The query to run. Must be passed if query_batch argument is not provided.
      name: query
      default: true
    - description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs. If specified with query_batch, will be applied to all queries in the array.
      name: timeout
      defaultValue: '10'
    - description: Time range to look back. The expected syntax is a human-readable time range, e.g., 60 minutes, 6 hours, 1 day, etc. If specified with query_batch, applies to all queries in the array.
      name: time_range
      defaultValue: ''
      predefined:
      - ''
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    - description: |-
        A JSON array of queries, limited to 10 queries. Cannot be provided with the query argument. Example for input:
        [{
          "query": "query #1",
          "name": "name #1",
          "timeout": "timeout #1",
          "time_range": "2 days ago"
          },
          {
          "query": "query #2",
          "name": "name #2",
          "timeout": "timeout #2",
          "time_range": "6 days ago"
          }]
        The query and name fields are mandatory. If timeout and time_range are specified, they will override the {timeout} and {time_range} argument.
      name: query_batch
    - description: If stated along with query, the response will be be saved in context under the Result.name path.
      name: name
    description: "Deprecated. Use the 'msg-advanced-hunting' command in the 'Microsoft Graph Security' integration instead."
    name: microsoft-atp-advanced-hunting
    outputs:
    - contextPath: MicrosoftATP.Hunt.Result
      description: The query results.
      type: String
    polling: true
    deprecated: true
  - arguments:
    - description: ID of the machine on which the event was identified.
      name: machine_id
      required: true
    - description: Severity of the alert.
      name: severity
      auto: PREDEFINED
      predefined:
      - Low
      - Medium
      - High
      required: true
    - description: Title for the alert.
      name: title
      required: true
    - description: Description of the alert.
      name: description
      required: true
    - description: Recommended action for the security officer to take when analyzing the alert.
      name: recommended_action
      required: true
    - description: The time of the event, as obtained from the advanced query.
      name: event_time
      required: true
    - description: The report ID, as obtained from the advanced query.
      name: report_id
      required: true
    - auto: PREDEFINED
      defaultValue: None
      description: Category of the alert.
      name: category
      predefined:
      - None
      - SuspiciousActivity
      - Malware
      - CredentialTheft
      - Exploit
      - WebExploit
      - DocumentExploit
      - PrivilegeEscalation
      - Persistence
      - RemoteAccessTool
      - CommandAndControl
      - SuspiciousNetworkTraffic
      - Ransomware
      - MalwareDownload
      - Reconnaissance
      - WebFingerprinting
      - Weaponization
      - Delivery
      - SocialEngineering
      - CredentialStealing
      - Installation
      - Backdoor
      - Trojan
      - TrojanDownloader
      - LateralMovement
      - ExplorationEnumeration
      - NetworkPropagation
      - Exfiltration
      - NotApplicable
      - EnterprisePolicy
      - General
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Deprecated. No available replacement.
    name: microsoft-atp-create-alert
    outputs:
    - contextPath: MicrosoftATP.Alert.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.Alert.IncidentID
      description: The incident ID of the alert.
      type: Number
    - contextPath: MicrosoftATP.Alert.InvestigationID
      description: The investigation ID related to the alert.
      type: Number
    - contextPath: MicrosoftATP.Alert.InvestigationState
      description: The current state of the investigation.
      type: String
    - contextPath: MicrosoftATP.Alert.AssignedTo
      description: The owner of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Severity
      description: The severity of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Status
      description: The current status of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.Alert.Determination
      description: The determination of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.DetectionSource
      description: The detection source.
      type: String
    - contextPath: MicrosoftATP.Alert.Category
      description: The category of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ThreatFamilyName
      description: The threat family.
      type: String
    - contextPath: MicrosoftATP.Alert.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.Alert.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.Alert.AlertCreationTime
      description: The date and time the alert was created.
      type: Date
    - contextPath: MicrosoftATP.Alert.FirstEventTime
      description: The first event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.Alert.LastEventTime
      description: The last event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.Alert.LastUpdateTime
      description: The UTC time of the last update.
      type: Date
    - contextPath: MicrosoftATP.Alert.ResolvedTime
      description: The date and time the alert status changed to 'Resolved'.
      type: Date
    - contextPath: MicrosoftATP.Alert.MachineID
      description: The machine ID associated with the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.Alert.AADTenantID
      description: The AAD tenant ID.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.Comment
      description: The alert comment string.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.CreatedBy
      description: The alert comment created by string.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.CreatedTime
      description: The alert comment created time date.
      type: Date
    polling: true
    deprecated: true
  - arguments:
    - description: ID of the alert.
      name: id
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Deprecated. An alternative is to use the 'msg-get-alert-details' command in the 'Microsoft Graph Security' integration, which can retrieve `userAccount` information as part of the alert details.
    name: microsoft-atp-get-alert-related-user
    outputs:
    - contextPath: MicrosoftATP.AlertUser.User.ID
      description: The user ID.
      type: String
    - contextPath: MicrosoftATP.AlertUser.User.AccountName
      description: The account name.
      type: String
    - contextPath: MicrosoftATP.AlertUser.User.AccountDomain
      description: The account domain.
      type: String
    - contextPath: MicrosoftATP.AlertUser.User.AccountSID
      description: The account SID.
      type: String
    - contextPath: MicrosoftATP.AlertUser.User.FirstSeen
      description: The user first seen date time.
      type: Date
    - contextPath: MicrosoftATP.AlertUser.User.LastSeen
      description: The user last seen date time.
      type: Date
    - contextPath: MicrosoftATP.AlertUser.User.MostPrevalentMachineID
      description: The most prevalent machine ID.
      type: String
    - contextPath: MicrosoftATP.AlertUser.User.LeastPrevalentMachineID
      description: The least prevalent machine ID.
      type: String
    - contextPath: MicrosoftATP.AlertUser.User.LogonTypes
      description: The user logon types.
      type: String
    - contextPath: MicrosoftATP.AlertUser.User.LogonCount
      description: The count of user logons.
      type: Number
    - contextPath: MicrosoftATP.AlertUser.User.DomainAdmin
      description: The domain admin.
      type: Number
    - contextPath: MicrosoftATP.AlertUser.User.NetworkUser
      description: The network user.
      type: Number
    - contextPath: MicrosoftATP.AlertUser.AlertID
      description: The alert ID.
      type: String
    polling: true
    deprecated: true
  - arguments:
    - description: ID of the alert.
      name: id
      required: true
    - defaultValue: '50'
      description: The maximum number of files to display.
      name: limit
    - defaultValue: '0'
      description: The page from which to get the related files.
      name: offset
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Deprecated. An alternative is to use the 'msg-get-alert-details' command in the 'Microsoft Graph Security' integration, which can retrieve `fileDetails` as part of the alert details.
    name: microsoft-atp-get-alert-related-files
    outputs:
    - contextPath: MicrosoftATP.AlertFile.Files.FilePublisher
      description: The file's publisher.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.Size
      description: The size of the file.
      type: Number
    - contextPath: MicrosoftATP.AlertFile.Files.GlobalLastObserved
      description: The last time the file was observed.
      type: Date
    - contextPath: MicrosoftATP.AlertFile.Files.Sha1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.IsValidCertificate
      description: Whether the signing certificate was successfully verified by the Microsoft Defender ATP agent.
      type: Number
    - contextPath: MicrosoftATP.AlertFile.Files.Sha256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.Signer
      description: The file signer.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.GlobalPrevalence
      description: The file prevalence across the organization.
      type: Number
    - contextPath: MicrosoftATP.AlertFile.Files.DeterminationValue
      description: The file determination value.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.GlobalFirstObserved
      description: The first time the file was observed.
      type: Date
    - contextPath: MicrosoftATP.AlertFile.Files.FileType
      description: The type of the file.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.SignerHash
      description: The hash of the signing certificate.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.Issuer
      description: The file issuer.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.IsPeFile
      description: True if the file is portable executable, False otherwise.
      type: Number
    - contextPath: MicrosoftATP.AlertFile.Files.DeterminationType
      description: The file determination type.
      type: String
    - contextPath: MicrosoftATP.AlertFile.Files.FileProductName
      description: The file product name.
      type: Unknown
    - contextPath: MicrosoftATP.AlertFile.Files.Md5
      description: The MD5 hash of the file.
      type: String
    polling: true
    deprecated: true
  - arguments:
    - description: ID of the alert.
      name: id
      required: true
    - defaultValue: '50'
      description: The maximum number of IPs to display.
      name: limit
    - defaultValue: '0'
      description: The page from which to get the related IPs.
      name: offset
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Deprecated. An alternative is to use the 'msg-get-alert-details' command in the 'Microsoft Graph Security' integration, which can retrieve `IpAddress` as part of the alert details.
    name: microsoft-atp-get-alert-related-ips
    outputs:
    - contextPath: MicrosoftATP.AlertIP.IPs.IpAddress
      description: The address of the IP.
      type: String
    - contextPath: MicrosoftATP.AlertIP.AlertID
      description: The alert ID.
      type: String
    polling: true
    deprecated: true
  - arguments:
    - description: ID of the alert.
      name: id
      required: true
    - description: The maximum number of domains to display.
      name: limit
      defaultValue: '50'
    - description: The page from which to get the related domains.
      name: offset
      defaultValue: '0'
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: |-
      Deprecated. An alternative is to use the 'msg-get-alert-details' command in the 'Microsoft Graph Security' integration to retrieve `DomainName` as part of the alert details.
    name: microsoft-atp-get-alert-related-domains
    outputs:
    - contextPath: MicrosoftATP.AlertDomain.Domains.Domain
      description: The domain address.
      type: String
    - contextPath: MicrosoftATP.AlertDomain.AlertID
      description: The alert ID.
      type: Unknown
    polling: true
    deprecated: true
  - arguments:
    - description: ID of the action.
      name: id
    - description: The machine action status.
      name: status
      auto: PREDEFINED
      predefined:
      - Pending
      - InProgress
      - Succeeded
      - Failed
      - TimeOut
      - Cancelled
    - description: A comma-separated list of machine IDs on which the action was executed.
      name: machine_id
      isArray: true
    - auto: PREDEFINED
      description: The machine action type.
      name: type
      predefined:
      - RunAntiVirusScan
      - Offboard
      - CollectInvestigationPackage
      - Isolate
      - Unisolate
      - StopAndQuarantineFile
      - RestrictCodeExecution
      - UnrestrictCodeExecution
    - description: The ID of the user that executed the action; only one can be added.
      name: requestor
    - defaultValue: '50'
      description: The maximum number of machines to return.
      name: limit
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    - name: filters
      description: String representation of filters (Override every other filters).
    description: |-
      Return the machine's actions. If you set an action ID, it returns the info on the specific action.
      Filtering can be done only on one argument.
    name: microsoft-atp-list-machine-actions-details
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Type
      description: The type of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Scope
      description: The scope of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RequestorComment
      description: The comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
      description: The date and time the action was created.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
      description: The last date and time the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
      description: The file identifier.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
      description: 'The file identifier type. Possible values: "SHA1" ,"SHA256", and "MD5".'
      type: String
    polling: true
  - arguments:
    - description: The machine ID.
      name: machine_id
      required: true
    - description: Comment to associate with the action.
      name: comment
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Collect an investigation package from a machine.
    name: microsoft-atp-collect-investigation-package
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Type
      description: The type of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Scope
      description: The scope of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RequestorComment
      description: The comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
      description: The date and time the action was created.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
      description: The last date and time the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
      description: The file identifier.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
      description: 'The file identifier type. Possible values: "SHA1" ,"SHA256", and "MD5".'
      type: String
    polling: true
  - arguments:
    - description: machine action ID.
      name: action_id
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Gets a URI that allows downloading an investigation package.
    name: microsoft-atp-get-investigation-package-sas-uri
    outputs:
    - contextPath: MicrosoftATP.InvestigationURI.Link
      description: The investigation package URI.
      type: String
    polling: true
  - arguments:
    - description: The machine ID.
      name: machine_id
      required: true
    - description: Comment to associate with the action.
      name: comment
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Restricts the execution of all applications on the machine except for a predefined set.
    name: microsoft-atp-restrict-app-execution
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Type
      description: The type of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Scope
      description: The scope of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RequestorComment
      description: The comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
      description: The date and time the action was created.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
      description: The last date and time the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
      description: The file identifier.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
      description: 'The file identifier type. Possible values: "SHA1" ,"SHA256", and "MD5".'
      type: String
    polling: true
  - arguments:
    - description: The machine ID.
      name: machine_id
      required: true
    - description: |-
        Comment to associate with the action.
      name: comment
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Enable the execution of any application on the machine.
    name: microsoft-atp-remove-app-restriction
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Type
      description: The type of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Scope
      description: The scope of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RequestorComment
      description: The comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
      description: The date and time the action was created.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
      description: The last date and time the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
      description: The file identifier.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
      description: 'The file identifier type. Possible values: "SHA1" ,"SHA256", and "MD5".'
      type: String
    polling: true
  - arguments:
    - description: The machine ID. When providing multiple values, each value is checked for the same hash.
      name: machine_id
      isArray: true
      required: true
    - description: |-
        The file SHA1 hash to stop and quarantine on the machine.
        When providing multiple values, each value is checked for the same machine_id.
      name: file_hash
      isArray: true
      required: true
    - description: Comment to associate with the action.
      name: comment
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    - description: Whether to use polling.
      auto: PREDEFINED
      defaultValue: 'false'
      name: polling
      predefined:
      - 'true'
      - 'false'
    - name: timeout_in_seconds
      description: Timeout for polling. Default is 300 seconds.
    - name: interval_in_seconds
      description: Interval between polling. Default is 10 seconds. Must be 10 or higher.
    - description: action IDs to use in polling commands. (automatically filled by polling).
      name: action_ids
      deprecated: true
    description: Stop the execution of a file on a machine and delete it.
    name: microsoft-atp-stop-and-quarantine-file
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Type
      description: The type of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Scope
      description: The scope of the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RequestorComment
      description: The comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
      description: The date and time the action was created.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
      description: The last date and time the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
      description: The file identifier.
      type: String
    - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
      description: 'The file identifier type. Possible values: "SHA1" ,"SHA256", and "MD5".'
      type: String
    polling: true
    compliantpolicies:
    - Quarantine File
  - arguments:
    - description: ID can be the investigation ID or the investigation triggering alert ID.
      name: id
    - description: The maximum number of investigations to display.
      name: limit
      defaultValue: '50'
    - defaultValue: '0'
      description: The page from which to get the investigations.
      name: offset
      predefined:
      - ''
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Retrieves a collection of investigations or retrieves a specific investigation by its ID.
    name: microsoft-atp-list-investigations
    outputs:
    - contextPath: MicrosoftATP.Investigation.ID
      description: The investigation ID.
      type: String
    - contextPath: MicrosoftATP.Investigation.StartTime
      description: The date and time the investigation was created.
      type: Date
    - contextPath: MicrosoftATP.Investigation.EndTime
      description: The date and time the investigation was completed.
      type: Date
    - contextPath: MicrosoftATP.Investigation.State
      description: The investigation state.
      type: String
    - contextPath: MicrosoftATP.Investigation.CancelledBy
      description: The ID of the user/application that cancelled that investigation.
      type: Unknown
    - contextPath: MicrosoftATP.Investigation.StatusDetails
      description: The details about the investigation state.
      type: Unknown
    - contextPath: MicrosoftATP.Investigation.MachineID
      description: The machine ID on which the investigation is executed.
      type: String
    - contextPath: MicrosoftATP.Investigation.ComputerDNSName
      description: The machine DNS name on which the investigation is executed.
      type: String
    - contextPath: MicrosoftATP.Investigation.TriggeringAlertID
      description: The alert ID that triggered the investigation.
      type: String
    polling: true
  - arguments:
    - description: The machine's ID.
      name: machine_id
      required: true
    - description: Comment to associate with the action.
      name: comment
      required: true
    - defaultValue: '50'
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      name: timeout
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Starts an automated investigation on a machine.
    name: microsoft-atp-start-investigation
    outputs:
    - contextPath: MicrosoftATP.Investigation.ID
      description: The investigation ID.
      type: String
    - contextPath: MicrosoftATP.Investigation.StartTime
      description: The date and time the investigation was created.
      type: Date
    - contextPath: MicrosoftATP.Investigation.EndTime
      description: The date and time the investigation was completed.
      type: Date
    - contextPath: MicrosoftATP.Investigation.State
      description: The investigation state.
      type: String
    - contextPath: MicrosoftATP.Investigation.CancelledBy
      description: The ID of the user/application that cancelled that investigation.
      type: Unknown
    - contextPath: MicrosoftATP.Investigation.StatusDetails
      description: The details about the investigation state.
      type: Unknown
    - contextPath: MicrosoftATP.Investigation.MachineID
      description: The machine ID on which the investigation is executed.
      type: String
    - contextPath: MicrosoftATP.Investigation.ComputerDNSName
      description: The machine DNS name on which the investigation is executed.
      type: String
    - contextPath: MicrosoftATP.Investigation.TriggeringAlertID
      description: The alert ID that triggered the investigation.
      type: String
    polling: true
  - arguments:
    - description: The domain address.
      name: domain
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Retrieves statistics on the given domain.
    name: microsoft-atp-get-domain-statistics
    outputs:
    - contextPath: MicrosoftATP.DomainStatistics.Statistics.Host
      description: The domain host.
      type: String
    - contextPath: MicrosoftATP.DomainStatistics.Statistics.OrgPrevalence
      description: The prevalence of the domain in the organization.
      type: String
    - contextPath: MicrosoftATP.DomainStatistics.Statistics.OrgFirstSeen
      description: The first date and time the domain was in the organization.
      type: Date
    - contextPath: MicrosoftATP.DomainStatistics.Statistics.OrgLastSeen
      description: The last date and time the domain was in the organization.
      type: Date
    polling: true
  - arguments:
    - description: The domain address.
      name: domain
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Deprecated. No available replacement.
    name: microsoft-atp-get-domain-alerts
    outputs:
    - contextPath: MicrosoftATP.DomainAlert.Domain
      description: The domain address.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.IncidentID
      description: The incident ID of the alert.
      type: Number
    - contextPath: MicrosoftATP.DomainAlert.Alerts.InvestigationID
      description: The investigation ID related to the alert.
      type: Number
    - contextPath: MicrosoftATP.DomainAlert.Alerts.InvestigationState
      description: The current state of the investigation.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.AssignedTo
      description: The owner of the alert.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Severity
      description: The severity of the alert.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Status
      description: The current status of the alert.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Determination
      description: The determination of the alert.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.DetectionSource
      description: The detection source.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Category
      description: The category of the alert.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.ThreatFamilyName
      description: The threat family name.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.AlertCreationTime
      description: The date and time the alert was created.
      type: Date
    - contextPath: MicrosoftATP.DomainAlert.Alerts.FirstEventTime
      description: The first event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.DomainAlert.Alerts.LastEventTime
      description: The last event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.DomainAlert.Alerts.LastUpdateTime
      description: The last update time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.DomainAlert.Alerts.ResolvedTime
      description: The date and time the status of the alert was changed to 'Resolved'.
      type: Date
    - contextPath: MicrosoftATP.DomainAlert.Alerts.MachineID
      description: The machine ID associated with the alert.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.AADTenantID
      description: The AAD tenant ID.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Comments.Comment
      description: The alert comment string.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Comments.CreatedBy
      description: The alert comment created by string.
      type: String
    - contextPath: MicrosoftATP.DomainAlert.Alerts.Comments.CreatedTime
      description: The alert comment created time date.
      type: Date
    polling: true
    deprecated: true
  - arguments:
    - description: The domain address.
      name: domain
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Retrieves a collection of machines that have communicated to or from a given domain address.
    name: microsoft-atp-get-domain-machines
    outputs:
    - contextPath: MicrosoftATP.DomainMachine.Domain
      description: The domain address.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.FirstSeen
      description: The first date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.DomainMachine.Machines.LastSeen
      description: The last date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.DomainMachine.Machines.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.OSVersion
      description: The operating system version.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.OSProcessor
      description: The operating system processor.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.LastIPAddress
      description: The last IP on the machine.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.LastExternalIPAddress
      description: The last IP through which the machine accessed the internet.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.OSBuild
      description: The operating system build number.
      type: Number
    - contextPath: MicrosoftATP.DomainMachine.Machines.HealthStatus
      description: The machine health status.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.RBACGroupID
      description: The machine RBAC group ID.
      type: Number
    - contextPath: MicrosoftATP.DomainMachine.Machines.RBACGroupName
      description: The machine RBAC group name.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.RiskScore
      description: The machine risk score.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.ExposureLevel
      description: The machine exposure level.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.IsAADJoined
      description: True if machine is AAD joined, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.DomainMachine.Machines.AADDeviceID
      description: The AAD Device ID.
      type: String
    - contextPath: MicrosoftATP.DomainMachine.Machines.MachineTags
      description: Set of machine tags.
      type: String
    polling: true
  - arguments:
    - description: File SHA1 hash to get statistics on.
      name: file_hash
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Retrieves statistics for the given file.
    name: microsoft-atp-get-file-statistics
    outputs:
    - contextPath: MicrosoftATP.FileStatistics.Sha1
      description: The file SHA1 hash.
      type: String
    - contextPath: MicrosoftATP.FileStatistics.Statistics.OrgPrevalence
      description: The number of times the file is detected in the organization.
      type: String
    - contextPath: MicrosoftATP.FileStatistics.Statistics.OrganizationPrevalence
      description: The number of times the file is detected in the organization.
      type: Number
    - contextPath: MicrosoftATP.FileStatistics.Statistics.OrgFirstSeen
      description: The first date and time the file was in the organization.
      type: Date
    - contextPath: MicrosoftATP.FileStatistics.Statistics.OrgLastSeen
      description: The last date and time the file was in the organization.
      type: Date
    - contextPath: MicrosoftATP.FileStatistics.Statistics.GlobalPrevalence
      description: The number of times the file is detected across all organizations by Microsoft Defender ATP.
      type: String
    - contextPath: MicrosoftATP.FileStatistics.Statistics.GloballyPrevalence
      description: The number of times the file is detected across all organizations by Microsoft Defender ATP.
      type: Number
    - contextPath: MicrosoftATP.FileStatistics.Statistics.GlobalFirstObserved
      description: The global first observation date and time of the file.
      type: Date
    - contextPath: MicrosoftATP.FileStatistics.Statistics.GlobalLastObserved
      description: The global last observation date and time of the file.
      type: Date
    - contextPath: MicrosoftATP.FileStatistics.Statistics.TopFileNames
      description: The file's top names.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.OrganizationPrevalence
      description: The number of times the indicator is detected in the organization.
      type: Number
    - contextPath: File.GlobalPrevalence
      description: The number of times the indicator is detected across all organizations by Microsoft Defender ATP.
      type: Number
    - contextPath: File.OrganizationFirstSeen
      description: The date and time when the indicator was first seen in the organization.
      type: Date
    - contextPath: File.OrganizationLastSeen
      description: The date and time when the indicator was last seen in the organization.
      type: Date
    - contextPath: File.FirstSeenBySource
      description: The date and time when the indicator was first seen by Microsoft Defender ATP.
      type: Date
    - contextPath: File.LastSeenBySource
      description: The date and time when the indicator was last seen by Microsoft Defender ATP.
      type: Date
    polling: true
  - arguments:
    - description: File SHA1 hash to get statistics on.
      name: file_hash
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Deprecated. No available replacement.
    name: microsoft-atp-get-file-alerts
    outputs:
    - contextPath: MicrosoftATP.FileAlert.Sha1
      description: The file SHA1 hash.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.IncidentID
      description: The incident ID of the alert.
      type: Number
    - contextPath: MicrosoftATP.FileAlert.Alerts.InvestigationID
      description: The investigation ID related to the alert.
      type: Number
    - contextPath: MicrosoftATP.FileAlert.Alerts.InvestigationState
      description: The current state of the investigation.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.AssignedTo
      description: The owner of the alert.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Severity
      description: The severity of the alert.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Status
      description: The current status of the alert.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Determination
      description: The determination of the alert.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.DetectionSource
      description: The detection source.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Category
      description: The category of the alert.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.ThreatFamilyName
      description: The threat family name.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.AlertCreationTime
      description: The date and time the alert was created.
      type: Date
    - contextPath: MicrosoftATP.FileAlert.Alerts.FirstEventTime
      description: The first event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.FileAlert.Alerts.LastEventTime
      description: The last event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.FileAlert.Alerts.LastUpdateTime
      description: The last update time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.FileAlert.Alerts.ResolvedTime
      description: The date and time the status of the alert was changed to 'Resolved'.
      type: Date
    - contextPath: MicrosoftATP.FileAlert.Alerts.MachineID
      description: The machine ID associated with the alert.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.AADTenantID
      description: The AAD tenant ID.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Comments.Comment
      description: The alert comment string.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Comments.CreatedBy
      description: The alert comment created by string.
      type: String
    - contextPath: MicrosoftATP.FileAlert.Alerts.Comments.CreatedTime
      description: The alert comment created time date.
      type: Date
    polling: true
    deprecated: true
  - arguments:
    - description: The IP address.
      name: ip
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Retrieves statistics for a given IP.
    name: microsoft-atp-get-ip-statistics
    outputs:
    - contextPath: MicrosoftATP.IPStatistics.Statistics.IPAddress
      description: The IP address.
      type: String
    - contextPath: MicrosoftATP.IPStatistics.Statistics.OrgPrevalence
      description: The prevalence of the IP in the organization.
      type: String
    - contextPath: MicrosoftATP.IPStatistics.Statistics.OrgFirstSeen
      description: The first date and time the IP was in the organization.
      type: Date
    - contextPath: MicrosoftATP.IPStatistics.Statistics.OrgLastSeen
      description: The last date and time the IP was in the organization.
      type: Date
    polling: true
  - arguments:
    - description: |-
        The IP address.
      name: ip
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Deprecated. No available replacement.
    name: microsoft-atp-get-ip-alerts
    outputs:
    - contextPath: MicrosoftATP.IPAlert.IPAddress
      description: The IP address.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.IncidentID
      description: The incident ID of the alert.
      type: Number
    - contextPath: MicrosoftATP.IPAlert.Alerts.InvestigationID
      description: The investigation ID related to the alert.
      type: Number
    - contextPath: MicrosoftATP.IPAlert.Alerts.InvestigationState
      description: The current state of the investigation.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.AssignedTo
      description: The owner of the alert.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Severity
      description: The severity of the alert.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Status
      description: The current status of the alert.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Determination
      description: The determination of the alert.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.DetectionSource
      description: The detection source.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Category
      description: The category of the alert.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.ThreatFamilyName
      description: The threat family name.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.AlertCreationTime
      description: The date and time the alert was created.
      type: Date
    - contextPath: MicrosoftATP.IPAlert.Alerts.FirstEventTime
      description: The first event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.IPAlert.Alerts.LastEventTime
      description: The last event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.IPAlert.Alerts.LastUpdateTime
      description: The last update time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.IPAlert.Alerts.ResolvedTime
      description: The date and time the status of the alert was changed to 'Resolved'.
      type: Date
    - contextPath: MicrosoftATP.IPAlert.Alerts.MachineID
      description: The machine ID associated with the alert.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.AADTenantID
      description: The AAD tenant ID.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Comments.Comment
      description: The alert comment string.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Comments.CreatedBy
      description: The alert comment created by string.
      type: String
    - contextPath: MicrosoftATP.IPAlert.Alerts.Comments.CreatedTime
      description: The alert comment created time date.
      type: Date
    polling: true
    deprecated: true
  - arguments:
    - description: |-
        The user ID. Note that the ID is not the full UPN, but only the username.
         (e.g., to retrieve alerts for user1@test.com, use user1).
      name: username
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Deprecated. No available replacement.
    name: microsoft-atp-get-user-alerts
    outputs:
    - contextPath: MicrosoftATP.UserAlert.Username
      description: The username.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.IncidentID
      description: The incident ID of the alert.
      type: Number
    - contextPath: MicrosoftATP.UserAlert.Alerts.InvestigationID
      description: The investigation ID related to the alert.
      type: Number
    - contextPath: MicrosoftATP.UserAlert.Alerts.InvestigationState
      description: The current state of the investigation.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.AssignedTo
      description: The owner of the alert.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Severity
      description: The severity of the alert.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Status
      description: The current status of the alert.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Determination
      description: The determination of the alert.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.DetectionSource
      description: The detection source.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Category
      description: The category of the alert.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.ThreatFamilyName
      description: The threat family name.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.AlertCreationTime
      description: The date and time the alert was created.
      type: Date
    - contextPath: MicrosoftATP.UserAlert.Alerts.FirstEventTime
      description: The first event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.UserAlert.Alerts.LastEventTime
      description: The last event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.UserAlert.Alerts.LastUpdateTime
      description: The last update time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.UserAlert.Alerts.ResolvedTime
      description: The date and time the status of the alert was changed to 'Resolved'.
      type: Date
    - contextPath: MicrosoftATP.UserAlert.Alerts.MachineID
      description: The machine ID associated with the alert.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.AADTenantID
      description: The AAD tenant ID.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Comments.Comment
      description: The alert comment string.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Comments.CreatedBy
      description: The alert comment created by string.
      type: String
    - contextPath: MicrosoftATP.UserAlert.Alerts.Comments.CreatedTime
      description: The alert comment created time date.
      type: Date
    polling: true
    deprecated: true
  - arguments:
    - description: |-
        The user ID. Note that the ID is not the full UPN, but only the username.
        (e.g., to retrieve machines for user1@test.com, use user1).
      name: username
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Retrieves a collection of machines related to a given user ID.
    name: microsoft-atp-get-user-machines
    outputs:
    - contextPath: MicrosoftATP.UserMachine.Username
      description: The username.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.FirstSeen
      description: The first date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.UserMachine.Machines.LastSeen
      description: The last date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.UserMachine.Machines.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.OSVersion
      description: The operating system version.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.OSProcessor
      description: The operating system processor.
      type: String
    - contextPath: MicrosoftATP.v.Machines.LastIPAddress
      description: The last IP on the machine.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.LastExternalIPAddress
      description: The last IP through which the machine accessed the internet.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.OSBuild
      description: The operating system build number.
      type: Number
    - contextPath: MicrosoftATP.UserMachine.Machines.HealthStatus
      description: The machine health status.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.RBACGroupID
      description: The machine RBAC group ID.
      type: Number
    - contextPath: MicrosoftATP.UserMachine.Machines.RBACGroupName
      description: The machine RBAC group name.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.RiskScore
      description: The machine risk score.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.ExposureLevel
      description: The machine exposure level.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.IsAADJoined
      description: True if machine is AAD joined, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.UserMachine.Machines.AADDeviceID
      description: The AAD device ID.
      type: String
    - contextPath: MicrosoftATP.UserMachine.Machines.MachineTags
      description: Set of machine tags.
      type: String
    polling: true
  - arguments:
    - description: The machine ID.
      name: machine_id
      required: true
    - description: The action to use for the tag.
      name: action
      auto: PREDEFINED
      predefined:
      - Add
      - Remove
      required: true
    - description: The tag name.
      name: tag
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Adds or removes a tag on a specific machine.
    name: microsoft-atp-add-remove-machine-tag
    outputs:
    - contextPath: MicrosoftATP.Machine.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.Machine.ComputerDNSName
      description: 'The machine DNS name.'
      type: String
    - contextPath: MicrosoftATP.Machine.FirstSeen
      description: The first date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.LastSeen
      description: The last date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.Machine.OSVersion
      description: The operating system version.
      type: String
    - contextPath: MicrosoftATP.Machine.OSProcessor
      description: 'The operating system processor.'
      type: String
    - contextPath: MicrosoftATP.Machine.LastIPAddress
      description: The last IP on the machine.
      type: String
    - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
      description: "The last IP through which the machine accessed the internet."
      type: String
    - contextPath: MicrosoftATP.Machine.OSBuild
      description: The operating system build number.
      type: Number
    - contextPath: MicrosoftATP.Machine.HealthStatus
      description: "The machine health status."
      type: String
    - contextPath: MicrosoftATP.Machine.RBACGroupID
      description: "The machine RBAC group ID."
      type: Number
    - contextPath: MicrosoftATP.Machine.RBACGroupName
      description: 'The machine RBAC group name.'
      type: String
    - contextPath: MicrosoftATP.Machine.RiskScore
      description: The machine risk score.
      type: String
    - contextPath: MicrosoftATP.Machine.ExposureLevel
      description: The machine exposure level.
      type: String
    - contextPath: MicrosoftATP.Machine.IsAADJoined
      description: True if machine is AAD joined, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.Machine.AADDeviceID
      description: The AAD device ID.
      type: String
    - contextPath: MicrosoftATP.Machine.MachineTags
      description: Set of machine tags.
      type: String
    polling: true
  - arguments:
    - description: The maximum number of indicators to return.
      name: limit
      defaultValue: '50'
    - description: Specifies the page size of the result set. Maximum is 200.
      name: page_size
      defaultValue: '50'
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    deprecated: true
    description: Deprecated. Use the microsoft-atp-sc-indicator-list command instead. Lists all indicators by the ID that the system creates when the indicator is ingested.
    name: microsoft-atp-indicator-list
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Generated GUID/unique identifier. Created by the system when the indicator is ingested.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", and "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.additionalInformation
      description: A catchall area into which extra data from the indicator not covered by the other indicator properties may be placed. Data placed into additionalInformation is typically not used by the targetProduct security tool.
      type: String
    - contextPath: MicrosoftATP.Indicators.azureTenantId
      description: Stamped by the system when the indicator is ingested. The Entra ID tenant ID of the submitting client.
      type: String
    - contextPath: MicrosoftATP.Indicators.confidence
      description: An integer representing the confidence with which the data within the indicator accurately identifies malicious behavior. Values are 0 – 100, with 100 being the highest.
      type: Number
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.diamondModel
      description: 'The area of the Diamond Model in which this indicator exists. Possible values: "unknown", "adversary", "capability", "infrastructure", and "victim".'
      type: String
    - contextPath: MicrosoftATP.Indicators.domainName
      description: Domain name associated with this indicator. Should be in the format subdomain.domain.topleveldomain.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationDateTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.externalId
      description: An identification number that ties the indicator back to the indicator provider’s system (e.g., a foreign key).
      type: String
    - contextPath: MicrosoftATP.Indicators.fileCompileDateTime
      description: "DateTime the file was compiled. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileCreatedDateTime
      description: "DateTime the file was created. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileHashType
      description: 'The type of hash stored in fileHashValue. Possible values: "unknown", "sha1", "sha256", "md5", "authenticodeHash256", "lsHash", and "ctph".'
      type: String
    - contextPath: MicrosoftATP.Indicators.fileHashValue
      description: The file hash value.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileMutexName
      description: The Mutex name used in file-based detections.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileName
      description: The name of the file if the indicator is file-based. Multiple file names may be delimited by commas.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePacker
      description: The packer used to build the file in question.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePath
      description: The path of the file indicating a compromise. Can be a Windows or *nix style path.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileSize
      description: The size of the file in bytes.
      type: Number
    - contextPath: MicrosoftATP.Indicators.fileType
      description: Text description of the type of file. For example, “Word Document” or “Binary”.
      type: String
    - contextPath: MicrosoftATP.Indicators.ingestedDateTime
      description: "Timestamp the indicator was ingested into the system. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.isActive
      description: Used to deactivate indicators within the system. By default, any indicator submitted is set as active. However, providers may submit existing indicators with this set to ‘False’ to deactivate indicators in the system.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.knownFalsePositives
      description: Scenarios in which the indicator may cause false positives. This should be human-readable text.
      type: String
    - contextPath: MicrosoftATP.Indicators.lastReportedDateTime
      description: "The last time the indicator was seen. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.networkCidrBlock
      description: CIDR Block notation representation of the network referenced in this indicator. Use only if the Source and Destination cannot be identified.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationAsn
      description: The destination autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkDestinationCidrBlock
      description: The CIDR Block notation representation of the destination network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv4
      description: The IPv4 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv6
      description: The IPv6 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationPort
      description: The TCP port destination.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkIPv4
      description: The IPv4 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkIPv6
      description: The IPv6 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkPort
      description: The TCP port.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkProtocol
      description: The decimal representation of the protocol field in the IPv4 header.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceAsn
      description: The source autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceCidrBlock
      description: The CIDR Block notation representation of the source network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv4
      description: The IPv4 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv6
      description: The IPv6 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourcePort
      description: The TCP port source.
      type: Number
    - contextPath: MicrosoftATP.Indicators.passiveOnly
      description: Determines if the indicator should trigger an event that is visible to an end user. When set to ‘true,’ security tools do not notify the end user that a ‘hit’ has occurred. This is most often treated as audit or silent mode by security products where they simply log that a match occurred but do not perform the action. Default value is false.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'Severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "MediumLow", "MediumHigh", and "High", where High is the most severe and Informational is not severe at all.'
      type: String
    - contextPath: MicrosoftATP.Indicators.targetProduct
      description: A string value representing a single security product to which the indicator should be applied.
      type: String
    - contextPath: MicrosoftATP.Indicators.threatType
      description: 'Each indicator must have a valid Indicator Threat Type. Possible values: "Botnet", "C2", "CryptoMining", "Darknet", "DDoS", "MaliciousUrl", "Malware", "Phishing", "Proxy", "PUA", and "WatchList".'
      type: String
    - contextPath: MicrosoftATP.Indicators.tlpLevel
      description: 'Traffic Light Protocol value for the indicator. Possible values: "unknown", "white", "green", "amber", and "red".'
      type: String
    - contextPath: MicrosoftATP.Indicators.url
      description: Uniform Resource Locator. This URL complies with RFC 1738.
      type: String
    - contextPath: MicrosoftATP.Indicators.userAgent
      description: User-Agent string from a web request that could indicate compromise.
      type: String
    - contextPath: MicrosoftATP.Indicators.vendorInformation
      description: Information about the vendor.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
    - contextPath: File.Path
      description: The path where the file is located.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    polling: true
  - arguments:
    - description: The ID of the indicator to get.
      name: indicator_id
      required: true
      default: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    deprecated: true
    description: Deprecated. Use the microsoft-atp-sc-indicator-get-by-id command instead. Gets an indicator by its ID.
    name: microsoft-atp-indicator-get-by-id
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", and "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.additionalInformation
      description: A catchall area into which extra data from the indicator not covered by the other indicator properties may be placed. Data placed into additionalInformation is typically not used by the targetProduct security tool.
      type: String
    - contextPath: MicrosoftATP.Indicators.azureTenantId
      description: Stamped by the system when the indicator is ingested. The Entra ID tenant ID of the submitting client.
      type: String
    - contextPath: MicrosoftATP.Indicators.confidence
      description: An integer representing the confidence with which the data within the indicator accurately identifies malicious behavior. Possible values are 0 – 100, with 100 being the highest.
      type: Number
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.diamondModel
      description: 'The area of the Diamond Model in which this indicator exists. Possible values: "unknown", "adversary", "capability", "infrastructure", and "victim".'
      type: String
    - contextPath: MicrosoftATP.Indicators.domainName
      description: Domain name associated with this indicator. Should be in the format subdomain.domain.topleveldomain.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationDateTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.externalId
      description: An identification number that ties the indicator back to the indicator provider’s system (e.g., a foreign key).
      type: String
    - contextPath: MicrosoftATP.Indicators.fileCompileDateTime
      description: "DateTime the file was compiled. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileCreatedDateTime
      description: "DateTime the file was created. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileHashType
      description: 'The type of hash stored in fileHashValue. Possible values: "unknown", "sha1", "sha256", "md5", "authenticodeHash256", "lsHash", and "ctph".'
      type: String
    - contextPath: MicrosoftATP.Indicators.fileHashValue
      description: The file hash value.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileMutexName
      description: The Mutex name used in file-based detections.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileName
      description: The name of the file if the indicator is file-based. Multiple file names may be delimited by commas.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePacker
      description: The packer used to build the file in question.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePath
      description: The path of the file indicating a compromise. Can be a Windows or *nix style path.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileSize
      description: The size of the file in bytes.
      type: Number
    - contextPath: MicrosoftATP.Indicators.fileType
      description: Text description of the type of file. For example, “Word Document” or “Binary”.
      type: String
    - contextPath: MicrosoftATP.Indicators.ingestedDateTime
      description: "Timestamp the indicator was ingested into the system. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.isActive
      description: Used to deactivate indicators within the system. By default, any indicator submitted is set as active. However, providers may submit existing indicators with this set to ‘False’ to deactivate indicators in the system.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.knownFalsePositives
      description: Scenarios in which the indicator may cause false positives. This should be human-readable text.
      type: String
    - contextPath: MicrosoftATP.Indicators.lastReportedDateTime
      description: "The last time the indicator was seen. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.networkCidrBlock
      description: CIDR Block notation representation of the network referenced in this indicator. Use only if the Source and Destination cannot be identified.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationAsn
      description: The destination autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkDestinationCidrBlock
      description: CIDR Block notation representation of the destination network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv4
      description: The IPv4 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv6
      description: The IPv6 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationPort
      description: The TCP port destination.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkIPv4
      description: The IPv4 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkIPv6
      description: The IPv6 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkPort
      description: The TCP port.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkProtocol
      description: The decimal representation of the protocol field in the IPv4 header.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceAsn
      description: The source autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceCidrBlock
      description: The CIDR Block notation representation of the source network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv4
      description: The IPv4 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv6
      description: The IPv6 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourcePort
      description: The TCP port source.
      type: Number
    - contextPath: MicrosoftATP.Indicators.passiveOnly
      description: Determines if the indicator should trigger an event that is visible to an end user. When set to ‘true,’ security tools do not notify the end user that a ‘hit’ has occurred. This is most often treated as audit or silent mode by security products where they simply log that a match occurred but do not perform the action. Default value is false.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'Severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "MediumLow", "MediumHigh", and "High", where High is the most severe and Informational is not severe at all.'
      type: String
    - contextPath: MicrosoftATP.Indicators.targetProduct
      description: A string value representing a single security product to which the indicator should be applied.
      type: String
    - contextPath: MicrosoftATP.Indicators.threatType
      description: 'Each indicator must have a valid Indicator Threat Type. Possible values: "Botnet", "C2", "CryptoMining", "Darknet", "DDoS", "MaliciousUrl", "Malware", "Phishing", "Proxy", "PUA", and "WatchList".'
      type: String
    - contextPath: MicrosoftATP.Indicators.tlpLevel
      description: 'Traffic Light Protocol value for the indicator. Possible values: "unknown", "white", "green", "amber", and "red".'
      type: String
    - contextPath: MicrosoftATP.Indicators.url
      description: Uniform Resource Locator. This URL complies with RFC 1738.
      type: String
    - contextPath: MicrosoftATP.Indicators.userAgent
      description: User-Agent string from a web request that could indicate compromise.
      type: String
    - contextPath: MicrosoftATP.Indicators.vendorInformation
      description: Information about the vendor.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
    - contextPath: File.Path
      description: The path where the file is located.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    polling: true
  - arguments:
    - auto: PREDEFINED
      description: The action to apply if the indicator is matched from within the targetProduct security tool.
      name: action
      predefined:
      - unknown
      - allow
      - block
      - alert
      required: true
    - description: Brief description (100 characters or less) of the threat represented by the indicator.
      name: description
      required: true
    - description: 'DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days).'
      name: expiration_time
      required: true
    - auto: PREDEFINED
      description: Each indicator must have a valid Indicator Threat Type.
      name: threat_type
      predefined:
      - Botnet
      - C2
      - CryptoMining
      - Darknet
      - DDoS
      - MaliciousUrl
      - Malware
      - Phishing
      - Proxy
      - PUA
      - WatchList
      required: true
    - auto: PREDEFINED
      description: 'Traffic Light Protocol value for the indicator.'
      name: tlp_level
      predefined:
      - unknown
      - white
      - green
      - amber
    - description: An integer representing the confidence with which the data within the indicator accurately identifies malicious behavior. Possible values are 0 – 100, with 100 being the highest.
      name: confidence
    - auto: PREDEFINED
      defaultValue: MediumHigh
      description: 'The severity of the malicious behavior identified by the data within the indicator, where High is the most severe and Informational is not severe at all.'
      name: severity
      predefined:
      - Informational
      - Low
      - MediumLow
      - MediumHigh
      - High
    - description: A comma-separated list that stores arbitrary tags/keywords.
      name: tags
    - description: "DateTime the file was compiled. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      name: file_compile_date_time
    - description: "DateTime the file was created. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      name: file_created_date_time
    - description: The type of hash stored in fileHashValue.
      name: file_hash_type
      auto: PREDEFINED
      predefined:
      - unknown
      - sha1
      - sha256
      - md5
      - authenticodeHash256
      - lsHash
      - ctph
    - description: The file hash value.
      name: file_hash_value
    - description: The Mutex name used in file-based detections.
      name: file_mutex_name
    - description: The name of the file if the indicator is file-based. Supports comma-separated list of file names.
      name: file_name
    - description: The packer used to build the file in question.
      name: file_packer
    - description: The path of the file indicating a compromise. May be a Windows or *nix style path.
      name: file_path
    - description: Size of the file in bytes.
      name: file_size
    - description: Text description of the type of file. For example, “Word Document” or “Binary”.
      name: file_type
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    deprecated: true
    description: Deprecated. Use the microsoft-atp-sc-indicator-create command instead. Creates a file indicator.
    name: microsoft-atp-indicator-create-file
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", and "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.additionalInformation
      description: A catchall area into which extra data from the indicator not covered by the other indicator properties may be placed. Data placed into additionalInformation is typically not used by the targetProduct security tool.
      type: String
    - contextPath: MicrosoftATP.Indicators.azureTenantId
      description: Stamped by the system when the indicator is ingested. The Entra ID tenant id of submitting client.
      type: String
    - contextPath: MicrosoftATP.Indicators.confidence
      description: An integer representing the confidence with which the data within the indicator accurately identifies malicious behavior. Possible values are 0 – 100, with 100 being the highest.
      type: Number
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.diamondModel
      description: 'The area of the Diamond Model in which this indicator exists. Possible values: "unknown", "adversary", "capability", "infrastructure", and "victim".'
      type: String
    - contextPath: MicrosoftATP.Indicators.domainName
      description: Domain name associated with this indicator. Should be in the format subdomain.domain.topleveldomain.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationDateTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.externalId
      description: An identification number that ties the indicator back to the indicator provider’s system (e.g., a foreign key).
      type: String
    - contextPath: MicrosoftATP.Indicators.fileCompileDateTime
      description: "DateTime the file was compiled. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileCreatedDateTime
      description: "DateTime the file was created. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileHashType
      description: 'The type of hash stored in fileHashValue. Possible values: "unknown", "sha1", "sha256", "md5", "authenticodeHash256", "lsHash", and "ctph".'
      type: String
    - contextPath: MicrosoftATP.Indicators.fileHashValue
      description: The file hash value.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileMutexName
      description: The Mutex name used in file-based detections.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileName
      description: The name of the file if the indicator is file-based. Multiple file names may be delimited by commas.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePacker
      description: The packer used to build the file in question.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePath
      description: The path of the file indicating a compromise. Can be a Windows or *nix style path.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileSize
      description: The size of the file in bytes.
      type: Number
    - contextPath: MicrosoftATP.Indicators.fileType
      description: Text description of the type of file. For example, “Word Document” or “Binary”.
      type: String
    - contextPath: MicrosoftATP.Indicators.ingestedDateTime
      description: "Timestamp the indicator was ingested into the system. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.isActive
      description: Used to deactivate indicators within the system. By default, any indicator submitted is set as active. However, providers may submit existing indicators with this set to ‘False’ to deactivate indicators in the system.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.knownFalsePositives
      description: Scenarios in which the indicator may cause false positives. This should be human-readable text.
      type: String
    - contextPath: MicrosoftATP.Indicators.lastReportedDateTime
      description: "The last time the indicator was seen. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.networkCidrBlock
      description: CIDR Block notation representation of the network referenced in this indicator. Use only if the Source and Destination cannot be identified.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationAsn
      description: The destination autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkDestinationCidrBlock
      description: The CIDR Block notation representation of the destination network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv4
      description: The IPv4 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv6
      description: The IPv6 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationPort
      description: The TCP port destination.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkIPv4
      description: The IPv4 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkIPv6
      description: The IPv6 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkPort
      description: The TCP port.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkProtocol
      description: The decimal representation of the protocol field in the IPv4 header.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceAsn
      description: The source autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceCidrBlock
      description: The CIDR Block notation representation of the source network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv4
      description: The IPv4 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv6
      description: The IPv6 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourcePort
      description: The TCP port source.
      type: Number
    - contextPath: MicrosoftATP.Indicators.passiveOnly
      description: Determines if the indicator should trigger an event that is visible to an end user. When set to ‘true,’ security tools do not notify the end user that a ‘hit’ has occurred. This is most often treated as audit or silent mode by security products where they simply log that a match occurred but do not perform the action. Default value is false.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'Severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "MediumLow", "MediumHigh", and "High", where High is the most severe and Informational is not severe at all.'
      type: Number
    - contextPath: MicrosoftATP.Indicators.targetProduct
      description: A string value representing a single security product to which the indicator should be applied.
      type: String
    - contextPath: MicrosoftATP.Indicators.threatType
      description: 'Each indicator must have a valid Indicator Threat Type. Possible values: "Botnet", "C2", "CryptoMining", "Darknet", "DDoS", "MaliciousUrl", "Malware", "Phishing", "Proxy", "PUA", and "WatchList".'
      type: String
    - contextPath: MicrosoftATP.Indicators.tlpLevel
      description: 'Traffic Light Protocol value for the indicator. Possible values: "unknown", "white", "green", "amber", and "red".'
      type: String
    - contextPath: MicrosoftATP.Indicators.url
      description: Uniform Resource Locator. This URL complies with RFC 1738.
      type: String
    - contextPath: MicrosoftATP.Indicators.userAgent
      description: User-Agent string from a web request that could indicate compromise.
      type: String
    - contextPath: MicrosoftATP.Indicators.vendorInformation
      description: Information about the vendor.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.Size
      description: 'The size of the file in bytes.'
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
    - contextPath: File.Path
      description: The path where the file is located.
      type: String
    polling: true
  - arguments:
    - description: The action to apply if the indicator is matched from within the targetProduct security tool.
      name: action
      required: true
      auto: PREDEFINED
      predefined:
      - unknown
      - allow
      - block
      - alert
    - description: 'Brief description (100 characters or less) of the threat represented by the indicator.'
      name: description
      required: true
    - description: 'DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days).'
      name: expiration_time
      required: true
    - description: Each indicator must have a valid Indicator Threat Type.
      name: threat_type
      auto: PREDEFINED
      predefined:
      - Botnet
      - C2
      - CryptoMining
      - Darknet
      - DDoS
      - MaliciousUrl
      - Malware
      - Phishing
      - Proxy
      - PUA
      - WatchList
      required: true
    - description: 'Traffic Light Protocol value for the indicator.'
      name: tlp_level
      auto: PREDEFINED
      predefined:
      - unknown
      - white
      - green
      - amber
    - description: An integer representing the confidence with which the data within the indicator accurately identifies malicious behavior. Possible values are 0 – 100, with 100 being the highest.
      name: confidence
    - auto: PREDEFINED
      defaultValue: MediumHigh
      description: 'The severity of the malicious behavior identified by the data within the indicator, where High is the most severe and Informational is not severe at all.'
      name: severity
      predefined:
      - Informational
      - Low
      - MediumLow
      - MediumHigh
      - High
    - description: A comma-separated list that stores arbitrary tags/keywords.
      name: tags
    - description: Domain name associated with this indicator. Should be of the format subdomain.domain.topleveldomain (For example, example.domain.net).
      name: domain_name
    - description: CIDR Block notation representation of the network referenced in this indicator. Use only if the Source and Destination cannot be identified.
      name: network_cidr_block
    - description: The destination autonomous system identifier of the network referenced in the indicator.
      name: network_destination_asn
    - description: The CIDR Block notation representation of the destination network in this indicator.
      name: network_destination_cidr_block
    - description: The IPv4 IP address destination.
      name: network_destination_ipv4
    - description: The IPv6 IP address destination.
      name: network_destination_ipv6
    - description: The TCP port destination.
      name: network_destination_port
    - description: The IPv4 IP address. Use only if the Source and Destination cannot be identified.
      name: network_ipv4
    - description: The IPv6 IP address. Use only if the Source and Destination cannot be identified.
      name: network_ipv6
    - description: The TCP port. Use only if the Source and Destination cannot be identified.
      name: network_port
    - description: The decimal representation of the protocol field in the IPv4 header.
      name: network_protocol
    - description: The source autonomous system identifier of the network referenced in the indicator.
      name: network_source_asn
    - description: The CIDR Block notation representation of the source network in this indicator.
      name: network_source_cidr_block
    - description: The IPv4 IP address source.
      name: network_source_ipv4
    - description: The IPv6 IP address source.
      name: network_source_ipv6
    - description: The TCP port source.
      name: network_source_port
    - description: Uniform Resource Locator. This URL must comply with RFC 1738.
      name: url
    - description: User-Agent string from a web request that could indicate a compromise.
      name: user_agent
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    deprecated: true
    description: Deprecated. Use the microsoft-atp-sc-indicator-create command instead. Creates a network indicator.
    name: microsoft-atp-indicator-create-network
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", and "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.additionalInformation
      description: A catchall area into which extra data from the indicator not covered by the other indicator properties may be placed. Data placed into additionalInformation is typically not used by the targetProduct security tool.
      type: String
    - contextPath: MicrosoftATP.Indicators.azureTenantId
      description: Stamped by the system when the indicator is ingested. The Entra ID tenant ID of the submitting client.
      type: String
    - contextPath: MicrosoftATP.Indicators.confidence
      description: An integer representing the confidence with which the data within the indicator accurately identifies malicious behavior. Possible values are 0 – 100, with 100 being the highest.
      type: Number
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.diamondModel
      description: 'The area of the Diamond Model in which this indicator exists. Possible values: "unknown", "adversary", "capability", "infrastructure", and "victim".'
      type: String
    - contextPath: MicrosoftATP.Indicators.domainName
      description: Domain name associated with this indicator. Should be in the format subdomain.domain.topleveldomain.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationDateTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.externalId
      description: An identification number that ties the indicator back to the indicator provider’s system (e.g., a foreign key).
      type: String
    - contextPath: MicrosoftATP.Indicators.fileCompileDateTime
      description: "DateTime the file was compiled. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileCreatedDateTime
      description: "DateTime the file was created. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileHashType
      description: 'The type of hash stored in fileHashValue. Possible values: "unknown", "sha1", "sha256", "md5", "authenticodeHash256", "lsHash", and "ctph".'
      type: String
    - contextPath: MicrosoftATP.Indicators.fileHashValue
      description: The file hash value.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileMutexName
      description: The Mutex name used in file-based detections.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileName
      description: The name of the file if the indicator is file-based. Multiple file names may be delimited by commas.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePacker
      description: The packer used to build the file in question.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePath
      description: The path of the file indicating a compromise. Can be a Windows or *nix style path.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileSize
      description: The size of the file in bytes.
      type: Number
    - contextPath: MicrosoftATP.Indicators.fileType
      description: Text description of the type of file. For example, “Word Document” or “Binary”.
      type: String
    - contextPath: MicrosoftATP.Indicators.ingestedDateTime
      description: "Timestamp the indicator was ingested into the system. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.isActive
      description: Used to deactivate indicators within the system. By default, any indicator submitted is set as active. However, providers may submit existing indicators with this set to ‘False’ to deactivate indicators in the system.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.knownFalsePositives
      description: Scenarios in which the indicator may cause false positives. This should be human-readable text.
      type: String
    - contextPath: MicrosoftATP.Indicators.lastReportedDateTime
      description: "The last time the indicator was seen. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.networkCidrBlock
      description: The CIDR Block notation representation of the network referenced in this indicator. Use only if the Source and Destination cannot be identified.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationAsn
      description: The destination autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkDestinationCidrBlock
      description: The CIDR Block notation representation of the destination network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv4
      description: The IPv4 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv6
      description: The IPv6 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationPort
      description: The TCP port destination.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkIPv4
      description: The IPv4 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkIPv6
      description: The IPv6 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkPort
      description: The TCP port.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkProtocol
      description: The decimal representation of the protocol field in the IPv4 header.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceAsn
      description: The source autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceCidrBlock
      description: The CIDR Block notation representation of the source network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv4
      description: The IPv4 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv6
      description: The IPv6 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourcePort
      description: The TCP port source.
      type: Number
    - contextPath: MicrosoftATP.Indicators.passiveOnly
      description: Determines if the indicator should trigger an event that is visible to an end user. When set to ‘true,’ security tools do not notify the end user that a ‘hit’ has occurred. This is most often treated as audit or silent mode by security products where they simply log that a match occurred but do not perform the action. Default value is false.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'Severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "MediumLow", "MediumHigh", and "High", where High is the most severe and Informational is not severe at all.'
      type: Number
    - contextPath: MicrosoftATP.Indicators.targetProduct
      description: A string value representing a single security product to which the indicator should be applied.
      type: String
    - contextPath: MicrosoftATP.Indicators.threatType
      description: 'Each indicator must have a valid Indicator Threat Type. Possible values: "Botnet", "C2", "CryptoMining", "Darknet", "DDoS", "MaliciousUrl", "Malware", "Phishing", "Proxy", "PUA", and "WatchList".'
      type: String
    - contextPath: MicrosoftATP.Indicators.tlpLevel
      description: 'Traffic Light Protocol value for the indicator. Possible values: "unknown", "white", "green", "amber", and "red".'
      type: String
    - contextPath: MicrosoftATP.Indicators.url
      description: Uniform Resource Locator. This URL complies with RFC 1738.
      type: String
    - contextPath: MicrosoftATP.Indicators.userAgent
      description: User-Agent string from a web request that could indicate compromise.
      type: String
    - contextPath: MicrosoftATP.Indicators.vendorInformation
      description: Information about the vendor.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    polling: true
  - arguments:
    - description: The ID of the indicator to update.
      name: indicator_id
      required: true
    - description: 'The severity of the malicious behavior identified by the data within the indicator, where High is the most severe and Informational is not severe at all.'
      name: severity
      defaultValue: MediumHigh
      auto: PREDEFINED
      predefined:
      - Informational
      - Low
      - MediumLow
      - MediumHigh
      - High
    - description: 'DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days).'
      name: expiration_time
      required: true
    - description: Brief description (100 characters or less) of the threat represented by the indicator.
      name: description
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    deprecated: true
    description: Deprecated. Use the microsoft-atp-sc-indicator-update command instead. Updates the specified indicator.
    name: microsoft-atp-indicator-update
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.additionalInformation
      description: A catchall area into which extra data from the indicator not covered by the other indicator properties may be placed. Data placed into additionalInformation is typically not used by the targetProduct security tool.
      type: String
    - contextPath: MicrosoftATP.Indicators.azureTenantId
      description: Stamped by the system when the indicator is ingested. The Entra ID tenant ID of the submitting client.
      type: String
    - contextPath: MicrosoftATP.Indicators.confidence
      description: An integer representing the confidence with which the data within the indicator accurately identifies malicious behavior. Possible values are 0 – 100, with 100 being the highest.
      type: Number
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.diamondModel
      description: 'The area of the Diamond Model in which this indicator exists. Possible values: "unknown", "adversary", "capability", "infrastructure", and "victim".'
      type: String
    - contextPath: MicrosoftATP.Indicators.domainName
      description: Domain name associated with this indicator. Should be in the format subdomain.domain.topleveldomain.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationDateTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.externalId
      description: An identification number that ties the indicator back to the indicator provider’s system (e.g., a foreign key).
      type: String
    - contextPath: MicrosoftATP.Indicators.fileCompileDateTime
      description: "DateTime the file was compiled. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileCreatedDateTime
      description: "DateTime the file was created. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.fileHashType
      description: 'The type of hash stored in fileHashValue. Possible values: "unknown", "sha1", "sha256", "md5", "authenticodeHash256", "lsHash", and "ctph".'
      type: String
    - contextPath: MicrosoftATP.Indicators.fileHashValue
      description: The file hash value.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileMutexName
      description: The Mutex name used in file-based detections.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileName
      description: The name of the file if the indicator is file-based. Multiple file names may be delimited by commas.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePacker
      description: The packer used to build the file in question.
      type: String
    - contextPath: MicrosoftATP.Indicators.filePath
      description: The path of the file indicating a compromise. Can be a Windows or *nix style path.
      type: String
    - contextPath: MicrosoftATP.Indicators.fileSize
      description: The size of the file in bytes.
      type: Number
    - contextPath: MicrosoftATP.Indicators.fileType
      description: Text description of the type of file. For example, “Word Document” or “Binary”.
      type: String
    - contextPath: MicrosoftATP.Indicators.ingestedDateTime
      description: "Timestamp the indicator was ingested into the system. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.isActive
      description: Used to deactivate indicators within the system. By default, any indicator submitted is set as active. However, providers may submit existing indicators with this set to ‘False’ to deactivate indicators in the system.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.knownFalsePositives
      description: Scenarios in which the indicator may cause false positives. This should be human-readable text.
      type: String
    - contextPath: MicrosoftATP.Indicators.lastReportedDateTime
      description: "The last time the indicator was seen. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.networkCidrBlock
      description: The CIDR Block notation representation of the network referenced in this indicator. Use only if the Source and Destination cannot be identified.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationAsn
      description: The destination autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkDestinationCidrBlock
      description: The CIDR Block notation representation of the destination network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv4
      description: The IPv4 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationIPv6
      description: The IPv6 IP address destination.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkDestinationPort
      description: The TCP port destination.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkIPv4
      description: The IPv4 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkIPv6
      description: The IPv6 IP address.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkPort
      description: The TCP port.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkProtocol
      description: The decimal representation of the protocol field in the IPv4 header.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceAsn
      description: The source autonomous system identifier of the network referenced in the indicator.
      type: Number
    - contextPath: MicrosoftATP.Indicators.networkSourceCidrBlock
      description: The CIDR Block notation representation of the source network in this indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv4
      description: The IPv4 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourceIPv6
      description: The IPv6 IP address source.
      type: String
    - contextPath: MicrosoftATP.Indicators.networkSourcePort
      description: The TCP port source.
      type: Number
    - contextPath: MicrosoftATP.Indicators.passiveOnly
      description: Determines if the indicator should trigger an event that is visible to an end user. When set to ‘true,’ security tools do not notify the end user that a ‘hit’ has occurred. This is most often treated as audit or silent mode by security products where they simply log that a match occurred but do not perform the action. Default value is false.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'Severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "MediumLow", "MediumHigh", and "High", where High is the most severe and Informational is not severe at all.'
      type: String
    - contextPath: MicrosoftATP.Indicators.targetProduct
      description: A string value representing a single security product to which the indicator should be applied.
      type: String
    - contextPath: MicrosoftATP.Indicators.threatType
      description: 'Each indicator must have a valid Indicator Threat Type. Possible values: "Botnet", "C2", "CryptoMining", "Darknet", "DDoS", "MaliciousUrl", "Malware", "Phishing", "Proxy", "PUA", and "WatchList".'
      type: String
    - contextPath: MicrosoftATP.Indicators.tlpLevel
      description: 'Traffic Light Protocol value for the indicator. Possible values: "unknown", "white", "green", "amber", and "red".'
      type: String
    - contextPath: MicrosoftATP.Indicators.url
      description: Uniform Resource Locator. This URL complies with RFC 1738.
      type: String
    - contextPath: MicrosoftATP.Indicators.userAgent
      description: User-Agent string from a web request that could indicate compromise.
      type: String
    - contextPath: MicrosoftATP.Indicators.vendorInformation
      description: Information about the vendor.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
    - contextPath: File.Path
      description: The path where the file is located.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    polling: true
  - arguments:
    - description: The ID of the indicator to delete.
      name: indicator_id
      required: true
    - description: 'Flag for the rate limit retry.'
      name: ran_once_flag
      deprecated: true
    description: Deprecated. Use the microsoft-atp-sc-indicator-delete command instead. Deletes the specified indicator.
    name: microsoft-atp-indicator-delete
    deprecated: true
    polling: true
  - arguments:
    - description: The value of the indicator to update.
      name: indicator_value
      required: true
    - auto: PREDEFINED
      description: Indicator Type.
      name: indicator_type
      required: true
      predefined:
      - FileSha1
      - FileSha256
      - FileMd5
      - IpAddress
      - DomainName
      - Url
    - auto: PREDEFINED
      description: The action taken if the indicator is discovered in the organization.
      name: action
      required: true
      predefined:
      - Audit
      - Block
      - BlockAndRemediate
      - Allowed
      - Warn
    - auto: PREDEFINED
      description: 'The severity of the malicious behavior identified by the data within the indicator, where High is the most severe and Informational is not severe at all.'
      name: severity
      predefined:
      - Informational
      - Low
      - Medium
      - High
    - description: 'DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days). If not provided, the indicator will not expire.'
      name: expiration_time
    - description: Brief description (100 characters or less) of the threat represented by the indicator.
      name: indicator_description
      required: true
    - description: The indicator alert title.
      name: indicator_title
      required: true
    - description: The application associated with the indicator.
      name: indicator_application
    - description: The indicator alert recommended actions.
      name: recommended_actions
    - description: A comma-separated list of RBAC group names the indicator is applied to.
      isArray: true
      name: rbac_group_names
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    - description: Whether to generate an alert for the indicator.
      name: generate_alert
    description: Updates the specified indicator.
    name: microsoft-atp-sc-indicator-update
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", and "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'The severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "Medium", and "High", where High is the most severe and Informational is not severe at all.'
      type: String
    - contextPath: MicrosoftATP.Indicators.indicatorValue
      description: The value of the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.recommendedActions
      description: Recommended actions for the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.generateAlert
      description: Whether an alert was generated.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.rbacGroupNames
      description: A list of RBAC device group names where the indicator is exposed and active. Empty list if it is exposed to all devices.
      type: Unknown
    - contextPath: MicrosoftATP.Indicators.mitreTechniques
      description: A list of MITRE techniques.
      type: Unknown
    - contextPath: MicrosoftATP.Indicators.indicatorType
      description: 'The indicator type. Possible values: "FileSha1", "FileSha256", "IpAddress", "DomainName" and "Url".'
      type: String
    - contextPath: MicrosoftATP.Indicators.lastUpdateTime
      description: The last time the indicator was updated.
      type: Date
    - contextPath: MicrosoftATP.Indicators.createdByDisplayName
      description: Display name of the created app.
      type: String
    - contextPath: MicrosoftATP.Indicators.application
      description: The application associated with the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.title
      description: The indicator title.
      type: String
    - contextPath: MicrosoftATP.Indicators.createdBySource
      description: The source of indicator creation. For example, PublicApi.
      type: String
    - contextPath: MicrosoftATP.Indicators.historicalDetection
      description: Whether a historical detection exists.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.lastUpdatedBy
      description: The identity of the user/application that last updated the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.creationTimeDateTimeUtc
      description: The date and time the indicator was created.
      type: Date
    - contextPath: MicrosoftATP.Indicators.category
      description: An number representing the indicator category.
      type: Number
    - contextPath: MicrosoftATP.Indicators.createdBy
      description: Unique identity of the user/application that submitted the indicator.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    polling: true
    compliantpolicies:
    - Quarantine File
  - arguments:
    - description: The value of the indicator to update.
      name: indicator_value
      required: true
    - description: Indicator Type.
      name: indicator_type
      auto: PREDEFINED
      required: true
      predefined:
      - FileSha1
      - FileSha256
      - FileMd5
      - IpAddress
      - DomainName
      - Url
    - auto: PREDEFINED
      description: The action taken if the indicator is discovered in the organization.
      name: action
      required: true
      predefined:
      - Audit
      - Block
      - BlockAndRemediate
      - Allowed
      - Warn
    - auto: PREDEFINED
      description: 'The severity of the malicious behavior identified by the data within the indicator, where High is the most severe and Informational is not severe at all.'
      name: severity
      predefined:
      - Informational
      - Low
      - Medium
      - High
    - description: 'DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days). If not provided, the indicator will not expire.'
      name: expiration_time
    - description: Brief description (100 characters or less) of the threat represented by the indicator.
      name: indicator_description
      required: true
    - description: The indicator alert title.
      name: indicator_title
      required: true
    - description: The application associated with the indicator.
      name: indicator_application
    - description: The indicator alert recommended actions.
      name: recommended_actions
    - description: A comma-separated list of RBAC group names the indicator is applied to.
      isArray: true
      name: rbac_group_names
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    - description: Whether to generate an alert for the indicator.
      name: generate_alert
    description: Creates a new indicator.
    name: microsoft-atp-sc-indicator-create
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'The severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "Medium", and "High", where High is the most severe and Informational is not severe at all.'
      type: String
    - contextPath: MicrosoftATP.Indicators.indicatorValue
      description: The value of the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.recommendedActions
      description: Recommended actions for the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.generateAlert
      description: Whether an alert was generated.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.rbacGroupNames
      description: A list of RBAC device group names where the indicator is exposed and active. Empty list if it is exposed to all devices.
      type: Unknown
    - contextPath: MicrosoftATP.Indicators.mitreTechniques
      description: A list of MITRE techniques.
      type: Unknown
    - contextPath: MicrosoftATP.Indicators.indicatorType
      description: 'Indicator Type. Possible values: "FileSha1", "FileSha256", "IpAddress", "DomainName" and "Url".'
      type: String
    - contextPath: MicrosoftATP.Indicators.lastUpdateTime
      description: The last time the indicator was updated.
      type: Date
    - contextPath: MicrosoftATP.Indicators.createdByDisplayName
      description: The display name of the created app.
      type: String
    - contextPath: MicrosoftATP.Indicators.application
      description: The application associated with the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.title
      description: The indicator title.
      type: String
    - contextPath: MicrosoftATP.Indicators.createdBySource
      description: Source of indicator creation. For example, PublicApi.
      type: String
    - contextPath: MicrosoftATP.Indicators.historicalDetection
      description: Whether a historical detection exists.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.lastUpdatedBy
      description: The identity of the user/application that last updated the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.creationTimeDateTimeUtc
      description: The date and time the indicator was created.
      type: Date
    - contextPath: MicrosoftATP.Indicators.category
      description: An number representing the indicator category.
      type: Number
    - contextPath: MicrosoftATP.Indicators.createdBy
      description: Unique identity of the user/application that submitted the indicator.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    polling: true
    compliantpolicies:
    - Quarantine File
  - arguments:
    - description: The ID of the indicator to delete. The ID can be retrieved by running the microsoft-atp-sc-indicator-list command.
      name: indicator_id
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Deletes the specified indicator.
    name: microsoft-atp-sc-indicator-delete
    polling: true
    compliantpolicies:
    - Quarantine File
  - arguments:
    - description: The maximum number of indicators to return.
      name: limit
      defaultValue: '50'
    - description: The number of indicators that are to be skipped and not included in the result.
      name: skip
    - description: The value of the indicator to get.
      name: indicator_value
    - description: The title of the indicator to get.
      name: indicator_title
    - auto: PREDEFINED
      description: The type of the indicator to get.
      name: indicator_type
      predefined:
      - FileSha1
      - FileSha256
      - FileMd5
      - IpAddress
      - DomainName
      - Url
      - CertificateThumbprint
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Lists all indicators by the ID that the system creates when the indicator is ingested.
    name: microsoft-atp-sc-indicator-list
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", and "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'The severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "Medium", and "High", where High is the most severe and Informational is not severe at all.'
      type: String
    - contextPath: MicrosoftATP.Indicators.indicatorValue
      description: The value of the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.recommendedActions
      description: Recommended actions for the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.generateAlert
      description: Whether an alert was generated.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.rbacGroupNames
      description: A list of RBAC device group names where the indicator is exposed and active. Empty list if it is exposed to all devices.
      type: Unknown
    - contextPath: MicrosoftATP.Indicators.mitreTechniques
      description: A list of MITRE techniques.
      type: Unknown
    - contextPath: MicrosoftATP.Indicators.indicatorType
      description: 'Indicator Type. Possible values: "FileSha1", "FileSha256", "IpAddress", "DomainName" and "Url".'
      type: String
    - contextPath: MicrosoftATP.Indicators.lastUpdateTime
      description: The last time the indicator was updated.
      type: Date
    - contextPath: MicrosoftATP.Indicators.createdByDisplayName
      description: The display name of the created app.
      type: String
    - contextPath: MicrosoftATP.Indicators.application
      description: The application associated with the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.title
      description: The indicator title.
      type: String
    - contextPath: MicrosoftATP.Indicators.createdBySource
      description: The source of indicator creation. For example, PublicApi.
      type: String
    - contextPath: MicrosoftATP.Indicators.historicalDetection
      description: Whether a historical detection exists.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.lastUpdatedBy
      description: The identity of the user/application that last updated the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.creationTimeDateTimeUtc
      description: The date and time the indicator was created.
      type: Date
    - contextPath: MicrosoftATP.Indicators.category
      description: A number representing the indicator category.
      type: Number
    - contextPath: MicrosoftATP.Indicators.createdBy
      description: Unique identity of the user/application that submitted the indicator.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    polling: true
  - arguments:
    - description: The ID of the indicator to get. The ID can be retrieved by running the microsoft-atp-sc-indicator-list command.
      name: indicator_id
      default: true
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Gets an indicator by its ID.
    name: microsoft-atp-sc-indicator-get-by-id
    outputs:
    - contextPath: MicrosoftATP.Indicators.id
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.action
      description: 'The action to apply if the indicator is matched from within the targetProduct security tool. Possible values: "unknown", "allow", "block", and "alert".'
      type: String
    - contextPath: MicrosoftATP.Indicators.description
      description: Brief description (100 characters or less) of the threat represented by the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.expirationTime
      description: "DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MicrosoftATP.Indicators.severity
      description: 'The severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "Medium" and "High", where High is the most severe and Informational is not severe at all.'
      type: String
    - contextPath: MicrosoftATP.Indicators.indicatorValue
      description: The value of the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.recommendedActions
      description: Recommended actions for the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.generateAlert
      description: Whether an alert was generated.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.rbacGroupNames
      description: A list of RBAC device group names where the indicator is exposed and active. Empty list if it is exposed to all devices.
      type: Unknown
    - contextPath: MicrosoftATP.Indicators.mitreTechniques
      description: A list of MITRE techniques.
      type: Unknown
    - contextPath: MicrosoftATP.Indicators.indicatorType
      description: 'Indicator type. Possible values: "FileSha1", "FileSha256", "IpAddress", "DomainName" and "Url".'
      type: String
    - contextPath: MicrosoftATP.Indicators.lastUpdateTime
      description: The last time the indicator was updated.
      type: Date
    - contextPath: MicrosoftATP.Indicators.createdByDisplayName
      description: The display name of the created app.
      type: String
    - contextPath: MicrosoftATP.Indicators.application
      description: The application associated with the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.title
      description: The indicator title.
      type: String
    - contextPath: MicrosoftATP.Indicators.createdBySource
      description: The source of indicator creation. For example, PublicApi.
      type: String
    - contextPath: MicrosoftATP.Indicators.historicalDetection
      description: Whether a historical detection exists.
      type: Boolean
    - contextPath: MicrosoftATP.Indicators.lastUpdatedBy
      description: The identity of the user/application that last updated the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.creationTimeDateTimeUtc
      description: The date and time the indicator was created.
      type: Date
    - contextPath: MicrosoftATP.Indicators.category
      description: An number representing the indicator category.
      type: Number
    - contextPath: MicrosoftATP.Indicators.createdBy
      description: Unique identity of the user/application that submitted the indicator.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    polling: true
  - arguments:
    - description: Software ID. Use the !microsoft-atp-list-software command to get the ID.
      name: id
    description: Retrieve a list of device references that has this software installed.
    name: microsoft-atp-list-machines-by-software
    outputs:
    - contextPath: MicrosoftATP.SoftwareMachine.id
      description: Machine identity.
      type: String
    - contextPath: MicrosoftATP.SoftwareMachine.computerDnsName
      description: Machine fully qualified name.
      type: String
    - contextPath: MicrosoftATP.SoftwareMachine.osPlatform
      description: Operating system platform.
      type: String
    - contextPath: MicrosoftATP.SoftwareMachine.rbacGroupName
      description: Machine group name.
      type: String
    - contextPath: MicrosoftATP.SoftwareMachine.rbacGroupId
      description: Machine group ID.
      type: Number
  - arguments:
    - description: Software ID. Use the !microsoft-atp-list-software command to get the ID.
      required: true
      name: id
    description: Retrieves missing KBs (security updates) by software ID.
    name: microsoft-atp-list-missing-kb-by-software
    outputs:
    - contextPath: MicMicrosoftATP.SoftwareKB.id
      description: Software ID.
      type: String
    - contextPath: MicMicrosoftATP.SoftwareKB.name
      description: Software name.
      type: String
    - contextPath: MicMicrosoftATP.SoftwareKB.osBuild
      description: The operating system build number.
      type: Number
    - contextPath: MicMicrosoftATP.SoftwareKB.productsNames
      description: 'Product names.'
      type: String
    - contextPath: MicMicrosoftATP.SoftwareKB.url
      description: URL.
      type: String
    - contextPath: MicMicrosoftATP.SoftwareKB.machineMissedOn
      description: Machine missed on.
      type: Number
    - contextPath: MicMicrosoftATP.SoftwareKB.cveAddressed
      description: CVE addressed.
      type: Number
  - arguments:
    - description: Software ID. Use the !microsoft-atp-list-software command to get the ID.
      name: id
      required: true
    description: Retrieves a list of all the vulnerabilities affecting the organization per software.
    name: microsoft-atp-list-vulnerabilities-by-software
    outputs:
    - contextPath: MicrosoftATP.SoftwareCVE.id
      description: Vulnerability ID.
      type: String
    - contextPath: MicrosoftATP.SoftwareCVE.name
      description: Vulnerability title.
      type: String
    - contextPath: MicrosoftATP.SoftwareCVE.description
      description: Vulnerability description.
      type: String
    - contextPath: MicrosoftATP.SoftwareCVE.severity
      description: 'Vulnerability severity. Possible values are: "Low", "Medium", "High", "Critical".'
      type: String
    - contextPath: MicrosoftATP.SoftwareCVE.cvssV3
      description: CVSS v3 score.
      type: Number
    - contextPath: MicrosoftATP.SoftwareCVE.exposedMachines
      description: Number of exposed devices.
      type: Number
    - contextPath: MicrosoftATP.SoftwareCVE.publishedOn
      description: Date when vulnerability was published. Date format will be in ISO 8601 format or relational expressions like “7 days ago”.
      type: Date
    - contextPath: MicrosoftATP.SoftwareCVE.updatedOn
      description: Date when vulnerability was updated. Date format will be in ISO 8601 format or relational expressions like “7 days ago”.
      type: Date
    - contextPath: MicrosoftATP.SoftwareCVE.publicExploit
      description: Whether a public exploit exists for some of the vulnerabilities.
      type: Boolean
    - contextPath: MicrosoftATP.SoftwareCVE.exploitVerified
      description: Whether a public exploit exists.
      type: Boolean
    - contextPath: MicrosoftATP.SoftwareCVE.exploitInKit
      description: Whether the exploit is part of an exploit kit.
      type: Boolean
    - contextPath: MicrosoftATP.SoftwareCVE.exploitTypes
      description: 'Exploit impact. Possible values are: "Local privilege escalation", "Denial of service", "Local".'
      type: String
    - contextPath: MicrosoftATP.SoftwareCVE.exploitUris
      description: Exploit source URLs.
      type: String
  - arguments:
    - description: Software ID.
      isArray: true
      name: id
    - description: Software name.
      isArray: true
      name: name
    - description: Software publisher name.
      isArray: true
      name: vendor
    - description: Maximum number of results to retrieve.
      name: limit
      defaultValue: '50'
    - description: The number of items in the queried collection that are to be skipped and not included in the result..
      name: offset
      defaultValue: '0'
    description: Retrieves the organization software inventory.
    name: microsoft-atp-list-software
    outputs:
    - contextPath: MicrosoftATP.Software.id
      description: Software ID.
      type: String
    - contextPath: MicrosoftATP.Software.name
      description: Software name.
      type: String
    - contextPath: MicrosoftATP.Software.vendor
      description: Software publisher name.
      type: String
    - contextPath: MicrosoftATP.Software.weaknesses
      description: Number of discovered vulnerabilities.
      type: Number
    - contextPath: MicrosoftATP.Software.publicExploit
      description: Whether a public exploit exists for some of the vulnerabilities.
      type: Boolean
    - contextPath: MicrosoftATP.Software.activeAlert
      description: Whether an active alert is associated with this software.
      type: Boolean
    - contextPath: MicrosoftATP.Software.exposedMachines
      description: Number of exposed devices.
      type: Number
    - contextPath: MicrosoftATP.Software.installedMachines
      description: 'The number of installed machines.'
      type: Number
    - contextPath: MicrosoftATP.Software.impactScore
      description: Exposure score impact of this software.
      type: Number
    - contextPath: MicrosoftATP.Software.isNormalized
      description: Whether the software is normalized.
      type: Boolean
    - contextPath: MicrosoftATP.Software.category
      description: Software category.
      type: String
    - contextPath: MicrosoftATP.Software.distributions
      description: Software distributions.
      type: String
  - arguments:
    - description: A comma-separated list of machine IDs used for getting the vulnerabilities.
      isArray: true
      name: machine_id
    - description: A comma-separated list of software IDs used for getting the vulnerabilities.
      name: software_id
      isArray: true
    - description: A comma-separated list of CVE IDs used for getting the vulnerabilities.
      name: cve_id
      isArray: true
    - description: A comma-separated list of product names used for getting the vulnerabilities.
      name: product_name
      isArray: true
    - description: A comma-separated list of product versions used for getting the vulnerabilities.
      name: product_version
      isArray: true
    - description: 'A comma-separated list of vulnerability severities. Possible values are: "Low", "Medium", "High", "Critical".'
      name: severity
      isArray: true
    - description: 'A comma-separated list of product vendors used for getting the vulnerabilities.'
      isArray: true
      name: product_vendor
    - description: Maximum number of results to retrieve.
      name: limit
      defaultValue: '25'
    - description: The number of items in the queried collection that are to be skipped and not included in the result.
      name: offset
      defaultValue: '0'
    description: Retrieves a list of all the vulnerabilities affecting the organization per machine.
    name: microsoft-atp-list-vulnerabilities-by-machine
    outputs:
    - contextPath: MicrosoftATP.MachineCVE.id
      description: Vulnerability ID.
      type: String
    - contextPath: MicrosoftATP.MachineCVE.cveId
      description: CVE ID.
      type: String
    - contextPath: MicrosoftATP.MachineCVE.machineId
      description: Machine ID.
      type: String
    - contextPath: MicrosoftATP.MachineCVE.fixingKbId
      description: 'Fixing Kb ID.'
      type: Unknown
    - contextPath: MicrosoftATP.MachineCVE.productName
      description: Product name.
      type: String
    - contextPath: MicrosoftATP.MachineCVE.productVendor
      description: Name of the product vendor.
      type: String
    - contextPath: MicrosoftATP.MachineCVE.productVersion
      description: Product version.
      type: String
    - contextPath: MicrosoftATP.MachineCVE.severity
      description: 'Vulnerability severity. Possible values are: "Low", "Medium", "High", "Critical".'
      type: String
  - arguments:
    - description: Vulnerability ID.
      name: id
      isArray: true
    - description: Vulnerability title.
      name: name_equal
    - description: Vulnerability title. Does not work with another filter arguments.
      name: name_contains
    - description: Vulnerability description. Does not work with another filter arguments.
      name: description_contains
    - description: Date when the vulnerability was published. Date format will be in ISO 8601 format or relational expressions like “7 days ago”.
      name: published_on
    - description: CVSS v3 score.
      name: cvss
    - description: 'A comma-separated list of vulnerability severities. Possible values are: "Low", "Medium", "High", "Critical".'
      isArray: true
      name: severity
    - description: Date when the vulnerability was updated. Date format will be in ISO 8601 format or relational expressions like “7 days ago”.
      name: updated_on
    - description: Maximum number of results to retrieve.
      name: limit
      defaultValue: '25'
    - description: The number of items in the queried collection that are to be skipped and not included in the result.
      defaultValue: '0'
      name: offset
    description: |-
      Retrieves a list of all vulnerabilities.
    name: microsoft-atp-list-vulnerabilities
    outputs:
    - contextPath: MicrosoftATP.Vulnerability.id
      description: Vulnerability ID.
      type: String
    - contextPath: MicrosoftATP.Vulnerability.name
      description: Vulnerability title.
      type: String
    - contextPath: MicrosoftATP.Vulnerability.description
      description: Vulnerability description.
      type: String
    - contextPath: MicrosoftATP.Vulnerability.severity
      description: 'Vulnerability severity. Possible values are: "Low", "Medium", "High", "Critical".'
      type: String
    - contextPath: MicrosoftATP.Vulnerability.cvssV3
      description: CVSS v3 score.
      type: Number
    - contextPath: MicrosoftATP.Vulnerability.exposedMachines
      description: Number of exposed devices.
      type: Number
    - contextPath: MicrosoftATP.Vulnerability.publishedOn
      description: Date when the vulnerability was published. Date format will be in ISO 8601 format or relational expressions like “7 days ago”.
      type: Date
    - contextPath: MicrosoftATP.Vulnerability.updatedOn
      description: Date when the vulnerability was updated. Date format will be in ISO 8601 format or relational expressions like “7 days ago”.
      type: Date
    - contextPath: MicrosoftATP.Vulnerability.publicExploit
      description: Whether the public exploit exists.
      type: Boolean
    - contextPath: MicrosoftATP.Vulnerability.exploitVerified
      description: Whether the exploit is verified to work.
      type: Boolean
    - contextPath: MicrosoftATP.Vulnerability.exploitInKit
      description: Whether the exploit is part of an exploit kit.
      type: Boolean
    - contextPath: MicrosoftATP.Vulnerability.exploitTypes
      description: 'Exploit impact. Possible values are: "Local privilege escalation", "Denial of service", "Local".'
      type: String
    - contextPath: MicrosoftATP.Vulnerability.exploitUris
      description: Exploit source URLs.
      type: String
  - arguments:
    - description: Software ID. Use the !microsoft-atp-list-software command to get the ID.
      name: id
    description: |-
      Retrieves a list of your organization's software version distribution.
    name: microsoft-atp-list-software-version-distribution
    outputs:
    - contextPath: MicrosoftATP.SoftwareVersion.version
      description: Version number.
      type: String
    - contextPath: MicrosoftATP.SoftwareVersion.installations
      description: Installations number.
      type: Number
    - contextPath: MicrosoftATP.SoftwareVersion.vulnerabilities
      description: Number of vulnerabilities.
      type: Number
  - arguments:
    - default: true
      description: A comma-separated list of CVE IDs used for getting the machines.
      isArray: true
      name: cve_id
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Retrieves a list of machines affected by a vulnerability.
    name: microsoft-atp-list-machines-by-vulnerability
    outputs:
    - contextPath: MicrosoftATP.CveMachine.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.CveMachine.ComputerDNSName
      description: The machine hostname.
      type: String
    - contextPath: MicrosoftATP.CveMachine.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.CveMachine.RBACGroupName
      description: The machine RBAC group name.
      type: String
    - contextPath: MicrosoftATP.CveMachine.CVE
      description: The given CVE IDs related to this machine.
      type: Unknown
    polling: true
  - arguments:
    - description: A comma-separated list of file hashes (SHA1 or SHA256) used for getting the file information.
      isArray: true
      name: hash
      default: true
      required: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Retrieves file information by a file hash (SHA1 or SHA256).
    name: microsoft-atp-get-file-info
    outputs:
    - contextPath: MicrosoftATP.File.Sha1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: MicrosoftATP.File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: MicrosoftATP.File.Sha256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: MicrosoftATP.File.GlobalPrevalence
      description: The file prevalence across the organization.
      type: Number
    - contextPath: MicrosoftATP.File.GlobalFirstObserved
      description: The first time the file was observed.
      type: Date
    - contextPath: MicrosoftATP.File.GlobalLastObserved
      description: The last time the file was observed.
      type: Date
    - contextPath: MicrosoftATP.File.Size
      description: The size of the file.
      type: Number
    - contextPath: MicrosoftATP.File.FileType
      description: The type of the file.
      type: String
    - contextPath: MicrosoftATP.File.IsPeFile
      description: True if the file is portable executable, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.File.FilePublisher
      description: The file's publisher.
      type: String
    - contextPath: MicrosoftATP.File.FileProductName
      description: The file product name.
      type: String
    - contextPath: MicrosoftATP.File.Signer
      description: The file signer.
      type: String
    - contextPath: MicrosoftATP.File.Issuer
      description: The file issuer.
      type: String
    - contextPath: MicrosoftATP.File.SignerHash
      description: The hash of the signing certificate.
      type: String
    - contextPath: MicrosoftATP.File.IsValidCertificate
      description: Was signing certificate successfully verified by Microsoft Defender ATP agent.
      type: Boolean
    - contextPath: MicrosoftATP.File.DeterminationValue
      description: The file determination value.
      type: String
    - contextPath: MicrosoftATP.File.DeterminationType
      description: The file determination type.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.Size
      description: The file size.
      type: Number
    polling: true
  - name: endpoint
    description: Gets machines that have communicated with Microsoft Defender for Endpoint cloud. At least one of the following arguments is required - IP, hostname, or ID. Otherwise, an error appears.
    arguments:
    - name: id
      description: 'The endpoint ID.'
      isArray: true
    - name: ip
      description: The endpoint IP address.
      default: true
      isArray: true
    - description: The endpoint hostname.
      isArray: true
      name: hostname
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    outputs:
    - contextPath: Endpoint.ID
      description: The endpoint's identifier.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname of the endpoint.
      type: String
    - contextPath: Endpoint.OS
      description: The endpoint's operating system.
      type: String
    - contextPath: Endpoint.OSVersion
      description: The endpoint's operating system's version.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The endpoint's IP address.
      type: String
    - contextPath: Endpoint.Status
      description: The health status of the endpoint.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The endpoint's MAC address.
      type: String
    - contextPath: Endpoint.Vendor
      description: The integration name of the endpoint vendor.
      type: String
    - contextPath: MicrosoftATP.Machine.ID
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.Machine.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.Machine.FirstSeen
      description: The first date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.LastSeen
      description: The last date and time the machine was observed by Microsoft Defender ATP.
      type: Date
    - contextPath: MicrosoftATP.Machine.OSPlatform
      description: The operating system platform.
      type: String
    - contextPath: MicrosoftATP.Machine.OSVersion
      description: The operating system version.
      type: String
    - contextPath: MicrosoftATP.Machine.OSProcessor
      description: The operating system processor.
      type: String
    - contextPath: MicrosoftATP.Machine.LastIPAddress
      description: The last IP on the machine.
      type: String
    - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
      description: The last machine IP to access the internet.
      type: String
    - contextPath: MicrosoftATP.Machine.OSBuild
      description: The operating system build number.
      type: Number
    - contextPath: MicrosoftATP.Machine.HealthStatus
      description: The machine health status.
      type: String
    - contextPath: MicrosoftATP.Machine.RBACGroupID
      description: The machine RBAC group ID.
      type: Number
    - contextPath: MicrosoftATP.Machine.RBACGroupName
      description: The machine RBAC group name.
      type: String
    - contextPath: MicrosoftATP.Machine.RiskScore
      description: The machine risk score.
      type: String
    - contextPath: MicrosoftATP.Machine.ExposureLevel
      description: The machine exposure score.
      type: String
    - contextPath: MicrosoftATP.Machine.IsAADJoined
      description: True if machine is AAD joined, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.Machine.AADDeviceID
      description: The AAD Device ID.
      type: String
    - contextPath: MicrosoftATP.Machine.MachineTags
      description: Set of machine tags.
      type: String
    - contextPath: MicrosoftATP.Machine.IPAddresses.ipAddress
      description: The machine IP address.
      type: String
    - contextPath: MicrosoftATP.Machine.IPAddresses.MACAddress
      description: The machine MAC address.
      type: String
    - contextPath: MicrosoftATP.Machine.IPAddresses.operationalStatus
      description: The machine operational status.
      type: String
    - contextPath: MicrosoftATP.Machine.IPAddresses.type
      description: The machine IP address type.
      type: String
    - contextPath: MicrosoftATP.Machine.AgentVersion
      description: The machine Agent version.
      type: String
    polling: true
  - name: microsoft-atp-indicator-batch-update
    description: Updates a batch of indicators. If an indicator does not exist, a new indicator is created.
    arguments:
    - name: indicator_batch
      description: 'A JSON object with a list of MS defender ATP indicators to update. The indicator_batch query should be a list of dictionaries. For example: [{"indicatorValue": "value1"}, {"indicatorValue": "value2"}].'
      required: true
    - name: ran_once_flag
      description: Flag for the rate limit retry.
      deprecated: true
    outputs:
    - contextPath: MicrosoftATP.Indicators.ID
      description: Created by the system when the indicator is ingested. Generated GUID/unique identifier.
      type: String
    - contextPath: MicrosoftATP.Indicators.Value
      description: The value of the indicator.
      type: String
    - contextPath: MicrosoftATP.Indicators.FailureReason
      description: The reason for update failure.
      type: String
    - contextPath: MicrosoftATP.Indicators.IsFailed
      description: Whether the update failed.
      type: Boolean
    polling: true
  - name: microsoft-atp-get-alert-by-id
    description: "Deprecated. Use 'msg-get-alert-details' in the 'Microsoft Graph Security' integration instead."
    arguments:
    - name: alert_ids
      description: A comma-separated list of alert IDs.
      required: true
      isArray: true
    - name: ran_once_flag
      description: Flag for the rate limit retry.
      deprecated: true
    outputs:
    - contextPath: MicrosoftATP.Alert.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.Alert.IncidentID
      description: The incident ID of the alert.
      type: Number
    - contextPath: MicrosoftATP.Alert.InvestigationID
      description: The investigation ID related to the alert.
      type: Number
    - contextPath: MicrosoftATP.Alert.InvestigationState
      description: The current state of the investigation.
      type: String
    - contextPath: MicrosoftATP.Alert.AssignedTo
      description: The owner of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Severity
      description: The severity of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Status
      description: The current status of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.Alert.Determination
      description: The determination of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.DetectionSource
      description: The detection source.
      type: String
    - contextPath: MicrosoftATP.Alert.Category
      description: The category of the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ThreatFamilyName
      description: The threat family.
      type: String
    - contextPath: MicrosoftATP.Alert.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.Alert.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.Alert.AlertCreationTime
      description: The date and time the alert was created.
      type: Date
    - contextPath: MicrosoftATP.Alert.FirstEventTime
      description: The first event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.Alert.LastEventTime
      description: The last event time that triggered the alert on that machine.
      type: Date
    - contextPath: MicrosoftATP.Alert.LastUpdateTime
      description: The UTC time of the last update.
      type: Date
    - contextPath: MicrosoftATP.Alert.ResolvedTime
      description: The date and time when the status of the alert was changed to 'Resolved'.
      type: Date
    - contextPath: MicrosoftATP.Alert.MachineID
      description: The machine ID associated with the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ComputerDNSName
      description: The machine DNS name.
      type: String
    - contextPath: MicrosoftATP.Alert.AADTenantID
      description: The AAD tenant ID.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.Comment
      description: The alert comment string.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.CreatedBy
      description: The alert comment created by string.
      type: String
    - contextPath: MicrosoftATP.Alert.Comments.CreatedTime
      description: The alert comment created time date.
      type: Date
    - contextPath: MicrosoftATP.Alert.Evidence
      description: Evidence related to the alert.
      type: Unknown
    - contextPath: MicrosoftATP.Alert.DetectorID
      description: The ID of the detector that triggered the alert.
      type: String
    - contextPath: MicrosoftATP.Alert.ThreatName
      description: The threat name.
      type: String
    - contextPath: MicrosoftATP.Alert.RelatedUser
      description: Details of the user related to a specific alert.
      type: String
    - contextPath: MicrosoftATP.Alert.MitreTechniques
      description: MITRE Enterprise technique ID.
      type: String
    - contextPath: MicrosoftATP.Alert.RBACGroupName
      description: The device RBAC group name.
      type: String
    polling: true
    deprecated: true
  - name: microsoft-atp-live-response-get-file
    description: 'Collects a file from a device. Note: Backslashes in the path must be escaped.'
    arguments:
    - name: machine_id
      description: Machine ID to add the file to.
      required: true
      default: true
    - name: comment
      description: A comment to associate with the action.
      required: true
    - name: path
      description: File path to get from the device.
      required: true
    - name: machine_action_id
      description: Action ID to retrieve status and data for.
      deprecated: true
    - name: interval_in_seconds
      description: Interval between polling. Default is 10 seconds. Must be 10 or higher.
    - name: timeout_in_seconds
      description: Timeout for polling. Default is 600 seconds.
    - name: ran_once_flag
      description: Flag for the rate limit retry.
      deprecated: true
    outputs:
    - contextPath: MicrosoftATP.LiveResponseAction.id
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.type
      description: The machine action type.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.title
      description: The machine action title.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.requestor
      description: The machine action requestor.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.requestorComment
      description: The machine action requestorComment.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.status
      description: The machine action status.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.machineId
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.computerDnsName
      description: The computer DNS name.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.creationDateTimeUtc
      description: The action creationDateTimeUtc.
      type: Date
    - contextPath: MicrosoftATP.LiveResponseAction.lastUpdateDateTimeUtc
      description: The machine action lastUpdateDateTimeUtc.
      type: Date
    - contextPath: MicrosoftATP.LiveResponseAction.cancellationRequestor
      description: The machine action cancellationRequestor.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.cancellationComment
      description: The machine action cancellationComment.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.cancellationDateTimeUtc
      description: The cancellationDateTimeUtc.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.errorHResult
      description: The errorHResult if it exists.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.scope
      description: The action scope.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.externalId
      description: The machine action externalId.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.requestSource
      description: The machine action requestSource.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.relatedFileInfo
      description: The machine action relatedFileInfo.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.index
      description: The machine action command index.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.startTime
      description: The machine action command startTime.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.endTime
      description: The machine action command endTime.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.commandStatus
      description: The machine action command Status.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.errors
      description: The machine action command errors if found.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.command.type
      description: The machine action command type.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.command.params.key
      description: The machine action command params key.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.command.params.value
      description: The machine action command params value.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.troubleshootInfo
      description: The machine action troubleshoot information.
      type: String
    polling: true
    execution: true
  - name: microsoft-atp-live-response-run-script
    description: |-
      Runs a script from the library on a device. The Args parameter is passed to your script. Timeouts after 10 minutes.
    arguments:
    - name: machine_id
      description: The machine ID to add the file to.
      required: true
      default: true
    - name: comment
      description: A comment to associate with the action.
      required: true
    - name: scriptName
      description: The script name to run on the device.
      required: true
    - name: arguments
      description: Arguments to run the script with.
    - name: machine_action_id
      description: The action ID to retrieve status and data for.
      deprecated: true
    - name: interval_in_seconds
      description: Interval between polling. Default is 10 seconds. Must be 10 or higher.
    - name: timeout_in_seconds
      description: Timeout for polling. Default is 600 seconds.
    - name: ran_once_flag
      description: Flag for the rate limit retry.
      deprecated: true
    outputs:
    - contextPath: MicrosoftATP.LiveResponseAction.script_name
      description: The script name.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.exit_code
      description: The script exit code.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.script_output
      description: The script outputs.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.script_errors
      description: The script errors if found.
      type: String
    polling: true
    execution: true
  - name: microsoft-atp-live-response-put-file
    description: Puts a file from the library to the device. Files are saved in a working folder and are deleted when the device restarts by default.
    arguments:
    - name: machine_id
      description: The machine ID to add the file to.
      required: true
      default: true
    - name: comment
      description: A comment to associate with the action.
      required: true
    - name: file_name
      description: File name to take from the library to the device.
      required: true
    - name: machine_action_id
      description: Action ID to retrieve status and data for.
      deprecated: true
    - name: interval_in_seconds
      description: Interval between polling. Default is 10 seconds. Must be 10 or higher.
    - name: timeout_in_seconds
      description: Timeout for polling. Default is 600 seconds.
    - name: ran_once_flag
      description: Flag for the rate limit retry.
      deprecated: true
    outputs:
    - contextPath: MicrosoftATP.LiveResponseAction.id
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.type
      description: The machine action type.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.title
      description: The machine action title.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.requestor
      description: The machine action requestor.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.requestorComment
      description: The machine action requestorComment.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.status
      description: The machine action status.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.machineId
      description: The machine ID.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.computerDnsName
      description: The computer DNS name.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.creationDateTimeUtc
      description: The action creationDateTimeUtc.
      type: Date
    - contextPath: MicrosoftATP.LiveResponseAction.lastUpdateDateTimeUtc
      description: The machine action lastUpdateDateTimeUtc.
      type: Date
    - contextPath: MicrosoftATP.LiveResponseAction.cancellationRequestor
      description: The machine action cancellationRequestor.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.cancellationComment
      description: The machine action cancellationComment.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.cancellationDateTimeUtc
      description: The cancellationDateTimeUtc.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.errorHResult
      description: The errorHResult if exists.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.scope
      description: The action scope.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.externalId
      description: The machine action externalId.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.requestSource
      description: The machine action requestSource.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.relatedFileInfo
      description: The machine action relatedFileInfo.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.index
      description: The machine action command index.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.startTime
      description: The machine action command startTime.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.endTime
      description: The machine action command endTime.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.commandStatus
      description: The machine action command Status.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.errors
      description: The machine action command errors if found.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.command.type
      description: The machine action command type.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.command.params.key
      description: The machine action command params key.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.commands.command.params.value
      description: The machine action command params value.
      type: String
    - contextPath: MicrosoftATP.LiveResponseAction.troubleshootInfo
      description: The machine action troubleshootInfo.
      type: String
    execution: true
    polling: true
  - name: microsoft-atp-live-response-result
    description: Gets a result file for a specified action.
    arguments:
    - name: machine_action_id
      description: The action ID to retrieve status and data for.
      required: true
      default: true
    - name: command_index
      description: A command index to retrieve the file for.
      required: true
    - name: ran_once_flag
      description: Flag for the rate limit retry.
      deprecated: true
    outputs:
    - contextPath: MicrosoftATP.LiveResponseAction
      description: The machine action ID.
      type: String
    execution: true
  - name: microsoft-atp-live-response-cancel-action
    description: Cancels an action with an unfinished status.
    arguments:
    - name: machine_action_id
      description: Action ID to retrieve status and data for.
      required: true
      default: true
    - name: comment
      description: A comment to associate with the action.
      required: true
    - name: ran_once_flag
      description: Flag for the rate limit retry.
      deprecated: true
    outputs: []
    polling: true
    execution: true
  - arguments:
    - description: When you select a “query_purpose” argument, a designated query template is used. "network_connections" - The network connections initiated by the host/file to other internal hosts. "smb_connections" - SMB connections. "credential_dumping" - Was there a use of credential dumping? If so can we detect the use of the dumped users on other hosts on the network. "management_connection" - Management connection attempts to other hosts.
      name: query_purpose
      required: true
      auto: PREDEFINED
      defaultValue: ''
      predefined:
      - network_connections
      - smb_connections
      - credential_dumping
      - management_connection
    - description: Device name to look for.
      name: device_name
      defaultValue: ''
    - name: remote_ip_count
      description: Threshold for network enumeration in smb_connection.
      defaultValue: ''
    - name: file_name
      description: The file name to look for.
      defaultValue: ''
    - name: sha1
      description: The SHA1 hash to look for.
      defaultValue: ''
    - name: sha256
      description: The SHA256 hash to look for.
      defaultValue: ''
    - name: md5
      description: The MD5 hash to look for.
      defaultValue: ''
    - name: device_id
      description: The device ID to look for.
      defaultValue: ''
    - name: query_operation
      description: The query operator to use with provided arguments.
      defaultValue: 'or'
      auto: PREDEFINED
      predefined:
      - or
      - and
    - name: limit
      description: The maximum number of results to retrieve.
      defaultValue: '50'
    - description: Time range to look back. Expected syntax is a human readable time range, e.g. 60 minutes, 6 hours, 1 day, etc.
      name: time_range
    - defaultValue: '10'
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      name: timeout
    - defaultValue: '1'
      description: The page number from which to start a search. Default is 1.
      name: page
    - description: Show the query as part of the entry result.
      name: show_query
      defaultValue: 'false'
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Detects evidence of attempted lateral movement. When you select a “query_purpose” argument, a designated query template is used.
    name: microsoft-atp-advanced-hunting-lateral-movement-evidence
    outputs:
    - contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections
      description: The query results for network_connections query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections
      description: The query results for smb_connections query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping
      description: The query results for credential_dumping query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection
      description: The query results for management_connection query_purpose.
      type: String
    polling: true
  - arguments:
    - description: When you select a “query_purpose” argument, a designated query template is used. "scheduled_job" - Did the process create any scheduled jobs? "registry_entry" - Did it write to the registry? Requires also the process_cmd argument to be provided. "startup_folder_changes" - Was anything added to the startup folder? "new_service_created" - Was a new service created? "service_updated" - Was an existing service edited? "file_replaced" - Was a file replaced in program files? "new_user" - Was a new user created (on the local machine)? "new_group" - Was a new group created? "group_user_change" - Was a user added to a group (on the local machine)? "local_firewall_change" - Was there a change to the local FW rules? "host_file_change" - Whether there was a change to the hosts file or not.
      name: query_purpose
      defaultValue: ''
      required: true
      auto: PREDEFINED
      predefined:
      - scheduled_job
      - registry_entry
      - startup_folder_changes
      - new_service_created
      - service_updated
      - file_replaced
      - new_user
      - new_group
      - group_user_change
      - local_firewall_change
      - host_file_change
    - description: Device name to look for.
      name: device_name
      defaultValue: ''
    - name: file_name
      description: File name to look for.
      defaultValue: ''
    - name: sha1
      description: SHA1 hash to look for.
      defaultValue: ''
    - name: sha256
      description: SHA256 hash to look for.
      defaultValue: ''
    - name: md5
      description: MD5 hash to look for.
      defaultValue: ''
    - name: device_id
      description: Device ID to look for.
      defaultValue: ''
    - name: query_operation
      description: Query operator to use with the provided arguments.
      defaultValue: 'or'
      auto: PREDEFINED
      predefined:
      - or
      - and
    - name: limit
      description: Maximum number of results to retrieve.
      defaultValue: '50'
    - description: Time range to look back. Expected syntax is a human readable time range, e.g. 60 minutes, 6 hours, 1 day, etc.
      name: time_range
    - defaultValue: '10'
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      name: timeout
    - defaultValue: '1'
      description: The page number from which to start a search. Default is 1.
      name: page
    - description: Show the query as part of the entry result.
      name: show_query
      defaultValue: 'false'
    - description: Process command line that initiated the registry entry. Can only be used with "registry_entry" query_purpose.
      name: process_cmd
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Detects evidence of persistence. When you select a “query_purpose” argument, a designated query template is used.
    name: microsoft-atp-advanced-hunting-persistence-evidence
    outputs:
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job
      description: The query results for scheduled_job query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry
      description: The query results for registry_entry query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes
      description: The query results for startup_folder_changes query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created
      description: The query results for new_service_created query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.service_updated
      description: The query results for service_updated query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced
      description: The query results for file_replaced query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_user
      description: The query results for new_user query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_group
      description: The query results for new_group query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change
      description: The query results for group_user_change query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change
      description: The query results for local_firewall_change query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change
      description: The query results for host_file_change query_purpose.
      type: String
    polling: true
  - arguments:
    - description: Device name to look for.
      name: device_name
      defaultValue: ''
    - description: File name to look for.
      name: file_name
      defaultValue: ''
    - description: SHA1 hash to look for.
      name: sha1
      defaultValue: ''
    - description: SHA256 hash to look for.
      name: sha256
      defaultValue: ''
    - description: MD5 hash to look for.
      name: md5
      defaultValue: ''
    - description: Device ID to look for.
      name: device_id
      defaultValue: ''
    - name: query_operation
      description: Query operator to use with provided arguments.
      defaultValue: 'or'
      auto: PREDEFINED
      predefined:
      - or
      - and
    - name: limit
      description: Maximum number of results to retrieve.
      defaultValue: '50'
    - name: time_range
      description: Time range to look back. Expected syntax is a human readable time range, e.g. 60 minutes, 6 hours, 1 day, etc.
    - name: timeout
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      defaultValue: '10'
    - defaultValue: '1'
      description: The page number from which to start a search. Default is 1.
      name: page
    - defaultValue: 'false'
      description: Show the query as part of the entry result.
      name: show_query
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Indicates how the file got on the machine. Possible details are "dropped_file" - Was the file dropped? From where? "created_file" - Created by another File (script, compiled binary). "network_shared" - Shared via network. "execution_chain" - What is the process execution chain.
    name: microsoft-atp-advanced-hunting-file-origin
    outputs:
    - contextPath: MicrosoftATP.HuntFileOrigin.Result
      description: The query results.
      type: String
    polling: true
  - arguments:
    - description: When you select a “query_purpose” argument, a designated query template is used. "parent_process" - Parent process. "grandparent_process" - Grandparent process. "process_details" - Process hash, path, signature details. "beaconing_evidence" - Does the process appear to be beaconing? "powershell_execution_unsigned_files" - Has the file executed PowerShell? Query without specifying processes. No additional arguments are required. "process_excecution_powershell" - Whether there the file executed PowerShell or not.
      name: query_purpose
      required: true
      auto: PREDEFINED
      defaultValue: ''
      predefined:
      - parent_process
      - grandparent_process
      - process_details
      - beaconing_evidence
      - powershell_execution_unsigned_files
      - process_excecution_powershell
    - description: Device name to look for.
      name: device_name
      defaultValue: ''
    - description: File name to look for.
      name: file_name
      defaultValue: ''
    - name: sha1
      description: SHA1 hash to look for.
      defaultValue: ''
    - name: sha256
      description: SHA256 hash to look for.
      defaultValue: ''
    - name: md5
      description: MD5 hash to look for.
      defaultValue: ''
    - name: device_id
      description: Device ID to look for.
      defaultValue: ''
    - name: query_operation
      auto: PREDEFINED
      description: Query operator to use with provided arguments.
      defaultValue: or
      predefined:
      - or
      - and
    - name: limit
      description: Maximum number of results to retrieve.
      defaultValue: '50'
    - name: time_range
      description: Time range to look back. Expected syntax is a human readable time range, e.g. 60 minutes, 6 hours, 1 day, etc.
    - defaultValue: '10'
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      name: timeout
    - defaultValue: '1'
      description: The page number from which to start a search. Default is 1.
      name: page
    - defaultValue: 'false'
      description: Show the query as part of the entry result.
      name: show_query
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Detects process details. When you select a “query_purpose” argument, a designated query template is used.
    name: microsoft-atp-advanced-hunting-process-details
    outputs:
    - contextPath: MicrosoftATP.HuntProcessDetails.Result.parent_process
      description: The query results for parent_process query_purposeThe query results.
      type: String
    - contextPath: MicrosoftATP.HuntProcessDetails.Result.grandparent_process
      description: The query results for grandparent_process query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntProcessDetails.Result.process_details
      description: The query results for process_details query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntProcessDetails.Result.beaconing_evidence
      description: The query results for beaconing_evidence query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntProcessDetails.Result.powershell_execution_unsigned_files
      description: The query results for powershell_execution_unsigned_files query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntProcessDetails.Result.process_excecution_powershell
      description: The query results for process_excecution_powershell query_purpose.
      type: String
    polling: true
  - name: microsoft-atp-advanced-hunting-network-connections
    description: Detects network connections. When you select a “query_purpose” argument, a designated query template is used.
    arguments:
    - name: query_purpose
      description: When you select a “query_purpose” argument, a designated query template is used. "external_addresses" - Network connections to external addresses. "dns_query" - DNS query. Query by providing hash or filename or specific processes. At least one of file arguments (file_name, sha1, sha256, md5) is required and one of device arguments (device_name, device_id). "encoded_commands" - Are there commands with base 64 encoding? Only device arguments are required (device_name, device_id), at least one.
      defaultValue: ''
      required: true
      auto: PREDEFINED
      predefined:
      - external_addresses
      - dns_query
      - encoded_commands
    - name: device_name
      description: Device name to look for.
      defaultValue: ''
    - name: file_name
      description: File name to look for.
      defaultValue: ''
    - name: sha1
      description: SHA1 hash to look for.
      defaultValue: ''
    - name: sha256
      description: SHA256 hash to look for.
      defaultValue: ''
    - defaultValue: ''
      description: MD5 hash to look for.
      name: md5
    - defaultValue: ''
      description: Device ID to look for.
      name: device_id
    - defaultValue: 'or'
      description: Query operator to use with provided arguments.
      name: query_operation
      auto: PREDEFINED
      predefined:
      - or
      - and
    - description: Maximum number of results to retrieve.
      name: limit
      defaultValue: '50'
    - name: time_range
      description: Time range to look back. Expected syntax is a human readable time range, e.g. 60 minutes, 6 hours, 1 day, etc.
    - defaultValue: '10'
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      name: timeout
    - defaultValue: '1'
      description: The page number from which to start a search. Default is 1.
      name: page
    - defaultValue: 'false'
      description: Show the query as part of the entry result.
      name: show_query
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    outputs:
    - contextPath: MicrosoftATP.HuntNetworkConnections.Result.external_addresses
      description: The query results for external_addresses query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntNetworkConnections.Result.dns_query
      description: The query results for dns_query query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntNetworkConnections.Result.encoded_commands
      description: The query results for encoded_commands query_purpose.
      type: String
    polling: true
  - name: microsoft-atp-advanced-hunting-privilege-escalation
    description: Detects evidence of privilege escalation.
    arguments:
    - name: device_name
      description: Device name to look for.
      defaultValue: ''
    - name: device_id
      description: Device ID to look for.
      defaultValue: ''
    - name: query_operation
      auto: PREDEFINED
      description: Query operator to use with provided arguments.
      defaultValue: or
      predefined:
      - or
      - and
    - name: limit
      description: Maximum number of results to retrieve.
      defaultValue: '50'
    - name: time_range
      description: Time range to look back. Expected syntax is a human readable time range, e.g. 60 minutes, 6 hours, 1 day, etc.
    - defaultValue: '10'
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      name: timeout
    - defaultValue: '1'
      description: The page number from which to start a search. Default is 1.
      name: page
    - defaultValue: 'false'
      description: Show the query as part of the entry result.
      name: show_query
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    outputs:
    - contextPath: MicrosoftATP.HuntPrivilegeEscalation.Result
      description: The query results.
      type: String
  - name: microsoft-atp-advanced-hunting-tampering
    description: Detects evidence of MSDE agent/sensor manipulation.
    arguments:
    - name: device_name
      description: Device name to look for.
      defaultValue: ''
    - name: device_id
      description: Device ID to look for.
      defaultValue: ''
    - name: query_operation
      description: Query operator to use with provided arguments.
      defaultValue: 'or'
      auto: PREDEFINED
      predefined:
      - or
      - and
    - name: limit
      description: Maximum number of results to retrieve.
      defaultValue: '50'
    - name: time_range
      description: Time range to look back. Expected syntax is a human readable time range, e.g. 60 minutes, 6 hours, 1 day, etc.
    - name: timeout
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      defaultValue: '10'
    - name: page
      description: The page number from which to start a search. Default is 1.
      defaultValue: '1'
    - name: show_query
      description: Show the query as part of the entry result.
      defaultValue: 'false'
    - name: ran_once_flag
      description: Flag for the rate limit retry.
      deprecated: true
    outputs:
    - contextPath: MicrosoftATP.HuntTampering.Result
      description: The query results.
      type: String
    polling: true
  - arguments:
    - description: When you select a “query_purpose” argument, a designated query template is used. "file_deleted" - Did the file delete itself? "event_log_cleared" - Was the event log cleared? Requires at least one of device arguments (device_name/device_id). "compromised_information" - Information on a compromised user and its activities. Requires only username argument. "connected_devices" - All connected devices by compromised user. Requires only username argument. "action_types" - All action types created by a user on each machine. Requires only username argument. "common_files" - Most common files associated with a user. Requires only username argument.
      name: query_purpose
      required: true
      auto: PREDEFINED
      defaultValue: ''
      predefined:
      - file_deleted
      - event_log_cleared
      - compromised_information
      - connected_devices
      - action_types
      - common_files
    - description: Device name to look for.
      name: device_name
      defaultValue: ''
    - name: file_name
      description: File name to look for.
      defaultValue: ''
    - name: sha1
      description: SHA1 hash to look for.
      defaultValue: ''
    - name: sha256
      description: SHA256 hash to look for.
      defaultValue: ''
    - name: md5
      description: MD5 hash to look for.
      defaultValue: ''
    - name: device_id
      description: Device ID to look for.
      defaultValue: ''
    - name: username
      description: Username to look for in relevant query types.
      defaultValue: ''
    - name: query_operation
      auto: PREDEFINED
      description: Query operator to use with provided arguments.
      defaultValue: or
      predefined:
      - or
      - and
    - name: limit
      description: Maximum number of results to retrieve.
      defaultValue: '50'
    - name: time_range
      description: Time range to look back. Expected syntax is a human readable time range, e.g. 60 minutes, 6 hours, 1 day, etc.
    - defaultValue: '10'
      description: The amount of time (in seconds) that a request waits for the query response before a timeout occurs.
      name: timeout
    - defaultValue: '1'
      description: The page number from which to start a search. Default is 1.
      name: page
    - defaultValue: 'false'
      description: Show the query as part of the entry result.
      name: show_query
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Detects cover up actions. When you select a “query_purpose” argument, a designated query template is used.
    name: microsoft-atp-advanced-hunting-cover-up
    outputs:
    - contextPath: MicrosoftATP.HuntCoverUp.Result.file_deleted
      description: The query results for file_deleted query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntCoverUp.Result.event_log_cleared
      description: The query results for event_log_cleared query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntCoverUp.Result.compromised_information
      description: The query results for compromised_information query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntCoverUp.Result.connected_devices
      description: The query results for connected_devices query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntCoverUp.Result.action_types
      description: The query results for action_types query_purpose.
      type: String
    - contextPath: MicrosoftATP.HuntCoverUp.Result.common_files
      description: The query results for common_files query_purpose.
      type: String
    polling: true
  - arguments:
    - default: true
      description: A machine ID used for getting logged on users.
      name: machine_id
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Retrieves a collection of logged on users on a specific device.
    name: microsoft-atp-get-machine-users
    outputs:
    - contextPath: MicrosoftATP.MachineUser.ID
      description: The user ID.
      type: String
    - contextPath: MicrosoftATP.MachineUser.AccountName
      description: The user account name.
      type: String
    - contextPath: MicrosoftATP.MachineUser.AccountDomain
      description: The domain of the user account.
      type: String
    - contextPath: MicrosoftATP.MachineUser.FirstSeen
      description: The first date and time the user has logged on the machine.
      type: Date
    - contextPath: MicrosoftATP.MachineUser.LastSeen
      description: The last date and time the user has logged on the machine.
      type: Date
    - contextPath: MicrosoftATP.MachineUser.LogonTypes
      description: The logon types of the user on the machine.
      type: String
    - contextPath: MicrosoftATP.MachineUser.DomainAdmin
      description: True if user is Domain Admin, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.MachineUser.NetworkUser
      description: True if user is network user, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.MachineUser.MachineID
      description: The machine ID.
      type: String
    polling: true
  - arguments:
    - description: A machine ID used for getting machine related alerts.
      name: machine_id
      required: true
      default: true
    - description: Flag for the rate limit retry.
      name: ran_once_flag
      deprecated: true
    description: Deprecated. No available replacement.
    name: microsoft-atp-get-machine-alerts
    outputs:
    - contextPath: MicrosoftATP.MachineAlerts.ID
      description: The alert ID.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.Title
      description: The alert title.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.Description
      description: The alert description.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.IncidentID
      description: The incident ID, if alert belongs to one.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.Severity
      description: The alert severity.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.Status
      description: The alert status.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.Classification
      description: The alert classification.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.Category
      description: The alert category.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.ThreatFamilyName
      description: The alert threat family name.
      type: String
    - contextPath: MicrosoftATP.MachineAlerts.MachineID
      description: The alerts machine ID.
      type: String
    polling: true
    deprecated: true
  - arguments:
    - description: The machine ID. Can be retrieved by running the 'microsoft-atp-get-machines' command.
      name: machine_id
      required: true
    - description: Comment to associate with the action.
      name: comment
      required: true
    - description: Timeout for polling. Default is 600 seconds.
      name: timeout_in_seconds
    - description: Action ID to retrieve status and data for. Retrieved from the 'get-machine-investigation-package' command.
      name: machine_action_id
      deprecated: true
    - description: Interval between polling. Default is 10 seconds. Must be 10 or higher.
      name: interval_in_seconds
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    description: Collect and download an investigation package from a machine.
    name: microsoft-atp-request-and-download-investigation-package
    outputs:
    - contextPath: MicrosoftATP.MachineAction.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.MachineAction.Status
      description: The current status of the machine action.
      type: String
    - contextPath: MicrosoftATP.MachineAction.MachineID
      description: The machine ID on which the action was executed.
      type: String
    polling: true
  - description: Offboard a machine from Microsoft Defender for Endpoint.
    name: microsoft-atp-offboard-machine
    arguments:
    - default: true
      description: A comma-separated list of machine IDs to be used for offboarding. e.g., 0a3250e0693a109f1affc9217be9459028aa8426,0a3250e0693a109f1affc9217be9459028aa8424.
      isArray: true
      name: machine_id
      required: true
    - description: A comment to associate with the action.
      name: comment
      required: true
    - deprecated: true
      description: Flag for the rate limit retry.
      name: ran_once_flag
    execution: true
    outputs:
    - contextPath: MicrosoftATP.OffboardMachine.ID
      description: The machine action ID.
      type: String
    - contextPath: MicrosoftATP.OffboardMachine.Type
      description: Type of the machine action.
      type: String
    - contextPath: MicrosoftATP.OffboardMachine.Scope
      description: Scope of the action.
      type: Unknown
    - contextPath: MicrosoftATP.OffboardMachine.Requestor
      description: The ID of the user that executed the action.
      type: String
    - contextPath: MicrosoftATP.OffboardMachine.RequestorComment
      description: Comment that was written when issuing the action.
      type: String
    - contextPath: MicrosoftATP.OffboardMachine.Status
      description: The current status of the command.
      type: String
    - contextPath: MicrosoftATP.OffboardMachine.MachineID
      description: The machine ID on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.OffboardMachine.ComputerDNSName
      description: The machine DNS name on which the action was executed.
      type: String
    - contextPath: MicrosoftATP.OffboardMachine.CreationDateTimeUtc
      description: The date and time when the action was created.
      type: Date
    - contextPath: MicrosoftATP.OffboardMachine.LastUpdateTimeUtc
      description: The last date and time when the action status was updated.
      type: Date
    - contextPath: MicrosoftATP.OffboardMachine.cancellationDateTimeUtc
      description: The date and time when the action was canceled.
      type: Date
    - contextPath: MicrosoftATP.OffboardMachine.RelatedFileInfo
      description: The file info.
      type: String
    - contextPath: MicrosoftATP.OffboardMachine.troubleshootInfo
      description: Troubleshooting information.
      type: String
    polling: true
  - description: Generate the login url used for Authorization code flow.
    name: microsoft-atp-generate-login-url
    arguments: []
  - description: Run this command if for some reason you need to rerun the authentication process.
    execution: false
    name: microsoft-atp-auth-reset
    arguments: []
  - description: This command gets the permissions from the currently configured credentials. Use for debugging and detecting permission issues.
    name: microsoft-atp-list-auth-permissions
  - arguments:
    - description: The machine ID. Can be retrieved by running the 'microsoft-atp-get-machines' command.
      name: machine_id
      required: true
    description: Get the specific machine's software details.
    name: microsoft-atp-get-machine-software
    polling: true
    outputs:
    - contextPath: MicrosoftATP.Software.ID
      description: The software ID.
      type: String
    - contextPath: MicrosoftATP.Software.Name
      description: The software name.
      type: String
    - contextPath: MicrosoftATP.Software.Vendor
      description: The software vendor name.
      type: String
    - contextPath: MicrosoftATP.Software.Weaknesses
      description: The amount of weaknesses present in the software.
      type: Number
    - contextPath: MicrosoftATP.Software.PublicExploit
      description: Does this software have a public exploit?
      type: Boolean
    - contextPath: MicrosoftATP.Software.ActiveAlert
      description: Does this software have an active alert?
      type: Boolean
    - contextPath: MicrosoftATP.Software.ExposedMachines
      description: The amount of machines exposed to this software.
      type: Number
    - contextPath: MicrosoftATP.Software.InstalledMachines
      description: The amount of machines with this software installed.
      type: Number
    - contextPath: MicrosoftATP.Software.ImpactScore
      description: The impact score of the software.
      type: Number
    - contextPath: MicrosoftATP.Software.IsNormalized
      description: Is the software value normalized?
      type: Boolean
    - contextPath: MicrosoftATP.Software.Category
      description: The software category.
      type: String
    - contextPath: MicrosoftATP.Software.Distributions
      description: The distributions on which this software is present.
      type: String
  - arguments:
    - description: The machine ID. Can be retrieved by running the 'microsoft-atp-get-machines' command.
      name: machine_id
      required: true
    description: Get the specific machine's missing security updates (KBs).
    name: microsoft-atp-get-machine-missing-kbs
    polling: true
    outputs:
    - contextPath: MicrosoftATP.PublicProductFix.ID
      description: The missing KB ID.
      type: String
    - contextPath: MicrosoftATP.PublicProductFix.Name
      description: The missing KB name.
      type: String
    - contextPath: MicrosoftATP.PublicProductFix.ProductsNames
      description: The product names.
      type: String
    - contextPath: MicrosoftATP.PublicProductFix.URL
      description: The KB URL.
      type: String
    - contextPath: MicrosoftATP.PublicProductFix.MachineMissedOn
      description: The amount of machines that is missing this KB.
      type: Number
    - contextPath: MicrosoftATP.PublicProductFix.CVEAddressed
      description: The CVE addressed by this KB.
      type: Number
    - contextPath: MicrosoftATP.PublicProductFix.OSBuild
      description: The OS build.
      type: String
  - arguments:
    - default: true
      description: Hash of the file to query. Supports MD5, SHA1, and SHA256.
      isArray: true
      name: file
      required: true
    description: Checks the file reputation of the specified hash.
    name: file
    outputs:
    - contextPath: MicrosoftATP.File.Sha1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: MicrosoftATP.File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: MicrosoftATP.File.Sha256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: MicrosoftATP.File.GlobalPrevalence
      description: The file prevalence across the organization.
      type: Number
    - contextPath: MicrosoftATP.File.GlobalFirstObserved
      description: The first time the file was observed.
      type: Date
    - contextPath: MicrosoftATP.File.GlobalLastObserved
      description: The last time the file was observed.
      type: Date
    - contextPath: MicrosoftATP.File.Size
      description: The size of the file.
      type: Number
    - contextPath: MicrosoftATP.File.FileType
      description: The type of the file.
      type: String
    - contextPath: MicrosoftATP.File.IsPeFile
      description: True if the file is portable executable, False otherwise.
      type: Boolean
    - contextPath: MicrosoftATP.File.FilePublisher
      description: The file's publisher.
      type: String
    - contextPath: MicrosoftATP.File.FileProductName
      description: The file product name.
      type: String
    - contextPath: MicrosoftATP.File.Signer
      description: The file signer.
      type: String
    - contextPath: MicrosoftATP.File.Issuer
      description: The file issuer.
      type: String
    - contextPath: MicrosoftATP.File.SignerHash
      description: The hash of the signing certificate.
      type: String
    - contextPath: MicrosoftATP.File.IsValidCertificate
      description: Was signing certificate successfully verified by Microsoft Defender ATP agent.
      type: Boolean
    - contextPath: MicrosoftATP.File.DeterminationValue
      description: The file determination value.
      type: String
    - contextPath: MicrosoftATP.File.DeterminationType
      description: The file determination type.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.Size
      description: The file size.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
  - arguments:
    - description: The machine ID. Can be retrieved by running the 'microsoft-atp-get-machines' command.
      name: machine_id
      required: true
    description: Get the specific machine's vulnerabilities.
    name: microsoft-atp-get-machine-vulnerabilities
    polling: true
    outputs:
    - contextPath: MicrosoftATP.PublicVulnerability.ID
      description: The vulnerability ID.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.Name
      description: The vulnerability name.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.CVESupportability
      description: The CVE supportability.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.CVSSV3
      description: The CVSS V3.
      type: Number
    - contextPath: MicrosoftATP.PublicVulnerability.CVSSVector
      description: The CVSS vector.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.Description
      description: A description of this vulnerability.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.EPSS
      description: The EPSS.
      type: Number
    - contextPath: MicrosoftATP.PublicVulnerability.ExploitInKit
      description: Is this vulnerability in an exploit kit?
      type: Boolean
    - contextPath: MicrosoftATP.PublicVulnerability.ExploitTypes
      description: The type(s) of exploit(s).
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.ExploitUris
      description: The exploit URIs.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.ExploitVerified
      description: Is this exploit verified?
      type: Boolean
    - contextPath: MicrosoftATP.PublicVulnerability.ExposedMachines
      description: The amount of machines exposed to this vulnerability.
      type: Number
    - contextPath: MicrosoftATP.PublicVulnerability.FirstDetected
      description: The date and time when this vulnerability was first detected.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.PublicExploit
      description: Does this vulnerability have a public exploit?
      type: Boolean
    - contextPath: MicrosoftATP.PublicVulnerability.PublishedOn
      description: The date and time when this vulnerability was published.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.Severity
      description: The severity of this vulnerability.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.Tags
      description: The tags associated with this vulnerability.
      type: String
    - contextPath: MicrosoftATP.PublicVulnerability.UpdatedOn
      description: The date and time when this vulnerability was last updated.
      type: String
  dockerimage: demisto/crypto:1.0.0.11658507
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
defaultmapperin: Microsoft Defender For Endpoint Mapper
fromversion: 5.0.0
tests:
- Microsoft Defender Advanced Threat Protection - Test
- Microsoft Defender Advanced Threat Protection - Test dev
- Microsoft Defender Advanced Threat Protection - Test self deployed
- Microsoft Defender Advanced Threat Protection - Test prod