commonfields: id: ProtectWise version: -1 name: ProtectWise display: ProtectWise category: Network Security provider: Verizon Communications description: Cloud based Security Network DVR. sectionorder: - Connect - Collect configuration: - display: Url name: url defaultvalue: https://api.protectwise.com/api/v1/ type: 0 required: true section: Connect - display: Email name: email defaultvalue: "" type: 0 hidden: true required: false section: Connect - display: Password name: password defaultvalue: "" type: 4 hidden: true required: false section: Connect - display: Email name: credentials_login type: 9 displaypassword: Password section: Connect required: false - display: API Token name: token type: 4 hidden: true required: false section: Connect - displaypassword: API Token name: credentials_api_token hiddenusername: true type: 9 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Only fetch events with this text in the name name: messageFilter defaultvalue: "" type: 0 required: false section: Collect - display: Filter by threat category name: threatCategory defaultvalue: "" type: 0 required: false section: Collect - display: Filter by killchain stage name: killChainStage defaultvalue: "" type: 0 required: false section: Collect - display: Filter by threat level (LOW, MEDIUM, or HIGH) name: threatLevel defaultvalue: "" type: 0 required: false section: Collect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect supportedModules: - agentix - xsiam - display: Incident type name: incidentType type: 13 required: false section: Collect supportedModules: - agentix - xsiam - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true supportedModules: - agentix - xsiam - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: "Maximum events to fetch per fetch" name: maxFetch defaultvalue: "50" type: 0 required: false section: Collect script: script: '' type: javascript commands: - name: sensors deprecated: true arguments: - name: sensorId default: true description: The ID of the individual sensor. If empty, will query all available sensors. description: Returns the specified, or all available sensors. - name: protectwise-show-sensors arguments: - name: sensorId default: true description: The ID of the individual sensor. If empty, will query all available sensors. outputs: - contextPath: Protectwise.Sensor.id description: The ID of the sensor. - contextPath: Protectwise.Sensor.friendly_name description: The name of the sensor. - contextPath: Protectwise.Sensor.ip_address description: The IP address of the sensor. - contextPath: Protectwise.Sensor.last_seen description: The time when the sensor was last seen. - contextPath: Protectwise.Sensor.customer_id description: The customer ID of the sensor. - contextPath: Protectwise.Sensor.enabled description: Whether the sensor is enabled. description: Returns all available sensors. - name: search deprecated: true arguments: - name: start required: true description: 'The timestamp of the start time of the event. For example, 1401451200000, or 2015-03-25T12:00:00.' - name: end required: true description: 'The timestamp of the end of the event. For example, 1401451500000, or 2015-03-25T12:00:00.' - name: eventType description: 'Filter by one or more event types. Can be: "MaliciousFlow", "KillChainEscalation", or "MaliciousConversation".' - name: killChainStage description: 'Filter by killchain stage. Can be: "Methodology", "Recon", "Delivery", "Exploit", "Beacon", "CnC", "Fortification", or Data_Theft".' - name: threatLevel description: 'Filter by the threat level. Can be: "NONE", "LOW", "MEDIUM", or "HIGH".' - name: threatCategory description: 'Filter by the threat category. Can be: "ExploitsAndAttacks", "DenialOfService", "Malware", "Scanning", "Botnets", "Phishing", "Suspicious", "MaliciousHost", "APT", "Misc", or "Unknown".' - name: observationStage description: 'Filter by the observation stage. Can be: "Realtime" or "Retrospective".' - name: ip description: Filter by events that are affected by a specific IP address. - name: minLimit description: The minimum number of results to return per page. - name: maxLimit description: The maximum number of results to return per page. - name: reverseOrder description: Whether to sort results by descending timestamp. If "true", results are returned in descending timestamp order. If "false", results are returned in ascending timestamp order. Default is "true". - name: nextPage description: An identifier to fetch the next page in the result set. description: Searches for events. Events are resources that describe a threat and contain a collection of observations. - name: protectwise-search-events arguments: - name: start required: true description: 'Timestamp of the start time of the event. For example, 1401451200000, or 2015-03-25T12:00:00.' - name: end required: true description: Timestamp of the end of the event. For example, 1401451500000, or 2015-03-25T12:00:00. - name: eventType description: 'Filters by one or more event types. Can be: "MaliciousFlow:, "KillChainEscalation", or "MaliciousConversation".' - name: killChainStage description: 'Filters by the killchain stage. Can be: "Methodology", "Recon", "Delivery", "Exploit", "Beacon", "CnC", "Fortification", or "Data_Theft".' - name: threatLevel description: 'Filters by Low, Medium, or High threats. Can be: "NONE", "LOW", "MEDIUM", or "HIGH".' - name: threatCategory description: 'Filters by threat category. Can be: "ExploitsAndAttacks", "DenialOfService", "Malware", "Scanning", "Botnets", "Phishing", "Suspicious", "MaliciousHost", "APT", "Misc", or "Unknown".' - name: observationStage description: Filters by Realtime or Retrospective. - name: ip description: Filters by events that are affected by a specific IP address. - name: minLimit description: Minimum number of results to return per page. - name: maxLimit description: Maximum number of results to return per page. - name: reverseOrder description: Return results sorted by descending timestamp (default = true). - name: nextPage description: An identifier which fetches the next page in the result set. outputs: - contextPath: Protectwise.Event.message description: Name of the event. - contextPath: Protectwise.Event.id description: Protectwise event ID. - contextPath: Protectwise.Event.type description: The type of the event. - contextPath: Protectwise.Event.sensorId description: The sensor ID of the event. - contextPath: Protectwise.Event.threatScore description: The threat score (0-100). - contextPath: Protectwise.Event.killChainStage description: The Kill Chain Stage of the event. - contextPath: Protectwise.Event.confidence description: The confidence level (0-100). - contextPath: Protectwise.Event.startedAt description: The time that Event started. - contextPath: Protectwise.Event.observedAt description: The time the event was observed. - contextPath: Protectwise.Event.endedAt description: The time the event ended. - contextPath: Protectwise.Event.observationCount description: The number of observations related to this event. - contextPath: Protectwise.Event.netflowCount description: The number of netflows related to this event. - contextPath: Protectwise.Event.observedStage description: The observed stage (Realtime or Retrospective). description: Searches for events. Events are resources that describe a threat and contains a collection of observations. Deprecated - use the protectwise-search-events command. - name: pw-event-get deprecated: true arguments: - name: id required: true default: true description: The ID of the event to return. description: Returns information about a single event and its associated observations. - name: protectwise-event-info arguments: - name: id required: true default: true description: The ID of the event. outputs: - contextPath: Protectwise.Event.message description: Name of the event. - contextPath: Protectwise.Event.id description: The ID of the event. - contextPath: Protectwise.Event.type description: The type of the event. - contextPath: Protectwise.Event.sensorId description: The sensor ID of the event. - contextPath: Protectwise.Event.threatScore description: The Threat score. From 0-100. - contextPath: Protectwise.Event.killChainStage description: Kill Chain Stage of the event. - contextPath: Protectwise.Event.confidence description: The Confidence level. From 0-100. - contextPath: Protectwise.Event.startedAt description: The time the event started. - contextPath: Protectwise.Event.observedAt description: The time the event was observed. - contextPath: Protectwise.Event.endedAt description: The time the event ended. - contextPath: Protectwise.Event.observationCount description: The number of observations related to this event. - contextPath: Protectwise.Event.netflowCount description: The number of netflows related to this event. - contextPath: Protectwise.Event.observedStage description: The observed stage (Realtime or Retrospective). - contextPath: Protectwise.Event.Netflows.key description: The Netflow key. - contextPath: Protectwise.Event.Netflows.srcIp description: The Netflow Source IP. - contextPath: Protectwise.Event.Netflows.dstIp description: The Netflow Dst IP. - contextPath: Protectwise.Event.Netflows.srcPort description: The Netflow source port. - contextPath: Protectwise.Event.Netflows.dstPort description: The Netflow DST Port. - contextPath: Protectwise.Event.Netflows.layer4Proto description: The Netflow Layer 4 Protocol. - contextPath: Protectwise.Event.Observations.id description: The observation ID. - contextPath: Protectwise.Event.Observations.killChainStage description: The Observation Killchain Stage. - contextPath: Protectwise.Event.Observations.source description: The Observation Source. - contextPath: Protectwise.Event.Observations.sensorId description: The Observation's Sensor ID. - contextPath: Protectwise.Event.Observations.threatScore description: The Observation threat score. - contextPath: Protectwise.Event.Observations.severity description: The Observation Severity. - contextPath: Protectwise.Event.Observations.confidence description: The observation confidence level (0-100). - contextPath: Protectwise.Event.Observations.occurredAt description: The time the observation occurred. - contextPath: Protectwise.Event.Observations.observedAt description: The time the observation observed. - contextPath: Protectwise.Event.Observations.endedAt description: The time the observation ended. - contextPath: Protectwise.Event.Observations.netflowId description: The ID of the related Netflow for this observation. - contextPath: Protectwise.Event.Observations.observedStage description: The observed stage of the observation. description: Searches for a single event in ProtectWise. Deprecated - use the protectwise-event-info command. - name: observation-search deprecated: true arguments: - name: sensorId required: true description: The sensor ID or a comma-separated list of sensor IDs. - name: start required: true description: 'The timestamp of the start time of the event. For example, 1401451200000, or 2015-03-25T12:00:00.' - name: end required: true description: 'The timestamp of the end of the event. For example, 1401451500000, or 2015-03-25T12:00:00.' - name: type description: 'Filter by observation type. Can be: "ids", "http", "iprep", "urlrep", "protocol" or "file".' - name: hasKillChain description: Search for observations in every kill chain stage (true false). - name: killChainStage description: Filter by kill chain stage (Methodology Recon Delivery Exploit Beacon CnC Fortification Data_Theft). - name: ip description: Filter observations by IP address in the src/dst fields. - name: threatLevel description: Filter by Low, Medium, or High threats (NONE LOW MEDIUM HIGH). - name: threatCategory description: Filter by threat category (ExploitsAndAttacks DenialOfService Malware Scanning Botnets Phishing Suspicious MaliciousHost APT Misc Unknown). - name: signatureId description: 'Filter by threat signature (find observations of the same type of threat) - Example: 69020504.' - name: minLimit description: Try to return at least this many results per page. - name: maxLimit description: Do not return more than this many results. - name: reverseOrder description: Return results sorted by descending timestamp (default = true). - name: nextPage description: An identifier to fetch the next page in the result set. description: Searches for observations in ProtectWise. - name: protectwise-search-observations arguments: - name: sensorId required: true description: The ID of the individual sensor or a comma-separated list of Sensor IDs. - name: start required: true description: 'Timestamp of the start time of the event. For example, 1401451200000, or 2015-03-25T12:00:00.' - name: end required: true description: 'Timestamp of the end of the event. For example, 1401451500000, or 2015-03-25T12:00:00.' - name: type description: 'Filter by observation type. Can be: "ids", "http", "iprep", "urlrep", "protocol", or "file".' - name: hasKillChain description: 'Searches for observations in every kill chain stage. Can be: "true" or "false".' - name: killChainStage description: 'Filter by killchain stage. Can be: "Methodology", "Recon", "Delivery", "Exploit", "Beacon", "CnC", "Fortification", or "Data_Theft".' - name: ip description: Filter observations by IP address in the src/dst fields. - name: threatLevel description: 'Filter by Low, Medium, or High threats. Can be: "NONE", "LOW", "MEDIUM", or "HIGH".' - name: threatCategory description: 'Filter by threat category. Can be: "ExploitsAndAttacks", "DenialOfService", "Malware", "Scanning", "Botnets", "Phishing", "Suspicious", "MaliciousHost", "APT", "Misc", or "Unknown".' - name: signatureId description: 'Filter by threat signature. Finds observations of the same type of threat). For example, 69020504.' - name: minLimit description: Minimum number of results per page. - name: maxLimit description: Maximum number of results per page. - name: reverseOrder description: Returns results sorted by descending timestamp. Default is true. - name: nextPage description: An identifier to fetch the next page in the result set. outputs: - contextPath: Protectwise.Observation.id description: The ID of the observation. - contextPath: Protectwise.Observation.killChainStage description: The Killchain Stage of the observation. - contextPath: Protectwise.Observation.source description: The source of the observation. - contextPath: Protectwise.Observation.sensorId description: The ID of the protectwise sensor that generated the observation. - contextPath: Protectwise.Observation.threatScore description: The threat score of the observation. - contextPath: Protectwise.Observation.severity description: The severity of the observation. - contextPath: Protectwise.Observation.confidence description: The confidence level of the observation. - contextPath: Protectwise.Observation.occurredAt description: The time the observation occurred. - contextPath: Protectwise.Observation.observedAt description: The time the observation was observed. - contextPath: Protectwise.Observation.endedAt description: The time the observation ended. - contextPath: Protectwise.Observation.netflowId description: The ID of the Netflow attached to this observation. - contextPath: Protectwise.Observation.observedStage description: The attack stage reflected by the observation. description: Searches for observations in ProtectWise. Deprecated - use the protectwise-search-observations command. - name: pw-observation-get deprecated: true arguments: - name: id required: true description: The ID of the observation. - name: sensorId required: true description: The ID of an individual sensor or a comma-separated list of sensor IDs. description: Searches for a single observation in ProtectWise. - name: protectwise-observation-info arguments: - name: id required: true description: The ID of the observation. - name: sensorId required: true description: The Sensor ID or a comma-separated list of Sensor IDs. outputs: - contextPath: Protectwise.Observation.id description: The ID of the observation. - contextPath: Protectwise.Observation.killChainStage description: The Killchain Stage of the observation. - contextPath: Protectwise.Observation.source description: Observation Source. - contextPath: Protectwise.Observation.sensorId description: ID of the Protectwise sensor that generated the observation. - contextPath: Protectwise.Observation.threatScore description: The threat Score of the observation. - contextPath: Protectwise.Observation.severity description: The severity of the observation. - contextPath: Protectwise.Observation.confidence description: The confidence level of the observation. - contextPath: Protectwise.Observation.occurredAt description: The time the observation occurred. - contextPath: Protectwise.Observation.observedAt description: The time the observation was Observed. - contextPath: Protectwise.Observation.endedAt description: The time the observation ended. - contextPath: Protectwise.Observation.netflowId description: The ID of the Netflow tied to this observation. - contextPath: Protectwise.Observation.observedStage description: The attack stage reflected by the observation. description: Lookup a single observation for ProtectWise. Deprecated - use the protectwise-event-pcap-download command. - name: event-pcap-download deprecated: true arguments: - name: eventId required: true default: true description: The event ID. - name: filename description: The filename for download. description: The Event PCAP file to download. - name: protectwise-event-pcap-download arguments: - name: eventId required: true default: true description: The ID of the event. - name: filename description: The filename for the download. description: Event Pcap Download. Deprecated - use the protectwise-event-pcap-info command. - name: event-pcap-info deprecated: true arguments: - name: eventId required: true default: true description: The ID of the event. description: Returns details of the ProtectWise Event PCAP files. - name: protectwise-event-pcap-info arguments: - name: eventId required: true default: true description: The event ID. outputs: - contextPath: Protectwise.Event.id description: The ID of the Event. - contextPath: Protectwise.Event.PCAPSize description: Estimated PCAP size in bytes. description: Get ProtectWise Event Pcap info. Deprecated - use the protectwise-observation-pcap-download command. - name: observation-pcap-download deprecated: true arguments: - name: id required: true default: true description: The ID of the observation. - name: sensorId required: true description: The ID of the sensor. - name: filename description: The filename for the download. description: Downloads the observation PCAP file. - name: protectwise-observation-pcap-download arguments: - name: id required: true default: true description: The ID of the observation. - name: sensorId required: true description: The ID of the sensor. - name: filename description: The filename for the download. description: Downloads the Observation PCAP file. Deprecated - use the protectwise-observation-pcap-info command. - name: observation-pcap-info deprecated: true arguments: - name: id required: true description: The ID of the observation. - name: sensorId required: true description: The ID of the sensor. description: Returns PCAP details of observations in Protectwise. - name: protectwise-observation-pcap-info arguments: - name: id required: true description: The ID of the observation. - name: sensorId required: true description: The ID of the Sensor. outputs: - contextPath: Protectwise.Observation.id description: The ID of the observation. - contextPath: Protectwise.Observation.sensorId description: The Sensor ID of the observation. - contextPath: Protectwise.Observation.PCAPSize description: Estimated PCAP size in bytes. description: Returns ProtectWise Observation PCAP file information. - name: get-token deprecated: true arguments: [] description: Returns the API token, which is used in the integration configuration. isfetch: true fromversion: 5.0.0 tests: - Protectwise-Test