commonfields: id: TaegisXDR version: -1 name: TaegisXDR display: TaegisXDR (Deprecated) deprecated: true category: Data Enrichment & Threat Intelligence provider: Sophos description: Deprecated. Use TaegisXDR v2 instead. configuration: - display: Taegis Environment name: environment type: 15 required: true options: - US1 - US2 - EU additionalinfo: Used to determine the URL and API endpoint to utilize for your tenant - display: Trust any certificate (not secure) name: insecure type: 8 defaultvalue: "false" required: false - display: Use system proxy settings name: proxy type: 8 required: false - display: Client ID name: client_id type: 4 required: true - display: Client Secret name: client_secret type: 4 required: true - display: Fetch incidents name: isFetch type: 8 required: false - name: max_fetch defaultvalue: '15' display: Maximum number of incidents per fetch type: 0 additionalinfo: The maximum limit is 200. required: false - name: first_fetch defaultvalue: 3 days display: First fetch time interval type: 0 additionalinfo: 'Date or relative timestamp to start fetching incidents from. For Alert, incidents will be fetched based on triggered date. For Event, the incidents will be fetched based on event time. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.).' required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: "1" type: 19 required: false - display: Incident type name: incidentType type: 13 required: false - display: Include Assets in Fetch name: include_assets defaultvalue: "true" type: 8 additionalinfo: An error can occur when the API is slow or there are a large numbers of assets being added to a new incident/investigation. Disabling this will fetch incidents without including asset information, allowing time for the investigation creation to be completed. required: false script: script: '' type: python commands: - name: taegis-fetch-alerts arguments: - name: ids description: A list of alert IDs or string of comma-separated alert IDs to return isArray: true - name: cql_query description: The Taegis CQL query to for searching Alerts - name: limit default: true description: Number of results to return per page defaultValue: "10" - name: offset description: The results to start with defaultValue: "0" outputs: - contextPath: TaegisXDR.Alerts description: List of Taegis alerts description: List Taegis alerts by ID - name: taegis-fetch-investigation arguments: - name: id description: The investigation ID to lookup - name: page description: The page number for fetching investigations defaultValue: "0" - name: page_size description: Number of investigations to return defaultValue: "10" - name: status description: A list of statuses to use when searching for investigations isArray: true outputs: - contextPath: TaegisXDR.Investigations description: Dictionary of the located Taegis investigation description: Fetch all investigations or a specific investigation - name: taegis-create-investigation arguments: - name: description required: true description: The description of the investigation - name: priority required: true default: true auto: PREDEFINED predefined: - "1" - "2" - "3" - "4" - "5" description: The priority of the investigation (1-5) defaultValue: "2" outputs: - contextPath: TaegisXDR.Investigation description: The investigation ID that was created description: Create an Investigation within Taegis - name: taegis-update-investigation arguments: - name: id required: true description: The investigation ID to update - name: priority description: The priority of the investigation (1-5) - name: key_findings description: The Key Findings field of the investigation - name: status auto: PREDEFINED predefined: - Open - Active - Awaiting Action - Suspended - 'Closed: Authorized Activity' - 'Closed: Confirmed Security Incident' - 'Closed: False Positive Alert' - 'Closed: Inconclusive' - 'Closed: Informational' - 'Closed: Not Vulnerable' - 'Closed: Threat Mitigated' description: New status for the investigation - name: service_desk_id description: An ticket or ID for to an external system for reference - name: service_desk_type description: The type of service desk id (e.g. XSOAR) - name: assignee_id description: The auth0 ID of a user, in 'auth0|12345' format outputs: - contextPath: TaegisXDR.InvestigationUpdate description: ID of the updated Taegis investigation description: Update an existing investigation - name: taegis-fetch-investigation-alerts arguments: - name: id required: true description: The investigation ID related to the alerts - name: page description: Page number of the investigation alerts defaultValue: "0" - name: page_size description: Number of alerts per investigation query defaultValue: "10" outputs: - contextPath: TaegisXDR.InvestigationAlerts description: List of alerts related to a Taegis investigation description: Fetch Alert IDs related to a specific investigation - name: taegis-execute-playbook arguments: - name: id required: true description: The ID of the playbook instance to execute - name: inputs description: JSON Object of optional playbook inputs outputs: - contextPath: TaegisXDR.Execution description: The playbook execution ID type: string description: Executes a Taegis playbook instance execution: true - name: taegis-fetch-playbook-execution arguments: - name: id required: true description: Playbook execution ID outputs: - contextPath: TaegisXDR.PlaybookExecution description: Returns related execution information description: Fetch the results of a Taegis playbook instance execution - name: taegis-fetch-comment arguments: - name: id required: true description: The ID of the comment to fetch outputs: - contextPath: TaegisXDR.Comment description: Return the comment description: Fetch comment by comment ID - name: taegis-fetch-comments arguments: - name: parent_id required: true description: The ID of the parent related to the comments - name: parent_type description: The parent type that the comments belong to defaultValue: investigation outputs: - contextPath: TaegisXDR.Comments description: A list of comments to return description: Fetch comments by Parent Type and ID - name: taegis-create-comment arguments: - name: comment required: true description: The comment string to add to the parent - name: parent_id required: true description: The parent that the comment is being added to - name: parent_type description: The parent type that the comment is being added to defaultValue: investigation outputs: - contextPath: TaegisXDR.CommentCreate description: The created comment information description: Create a comment on an investigation - name: taegis-update-comment arguments: - name: id required: true description: The ID of the comment to update - name: comment required: true description: String to update/replace the comment with outputs: - contextPath: TaegisXDR.CommentUpdate description: The comment update results description: Update an existing comment - name: taegis-fetch-users arguments: - name: id description: The auth0 ID, in 'auth0|12345' format - name: email description: The email address to search for - name: status description: Search by user status - name: page description: Page for results defaultValue: "0" - name: page_size description: Results to return per page defaultValue: "10" outputs: - contextPath: TaegisXDR.Users description: The located user(s) description: Fetch a user by ID or email address - name: taegis-archive-investigation arguments: - name: id required: true description: ID of investigation to update outputs: - contextPath: TaegisXDR.ArchivedInvestigation description: The results from archiving an investigation description: Archive an investigation - name: taegis-unarchive-investigation arguments: - name: id required: true description: ID of investigation to update outputs: - contextPath: TaegisXDR.UnarchivedInvestigation description: The results from unarchiving an investigation description: Unarchive an investigation - name: taegis-update-alert-status arguments: - name: ids required: true description: A list of alert IDs or string of comma-separated alert IDs to return isArray: true - name: status required: true auto: PREDEFINED predefined: - FALSE_POSITIVE - NOT_ACTIONABLE - OPEN - TRUE_POSITIVE_BENIGN - TRUE_POSITIVE_MALICIOUS description: The status to update the alert with - name: reason description: A simple comment/reason for the status change outputs: - contextPath: TaegisXDR.AlertStatusUpdate description: The result of the alert status update description: Update the status of an alert - name: taegis-fetch-assets arguments: - name: page description: Search results page number defaultValue: "0" - name: page_size description: The number of results per-page defaultValue: "10" - name: endpoint_type description: Filter assets by asset type - name: host_id description: Filter assets by host ID - name: hostname description: Filter assets by hostname - name: investigation_id description: Filter assets by related investigation ID - name: ip_address description: Filter assets by IP address - name: mac_address description: Filter assets by MAC address - name: os_family description: Filter assets by OS family - name: os_version description: Filter assets by OS version - name: sensor_version description: Filter assets by sensor version - name: username description: Filter assets by username outputs: - contextPath: TaegisXDR.Assets description: A list of located assets description: Fetch assets based on search criteria - name: taegis-isolate-asset arguments: - name: id required: true description: Asset ID to isolate - name: reason required: true description: A reason for the isolation outputs: - contextPath: TaegisXDR.AssetIsolation description: Results from the asset isolation description: Isolate a specific asset - name: taegis-fetch-endpoint arguments: - name: id required: true description: The endpoint ID to fetch outputs: - contextPath: TaegisXDR.Endpoint description: Results from fetching the endpoint information description: Fetch endpoint information dockerimage: demisto/python3:3.10.12.65389 subtype: python3 isfetch: true isFetchSamples: true fromversion: 5.5.0 tests: - No tests (auto formatted)