category: Network Security
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: SaasSecurity
  version: -1
configuration:
- display: Server URL
  name: url
  defaultvalue: https://api.aperture.paloaltonetworks.com
  additionalinfo: 'The instance configuration URL based on the server location: <br/>US: https://api.aperture.paloaltonetworks.com<br/> EU: https://api.aperture-eu.paloaltonetworks.com<br/> APAC: https://api.aperture-apac.paloaltonetworks.com'
  type: 0
  required: true
  section: Connect
- display: Client ID
  displaypassword: Client Secret
  name: credentials
  type: 9
  required: true
  additionalinfo: The SaaS Security Client ID and Client Secret.
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: 'Selects which direction you want the incidents mirrored. You can mirror Incoming only (from SaaS Security to Cortex XSOAR), **Outgoing** only (from Cortex XSOAR to SaaS Security), or both **Incoming And Outgoing**.'
  defaultvalue: None
  display: Incident Mirroring Direction
  hidden:
  - marketplacev2
  - platform
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  required: false
  section: Collect
- display: Number of incidents per fetch.
  name: max_fetch
  defaultvalue: "20"
  type: 0
  required: true
  additionalinfo: "Important: The limit value can range from 10 to 200 and must be in multiples of 10."
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: First fetch timestamp (<number> <time unit>. For example, 12 hours, 7 days)
  name: first_fetch
  defaultvalue: 3 days
  type: 0
  required: false
  section: Collect
- display: 'Fetch only incidents with matching state'
  additionalinfo: Fetches only incidents with matching **All**, **Closed**, or **Open** state. If nothing is selected, **All** states will be used.
  name: state
  type: 15
  options:
  - All
  - Open
  - Closed
  required: false
  section: Collect
- display: 'Fetch only incidents with matching severity'
  additionalinfo: If nothing is selected, **All** severities will be used.
  name: severity
  type: 16
  options:
  - '1.0'
  - '2.0'
  - '3.0'
  - '4.0'
  - '5.0'
  required: false
  section: Collect
- display: 'Fetch only incidents with matching status'
  additionalinfo: If nothing is selected, **All** statuses will be used.
  name: status
  type: 16
  options:
  - New
  - Assigned
  - In Progress
  - Pending
  - No Reason
  - Business Justified
  - Misidentified
  - In The Cloud
  - Dismiss
  required: false
  section: Collect
- display: Fetch only incidents with matching Application IDs
  name: app_ids
  type: 0
  additionalinfo: A comma-separated list of Application IDs. Run the ***saas-security-get-apps*** command to return the **Application ID**, **Name**, and **Type** for all applications.
  required: false
  section: Collect
- additionalinfo: If selected, when the incident closes on SaaS Security, the incident closes in Cortex XSOAR.
  defaultvalue: 'false'
  display: Close Mirrored XSOAR Incident
  hidden:
  - marketplacev2
  - platform
  name: close_incident
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  additionalinfo: By default, SSL verification is enabled. If selected, the connection isn’t secure and all requests return an SSL error because the certificate cannot be verified.
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  additionalinfo: Uses the system proxy server to communicate with the integration. If not selected, the integration will not use the system proxy server.
  required: false
  section: Connect
description: SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app’s API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex XSOAR to effectively manage the incidents discovered by SaaS Security API.
display: SaaS Security
name: SaasSecurity
script:
  commands:
  - name: saas-security-incidents-get
    description: Retrieves incidents from the SaaS Security platform.
    arguments:
    - name: limit
      description: "The number of incidents to pull. Important: The limit value can range from 10 to 200 and must be in multiples of 10."
      defaultValue: "50"
    - name: from
      description: The start time of the query, filtered by the date the incident was updated,\ \ For example, `2021-08-23T09:26:25.872Z`.
    - name: to
      description: The end time of the query, filtered by the date the incident was updated. For example, `2021-08-23T09:26:25.872Z`.
    - name: app_ids
      description: Comma-separated list of application IDs. Run the 'saas-security-get-apps' command to return the Application ID, Name, and Type for all applications.
      isArray: true
    - name: state
      auto: PREDEFINED
      predefined:
      - All
      - Open
      - Closed
      description: 'The state of the incidents. If empty, retrieves all states. Possible values: "All", "Open", and "Closed".'
      defaultValue: open
    - name: severity
      auto: PREDEFINED
      predefined:
      - '1.0'
      - '2.0'
      - '3.0'
      - '4.0'
      - '5.0'
      description: 'The severity of the incidents. If none is selected, all severities will be pulled. Possible values: "1.0", "2.0", "3.0", "4.0", and "5.0".'
    - name: status
      auto: PREDEFINED
      predefined:
      - New
      - Assigned
      - In Progress
      - Pending
      - No Reason
      - Business Justified
      - Misidentified
      - In The Cloud
      - Dismiss
      isArray: true
      description: 'The status of the incidents. Possible values: "New", "Assigned", "In Progress", "Pending", "No Reason", "Business Justified", "Misidentified", "In The Cloud", and "Dismiss".'
    - name: next_page
      description: Get the next batch of incidents. No other argument is needed when providing this.
    outputs:
    - contextPath: SaasSecurity.Incident.incident_id
      description: The incident ID.
      type: Number
    - contextPath: SaasSecurity.Incident.tenant
      description: The tenant associated with the incident.
      type: String
    - contextPath: SaasSecurity.Incident.app_id
      description: The application ID.
      type: String
    - contextPath: SaasSecurity.Incident.app_name
      description: The application name.
      type: String
    - contextPath: SaasSecurity.Incident.app_type
      description: The application type.
      type: String
    - contextPath: SaasSecurity.Incident.cloud_id
      description: The cloud ID.
      type: String
    - contextPath: SaasSecurity.Incident.asset_name
      description: The asset name.
      type: String
    - contextPath: SaasSecurity.Incident.asset_sha256
      description: The SHA256 hash value of the asset.
      type: String
    - contextPath: SaasSecurity.Incident.asset_id
      description: The asset ID.
      type: String
    - contextPath: SaasSecurity.Incident.asset_page_uri
      description: The asset page URI.
      type: String
    - contextPath: SaasSecurity.Incident.asset_cloud_uri
      description: The asset cloud URI.
      type: String
    - contextPath: SaasSecurity.Incident.exposure_type
      description: The exposure type (Internal/External).
      type: Number
    - contextPath: SaasSecurity.Incident.exposure_level
      description: The exposure level.
      type: String
    - contextPath: SaasSecurity.Incident.policy_id
      description: The policy ID.
      type: String
    - contextPath: SaasSecurity.Incident.policy_name
      description: The policy name.
      type: String
    - contextPath: SaasSecurity.Incident.policy_version
      description: The policy version.
      type: Number
    - contextPath: SaasSecurity.Incident.policy_page_uri
      description: The policy page URI.
      type: String
    - contextPath: SaasSecurity.Incident.severity
      description: The severity of the incident.
      type: String
    - contextPath: SaasSecurity.Incident.status
      description: The incident status.
      type: String
    - contextPath: SaasSecurity.Incident.state
      description: The incident state.
      type: String
    - contextPath: SaasSecurity.Incident.category
      description: The incident category.
      type: String
    - contextPath: SaasSecurity.Incident.resolved_by
      description: The name of the user who resolved the incident.
      type: String
    - contextPath: SaasSecurity.Incident.resolution_date
      description: The date the incident was resolved.
      type: Date
    - contextPath: SaasSecurity.Incident.created_at
      description: The date the incident was created, e.g., `2021-08-23T09:26:25.872Z`.
      type: Date
    - contextPath: SaasSecurity.Incident.updated_at
      description: The Date the incident was last updated. e.g., `2021-08-24T09:26:25.872Z`.
      type: Date
    - contextPath: SaasSecurity.Incident.asset_owner_id
      description: The ID of the asset owner.
      type: String
    - contextPath: SaasSecurity.Incident.asset_owner_name
      description: The name of the asset owner.
      type: String
    - contextPath: SaasSecurity.Incident.asset_owner_email
      description: The email address of the asset owner.
      type: String
    - contextPath: SaasSecurity.NextResultsPage
      description: The URI for the next batch of incidents.
      type: String
  - name: saas-security-incident-get-by-id
    arguments:
    - name: id
      required: true
      default: true
      description: The incident ID.
    outputs:
    - contextPath: SaasSecurity.Incident.incident_id
      description: The Incident ID.
      type: Number
    - contextPath: SaasSecurity.Incident.tenant
      description: The tenant associated with the incident.
      type: String
    - contextPath: SaasSecurity.Incident.app_id
      description: The application ID.
      type: String
    - contextPath: SaasSecurity.Incident.app_name
      description: The application name.
      type: String
    - contextPath: SaasSecurity.Incident.app_type
      description: The application type.
      type: String
    - contextPath: SaasSecurity.Incident.cloud_id
      description: The cloud ID.
      type: String
    - contextPath: SaasSecurity.Incident.asset_name
      description: The asset name.
      type: String
    - contextPath: SaasSecurity.Incident.asset_sha256
      description: The SHA256 hash value of the asset.
      type: String
    - contextPath: SaasSecurity.Incident.asset_id
      description: The asset ID.
      type: String
    - contextPath: SaasSecurity.Incident.asset_page_uri
      description: The asset page URI.
      type: String
    - contextPath: SaasSecurity.Incident.asset_cloud_uri
      description: The asset cloud URI.
      type: String
    - contextPath: SaasSecurity.Incident.exposure_type
      description: The exposure type (Internal/External).
      type: Number
    - contextPath: SaasSecurity.Incident.exposure_level
      description: The exposure level.
      type: String
    - contextPath: SaasSecurity.Incident.policy_id
      description: The policy ID.
      type: String
    - contextPath: SaasSecurity.Incident.policy_name
      description: The policy name.
      type: String
    - contextPath: SaasSecurity.Incident.policy_version
      description: The policy version.
      type: Number
    - contextPath: SaasSecurity.Incident.policy_page_uri
      description: The policy page URI.
      type: String
    - contextPath: SaasSecurity.Incident.severity
      description: The severity of the incident.
      type: String
    - contextPath: SaasSecurity.Incident.status
      description: The incident status.
      type: String
    - contextPath: SaasSecurity.Incident.state
      description: The incident state.
      type: String

    - contextPath: SaasSecurity.Incident.category
      description: The incident category.
      type: String
    - contextPath: SaasSecurity.Incident.resolved_by
      description: The name of the user who resolved the incident.
      type: String
    - contextPath: SaasSecurity.Incident.resolution_date
      description: The date the incident was resolved.
      type: Date
    - contextPath: SaasSecurity.Incident.created_at
      description: The date the incident was created, e.g., `2021-08-23T09:26:25.872Z`.
      type: Date
    - contextPath: SaasSecurity.Incident.updated_at
      description: The date the incident was last updated, e.g., `2021-08-24T09:26:25.872Z`.
      type: Date
    - contextPath: SaasSecurity.Incident.asset_owner_id
      description: The ID of the asset owner.
      type: String
    - contextPath: SaasSecurity.Incident.asset_owner_name
      description: The name of the asset owner.
      type: String
    - contextPath: SaasSecurity.Incident.asset_owner_email
      description: The email address of the asset owner.
      type: String
    description: Gets an incident by its ID.
  - name: saas-security-incident-state-update
    arguments:
    - name: id
      required: true
      description: The incident ID.
    - name: category
      description: 'The reason for closing the incident. Possible values: "Misidentified", "No Reason", and "Business Justified".'
      required: true
      auto: PREDEFINED
      predefined:
      - Misidentified
      - No Reason
      - Business Justified
      defaultValue: Reason for state update.
    outputs:
    - contextPath: SaasSecurity.IncidentState.incident_id
      description: The incident ID.
      type: String
    - contextPath: SaasSecurity.IncidentState.state
      description: The incident state (open/closed).
      type: String
    - contextPath: SaasSecurity.IncidentState.category
      description: The incident category.
      type: String
    - contextPath: SaasSecurity.IncidentState.resolved_by
      description: The name of the user who resolved the incident.
      type: String
    - contextPath: SaasSecurity.IncidentState.resolution_date
      description: The date when the incident was resolved.
      type: Date
    description: Closes an incident and updates its category.
  - name: saas-security-get-apps
    arguments: []
    outputs:
    - contextPath: SaasSecurity.App.app_name
      description: The application name.
      type: String
    - contextPath: SaasSecurity.App.app_id
      description: The application ID.
      type: String
    - contextPath: SaasSecurity.App.app_type
      description: The application type.
      type: String
    description: Returns the Application ID, Name, and Type for all applications.
  - name: saas-security-asset-remediate
    arguments:
    - name: asset_id
      required: true
      description: The ID of the asset to remediate.
    - name: remediation_type
      required: true
      auto: PREDEFINED
      predefined:
      - Remove public sharing
      - Quarantine
      - Restore
      description: 'The remediation action to take. Possible values: "Remove public sharing"(only for Office365, Dropbox, Box, Google Drive apps), "Quarantine", and "Restore".'
    - name: remove_inherited_sharing
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: 'Used when the remediation type is “Remove public sharing”. When set to true, all the parent folders with a shared URL will be removed.'
      defaultValue: "false"
    outputs:
    - contextPath: SaasSecurity.Remediation.asset_id
      description: The asset ID.
      type: String
    - contextPath: SaasSecurity.Remediation.remediation_type
      description: The remediation type.
      type: String
    - contextPath: SaasSecurity.Remediation.status
      description: The remediation action status.
      type: String
    description: Remediates an asset.
  - name: saas-security-remediation-status-get
    description: Gets the remediation status for a given asset ID.
    arguments:
    - name: asset_id
      required: true
      description: The asset ID.
    - name: remediation_type
      required: true
      auto: PREDEFINED
      predefined:
      - Remove public sharing
      - Quarantine
      - Restore
      description: 'The remediation action that was taken. Possible values: "Remove public sharing"(only for Office365, Dropbox, Box, Google Drive apps), "Quarantine", and "Restore".'
    outputs:
    - contextPath: SaasSecurity.Remediation.asset_id
      description: The asset ID.
      type: String
    - contextPath: SaasSecurity.Remediation.asset_name
      description: The asset name.
      type: String
    - contextPath: SaasSecurity.Remediation.remediation_type
      description: The remediation type.
      type: String
    - contextPath: SaasSecurity.Remediation.action_taker
      description: The source of the remediation action. For example, 'api'.
      type: String
    - contextPath: SaasSecurity.Remediation.action_date
      description: The date when the remediation action was taken.
      type: Date
    - contextPath: SaasSecurity.Remediation.status
      description: The remediation action status.
      type: String
  - name: get-remote-data
    arguments:
    - description: The remote incident ID.
      name: id
      required: true
    - defaultValue: '0'
      description: UTC timestamp in seconds. The incident is only updated if it was modified after the last update time.
      name: lastUpdate
    description: Get remote data from a remote incident. Note that this method will not update the current incident. It's used for debugging purposes.
  - description: Returns the list of fields for an incident type.
    name: get-mapping-fields
  - arguments:
    - description: Date string representing the local time. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
    description: Get the list of incidents that were modified since the last update. Note that this method is used for debugging purposes. get-modified-remote-data is used as part of a Mirroring feature, which is available since Cortex XSOAR version 6.1.
    name: get-modified-remote-data
  - description: Updates local incident changes in the remote incident. This method is only used for debugging purposes and will not update the current incident.
    name: update-remote-system
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
defaultmapperin: Saas Security - Incoming Mapper
defaultmapperout: Saas Security - Outgoing Mapper
fromversion: 6.0.0
tests:
- SaasSecurity-Test