import io
import json
from collections.abc import Callable
from datetime import datetime
from itertools import takewhile
from typing import Any
from zipfile import ZipFile

import dateparser
import demistomock as demisto  # noqa: F401
import urllib3
from CommonServerPython import *  # noqa: F401
from dateutil.parser import parse

# Disable insecure warnings
urllib3.disable_warnings()

# These parameters will be used for retry mechanism logging
TOTAL_RETRY_COUNT = 0
FULL_URL = None

# Valid Entity Type for Whitelists
VALID_ENTITY_TYPE = ["Users", "Activityaccount", "Resources", "Activityip"]

# Valid Whitelist Types
VALID_WHITELIST_TYPE = ["Global", "Attribute"]

# Special characters for spotter query
SPOTTER_SPECIAL_CHARACTERS = ["\\", "*", "?"]

# Markdown characters.
MARKDOWN_CHARS = r"\*_{}[]()#+-!"

# Mapping of user input of mirroring direction to XSOAR.
MIRROR_DIRECTION = {"None": None, "Incoming": "In", "Outgoing": "Out", "Incoming And Outgoing": "Both"}
# If any comment is added to the incident, then this will be the action we'll get through incident activity history
# command.
COMMENT_ACTION = "COMMENTS_ADDED"
# If any file is attached to the incident, then this will be the action we'll get through incident activity history
# command.
ATTACHMENT_ACTION = "ATTACHED_FILE"
# This will store the state mapping of XSOAR states with Securonix states.
XSOAR_TO_SECURONIX_STATE_MAPPING: dict = {}
# Policy types for which retry should have end time to the current time.
POLICY_TYPES_TO_RETRY = ["DIRECTIVE", "LAND SPEED", "TIER2", "BEACONING"]

MESSAGE = {
    "INVALID_MAX_VALUE": "Please provide a value for 'max' between 1 and 10,000.",
}


def reformat_resource_groups_outputs(text: str) -> str:
    """rg_*text -> ResourceGroupText
    Args:
        text: the text to transform
    Returns:
        A Camel Cased string.
    """
    suffix = text[3:]
    if suffix == "id":
        suffix = "ID"
    elif suffix == "resourcetypeid":
        suffix = "TypeID"
    else:
        suffix = suffix.title()
    return f"ResourceGroup{suffix}"


def reformat_outputs(text: str) -> str:
    """camelCase -> Camel Case, id -> ID
    Args:
        text: the text to transform
    Returns:
        A Demisto output standard string
    """
    if text.startswith("rg_"):
        return reformat_resource_groups_outputs(text)
    if text == "id":
        return "ID"
    if text in ["lanid", "u_lanid"]:
        return "LanID"
    if text == "jobId":
        return "JobID"
    if text == "eventId":
        return "EventID"
    if text in ["entityId", "entityid"]:
        return "EntityID"
    if text in ["tenantId", "tenantid"]:
        return "TenantID"
    if text == "incidentId":
        return "IncidentID"
    if text == "Datasourceid":
        return "DataSourceID"
    if text in ["employeeId", "employeeid", "u_employeeid"]:
        return "EmployeeID"
    if text == "violatorId":
        return "ViolatorID"
    if text == "threatname":
        return "ThreatName"
    if text == "generationtime":
        return "GenerationTime"
    if text == "generationtime_epoch":
        return "GenerationTime_Epoch"

    if text.startswith(("U_", "u_")):
        text = text[2:]
    return "".join(" " + char if char.isupper() else char.strip() for char in text).strip().title()


def parse_data_arr(data_arr: Any, fields_to_drop: list = [], fields_to_include: list = []):
    """Parse data as received from Securonix into Demisto's conventions
    Args:
        data_arr: a dictionary containing the data
        fields_to_drop: Fields to drop from the array of the data
        fields_to_include: Fields to include from the array of the data
    Returns:
        A Camel Cased dictionary with the relevant fields.
        readable: for the human readable
        outputs: for the entry context
    """
    if isinstance(data_arr, list):
        readable_arr, outputs_arr = [], []
        for data in data_arr:
            readable = {reformat_outputs(i): j for i, j in data.items() if i not in fields_to_drop}
            if fields_to_include:
                readable = {i: j for i, j in readable.items() if i in fields_to_include}
            readable_arr.append(readable)
            outputs_arr.append({k.replace(" ", ""): v for k, v in readable.copy().items()})
        return readable_arr, outputs_arr

    readable = {reformat_outputs(i): j for i, j in data_arr.items() if i not in fields_to_drop}
    if fields_to_include:
        readable = {i: j for i, j in readable.items() if i in fields_to_include}
    outputs = {k.replace(" ", ""): v for k, v in readable.copy().items()}

    return readable, outputs


def string_escape_MD(data: Any):
    """
    Escape any chars that might break a markdown string.

    :type data: ``Any``
    :param data: The data to be modified (required).

    :return: A modified data.
    :rtype: ``str``
    """
    if isinstance(data, str):
        data = "".join(["\\" + str(c) if c in MARKDOWN_CHARS else str(c) for c in data])
    elif isinstance(data, list):
        new_data = []
        for sub_data in data:
            if isinstance(sub_data, str):
                sub_data = "".join(["\\" + str(c) if c in MARKDOWN_CHARS else str(c) for c in sub_data])
            new_data.append(sub_data)
        data = new_data

    return data


def incident_priority_to_dbot_score(priority_str: str, default_severity: str):
    """Converts an priority string to DBot score representation
        alert severity. Can be one of:
        Low    ->  1
        Medium ->  2
        High   ->  3

    Args:
        priority_str: String representation of priority.
        default_severity: Default incoming incident severity

    Returns:
        Dbot representation of severity
    """
    if default_severity:
        priority = default_severity.lower()
    else:
        priority = priority_str.lower()

    if priority == "low":
        return 1
    if priority == "medium":
        return 2
    if priority == "high":
        return 3
    demisto.info(f"Securonix incident priority: {priority} is not known. Setting as unknown(DBotScore of 0).")
    return 0


def validate_configuration_parameters(params: dict[str, Any]):
    """
    Check whether entered configuration parameters are valid or not.

    :type: params: dict
    :param: Dictionary of demisto configuration parameter

    :return: raise ValueError if any configuration parameter is not in valid format else returns None
    :rtype: None
    """
    fetch_time = params.get("fetch_time")
    max_fetch = params.get("max_fetch")
    # Validate empty values
    if fetch_time is None:
        raise ValueError("Please provide First fetch time")
    if max_fetch is None:
        raise ValueError("Please provide max_fetch")
    # validate max_fetch
    arg_to_number(max_fetch, arg_name="max_fetch")
    # validate first_fetch parameter
    arg_to_datetime(fetch_time, "First fetch time")


class RetryExponential(Retry):
    """
    Create wrapper of urllib3.util.retry for Add extra logs before making a retry request with exponential delay
    """

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        diff = TOTAL_RETRY_COUNT - self.total  # type: ignore
        if 0 < diff <= TOTAL_RETRY_COUNT:
            demisto.debug(f"Performing retry {diff} with {self.get_backoff_time()} seconds delay for URL {FULL_URL}")


class RetryFixed(Retry):
    """
    Create wrapper of urllib3.util.retry for Add extra logs before making a retry request with fixed delay
    """

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        diff = TOTAL_RETRY_COUNT - self.total  # type: ignore
        if 0 < diff <= TOTAL_RETRY_COUNT:
            demisto.debug(f"Performing retry {diff} with {self.get_backoff_time()} seconds delay for URL {FULL_URL}.")

    # Overriding get_backoff_time logic for fixed backoff_factor
    def get_backoff_time(self) -> float:
        """
        Formula for computing the fixed backoff

        :rtype: float
        """
        consecutive_errors_len = len(list(takewhile(lambda x: x.redirect_location is None, reversed(self.history))))

        if consecutive_errors_len <= 1:
            return 0
        return min(self.DEFAULT_BACKOFF_MAX, int(self.backoff_factor))


def validate_mirroring_parameters(params: dict[str, Any]) -> None:
    """Validate mirroring specific configuration parameters.

    Args:
        params: The integration configuration parameters got from demisto.params()
    """
    mirror_direction = params.get("mirror_direction", "None").strip()
    close_states_of_securonix = params.get("close_states_of_securonix", "").strip().lower()
    active_state_action = params.get("active_state_action_mapping", "").strip()
    active_state_status = params.get("active_state_status_mapping", "").strip().lower()
    close_state_action = params.get("closed_state_action_mapping", "").strip()
    close_state_status = params.get("closed_state_status_mapping", "").strip().lower()
    close_incident = argToBoolean(params.get("close_incident", False))
    comment_entry_tag = params.get("comment_tag", "").strip()

    if mirror_direction == "None":
        return

    if mirror_direction == "Incoming" and (not close_states_of_securonix or not argToList(close_states_of_securonix)):
        raise ValueError(
            'Following field is required for Incoming Mirroring: "Securonix workflow state(s) that '
            'can be considered as Close state in XSOAR for Incoming mirroring".'
        )

    if mirror_direction == "Outgoing" and (
        not active_state_action
        or not active_state_status
        or not close_state_action
        or not close_state_status
        or not comment_entry_tag
    ):
        raise ValueError(
            'Following fields are required for Outgoing Mirroring: "Securonix action name to map '
            'with XSOAR\'s active state for Outgoing mirroring", "Securonix status to map with '
            'XSOAR\'s active state for Outgoing mirroring", "Securonix action name to map with '
            "XSOAR's closed state for Outgoing mirroring\", \"Securonix status to map with XSOAR's "
            'closed state for Outgoing mirroring", "Comment Entry Tag".'
        )

    if mirror_direction == "Incoming And Outgoing" and (
        not active_state_action
        or not active_state_status
        or not close_state_action
        or not close_state_status
        or not close_states_of_securonix
        or not argToList(close_states_of_securonix)
        or not comment_entry_tag
    ):
        raise ValueError(
            'Following fields are required for Incoming And Outgoing Mirroring: "Securonix workflow '
            'state(s) that can be considered as Close state in XSOAR for Incoming mirroring", '
            '"Securonix action name to map with XSOAR\'s active state for Outgoing mirroring", '
            '"Securonix status to map with XSOAR\'s active state for Outgoing mirroring", "Securonix'
            ' action name to map with XSOAR\'s closed state for Outgoing mirroring", "Securonix status'
            ' to map with XSOAR\'s closed state for Outgoing mirroring", "Comment Entry Tag".'
        )

    if close_incident and not active_state_action or not active_state_status or not close_state_action or not close_state_status:
        raise ValueError(
            'Following fields are required for closing incident on Securonix: "Securonix action name '
            'to map with XSOAR\'s active state for Outgoing mirroring", "Securonix status to map '
            'with XSOAR\'s active state for Outgoing mirroring", "Securonix action name to map with '
            "XSOAR's closed state for Outgoing mirroring\", \"Securonix status to map with XSOAR's "
            'closed state for Outgoing mirroring".'
        )


def validate_delete_whitelist_parameters(
    whitelist_type: str, entity_id: str, attribute_name: str, attribute_value: str, tenant_name: str
) -> None:
    """Validate parameters for delete whitelist entry command.

    Args:
        whitelist_type: Type of whitelist that user wants to delete from.
        entity_id: Entity ID value that needs to be removed from the whitelist.
        attribute_name: Name of the attribute being removed.
        attribute_value: The value of the attribute being removed.
        tenant_name: The name of the tenant the whitelist belongs to.

    Raises:
        ValueError: Raises ValueError if parameters are invalid.
    """
    # Validate whitelist_type parameter.
    if whitelist_type and whitelist_type not in VALID_WHITELIST_TYPE:
        raise ValueError(f"{whitelist_type} is an invalid value for whitelist_type.Valid whitelist types are {VALID_ENTITY_TYPE}")

    # Validate entity_id parameter.
    if whitelist_type == "Global" and not entity_id:
        raise ValueError("entity_id is required parameter for Global whitelist type.")

    # Validate attribute_name parameter.
    if whitelist_type == "Attribute" and not attribute_name:
        raise ValueError("attribute_name is required parameter for Attribute whitelist type.")

    # Validate attribute_value parameter.
    if whitelist_type == "Attribute" and not attribute_value:
        raise ValueError("attribute_value is required parameter for Attribute whitelist type.")

    # Validate tenant_name parameter.
    if not tenant_name:
        raise ValueError("tenant_name is a required parameter.")


def get_mirroring() -> dict:
    """Add mirroring related keys in an incident.

    Returns:
        Dict: A dictionary containing required key-value pairs for mirroring.
    """
    # Fetch the integration configuration parameters to determine the flow of the mirroring and mirror tags.
    params = demisto.params()
    mirror_direction = params.get("mirror_direction", "None").strip()
    mirror_tags = params.get("comment_tag", "").strip()

    return {
        "mirror_direction": MIRROR_DIRECTION.get(mirror_direction),
        "mirror_instance": demisto.integrationInstance(),
        "mirror_tags": mirror_tags,
    }


def filter_activity_entries_by_time(activity_data: list[dict[str, Any]], timestamp: int) -> list[dict[str, Any]]:
    """Filter the incident activity entries by the given timestamp.

    Args:
        activity_data (List[Dict[str, Any]]): A list of incident activity data.
        timestamp (int): The timestamp to filter the activity data.

    Returns:
        List[Dict[str, Any]]: Filtered incident activity entries.
    """
    filtered_activities = []

    for activity in activity_data:
        activity_timestamp = activity.get("eventTime", "")

        # If no event timestamp found in an entry, then skip that entry.
        if not activity_timestamp:
            demisto.debug(f"Skipping entry as no event timestamp found: {json.dumps(activity)}")
            continue

        if date_to_timestamp(parse(activity_timestamp)) >= timestamp:
            filtered_activities.append(activity)

    return filtered_activities


def filter_comment_activity_entries(activity_data: list[dict[str, Any]]) -> list[dict[str, Any]]:
    """Filter the comment entries from the given incident activity entries.

    Args:
        activity_data (List[Dict[str, Any]]): A list of incident activity data.

    Returns:
        List[Dict[str, Any]]: Filtered comment entries from incident activity entries.
    """
    comment_entries = []

    for activity in activity_data:
        activity_action = activity.get("actiontaken", "")

        if activity_action == COMMENT_ACTION:
            comment_entries.append(activity)

    return comment_entries


def filter_attachment_activity_entries(activity_data: list[dict[str, Any]]) -> list[dict[str, Any]]:
    """Filter the attachment entries from the given incident activity entries.

    Args:
        activity_data (List[Dict[str, Any]]): A list of incident activity data.

    Returns:
        List[Dict[str, Any]]: Filtered attachment entries from incident activity entries.
    """
    attachment_entries = []

    for activity in activity_data:
        activity_action = activity.get("actiontaken", "")

        if activity_action == ATTACHMENT_ACTION:
            attachment_entries.append(activity)

    return attachment_entries


def extract_names_of_attachments_from_entries(attachment_entries: list[dict[str, Any]]) -> list[str]:
    """Return names of the attachments for a list of attachment entries.

    Args:
        attachment_entries (List[Dict[str, Any]]): A list of attachment entries.

    Returns:
        List[str]: A list of attachment names.
    """
    attachment_names = [attachment.get("attachment") for attachment in attachment_entries]

    # Remove any None values from the list and return it.
    return list(filter(None, attachment_names))


def is_incident_closed_on_securonix(activity_data: list[dict[str, Any]], close_states_of_securonix: list[str]) -> bool:
    """Check whether the incident is closed on the Securonix.

    Args:
        activity_data: A list of activity data from which to determine whether the incident is closed or not.
        close_states_of_securonix: A list of Securonix states which defines the close state for XSOAR.

    Returns:
        bool: Indicating whether the incident is closed on Securonix or not.
    """
    incident_closed = []

    for activity in activity_data:
        current_status = activity.get("status", "").strip().lower()
        last_status = activity.get("lastStatus", "").strip().lower()

        if current_status != last_status and current_status in close_states_of_securonix:
            incident_closed.append(True)
        else:
            incident_closed.append(False)

    return any(incident_closed)


def extract_closing_comments(activity_data: list[dict[str, Any]], close_states_of_securonix: list[str]) -> str:
    """Extract the contents of the closing comments from activity data provided from Securonix.

    Args:
        activity_data: A list of activity data from which to extract the closing comments.
        close_states_of_securonix: A list of Securonix states which defines the close state for XSOAR.

    Returns:
        str: A string representing closing comments.
    """
    closing_comments = []

    for activity in activity_data:
        current_status = activity.get("status", "").strip().lower()
        last_status = activity.get("lastStatus", "").strip().lower()

        if current_status != last_status and current_status in close_states_of_securonix:
            comments_list = activity.get("comment", [])

            for _comment in comments_list:
                closing_comments.append(_comment.get("Comments", ""))

    if not closing_comments:
        closing_comments.append("Closing the XSOAR incident as Securonix incident is closed.")

    return " | ".join(closing_comments)


def escape_spotter_query(original_query: str) -> str:
    """Escape the special characters of the spotter query provided from Securonix Incident.

    Args:
        original_query: The original spotter query provided from Securonix Incident

    Returns:
        str: The spotter query escaped for special characters.
    """
    escaped_query = original_query
    for special_char in SPOTTER_SPECIAL_CHARACTERS:
        escaped_query = escaped_query.replace(special_char, f"\\{special_char}")
    return escaped_query


class Client(BaseClient):
    """
    Client to use in the Securonix integration. Overrides BaseClient
    """

    def __init__(
        self,
        tenant: str,
        server_url: str,
        username: str,
        password: str,
        verify: bool,
        proxy: bool,
        securonix_retry_count: int,
        securonix_retry_delay: int,
        securonix_retry_delay_type: str,
    ):
        super().__init__(base_url=server_url, verify=verify, proxy=proxy)
        self._username = username
        self._password = password
        self._tenant = tenant
        self._securonix_retry_count = securonix_retry_count
        self._securonix_retry_delay = securonix_retry_delay
        self._securonix_retry_delay_type = securonix_retry_delay_type
        self.session = requests.Session()

        # Fetch cached integration context.
        integration_context = get_integration_context()
        self._token = integration_context.get("token") or self._generate_token()

        # the following condition was added to overcome the security hardening happened in Python 3.10.
        # https://github.com/python/cpython/pull/25778
        # https://bugs.python.org/issue43998

        if IS_PY3 and PY_VER_MINOR >= 10 and not verify:
            self.session.mount("https://", SSLAdapter(verify=verify))

    def get_securonix_retry_count(self):
        return self._securonix_retry_count

    def get_securonix_retry_delay(self):
        return self._securonix_retry_delay

    def get_securonix_retry_delay_type(self):
        return self._securonix_retry_delay_type

    def implement_retry(
        self,
        retries: int = 0,
        status_list_to_retry: list = None,
        backoff_factor: int = 30,
        raise_on_redirect: bool = False,
        raise_on_status: bool = False,
    ):
        """
        Implements the retry mechanism.
        In the default case where retries = 0 the request will fail on the first time

        :type retries: ``int`` :param retries: How many retries should be made in case of a failure. when set to '0'-
        will fail on the first time

        :type status_list_to_retry: ``iterable``
        :param status_list_to_retry: A set of integer HTTP status codes that we should force a retry on.
            A retry is initiated if the request method is in ['GET', 'POST', 'PUT']
            and the response status code is in ``status_list_to_retry``.

        :type backoff_factor ``float``
        :param backoff_factor:
            A backoff factor to apply between attempts after the second try
            (most errors are resolved immediately by a second try without a
            delay). urllib3 will sleep for::

                {backoff factor} * (2 ** ({number of total retries} - 1))

            seconds. If the backoff_factor is 0.1, then :func:`.sleep` will sleep
            for [0.0s, 0.2s, 0.4s, ...] between retries. It will never be longer
            than :attr:`Retry.BACKOFF_MAX`.

            By default, backoff_factor set to 5

        :type raise_on_redirect ``bool``
        :param raise_on_redirect: Whether, if the number of redirects is
            exhausted, to raise a MaxRetryError, or to return a response with a
            response code in the 3xx range.

        :type raise_on_status ``bool``
        :param raise_on_status: Similar meaning to ``raise_on_redirect``:
            whether we should raise an exception, or return a response,
            if status falls in ``status_forcelist`` range and retries have
            been exhausted.
        """
        try:
            method_whitelist = (
                "allowed_methods"
                if hasattr(
                    Retry.DEFAULT,  # type: ignore[attr-defined]
                    "allowed_methods",
                )
                else "method_whitelist"
            )
            whitelist_kawargs = {method_whitelist: frozenset(["GET", "POST", "PUT"])}
            retry = None
            if self._securonix_retry_delay_type == "Fixed":
                demisto.debug("Securonix Retry delay type is Fixed")
                # Set DEFAULT_BACKOFF_MAX to 2hour(in seconds)
                RetryFixed.DEFAULT_BACKOFF_MAX = 7200
                retry = RetryFixed(
                    total=retries,
                    connect=0,
                    read=0,
                    backoff_factor=backoff_factor,
                    status=retries,
                    status_forcelist=status_list_to_retry,
                    raise_on_status=raise_on_status,
                    raise_on_redirect=raise_on_redirect,
                    **whitelist_kawargs,  # type: ignore[arg-type]
                )
            else:
                demisto.debug("Securonix Retry delay type is Exponential")
                # Set DEFAULT_BACKOFF_MAX to 2hour(in seconds)
                RetryExponential.DEFAULT_BACKOFF_MAX = 7200
                retry = RetryExponential(  # type: ignore
                    total=retries,
                    backoff_factor=backoff_factor,
                    connect=0,
                    read=0,
                    status=retries,
                    status_forcelist=status_list_to_retry,
                    raise_on_status=raise_on_status,
                    raise_on_redirect=raise_on_redirect,
                    **whitelist_kawargs,  # type: ignore[arg-type]
                )
            http_adapter = HTTPAdapter(max_retries=retry)

            # the following condition was added to overcome the security hardening happened in Python 3.10.
            # https://github.com/python/cpython/pull/25778
            # https://bugs.python.org/issue43998

            if self._verify:
                https_adapter = http_adapter
            elif IS_PY3 and PY_VER_MINOR >= 10:
                https_adapter = SSLAdapter(max_retries=retry, verify=self._verify)  # type: ignore[arg-type]
            else:
                https_adapter = http_adapter

            self.session.mount("https://", https_adapter)

        except NameError:
            pass

    def http_request(
        self,
        method,
        url_suffix,
        headers=None,
        params=None,
        response_type: str = "json",
        json=None,
        data=None,
        regenerate_access_token=True,
    ):
        """
        Generic request to Securonix
        """
        global FULL_URL
        FULL_URL = urljoin(self._base_url, url_suffix)
        status_list_to_retry = [429] + list(range(500, 600))
        if self._securonix_retry_count > 0:
            self.implement_retry(
                retries=self._securonix_retry_count,
                status_list_to_retry=status_list_to_retry,
                backoff_factor=self._securonix_retry_delay,
                raise_on_redirect=False,
                raise_on_status=True,
            )

        try:
            demisto.debug(f"Making HTTP request with URL {FULL_URL}")
            result = self.session.request(
                method,
                FULL_URL,
                params=params,
                headers=headers,
                verify=self._verify,
                json=json,
                data=data,
            )
            if result.status_code == 403 and regenerate_access_token:
                self._token = self._generate_token()
                headers["token"] = self._token
                return self.http_request(method, url_suffix, headers, params, response_type, json, data, False)
            if not result.ok:
                raise ValueError(f"Error in API call to Securonix {result.status_code}. Reason: {result.text}")
            try:
                if url_suffix == "/incident/attachments":
                    return result
                if response_type != "json":
                    return result.text
                return result.json()
            except Exception:
                raise ValueError(f"Failed to parse http response to JSON format. Original response body: \n{result.text}")

        except requests.exceptions.ConnectTimeout as exception:
            err_msg = (
                "Connection Timeout Error - potential reasons might be that the Server URL parameter"
                " is incorrect or that the Server is not accessible from your host."
            )
            raise Exception(f"{err_msg}\n{exception}")

        except requests.exceptions.SSLError as exception:
            err_msg = (
                "SSL Certificate Verification Failed - try selecting 'Trust any certificate' checkbox in"
                " the integration configuration."
            )
            raise Exception(f"{err_msg}\n{exception}")

        except requests.exceptions.ProxyError as exception:
            err_msg = (
                "Proxy Error - if the 'Use system proxy' checkbox in the integration configuration is"
                " selected, try clearing the checkbox."
            )
            raise Exception(f"{err_msg}\n{exception}")

        except requests.exceptions.ConnectionError as exception:
            error_class = str(exception.__class__)
            err_type = "<" + error_class[error_class.find("'") + 1 : error_class.rfind("'")] + ">"  # noqa: E203
            err_msg = (
                f"Error Type: {err_type}\n"
                f"Error Number: [{exception.errno}]\n"
                f"Message: {exception.strerror}\n"
                f"Verify that the tenant parameter is correct "
                f"and that you have access to the server from your host."
            )
            raise Exception(f"{err_msg}\n{exception}")

        except requests.exceptions.RetryError as exception:
            try:
                reason = f"Reason: {exception.args[0].reason.args[0]}"  # pylint: disable=no-member
            except Exception:  # noqa: disable=broad-except
                reason = ""
            err_msg = (
                f"Max Retries Error: Request attempts with {self._securonix_retry_count} retries and with "
                f"{self._securonix_retry_delay} seconds {self._securonix_retry_delay_type} delay "
                f"failed.\n{reason}"
            )
            if self._securonix_retry_delay_type == "Exponential":
                # For Exponential delay we are dividing it by 2 so for error message make it to original value
                err_msg = (
                    f"Max Retries Error: Request attempts with {self._securonix_retry_count} retries and with"
                    f" {self._securonix_retry_delay * 2} seconds {self._securonix_retry_delay_type} delay "
                    f"failed.\n{reason}"
                )
            demisto.error(err_msg)
            raise Exception(f"{err_msg}\n{exception}")

        except requests.exceptions.InvalidHeader as exception:
            set_integration_context({})
            raise Exception(f"Invalid token generated from the API.\n{exception}")

        except Exception as exception:
            raise Exception(str(exception))

    def _generate_token(self) -> str:
        """Generate a token

        Returns:
            token valid for 1 day
        """
        demisto.info("Generating new access token.")
        headers = {
            "username": self._username,
            "password": self._password,
            "validity": "1",
        }
        token = self.http_request("GET", "/token/generate", headers=headers, response_type="text")

        set_integration_context({"token": token})
        return token

    def list_workflows_request(self) -> dict:
        """List workflows.

        Returns:
            Response from API.
        """
        workflows = self.http_request("GET", "/incident/get", headers={"token": self._token}, params={"type": "workflows"})
        return workflows.get("result").get("workflows")

    def get_default_assignee_for_workflow_request(self, workflow: str) -> dict:
        """Get default assignee for a workflow..

        Args:
            workflow: workflow name

        Returns:
            Response from API.
        """
        params = {"type": "defaultAssignee", "workflow": workflow}
        default_assignee = self.http_request("GET", "/incident/get", headers={"token": self._token}, params=params)
        return default_assignee.get("result")

    def list_possible_threat_actions_request(self) -> dict:
        """List possible threat actions.

        Returns:
            Response from API.
        """

        threat_actions = self.http_request(
            "GET", "/incident/get", headers={"token": self._token}, params={"type": "threatActions"}
        )
        return threat_actions.get("result")

    def list_policies_request(self) -> dict:
        """List policies.

        Returns:
            Response from API.
        """

        policies = self.http_request("GET", "/policy/getAllPolicies", headers={"token": self._token}, response_type="xml")
        return policies

    def list_resource_groups_request(self) -> dict:
        """List resource groups.

        Returns:
            Response from API.
        """

        resource_groups = self.http_request("GET", "/list/resourceGroups", headers={"token": self._token}, response_type="xml")
        return resource_groups

    def list_users_request(self) -> dict:
        """List users.

        Returns:
            Response from API.
        """

        users = self.http_request("GET", "/list/allUsers", headers={"token": self._token}, response_type="xml")
        return users

    def list_activity_data_request(self, from_: str, to_: str, query: str = None, max_records: int = None) -> dict:
        """List activity data.

        Args:
            from_: eventtime start range in format MM/dd/yyyy HH:mm:ss.
            to_: eventtime end range in format MM/dd/yyyy HH:mm:ss.
            query: open query.
            max_records: maximum number of activity records to retrieve.

        Returns:
            Response from API.
        """
        params = {"query": "index=activity", "eventtime_from": from_, "eventtime_to": to_, "prettyJson": True}
        if max_records is not None:
            params["max"] = max_records
        remove_nulls_from_dictionary(params)
        if query:
            if re.findall(r"index\s*=\s*\w+", query):
                params["query"] = query
            else:
                params["query"] = f"{params['query']} AND {query}"
        activity_data = self.http_request("GET", "/spotter/index/search", headers={"token": self._token}, params=params)
        return activity_data

    def list_violation_data_request(
        self, from_: str, to_: str, query: str = None, query_id: str = None, max_violations: int | None = 1000
    ) -> dict:
        """List violation data.

        Args:
            from_: eventtime start range in format MM/dd/yyyy HH:mm:ss.
            to_: eventtime end range in format MM/dd/yyyy HH:mm:ss.
            query: open query.
            query_id: query_id to paginate violations.
            max_violations: max number of violations to return.

        Returns:
            Response from API.
        """
        params = {
            "query": "index=violation",
            "generationtime_from": from_,
            "generationtime_to": to_,
            "queryId": query_id,
            "prettyJson": True,
            "max": max_violations,
        }
        if query:
            if re.findall(r"index\s*=\s*\w+", query):
                params["query"] = query
            else:
                params["query"] = f"{params['query']} AND {query}"

        remove_nulls_from_dictionary(params)
        violation_data = self.http_request("GET", "/spotter/index/search", headers={"token": self._token}, params=params)
        return violation_data

    def list_incidents_request(
        self, from_epoch: str, to_epoch: str, incident_status: str, max_incidents: str = "200", offset: str = "0"
    ) -> dict:
        """List all incidents by sending a GET request.

        Args:
            from_epoch: from time in epoch
            to_epoch: to time in epoch
            incident_status: incident status e.g:closed, opened
            max_incidents: max incidents to get
            offset: offset to be used

        Returns:
            Response from API.
        """
        headers = {"token": self._token, "Accept": "application/vnd.snypr.app-v6.0+json"}
        params = {
            "type": "list",
            "from": from_epoch,
            "to": to_epoch,
            "rangeType": incident_status,
            "max": max_incidents,
            "order": "asc",
            "offset": offset,
        }
        incidents = self.http_request("GET", "/incident/get", headers=headers, params=params)
        return incidents.get("result").get("data")

    def get_incident_request(self, incident_id: str) -> dict:
        """get incident meta data by sending a GET request.

        Args:
            incident_id: incident ID.

        Returns:
            Response from API.
        """
        headers = {"token": self._token, "Accept": "application/vnd.snypr.app-v6.0+json"}
        params = {
            "type": "metaInfo",
            "incidentId": incident_id,
        }
        incident = self.http_request("GET", "/incident/get", headers=headers, params=params)
        return incident.get("result").get("data")

    def get_incident_status_request(self, incident_id: str) -> dict:
        """get incident meta data by sending a GET request.

        Args:
            incident_id: incident ID.

        Returns:
            Response from API.
        """
        params = {
            "type": "status",
            "incidentId": incident_id,
        }
        incident = self.http_request("GET", "/incident/get", headers={"token": self._token}, params=params)
        return incident.get("result")

    def get_incident_workflow_request(self, incident_id: str) -> dict:
        """get incident workflow by sending a GET request.

        Args:
            incident_id: incident ID.

        Returns:
            Response from API.
        """
        params = {
            "type": "workflow",
            "incidentId": incident_id,
        }
        incident = self.http_request("GET", "/incident/get", headers={"token": self._token}, params=params)
        return incident.get("result")

    def get_incident_available_actions_request(self, incident_id: str) -> dict:
        """get incident available actions by sending a GET request.

        Args:
            incident_id: incident ID.

        Returns:
            Response from API.
        """
        params = {
            "type": "actions",
            "incidentId": incident_id,
        }
        incident = self.http_request("GET", "/incident/get", headers={"token": self._token}, params=params)
        return incident.get("result")

    def get_incident_attachments_request(
        self, incident_id, attachment_type: str = None, attachment_from: int = None, attachment_to: int = None
    ):
        """Get incident attachments by sending a GET request.

        Args:
            incident_id: Incident ID.
            attachment_type: The type of attachment to retrieve. Supported options are
            csv, pdf, and txt. Comma-separated values are supported.
            attachment_from: Start time for which to retrieve attachments. (in the format YYYY-MM-DDTHH:MM:SS format)
            attachment_to: End time for which to retrieve attachments. (in the in the format YYYY-MM-DDTHH:MM:SS format)
            format)

        Returns:
            Response from API.
        """
        params = {
            "incidentId": incident_id,
            "attachmenttype": attachment_type,
            "datefrom": attachment_from,
            "dateto": attachment_to,
        }
        remove_nulls_from_dictionary(params)
        attachment_res = self.http_request("GET", "/incident/attachments", headers={"token": self._token}, params=params)
        return attachment_res

    def perform_action_on_incident_request(self, incident_id, action: str, action_parameters: str) -> dict:
        """get incident available actions by sending a GET request.

        Args:
            incident_id: incident ID.
            action: action to perform on the incident.
            action_parameters: parameters needed in order to perform the action.

        Returns:
            Response from API.
        """

        params = {"type": "actionInfo", "incidentId": incident_id, "actionName": action}
        if action_parameters:
            action_parameters_dict = {k: v.strip('"') for k, v in [i.split("=", 1) for i in action_parameters.split(",")]}
            params.update(action_parameters_dict)

        possible_action = self.http_request("GET", "/incident/get", headers={"token": self._token}, params=params)

        if "error" in possible_action:
            err_msg = possible_action.get("error")
            raise Exception(
                f"Failed to perform the action {action} on incident {incident_id}.\nError from Securonix is: {err_msg}"
            )

        incident = self.http_request("POST", "/incident/actions", headers={"token": self._token}, params=params)
        return incident.get("result")

    def add_comment_to_incident_request(self, incident_id: str, comment: str) -> dict:
        """add comment to an incident by sending a POST request.

        Args:
            incident_id: incident ID.
            comment: action to perform on the incident

        Returns:
            Response from API.
        """
        params = {"incidentId": incident_id, "comment": comment, "actionName": "comment"}
        incident = self.http_request("POST", "/incident/actions", headers={"token": self._token}, params=params)
        return incident.get("result")

    def create_incident_request(
        self,
        violation_name: str,
        resource_group: str,
        resource_name: str,
        entity_type: str,
        entity_name: str,
        action_name: str,
        workflow: str = None,
        comment: str = None,
        criticality: str = None,
    ) -> dict:
        """create an incident by sending a POST request.

        Args:
            violation_name: violation or policy name.
            resource_group: resource group name.
            resource_name: resource name.
            entity_type: entity type.
            entity_name: entity name.
            action_name: action name.
            workflow: workflow name.
            comment: comment on the incident.
            criticality: criticality for the incident.

        Returns:
            Response from API.
        """
        params = {
            "violationName": violation_name,
            "datasourceName": resource_group,
            "resourceName": resource_name,
            "entityType": entity_type,
            "entityName": entity_name,
            "actionName": action_name,
        }
        if workflow:
            params["workflow"] = workflow
        if comment:
            params["comment"] = comment
        if criticality:
            params["criticality"] = criticality

        response = self.http_request("POST", "/incident/actions", headers={"token": self._token}, params=params)
        return response

    def list_watchlist_request(self):
        """list watchlists by sending a GET request.

        Returns:
            Response from API.
        """
        watchlists = self.http_request("GET", "/incident/listWatchlist", headers={"token": self._token})
        return watchlists.get("result")

    def get_watchlist_request(self, watchlist_name: str) -> dict:
        """Get a watchlist by sending a GET request.

        Args:
            watchlist_name: watchlist name.

        Returns:
            Response from API.
        """
        params = {
            "query": f'index=watchlist AND watchlistname="{watchlist_name}"',
        }
        watchlist = self.http_request("GET", "/spotter/index/search", headers={"token": self._token}, params=params)
        return watchlist

    def create_watchlist_request(self, watchlist_name: str, tenant_name: str) -> dict:
        """Create a watchlist by sending a POST request.

        Args:
            watchlist_name: watchlist name.
            tenant_name: Name of the tenant the watchlist belongs to.

        Returns:
            Response from API.
        """
        params = {"watchlistname": watchlist_name, "tenantname": tenant_name}
        remove_nulls_from_dictionary(params)
        watchlist = self.http_request(
            "POST", "/incident/createWatchlist", headers={"token": self._token}, params=params, response_type="text"
        )
        return watchlist

    def check_entity_in_watchlist_request(self, entity_name: str, watchlist_name: str) -> dict:
        """Check if an entity is whitelisted by sending a GET request.

        Args:
            entity_name: Entity name.
            watchlist_name: Watchlist name.

        Returns:
            Response from API.
        """
        params = {"entityId": entity_name, "watchlistname": watchlist_name}
        response = self.http_request("GET", "/incident/checkIfWatchlisted", headers={"token": self._token}, params=params)
        return response

    def add_entity_to_watchlist_request(self, watchlist_name: str, entity_type: str, entity_name: str, expiry_days: str) -> dict:
        """Check if an entity is whitelisted by sending a GET request.

        Args:
            watchlist_name: Watchlist name.
            entity_type: Entity type.
            entity_name: Entity name.
            expiry_days: Expiry in days.
        Returns:
            Response from API.
        """
        params = {
            "watchlistname": watchlist_name,
            "entityType": entity_type,
            "entityId": entity_name,
            "expirydays": expiry_days,
            "resourcegroupid": "-1",
        }
        watchlist = self.http_request(
            "POST", "/incident/addToWatchlist", headers={"token": self._token}, params=params, response_type="txt"
        )
        return watchlist

    def list_threats_request(
        self, from_epoch: int, to_epoch: int, tenant_name: str, offset: int = 0, max_incidents: int = 10
    ) -> dict:
        """List all threats by sending a GET request.

        Args:
            from_epoch: from time in epoch
            to_epoch: to time in epoch
            tenant_name: tenant name
            offset: A page number to fetch from
            max_incidents: max incidents to get

        Returns:
            Response from API.
        """
        params = {
            "datefrom": from_epoch,
            "dateto": to_epoch,
            "tenantname": tenant_name,
            "max": max_incidents,
            "offset": offset,
        }
        headers = {"token": self._token, "Accept": "application/vnd.snypr.app-v1.0+json"}

        remove_nulls_from_dictionary(params)
        response = self.http_request("GET", "/sccWidget/getThreats", headers=headers, params=params)
        return response.get("Response", {}).get("threats", {})

    def get_incident_activity_history_request(self, incident_id: str) -> list:
        """Get incident activity history by sending a GET request.

        Args:
            incident_id (str): Incident ID for which to retrieve the activity history.

        Returns:
            Response from API.
        """
        params = {
            "type": "activityStreamInfo",
            "incidentId": incident_id,
        }
        incident = self.http_request("GET", "/incident/get", headers={"token": self._token}, params=params)
        return incident.get("result", {}).get("activityStreamData", [])

    def list_whitelists_request(self, tenant_name: str) -> list:
        """Get a whitelist information by sending a GET request.

        Args:
            tenant_name: Name of the tenant the whitelist belongs to.

        Returns:
            Response from API.
        """
        params = {"tenantname": tenant_name}
        remove_nulls_from_dictionary(params)
        whitelist = self.http_request("GET", "/incident/getlistofWhitelist", headers={"token": self._token}, params=params)
        return whitelist.get("result", [])

    def get_whitelist_entry_request(self, tenant_name: str, whitelist_name: str) -> dict:
        """Get a whitelist information by sending a GET request.

        Args:
            tenant_name: Name of the tenant the whitelist belongs to.
            whitelist_name: Name of the whitelist.

        Returns:
            Response from API.
        """
        params = {"tenantname": tenant_name, "whitelistname": whitelist_name}
        remove_nulls_from_dictionary(params)
        whitelist = self.http_request("GET", "/incident/listWhitelistEntities", headers={"token": self._token}, params=params)
        return whitelist.get("result", {})

    def add_whitelist_entry_request(
        self,
        tenant_name: str,
        whitelist_name: str,
        whitelist_type: str,
        entity_type: str,
        entity_id: str,
        expiry_date: str,
        resource_name: str,
        resource_group_id: str,
        attribute_name: str,
        attribute_value: str,
        violation_type: str,
        violation_name: str,
    ):
        """Add entry in whitelist by sending a POST request.

        Args:
            tenant_name: Name of the tenant the whitelist belongs to.
            whitelist_name: Name of the whitelist.
            whitelist_type: Type of the whitelist.
            entity_type: Entity Type is required if whitelist is global.
            entity_id: Entity ID is required if whitelist is global.
            expiry_date: Expiry Date in format(MM/DD/YYYY).
            resource_name: Resource name which the account belongs to.
            resource_group_id: Resource Group ID which the account belongs to.
            attribute_name: Attribute name.
            attribute_value: Attribute Value.
            violation_type: Violation Type.
            violation_name: Violation Name.

        Returns:
            Response from API.
        """
        params = {
            "tenantname": tenant_name,
            "whitelistname": whitelist_name,
            "whitelisttype": whitelist_type,
            "entitytype": entity_type,
            "entityid": entity_id,
            "expirydate": expiry_date,
            "resourcename": resource_name,
            "resourcegroupid": resource_group_id,
            "attributename": attribute_name,
            "attributevalue": attribute_value,
            "violationtype": violation_type,
            "violationname": violation_name,
        }
        remove_nulls_from_dictionary(params)
        response = self.http_request("POST", "/incident/addToWhitelist", headers={"token": self._token}, params=params)
        return response

    def create_whitelist_request(self, tenant_name: str, whitelist_name: str, entity_type: str) -> dict:
        """Create a whitelist by sending a POST request.

        Args:
            tenant_name: Name of the tenant the whitelist belongs to.
            whitelist_name: Name of the whitelist.
            entity_type: Type of entity that the whitelist is intended to hold.

        Returns:
            Response from API.
        """
        params = {"tenantname": tenant_name, "whitelistname": whitelist_name, "entitytype": entity_type}
        remove_nulls_from_dictionary(params)
        whitelist = self.http_request("POST", "/incident/createGlobalWhitelist", headers={"token": self._token}, params=params)
        return whitelist

    def delete_whitelist_entry_request(
        self,
        tenant_name: str,
        whitelist_name: str,
        whitelist_type: str,
        entity_id: str,
        attribute_name: str,
        attribute_value: str,
    ) -> dict:
        """Delete a whitelist entry by sending POST request.

        Args:
            tenant_name: Name of the tenant the whitelist belongs to.
            whitelist_name: Name of the whitelist.
            whitelist_type: Type of whitelist that user wants to delete from.
            entity_id: Entity ID value that needs to be removed from the whitelist.
            attribute_name: Name of the attribute being removed.
            attribute_value: The value of the attribute being removed.

        Returns:
            Response from API.
        """
        params = {
            "tenantname": tenant_name,
            "whitelistname": whitelist_name,
            "whitelisttype": whitelist_type,
            "entityid": entity_id,
            "attributename": attribute_name,
            "attributevalue": attribute_value,
        }
        remove_nulls_from_dictionary(params)
        return self.http_request("GET", "/incident/removeFromWhitelist", headers={"token": self._token}, params=params)

    def delete_lookup_table_config_and_data_request(self, name: str) -> str:
        """Delete a lookup table and its configuration data from Securonix.

        Args:
            name (str): Name of the lookup table.

        Returns:
            str: Response from API.
        """
        params = {"lookupTableName": name}
        return self.http_request(
            "DELETE",
            "/lookupTable/deleteLookupConfigAndData",
            headers={"token": self._token},
            params=params,
            response_type="text",
        )

    def get_lookup_tables_request(self, max_records: int | None = 50, offset: int | None = 0) -> list:
        """Get the list of lookup tables stored on the Securonix platform.

        Args:
            max_records (Optional[int]): Number of records to return. Default value is 50.
            offset (Optional[int]): Specify from which record the data should be returned.

        Returns:
            Response from API.
        """
        params = {"max": max_records, "offset": offset}
        return self.http_request("GET", "/lookupTable/listLookupTables", headers={"token": self._token}, params=params)

    def add_entry_to_lookup_table_request(self, name: str, entries: list[dict], tenant_name: str | None = None) -> str:
        """Adds the provided entries to the specified lookup table.

        Args:
            name (str): Name of the lookup table in which to add the data.
            entries (List[Dict]): List of entries to add to the table.
            tenant_name (Optional[str]): Tenant name to which the lookup table belongs to.
        """
        body = {"lookupTableName": name, "tenantName": tenant_name, "lookupTableData": entries}
        remove_nulls_from_dictionary(body)
        return self.http_request(
            "POST", "/lookupTable/addLookupTableData", headers={"token": self._token}, json=body, response_type="text"
        )

    def list_lookup_table_entries_request(
        self,
        name: str,
        query: str | None = None,
        attribute: str | None = "key",
        max_records: int | None = 15,
        offset: int | None = 0,
        page_num: int | None = 1,
        sort: str | None = None,
        order: str | None = "asc",
    ) -> list:
        """List the entries of the lookup table.

        Args:
            name (str): Name of the lookup table.
            query (Optional[str], optional): Query to filter the entries of the lookup table. Defaults to None.
            attribute (Optional[str], optional): Column name on which to filter the data. Defaults to 'key'.
            max_records (Optional[int], optional): Number of records to retrieve. Defaults to 15.
            offset (Optional[int], optional): Specify from which record the data should be returned. Defaults to 0.
            page_num (Optional[int], optional): Specify a value to retrieve the records from a specified page.
                Defaults to 1.
            sort (Optional[str]): Name of the column on which to sort the data.
            order (Optional[str]): The order in which to sort the data.

        Returns:
            List: List of lookup table entries.
        """
        headers = {"token": self._token, "Content-Type": "application/json"}

        body = {
            "lookupTableName": name,
            "query": query,
            "attribute": attribute,
            "max": max_records,
            "offset": offset,
            "pagenum": page_num,
            "sort": sort,
            "order": order,
        }
        remove_nulls_from_dictionary(body)
        payload = json.dumps(body)

        return self.http_request("GET", "/lookupTable/getLookupTableData", headers=headers, data=payload)

    def create_lookup_table_request(
        self, tenant_name: str, name: str, scope: str, field_names: list, encrypt: list, key: list
    ) -> dict:
        """Create a lookup table by sending a POST request.

        Args:
            tenant_name: Name of the tenant the whitelist belongs to.
            name: Lookup table name.
            scope: Scope of lookup table.
            field_names: Field names for lookup table.
            encrypt: Field name which data needs to be encrypted.
            key: Field name to be used as key.

        Returns:
            Response from API.
        """
        data: dict[str, Any] = {"lookupTableName": name, "lookupTableScope": scope, "tenantName": tenant_name}
        field_list: list = []
        for field in field_names:
            field_dic = {"fieldName": field, "encrypt": field in encrypt, "key": field in key}
            field_list.append(field_dic)
        data.update({"lookupFieldList": field_list})
        remove_nulls_from_dictionary(data)
        response = self.http_request(
            "POST", "/lookupTable/createLookupTable", headers={"token": self._token}, json=data, response_type="text"
        )
        return response

    def delete_lookup_table_entries(self, name: str, lookup_unique_keys: list[str]) -> str:
        """Delete entries from the lookup table.

        Args:
            name (str): Name of the lookup table.
            lookup_unique_keys (List[str]): List of keys to delete from the lookup table.

        Returns:
            str: Response from API.
        """
        data: dict[str, Any] = {"lookupTableName": name, "keyList": lookup_unique_keys}
        response = self.http_request(
            "DELETE", "/lookupTable/deleteLookupKeys", headers={"token": self._token}, json=data, response_type="text"
        )
        return response


def test_module(client: Client) -> str:
    """
    Performs basic get request to get incident samples
    """
    params = demisto.params()
    client.list_workflows_request()

    if params.get("isFetch"):
        validate_configuration_parameters(params)
        validate_mirroring_parameters(params=params)

        timestamp_format = "%Y-%m-%dT%H:%M:%S.%fZ"
        from_epoch = date_to_timestamp(parse_date_range("1 day", utc=True)[0], date_format=timestamp_format)
        to_epoch = date_to_timestamp(datetime.now(), date_format=timestamp_format)
        client.list_incidents_request(from_epoch, to_epoch, incident_status="opened")

    return "ok"


def list_workflows(client: Client, *_) -> tuple[str, dict, dict]:
    """List all workflows.

    Args:
        client: Client object with request.
        *_:

    Returns:
        Outputs.
    """
    workflows = client.list_workflows_request()
    workflows_readable, workflows_outputs = parse_data_arr(workflows)
    human_readable = tableToMarkdown(
        name="Available workflows:", t=workflows_readable, headers=["Workflow", "Type", "Value"], removeNull=True
    )
    entry_context = {"Securonix.Workflows(val.Workflow == obj.Workflow)": workflows_outputs}
    return human_readable, entry_context, workflows


def get_default_assignee_for_workflow(client: Client, args: dict) -> tuple[str, dict, dict]:
    """Perform action on an incident.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    workflow = str(args.get("workflow"))
    default_assignee = client.get_default_assignee_for_workflow_request(workflow)
    workflow_output = {
        "Workflow": workflow,
        "Type": default_assignee.get("type"),
        "Value": default_assignee.get("value"),
    }
    entry_context = {"Securonix.Workflows(val.Workflow === obj.Workflow)": workflow_output}
    human_readable = f"Default assignee for the workflow {workflow} is: {default_assignee.get('value')}."
    return human_readable, entry_context, default_assignee


def list_possible_threat_actions(client: Client, *_) -> tuple[str, dict, dict]:
    """List all workflows.

    Args:
        client: Client object with request.
        *_:

    Returns:
        Outputs.
    """
    threat_actions = client.list_possible_threat_actions_request()
    human_readable = f"Possible threat actions are: {', '.join(threat_actions)}."
    entry_context = {"Securonix.ThreatActions": threat_actions}
    return human_readable, entry_context, threat_actions


def list_policies(client: Client, *_) -> tuple[str, dict, dict]:
    """List all policies.

    Args:
        client: Client object with request.
        *_:

    Returns:
        Outputs.
    """
    policies_xml = client.list_policies_request()
    policies_json = xml2json(policies_xml)
    policies = json.loads(policies_json)
    policies_arr = policies.get("policies").get("policy")
    policies_readable, policies_outputs = parse_data_arr(policies_arr)
    headers = ["ID", "Name", "Criticality", "Created On", "Created By", "Description"]
    human_readable = tableToMarkdown(name="Policies:", t=policies_readable, headers=headers, removeNull=True)
    entry_context = {"Securonix.Policies(val.ID === obj.ID)": policies_outputs}

    return human_readable, entry_context, policies


def list_resource_groups(client: Client, *_) -> tuple[str, dict, dict]:
    """List all resource groups.

    Args:
        client: Client object with request.
        *_:

    Returns:
        Outputs.
    """
    resource_groups_xml = client.list_resource_groups_request()

    resource_groups_json = xml2json(resource_groups_xml)
    resource_groups = json.loads(resource_groups_json)
    resource_groups_arr = resource_groups.get("resourceGroups").get("resourceGroup")

    resource_groups_readable, resource_groups_outputs = parse_data_arr(resource_groups_arr)
    headers = ["Name", "Type"]
    human_readable = tableToMarkdown(name="Resource groups:", t=resource_groups_readable, headers=headers, removeNull=True)
    entry_context = {"Securonix.ResourceGroups(val.Name === obj.Name)": resource_groups_outputs}

    return human_readable, entry_context, resource_groups


def list_users(client: Client, *_) -> tuple[str, dict, dict]:
    """List all users.

    Args:
        client: Client object with request.
        *_:

    Returns:
        Outputs.
    """
    users_xml = client.list_users_request()

    users_json = xml2json(users_xml)
    users = json.loads(users_json)
    users_arr = users.get("users").get("user")

    users_readable, users_outputs = parse_data_arr(users_arr)
    headers = ["Employee Id", "First Name", "Last Name", "Criticality", "Title", "Email"]
    human_readable = tableToMarkdown(name="Resource groups:", t=users_readable, headers=headers, removeNull=True)
    entry_context = {"Securonix.Users(val.EmployeeID === obj.EmployeeID)": users_outputs}

    return human_readable, entry_context, users


def list_activity_data(client: Client, args) -> tuple[str, dict, dict]:
    """List activity data.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    from_ = args.get("from", "").strip()
    to_ = args.get("to", "").strip()
    query = escape_spotter_query(args.get("query", "").strip())
    max_records = arg_to_number(args.get("max", "1000"), arg_name="max")

    if max_records is not None and (max_records < 1 or max_records > 10000):
        raise ValueError(MESSAGE["INVALID_MAX_VALUE"])

    activity_data = client.list_activity_data_request(from_, to_, query, max_records)  # type: ignore

    if activity_data.get("error"):
        raise Exception(
            f"Failed to get activity data in the given time frame.\nError from Securonix is: {activity_data.get('errorMessage')}"
        )

    activity_events = activity_data.get("events")
    activity_readables, activity_outputs = parse_data_arr(activity_events)
    for index, activity in enumerate(activity_readables):
        if activity.get("Eventid"):
            activity["EventID"] = activity.get("Eventid")
            del activity["Eventid"]
        if index < len(activity_outputs) and activity_outputs[index].get("Eventid"):
            activity_outputs[index]["EventID"] = activity_outputs[index].get("Eventid")
            del activity_outputs[index]["Eventid"]
        if "Timeline" in activity:
            activity["Timeline"] = timestamp_to_datestring(activity.get("Timeline", 0), is_utc=True)
    headers = ["EventID", "Eventtime", "Message", "Accountname", "Timeline", "Devicehostname", "Accountresourcekey"]
    human_readable = tableToMarkdown(
        name="Activity data:",
        t=[
            {key: string_escape_MD(value) for key, value in activity_readable.items()} for activity_readable in activity_readables
        ],
        headers=headers,
        removeNull=True,
    )

    pagination_data = {
        "totalDocuments": activity_data.get("totalDocuments"),
        "message": activity_data.get("message"),
        "queryId": activity_data.get("queryId"),
        "command_name": "securonix-list-activity-data",
    }

    entry_context = {"Securonix.Activity(val.command_name === obj.command_name)": remove_empty_elements(pagination_data)}

    activity_outputs = remove_empty_elements(activity_outputs)
    if activity_outputs:
        entry_context["Securonix.ActivityData(val.EventID === obj.EventID)"] = activity_outputs

    return human_readable, entry_context, activity_data


def list_violation_data(client: Client, args) -> list[CommandResults]:
    """List violation data.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    from_ = args.get("from", "").strip()
    to_ = args.get("to", "").strip()
    query = escape_spotter_query(args.get("query", "").strip())
    query_id = args.get("query_id", "").strip()
    max_violations = arg_to_number(args.get("max", "1000"))

    if max_violations is not None and max_violations <= 0:
        raise ValueError(MESSAGE["INVALID_MAX_VALUE"])

    violation_data = client.list_violation_data_request(from_, to_, query, query_id, max_violations)

    if violation_data.get("error"):
        raise Exception(
            f"Failed to get violation data in the given time frame.\n"
            f"Error from Securonix is: {violation_data.get('errorMessage')}"
        )
    violation_events = violation_data.get("events")
    if len(violation_events) > 0:  # type: ignore[arg-type]
        violation_readables, violation_outputs = parse_data_arr(violation_events)
        headers = ["EventID", "Eventtime", "Message", "Policyname", "Accountname"]
        human_readable = tableToMarkdown(
            name="Activity data:",
            t=[
                {key: string_escape_MD(value) for key, value in violation_readable.items()}
                for violation_readable in violation_readables
            ],
            headers=headers,
            removeNull=True,
        )

        data = {
            "totalDocuments": violation_data.get("totalDocuments"),
            "message": violation_data.get("message"),
            "queryId": violation_data.get("queryId"),
        }

        return [
            CommandResults(
                outputs_prefix="Securonix.ViolationData",
                readable_output=human_readable,
                outputs=remove_empty_elements(violation_outputs),
                raw_response=violation_data,
                outputs_key_field=[
                    "Policyname",
                    "Violator",
                    "Resourcegroupid",
                    "Tenantname",
                    "Resourcename",
                    "EmployeeID",
                    "Accountname",
                    "Ipaddress",
                ],
            ),
            CommandResults(
                outputs_prefix="Securonix.Violation",
                outputs=remove_empty_elements(data),
                readable_output=f"#### Next page query id: {data.get('queryId')}",
            ),
        ]
    else:
        return [CommandResults(readable_output="There are no violation events.", outputs={}, raw_response=violation_data)]


def run_polling_command(client, args: dict, command_name: str, search_function: Callable):
    """
    For Scheduling command.

    Args:
        client: Client object with request.
        args: Command arguments.
        command_name: Name of the command.
        search_function: Callable object of command.

    Returns:
        Outputs.
    """
    command_results = []
    result = search_function(client, args)
    command_results.append(result)
    outputs = result[0].raw_response.get("events")
    delay_type = client.get_securonix_retry_delay_type()
    retry_count: int = client.get_securonix_retry_count()
    retry_delay: int = client.get_securonix_retry_delay()

    if len(outputs) == 0 and retry_count > 0:
        if delay_type == "Exponential":
            retry_delay = client.get_securonix_retry_delay() * 2
        retry_timeout: int = retry_delay * retry_count + retry_count * 1
        policy_type = args.get("policy_type", "").strip().upper()
        if policy_type in POLICY_TYPES_TO_RETRY:
            args["to"] = datetime.now().astimezone(timezone.utc).strftime(r"%m/%d/%Y %H:%M:%S")
        polling_args = {"polling": True, **args}
        scheduled_command = ScheduledCommand(
            command=command_name, next_run_in_seconds=retry_delay, args=polling_args, timeout_in_seconds=retry_timeout
        )
        command_results.append(CommandResults(scheduled_command=scheduled_command))
        return command_results
    return result


def list_incidents(client: Client, args: dict) -> tuple[str, dict, dict]:
    """List incidents.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    timestamp_format = "%Y-%m-%dT%H:%M:%S.%fZ"
    from_, _ = parse_date_range(args.get("from"), utc=True)
    from_epoch = date_to_timestamp(from_, date_format=timestamp_format)
    to_ = args.get("to") if "to_" in args else datetime.now()
    to_epoch = date_to_timestamp(to_, date_format=timestamp_format)
    incident_types = str(args.get("incident_types")) if "incident_types" in args else "opened"
    max_incidents = str(args.get("max", "50"))
    incidents = client.list_incidents_request(from_epoch, to_epoch, incident_types, max_incidents)

    total_incidents = incidents.get("totalIncidents")
    if not total_incidents or float(total_incidents) <= 0.0:
        return "No incidents where found in this time frame.", {}, incidents

    incidents_items: list = incidents.get("incidentItems", [])
    incidents_readables, incidents_outputs = parse_data_arr(incidents_items)
    headers = ["IncidentID", "Incident Status", "Incident Type", "Priority", "Reason"]
    human_readable = tableToMarkdown(
        name="Incidents:",
        t=[
            {key: string_escape_MD(value) for key, value in incidents_readable.items()}
            for incidents_readable in incidents_readables
        ],
        headers=headers,
        removeNull=True,
    )
    entry_context = {"Securonix.Incidents(val.IncidentID === obj.IncidentID)": incidents_outputs}
    return human_readable, entry_context, incidents


def get_incident(client: Client, args: dict) -> tuple[str, dict, dict]:
    """Get incident.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    incident_id = str(args.get("incident_id"))
    incident = client.get_incident_request(incident_id)

    incident_items = incident.get("incidentItems")
    if not incident_items:
        raise Exception("Incident ID is not in Securonix.")
    incident_readables, incident_outputs = parse_data_arr(incident_items)
    human_readable = tableToMarkdown(
        name="Incident:",
        t=[
            {key: string_escape_MD(value) for key, value in incident_readable.items()} for incident_readable in incident_readables
        ],
        removeNull=True,
    )
    entry_context = {"Securonix.Incidents(val.IncidentID === obj.IncidentID)": incident_outputs}
    return human_readable, entry_context, incident


def get_incident_status(client: Client, args: dict) -> tuple[str, dict, dict]:
    """Get incident.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    incident_id = str(args.get("incident_id"))
    incident = client.get_incident_status_request(incident_id)
    incident_status = incident.get("status")
    incident_outputs = {"IncidentID": incident_id, "IncidentStatus": incident_status}
    entry_context = {"Securonix.Incidents(val.IncidentID === obj.IncidentID)": incident_outputs}
    return f"Incident {incident_id} status is {incident_status}.", entry_context, incident


def get_incident_workflow(client: Client, args: dict) -> tuple[str, dict, dict]:
    """Get incident workflow.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    incident_id = str(args.get("incident_id"))

    incident = client.get_incident_workflow_request(incident_id)
    incident_workflow = incident.get("workflow")
    incident_outputs = {"IncidentID": incident_id, "WorkflowName": incident_workflow}
    entry_context = {"Securonix.Incidents(val.IncidentId === obj.IncidentId)": incident_outputs}
    return f"Incident {incident_id} workflow is {incident_workflow}.", entry_context, incident


def get_incident_available_actions(client: Client, args: dict) -> tuple[str, dict, dict]:
    """Get incident available actions.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    incident_id = str(args.get("incident_id"))

    incident_actions = client.get_incident_available_actions_request(incident_id)
    if not incident_actions:
        return f"Incident {incident_id} does not have any available actions.", {}, incident_actions
    actions = []
    for action_details in incident_actions:
        actions.append(action_details.get("actionName"))

    incident_outputs = {"IncidentID": incident_id, "AvailableActions": actions}
    entry_context = {"Securonix.Incidents(val.IncidentID === obj.IncidentID)": incident_outputs}
    return f"Incident {incident_id} available actions: {actions}.", entry_context, incident_actions


def get_incident_attachments(client: Client, args: dict, incident_id: str = None):
    """Get incident attachments.

    Args:
        client: Client object with request.
        args: Usually demisto.args()
        incident_id: Incident ID

    Returns:
        Outputs.
    """
    incident_id_ = args.get("incident_id", "").strip()
    attachment_type = ",".join(argToList(args.get("attachment_type")))
    attachment_from = args.get("from")
    attachment_to = args.get("to")
    if attachment_from:
        attachment_from = attachment_from.strip()
        attachment_from = date_to_timestamp(arg_to_datetime(attachment_from, arg_name="attachment_from"))
    if attachment_to:
        attachment_to = attachment_to.strip()
        attachment_to = date_to_timestamp(arg_to_datetime(attachment_to, arg_name="attachment_to"))

    if incident_id:
        attachments_res = client.get_incident_attachments_request(incident_id)
    else:
        attachments_res = client.get_incident_attachments_request(
            incident_id_,
            attachment_type,
            attachment_from,  # type: ignore
            attachment_to,
        )  # type: ignore
    try:
        # So if there is no attachments then in response status code will be 200 and in content there is json with
        # error field
        if "Content-Disposition" not in attachments_res.headers:
            return CommandResults(readable_output=f"#### No Attachments found for Incident ID: {incident_id_}")
    except requests.exceptions.JSONDecodeError:  # type: ignore
        # Here if API have attachments then it will return byte data so then res.json() raise decode error. Means we
        # received attachments that's in below code there is debug log
        demisto.debug("Retrieved attachment for incident.")

    content_disposition = attachments_res.headers.get("Content-Disposition")
    filename = content_disposition.split(";")[1].replace("filename=", "")
    file_list = []
    if filename.startswith(incident_id or incident_id_):
        zip_obj = ZipFile(io.BytesIO(attachments_res.content))
        zip_filenames = zip_obj.namelist()
        zip_obj.extractall(path=os.path.abspath(os.getcwd()))
        zip_obj.close()
        file_list.append(
            CommandResults(
                outputs_prefix="Securonix.Incidents.Attachments",
                outputs=[{"IncidentID": incident_id_, "Files": zip_filenames}],
                readable_output=f"### Incident ID: {incident_id_}",
            )
        )
        for name in zip_filenames:
            with open(name, "br") as file:
                file_list.append(fileResult(filename=name, data=file.read()))
        return file_list
    else:
        file_list.extend(
            [
                CommandResults(
                    outputs_prefix="Securonix.Incidents.Attachments",
                    outputs=[{"IncidentID": incident_id_, "Files": filename}],
                    readable_output=f"### Incident ID: {incident_id_}",
                ),
                fileResult(filename=filename, data=attachments_res.content),
            ]
        )
        return file_list


def perform_action_on_incident(client: Client, args: dict) -> tuple[str, dict, dict]:
    """Perform action on an incident.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    incident_id = str(args.get("incident_id"))
    action = str(args.get("action"))
    action_parameters = str(args.get("action_parameters", ""))
    incident_result = client.perform_action_on_incident_request(incident_id, action, action_parameters)
    if incident_result != "submitted":
        raise Exception(f"Failed to perform the action {action} on incident {incident_id}.")
    return f"Action {action} was performed on incident {incident_id}.", {}, incident_result


def add_comment_to_incident(client: Client, args: dict) -> tuple[str, dict, dict]:
    """Add comment to an incident.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    incident_id = str(args.get("incident_id"))
    comment = str(args.get("comment"))
    incident = client.add_comment_to_incident_request(incident_id, comment)
    if not incident:
        raise Exception(f"Failed to add comment to the incident {incident_id}.")
    return f"Comment was added to the incident {incident_id} successfully.", {}, incident


def create_incident(client: Client, args: dict) -> tuple[str, dict, dict]:
    """Create an incident.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    violation_name = str(args.get("violation_name"))
    resource_group = str(args.get("resource_group"))
    resource_name = str(args.get("resource_name"))
    entity_type = str(args.get("entity_type"))
    entity_name = str(args.get("entity_name"))
    action_name = str(args.get("action_name"))
    workflow = str(args.get("workflow")) if "workflow" in args else None
    comment = str(args.get("comment")) if "comment" in args else None
    criticality = str(args.get("criticality")) if "criticality" in args else None

    if "create incident" in action_name and not workflow:
        raise Exception(f"Creating an incident with the action: {action_name}, Supply a workflow.")
    response = client.create_incident_request(
        violation_name, resource_group, resource_name, entity_type, entity_name, action_name, workflow, comment, criticality
    )
    result = response.get("result")
    if not result:
        raise Exception(f"Failed to create the incident.\nResponse from Securonix is: {response!s}")

    message = response.get("messages")
    if message:
        if isinstance(message, list) and "Invalid" in message[0]:
            message = message[0]
            raise Exception(f"Failed to create the incident with message: \n{message}")
        if "Invalid" in message:
            raise Exception(f"Failed to create the incident with message: \n{message}")

    incident_data = result.get("data")
    incident_items = incident_data.get("incidentItems")
    incident_readable, incident_outputs = parse_data_arr(incident_items)
    headers = ["Entity", "Incident Status", "Incident Type", "IncidentID", "Priority", "Reason", "Url"]
    human_readable = tableToMarkdown(
        name="Incident was created successfully", t=incident_readable, headers=headers, removeNull=True
    )
    entry_context = {"Securonix.Incidents(val.IncidentID === obj.IncidentID)": incident_outputs}
    return human_readable, entry_context, response


def list_watchlists(client: Client, *_) -> tuple[str, dict, dict]:
    """List all watchlists.

    Args:
        client: Client object with request.

    Returns:
        Outputs.
    """
    watchlists = client.list_watchlist_request()
    if not watchlists:
        raise Exception("Failed to list watchlists.")

    human_readable = f"Watchlists: {', '.join(watchlists)}."
    entry_context = {"Securonix.WatchlistsNames": watchlists}
    return human_readable, entry_context, watchlists


def get_watchlist(client: Client, args) -> tuple[str, dict, dict]:
    """Get watchlist data.

    Args:
        client: Client object with request.
        args: Usually demisto.args()
    Returns:
        Outputs.
    """
    watchlist_name = args.get("watchlist_name", "").strip()
    watchlist = client.get_watchlist_request(watchlist_name)

    watchlist_events = watchlist.get("events")
    if not watchlist_events:
        raise Exception(
            "Watchlist does not contain items.\nMake sure the watchlist is not empty and that the watchlist name is correct."
        )
    fields_to_drop = ["decayflag", "tenantid", "tenantname", "watchlistname", "type"]
    watchlist_readable, watchlist_events_outputs = parse_data_arr(watchlist_events, fields_to_drop=fields_to_drop)
    watchlist_outputs = {
        "Watchlistname": watchlist_name,
        "Type": watchlist_events[0].get("type"),
        "TenantID": watchlist_events[0].get("tenantid"),
        "TenantName": watchlist_events[0].get("tenantname"),
        "Events": watchlist_events_outputs,
    }
    headers = ["Entityname", "Fullname", "Workemail", "Expired"]
    human_readable = tableToMarkdown(
        name=f"Watchlist {watchlist_name} of type {watchlist_outputs.get('Type')}: ",
        t=watchlist_readable,
        headers=headers,
        removeNull=True,
    )
    entry_context = {"Securonix.Watchlists(val.Watchlistname === obj.Watchlistname)": watchlist_outputs}
    return human_readable, entry_context, watchlist


def create_watchlist(client: Client, args) -> tuple[str, dict, dict]:
    """Create a watchlist.

    Args:
        client: Client object with request.
        args: Usually demisto.args()
    Returns:
        Outputs.
    """
    watchlist_name = args.get("watchlist_name", "").strip()
    tenant_name = args.get("tenant_name", "").strip()

    response = client.create_watchlist_request(watchlist_name, tenant_name)

    if "successfully" not in response:
        raise Exception(f"Failed to list watchlists.\nResponse from Securonix is: {response!s}")
    human_readable = f"Watchlist {watchlist_name} was created successfully."
    watchlist = {"Watchlistname": watchlist_name, "TenantName": tenant_name}
    remove_nulls_from_dictionary(watchlist)
    entry_context = {
        "Securonix.Watchlists(val.Watchlistname === obj.Watchlistname && val.TenantName === obj.TenantName)": watchlist
    }
    return human_readable, entry_context, response


def check_entity_in_watchlist(client: Client, args) -> tuple[str, dict, dict]:
    """Check if entity is in a watchlist.

    Args:
        client: Client object with request.
        args: Usually demisto.args()
    Returns:
        Outputs.
    """
    entity_name = args.get("entity_name")
    watchlist_name = args.get("watchlist_name")
    watchlist = client.check_entity_in_watchlist_request(entity_name, watchlist_name)

    result = watchlist.get("result")
    if result == "NO" or (isinstance(result, list) and result[0] == "NO"):
        human_readable = f"Entity unique identifier {entity_name} provided is not on the watchlist: {watchlist_name}."
        output = {"Entityname": entity_name}
    else:  # YES
        human_readable = f"The Entity unique identifier {entity_name} provided is on the watchlist: {watchlist_name}."
        output = {"Entityname": entity_name, "Watchlistname": watchlist_name}
    entry_context = {"Securonix.EntityInWatchlist(val.Entityname === obj.Entityname)": output}
    return human_readable, entry_context, watchlist


def add_entity_to_watchlist(client: Client, args) -> tuple[str, dict, dict]:
    """Adds an entity to a watchlist.

    Args:
        client: Client object with request.
        args: Usually demisto.args()
    Returns:
        Outputs.
    """
    watchlist_name = args.get("watchlist_name")
    entity_type = args.get("entity_type")
    entity_name = args.get("entity_name")
    expiry_days = args.get("expiry_days") if "expiry_days" in args else "30"

    response = client.add_entity_to_watchlist_request(watchlist_name, entity_type, entity_name, expiry_days)

    if "successfull" not in response:
        raise Exception(
            f"Failed to add entity {entity_name} to the watchlist {watchlist_name}.\nError from Securonix is: {response}."
        )
    human_readable = f"Added successfully the entity {entity_name} to the watchlist {watchlist_name}."
    return human_readable, {}, response


def list_threats(client: Client, args: dict[str, Any]) -> tuple[str, dict, dict]:
    """List threats violated within a specified time range and get details about the threat models and policies violated.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    date_from = date_to_timestamp(arg_to_datetime(args.get("date_from"), arg_name="date_from"))
    date_to = date_to_timestamp(
        arg_to_datetime(args.get("date_to", datetime.now().strftime("'%Y-%m-%dT%H:%M:%S'")), arg_name="date_to")
    )
    page_size = arg_to_number(args.get("page_size", 10), arg_name="page_size")
    tenant_name = args.get("tenant_name")
    offset = arg_to_number(args.get("offset", 0), arg_name="offset")

    threat_response = client.list_threats_request(date_from, date_to, tenant_name, offset, page_size)  # type: ignore
    threat_response = remove_empty_elements(threat_response)

    threat_readable, threats_outputs = parse_data_arr(threat_response)

    headers = [
        "ThreatName",
        "EntityID",
        "Violator",
        "Category",
        "Resourcegroupname",
        "Resourcename",
        "Resourcetype",
        "GenerationTime",
        "Policies",
        "TenantID",
        "Tenantname",
    ]
    human_readable = tableToMarkdown(name="Threats:", t=threat_readable, headers=headers, removeNull=True)
    entry_context = {
        "Securonix.Threat(val.EntityID === obj.EntityID && val.Resourcename === obj.Resourcename && val.Resourcetype "
        "=== obj.Resourcetype && val.Resourcegroupname === obj.Resourcegroupname && val.Policies.toString() === "
        "obj.Policies.toString())": threats_outputs
    }
    return human_readable, entry_context, threat_response


def get_incident_activity_history(client: Client, args: dict[str, Any]) -> tuple[str, dict, list]:
    """Get the incident activity history for the specified incident ID.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    incident_id = args.get("incident_id", "").strip()

    # Raises error when user has provided '  ' in input.
    if not incident_id:
        raise ValueError("Incident ID is a required parameter.")

    # Retrieve activity history for the specified incident ID.
    activity_history = client.get_incident_activity_history_request(incident_id)

    # Prepare entry context for the command.
    # As the response is in such a format, we can not determine a primary key for the context data.
    entry_context = {"Securonix.IncidentHistory": activity_history}

    # Prepare human-readable output for the command.
    activity_history_readable = [
        {
            "Action Taken": h.get("actiontaken"),
            "Username": h.get("username"),
            "Event Time": h.get("eventTime"),
            "Status": h.get("status"),
            "Last Status": h.get("lastStatus"),
            "Comment": "\n".join([c.get("Comments", "") for c in h.get("comment", [])]),
            "Playbook ID": h.get("playBookOutput", {}).get("playBookId"),
            "Playbook Name": h.get("playBookOutput", {}).get("playBookName"),
            "Playbook Executor": h.get("playBookOutput", {}).get("executor"),
            "Attachment Name": h.get("attachment"),
        }
        for h in activity_history
    ]

    # Reversing the human-readable list, as we want to show the latest activity first, rather than the old.
    activity_history_readable.reverse()

    headers = [
        "Action Taken",
        "Username",
        "Event Time",
        "Status",
        "Last Status",
        "Comment",
        "Playbook ID",
        "Playbook Name",
        "Playbook Executor",
        "Attachment Name",
    ]
    human_readable = tableToMarkdown(
        f"Incident activity history for ID: {incident_id}", t=activity_history_readable, headers=headers, removeNull=True
    )

    return human_readable, entry_context, activity_history


def list_whitelists(client: Client, args: dict[str, Any]) -> tuple[str, dict, list]:
    """List all whitelist.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    tenant_name = args.get("tenant_name", "").strip()

    whitelists = client.list_whitelists_request(tenant_name)

    whitelists_entries = []

    for whitelist in whitelists:
        whitelist_details = whitelist.split("|", 3)
        if len(whitelist_details) < 3:
            empty_details = 3 - len(whitelist_details)
            whitelist_details += "null" * empty_details
        whitelists_entries.append(
            {
                "WhitelistName": whitelist_details[0].strip().replace("null", ""),
                "WhitelistType": whitelist_details[1].strip().replace("null", ""),
                "TenantName": whitelist_details[2].strip().replace("null", ""),
            }
        )

    whitelists_entries = remove_empty_elements(whitelists_entries)

    headers = ["WhitelistName", "WhitelistType", "TenantName"]
    human_readable = tableToMarkdown(name="Whitelists:", t=whitelists_entries, headers=headers, removeNull=True)
    entry_context = {
        "Securonix.Whitelist(val.WhitelistName === obj.WhitelistName && val.TenantName === obj.TenantName)": whitelists_entries
    }

    return human_readable, entry_context, whitelists


def get_whitelist_entry(client: Client, args: dict[str, Any]) -> tuple[str, dict, dict]:
    """Get information for the specified whitelist.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    tenant_name = args.get("tenant_name", "").strip()
    whitelist_name = args.get("whitelist_name", "").strip()

    whitelist = client.get_whitelist_entry_request(tenant_name, whitelist_name)

    if not whitelist:
        raise Exception("Whitelist does not contain items.\nMake sure the whitelist_name is not empty and it is correct.")

    whitelist_entries = []

    for key, val in whitelist.items():
        whitelist_entries.append({"Entity/Attribute": key, "ExpiryDate": val})
    watchlist_outputs = {"WhitelistName": whitelist_name, "TenantName": tenant_name, "Entries": whitelist_entries}
    remove_nulls_from_dictionary(watchlist_outputs)

    headers = ["Entity/Attribute", "ExpiryDate"]
    human_readable = tableToMarkdown(
        name=f"Whitelist: {whitelist_name}", t=remove_empty_elements(whitelist_entries), headers=headers, removeNull=True
    )
    entry_context = {
        "Securonix.Whitelist(val.WhitelistName === obj.WhitelistName && val.TenantName === obj.TenantName)": watchlist_outputs
    }

    return human_readable, entry_context, whitelist


def add_whitelist_entry(client: Client, args) -> tuple[str, dict, dict]:
    """Adds an entry to a whitelist.

    Args:
        client: Client object with request.
        args: Usually demisto.args()
    Returns:
        Outputs.
    """
    tenant_name = args.get("tenant_name", "").strip()
    whitelist_name = args.get("whitelist_name", "").strip()
    whitelist_type = args.get("whitelist_type", "").strip()
    entity_type = args.get("entity_type", "").strip()
    entity_id = args.get("entity_id", "").strip()
    expiry_date = args.get("expiry_date", "").strip()
    resource_name = args.get("resource_name", "").strip()
    resource_group_id = args.get("resource_group_id", "").strip()
    attribute_name = args.get("attribute_name", "").strip()
    attribute_value = args.get("attribute_value", "").strip()
    violation_type = args.get("violation_type", "").strip()
    violation_name = args.get("violation_name", "").strip()

    if whitelist_type not in ["Global", "Attribute"]:
        raise Exception("Provide valid whitelist_type")

    if whitelist_type == "Global" and entity_type not in ["Users", "Activityaccount", "Resources", "Activityip"]:
        raise Exception("Provide valid entity_type")

    if whitelist_type == "Attribute":
        if attribute_name not in ["source ip", "resourcetype", "transactionstring"]:
            raise Exception("Provide valid attribute_name")

        if violation_type not in ["Policy", "ThreatModel", "Functionality"]:
            raise Exception("Provide valid violation_type")

    try:
        if expiry_date:
            datetime.strptime(expiry_date, "%m/%d/%Y")
    except ValueError:
        raise Exception("exipry_date is not in MM/DD/YYYY format")

    response = client.add_whitelist_entry_request(
        tenant_name,
        whitelist_name,
        whitelist_type,
        entity_type,
        entity_id,
        expiry_date,
        resource_name,
        resource_group_id,
        attribute_name,
        attribute_value,
        violation_type,
        violation_name,
    )
    if response.get("status_code") == 400:
        raise Exception(f"Failed to add entity to the whitelist.\nError from Securonix is: {response}.")
    human_readable = "Entity added to global whitelist Successfully."

    return human_readable, {}, response


def create_whitelist(client: Client, args) -> tuple[str, dict, dict]:
    """Create a whitelist.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    tenant_name = args.get("tenant_name", "").strip()
    whitelist_name = args.get("whitelist_name", "").strip()
    entity_type = args.get("entity_type", "").strip()

    if entity_type not in VALID_ENTITY_TYPE:
        raise Exception(f"{entity_type} is invalid entity_type. Valid entity types are {VALID_ENTITY_TYPE}")

    response = client.create_whitelist_request(tenant_name, whitelist_name, entity_type)

    if "successfully" not in str(response.get("messages")).lower():
        raise Exception(f"Failed to create whitelist.\nResponse from Securonix is: {response!s}")

    human_readable = f"Whitelist {whitelist_name} was created successfully."

    return human_readable, {}, response


def delete_lookup_table_config_and_data(client: Client, args: dict[str, Any]) -> tuple:
    """Delete a lookup table and its configuration data from Securonix.

    Args:
        client (Client): Client object with request.
        args: (Dict[str, Any]): Usually demisto.args().

    Returns:
        Outputs.
    """
    name = args.get("name", "").strip()

    if not name:
        raise ValueError("Lookup table name is a required argument.")

    response = client.delete_lookup_table_config_and_data_request(name=name)

    if "successfully" not in response.lower():
        raise Exception(f"Failed to delete lookup table and its data.\nResponse from Securonix is: {response!s}")

    human_readable = f"The table {name} has been deleted successfully on Securonix."

    entry_context = {
        "Securonix.LookupTable(val.lookupTableName === obj.lookupTableName)": {"lookupTableName": name, "isDeleted": True}
    }
    return human_readable, entry_context, response


def delete_whitelist_entry(client: Client, args) -> tuple[str, dict, dict]:
    """Delete an entry from the whitelist.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    tenant_name = args.get("tenant_name", "").strip()
    whitelist_name = args.get("whitelist_name", "").strip()
    whitelist_type = args.get("whitelist_type", "").strip()
    entity_id = args.get("entity_id", "").strip()
    attribute_name = args.get("attribute_name", "").strip()
    attribute_value = args.get("attribute_value", "").strip()

    validate_delete_whitelist_parameters(whitelist_type, entity_id, attribute_name, attribute_value, tenant_name)

    response = client.delete_whitelist_entry_request(
        tenant_name, whitelist_name, whitelist_type, entity_id, attribute_name, attribute_value
    )
    result = response.get("result", [])

    if "successfully" not in str(result).lower():
        raise Exception(f"Failed to remove entry from whitelist.\nResponse from Securonix is: {result!s}")

    human_readable = "".join(result).replace(" ..! ", ".")

    return human_readable, {}, response


def list_lookup_tables(client: Client, args: dict[str, Any]) -> tuple[str, dict, list]:
    """Retrieves a list of lookup tables available within the Securonix platform.

    Args:
        client (Client): Client object with request.
        args: (Dict[str, Any]): Usually demisto.args().

    Returns:
        Outputs.
    """
    max_records = arg_to_number(args.get("max", "50").strip() or "50")
    offset = arg_to_number(args.get("offset", "0").strip() or "0")

    lookup_tables = client.get_lookup_tables_request(max_records=max_records, offset=offset)

    lookup_table_readable = [
        {
            "Tenant Name": table.get("tenantName", ""),
            "Lookup Table Name": table.get("lookupTableName", ""),
            "Total Records": table.get("totalRecords", ""),
            "Scope": table.get("scope", ""),
            "Type of Lookup Table": table.get("type", ""),
        }
        for table in lookup_tables
    ]

    headers = ["Tenant Name", "Lookup Table Name", "Total Records", "Scope", "Type of Lookup Table"]
    human_readable = tableToMarkdown("Lookup Tables:", t=lookup_table_readable, headers=headers, removeNull=True)

    entry_context = {"Securonix.LookupTable(val.lookupTableName === obj.lookupTableName)": remove_empty_elements(lookup_tables)}

    return human_readable, entry_context, lookup_tables


def validate_expiry_time_of_lookup_table_entries(table_entries: Union[dict, list[dict]]) -> None:
    """Check whether the expiration time of the lookup table entries is valid.

    Args:
        table_entries (Union[Dict, List[Dict]]): Lookup table entries to add to the lookup table.
    """

    def is_expiration_time_in_valid_format(expiration_time: str) -> None:
        try:
            datetime.strptime(expiration_time, "%m/%d/%Y")
        except ValueError as exception:
            raise ValueError("The value of expiryDate field is not in MM/DD/YYYY format.") from exception

    if isinstance(table_entries, dict):
        expiration_time = table_entries.get("expiryDate")

        if expiration_time:
            is_expiration_time_in_valid_format(expiration_time)

    if isinstance(table_entries, list):
        for entry in table_entries:
            expiration_time = entry.get("expiryDate")

            if expiration_time:
                is_expiration_time_in_valid_format(expiration_time)


def add_entry_to_lookup_table(client: Client, args: dict[str, Any]) -> tuple:
    """Add entries to the lookup table.

    Args:
        client (Client): Client object with request.
        args: (Dict[str, Any]): Usually demisto.args().

    Returns:
        Outputs.
    """
    table_name = args.get("name", "").strip()
    tanant_name = args.get("tenant_name", "").strip()
    json_data = args.get("json_data", "").strip()
    entry_id = args.get("file_entry_id", "").strip()

    # Validate the command arguments.
    if not table_name:
        raise ValueError("Lookup table name is a required parameter.")

    if not json_data and not entry_id:
        raise ValueError("Either JSON data or file entry ID is required to add data to lookup table.")

    # File will take precedence over JSON data.
    if entry_id:
        file_obj = demisto.getFilePath(entry_id)
        file_path = file_obj.get("path")

        try:
            with open(file_path) as file:
                json_entries = json.loads(file.read())
        except json.JSONDecodeError as exception:
            raise Exception(f"Could not able to parse the provided JSON data. Error: {exception!s}") from exception
    else:
        try:
            json_entries = json.loads(json_data)
        except json.JSONDecodeError as exception:
            raise Exception(f"Could not able to parse the provided JSON data. Error: {exception!s}") from exception

    validate_expiry_time_of_lookup_table_entries(table_entries=json_entries)

    if isinstance(json_entries, dict):
        json_entries = [json_entries]

    response = client.add_entry_to_lookup_table_request(name=table_name, entries=json_entries, tenant_name=tanant_name)

    if "successfully" not in response.lower():
        raise Exception(f"Failed adding entries to the lookup table. Error from Securonix: {response!s}")

    return response, {}, response


def prepare_entry_contex_lookup_table_entries_list(entries: list[dict]) -> list[dict]:
    """Prepare entry context for list-lookup-table-entries command.

    Args:
        entries (List[Dict]): Response received from API.

    Returns:
        List[Dict]: Entry context list.
    """
    new_entries = []

    for entry in entries:
        new_entry: dict[str, Any] = {"entry": []}

        for key, value in entry.items():
            if key.startswith("value_"):
                new_entry["entry"].append(
                    {
                        "key": key[6:],  # Remove "value_" from the key.
                        "value": value,
                    }
                )
            else:
                new_entry[key] = value

        new_entries.append(new_entry)

    return new_entries


def prepare_human_readable_for_lookup_table_entries_list(entries: list[dict]) -> str:
    """Prepare human-readable string for lookup-table-entries-list command.

    Args:
        entries (List[Dict]): List of entries.

    Returns:
        str: Markdown string.
    """
    table = []

    for entry in entries:
        new_entry = {
            "Key": entry.get("key"),
            "Timestamp": entry.get("timestamp"),
            "Lookup Unique Key": entry.get("lookupuniquekey"),
            "Tenant Name": entry.get("tenantname"),
        }
        for e in entry.get("entry", []):
            new_entry[e["key"]] = e["value"]
        table.append(new_entry)

    return tableToMarkdown(name="Entries:", t=table, removeNull=True)


def list_lookup_table_entries(client: Client, args: dict[str, Any]) -> tuple:
    """List the entries of the provided lookup table.

    Args:
        client (Client): Client object with request.
        args (Dict[str, Any]): Usually demisto.args().

    Returns:
        Outputs.
    """
    name = args.get("name", "").strip()
    query = args.get("query", "").strip()
    attribute = args.get("attribute", "key").strip() or "key"
    max_records = arg_to_number(args.get("max", "15").strip() or "15")
    offset = arg_to_number(args.get("offset", "0").strip() or "0")
    page_num = arg_to_number(args.get("page_num", "1").strip() or "1")
    sort = args.get("sort", "").strip()
    order = args.get("order", "asc").strip().lower() or "asc"

    # Validate required parameters.
    if not name:
        raise ValueError("Lookup table name is a required argument.")

    # Validate order argument.
    if order and order not in ["asc", "desc"]:
        raise ValueError('Order argument must be "asc" or "desc".')

    response = client.list_lookup_table_entries_request(
        name=name,
        query=query,
        attribute=attribute,
        max_records=max_records,
        offset=offset,
        page_num=page_num,
        sort=sort,
        order=order,
    )

    entry_context_list: list[dict] = prepare_entry_contex_lookup_table_entries_list(response)
    human_readable = prepare_human_readable_for_lookup_table_entries_list(entry_context_list)

    entry_context = {
        "Securonix.LookupTableEntries(val.lookupuniquekey === obj.lookupuniquekey)": remove_empty_elements(entry_context_list)
    }

    return human_readable, entry_context, response


def create_lookup_table(client: Client, args) -> tuple[str, dict, dict]:
    """Create a lookup table.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    name = args.get("name", "").strip()
    scope = args.get("scope")
    tenant_name = args.get("tenant_name", "").strip()
    field_names = argToList(args.get("field_names", "").strip())
    encrypt = argToList(args.get("encrypt", "").strip())
    key = argToList(args.get("key", "").strip())

    response = client.create_lookup_table_request(tenant_name, name, scope, field_names, encrypt, key)
    if "successfully" not in response.lower():  # type: ignore[attr-defined]
        raise Exception(f"Failed to create lookup table.\nResponse from Securonix is: {response}")
    human_readable = f"Lookup Table {name} created successfully."

    return human_readable, {}, response


def delete_lookup_table_entries(client: Client, args: dict[str, Any]):
    """Delete entries from the lookup table.

    Args:
        client: Client object with request.
        args: Usually demisto.args()

    Returns:
        Outputs.
    """
    name = args.get("name", "").strip()
    lookup_unique_keys = argToList(args.get("lookup_unique_keys", "").strip())

    if not name:
        raise ValueError("Lookup table name is a required parameter.")

    if not lookup_unique_keys:
        raise ValueError("At least one lookup table key is required to execute the command.")

    response = client.delete_lookup_table_entries(name=name, lookup_unique_keys=lookup_unique_keys)
    human_readable = f"Successfully deleted following entries from {name}: {', '.join(lookup_unique_keys)}."

    return human_readable, {}, response


def fetch_securonix_incident(
    client: Client,
    fetch_time: str | None,
    incident_status: str,
    default_severity: str,
    max_fetch: str,
    last_run: dict,
    close_incident: bool,
) -> list:
    """Uses to fetch incidents into Demisto
    Documentation: https://github.com/demisto/content/tree/master/docs/fetching_incidents

    Args:
        client: Client object with request
        fetch_time: From when to fetch if first time, e.g. `3 days`
        incident_status: Incident statuses to fetch, can be: all, opened, closed, updated
        default_severity: Default incoming incident severity
        last_run: Last fetch object.
        max_fetch: maximum amount of incidents to fetch
        close_incident: Close respective Securonix incident.

    Returns:
        incidents, new last_run
    """
    timestamp_format = "%Y-%m-%dT%H:%M:%S.%fZ"
    if not last_run:  # if first time running
        new_last_run = {
            "from": int(
                arg_to_datetime(fetch_time, arg_name="First fetch time range").timestamp() * 1000  # type: ignore
            ),
            "to": int(datetime.now(tz=timezone.utc).timestamp() * 1000),
            "offset": 0,
        }
        demisto.debug(f"No last run object found, creating new last run object with value: {json.dumps(new_last_run)}")
    elif "time" in last_run:
        demisto.debug("Upgrading the last run object.")
        new_last_run = last_run
        new_last_run["from"] = date_to_timestamp(last_run.get("time"), date_format=timestamp_format)
        new_last_run["to"] = int(datetime.now(tz=timezone.utc).timestamp() * 1000)
        new_last_run["offset"] = 0
        del new_last_run["time"]
    else:
        new_last_run = last_run
        demisto.debug("Using the last run object got from the previous run.")

    demisto_incidents: list = []

    from_epoch = new_last_run.get("from")
    to_epoch = new_last_run.get("to")
    offset = new_last_run.get("offset")
    demisto.info(f"Fetching Securonix incidents. From: {from_epoch}. To: {to_epoch}. Offset: {offset}")

    if incident_status.lower() == "all":
        incident_status = "updated"

    securonix_incidents = client.list_incidents_request(
        from_epoch=str(from_epoch),
        to_epoch=str(to_epoch),
        incident_status=incident_status,
        max_incidents=max_fetch,
        offset=str(offset),
    )

    if securonix_incidents:
        already_fetched: list[str] = new_last_run.get("already_fetched", [])  # type: ignore
        incident_items = securonix_incidents.get("incidentItems", [])

        for incident in incident_items:
            incident_id = str(incident.get("incidentId", 0))
            violator_id = str(incident.get("violatorId", 0))
            reasons = incident.get("reason", [])
            policy_list: list[str] = []
            policy_stages_json = {}
            policy_stages_table = []
            if isinstance(reasons, list):
                for reason in reasons:
                    if isinstance(reason, str) and "PolicyType" in reason:
                        policy_type = reason.split(":")[-1].strip()
                        incident["policy_type"] = policy_type
                    if isinstance(reason, dict) and "Policies" in reason:
                        # Parse the policies.
                        policies = reason.get("Policies")
                        if not isinstance(policies, dict):
                            continue
                        policy_keys = list(policies.keys())
                        policy_keys.sort()
                        for stage_key in policy_keys:
                            stage_dict = policies.get(stage_key)
                            if not stage_dict or not isinstance(stage_dict, dict):
                                continue
                            stage_name = list(stage_dict.keys())[0]
                            stage_policies: list[str] = stage_dict.get(stage_name)  # type: ignore
                            if not stage_policies or not isinstance(stage_policies, list):
                                continue
                            stage_policies_str = ", ".join(str(policy) for policy in stage_policies)  # type: ignore
                            policy_list.extend(stage_policies)  # type: ignore
                            policy_stages_json[f"{stage_key}:{stage_name}"] = stage_policies  # noqa: E231
                            policy_stages_table.append(
                                {"Stage Name": f"{stage_key}:{stage_name}", "Policies": stage_policies_str}  # noqa: E231
                            )

            if policy_list:
                # Add the parsed policies to the incident.
                incident["policy_list"] = list(dict.fromkeys(policy_list))
                incident["policy_stages_json"] = policy_stages_json
                incident["policy_stages_table"] = policy_stages_table

            if incident_id not in already_fetched:
                incident.update(get_mirroring())

                if close_incident:
                    incident["close_sx_incident"] = True
                else:
                    incident["close_sx_incident"] = False

                incident_name = get_incident_name(incident, incident_id, violator_id)

                demisto_incidents.append(
                    {
                        "name": incident_name,
                        "occurred": timestamp_to_datestring(incident.get("lastUpdateDate")),
                        "severity": incident_priority_to_dbot_score(incident.get("priority"), default_severity),
                        "rawJSON": json.dumps(incident),
                    }
                )

                already_fetched.append(str(incident_id))

        # If incidents returned from API, then only update the offset value.
        if incident_items:
            new_offset = offset + len(incident_items)  # type: ignore
            new_from = from_epoch
            new_to = to_epoch
            demisto.debug(f"Updating the offset to {new_offset}.")
        # Else, reset the value of offset. From value would be the to_epoch of previous run.
        # And, To value would be current timestamp.
        else:
            new_offset = 0
            new_from = to_epoch
            new_to = int(datetime.now(tz=timezone.utc).timestamp() * 1000)
            demisto.debug(f"Resetting the offset to 0. New From is {new_from}. New To is {new_to}.")

        new_last_run.update(
            {
                "from": new_from,  # type: ignore
                "to": new_to,  # type: ignore
                "offset": new_offset,
                "already_fetched": already_fetched,  # type: ignore
            }
        )

    demisto.setLastRun({"value": json.dumps(new_last_run)})

    demisto.info(f"Creating {len(demisto_incidents)} new incidents.")
    return demisto_incidents


def fetch_securonix_threat(client: Client, fetch_time: str | None, tenant_name: str, max_fetch: str, last_run: dict) -> list:
    """Uses to fetch threats into Demisto.

    Args:
        client: Client object with request
        fetch_time: From when to fetch if first time, e.g. `3 days`
        tenant_name: Name of the tenant from which threat belongs to
        last_run: Last fetch object.
        max_fetch: maximum amount of incidents to fetch

    Returns:
        incidents, new last_run
    """
    timestamp_format = "%Y-%m-%dT%H:%M:%S.%fZ"
    if not last_run:  # if first time running
        new_last_run = {
            "time": arg_to_datetime(fetch_time, arg_name="First fetch time range").strftime(  # type: ignore
                timestamp_format
            )
        }
    else:
        new_last_run = last_run
    demisto_incidents: list = []
    from_epoch = date_to_timestamp(new_last_run.get("time"), date_format=timestamp_format)
    to_epoch = date_to_timestamp(datetime.now(), date_format=timestamp_format)
    # Get threats from Securonix
    demisto.info(f"Fetching Securonix Threats. From: {from_epoch}. To: {to_epoch}")

    offset = last_run.get("offset", 0)

    securonix_threats = client.list_threats_request(from_epoch, to_epoch, tenant_name, offset, max_fetch)  # type: ignore

    already_fetched = last_run.get("already_fetched", [])
    if securonix_threats:
        for threat in securonix_threats:
            threat_name = threat.get("threatname", "Securonix Threat")
            entity_id = threat.get("entityid", "")
            resource_name = threat.get("resourcename", "")
            resource_type = threat.get("resourcetype", "")
            resource_group_name = threat.get("resourcegroupname", "")
            policies = ", ".join(sorted(threat.get("policies", [])))

            if (entity_id, resource_name, resource_type, resource_group_name, policies) not in already_fetched:
                incident_name = f"{threat_name}, Entity ID: {entity_id}"

                demisto_incidents.append(
                    {
                        "name": incident_name,
                        "occurred": timestamp_to_datestring(threat.get("generationtime_epoch", datetime.now())),
                        "rawJSON": json.dumps(threat),
                    }
                )
                already_fetched.append((entity_id, resource_name, resource_type, resource_group_name, policies))

        new_last_run.update({"offset": offset + int(max_fetch), "already_fetched": already_fetched})
    else:
        now = datetime.now().strftime(timestamp_format)
        new_last_run.update({"offset": 0, "time": now})

    demisto.setLastRun({"value": json.dumps(new_last_run)})
    return demisto_incidents


def get_incident_name(incident: dict, incident_id: str, violator_id: str) -> str:
    """Get the incident name by concatenating the incident reasons if possible

    Args:
        incident: incident details
        incident_id: the incident id
        violator_id: the violator id

    Returns:
        incident name.
    """
    incident_reasons = incident.get("reason", [])
    try:
        incident_reason = ""
        for reason in incident_reasons:
            if isinstance(reason, str):
                if reason.startswith("Threat Model: "):
                    incident_reason += f"{reason[14:]}, "
                if reason.startswith("Policy: "):
                    incident_reason += f"{reason[8:]}, "
        if incident_reason:
            # Remove ", " last chars and concatenate with the incident ID
            incident_name = f"{incident_reason[:-2]}: {incident_id}"
        else:
            incident_name = f"Securonix Incident {incident_id}, Violator ID: {violator_id}"
    except ValueError:
        incident_name = f"Securonix Incident: {incident_id}."

    return incident_name


def get_modified_remote_data_command(client: Client, args: dict[str, Any]) -> GetModifiedRemoteDataResponse:
    """Retrieve the IDs of the incidents which are updated since the last updated.

    Args:
        client: XSOAR client to use.
        args:
            lastUpdate: When was the last time we retrieved data.

    Returns:
        GetModifiedRemoteDataResponse: List of incidents IDs which are modified since the last update.
    """
    # Retrieve the arguments passed with the command.
    command_args = GetModifiedRemoteDataArgs(args)

    # Parse the last update date got from the command arguments.
    command_last_run_date = dateparser.parse(command_args.last_update, settings={"TIMEZONE": "UTC"})

    demisto.debug(f"Last update date of get-modified-remote-data command is {command_last_run_date}.")

    # Convert the datetime object to epoch as the API requires the time in epoch format.
    from_epoch_time = date_to_timestamp(command_last_run_date)
    # End time for the API call will be current time.
    to_epoch_time = date_to_timestamp(datetime.now(tz=timezone.utc))

    offset = 0
    len_of_incidents = 0
    updated_incident_ids = []

    while True:
        offset += len_of_incidents

        list_incidents_resp = client.list_incidents_request(
            from_epoch=str(from_epoch_time),
            to_epoch=str(to_epoch_time),
            incident_status="updated",
            max_incidents="500",
            offset=str(offset),
        )

        len_of_incidents = len(list_incidents_resp.get("incidentItems", []))

        if len_of_incidents == 0:
            break

        # Extract the IDs of the incidents.
        updated_incident_ids.extend([inc.get("incidentId") for inc in list_incidents_resp.get("incidentItems", [])])

        if len(updated_incident_ids) >= 10000:
            break

    # Filter out None values if there are any.
    updated_incident_ids: list[str] = list(filter(None, updated_incident_ids))

    # Filter out any duplicate incident IDs.
    updated_incident_ids = list(set(updated_incident_ids))

    # At max 10,000 incidents should be updated.
    updated_incident_ids = updated_incident_ids[:10000]

    demisto.debug(f"Number of incidents modified between {from_epoch_time} to {to_epoch_time} are {len(updated_incident_ids)}.")
    demisto.debug(f"List of modified incident ids between {from_epoch_time} to {to_epoch_time} is {updated_incident_ids}.")

    return GetModifiedRemoteDataResponse(updated_incident_ids)


def get_remote_data_command(
    client: Client, args: dict[str, Any], close_states_of_securonix: list[str]
) -> Union[str, GetRemoteDataResponse]:
    """Return the updated incident and updated entries.

    Args:
        client: XSOAR client to use.
        args:
            id: Incident ID to retrieve.
            lastUpdate: When was the last time we retrieved data.
        close_states_of_securonix: List of Securonix incident states that can be considered as closed.

    Returns:
        Union[str, GetRemoteDataResponse]: first entry is the incident (which can be completely empty) and the new
            entries.
    """
    new_entries_to_return = []
    timestamp_format = "%Y-%m-%dT%H:%M:%S.%fZ"

    sx_incident_id: str = args.get("id")  # type: ignore
    demisto.debug(f"Getting update for remote {sx_incident_id}.")

    command_last_run_dt = arg_to_datetime(arg=args.get("lastUpdate"), arg_name="lastUpdate", required=True)
    command_last_run_epoch = date_to_timestamp(command_last_run_dt, date_format=timestamp_format)
    demisto.debug(f"The time when the last time get-remote-data command is called for current incident is {command_last_run_dt}.")

    # Retrieve the latest incident data from the Securonix platform.
    remote_incident_data = client.get_incident_request(incident_id=sx_incident_id)
    remote_incident_data = remote_incident_data.get("incidentItems", [])
    remote_incident_data = remote_incident_data[0]

    if not remote_incident_data:
        return "Incident was not found."

    # Check the last modified date of the incident fetched.
    incident_last_update_dt = arg_to_datetime(
        arg=remote_incident_data.get("lastUpdateDate"), arg_name="lastUpdateDate", required=True
    )
    incident_last_update_epoch = date_to_timestamp(incident_last_update_dt, date_format=timestamp_format)

    if command_last_run_epoch > incident_last_update_epoch:
        demisto.debug(f"Nothing new in the Securonix incident {sx_incident_id}.")
    else:
        demisto.debug(f"The Securonix incident {sx_incident_id} is updated.")

    activity_history = client.get_incident_activity_history_request(incident_id=sx_incident_id)
    filtered_history_entries = filter_activity_entries_by_time(activity_history, timestamp=command_last_run_epoch)

    # Update the status of XSOAR incident.
    close_incident = argToBoolean(demisto.params().get("close_incident", False))

    # Skip closing of XSOAR if the close Securonix incident checkbox is checked.
    if not close_incident:
        if is_incident_closed_on_securonix(filtered_history_entries, close_states_of_securonix):
            demisto.debug(f"Closing the XSOAR incident as its respective Securonix incident {sx_incident_id} is closed.")
            close_comments = extract_closing_comments(filtered_history_entries, close_states_of_securonix)

            new_entries_to_return.append(
                {
                    "Type": EntryType.NOTE,
                    "Contents": {"dbotIncidentClose": True, "closeNotes": close_comments, "closeReason": "Resolved"},
                    "ContentsFormat": EntryFormat.JSON,
                    "Note": True,
                }
            )
        else:
            demisto.debug(f"Not closing the XSOAR incident as its respective Securonix incident {sx_incident_id} is still open.")

    # Update the comments.
    comment_entries = filter_comment_activity_entries(filtered_history_entries)

    for entry in comment_entries:
        comments_text = []
        comments_list = entry.get("comment", {})

        for _comment in comments_list:
            comments_text.append(_comment.get("Comments"))

        comments_text: list[str] = list(filter(None, comments_text))

        if "Mirrored From XSOAR" in ", ".join(comments_text):
            demisto.debug("Skipping the comment as it is mirrored from XSOAR.")
            continue

        new_entries_to_return.append(
            {
                "Type": EntryType.NOTE,
                "Contents": f"[Mirrored From Securonix]\n"
                f"Added By: {entry.get('username')}\n"
                f"Added At: {entry.get('eventTime')} UTC\n"
                f"Comment Content: {', '.join(comments_text)}",
                "ContentsFormat": EntryFormat.TEXT,
                "Note": True,
            }
        )

    # Update the attachments.
    attachment_entries = filter_attachment_activity_entries(filtered_history_entries)
    attachment_names = extract_names_of_attachments_from_entries(attachment_entries)

    if attachment_entries:
        attachment_file_entries = get_incident_attachments(client, {}, incident_id=sx_incident_id)

        # Removing the first entry from the response, as it is CommandResults.
        for xsoar_file_entry in attachment_file_entries:
            if isinstance(xsoar_file_entry, CommandResults):
                continue

            if xsoar_file_entry.get("File", "") in attachment_names:
                new_entries_to_return.append(xsoar_file_entry)

    return GetRemoteDataResponse(remote_incident_data, new_entries_to_return)


def create_xsoar_to_securonix_state_mapping(params: dict[str, Any]) -> CommandResults:
    """Create a mapping of Securonix status and action with XSOAR's states.

    Args:
        params: The configuration parameters got from demisto.params()

    Returns:
        CommandResults: Standard CommandResults object.
    """
    global XSOAR_TO_SECURONIX_STATE_MAPPING

    active_state_action = params.get("active_state_action_mapping", "").strip()
    active_state_status = params.get("active_state_status_mapping", "").strip().lower()

    close_state_action = params.get("closed_state_action_mapping", "").strip()
    close_state_status = params.get("closed_state_status_mapping", "").strip().lower()

    XSOAR_TO_SECURONIX_STATE_MAPPING["ACTIVE"] = {"action": active_state_action, "status": active_state_status}

    XSOAR_TO_SECURONIX_STATE_MAPPING["DONE"] = {"action": close_state_action, "status": close_state_status}

    hr_table = [
        {
            "XSOAR Status": "Active",
            "Securonix Status": XSOAR_TO_SECURONIX_STATE_MAPPING["ACTIVE"]["status"],
            "Securonix Action Name": XSOAR_TO_SECURONIX_STATE_MAPPING["ACTIVE"]["action"],
        },
        {
            "XSOAR Status": "Closed",
            "Securonix Status": XSOAR_TO_SECURONIX_STATE_MAPPING["DONE"]["status"],
            "Securonix Action Name": XSOAR_TO_SECURONIX_STATE_MAPPING["DONE"]["action"],
        },
    ]

    human_readable = tableToMarkdown(
        "State Mapping:", t=hr_table, headers=["XSOAR Status", "Securonix Status", "Securonix Action Name"], removeNull=True
    )

    return CommandResults(
        outputs_prefix="Securonix.StateMapping",
        outputs=XSOAR_TO_SECURONIX_STATE_MAPPING,
        readable_output=human_readable,
        raw_response=XSOAR_TO_SECURONIX_STATE_MAPPING,
    )


def update_remote_system(client: Client, args: dict[str, Any]) -> str:
    """This command pushes local changes to the remote incident.

    Args:
        client (Client): XSOAR Client to use.
        args (Dict[str, Any]):
            args['data']: The data to send to the remote system.
            args['entries']: The entries to send to the remote system.
            args['incident_changed']: Boolean telling us if the local incident indeed changed or not.
            args['remote_incident_id']: The remote incident id.

    Returns:
        str: The remote incident ID.
    """
    parsed_args = UpdateRemoteSystemArgs(args)
    remote_incident_id = parsed_args.remote_incident_id
    xsoar_incident_id = parsed_args.data.get("id", "")
    new_entries = parsed_args.entries

    if new_entries:
        for entry in new_entries:
            demisto.debug(f"Sending the entry with ID: {entry.get('id')} and Type: {entry.get('type')}")

            entry_content = entry.get("contents", "")
            entry_user = entry.get("user", "dbot") or "dbot"

            comment_str = (
                f"[Mirrored From XSOAR] XSOAR Incident ID: {xsoar_incident_id}\nAdded By: {entry_user}\nComment: {entry_content}"
            )
            client.add_comment_to_incident_request(remote_incident_id, comment_str)

    close_incident = parsed_args.data.get("securonixcloseincident", False)

    if not close_incident and parsed_args.incident_changed and parsed_args.inc_status == IncidentStatus.DONE:
        delta_keys = parsed_args.delta.keys()
        if "closingUserId" not in delta_keys and "closeReason" not in delta_keys:
            return remote_incident_id

        close_notes = parsed_args.delta.get("closeNotes", "")
        close_reason = parsed_args.delta.get("closeReason", "")
        close_user_id = parsed_args.delta.get("closingUserId", "")

        closing_comment = (
            f"[Mirrored From XSOAR] XSOAR Incident ID: {xsoar_incident_id}\n"
            f"Closed By: {close_user_id}\nClose Reason: {close_reason}\nClose Notes: {close_notes}"
        )
        demisto.debug(f"Closing Comment: {closing_comment}")

        client.perform_action_on_incident_request(
            incident_id=remote_incident_id, action=XSOAR_TO_SECURONIX_STATE_MAPPING["DONE"]["action"], action_parameters=""
        )
        client.add_comment_to_incident_request(incident_id=remote_incident_id, comment=closing_comment)

    return remote_incident_id


def main():
    """
    PARSE AND VALIDATE INTEGRATION PARAMS
    """
    params = demisto.params()
    remove_nulls_from_dictionary(params)

    host = params.get("host", None)
    tenant = params.get("tenant")
    if not host:
        server_url = tenant
        if not tenant.startswith("http://") and not tenant.startswith("https://"):
            server_url = f"https://{tenant}"  # noqa: E231
        if not tenant.endswith(".securonix.net/Snypr/ws/"):
            server_url += ".securonix.net/Snypr/ws/"
    else:
        host = host.rstrip("/")
        if not host.endswith("/ws"):
            host += "/ws/"
        server_url = host

    username = params.get("username")
    password = params.get("password")
    verify = not params.get("unsecure", False)
    proxy = demisto.params().get("proxy") is True
    # Updating TOTAL_RETRY_COUNT to get user provided value
    global TOTAL_RETRY_COUNT
    TOTAL_RETRY_COUNT = arg_to_number(
        params.get("securonix_retry_count", "0"),  # type: ignore
        arg_name="securonix_retry_count",
    )
    TOTAL_RETRY_COUNT = min(TOTAL_RETRY_COUNT, 5)
    securonix_retry_delay_type = params.get("securonix_retry_delay_type", "Exponential")
    securonix_retry_delay = arg_to_number(params.get("securonix_retry_delay", "30"), arg_name="securonix_retry_delay")
    if securonix_retry_delay <= 30:  # type: ignore
        securonix_retry_delay = 30
    elif securonix_retry_delay >= 300:  # type: ignore
        securonix_retry_delay = 300
    if securonix_retry_delay_type == "Exponential":
        securonix_retry_delay = int(securonix_retry_delay / 2)  # type: ignore
    # Create a state mapping from XSOAR to Securonix.
    create_xsoar_to_securonix_state_mapping(params)

    command = demisto.command()
    LOG(f"Command being called in Securonix is: {command}")

    try:
        client = Client(
            tenant=tenant,
            server_url=server_url,
            username=username,
            password=password,
            verify=verify,
            proxy=proxy,
            securonix_retry_count=TOTAL_RETRY_COUNT,  # type: ignore
            securonix_retry_delay=securonix_retry_delay,  # type: ignore[arg-type]
            securonix_retry_delay_type=securonix_retry_delay_type,
        )
        commands: dict[str, Callable[[Client, dict[str, str]], tuple[str, dict[Any, Any], dict[Any, Any]]]] = {
            "securonix-list-workflows": list_workflows,
            "securonix-get-default-assignee-for-workflow": get_default_assignee_for_workflow,
            "securonix-list-possible-threat-actions": list_possible_threat_actions,
            "securonix-list-policies": list_policies,
            "securonix-list-resource-groups": list_resource_groups,
            "securonix-list-users": list_users,
            "securonix-list-activity-data": list_activity_data,
            "securonix-list-incidents": list_incidents,
            "securonix-get-incident": get_incident,
            "securonix-get-incident-status": get_incident_status,
            "securonix-get-incident-workflow": get_incident_workflow,
            "securonix-get-incident-available-actions": get_incident_available_actions,
            "securonix-perform-action-on-incident": perform_action_on_incident,
            "securonix-add-comment-to-incident": add_comment_to_incident,
            "securonix-create-incident": create_incident,
            "securonix-list-watchlists": list_watchlists,
            "securonix-get-watchlist": get_watchlist,
            "securonix-create-watchlist": create_watchlist,
            "securonix-check-entity-in-watchlist": check_entity_in_watchlist,
            "securonix-add-entity-to-watchlist": add_entity_to_watchlist,
            "securonix-threats-list": list_threats,
            "securonix-incident-activity-history-get": get_incident_activity_history,  # type: ignore[dict-item]
            "securonix-whitelists-get": list_whitelists,  # type: ignore[dict-item]
            "securonix-whitelist-entry-list": get_whitelist_entry,
            "securonix-whitelist-entry-add": add_whitelist_entry,
            "securonix-whitelist-create": create_whitelist,
            "securonix-lookup-table-config-and-data-delete": delete_lookup_table_config_and_data,  # type: ignore
            "securonix-whitelist-entry-delete": delete_whitelist_entry,
            "securonix-lookup-tables-list": list_lookup_tables,  # type: ignore[dict-item]
            "securonix-lookup-table-entry-add": add_entry_to_lookup_table,  # type: ignore[dict-item]
            "securonix-lookup-table-entries-list": list_lookup_table_entries,  # type: ignore[dict-item]
            "securonix-lookup-table-create": create_lookup_table,
            "securonix-lookup-table-entries-delete": delete_lookup_table_entries,
        }
        if command == "fetch-incidents":
            validate_mirroring_parameters(params=params)

            fetch_time = params.get("fetch_time", "1 hour")
            tenant_name = params.get("tenant_name")
            incident_status = params.get("incident_status") if "incident_status" in params else "opened"
            default_severity = params.get("default_severity", "")
            max_fetch_ = arg_to_number(params.get("max_fetch", "200"), arg_name="max_fetch")
            max_fetch = str(min(200, max_fetch_))  # type: ignore
            last_run = json.loads(demisto.getLastRun().get("value", "{}"))
            close_incident = argToBoolean(params.get("close_incident", False))

            if params.get("entity_type_to_fetch") == "Threat":
                incidents = fetch_securonix_threat(client, fetch_time, tenant_name, max_fetch, last_run=last_run)
            else:
                incidents = fetch_securonix_incident(
                    client,
                    fetch_time,
                    incident_status,
                    default_severity,
                    max_fetch,
                    last_run=last_run,
                    close_incident=close_incident,
                )

            demisto.incidents(incidents)
        elif command == "securonix-list-violation-data":
            return_results(
                run_polling_command(
                    client=client,
                    args=demisto.args(),
                    search_function=list_violation_data,
                    command_name="securonix-list-violation-data",
                )
            )
        elif command == "test-module":
            demisto.results(test_module(client))
        elif command == "securonix-incident-attachment-get":
            return_results(get_incident_attachments(client=client, args=demisto.args()))
        elif command == "get-remote-data":
            close_states_of_securonix = params.get("close_states_of_securonix", "").strip().lower()
            close_states_of_securonix = argToList(close_states_of_securonix)

            return_results(get_remote_data_command(client, demisto.args(), close_states_of_securonix))
        elif command == "get-modified-remote-data":
            return_results(get_modified_remote_data_command(client, demisto.args()))
        elif command == "securonix-xsoar-state-mapping-get":
            return_results(create_xsoar_to_securonix_state_mapping(params=params))
        elif command == "update-remote-system":
            return_results(update_remote_system(client, demisto.args()))
        elif command in commands:
            return_outputs(*commands[command](client, demisto.args()))
        else:
            raise NotImplementedError(f'Command "{command}" is not implemented.')

    except Exception as err:
        return_error(str(err))


if __name__ in ["__main__", "builtin", "builtins"]:
    main()