category: Network Security
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: Palo Alto Networks IoT
  version: -1
configuration:
- defaultvalue: https://example.iot.paloaltonetworks.com
  display: Palo Alto Networks IoT Security Portal URL (e.g. https://example.iot.paloaltonetworks.com)
  name: url
  required: true
  type: 0
  section: Connect
- defaultvalue: paloaltonetworks
  display: Tenant ID
  name: tenant_id
  required: true
  type: 0
  section: Connect
- display: Access Key ID
  name: credentials
  type: 9
  displaypassword: Secret Access Key
  section: Connect
  required: false
- display: Access Key ID
  name: access_key_id
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Secret Access Key
  name: secret_access_key
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: '7 days'
  display: First fetch time
  name: first_fetch
  type: 0
  additionalinfo: "The format: <number> <time unit>. e.g., 12 hours, 7 days, 2 seconds etc."
  section: Collect
  required: false
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: '10'
  type: 0
  additionalinfo: Maximal number of events is 100
  section: Collect
  required: false
- display: Fetch IoT Alerts
  name: fetch_alerts
  defaultvalue: "true"
  type: 8
  additionalinfo: When selected, the integration fetches IoT alerts from the IoT Security Portal.
  section: Collect
  advanced: true
  required: false
- display: Fetch IoT Vulnerabilities
  name: fetch_vulns
  defaultvalue: "true"
  type: 8
  additionalinfo: When selected, the integration fetches IoT vulnerabilities from the IoT Security Portal.
  section: Collect
  advanced: true
  required: false
- display: The timeout for querying APIs
  name: api_timeout
  type: 0
  defaultvalue: "60"
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
description: This is the Palo Alto Networks IoT integration (previously Zingbox).
display: Palo Alto Networks IoT
name: Palo Alto Networks IoT
script:
  commands:
  - name: iot-security-get-device
    arguments:
    - description: The device uid (mac address).
      name: id
      required: true
    description: IoT get device command - get a single device's details.
    outputs:
    - contextPath: PaloAltoNetworksIoT.Device
      description: Device details.
      type: unknown
    - contextPath: PaloAltoNetworksIoT.Device.hostname
      description: The hostname of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.ip_address
      description: The IP address of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile_type
      description: "The device profile type: Non_IoT vs IoT."
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile_vertical
      description: The device profile vertical.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.category
      description: The device category.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile
      description: The device profile.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.last_activity
      description: The last activity timestamp of the device.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.long_description
      description: The long description of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.vlan
      description: The device VLAN ID.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.site_name
      description: The site which the device is in.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.risk_score
      description: The device risk score.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.risk_level
      description: "The device risk level: Low, Medium, High, Critical."
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.subnet
      description: The device subnet.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.first_seen_date
      description: The first seen date of the device.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.confidence_score
      description: The device confidence score.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.deviceid
      description: The device ID.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.location
      description: The device location.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.vendor
      description: The device vendor.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.model
      description: The device model.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.description
      description: The device description.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.asset_tag
      description: 'The device asset tag (e.g. a sticky label at the bottom of the device).'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.os_group
      description: 'The device OS group.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Serial_Number
      description: 'The device serial number.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.DHCP
      description: 'Whether the device is in DHCP model: Valid values are Yes or No.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.wire_or_wireless
      description: 'Is the device wired or wireless.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.department
      description: 'The device department.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Switch_Port
      description: 'The port of the switch this device is connected to.'
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.Switch_Name
      description: 'The name of the switch this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Switch_IP
      description: 'The IP of the switch this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Access_Point_IP
      description: 'The IP of the access point this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Access_Point_Name
      description: 'The name of the access point this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.SSID
      description: 'The SSID of the wireless network this device is connected to.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.MAC
      description: 'The device MAC address.'
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.display_tags
      description: 'The user tags of the device.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.mac_address
      description: 'The device MAC address.'
      type: String
  - name: iot-security-get-device-by-ip
    arguments:
    - name: ip
      required: true
      description: The device ip (ip address).
    outputs:
    - contextPath: PaloAltoNetworksIoT.Device
      description: Device details.
      type: unknown
    - contextPath: PaloAltoNetworksIoT.Device.hostname
      description: The hostname of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.ip_address
      description: The IP address of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile_type
      description: 'The device profile type: Non_IoT vs IoT.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile_vertical
      description: The device profile vertical.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.category
      description: The device category.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.profile
      description: The device profile.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.last_activity
      description: The last activity timestamp of the device.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.long_description
      description: The long description of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.vlan
      description: The device VLAN ID.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.site_name
      description: The site which the device is in.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.risk_score
      description: The device risk score.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.risk_level
      description: 'The device risk level: Low, Medium, High, Critical.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.subnet
      description: The device subnet.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.first_seen_date
      description: The first seen date of the device.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.confidence_score
      description: The device confidence score.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.deviceid
      description: The device ID.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.location
      description: The device location.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.vendor
      description: The device vendor.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.model
      description: The device model.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.description
      description: The device description.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.asset_tag
      description: The device asset tag (e.g. a sticky label at the bottom of the device).
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.os_group
      description: The device OS group.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Serial_Number
      description: The device serial number.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.DHCP
      description: 'Whether the device is in DHCP model: Valid values are Yes or No.'
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.wire_or_wireless
      description: Is the device wired or wireless.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.department
      description: The device department.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Switch_Port
      description: The port of the switch this device is connected to.
      type: Number
    - contextPath: PaloAltoNetworksIoT.Device.Switch_Name
      description: The name of the switch this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Switch_IP
      description: The IP of the switch this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Access_Point_IP
      description: The IP of the access point this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.Access_Point_Name
      description: The name of the access point this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.SSID
      description: The SSID of the wireless network this device is connected to.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.MAC
      description: The device MAC address.
      type: Date
    - contextPath: PaloAltoNetworksIoT.Device.display_tags
      description: The user tags of the device.
      type: String
    - contextPath: PaloAltoNetworksIoT.Device.mac_address
      description: The device MAC address.
      type: String
    description: IoT get device command - get a single device's details.
  - name: iot-security-list-devices
    arguments:
    - description: The offset in the pagination.
      name: offset
    - description: The maximum size of the list of the devices.
      name: limit
    description: IoT list devices command.
    outputs:
    - contextPath: PaloAltoNetworksIoT.DeviceList
      description: List of devices.
      type: unknown
  - name: iot-security-list-alerts
    arguments:
    - description: The start time in the format of ISO 8601 in UTC, e.g. 2018-11-06T08:56:41Z.
      name: start_time
    - description: The offset in the pagination.
      name: offset
    - description: The maximum size of the list of the alerts.
      name: limit
    description: IoT list alerts.
    outputs:
    - contextPath: PaloAltoNetworksIoT.Alerts
      description: List of alerts.
      type: unknown
  - name: iot-security-list-vulns
    arguments:
    - description: The start time in the format of ISO 8601 in UTC, e.g. 2018-11-06T08:56:41Z.
      name: start_time
    - description: The offset in the pagination.
      name: offset
    - description: The maximum size of the list of the vulnerabilities.
      name: limit
    description: IoT list Vulnerabilities.
    outputs:
    - contextPath: PaloAltoNetworksIoT.Vulns
      description: List of vulnerabilities.
      type: unknown
  - name: iot-security-resolve-alert
    arguments:
    - description: The alert ID.
      name: id
      required: true
    - description: The alert resolution reason.
      name: reason
    - description: The alert resolution reason type (No Action Needed, Issue Mitigated).
      name: reason_type
      predefined:
      - 'No Action Needed'
      - 'Issue Mitigated'
    description: Resolving an IoT alert.
  - name: iot-security-resolve-vuln
    arguments:
    - description: The vulnerability ID.
      name: id
      required: true
    - description: The vulnerability full name.
      name: full_name
      required: true
    - description: The vulnerability resolution reason.
      name: reason
    description: Resolving an IoT vulnerability.
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 5.0.0
tests:
- PaloAltoNetworks_IoT-Test