category: Network Security
provider: LogPoint
commonfields:
  id: SecBI
  version: -1
configuration:
- display: SecBI API URL (e.g. https://demisto.secbi.com)
  name: API_URL
  required: true
  type: 0
- display: SecBI API key
  name: API_KEY
  required: true
  type: 4
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
description: A threat, intelligence, and investigation platform, enabled by automation of detection and investigation, including remediation and prevention policy enforcements on all integrated appliances.
display: SecBI
name: SecBI
script:
  commands:
  - arguments:
    - description: "The Query for which to filter the incident IDs using Elasticsearch's Query String Syntax. E.g.: \"firstAppearance:[2018-06-01 TO 2018-06-21]\"."
      name: query
    - default: true
      defaultValue: '100'
      description: Limits the amount of IDs to return. (-1) for all.
      name: limit
    description: Returns all incident IDs in SecBI.
    name: secbi-get-incidents-list
    outputs:
    - contextPath: SecBI.IncidentsList
      description: The SecBI incident IDs List.
      type: String
  - arguments:
    - description: The SecBI incident ID.
      name: incident_id
      required: true
    description: Returns a specific SecBI Incident by SecBI incident ID.
    name: secbi-get-incident
    outputs:
    - contextPath: SecBI.Incident.ID
      description: The SecBI incident ID.
      type: String
    - contextPath: SecBI.Incident.Host
      description: The host names of the SecBI Incident.
      type: String
    - contextPath: SecBI.Incident.Identity
      description: The identities of the SecBI incident.
      type: String
    - contextPath: SecBI.Incident.InternalIp
      description: The internal client IP addresses of the SecBI incident.
      type: String
    - contextPath: SecBI.Incident.SIp
      description: The server IP addresses of the SecBI incident.
      type: String
    - contextPath: SecBI.Incident.FirstAppearance
      description: The first appearance of data of the SecBI incident.
      type: Date
    - contextPath: SecBI.Incident.LastAppearance
      description: The last appearance of data of the SecBI incident.
      type: Date
  - arguments:
    - description: The host for which to get a SecBI incident.
      name: host
      required: true
    description: Returns a specific SecBI incident by Host.
    name: secbi-get-incident-by-host
    outputs:
    - contextPath: SecBI.Incident.ID
      description: SecBI incident ID.
      type: String
    - contextPath: SecBI.Incident.Host
      description: Host names of the SecBI incident.
      type: String
    - contextPath: SecBI.Incident.Identity
      description: Incident identities of SecBI.
      type: String
    - contextPath: SecBI.Incident.InternalIp
      description: The internal client IP addresses of the SecBI incident.
      type: String
    - contextPath: SecBI.Incident.SIp
      description: The server IP addresses of the SecBI incident.
      type: String
    - contextPath: SecBI.Incident.FirstAppearance
      description: The first appearance of data of the SecBI incident.
      type: Date
    - contextPath: SecBI.Incident.LastAppearance
      description: The last appearance of data of the SecBI incident.
      type: Date
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- SecBI - Test
fromversion: 5.0.0