category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: Harness
commonfields:
  id: Traceable
  version: -1
configuration:
- display: Traceable Platform API Endpoint URL
  name: url
  defaultvalue: https://api.traceable.ai
  type: 0
  required: true
  section: Connect
- display: ""
  displaypassword: API Token
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  defaultvalue: 'true'
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  defaultvalue: 1 days
  type: 0
  required: false
  section: Collect
- name: max_fetch
  display: Max number of records to fetch per API call to Traceable API Endpoint
  required: false
  type: 0
  defaultvalue: '100'
  section: Collect
- name: span_fetch_threadpool
  display: Number of span queries to run in parallel
  required: false
  type: 0
  defaultvalue: '5'
  section: Collect
- display: "Max spans per thread (1 to 1000)"
  name: span_query_batch_size
  type: 0
  required: false
  additionalinfo: Provide a value between 1 and 1000.
  defaultvalue: '50'
  section: Connect
- display: "Comma Separated Environment List To Process"
  name: environment
  type: 12
  required: false
  section: Connect
- display: "Security Score Category"
  name: securityScoreCategory
  defaultvalue: CRITICAL,HIGH,MEDIUM
  type: 16
  required: false
  options:
  - CRITICAL
  - HIGH
  - MEDIUM
  - LOW
  section: Collect
- display: "Threat Category"
  name: threatCategory
  defaultvalue: Malicious Activities,API Abuse,Malicious Sources
  type: 16
  required: false
  options:
  - Malicious Activities
  - API Abuse
  - Malicious Sources
  section: Collect
- display: "IP Reputation Level"
  name: ipReputationLevel
  defaultvalue: CRITICAL,HIGH,MEDIUM
  type: 16
  required: false
  options:
  - CRITICAL
  - HIGH
  - MEDIUM
  - LOW
  - UNKNOWN
  section: Collect
- display: "IP Abuse Velocity"
  name: ipAbuseVelocity
  type: 16
  required: false
  options:
  - CRITICAL
  - HIGH
  - MEDIUM
  - LOW
  - UNKNOWN
  defaultvalue: CRITICAL,HIGH,MEDIUM
  section: Collect
- display: "IP Location Type"
  name: ipCategories
  required: false
  type: 16
  options:
  - Anonymous VPN
  - Hosting Provider
  - Public Proxy
  - TOR Exit Node
  - BOT
  - Unknown
  section: Collect
- display: Traceable Platform Endpoint URL
  defaultvalue: https://app.traceable.ai
  name: app_url
  required: false
  type: 0
  section: Connect
- display: Incident type
  name: incidentType
  defaultvalue: Exploit
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Ignore Status Codes (eg. 301, 400-499)
  name: ignoreStatusCodes
  defaultvalue: 400-499
  type: 0
  required: false
  additionalinfo: Provide comma-separated HTTP Status ranges or individual status codes to ignore. Eg. 301, 400-499.
  section: Collect
- display: Incident optional field list
  name: optionalDomainEventFieldList
  defaultvalue: actorDevice,actorEntityId,actorId,actorScoreCategory,actorSession,apiName,apiUri,category,ipAbuseVelocity,ipReputationLevel,securityEventType,securityScore,serviceId,actorScore,threatCategory,type
  options:
  - actorDevice
  - actorEntityId
  - actorId
  - actorScoreCategory
  - actorSession
  - apiName
  - apiUri
  - category
  - ipAbuseVelocity
  - ipReputationLevel
  - securityEventType
  - securityScore
  - serviceId
  - actorScore
  - threatCategory
  - type
  type: 16
  required: false
  section: Collect
- display: Additional API Attributes
  name: optionalAPIAttributes
  defaultvalue: isExternal,isAuthenticated,riskScore,riskScoreCategory,isLearnt
  options:
  - isExternal
  - isAuthenticated
  - riskScore
  - riskScoreCategory
  - isLearnt
  type: 16
  required: false
  section: Collect
- display: Fetch unique incidents
  additionalinfo: Ignores repeat occurrences of a given incidence for a specified time.
  defaultvalue: "true"
  name: isFetchUniqueIncidents
  type: 8
  required: false
  section: Collect
- name: timegap_between_repeat_incidents
  display: Time between raising similar incidents (in <number> <time unit>, e.g., in 12 hours, in 7 days)
  additionalinfo: Specifies a timeframe in the future until which a repeat incidence will be ignored.
  required: false
  type: 0
  defaultvalue: 'in 7 days'
  section: Collect
description: "Traceable Platform Integration enables publishing Traceable Detected Security Events to be published to Cortex Xsoar for further action."
display: "Traceable"
name: Traceable
script:
  isfetch: true
  isFetchSamples: true
  runonce: false
  script: "-"
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: list_incident_cache
    description: List the entries present in the Traceable instance cache.
    arguments: []
    outputs:
    - contextPath: Traceable.Instancecache.id
      description: Cache entry ID.
      type: string
    - contextPath: Traceable.Instancecache.expiry
      description: Cache entry expiration date.
      type: date
  - name: purge_incident_cache
    description: Delete all entries in the incident cache.
    arguments: []
    outputs:
    - contextPath: Traceable.Instancecache.id
      description: Cache entry ID.
      type: string
    - contextPath: Traceable.Instancecache.expiry
      description: Cache entry expiration date.
      type: date
    - contextPath: Traceable.Instancecache.deletion_status
      description: Cache entry deletion status.
      type: string
fromversion: 5.5.0
tests:
- No tests (auto formatted)