category: Data Enrichment & Threat Intelligence
provider: Reco AI
sectionorder:
- Connect
- Collect
commonfields:
  id: Reco
  version: -1
configuration:
- additionalinfo: The base URL of your Reco instance.
  display: Server URL (e.g. https://host.reco.ai/api/v1)
  name: url
  required: true
  type: 0
  section: Connect
- section: Connect
  additionalinfo: The API token (Bearer) used to authenticate with the Reco External API.
  display: JWT app token
  displaypassword: API Token
  name: api_token
  type: 4
  required: true
  hiddenusername: true
- additionalinfo: The option to skip TLS certificate verification when connecting to the Reco API.
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- additionalinfo: The option to route requests through the system proxy.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: The incident type to map Reco alerts to.
  display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: The option to enable automatic incident fetching.
  display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: The maximum number of incidents to fetch per run (up to 500).
  defaultvalue: '200'
  display: Max fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Incidents SaaS Source
  display: Source
  name: source
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Created At time before which incidents will be fetched
  display: Before
  name: before
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Created At time after which incidents will be fetched
  display: After
  name: after
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: 'The minimum severity threshold for fetched incidents. Accepts a single value: LOW, MEDIUM, HIGH, or CRITICAL (or numeric equivalents 10, 20, 30, 40). Alerts at or above this severity are fetched. For example, "MEDIUM" fetches medium, high, and critical severity alerts.'
  display: Minimum risk level (e.g. MEDIUM fetches medium and higher)
  name: risk_level
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: The amount of time to look back on the first fetch run (e.g. `7 days`, `12 hours`).
  defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Interval in minutes between two consecutive fetch incidents runs.
  defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
description: Reco is the leader in SaaS & AI Security, providing full visibility and control across your SaaS ecosystem and AI agents.
display: Reco
name: Reco
script:
  dockerimage: demisto/python3:3.12.13.10404775
  isfetch: true
  runonce: false
  script: "-"
  subtype: python3
  type: python
  commands:
  - arguments:
    - description: Values to add to the exclusion filter (split by ',').
      name: values_to_add
      required: true
      type: List
      isArray: true
    - description: key too add to the exclusion filter (e.g. "CASE_SENSITIVE_TERMS", "LOCATION_CASE_INSENSITIVE_TERMS", "OWNERS", "FILE_IDS", "LOCATIONS").
      name: key_to_add
      required: true
    description: Add exclusion filter to Reco Classifier.
    name: reco-add-exclusion-filter
  - arguments:
    - description: Comment to add to the alert.
      name: comment
      required: true
    - description: Alert ID to add the comment to.
      name: alert_id
      required: true
    description: Add a comment to an alert in Reco.
    name: reco-add-comment-to-alert
  - arguments:
    - description: Comment to add to the alert.
      name: comment
      required: true
    - description: Incident ID to add the comment to.
      name: incident_id
      required: true
    description: Add a comment to an alert in Reco.
    name: reco-update-incident-timeline
  - arguments:
    - description: entity id of the file to resolve.
      name: entity_id
      required: true
    - description: label name to resolve (e.g. "Accessible to All Org Users", "Accessible by General Public").
      name: label_name
      required: true
    description: Resolve an event in Reco Finding. Reco Findings contains aggregations of events. This command resolves the event in the Reco Finding.
    name: reco-resolve-visibility-event
  - arguments: []
    description: Get Risky Users from Reco.
    name: reco-get-risky-users
    outputs:
    - contextPath: Reco.RiskyUsers
      description: Risky Users.
    - contextPath: Reco.RiskyUsers.id
      description: The account ID.
      type: String
    - contextPath: Reco.RiskyUsers.name
      description: The account display name.
      type: String
    - contextPath: Reco.RiskyUsers.accountEmail
      description: The account email address.
      type: String
    - contextPath: Reco.RiskyUsers.permissions
      description: The account permissions in the SaaS application.
      type: String
    - contextPath: Reco.RiskyUsers.hasMfa
      description: The value that indicates whether the account has MFA enabled.
      type: Boolean
    - contextPath: Reco.RiskyUsers.openAlerts
      description: The number of open alerts for this account.
      type: Number
    - contextPath: Reco.RiskyUsers.isAdmin
      description: The value that indicates whether the account has admin privileges.
      type: Boolean
    - contextPath: Reco.RiskyUsers.isRiskyUser
      description: The value that indicates whether the account is flagged as risky.
      type: Boolean
    - contextPath: Reco.RiskyUsers.lastSeen
      description: The last activity timestamp for the account.
      type: Date
  - arguments:
    - description: Email address of the user to add to the risky users list in Reco.
      name: email_address
      required: true
    description: Tag a user as risky in Reco.
    name: reco-add-risky-user-label
  - arguments:
    - description: Email address of the user.
      name: email_address
      required: true
    - description: Return only sensitive assets owned by this user.
      name: only_sensitive
      type: Boolean
    description: Get all files user has access to from Reco.
    name: reco-get-assets-user-has-access-to
    outputs:
    - contextPath: Reco.Assets
      description: Assets user has access to.
  - arguments:
    - description: Email address of the user to tag as levaing org user.
      name: email_address
      required: true
    description: Tag a user as leaving org user in Reco.
    name: reco-add-leaving-org-user-label
  - arguments:
    - description: Asset name to search for.
      name: asset_name
      required: true
    - description: Return only sensitive assets owned by this user.
      name: regex_search
      type: Boolean
    description: Get all sensitive assets from Reco by name.
    name: reco-get-sensitive-assets-by-name
    outputs:
    - contextPath: Reco.SensitiveAssets.id
      description: The unique identifier of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.url
      description: The URL of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivityLevel
      description: The sensitivity level of the asset (numeric).
      type: Number
    - contextPath: Reco.SensitiveAssets.permissionVisibility
      description: The visibility/permission level of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.dataCategories
      description: The data categories detected in the asset.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.file_name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_url
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.currently_permitted_users
      description: List of currently permitted users.
      type: String
    - contextPath: Reco.SensitiveAssets.visibility
      description: Visibility of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivity_level
      description: The sensitivity level of the asset.
      type: Number
  - arguments:
    - description: Asset id to search for.
      name: asset_id
      required: true
    description: Get all sensitive assets from Reco by id.
    name: reco-get-sensitive-assets-by-id
    outputs:
    - contextPath: Reco.SensitiveAssets.id
      description: The unique identifier of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.url
      description: The URL of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivityLevel
      description: The sensitivity level of the asset (numeric).
      type: Number
    - contextPath: Reco.SensitiveAssets.permissionVisibility
      description: The visibility/permission level of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.dataCategories
      description: The data categories detected in the asset.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.file_name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_url
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.currently_permitted_users
      description: List of currently permitted users.
      type: String
    - contextPath: Reco.SensitiveAssets.visibility
      description: Visibility of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivity_level
      description: The sensitivity level of the asset.
      type: Number
  - arguments:
    - description: Entity Type (RM_LINK_TYPE_USER).
      name: entity
      required: true
    - description: Entity ID (user email).
      name: param
      type: Boolean
    description: Generate a magic link for reco UI (overview page).
    name: reco-get-link-to-user-overview-page
  - arguments:
    - description: Last interaction time in days.
      name: last_interaction_time_in_days
      required: true
    description: Get 3rd parties accessible to sensitive assets.
    name: reco-get-3rd-parties-accessible-to-data-list
    outputs:
    - contextPath: Reco.Domains.domain
      description: The domain of the 3rd party.
      type: String
    - contextPath: Reco.Domains.last_activity
      description: The last interaction time with the 3rd party.
      type: String
    - contextPath: Reco.Domains.files_num
      description: The number of files the 3rd party has access to.
      type: Number
    - contextPath: Reco.Domains.users_with_access_num
      description: The number of users the 3rd party has access to.
      type: Number
  - arguments: []
    description: Get all sensitive assets with public link from Reco.
    name: reco-get-sensitive-assets-with-public-link
    outputs:
    - contextPath: Reco.Assets.asset_id
      description: The asset id.
      type: String
    - contextPath: Reco.Assets.asset
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.Assets.data_category
      description: The data category of the asset.
      type: String
    - contextPath: Reco.Assets.data_categories
      description: The data categories of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.Assets.last_access_date
      description: The last access date of the asset.
      type: String
  - arguments:
    - description: Last interaction time in days.
      name: last_interaction_time_in_days
      required: true
    - description: Domain to search.
      name: domain
      required: true
    description: Get files shared with 3rd parties.
    name: reco-get-files-shared-with-3rd-parties
    outputs:
    - contextPath: Reco.Assets.asset_id
      description: The asset id of the file.
      type: String
    - contextPath: Reco.Assets.location
      description: The location of the file.
      type: String
    - contextPath: Reco.Assets.file_owner
      description: The owner of the file.
      type: String
    - contextPath: Reco.Assets.users
      description: Users the file is shared with.
      type: String
    - contextPath: Reco.Assets.asset
      description: The asset metadata.
      type: Unknown
    - contextPath: Reco.Assets.data_category
      description: The data category of the assets the 3rd party has access to.
      type: String
    - contextPath: Reco.Assets.last_access_date
      description: The last access date of the asset.
      type: String
    - contextPath: Reco.Assets.domain
      description: The domain of the 3rd party.
      type: String
  - arguments:
    - description: alert id to get.
      name: alert_id
      required: true
    - description: status to set the alert to.
      name: status
      required: true
      auto: PREDEFINED
      predefined:
      - ALERT_STATUS_NEW
      - ALERT_STATUS_IN_PROGRESS
      - ALERT_STATUS_CLOSED
      - ALERT_STATUS_PREVIEW
      - ALERT_STATUS_TO_REVIEW
      - ALERT_STATUS_PASSED
      - ALERT_STATUS_RISK_ACCEPTED
      - ALERT_STATUS_RISK_MITIGATED
      - ALERT_STATUS_NA
      - ALERT_STATUS_NA_NEW
      - ALERT_STATUS_NA_NO_AD
      - ALERT_STATUS_NOT_APPLICABLE
    description: update alert status in Reco.
    name: reco-change-alert-status
  - arguments:
    - description: user email address.
      name: email_address
      required: true
    outputs:
    - contextPath: Reco.User.id
      description: The identity ID.
      type: String
    - contextPath: Reco.User.email
      description: The primary email of the identity.
      type: String
    - contextPath: Reco.User.name
      description: The full name of the identity.
      type: String
    - contextPath: Reco.User.departments
      description: The departments the identity belongs to.
      type: String
    - contextPath: Reco.User.jobTitles
      description: The job titles of the identity.
      type: String
    - contextPath: Reco.User.isFormer
      description: The value that indicates whether the identity is a former employee.
      type: Boolean
    - contextPath: Reco.User.isInternal
      description: The value that indicates whether the identity is an internal employee.
      type: Boolean
    - contextPath: Reco.User.openAlerts
      description: The number of open alerts for this identity.
      type: Number
    - contextPath: Reco.User.lastSeen
      description: The last activity timestamp for the identity.
      type: Date
    - contextPath: Reco.User.email_account
      description: The email of the user.
      type: String
    - contextPath: Reco.User.full_name
      description: The user full name.
      type: String
    - contextPath: Reco.User.job_titles
      description: Job Title.
      type: String
    - contextPath: Reco.User.category
      description: Category.
      type: String
    - contextPath: Reco.User.groups
      description: The groups user is member of.
      type: String
    - contextPath: Reco.User.labels
      description: User Labels.
      type: Unknown
    description: Get user context by email address from Reco.
    name: reco-get-user-context-by-email-address
  - arguments:
    - description: user email address.
      name: email_address
      required: true
    outputs:
    - contextPath: Reco.Assets.asset_id
      description: The asset id.
      type: String
    - contextPath: Reco.Assets.asset
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.Assets.data_category
      description: The data category of the asset.
      type: String
    - contextPath: Reco.Assets.data_categories
      description: The data categories of the asset.
      type: String
    - contextPath: Reco.Assets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.Assets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.Assets.last_access_date
      description: The last access date of the asset.
      type: String
    - contextPath: Reco.Assets.email_account
      description: Email account of the user.
      type: String
    - contextPath: Reco.Assets.file_owner
      description: The owner of the asset.
      type: String
    description: Get files user has access to from Reco.
    name: reco-get-files-exposed-to-email-address
  - arguments:
    - description: user email address.
      name: email_address
      required: true
    outputs:
    - contextPath: Reco.Assets.asset_id
      description: The asset id.
      type: String
    - contextPath: Reco.Assets.asset
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.Assets.data_category
      description: The data category of the asset.
      type: String
    - contextPath: Reco.Assets.data_categories
      description: The data categories of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.Assets.last_access_date
      description: The last access date of the asset.
      type: String
    - contextPath: Reco.Assets.file_owner
      description: The owner of the asset.
      type: String
    description: Get files user has access to from Reco.
    name: reco-get-assets-shared-externally
  - arguments: []
    description: Get Private emails with access.
    name: reco-get-private-email-list-with-access
    outputs:
    - contextPath: Reco.privateEmails.email_account
      description: Private email account.
      type: String
    - contextPath: Reco.privateEmails.primary_email
      description: Primary email account.
      type: String
    - contextPath: Reco.privateEmails.files_num
      description: Number of files the private email account has access to.
      type: Number
    - contextPath: Reco.privateEmails.user_category
      description: User category.
      type: String
  - arguments:
    - description: Asset id to search for.
      name: asset_id
      required: true
    description: Get all assets from Reco by id.
    name: reco-get-assets-by-id
    outputs:
    - contextPath: Reco.SensitiveAssets.id
      description: The unique identifier of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.url
      description: The URL of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivityLevel
      description: The sensitivity level of the asset (numeric).
      type: Number
    - contextPath: Reco.SensitiveAssets.permissionVisibility
      description: The visibility/permission level of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.location
      description: The path of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.dataCategories
      description: The data categories detected in the asset.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.file_name
      description: The name of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_owner
      description: The owner of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.file_url
      description: Json string of the asset's url and the name.
      type: Unknown
    - contextPath: Reco.SensitiveAssets.currently_permitted_users
      description: List of currently permitted users.
      type: String
    - contextPath: Reco.SensitiveAssets.visibility
      description: Visibility of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.source
      description: SaaS tool source of the asset.
      type: String
    - contextPath: Reco.SensitiveAssets.sensitivity_level
      description: The sensitivity level of the asset.
      type: Number
  - arguments:
    - description: Alert ID.
      name: alert_id
      required: true
    description: Get alert ai summary from Reco.
    name: reco-get-alert-ai-summary
    outputs:
    - contextPath: Reco.AlertSummary.markdown
      description: The markdown of the alert summary.
      type: String
  - arguments:
    - description: Before date filter (YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ format).
      name: before
      required: false
    - description: After date filter (YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ format).
      name: after
      required: false
    - description: Page size for pagination (default 1000). The command fetches all available apps across all pages.
      name: limit
      required: false
      defaultValue: '1000'
    description: Get app discovery data from Reco. Fetches all available apps using pagination.
    name: reco-get-apps
    outputs:
    - contextPath: Reco.Apps.id
      description: The unique identifier of the application.
      type: String
    - contextPath: Reco.Apps.name
      description: The name of the application.
      type: String
    - contextPath: Reco.Apps.category
      description: The category of the application.
      type: String
    - contextPath: Reco.Apps.usersCount
      description: The number of users with access to the application.
      type: Number
    - contextPath: Reco.Apps.authorization
      description: The authorization/sanction status of the application.
      type: String
    - contextPath: Reco.Apps.authType
      description: The authentication type used by the application.
      type: String
    - contextPath: Reco.Apps.isUsingAi
      description: The value that indicates whether the application uses AI.
      type: Boolean
    - contextPath: Reco.Apps.isShadowApp
      description: The value that indicates whether the application is a shadow/unmanaged app.
      type: Boolean
    - contextPath: Reco.Apps.vendorGrade
      description: The vendor security grade of the application.
      type: String
    - contextPath: Reco.Apps.aiCapability
      description: The AI capability description for the application.
      type: String
    - contextPath: Reco.Apps.lastSeen
      description: The last activity timestamp for the application.
      type: Date
    - contextPath: Reco.Apps.app_name
      description: The name of the application.
      type: String
    - contextPath: Reco.Apps.app_id
      description: The unique identifier of the application.
      type: String
    - contextPath: Reco.Apps.risk_score
      description: The risk score of the application.
      type: Number
    - contextPath: Reco.Apps.users_count
      description: The number of users with access to the application.
      type: Number
    - contextPath: Reco.Apps.data_access
      description: The data access level of the application.
      type: String
    - contextPath: Reco.Apps.updated_at
      description: The last update timestamp of the application.
      type: Date
    - contextPath: Reco.Apps.created_at
      description: The creation timestamp of the application.
      type: Date
    - contextPath: Reco.Apps.status
      description: The status of the application.
      type: String
  - arguments:
    - description: Application ID to update authorization status for.
      name: app_id
      required: true
    - description: Authorization status to set for the application.
      name: authorization_status
      required: true
      auto: PREDEFINED
      predefined:
      - AUTH_STATUS_UNSPECIFIED
      - AUTH_STATUS_TO_REVIEW
      - AUTH_STATUS_SANCTIONED
      - AUTH_STATUS_UNSANCTIONED
      - AUTH_STATUS_ACCEPTED_RISK
      - AUTH_STATUS_EVALUATING
      - AUTH_STATUS_UNDER_INVESTIGATION
      - AUTH_STATUS_INVESTIGATED
      - AUTH_STATUS_CLOUD_INVENTORY
      - AUTH_STATUS_SYSTEM_SANCTIONED
    description: Set authorization status for an application in Reco.
    name: reco-set-app-authorization-status
    outputs:
    - contextPath: Reco.AppAuthorization.app_id
      description: The application ID that was updated.
      type: String
    - contextPath: Reco.AppAuthorization.authorization_status
      description: The authorization status that was set.
      type: String
    - contextPath: Reco.AppAuthorization.updated
      description: The value that indicates whether the update was successful.
      type: Boolean
    - contextPath: Reco.AppAuthorization.rows_affected
      description: Number of rows affected by the update operation.
      type: Number
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "actor.email eq \"user@example.com\" and eventTime gt \"2024-01-01T00:00:00Z\"").'
      name: filters
      required: false
    - description: The maximum number of events to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists SaaS events from Reco using the external API.
    name: reco-list-events
    outputs:
    - contextPath: Reco.Events.id
      description: The event ID.
      type: String
    - contextPath: Reco.Events.eventType
      description: The event type code.
      type: String
    - contextPath: Reco.Events.formattedEventType
      description: The human-readable event type.
      type: String
    - contextPath: Reco.Events.application
      description: The SaaS application the event belongs to.
      type: String
    - contextPath: Reco.Events.actorEmail
      description: The email of the actor who triggered the event.
      type: String
    - contextPath: Reco.Events.actorName
      description: The name of the actor who triggered the event.
      type: String
    - contextPath: Reco.Events.eventTime
      description: The timestamp of the event.
      type: Date
    - contextPath: Reco.Events.outcomeString
      description: The outcome description of the event.
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "severity eq \"HIGH\"").'
      name: filters
      required: false
    - description: The maximum number of posture issues to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists posture issues from Reco using the external API.
    name: reco-list-posture-issues
    outputs:
    - contextPath: Reco.PostureIssues.id
      description: The posture issue ID.
      type: String
    - contextPath: Reco.PostureIssues.name
      description: The posture issue name.
      type: String
    - contextPath: Reco.PostureIssues.severity
      description: The severity of the posture issue.
      type: String
    - contextPath: Reco.PostureIssues.checkStatus
      description: The current check status of the posture issue.
      type: String
    - contextPath: Reco.PostureIssues.scorePercentage
      description: The compliance score percentage for this issue.
      type: Number
    - contextPath: Reco.PostureIssues.checkedInstance
      description: The SaaS instance this issue was checked against.
      type: Unknown
    - contextPath: Reco.PostureIssues.url
      description: The link to the posture issue detail in the Reco UI.
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "isRiskyUser eq true" or "accountEmail co \"@example.com\"").'
      name: filters
      required: false
    - description: The maximum number of accounts to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists accounts (SaaS user accounts) from Reco using the external API.
    name: reco-list-accounts
    outputs:
    - contextPath: Reco.Accounts.id
      description: The account ID.
      type: String
    - contextPath: Reco.Accounts.name
      description: The account display name.
      type: String
    - contextPath: Reco.Accounts.accountEmail
      description: The account email address.
      type: String
    - contextPath: Reco.Accounts.permissions
      description: The account permissions in the SaaS application.
      type: String
    - contextPath: Reco.Accounts.hasMfa
      description: The value that indicates whether the account has MFA enabled.
      type: Boolean
    - contextPath: Reco.Accounts.openAlerts
      description: The number of open alerts for this account.
      type: Number
    - contextPath: Reco.Accounts.isAdmin
      description: The value that indicates whether the account has admin privileges.
      type: Boolean
    - contextPath: Reco.Accounts.isRiskyUser
      description: The value that indicates whether the account is flagged as risky.
      type: Boolean
    - contextPath: Reco.Accounts.lastSeen
      description: The last activity timestamp for the account.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "isUnmanaged eq true" or "devicePlatform eq \"Windows\"").'
      name: filters
      required: false
    - description: The maximum number of devices to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists devices from Reco using the external API.
    name: reco-list-devices
    outputs:
    - contextPath: Reco.Devices.id
      description: The device ID.
      type: String
    - contextPath: Reco.Devices.name
      description: The device name.
      type: String
    - contextPath: Reco.Devices.devicePlatform
      description: The device platform (Windows, macOS, iOS, Android, etc.).
      type: String
    - contextPath: Reco.Devices.os
      description: The operating system of the device.
      type: String
    - contextPath: Reco.Devices.osVersion
      description: The operating system version.
      type: String
    - contextPath: Reco.Devices.isUnmanaged
      description: The value that indicates whether the device is unmanaged (not enrolled in MDM).
      type: Boolean
    - contextPath: Reco.Devices.hasNonCompliant
      description: The value that indicates whether the device has non-compliant policies.
      type: Boolean
    - contextPath: Reco.Devices.lastSeen
      description: The last activity timestamp for the device.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "authorization eq \"AUTH_STATUS_UNSANCTIONED\"").'
      name: filters
      required: false
    - description: The maximum number of AI agents to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists AI agents detected by Reco using the external API.
    name: reco-list-ai-agents
    outputs:
    - contextPath: Reco.AiAgents.id
      description: The AI agent ID.
      type: String
    - contextPath: Reco.AiAgents.name
      description: The AI agent name.
      type: String
    - contextPath: Reco.AiAgents.vendor
      description: The vendor of the AI agent.
      type: String
    - contextPath: Reco.AiAgents.type
      description: The type of AI agent.
      type: String
    - contextPath: Reco.AiAgents.authorization
      description: The authorization/sanction status of the AI agent.
      type: String
    - contextPath: Reco.AiAgents.agentStatus
      description: The current status of the AI agent.
      type: String
    - contextPath: Reco.AiAgents.risk
      description: The risk level of the AI agent.
      type: String
    - contextPath: Reco.AiAgents.lastUsage
      description: The last usage timestamp for the AI agent.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "name co \"Engineering\"").'
      name: filters
      required: false
    - description: The maximum number of groups to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists SaaS groups from Reco using the external API.
    name: reco-list-groups
    outputs:
    - contextPath: Reco.Groups.id
      description: The group ID.
      type: String
    - contextPath: Reco.Groups.name
      description: The group name.
      type: String
    - contextPath: Reco.Groups.email
      description: The group email address.
      type: String
    - contextPath: Reco.Groups.membersCount
      description: The number of members in the group.
      type: Number
    - contextPath: Reco.Groups.appsCount
      description: The number of apps the group has access to.
      type: Number
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "authorization eq \"AUTH_STATUS_UNSANCTIONED\" or permissionRisk eq \"30\"").'
      name: filters
      required: false
    - description: The maximum number of SaaS-to-SaaS grants to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists SaaS-to-SaaS OAuth grants and integrations from Reco using the external API.
    name: reco-list-saas-to-saas
    outputs:
    - contextPath: Reco.SaasToSaas.id
      description: The SaaS-to-SaaS grant ID.
      type: String
    - contextPath: Reco.SaasToSaas.plugin
      description: The plugin or app name receiving the grant.
      type: String
    - contextPath: Reco.SaasToSaas.authorization
      description: The authorization status of the grant.
      type: String
    - contextPath: Reco.SaasToSaas.permissionRisk
      description: The permission risk level (10=LOW, 20=MEDIUM, 30=HIGH).
      type: String
    - contextPath: Reco.SaasToSaas.accounts
      description: The number of accounts with this grant.
      type: Number
    - contextPath: Reco.SaasToSaas.aiCapability
      description: The AI capability of the third-party app.
      type: String
    - contextPath: Reco.SaasToSaas.lastSeen
      description: The last activity timestamp for this grant.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "country eq \"CN\" or hasVpn eq true").'
      name: filters
      required: false
    - description: The maximum number of IP addresses to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists observed IP addresses from Reco using the external API.
    name: reco-list-ip-addresses
    outputs:
    - contextPath: Reco.IpAddresses.ipAddress
      description: The IP address or CIDR range.
      type: String
    - contextPath: Reco.IpAddresses.country
      description: The country of the IP address.
      type: String
    - contextPath: Reco.IpAddresses.asnName
      description: The ASN name of the IP address.
      type: String
    - contextPath: Reco.IpAddresses.eventsCount
      description: The number of events from this IP.
      type: Number
    - contextPath: Reco.IpAddresses.usersCount
      description: The number of users seen from this IP.
      type: Number
    - contextPath: Reco.IpAddresses.hasVpn
      description: The value that indicates whether the IP is associated with a VPN.
      type: Boolean
    - contextPath: Reco.IpAddresses.hasProxy
      description: The value that indicates whether the IP is associated with a proxy.
      type: Boolean
    - contextPath: Reco.IpAddresses.lastEventTime
      description: The last event timestamp from this IP.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "name eq \"Finance\"").'
      name: filters
      required: false
    - description: The maximum number of business units to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists external business units from Reco using the external API.
    name: reco-list-business-units
    outputs:
    - contextPath: Reco.BusinessUnits.id
      description: The business unit ID.
      type: String
    - contextPath: Reco.BusinessUnits.name
      description: The business unit name.
      type: String
    - contextPath: Reco.BusinessUnits.manager
      description: The manager of the business unit.
      type: String
    - contextPath: Reco.BusinessUnits.createdAt
      description: The creation timestamp of the business unit.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "userEmail eq \"admin@example.com\" and action eq \"DELETE\"").'
      name: filters
      required: false
    - description: The maximum number of audit log entries to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists Reco platform audit logs using the external API.
    name: reco-list-audit-logs
    outputs:
    - contextPath: Reco.AuditLogs.id
      description: The audit log entry ID.
      type: String
    - contextPath: Reco.AuditLogs.userEmail
      description: The email of the user who performed the action.
      type: String
    - contextPath: Reco.AuditLogs.module
      description: The module where the action was performed.
      type: String
    - contextPath: Reco.AuditLogs.action
      description: The action performed.
      type: String
    - contextPath: Reco.AuditLogs.objectName
      description: The name of the object affected.
      type: String
    - contextPath: Reco.AuditLogs.timestamp
      description: The timestamp of the audit log entry.
      type: Date
    - contextPath: Reco.AuditLogs.remoteAddr
      description: The remote IP address of the actor.
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "severity eq \"HIGH\" and apps co \"Google\"").'
      name: filters
      required: false
    - description: The maximum number of posture check definitions to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists posture check definitions from Reco using the external API.
    name: reco-list-posture-checks
    outputs:
    - contextPath: Reco.PostureChecks.id
      description: The posture check ID.
      type: String
    - contextPath: Reco.PostureChecks.name
      description: The posture check name.
      type: String
    - contextPath: Reco.PostureChecks.severity
      description: The severity of the posture check.
      type: String
    - contextPath: Reco.PostureChecks.policyType
      description: The policy type of the posture check.
      type: String
    - contextPath: Reco.PostureChecks.apps
      description: The applications this posture check applies to.
      type: Unknown
    - contextPath: Reco.PostureChecks.type
      description: The type of posture check (built-in or custom).
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "severity eq \"HIGH\" and status eq \"ON\"").'
      name: filters
      required: false
    - description: The maximum number of policies to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists threat detection policies from Reco using the external API.
    name: reco-list-threat-detection-policies
    outputs:
    - contextPath: Reco.ThreatDetectionPolicies.id
      description: The policy ID.
      type: String
    - contextPath: Reco.ThreatDetectionPolicies.name
      description: The policy name.
      type: String
    - contextPath: Reco.ThreatDetectionPolicies.severity
      description: The severity of the policy.
      type: String
    - contextPath: Reco.ThreatDetectionPolicies.status
      description: The status of the policy (ON, OFF, or PREVIEW).
      type: String
    - contextPath: Reco.ThreatDetectionPolicies.apps
      description: The applications monitored by the policy.
      type: Unknown
    - contextPath: Reco.ThreatDetectionPolicies.openAlerts
      description: The number of open alerts triggered by this policy.
      type: Number
    - contextPath: Reco.ThreatDetectionPolicies.type
      description: The type of policy (built-in or custom).
      type: String
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "policyName co \"MFA\"").'
      name: filters
      required: false
    - description: The maximum number of exclusions to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists alert suppression exclusion rules from Reco using the external API.
    name: reco-list-exclusions
    outputs:
    - contextPath: Reco.Exclusions.id
      description: The exclusion rule ID.
      type: String
    - contextPath: Reco.Exclusions.name
      description: The exclusion rule name.
      type: String
    - contextPath: Reco.Exclusions.policyName
      description: The name of the policy this exclusion applies to.
      type: String
    - contextPath: Reco.Exclusions.apps
      description: The applications this exclusion applies to.
      type: Unknown
    - contextPath: Reco.Exclusions.createdBy
      description: The user who created the exclusion.
      type: String
    - contextPath: Reco.Exclusions.createdAt
      description: The creation timestamp of the exclusion.
      type: Date
  - arguments:
    - description: 'The SCIM v2 filter expression (e.g. "isUsingAi eq true").'
      name: filters
      required: false
    - description: The maximum number of app instances to return.
      name: limit
      required: false
      defaultValue: '1000'
    description: Lists integrated app instances (app portfolio) from Reco using the external API. Only returns instances with an active integration status.
    name: reco-list-app-instances
    outputs:
    - contextPath: Reco.AppInstances.id
      description: The app instance ID.
      type: String
    - contextPath: Reco.AppInstances.name
      description: The app instance name.
      type: String
    - contextPath: Reco.AppInstances.instanceType
      description: The type of the app instance.
      type: String
    - contextPath: Reco.AppInstances.accountsCount
      description: The number of accounts in this app instance.
      type: Number
    - contextPath: Reco.AppInstances.isUsingAi
      description: The value that indicates whether this app instance uses AI features.
      type: Boolean
    - contextPath: Reco.AppInstances.saasToSaasCount
      description: The number of SaaS-to-SaaS grants for this instance.
      type: Number
    - contextPath: Reco.AppInstances.filesCount
      description: The number of files tracked in this instance.
      type: Number
tests:
- No tests
fromversion: 6.5.0