category: Analytics & SIEM
provider: runZero
sectionorder:
- Connect
- Collect
commonfields:
  id: RunZero Event Collector
  version: -1
configuration:
- name: url
  defaultvalue: https://console.runzero.com/
  display: Server URL
  required: true
  type: 0
  section: Connect
- name: client_id
  defaultvalue: client_id
  display: Client ID
  required: true
  type: 0
  additionalinfo: The client ID as defined in RunZero.
  section: Connect
- name: client_secret
  displaypassword: Client secret
  required: true
  defaultvalue:
  type: 9
  hiddenusername: true
  additionalinfo: The client secret to access the service REST API.
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Max events per fetch
  additionalinfo: The maximum number of events to retrieve for each event type (up to 10000 events). For more information about event types, see the help section.
  defaultvalue: '1000'
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
description: This is the RunZero event collector integration for XSIAM.
display: RunZero Event Collector
name: RunZero Event Collector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: Maximum number of results to return.
      name: limit
    - description: "Filter by start time. \nExamples:\n  \"3 days ago\"\n  \"1 month\"\n  \"2019-10-10T12:22:00\"\n  \"2019-10-10\"."
      name: start_time
    description: Gets events from RunZero.
    name: runzero-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam