category: Analytics & SIEM
provider: SOCRadar
commonfields:
  id: SOCRadarIncidents
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: The API Key to use for connection to SOCRadar
  displaypassword: API Key
  name: apikey
  required: true
  type: 9
  hiddenusername: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- defaultvalue: 3 days
  display: First Fetch Time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: Company ID in SOCRadar to fetch incidents.
  display: Company ID
  name: socradar_company_id
  required: true
  type: 0
  section: Connect
- additionalinfo: Select severity level(s) of incidents to fetch. Leave blank to fetch all.
  display: Severity Level
  name: severity
  options:
  - Info
  - Low
  - Medium
  - High
  - Critical
  type: 16
  section: Collect
  required: false
- additionalinfo: Maximum number of incidents to fetch in each integration execution interval.
  defaultvalue: '20'
  display: Maximum number of incidents to fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: Fetch Incidents by resolution status (All, Resolved, Not Resolved)
  defaultvalue: All
  display: Resolution Status
  name: resolution_status
  options:
  - All
  - Resolved
  - Not Resolved
  type: 15
  section: Collect
  required: false
- additionalinfo: Fetch Incidents by false positive status (All, FP, Not FP)
  defaultvalue: All
  display: FP Status
  name: fp_status
  options:
  - All
  - FP
  - Not FP
  type: 15
  section: Collect
  required: false
- additionalinfo: Fetch incidents which belong to this particular main type.
  display: Incident Main Type
  name: incident_main_type
  type: 0
  section: Collect
  required: false
- additionalinfo: Fetch incidents which belong to this particular sub type.
  display: Incident Sub Type
  name: incident_sub_type
  type: 0
  section: Collect
  required: false
- display: Include Company ID
  name: include_company_id
  type: 8
  required: false
  defaultvalue: "false"
  section: Collect
  additionalinfo: If enabled, the SOCRadar Company ID configured in this instance will be stored as a custom field on each fetched incident. Useful for multi-tenant environments to identify which company an incident belongs to.
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
defaultclassifier: SOCRadar Incident Classifier
defaultmapperin: SOCRadar Incident Mapper
defaultmapperout: 'null'
description: Fetches SOCRadar incidents with desired parameters so that relevant actions over the incidents can be taken by using Cortex XSOAR.
display: SOCRadar Incidents
name: SOCRadarIncidents
script:
  commands:
  - arguments:
    - description: SOCRadar Incident ID to be marked as false positive.
      name: socradar_incident_id
      required: true
    - description: Comments about false positive action over the incident.
      name: comments
    description: Marks incident as false positive in SOCRadar platform.
    name: socradar-mark-incident-fp
  - arguments:
    - description: SOCRadar Incident ID to be marked as resolved.
      name: socradar_incident_id
      required: true
    - description: Comments about resolved action over the incident.
      name: comments
    description: Marks incident as resolved in SOCRadar platform.
    name: socradar-mark-incident-resolved
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- SOCRadarIncidents-Test
fromversion: 6.0.0