category: Analytics & SIEM
provider: Broadcom
commonfields:
  id: SymantecCloudSOCEventCollector
  version: -1
configuration:
- defaultvalue: https://api.elastica.net/casb/
  display: Server URL (e.g., https://api.elastica.net/casb/)
  name: url
  required: true
  type: 0
  section: Connect
- display: Key ID
  name: credentials
  required: true
  type: 9
  displaypassword: Key Secret
  section: Connect
- defaultvalue: 3 days
  display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days) - within the last 12 months. Recommended time is 3 days.
  name: first_fetch
  type: 0
  additionalinfo: The investigation logs start with a 'first_fetch' maximum of 180 days.
  section: Collect
  required: false
- defaultvalue: 1000
  display: Maximum number of incidents per fetch.
  name: max_fetch
  additionalinfo: max_fetch can be up to 10,000 events.
  type: 0
  section: Collect
  required: false
description: Gets Events from Symantec CloudSOC.
display: Symantec CloudSOC Event Collector
name: SymantecCloudSOCEventCollector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - defaultValue: 1000
      description: Maximum number of results to return.
      name: limit
    description: Gets events from Symantec CloudSOC.
    name: symantec-cloudsoc-get-events
  isfetchevents: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam