category: Case Management
provider: Broadcom
commonfields:
  id: Symantec MSS
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.monitoredsecurity.com
  display: Server URL
  name: server
  required: true
  type: 0
  section: Connect
- display: Certificate (Base64 encoded)
  name: certificate
  required: true
  type: 12
  section: Connect
- display: Certificate Passphrase
  name: passphrase
  type: 4
  hidden: true
  required: false
  section: Connect
- name: passphrase_creds
  type: 9
  displaypassword: Certificate Passphrase
  hiddenusername: true
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: Emergency,Critical
  display: Fetch incidents for severities
  name: severities
  type: 0
  section: Collect
  required: false
description: Leverage the power of Symantec Managed Security Services for continual threat monitoring and customized guidance 24x7.
display: Symantec Managed Security Services
name: Symantec MSS
script:
  commands:
  - arguments:
    - default: true
      description: The incident number in the SOC.
      name: number
      required: true
    - description: To change the incident status.
      name: status
    - description: To change the incident status resolution.
      name: resolution
    - description: Update reference comments.
      name: reference
    - description: To change the incident severity.
      name: severity
    - description: 'To change incident assignment to organization (Note: assign to an organization OR a person is required).'
      name: assignOrganization
    - description: 'To change incident assignment to person. (Note: assign to an organization OR a person is required).'
      name: assignPerson
    - description: Incident update comment.
      name: comments
    description: Updates an incident's workflow by incident number.
    name: symantec-mss-update-incident
  - arguments:
    - default: true
      description: The incident number in the SOC.
      name: number
      required: true
    description: Query an incident by number.
    name: symantec-mss-get-incident
  - arguments:
    - default: true
      description: Incidents created since the specified date (i.e. 2014-09-11T18:57:36.707Z). If not supplied, defaults to the last 24 hours.
      name: time
    - description: Comma-delimited list of valid Security Incident severities set by MSS. If not supplied, all severities are returned.
      name: severities
    - description: Comma-delimited list of valid Source IP Addresses. If not supplied, all addresses are returned.
      name: sourceIp
    - description: The maximum number of incidents to return. If not supplied,  all incidents are returned.
      name: max
    description: Get a list of incidents.
    name: symantec-mss-incidents-list
  dockerimage: demisto/crypto:1.0.0.3539024
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- SymantecMSSTest
fromversion: 5.0.0