category: Network Security
provider: Cisco Systems
commonfields:
  id: Stealthwatch Cloud
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Stealthwatch's server URL
  name: serverURL
  required: true
  type: 0
  section: Connect
- display: Stealthwatch Cloud API key. Should be in the form of "ApiKey <username>:<apikey>"
  name: APIKey
  type: 4
  hidden: true
  required: false
  section: Connect
- name: credentials_api_key
  type: 9
  displaypassword: Stealthwatch Cloud API key. Should be in the form of "ApiKey <username>:<apikey>"
  hiddenusername: true
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  defaultvalue: 'false'
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
description: Protect your cloud assets and private network.
display: Cisco Secure Cloud Analytics (Stealthwatch Cloud)
name: Stealthwatch Cloud
script:
  commands:
  - arguments:
    - description: The id of the required alert.
      name: alertID
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Add comments information, can be long.
      name: addComments
      predefined:
      - 'true'
      - 'false'
    description: Get info about a specific alert by its ID
    name: sw-show-alert
    outputs:
    - contextPath: Stealthwatch.Alert.id
      description: Alert's id.
      type: number
    - contextPath: Stealthwatch.Alert.assigned_to
      description: Alert's assignee.
      type: string
    - contextPath: Stealthwatch.Alert.obj_created
      description: Alert's creation date.
      type: date
    - contextPath: Stealthwatch.Alert.last_modified
      description: Alert's last modification.
      type: date
    - contextPath: Stealthwatch.Alert.resolved
      description: 'Alert''s state.'
      type: boolean
    - contextPath: Stealthwatch.Alert.source_info.ips
      description: IP of the alert's source.
      type: string
    - contextPath: Stealthwatch.Alert.source_info.hostnames
      description: Hostname of the alert's source.
      type: string
  - arguments:
    - description: The id of the alert for update.
      name: alertID
      required: true
    - auto: PREDEFINED
      description: Set the resolved field to true and set the merit field to close an alert. merit can be 8 ("helpful") or 9 ("not helpful").
      name: resolved
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Set the resolved field to true and set the merit field to close an alert. merit can be 8 ("helpful") or 9 ("not helpful").
      name: merit
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '8'
      - '9'
    - description: Tags (string).
      name: tags
    - description: Set the new_comment field to add a comment to the alert.
      name: new_comment
    - description: Publish time (string). Example, publish_time=2018-08-01T07:54:39Z.
      name: publish_time
    - description: Snooze settings (string).
      name: snooze_settings
    - description: 'Username (string).'
      name: resolved_user
    - description: Assigned to (integer).
      name: assigned_to
    description: Update an alert
    name: sw-update-alert
    outputs:
    - contextPath: Stealthwatch.Alert.id
      description: Alert's id.
      type: number
    - contextPath: Stealthwatch.Alert.assigned_to
      description: Alert's assignee.
      type: string
    - contextPath: Stealthwatch.Alert.obj_created
      description: Alert's creation date.
      type: date
    - contextPath: Stealthwatch.Alert.last_modified
      description: Alert's last modification.
      type: date
    - contextPath: Stealthwatch.Alert.resolved
      description: 'Alert''s state.'
      type: boolean
    - contextPath: Stealthwatch.Alert.source_info.ips
      description: IP of the alert's source.
      type: string
    - contextPath: Stealthwatch.Alert.source_info.hostname
      description: Hostname of the alert's source.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: 'status filters alerts by status: open, closed, or all. Default is open. all allows you to see an individual alert regardless of whether it''s open or closed.'
      name: status
      predefined:
      - open
      - closed
      - all
    - description: search finds a particular string amongst the alerts. For example, a particular IP address, hostname, or alert type.
      name: search
    - description: assignee filters shows only alerts assigned to a particular user.
      name: assignee
    - description: tags shows alerts that are assigned a particular incident tag.
      name: tags
    - defaultValue: '5'
      description: Amount of alerts to list. Default is 5.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Add comments information, can be long.
      name: addComments
      predefined:
      - 'true'
      - 'false'
    description: Get the list of Stealthwatch alerts
    name: sw-list-alerts
    outputs:
    - contextPath: Stealthwatch.Alert.id
      description: Alert's id.
      type: number
    - contextPath: Stealthwatch.Alert.assigned_to
      description: Alert's assignee.
      type: string
    - contextPath: Stealthwatch.Alert.obj_created
      description: Alert's creation date.
      type: date
    - contextPath: Stealthwatch.Alert.last_modified
      description: Alert's last modification.
      type: date
    - contextPath: Stealthwatch.Alert.resolved
      description: 'Alert''s state.'
      type: boolean
    - contextPath: Stealthwatch.Alert.source_info.ips
      description: IP of the alert's source.
      type: string
    - contextPath: Stealthwatch.Alert.source_info.hostname
      description: Hostname of the alert's source.
      type: string
  - arguments:
    - description: Domain to add to the block list.
      name: domain
    - description: IP to add to the block list.
      name: ip
    description: Add a domain or IP to the block list
    name: sw-block-domain-or-ip
    outputs:
    - contextPath: Stealthwatch.Domain.identifier
      description: Domain name.
      type: string
    - contextPath: Stealthwatch.Domain.title
      description: Domain title.
      type: string
    - contextPath: Stealthwatch.Domain.id
      description: Domain id.
      type: number
    - contextPath: Stealthwatch.IP.identifier
      description: IP address.
      type: string
    - contextPath: Stealthwatch.IP.title
      description: IP title.
      type: string
    - contextPath: Stealthwatch.IP.id
      description: IP id.
      type: string
  - arguments:
    - description: ID of the domain to remove from the block list. You can find the id using 'sw-list-blocked-domains'.
      name: id
      required: true
    description: Remove a domain from the block list
    name: sw-unblock-domain
  - arguments:
    - description: search finds a particular string amongst the alerts. For example, a particular IP address, hostname, or alert type.
      name: search
    - description: Search for specific domain.
      name: domain
    - defaultValue: '5'
      description: Amount of domains to list. Default is 5.
      name: limit
    description: Returns list of the blocked domains
    name: sw-list-blocked-domains
    outputs:
    - contextPath: Stealthwatch.Domain.identifier
      description: Domain name.
      type: string
    - contextPath: Stealthwatch.Domain.title
      description: Domain title.
      type: string
    - contextPath: Stealthwatch.Domain.id
      description: Domain id.
      type: number
  - arguments:
    - description: search finds a particular string amongst the alerts. For example, a particular IP address, hostname, or alert type.
      name: search
    - description: Use the alert query parameter with an alert id to only show observations referenced by the alert.
      name: alert
    - description: Get a specific observation by its id.
      name: id
    - defaultValue: '5'
      description: Amount of observations to list. Default is 5.
      name: limit
    description: Get observations by alert ID, observation ID, or free search
    name: sw-list-observations
    outputs:
    - contextPath: Stealthwatch.Observation.id
      description: Observation ID.
      type: number
    - contextPath: Stealthwatch.Observation.port_count
      description: Observation port count.
      type: number
    - contextPath: Stealthwatch.Observation.creation_time
      description: Observation creation time.
      type: string
    - contextPath: Stealthwatch.Observation.end_time
      description: Observation end time.
      type: string
    - contextPath: Stealthwatch.Observation.scanned_ip
      description: Observation scanned ip.
      type: string
    - contextPath: Stealthwatch.Observation.scanner_ip
      description: Observation scanner ip.
      type: string
    - contextPath: Stealthwatch.Observation.source
      description: Observation source.
      type: unknown
  - arguments:
    - description: Session's start time (UTC). For example, startTime="2018-09-30T12:00:00Z".
      name: startTime
      required: true
    - description: Session's end time (UTC). For example, endTime="2018-07-31T15:00:00Z".
      name: endTime
    - defaultValue: '400'
      description: Amount of observations to list. Default is 400.
      name: limit
    - description: Source IP address to filter by.
      name: ip
    - description: Connected IP to filter by.
      name: connectedIP
    - description: Connected device ID.
      name: connectedDeviceId
    - auto: PREDEFINED
      defaultValue: all
      description: Select type of session - external/internal to receive data only about this kind of session.
      name: sessionType
      predefined:
      - all
      - external
      - internal
    description: 'Get sessions by the session''s occurrence time ( Time format: YYYY-MM-DDTHH:MM:SSZ)'
    name: sw-list-sessions
    outputs:
    - contextPath: Stealthwatch.Session.id
      description: Session ID.
      type: number
    - contextPath: Stealthwatch.Session.port
      description: Session port.
      type: number
    - contextPath: Stealthwatch.Session.start_timestamp_utc
      description: Session start time.
      type: string
    - contextPath: Stealthwatch.Session.ip
      description: Session IP.
      type: string
    - contextPath: Stealthwatch.Session.connected_ip
      description: Session connected IP.
      type: string
    - contextPath: Stealthwatch.Session.device_id
      description: Source device ID.
      type: number
    - contextPath: Stealthwatch.Session.connected_device_id
      description: Connected device ID.
      type: number
    - contextPath: Stealthwatch.Session.connected_device_is_external
      description: Is the connected device external.
      type: boolean
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10325753
tests:
- No test
fromversion: 5.0.0