name: SysdigResponseActions
display: Sysdig Response Actions
category: Data Enrichment & Threat Intelligence
provider: Sysdig
sectionorder:
- Connect
- Collect
commonfields:
  id: SysdigResponseActions
  version: -1
configuration:
- name: url
  type: 0
  defaultvalue: https://us2.app.sysdig.com
  required: true
  display: Your server URL
  section: Connect
- name: credentials
  type: 9
  required: true
  section: Connect
  displaypassword: API Key
  hiddenusername: true
- name: insecure
  type: 8
  required: false
  display: Trust any certificate (not secure)
  section: Connect
- name: proxy
  type: 8
  required: false
  display: Use system proxy settings
  section: Connect
- name: classifier
  type: 13
  required: false
  display: Classifier
  section: Collect
- name: mapper
  type: 13
  defaultvalue: Sysdig Mapper Runtime Event
  required: false
  display: Mapper (incoming)
  section: Collect
- name: isFetch
  type: 8
  display: Fetch incidents
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- name: incidentType
  type: 13
  display: Incident type
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- name: max_fetch
  type: 0
  defaultvalue: '50'
  display: The maximum number of incidents per fetch
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- name: first_fetch
  type: 0
  defaultvalue: 7 days
  required: false
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  section: Collect
description: Uses the Sysdig agent to respond to malicious activity by triggering different actions at the host or container level, such as killing a container, quarantining a file, or performing a system capture.
script:
  commands:
  - name: execute-response-action
    deprecated: false
    description: "Executes response actions through the Sysdig API. Each action type requires a specific set of parameters.\nUse the actionType description to see which parameters are required for each action."
    arguments:
    - name: actionType
      description: "The action type to perform. Required parameters per action:\n- KILL_PROCESS: host_id, process_id (startTime defaults to -1)\n- KILL_CONTAINER: host_id, container_id\n- STOP_CONTAINER: host_id, container_id\n- PAUSE_CONTAINER: host_id, container_id\n- UNPAUSE_CONTAINER: host_id, container_id\n- START_CONTAINER: host_id, container_id\n- FILE_QUARANTINE: host_id, path_absolute (optional: container_id)\n- FILE_ACQUIRE: host_id, path_absolute (optional: container_id)\n- FILE_UNQUARANTINE: host_id, path_absolute, quarantined_file_path (optional: container_id)\n- DELETE_POD: k8s_cluster_name, k8s_namespace_name, k8s_pod_name\n- ROLLOUT_RESTART: k8s_cluster_name, k8s_namespace_name, k8s_workload_type, k8s_workload_name\n- ISOLATE_NETWORK: k8s_cluster_name, k8s_namespace_name, k8s_workload_type, k8s_workload_name (optional: network_protocol, network_port, network_cidr, network_direction)\n- DELETE_NETWORK_POLICY: k8s_cluster_name, k8s_namespace_name, network_policy_name\n- GET_LOGS: k8s_cluster_name, k8s_namespace_name (optional: k8s_workload_type, k8s_workload_name, k8s_pod_name, k8s_container_name, previous, all_containers)\n- KUBERNETES_VOLUME_SNAPSHOT: k8s_cluster_name, k8s_namespace_name (optional: k8s_pvc_name, k8s_workload_type, k8s_workload_name)\n- KUBERNETES_DELETE_VOLUME_SNAPSHOT: k8s_cluster_name, k8s_namespace_name, k8s_pvc_name, k8s_volume_snapshot_name\n- CAPTURE: host_id, capture_storage_config_id, capture_duration_ns, capture_past_duration_ns (optional: capture_filters, capture_max_size, container_id, capture_token)\n- IAM_QUARANTINE: cloud_provider, cloud_account_id (optional: ct_user_arn, ct_user_identity_type, ct_user)\n- IAM_UNQUARANTINE: cloud_provider, cloud_account_id, iam_policy_name, ct_user_identity_type, ct_user\n- MAKE_PRIVATE_CLOUD_RESOURCE: cloud_provider, cloud_account_id, cloud_resource_type, cloud_resource_name (optional: cloud_region)\n- UNDO_MAKE_PRIVATE_CLOUD_RESOURCE: cloud_provider, cloud_account_id, cloud_resource_type, cloud_resource_name, previous_public_access_settings (optional: cloud_region)\n- CLOUD_VOLUME_SNAPSHOT: cloud_provider, cloud_account_id, cloud_region, aws_instance_id\n- UNDO_CLOUD_VOLUME_SNAPSHOT: cloud_provider, cloud_account_id, cloud_region, snapshot_ids, aws_instance_id\n- FETCH_CLOUD_LOGS: cloud_provider, cloud_account_id, cloud_region, from_timestamp, to_timestamp (optional: ct_original_user, ct_name, ct_src)."
      required: true
      predefined:
      - KILL_PROCESS
      - KILL_CONTAINER
      - STOP_CONTAINER
      - PAUSE_CONTAINER
      - UNPAUSE_CONTAINER
      - START_CONTAINER
      - FILE_QUARANTINE
      - FILE_ACQUIRE
      - FILE_UNQUARANTINE
      - DELETE_POD
      - ROLLOUT_RESTART
      - ISOLATE_NETWORK
      - DELETE_NETWORK_POLICY
      - GET_LOGS
      - KUBERNETES_VOLUME_SNAPSHOT
      - KUBERNETES_DELETE_VOLUME_SNAPSHOT
      - CAPTURE
      - IAM_QUARANTINE
      - IAM_UNQUARANTINE
      - MAKE_PRIVATE_CLOUD_RESOURCE
      - UNDO_MAKE_PRIVATE_CLOUD_RESOURCE
      - CLOUD_VOLUME_SNAPSHOT
      - UNDO_CLOUD_VOLUME_SNAPSHOT
      - FETCH_CLOUD_LOGS
      deprecated: false
      hidden: false
      auto: PREDEFINED
    - name: callerId
      description: The unique caller identifier for the audit trail.
      required: true
      deprecated: false
      type: String
      hidden: false
    - name: host_id
      description: 'The host ID where the agent runs. Required for: KILL_PROCESS, KILL_CONTAINER, STOP_CONTAINER, PAUSE_CONTAINER, UNPAUSE_CONTAINER, START_CONTAINER, FILE_QUARANTINE, FILE_ACQUIRE, FILE_UNQUARANTINE, CAPTURE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: container_id
      description: 'The container ID. Required for: KILL_CONTAINER, STOP_CONTAINER, PAUSE_CONTAINER, UNPAUSE_CONTAINER, START_CONTAINER. Optional for: FILE_QUARANTINE, FILE_ACQUIRE, FILE_UNQUARANTINE, CAPTURE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: process_id
      description: 'The process ID to kill. Required for: KILL_PROCESS.'
      required: false
      deprecated: false
      type: Number
      hidden: false
    - name: path_absolute
      description: 'The absolute file path. Required for: FILE_QUARANTINE, FILE_ACQUIRE, FILE_UNQUARANTINE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: quarantined_file_path
      description: 'The path of the quarantined file. Required for: FILE_UNQUARANTINE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: k8s_cluster_name
      description: 'The Kubernetes cluster name. Required for: DELETE_POD, ROLLOUT_RESTART, ISOLATE_NETWORK, DELETE_NETWORK_POLICY, GET_LOGS, KUBERNETES_VOLUME_SNAPSHOT, KUBERNETES_DELETE_VOLUME_SNAPSHOT.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: k8s_namespace_name
      description: 'The Kubernetes namespace. Required for: DELETE_POD, ROLLOUT_RESTART, ISOLATE_NETWORK, DELETE_NETWORK_POLICY, GET_LOGS, KUBERNETES_VOLUME_SNAPSHOT, KUBERNETES_DELETE_VOLUME_SNAPSHOT.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: k8s_pod_name
      description: 'The Kubernetes pod name. Required for: DELETE_POD. Optional for: GET_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: k8s_workload_type
      description: 'The Kubernetes workload type (for example, Deployment, StatefulSet, DaemonSet). Required for: ROLLOUT_RESTART, ISOLATE_NETWORK. Optional for: GET_LOGS, KUBERNETES_VOLUME_SNAPSHOT.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: k8s_workload_name
      description: 'The Kubernetes workload name. Required for: ROLLOUT_RESTART, ISOLATE_NETWORK. Optional for: GET_LOGS, KUBERNETES_VOLUME_SNAPSHOT.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: k8s_pvc_name
      description: 'The PVC name. Optional for: KUBERNETES_VOLUME_SNAPSHOT. Required for: KUBERNETES_DELETE_VOLUME_SNAPSHOT.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: k8s_volume_snapshot_name
      description: 'The volume snapshot name. Required for: KUBERNETES_DELETE_VOLUME_SNAPSHOT.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: k8s_container_name
      description: 'The container name for log retrieval. Optional for: GET_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: network_policy_name
      description: 'The network policy name. Required for: DELETE_NETWORK_POLICY.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: network_protocol
      description: 'The network protocol (TCP, UDP). Optional for: ISOLATE_NETWORK.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: network_port
      description: 'The port number. Optional for: ISOLATE_NETWORK.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: network_cidr
      description: 'The CIDR range. Optional for: ISOLATE_NETWORK.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: network_direction
      description: 'The traffic direction (ingress, egress). Optional for: ISOLATE_NETWORK.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: previous
      description: 'Whether to retrieve logs from the previous container instance. Optional for: GET_LOGS.'
      required: false
      deprecated: false
      type: Boolean
      hidden: false
    - name: all_containers
      description: 'Whether to retrieve logs from all containers. Optional for: GET_LOGS.'
      required: false
      deprecated: false
      type: Boolean
      hidden: false
    - name: capture_storage_config_id
      description: 'The remote storage configuration ID. Required for: CAPTURE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: capture_duration_ns
      description: 'The capture duration in nanoseconds. Required for: CAPTURE.'
      required: false
      deprecated: false
      type: Number
      hidden: false
    - name: capture_past_duration_ns
      description: 'The amount of time to capture retroactively, in nanoseconds. Required for: CAPTURE.'
      required: false
      deprecated: false
      type: Number
      hidden: false
    - name: capture_filters
      description: 'The syscall filter expression. Optional for: CAPTURE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: capture_max_size
      description: 'The maximum capture file size in bytes (0 = no limit). Optional for: CAPTURE.'
      required: false
      deprecated: false
      type: Number
      hidden: false
    - name: capture_token
      description: 'The base name of the capture file. Optional for: CAPTURE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: cloud_provider
      description: 'The cloud provider name (for example, aws). Required for: IAM_QUARANTINE, IAM_UNQUARANTINE, MAKE_PRIVATE_CLOUD_RESOURCE, UNDO_MAKE_PRIVATE_CLOUD_RESOURCE, CLOUD_VOLUME_SNAPSHOT, UNDO_CLOUD_VOLUME_SNAPSHOT, FETCH_CLOUD_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: cloud_account_id
      description: 'The cloud account ID. Required for: IAM_QUARANTINE, IAM_UNQUARANTINE, MAKE_PRIVATE_CLOUD_RESOURCE, UNDO_MAKE_PRIVATE_CLOUD_RESOURCE, CLOUD_VOLUME_SNAPSHOT, UNDO_CLOUD_VOLUME_SNAPSHOT, FETCH_CLOUD_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: cloud_region
      description: 'The cloud region. Required for: CLOUD_VOLUME_SNAPSHOT, UNDO_CLOUD_VOLUME_SNAPSHOT, FETCH_CLOUD_LOGS. Optional for: MAKE_PRIVATE_CLOUD_RESOURCE, UNDO_MAKE_PRIVATE_CLOUD_RESOURCE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: ct_user_arn
      description: 'The AWS identity ARN. Optional for: IAM_QUARANTINE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: ct_user_identity_type
      description: 'The AWS identity type (IAMUser, Role, AssumedRole). Required for: IAM_UNQUARANTINE. Optional for: IAM_QUARANTINE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: ct_user
      description: 'The AWS identity name. Required for: IAM_UNQUARANTINE. Optional for: IAM_QUARANTINE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: ct_original_user
      description: 'The CloudTrail original user. Optional for: FETCH_CLOUD_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: ct_name
      description: 'The CloudTrail event name. Optional for: FETCH_CLOUD_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: ct_src
      description: 'The CloudTrail source. Optional for: FETCH_CLOUD_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: iam_policy_name
      description: 'The IAM policy name to remove. Required for: IAM_UNQUARANTINE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: cloud_resource_type
      description: 'The cloud resource type (rds, s3). Required for: MAKE_PRIVATE_CLOUD_RESOURCE, UNDO_MAKE_PRIVATE_CLOUD_RESOURCE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: cloud_resource_name
      description: 'The cloud resource name. Required for: MAKE_PRIVATE_CLOUD_RESOURCE, UNDO_MAKE_PRIVATE_CLOUD_RESOURCE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: previous_public_access_settings
      description: 'The previous public access settings. Required for: UNDO_MAKE_PRIVATE_CLOUD_RESOURCE.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: aws_instance_id
      description: 'The AWS instance ID. Required for: CLOUD_VOLUME_SNAPSHOT, UNDO_CLOUD_VOLUME_SNAPSHOT.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: snapshot_ids
      description: 'The comma-separated snapshot IDs. Required for: UNDO_CLOUD_VOLUME_SNAPSHOT.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: from_timestamp
      description: 'The start timestamp for the log search. Required for: FETCH_CLOUD_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    - name: to_timestamp
      description: 'The end timestamp for the log search. Required for: FETCH_CLOUD_LOGS.'
      required: false
      deprecated: false
      type: String
      hidden: false
    outputs:
    - description: The output of the response-actions API.
      contextPath: execute_response_action.Output
      type: Dict
      important: false
  - name: create-system-capture
    deprecated: false
    description: Triggers a system capture, recording all system calls at the host level.
    arguments:
    - name: container_id
      description: 'The container ID to apply the action. Example "container.id": "123456789123".'
      required: true
      deprecated: false
      type: String
      hidden: false
    - name: host_name
      description: The host name. Example "ip-1-1-1-1.us-west-1.compute.internal".
      required: true
      deprecated: false
      type: String
      hidden: false
    - name: capture_name
      description: The capture name.
      required: true
      deprecated: false
      type: String
      hidden: false
    - name: agent_id
      description: The agent ID.
      required: true
      deprecated: false
      type: String
      hidden: false
    - name: customer_id
      description: The customer ID.
      required: true
      deprecated: false
      type: String
      hidden: false
    - name: machine_id
      description: The machine ID/MAC. Example "01:aa:02:bb:03:cc".
      required: true
      deprecated: false
      type: String
      hidden: false
    - name: scan_duration
      description: The capture duration in seconds.
      required: false
      deprecated: false
      type: Number
      hidden: false
    - name: scap_filter
      description: 'The filter for the scope of the capture to take. Example: (proc.name=ncat or proc.name=vi).'
      required: false
      deprecated: false
      type: String
      hidden: false
    outputs:
    - description: The output of the created system capture.
      contextPath: create_system_capture.Output
      type: Dict
      important: false
  - name: get-capture-file
    deprecated: false
    description: Gets a system capture based on the capture ID.
    arguments:
    - name: capture_id
      description: The system capture ID.
      required: true
      deprecated: false
      type: Number
      hidden: false
    outputs:
    - description: The output of the downloaded system capture.
      contextPath: get_capture_file.Output
      type: Dict
      important: false
  - name: get-action-execution
    deprecated: false
    description: Gets the status and information of a triggered action execution.
    arguments:
    - name: action_execution_id
      description: The action execution ID.
      required: true
      deprecated: false
      type: String
      hidden: false
    outputs:
    - description: The output of the action execution info.
      contextPath: get_action_execution.Output
      type: Dict
      important: false
  - name: sysdig-agent-info-get
    deprecated: false
    description: Resolves a host MAC address to its Sysdig agent details (agent ID, customer ID, hostname). The result is cached per MAC address.
    arguments:
    - name: machine_id
      description: The MAC address (machineId) of the host to look up.
      required: true
      deprecated: false
      type: String
      hidden: false
    - name: force_refresh
      description: Whether to force a refresh of the cached agent info from the Sysdig API.
      required: false
      deprecated: false
      type: Boolean
      hidden: false
    outputs:
    - description: The Sysdig agent ID.
      contextPath: Sysdig.Agent.agentId
      type: String
      important: false
    - description: The Sysdig customer ID.
      contextPath: Sysdig.Agent.customerId
      type: String
      important: false
    - description: The agent hostname.
      contextPath: Sysdig.Agent.hostName
      type: String
      important: false
    - description: The host MAC address.
      contextPath: Sysdig.Agent.machineId
      type: String
      important: false
    - description: The opaque host identifier.
      contextPath: Sysdig.Agent.hostId
      type: String
      important: false
    - description: The Kubernetes cluster name.
      contextPath: Sysdig.Agent.clusterName
      type: String
      important: false
  - name: sysdig-customer-info-get
    deprecated: false
    description: Gets the Sysdig customer ID and name. The result is cached per integration instance.
    arguments:
    - name: force_refresh
      description: Whether to force a refresh of the cached customer info from the Sysdig API.
      required: false
      deprecated: false
      type: Boolean
      hidden: false
    outputs:
    - description: The Sysdig customer ID.
      contextPath: Sysdig.Customer.customerId
      type: String
      important: false
    - description: The Sysdig customer name.
      contextPath: Sysdig.Customer.customerName
      type: String
      important: false
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  isFetchSamples: true
  runonce: false
  script: ''
  subtype: python3
  type: python
marketplaces:
- xsoar
- marketplacev2
- xsoar_saas
- platform
tests:
- No tests (auto formatted)
fromversion: 6.10.0
toversion: 99.99.99