category: Network Security
sectionorder:
- Connect
- Collect
provider: Razor Group
commonfields:
  id: Perch
  version: -1
configuration:
- defaultvalue: https://api.perch.rocks/
  display: Server URL (e.g., https://api.perch.rocks/)
  name: url
  required: true
  type: 0
  section: Connect
- display: API Token
  name: api-key
  type: 4
  hidden: true
  required: false
  section: Connect
- name: api-key_creds
  type: 9
  displaypassword: API Token
  hiddenusername: true
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Previous days to fetch
  name: fetch_time
  type: 0
  defaultvalue: '7'
  required: false
  section: Collect
- display: Credentials
  name: credentials
  type: 9
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- additionalinfo: 'The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: an incident whose status was changed to a filtered status after its creation time will not be fetched.'
  display: Incident Soc Statuses to Fetch
  name: soc_status
  options:
  - Not Reviewed
  - Investigating
  - On hold
  - False Positive
  - Escalated
  type: 16
  required: false
  section: Collect
description: Perch is a co-managed threat detection and response platform.
display: Perch
name: Perch
script:
  commands:
  - arguments:
    - description: Page of results to return.
      name: page
    - description: Number of results to return per page.
      name: page_size
    - auto: PREDEFINED
      description: Whether the alert is closed.
      name: closed
      predefined:
      - 'true'
      - 'false'
    - description: Time that the alert was closed.
      name: closed_at
    - description: Community ID that generated the alert.
      name: community_id
    - description: Time that the alert was created.
      name: created_at
    - description: Destination IP address.
      name: dest_ip
    - description: Destination port.
      name: dest_port
    - description: Full URL of the alert.
      name: full_url
    - description: ID of the alert.
      name: id
    - description: ID of the indicator.
      name: indicator_id
    - auto: PREDEFINED
      description: Whether the indicator is loaded.
      name: indicator_loaded
      predefined:
      - 'true'
      - 'false'
    - description: Observable ID.
      name: observable_id
    - description: Protocol effected by the alert.
      name: protocol
    - description: ID of the sensor that generated the alert.
      name: sensor_id
    - description: Name of the sensor that generated the alert.
      name: sensor_name
    - description: Status in the SOC.
      name: soc_status
    - description: Source IP address.
      name: src_ip
    - description: Source port.
      name: src_port
    - description: Status of the alert.
      name: status
    - description: Time that the status was last updated.
      name: status_updated_at
    - description: ID of the team that generated the alert.
      name: team_id
    - description: Title of the alert.
      name: title
    - description: Timestamp of the alert.
      name: ts
    - description: Order of the returned alerts.
      name: ordering
    description: Searches for alerts in Perch.
    name: perch-search-alerts
    outputs:
    - contextPath: Perch.Alert.DestPort
      description: Destination port of the alert.
      type: Number
    - contextPath: Perch.Alert.SrcPort
      description: Source port of the alert.
      type: Number
    - contextPath: Perch.Alert.DestIP
      description: Destination IP of the alert.
      type: Number
    - contextPath: Perch.Alert.IndicatorID
      description: Indicator ID of the alert.
      type: Number
    - contextPath: Perch.Alert.SrcIP
      description: IP address of the source.
      type: String
    - contextPath: Perch.Alert.SrcGeo.Country
      description: Country of the threat.
      type: String
    - contextPath: Perch.Alert.SrcGeo.Latitude
      description: Latitude of the detected threat.
      type: Number
    - contextPath: Perch.Alert.SrcGeo.Longitude
      description: Longitude of the detected threat.
      type: Number
    - contextPath: Perch.Alert.SensorID
      description: ID of the sensor that reported the threat.
      type: Number
    - contextPath: Perch.Alert.Title
      description: Title of the alert.
      type: String
    - contextPath: Perch.Alert.Protocol
      description: Protocol on which the alert was detected.
      type: String
    - contextPath: Perch.Alert.ID
      description: ID of the alert.
      type: Number
    - contextPath: Perch.Alert.ObservableID
      description: ID of the observable event.
      type: Number
    - contextPath: Perch.Alert.TS
      description: Timestamp of the alert.
      type: Date
  - arguments:
    - description: ID of the community.
      name: id
      required: true
    description: Gets community information by ID.
    name: perch-get-community
    outputs:
    - contextPath: Perch.Community.Allsectors
      description: Indicates if the community covers all sectors.
      type: Boolean
    - contextPath: Perch.Community.Credentialreq
      description: Credentials required to interact with the community.
      type: Number
    - contextPath: Perch.Community.Desc
      description: Description of the community.
      type: String
    - contextPath: Perch.Community.Id
      description: ID of the community.
      type: Number
    - contextPath: Perch.Community.Name
      description: Name of the community.
      type: String
    - contextPath: Perch.Community.Poweredby
      description: Organization providing the feed.
      type: String
    - contextPath: Perch.Community.Selectablefeeds
      description: Whether the feeds are selectable.
      type: Boolean
  - description: Lists all communities.
    name: perch-list-communities
    outputs:
    - contextPath: Perch.Community.Allsectors
      description: Indicates if the community covers all sectors.
      type: Boolean
    - contextPath: Perch.Community.Credentialreq
      description: Credentials required to interact with the community.
      type: Number
    - contextPath: Perch.Community.Desc
      description: Description of the community.
      type: String
    - contextPath: Perch.Community.Id
      description: ID of the community.
      type: Number
    - contextPath: Perch.Community.Name
      description: Name of the community.
      type: String
    - contextPath: Perch.Community.Poweredby
      description: Organization providing the feed.
      type: String
    - contextPath: Perch.Community.Selectablefeeds
      description: Whether the feeds are selectable.
      type: Boolean
  - arguments:
    - description: Communities to report the indicator to.
      name: communities
      required: true
    - auto: PREDEFINED
      description: Confidence of the findings.
      name: confidence
      predefined:
      - LOW
      - MEDIUM
      - HIGH
      required: true
    - auto: PREDEFINED
      description: Type of indicator.
      name: type
      predefined:
      - IP
      - Domain
      - URL
      - REGEX
      - File Hash
      required: true
    - description: The value of the indicator.
      name: value
      required: true
    - description: The title of the indicator.
      name: title
      required: true
    - description: Description of the indicator.
      name: description
      required: true
    - description: TLP of the Indicator.
      name: tlp
      required: true
    - description: Operator of the indicator.
      name: operator
    - description: When the indicator was first sighted.
      name: first_sighting
    - description: Sends a email with the summary of the indicator.
      name: email_summary
    description: Creates an indicator in Perch.
    name: perch-create-indicator
    outputs:
    - contextPath: Perch.Indicator.Confidence
      description: Confidence of the indicator.
      type: Unknown
    - contextPath: Perch.Indicator.UpdatedAt
      description: Date and time that the indicator was last updated.
      type: Date
    - contextPath: Perch.Indicator.TLP
      description: TLP of the Indicator.
      type: String
    - contextPath: Perch.Indicator.Title
      description: Title of the indicator.
      type: String
    - contextPath: Perch.Indicator.ID
      description: ID of the indicator.
      type: Number
    - contextPath: Perch.Indicator.CreatedAt
      description: Date that the indicator was created.
      type: Date
    - contextPath: Perch.Indicator.Team
      description: ID of the team.
      type: Number
    - contextPath: Perch.Indicator.PerchID
      description: The Perch ID for the incident.
      type: String
    - contextPath: Perch.Indicator.CreatedBy
      description: ID of user that created the incident.
      type: Number
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Perch-Test
fromversion: 5.0.0