name: SaaS Security Event Collector
display: SaaS Security Event Collector
category: Analytics & SIEM
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: SaaS Security Event Collector
  version: -1
configuration:
- additionalinfo: 'The instance configuration URL based on the server location: <br/>US: https://api.aperture.paloaltonetworks.com<br/> EU: https://api.aperture-eu.paloaltonetworks.com<br/> APAC: https://api.aperture-apac.paloaltonetworks.com'
  defaultvalue: https://api.aperture.paloaltonetworks.com
  display: Your server URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The SaaS Security Client ID and Client Secret.
  display: Client ID
  displaypassword: Client Secret
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: The maximum number of events per fetch.
  additionalinfo: 'The maximum number of events to fetch. Applies only to the manual ''saas-security-get-events'' command. During scheduled ''Fetch Events'', the collector drains as much of the queue as possible per cycle (bounded by ''The maximum number of iterations to retrieve events''), so this value does not throttle live ingestion. Must be divisible by 10 due to SaaS Security API limitations.'
  defaultvalue: 1000
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: The maximum number of iterations to retrieve events
  additionalinfo: 'The maximum number of iterations to retrieve events. Each iteration retrieves up to 100 events from the SaaS Security queue (the API''s per-request limit). This is an upper bound on iterations per fetch execution; in practice each execution stops within a safe time budget before the engine timeout, so this mainly provides headroom to keep draining a large backlog for the full budget. The collector keeps draining across consecutive executions until the queue is empty. A lower configured value is automatically raised to the required minimum.'
  defaultvalue: 900
  name: max_iterations
  type: 0
  required: false
  section: Collect
- display: Number of concurrent fetch requests
  additionalinfo: 'The number of GET requests issued concurrently against the SaaS Security queue per fetch round. Higher values increase drain throughput for high event rates. Maximum is 30. This is an advanced parameter.'
  defaultvalue: 10
  name: event_fetch_concurrency
  type: 0
  required: false
  advanced: true
  section: Collect
- display: Treat an empty Cortex XSIAM response as delivered
  additionalinfo: 'Whether to treat a send that fails only because Cortex XSIAM returned a success (200) with an empty/blank body (no JSON acknowledgement to parse) as delivered instead of being re-stashed and retried indefinitely. The events were already sent over the wire; only the acknowledgement was missing. Truncated or non-empty unparseable responses are still treated as real failures and retried. Enable this as a temporary workaround for a known server-side empty-body response; disable it to strictly require a valid acknowledgement. This is an advanced parameter.'
  defaultvalue: 'true'
  name: event_pass_over_empty_response
  type: 8
  required: false
  advanced: true
  section: Collect
description: Palo Alto Networks SaaS Security Event Collector integration for XSIAM.
script:
  commands:
  - description: Manual command to fetch events and display them. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    name: saas-security-get-events
    arguments:
    - name: limit
      description: The maximum number of events to get. Must be divisible by 10 due to SaaS Security API limitations. Overrides the max-fetch parameter of the integration.
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them. *If setting to 'False' The returned events will be lost.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    outputs:
    - contextPath: SaasSecurity.Event.log_type
      description: Event type.
      type: String
    - contextPath: SaasSecurity.Event.item_type
      description: Item type (File, Folder, or User).
      type: String
    - contextPath: SaasSecurity.Event.item_name
      description: Name of the file, folder, or user associated with the event.
      type: String
    - contextPath: SaasSecurity.Event.item_unique_id
      description: Unique ID number for an asset’s related asset.
      type: String
    - contextPath: SaasSecurity.Event.user
      description: Cloud app user that performed the action.
      type: String
    - contextPath: SaasSecurity.Event.source_ip
      description: Original session source IP address.
      type: String
    - contextPath: SaasSecurity.Event.location
      description: Location of the cloud app user that performed the event.
      type: String
    - contextPath: SaasSecurity.Event.action
      description: Action performed.
      type: String
    - contextPath: SaasSecurity.Event.target_name
      description: Target name.
      type: String
    - contextPath: SaasSecurity.Event.target_type
      description: Target type.
      type: String
    - contextPath: SaasSecurity.Event.serial
      description: Serial number of the organization using the service (tenant).
      type: String
    - contextPath: SaasSecurity.Event.cloud_app_instance
      description: Cloud app name (not cloud app type).
      type: String
    - contextPath: SaasSecurity.Event.timestamp
      description: ISO8601 timestamp to show when the event occurred.
      type: Date
    - contextPath: SaasSecurity.Event.severity
      description: Severity (0-5).
      type: Number
    - contextPath: SaasSecurity.Event.incident_id
      description: Incident/risk id.
      type: String
    - contextPath: SaasSecurity.Event.exposure
      description: Exposure level (public, external, company, or internal).
      type: String
    - contextPath: SaasSecurity.Event.asset_id
      description: The asset ID.
      type: String
    - contextPath: SaasSecurity.Event.item_owner
      description: The item owner.
      type: String
    - contextPath: SaasSecurity.Event.container_name
      description: Item’s container name.
      type: String
    - contextPath: SaasSecurity.Event.item_creator
      description: Item creator.
      type: String
    - contextPath: SaasSecurity.Event.occurrences_by_rule
      description: Number of times the asset violated the policy.
      type: Number
    - contextPath: SaasSecurity.Event.policy_rule_name
      description: Violated policy’s name.
      type: String
    - contextPath: SaasSecurity.Event.incident_owner
      description: Incident owner.
      type: String
    - contextPath: SaasSecurity.Event.incident_category
      description: Incident category.
      type: String
    - contextPath: SaasSecurity.Event.item_creator_email
      description: Item creator’s email.
      type: String
    - contextPath: SaasSecurity.Event.action_taken
      description: Action taken.
      type: String
    - contextPath: SaasSecurity.Event.action_taken_by
      description: Action taken by.
      type: String
    - contextPath: SaasSecurity.Event.field
      description: Name of field (optional).
      type: String
    - contextPath: SaasSecurity.Event.resource_value_old
      description: Old resource value. (optional).
      type: String
    - contextPath: SaasSecurity.Event.resource_value_new
      description: New resource value. (optional).
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
supportedModules:
- xsiam