category: Network Security
provider: Broadcom
commonfields:
  id: Symantec Data Loss Prevention
  version: -1
configuration:
- display: Enforce Server (e.g. https://192.168.0.1)
  name: server
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  required: false
- display: Saved Report ID (Required for list incidents)
  name: saved_report_id
  type: 0
  required: false
- defaultvalue: '10'
  display: Fetch limit
  name: fetch_limit
  type: 0
  required: false
description: Deprecated. Use the Symantec Data Loss Prevention V2 integration instead. Symantec Data Loss Prevention enables you to discover, monitor and protect your sensitive corporate information.
display: Symantec Data Loss Prevention (Deprecated)
name: Symantec Data Loss Prevention
script:
  commands:
  - arguments:
    - defaultValue: 1 day
      description: Returns incidents with a creation date later than specified. Given in free text. For example, 2 days.
      name: creation_date
    description: Returns a list of incidents.
    name: symantec-dlp-list-incidents
    outputs:
    - contextPath: SymantecDLP.Incident.ID
      description: The ID of the Incident.
      type: Number
  - arguments:
    - description: The Incident ID for which to return details.
      name: incident_id
      required: true
    - auto: PREDEFINED
      default: true
      defaultValue: none
      description: |-
        Adds additional information to an incident. The following values can be used:
        all - All custom attributes are needed.
        none - None of the custom attributes are needed.
        specific attributes - A comma separated list of custom attributes names. For example, ca1,ca2,ca3.
        custom attribute group name - A comma separated list of custom attributes group names. For example, cag1, cag2, cag3. This value retrieves all custom attributes in the relevant group.
        Default is none.
      name: custom_attributes
      predefined:
      - all
      - none
      - specific attributes
      - custom attribute group name
    - description: A comma separated list of custom attributes names or group names. For example, item1,item2,item3.
      name: custom_data
    description: Returns the details of the specified incident.
    name: symantec-dlp-get-incident-details
    outputs:
    - contextPath: SymantecDLP.Incident.ID
      description: The ID of the incident.
      type: Number
    - contextPath: SymantecDLP.Incident.LongID
      description: The long ID of the incident.
      type: Number
    - contextPath: SymantecDLP.Incident.StatusCode
      description: The status code of the incident.
      type: String
    - contextPath: SymantecDLP.Incident.CreationDate
      description: The creation date of the incident.
      type: Date
    - contextPath: SymantecDLP.Incident.DetectionDate
      description: The detection date of the incident.
      type: Date
    - contextPath: SymantecDLP.Incident.Severity
      description: The severity of the incident.
      type: String
    - contextPath: SymantecDLP.Incident.MessageSource
      description: The localized label that corresponds to the Symantec DLP product that generated the incident.
      type: String
    - contextPath: SymantecDLP.Incident.MessageSourceType
      description: 'Indicates the Symantec DLP product that generated the incident. Can be: "NETWORK", "DISCOVER", "ENDPOINT", "DIM", and "DAR".'
      type: String
    - contextPath: SymantecDLP.Incident.MessageType
      description: Indicates the Symantec DLP product component that generated the incident.
      type: String
    - contextPath: SymantecDLP.Incident.MessageTypeID
      description: The ID of the Message Type.
      type: Number
    - contextPath: SymantecDLP.Incident.Policy.Name
      description: The name of the policy.
      type: String
    - contextPath: SymantecDLP.Incident.Policy.Version
      description: The version of the policy.
      type: String
    - contextPath: SymantecDLP.Incident.Policy.Label
      description: The label of the policy.
      type: String
    - contextPath: SymantecDLP.Incident.Policy.ID
      description: The ID of the policy.
      type: Number
    - contextPath: SymantecDLP.Incident.BlockedStatus
      description: Indicates whether the message was blocked.
      type: String
    - contextPath: SymantecDLP.Incident.MatchCount
      description: Indicates the number of detection rule matches in the incident.
      type: Number
    - contextPath: SymantecDLP.Incident.RuleViolationCount
      description: Indicates the number of policy rules that were violated.
      type: Number
    - contextPath: SymantecDLP.Incident.DetectionServer
      description: The name of the detection server that created the incident.
      type: String
    - contextPath: SymantecDLP.Incident.DataOwner.Name
      description: The name of the data owner.
      type: String
    - contextPath: SymantecDLP.Incident.DataOwner.Email
      description: The email of the data owner.
      type: String
    - contextPath: SymantecDLP.Incident.EventDate
      description: The date and time at which the violation event occurred.
      type: Date
    - contextPath: SymantecDLP.Incident.ViolatedPolicyRule.Name
      description: The name of the rule within the policy that the message violated.
      type: String
    - contextPath: SymantecDLP.Incident.ViolatedPolicyRule.ID
      description: The ID of the rule within the policy that the message violated.
      type: Number
    - contextPath: SymantecDLP.Incident.OtherViolatedPolicy.Name
      description: The name of any additional policies that the message violated.
      type: String
    - contextPath: SymantecDLP.Incident.OtherViolatedPolicy.Version
      description: The version of any additional policies that the message violated.
      type: String
    - contextPath: SymantecDLP.Incident.OtherViolatedPolicy.Label
      description: The label of any additional policies that the message violated.
      type: String
    - contextPath: SymantecDLP.Incident.OtherViolatedPolicy.ID
      description: The ID of any additional policies that the message violated.
      type: Number
    - contextPath: SymantecDLP.Incident.CustomAttribute.Name
      description: The custom attribute name.
      type: String
    - contextPath: SymantecDLP.Incident.CustomAttribute.Value
      description: The custom attribute value.
      type: String
  - arguments:
    - description: Incident ID to update.
      name: incident_id
    - auto: PREDEFINED
      description: 'Represents the severity level of the incident. Can be: "High", "Medium", "Low", and "Info".'
      name: severity
      predefined:
      - High
      - Medium
      - Low
      - Info
    - description: |-
        Represents the status value of the incident.
        Define incident status values using the
        Enforce Server administration console.
      name: status
    - auto: PREDEFINED
      description: |-
        Represents the remediation status of an
        incident.
      name: remediation_status
      predefined:
      - BLOCKED
      - CONTENT_REMOVED
      - CUSTOM_ACTION_ON_EMAIL
      - EMAIL_APPROVED
      - EMAIL_BLOCKED
      - EMAIL_MESSAGE_EXPUNGED
      - EMAIL_QUARANTINED
      - ENDPOINT_BLOCK
      - ENDPOINT_NOTIFY
      - ENDPOINT_FILE_QUARANTINED
      - ENDPOINT_FILE_QUARANTINE_FAILED
      - ENDPOINT_NOTIFY_CANCEL_ALLOW
      - ENDPOINT_NOTIFY_CANCEL_BLOCK
      - ENDPOINT_NOTIFY_CANCEL_TIMEOUT_ALLOW
      - ENDPOINT_NOTIFY_CANCEL_TIMEOUT_BLOCK
      - FLEX_RESPONSE_ERROR
      - FLEX_RESPONSE_EXECUTED
      - FLEX_RESPONSE_REQUESTED
      - MESSAGE_MODIFIED
      - PASSED
      - PLACE_HOLDER_DO_NOT_USE
      - PROTECT_FILE_COPIED
      - PROTECT_FILE_DELETED
      - PROTECT_FILE_QUARANTINED
      - PROTECT_REMEDIATION_ERROR
      - REST_ENCRYTPED
      - REST_PERFORMED_DRM
      - REST_PERFORMED_BREAK_LINKS
      - REST_PERFORMED_CUSTOM_ACTION
    - description: |-
        Represents the remediation location of the
        incident. Values can be user-defined.
      name: remediation_location
    - description: The custom attribute name.
      name: custom_attribute_name
    - description: The custom attribute value.
      name: custom_attribute_value
    - description: The data owner name.
      name: data_owner_name
    - description: The data owner email.
      name: data_owner_email
    - description: The note to be added.
      name: note
    - description: The time of the note in ISO format.
      name: note_time
    description: Updates the details of a specific incident.
    name: symantec-dlp-update-incident
  - arguments:
    - description: The Incident ID for which to get binaries.
      name: incident_id
    - auto: PREDEFINED
      defaultValue: 'True'
      description: Whether the Web Service includes the original message in the response document.
      name: include_original_message
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'True'
      description: Whether the Web Service includes all message components (such as, headers and file attachments) in the response document.
      name: include_all_components
      predefined:
      - 'True'
      - 'False'
    description: |-
      Retrieves additional components of the message that generated the
      incident. May include binary files.
    execution: true
    name: symantec-dlp-incident-binaries
    outputs:
    - contextPath: SymantecDLP.Incident.ID
      description: The ID of the incident.
      type: Number
    - contextPath: SymantecDLP.Incident.LongID
      description: The long ID of the incident.
      type: Number
    - contextPath: SymantecDLP.Incident.OriginalMessage
      description: The original message of the incident.
      type: String
    - contextPath: SymantecDLP.Component.ID
      description: The ID of the component.
      type: Number
    - contextPath: SymantecDLP.Component.Name
      description: The name of the component.
      type: String
    - contextPath: SymantecDLP.Component.TypeID
      description: The ID of the type of the component.
      type: Number
    - contextPath: SymantecDLP.Component.Type
      description: The type of the component.
      type: String
    - contextPath: SymantecDLP.Component.Content
      description: The content of the component.
      type: String
    - contextPath: SymantecDLP.Component.LongID
      description: The long ID of the component.
      type: Number
  - description: |-
      Returns a list of all custom attribute names defined in
      the Symantec DLP deployment.
    name: symantec-dlp-list-custom-attributes
  - description: |-
      Returns a list of the custom status values defined in the
      Symantec DLP deployment.
    name: symantec-dlp-list-incident-status
  - arguments:
    - description: The ID of the incident.
      name: incident_id
    - auto: PREDEFINED
      defaultValue: 'True'
      description: Whether image violations should be included in the Incident Violations Response.
      name: include_image_violations
      predefined:
      - 'True'
      - 'False'
    description: Returns the highlighted matches of a specific incident.
    name: symantec-dlp-incident-violations
    outputs:
    - contextPath: SymantecDLP.Incident.ID
      description: The ID of the incident.
      type: Number
    - contextPath: SymantecDLP.Incident.LongID
      description: The long ID of the incident.
      type: Number
    - contextPath: SymantecDLP.Incident.StatusCode
      description: The status code of the incident.
      type: String
    - contextPath: SymantecDLP.Incident.ViolatingComponent.Name
      description: The name of the violating component.
      type: String
    - contextPath: SymantecDLP.Incident.ViolatingComponent.DocumentFormat
      description: The document format of the violating component.
      type: String
    - contextPath: SymantecDLP.Incident.ViolatingComponent.Type
      description: The type of the violating component.
      type: String
    - contextPath: SymantecDLP.Incident.ViolatingComponent.TypeID
      description: The type ID of the violating component.
      type: Number
    - contextPath: SymantecDLP.Incident.ViolatingComponent.ViolatingCount
      description: The number of policy rules that were violated.
      type: Number
    - contextPath: SymantecDLP.Incident.ViolatingComponent.ViolatingSegment.DocumentViolation
      description: Details about the document violation.
      type: String
    - contextPath: SymantecDLP.Incident.ViolatingComponent.ViolatingSegment.FileSizeViolation
      description: Details about the file size violation.
      type: Number
    - contextPath: SymantecDLP.Incident.ViolatingComponent.ViolatingSegment.Text.Data
      description: The data that triggered the violation.
      type: String
    - contextPath: SymantecDLP.Incident.ViolatingComponent.ViolatingSegment.Text.Type
      description: The type of data that triggered the violation.
      type: String
    - contextPath: SymantecDLP.Incident.ViolatingComponent.ViolatingSegment.Text.RuleID
      description: The rule ID which triggered the violation.
      type: Number
    - contextPath: SymantecDLP.Incident.ViolatingComponent.ViolatingSegment.Text.RuleName
      description: The rule name which triggered the violation.
      type: String
  dockerimage: demisto/zeep:1.0.0.23423
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
deprecated: true