category: Endpoint provider: Palo Alto Networks commonfields: id: Traps version: -1 configuration: - display: Server URL name: url required: true type: 0 - display: Application ID name: application_id required: true type: 0 - display: Private Key name: private_key required: true type: 14 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: |- Deprecated. Use CortexXDR instead. display: Palo Alto Networks Traps (Deprecated) name: Traps script: commands: - arguments: - description: Endpoint ID. isArray: true name: endpoint_id required: true deprecated: true description: Returns details for the specified endpoint. name: traps-get-endpoint-by-id outputs: - contextPath: Traps.Endpoint.ID description: The ID of the endpoint. type: String - contextPath: Traps.Endpoint.Name description: The name of the endpoint. type: String - contextPath: Traps.Endpoint.Domain description: The domain of the endpoint. type: date - contextPath: Traps.Endpoint.Platform description: The OS of the endpoint. type: String - contextPath: Traps.Endpoint.Status description: The status of the endpoint. type: String - contextPath: Traps.Endpoint.IP description: The IP address of the endpoint. type: String - contextPath: Traps.Endpoint.ComputerSid description: The computer SID. type: String - contextPath: Traps.Endpoint.IsCompromised description: Whether the endpoint is compromised. type: String - contextPath: Traps.Endpoint.OsVersion description: The version of the OS on the endpoint. type: String - contextPath: Traps.Endpoint.OsProductType description: The OS type of the endpoint. type: String - contextPath: Traps.Endpoint.OsProductName description: The name of the OS on the endpoint. type: String - contextPath: Traps.Endpoint.Is64 description: The bitness of the OS on the endpoint. type: String - contextPath: Traps.Endpoint.LastSeen description: The date/time of the last active ping. type: String - contextPath: Traps.Endpoint.LastUser description: The last active user on the machine. type: String - contextPath: Traps.Endpoint.ScanStatus description: The status of the last scan run on the machine. type: String - arguments: - description: The ID of the endpoint. name: endpoint_id required: true - description: The name of the file to retrieve (including path). name: file_name required: true - description: The ID of the event. name: event_id required: true deprecated: true description: Executes a file retrieve operation / SAM on the specified agent. name: traps-endpoint-files-retrieve outputs: - contextPath: Traps.FileRetrieve.EndpointID description: The ID of the endpoint. type: String - contextPath: Traps.FileRetrieve.OperationID description: The ID of the operation. type: String - contextPath: Traps.FileRetrieve.Type description: The type of operation. type: String - arguments: - description: The ID of the endpoint. name: endpoint_id required: true deprecated: true description: Performs a scan operation on the specified endpoint. name: traps-endpoint-scan outputs: - contextPath: Traps.Scan.EndpointID description: The ID of the endpoint. type: String - contextPath: Traps.Scan.OperationID description: The ID of the operation. type: String - contextPath: Traps.Scan.Type description: The type of operation. type: String - arguments: - description: The ID of the event to modify. name: event_id required: true - auto: PREDEFINED description: The new status for the event. name: status predefined: - new - investigating - closed - description: A comment for the event. name: comment deprecated: true description: Modifies the status and adds a comment to an existing event. name: traps-event-update - arguments: - description: A comma-separated list of IDs for events to modify. isArray: true name: event_ids required: true - auto: PREDEFINED description: The new status for the event. name: status predefined: - new - investigating - closed required: true deprecated: true description: Modifies the status of multiple events. name: traps-event-bulk-update-status - arguments: - description: The SHA256 hash to add to the block list. name: hash_id required: true deprecated: true description: Adds the specified file hash to the block list. name: traps-hash-blacklist outputs: - contextPath: Traps.File.BlacklistStatus description: The status of the file hash ("blacklisted" or "none"). type: String - contextPath: Traps.File.SHA256 description: The SHA256 hash of the file. type: String - arguments: - description: The SHA256 hash to remove from the block list. name: hash_id required: true deprecated: true description: Removes the specified file hash from the block list. name: traps-hash-blacklist-remove outputs: - contextPath: Traps.File.BlacklistStatus description: The status of the file hash ("blacklisted" or "none"). type: String - contextPath: Traps.File.SHA256 description: The SHA256 hash of the file. type: String - arguments: - description: A comma-separated list of SHA256 file hashes for which to return the block list status. isArray: true name: hash_ids required: true deprecated: true description: Returns the block list status of the specified file hashes. name: traps-hashes-blacklist-status outputs: - contextPath: Traps.File.BlacklistStatus description: The block list status of the file hash. Can be "blacklisted" or "none". type: String - contextPath: Traps.File.SHA256 description: The SHA256 hash of the file. type: String - arguments: - description: The ID of the event for which to create a quarantine entry.. name: event_id required: true deprecated: true description: Creates a quarantine entry for the specified event. name: traps-event-quarantine outputs: - contextPath: Traps.Quarantine.EventID description: The ID of the event. type: String - contextPath: Traps.Quarantine.OperationID description: The ID of the operation. type: String - contextPath: Traps.Quarantine.Type description: The type of operation. type: String - arguments: - description: The ID of the endpoint to isolate. name: endpoint_id required: true deprecated: true description: Isolates the specified endpoint. name: traps-endpoint-isolate outputs: - contextPath: Traps.Isolate.EndpointID description: The ID of the endpoint. type: String - contextPath: Traps.Isolate.OperationID description: The ID of the operation. type: String - contextPath: Traps.Isolate.Type description: The type of operation. type: String - arguments: - description: The ID of the operation for which to get the result of the quarantine operation. name: operation_id required: true deprecated: true description: Returns the result of the specified quarantine operation. name: traps-event-quarantine-result outputs: - contextPath: Traps.QuarantineResult.SHA256 description: The SHA256 hash of the file. type: String - contextPath: Traps.QuarantineResult.FilePath description: The file path on the endpoint. type: String - contextPath: Traps.QuarantineResult.OperationID description: The ID of the operation. type: String - contextPath: Traps.QuarantineResult.Status description: The status of the quarantine operation. type: String - arguments: - description: The ID of the operation. name: operation_id required: true deprecated: true description: Returns the status of the specified endpoint isolate operation. name: traps-endpoint-isolate-status outputs: - contextPath: Traps.IsolateResult.OperationID description: Operation ID. Use this to retrieve status / results. type: String - contextPath: Traps.IsolateResult.Status description: The status of the isolation operation. type: String - arguments: - description: The ID of the operation. name: operation_id required: true deprecated: true description: Returns the result of the endpoint file retrieve operation. name: traps-endpoint-files-retrieve-result - arguments: - description: The ID of the operation. name: operation_id required: true deprecated: true description: Returns the results of an endpoint scan operation. name: traps-endpoint-scan-result outputs: - contextPath: Traps.ScanResult.FileScanned description: The number of scanned files. type: Number - contextPath: Traps.ScanResult.FilesFailed description: The number of files that were not scanned. type: Number - contextPath: Traps.ScanResult.MalwareFound description: The number of detected malware. type: Number - contextPath: Traps.ScanResult.OperationID description: The ID of the operation. type: String - contextPath: Traps.ScanResult.Status description: The status of the scan. type: String dockerimage: demisto/auth-utils:1.0.0.76157 runonce: false script: '-' subtype: python3 type: python tests: - No test fromversion: 5.0.0 deprecated: true