category: Network Security sectionorder: - Connect - Collect commonfields: id: VectraRUXEventsDetections version: -1 configuration: - additionalinfo: URL of the Vectra AI platform. display: Server URL name: server_url required: true type: 0 section: Connect - display: Client ID displaypassword: Client Secret Key name: credentials type: 9 required: true section: Connect - display: Fetch incidents name: isFetch required: false type: 8 section: Collect supportedModules: - agentix - xsiam - additionalinfo: The maximum number of events detections to fetch each time. If the value is greater than 200, it will be considered as 200. The maximum is 200. defaultvalue: '50' display: Max Fetch name: max_fetch required: false type: 0 section: Collect supportedModules: - agentix - xsiam - additionalinfo: "The date or relative timestamp from which to begin fetching events detections.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Oct 2025, 01 Mar 2021 04:45:33, 2025-12-17T14:05:44Z." defaultvalue: 1 hour display: First Fetch Time name: first_fetch required: false type: 0 section: Collect - additionalinfo: Filter by entity type. If not selected, it will fetch all events detections. display: Entity Types name: entity_types defaultvalue: Host,Account options: - Host - Account required: false type: 16 section: Collect - additionalinfo: Enabling this checkbox generates incidents for prioritized events detections. If not selected, incidents are created for all events detections. display: Create Incidents for Prioritized Detections name: only_prioritized_detections required: false type: 8 section: Collect - additionalinfo: Enabling this checkbox generates incidents for escalated events detections. If not selected, incidents are created for all events detections. display: Create Incidents for Escalated Detections name: only_escalated_detections required: false type: 8 section: Collect - additionalinfo: The mirroring direction in which to mirror the detections. You can mirror 'Incoming' (from Vectra to XSOAR), 'Outgoing' (from XSOAR to Vectra), or in both directions. display: Mirroring Direction name: mirror_direction options: - Incoming - Outgoing - Incoming And Outgoing required: false type: 15 section: Collect - additionalinfo: The tag value should be used to mirror the detection note by adding the same tag in the notes. defaultvalue: note display: Mirror tag for notes hidden: false name: note_tag required: false type: 0 section: Collect - additionalinfo: "Enabling this checkbox opens the detection in Vectra when the incident is reopened in XSOAR.\n\nNote: This parameter is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'." display: Open Detection on Incident Reopen name: open_detection_on_incident_reopen defaultvalue: 'true' required: false type: 8 section: Collect - additionalinfo: "Detection status to set in Vectra when incident is reopened in XSOAR. Default value is 'Escalated'.\n\nNote: This parameter is only used when open detection on incident reopen is 'checked' and the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'." display: Detection Status for Incident Reopen name: detection_status_for_reopen type: 15 options: - Open - Escalated defaultvalue: Escalated required: false section: Collect - additionalinfo: "Enabling this checkbox closes the detection in Vectra when the incident is closed in XSOAR.\n\nNote: This parameter is only used when the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'." display: Close Detection on Incident Closure name: close_detection_on_incident_closure defaultvalue: 'true' required: false type: 8 section: Collect - additionalinfo: "Detection close reason to set in Vectra when closing incidents in XSOAR. Default value is 'Remediated'.\n\nNote: This parameter is only used when close detection on incident closer is 'checked' and the mirroring direction is set to 'Outgoing' or 'Incoming And Outgoing'." display: Detection Close Reason for Incident Closure name: close_reason_of_detection type: 15 options: - Benign - Remediated defaultvalue: Remediated required: false section: Collect - display: Incident type defaultvalue: Vectra RUX Events Detection name: incidentType required: false type: 13 section: Collect supportedModules: - agentix - xsiam - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true supportedModules: - agentix - xsiam - additionalinfo: When checked, no SSL certificates check will be done when interacting with the Vectra RUX API. It's insecure. (Default - unchecked) display: Trust any certificate (not secure) name: insecure required: false type: 8 section: Connect - additionalinfo: Use the system proxy settings to reach with the Vectra RUX API. display: Use system proxy settings name: proxy required: false type: 8 section: Connect description: This integration allows the security operations center to create and manage incidents based on Vectra Events Detections. display: Vectra RUX - Network Detection & Response provider: Vectra AI name: VectraRUXEventsDetections defaultmapperin: Vectra RUX - Incoming Mapper script: commands: - name: vectra-detections-mark-asclosed description: Mark detections as closed with provided detection IDs in the argument. execution: true # This command modifies the Vectra system arguments: - name: detection_ids required: true description: Provide a list of detection IDs separated by commas or a single detection ID. isArray: true - name: close_reason required: true description: Provide the close reason. auto: PREDEFINED predefined: - benign - remediated - arguments: - default: false description: Filter by email. isArray: false name: email required: false secret: false - auto: PREDEFINED default: false description: Filter users with the specified role. Use the role standardized name. isArray: false name: role predefined: - Admin - Auditor - Global Analyst - Read-Only - Restricted Admin - Security Analyst - Setting Admin - Super Admin required: false secret: false - default: false description: |- Return only the users which have a last login timestamp equal to or after the given timestamp. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2023, 01 Mar 2021 04:45:33, 2022-04-17T14:05:44Z. isArray: false name: last_login_timestamp required: false secret: false deprecated: false description: Returns a list of users. execution: false name: vectra-user-list outputs: - contextPath: Vectra.User.id description: The ID of the User. type: Number - contextPath: Vectra.User.user_id description: The ID of the User. type: Number - contextPath: Vectra.User.name description: Username of the user. type: String - contextPath: Vectra.User.email description: The email associated with the user. type: String - contextPath: Vectra.User.role description: The role associated with the user. type: String - contextPath: Vectra.User.last_login_timestamp description: Last login timestamp in UTC format of the user. type: String - contextPath: Vectra.User.last_login description: Last login timestamp of the user. type: String - arguments: - auto: PREDEFINED default: false description: Fetch only entities whose priority score is above the configured priority threshold will be included in the response. isArray: false name: prioritized predefined: - 'true' - 'false' required: false secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: false secret: false - description: Filter by matching entity name. name: name - default: false description: Filter by a tag or a comma-separated list of tags. isArray: false name: tags required: false secret: false - auto: PREDEFINED default: false description: Filter on entity activation state. isArray: false name: state predefined: - active - inactive required: false secret: false - default: false description: Orders records by last timestamp or urgency score. Default sorting is by urgency score in descending order. Use the minus symbol (-) to sort scores in descending order. Multiple ordering fields can be specified with a comma-separated list (e.g., ordering=urgency_score,-name). isArray: false name: ordering required: false secret: false - default: false description: |- Return only the entities which have a last detection timestamp equal to or after the given timestamp. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2023, 01 Mar 2021 04:45:33, 2022-04-17T14:05:44Z. isArray: false name: last_detection_timestamp required: false secret: false - default: false defaultValue: '1' description: Enables the caller to specify a particular page of results. isArray: false name: page required: false secret: false - default: false defaultValue: '50' description: Specify the desired page size for the request. Maximum is 5000. isArray: false name: page_size required: false secret: false - default: false description: |- Return only the entities which have a last modified timestamp equal to or after the given timestamp. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2023, 01 Mar 2021 04:45:33, 2022-04-17T14:05:44Z. isArray: false name: last_modified_timestamp required: false secret: false deprecated: false description: Returns a list of entities. execution: false name: vectra-entity-list outputs: - contextPath: Vectra.Entity.id description: ID of the entity. type: Number - contextPath: Vectra.Entity.name description: Name of the entity. type: String - contextPath: Vectra.Entity.breadth_contrib description: Breadth contribution of the entity. type: Number - contextPath: Vectra.Entity.importance description: Entity importance. type: Number - contextPath: Vectra.Entity.type description: Type of the entity. type: String - contextPath: Vectra.Entity.is_prioritized description: Entity is prioritized or not. type: Boolean - contextPath: Vectra.Entity.severity description: Severity of the entity. type: String - contextPath: Vectra.Entity.urgency_score description: Urgency score of the entity. type: Number - contextPath: Vectra.Entity.velocity_contrib description: Velocity contribution of the entity. type: Number - contextPath: Vectra.Entity.detection_set description: Set of detections related to entity. type: String - contextPath: Vectra.Entity.last_detection_timestamp description: Time of the last detection activity related to entity. type: Date - contextPath: Vectra.Entity.notes.id description: Notes of the entity. type: String - contextPath: Vectra.Entity.notes.dateCreated description: Created date of the Note. type: String - contextPath: Vectra.Entity.notes.dateModified description: Modified date of the Note. type: String - contextPath: Vectra.Entity.notes.createdBy description: Created user of the Note. type: String - contextPath: Vectra.Entity.notes.ModifiedBy description: Modified user of the Note. type: String - contextPath: Vectra.Entity.notes.note description: Note of the entity. type: String - contextPath: Vectra.Entity.attack_rating description: Attack Ratting of the entity. type: Number - contextPath: Vectra.Entity.privilege_level description: Privilege Level of the entity. type: String - contextPath: Vectra.Entity.privilege_category description: Privilege Category of the entity. type: String - contextPath: Vectra.Entity.attack_profile description: Attack Profile of the entity. type: String - contextPath: Vectra.Entity.sensors description: Sensors of the entity. type: Unknown - contextPath: Vectra.Entity.state description: State of the entity. type: String - contextPath: Vectra.Entity.tags description: Tags of the entity. type: Unknown - contextPath: Vectra.Entity.url description: Url link of the entity. type: String - contextPath: Vectra.Entity.host_type description: Host type of the entity. type: Unknown - contextPath: Vectra.Entity.account_type description: Account type of the entity. type: String - arguments: - default: false description: Specify the id of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - host - account required: true secret: false deprecated: false description: Describes an entity by ID. execution: false name: vectra-entity-describe outputs: - contextPath: Vectra.Entity.id description: ID of the entity. type: Number - contextPath: Vectra.Entity.name description: Name of the entity. type: String - contextPath: Vectra.Entity.breadth_contrib description: Breadth contribution of the entity. type: Number - contextPath: Vectra.Entity.importance description: Entity importance. type: Number - contextPath: Vectra.Entity.type description: Type of the entity. type: String - contextPath: Vectra.Entity.is_prioritized description: Entity is prioritized or not. type: Boolean - contextPath: Vectra.Entity.severity description: Severity of the entity. type: String - contextPath: Vectra.Entity.urgency_score description: Urgency score of the entity. type: Number - contextPath: Vectra.Entity.velocity_contrib description: Velocity contribution of the entity. type: Number - contextPath: Vectra.Entity.detection_set description: Set of detections related to the entity. type: String - contextPath: Vectra.Entity.last_detection_timestamp description: Time of the last detection activity related to the entity. type: Date - contextPath: Vectra.Entity.last_modified_timestamp description: Time of the last modification activity related to the entity. type: Date - contextPath: Vectra.Entity.notes.id description: Notes of the entity. type: String - contextPath: Vectra.Entity.notes.dateCreated description: Created date of the Note. type: String - contextPath: Vectra.Entity.notes.dateModified description: Modified date of the Note. type: String - contextPath: Vectra.Entity.notes.createdBy description: Created user of the Note. type: String - contextPath: Vectra.Entity.notes.ModifiedBy description: Modified user of the Note. type: String - contextPath: Vectra.Entity.notes.note description: Note of the entity. type: String - contextPath: Vectra.Entity.attack_rating description: Attack Ratting of the entity. type: Number - contextPath: Vectra.Entity.privilege_level description: Privilege Level of the entity. type: String - contextPath: Vectra.Entity.privilege_category description: Privilege Category of the entity. type: String - contextPath: Vectra.Entity.attack_profile description: Attack Profile of the entity. type: String - contextPath: Vectra.Entity.sensors description: Sensors of the entity. type: Unknown - contextPath: Vectra.Entity.state description: State of the entity. type: String - contextPath: Vectra.Entity.tags description: Tags of the entity. type: Unknown - contextPath: Vectra.Entity.url description: Url link of the entity. type: String - contextPath: Vectra.Entity.host_type description: Host type of the entity. type: Unknown - contextPath: Vectra.Entity.account_type description: Account type of the entity. type: Unknown - arguments: - default: false description: Specify the id of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: true secret: false - default: false defaultValue: '1' description: Enables the caller to specify a particular page of results. isArray: false name: page required: false secret: false - default: false defaultValue: '50' description: Specify the desired page size for the request. Maximum is 5000. isArray: false name: page_size required: false secret: false - auto: PREDEFINED default: false description: The category of the detection. isArray: false name: detection_category predefined: - Command & Control - Botnet - Reconnaissance - Lateral Movement - Exfiltration - Info required: false secret: false - default: false description: Filter by detection type. isArray: false name: detection_type required: false secret: false - default: false description: "Return only the detections which have a last timestamp equal to or after the given timestamp. \nFormats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours.\nExample: 2023-04-25T00:00:00Z, 2023-04-25, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2023 04:45:33, 15 Jun." isArray: false name: last_timestamp required: false secret: false - default: false description: Filter by detection name. isArray: false name: detection_name required: false secret: false - default: false defaultValue: active description: Filter by state. isArray: false name: state required: false secret: false - default: false description: Filter by a tag or a comma-separated list of tags. isArray: false name: tags required: false secret: false deprecated: false description: Returns a list of detections for a specified entity. execution: false name: vectra-entity-detection-list outputs: - contextPath: Vectra.Entity.Detections.id description: Entity detection ID. type: Number - contextPath: Vectra.Entity.Detections.assigned_date description: Date assigned to the detection. type: Unknown - contextPath: Vectra.Entity.Detections.assigned_to description: User or entity assigned to the detection. type: Unknown - contextPath: Vectra.Entity.Detections.category description: Category of the detection. type: String - contextPath: Vectra.Entity.Detections.certainty description: Certainty level of the detection. type: Number - contextPath: Vectra.Entity.Detections.c_score description: Confidence score of the detection. type: Number - contextPath: Vectra.Entity.Detections.description description: Description of the detection. type: String - contextPath: Vectra.Entity.Detections.detection description: Detection information. type: String - contextPath: Vectra.Entity.Detections.detection_category description: Category of the detection. type: String - contextPath: Vectra.Entity.Detections.detection_type description: Type of the detection. type: String - contextPath: Vectra.Entity.Detections.grouped_details.external_target.ip description: IP address of the external target in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.external_target.name description: Name of the external target in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.num_sessions description: Number of sessions in the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.bytes_received description: Total bytes received in the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.bytes_sent description: Total bytes sent in the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.ja3_hashes description: JA3 hashes in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.ja3s_hashes description: JA3S hashes in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.tunnel_type description: Tunnel type used in the sessions of the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.protocol description: Protocol used in the sessions of the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.app_protocol description: Application protocol used in the sessions of the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_port description: Destination port in the sessions of the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_ip description: Destination IP address in the sessions of the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.bytes_received description: Total bytes received in the sessions of the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.sessions.bytes_sent description: Total bytes sent in the sessions of the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.sessions.first_timestamp description: First timestamp of the sessions in the detection group. type: Date - contextPath: Vectra.Entity.Detections.grouped_details.sessions.last_timestamp description: Last timestamp of the sessions in the detection group. type: Date - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_geo description: Geolocation of the destination IP in the sessions of the detection group. type: Unknown - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_geo_lat description: Latitude of the destination IP in the sessions of the detection group. type: Unknown - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_geo_lon description: Longitude of the destination IP in the sessions of the detection group. type: Unknown - contextPath: Vectra.Entity.Detections.grouped_details.first_timestamp description: First timestamp of the detection group. type: Date - contextPath: Vectra.Entity.Detections.grouped_details.last_timestamp description: Last timestamp of the detection group. type: Date - contextPath: Vectra.Entity.Detections.grouped_details.dst_ips description: Destination IP addresses in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.dst_ports description: Destination ports in the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.target_domains description: Target domains in the detection group. type: String - contextPath: Vectra.Entity.Detections.is_targeting_key_asset description: Indicates if the detection is targeting a key asset. type: Boolean - contextPath: Vectra.Entity.Detections.last_timestamp description: Last timestamp of the detection. type: Date - contextPath: Vectra.Entity.Detections.note description: Note associated with the detection. type: Unknown - contextPath: Vectra.Entity.Detections.note_modified_by description: User or entity who last modified the note. type: Unknown - contextPath: Vectra.Entity.Detections.note_modified_timestamp description: Timestamp when the note was last modified. type: Unknown - contextPath: Vectra.Entity.Detections.notes description: Additional notes related to the detection. type: Unknown - contextPath: Vectra.Entity.Detections.sensor_name description: Name of the sensor associated with the detection. type: String - contextPath: Vectra.Entity.Detections.src_account.id description: ID of the source account associated with the detection. type: Number - contextPath: Vectra.Entity.Detections.src_account.name description: Name of the source account associated with the detection. type: String - contextPath: Vectra.Entity.Detections.src_account.url description: URL of the source account associated with the detection. type: String - contextPath: Vectra.Entity.Detections.src_account.threat description: Threat level of the source account associated with the detection. type: Number - contextPath: Vectra.Entity.Detections.src_account.certainty description: Certainty level of the source account associated with the detection. type: Number - contextPath: Vectra.Entity.Detections.src_account.privilege_level description: Privilege level of the source account associated with the detection. type: Number - contextPath: Vectra.Entity.Detections.src_account.privilege_category description: Privilege category of the source account associated with the detection. type: String - contextPath: Vectra.Entity.Detections.src_host.id description: ID of the source host in the detection. type: Number - contextPath: Vectra.Entity.Detections.src_host.ip description: IP address of the source host in the detection. type: String - contextPath: Vectra.Entity.Detections.src_host.name description: Name of the source host in the detection. type: String - contextPath: Vectra.Entity.Detections.src_host.url description: URL associated with the source host in the detection. type: String - contextPath: Vectra.Entity.Detections.src_host.is_key_asset description: Indicates if the source host is a key asset. type: Boolean - contextPath: Vectra.Entity.Detections.src_host.groups description: Groups associated with the source host in the detection. type: Unknown - contextPath: Vectra.Entity.Detections.src_host.threat description: Threat level associated with the source host in the detection. type: Number - contextPath: Vectra.Entity.Detections.src_host.certainty description: Certainty level associated with the source host in the detection. type: Number - contextPath: Vectra.Entity.Detections.src_ip description: Source IP address in the detection. type: String - contextPath: Vectra.Entity.Detections.state description: State of the detection. type: String - contextPath: Vectra.Entity.Detections.summary.bytes_received description: Total bytes received in the detection summary. type: Number - contextPath: Vectra.Entity.Detections.summary.bytes_sent description: Total bytes sent in the detection summary. type: Number - contextPath: Vectra.Entity.Detections.summary.cnc_server description: CNC server associated with the detection summary. type: String - contextPath: Vectra.Entity.Detections.summary.num_events description: Total number of events related to the detection. type: Number - contextPath: Vectra.Entity.Detections.summary.probable_owner description: Probable owner of the detection summary. type: Unknown - contextPath: Vectra.Entity.Detections.summary.sessions description: Total sessions in the detection summary. type: Number - contextPath: Vectra.Entity.Detections.tags description: Tags associated with the detection. type: Unknown - contextPath: Vectra.Entity.Detections.threat description: Threat level of the detection. type: Number - contextPath: Vectra.Entity.Detections.t_score description: T-score of the detection. type: Number - contextPath: Vectra.Entity.Detections.type description: Type of the detection. type: String - contextPath: Vectra.Entity.Detections.url description: URL associated with the detection. type: String - arguments: - default: false description: Specify the ID(s) of the detections. isArray: true name: detection_ids required: true secret: false - default: false defaultValue: '1' description: Enables the caller to specify a particular page of results. isArray: false name: page required: false secret: false - default: false defaultValue: '50' description: Specify the desired page size for the request. Maximum is 5000. isArray: false name: page_size required: false secret: false deprecated: false description: Returns a list of detections for the specified detection ID(s). execution: false name: vectra-detection-describe outputs: - contextPath: Vectra.Entity.Detections.id description: Entity detection ID. type: Number - contextPath: Vectra.Entity.Detections.assigned_date description: Date assigned to the detection. type: Unknown - contextPath: Vectra.Entity.Detections.assigned_to description: User or entity assigned to the detection. type: Unknown - contextPath: Vectra.Entity.Detections.category description: Category of the detection. type: String - contextPath: Vectra.Entity.Detections.certainty description: Certainty level of the detection. type: Number - contextPath: Vectra.Entity.Detections.c_score description: Confidence score of the detection. type: Number - contextPath: Vectra.Entity.Detections.description description: Description of the detection. type: String - contextPath: Vectra.Entity.Detections.detection description: Detection information. type: String - contextPath: Vectra.Entity.Detections.detection_category description: Category of the detection. type: String - contextPath: Vectra.Entity.Detections.detection_type description: Type of the detection. type: String - contextPath: Vectra.Entity.Detections.grouped_details.external_target.ip description: IP address of the external target in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.external_target.name description: Name of the external target in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.num_sessions description: Number of sessions in the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.bytes_received description: Total bytes received in the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.bytes_sent description: Total bytes sent in the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.ja3_hashes description: JA3 hashes in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.ja3s_hashes description: JA3S hashes in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.tunnel_type description: Tunnel type used in the sessions of the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.protocol description: Protocol used in the sessions of the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.app_protocol description: Application protocol used in the sessions of the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_port description: Destination port in the sessions of the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_ip description: Destination IP address in the sessions of the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.sessions.bytes_received description: Total bytes received in the sessions of the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.sessions.bytes_sent description: Total bytes sent in the sessions of the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.sessions.first_timestamp description: First timestamp of the sessions in the detection group. type: Date - contextPath: Vectra.Entity.Detections.grouped_details.sessions.last_timestamp description: Last timestamp of the sessions in the detection group. type: Date - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_geo description: Geolocation of the destination IP in the sessions of the detection group. type: Unknown - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_geo_lat description: Latitude of the destination IP in the sessions of the detection group. type: Unknown - contextPath: Vectra.Entity.Detections.grouped_details.sessions.dst_geo_lon description: Longitude of the destination IP in the sessions of the detection group. type: Unknown - contextPath: Vectra.Entity.Detections.grouped_details.first_timestamp description: First timestamp of the detection group. type: Date - contextPath: Vectra.Entity.Detections.grouped_details.last_timestamp description: Last timestamp of the detection group. type: Date - contextPath: Vectra.Entity.Detections.grouped_details.dst_ips description: Destination IP addresses in the detection group. type: String - contextPath: Vectra.Entity.Detections.grouped_details.dst_ports description: Destination ports in the detection group. type: Number - contextPath: Vectra.Entity.Detections.grouped_details.target_domains description: Target domains in the detection group. type: String - contextPath: Vectra.Entity.Detections.is_targeting_key_asset description: Indicates if the detection is targeting a key asset. type: Boolean - contextPath: Vectra.Entity.Detections.last_timestamp description: Last timestamp of the detection. type: Date - contextPath: Vectra.Entity.Detections.note description: Note associated with the detection. type: Unknown - contextPath: Vectra.Entity.Detections.note_modified_by description: User or entity who last modified the note. type: Unknown - contextPath: Vectra.Entity.Detections.note_modified_timestamp description: Timestamp when the note was last modified. type: Unknown - contextPath: Vectra.Entity.Detections.notes description: Additional notes related to the detection. type: Unknown - contextPath: Vectra.Entity.Detections.sensor_name description: Name of the sensor associated with the detection. type: String - contextPath: Vectra.Entity.Detections.src_account.id description: ID of the source account associated with the detection. type: Number - contextPath: Vectra.Entity.Detections.src_account.name description: Name of the source account associated with the detection. type: String - contextPath: Vectra.Entity.Detections.src_account.url description: URL of the source account associated with the detection. type: String - contextPath: Vectra.Entity.Detections.src_account.threat description: Threat level of the source account associated with the detection. type: Number - contextPath: Vectra.Entity.Detections.src_account.certainty description: Certainty level of the source account associated with the detection. type: Number - contextPath: Vectra.Entity.Detections.src_account.privilege_level description: Privilege level of the source account associated with the detection. type: Number - contextPath: Vectra.Entity.Detections.src_account.privilege_category description: Privilege category of the source account associated with the detection. type: String - contextPath: Vectra.Entity.Detections.src_host.id description: ID of the source host in the detection. type: Number - contextPath: Vectra.Entity.Detections.src_host.ip description: IP address of the source host in the detection. type: String - contextPath: Vectra.Entity.Detections.src_host.name description: Name of the source host in the detection. type: String - contextPath: Vectra.Entity.Detections.src_host.url description: URL associated with the source host in the detection. type: String - contextPath: Vectra.Entity.Detections.src_host.is_key_asset description: Indicates if the source host is a key asset. type: Boolean - contextPath: Vectra.Entity.Detections.src_host.groups description: Groups associated with the source host in the detection. type: Unknown - contextPath: Vectra.Entity.Detections.src_host.threat description: Threat level associated with the source host in the detection. type: Number - contextPath: Vectra.Entity.Detections.src_host.certainty description: Certainty level associated with the source host in the detection. type: Number - contextPath: Vectra.Entity.Detections.src_ip description: Source IP address in the detection. type: String - contextPath: Vectra.Entity.Detections.state description: State of the detection. type: String - contextPath: Vectra.Entity.Detections.summary.bytes_received description: Total bytes received in the detection summary. type: Number - contextPath: Vectra.Entity.Detections.summary.bytes_sent description: Total bytes sent in the detection summary. type: Number - contextPath: Vectra.Entity.Detections.summary.cnc_server description: CNC server associated with the detection summary. type: String - contextPath: Vectra.Entity.Detections.summary.num_events description: Total number of events related to the detection. type: Number - contextPath: Vectra.Entity.Detections.summary.probable_owner description: Probable owner of the detection summary. type: Unknown - contextPath: Vectra.Entity.Detections.summary.sessions description: Total sessions in the detection summary. type: Number - contextPath: Vectra.Entity.Detections.tags description: Tags associated with the detection. type: Unknown - contextPath: Vectra.Entity.Detections.threat description: Threat level of the detection. type: Number - contextPath: Vectra.Entity.Detections.t_score description: T-score of the detection. type: Number - contextPath: Vectra.Entity.Detections.type description: Type of the detection. type: String - contextPath: Vectra.Entity.Detections.url description: URL associated with the detection. type: String - arguments: - default: false description: Specify the id of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: true secret: false - default: false description: Note to be added in the specified entity_id. isArray: false name: note required: true secret: false deprecated: false description: Add a note to the entity. execution: false name: vectra-entity-note-add outputs: - contextPath: Vectra.Entity.Notes.entity_id description: ID of the entity associated with the note. type: String - contextPath: Vectra.Entity.Notes.note_id description: ID of the note. type: Number - contextPath: Vectra.Entity.Notes.date_created description: Date when the note was created. type: Date - contextPath: Vectra.Entity.Notes.date_modified description: Date when the note was last modified. type: Unknown - contextPath: Vectra.Entity.Notes.created_by description: User who created the note. type: String - contextPath: Vectra.Entity.Notes.modified_by description: User who last modified the note. type: Unknown - contextPath: Vectra.Entity.Notes.note description: Content of the note. type: String - arguments: - default: false description: Specify the id of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: true secret: false - default: false description: Specify the ID of the note. isArray: false name: note_id required: true secret: false - default: false description: Note to be updated for the specified note_id. isArray: false name: note required: true secret: false deprecated: false description: Update a note in the entity. execution: false name: vectra-entity-note-update outputs: - contextPath: Vectra.Entity.Notes.entity_id description: ID of the entity associated with the note. type: String - contextPath: Vectra.Entity.Notes.note_id description: ID of the note. type: Number - contextPath: Vectra.Entity.Notes.date_created description: Date when the note was created. type: Date - contextPath: Vectra.Entity.Notes.date_modified description: Date when the note was last modified. type: Unknown - contextPath: Vectra.Entity.Notes.created_by description: User who created the note. type: String - contextPath: Vectra.Entity.Notes.modified_by description: User who last modified the note. type: Unknown - contextPath: Vectra.Entity.Notes.note description: Content of the note. type: String - arguments: - default: false description: Specify the ID of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: true secret: false - default: false description: Specify the ID of the note. isArray: false name: note_id required: true secret: false deprecated: false description: Remove a note from the entity. execution: false name: vectra-entity-note-remove - arguments: - default: false description: Specify the id of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: true secret: false - default: false description: Comma-separated values of tags to be included in the entity. isArray: true name: tags required: true secret: false deprecated: false description: Add tags in the entity. execution: false name: vectra-entity-tag-add outputs: - contextPath: Vectra.Entity.Tags.tag_id description: ID of the tag. type: String - contextPath: Vectra.Entity.Tags.entity_id description: ID of the entity associated with the tag. type: String - contextPath: Vectra.Entity.Tags.entity_type description: Type of the entity. type: String - contextPath: Vectra.Entity.Tags.tags description: A list of tags linked to an entity. type: Unknown - arguments: - default: false description: Specify the id of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: true secret: false - default: false description: Comma-separated values of tags to be removed from the entity. isArray: true name: tags required: true secret: false deprecated: false description: Remove tags from the entity. execution: false name: vectra-entity-tag-remove outputs: - contextPath: Vectra.Entity.Tags.tag_id description: ID of the tag. type: String - contextPath: Vectra.Entity.Tags.entity_id description: ID of the entity associated with the tag. type: String - contextPath: Vectra.Entity.Tags.entity_type description: Type of the entity. type: String - contextPath: Vectra.Entity.Tags.tags description: A list of tags linked to an entity. type: Unknown - arguments: - default: false description: Specify the id of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: true secret: false deprecated: false description: Returns a list of tags for a specified entity. execution: false name: vectra-entity-tag-list outputs: - contextPath: Vectra.Entity.Tags.tag_id description: ID of the tag. type: String - contextPath: Vectra.Entity.Tags.entity_id description: ID of the entity associated with the tag. type: String - contextPath: Vectra.Entity.Tags.entity_type description: Type of the entity. type: String - contextPath: Vectra.Entity.Tags.tags description: A list of tags linked to an entity. type: Unknown - arguments: - default: false description: Specify the ID of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: true secret: false - default: false description: Specify the ID of the user. isArray: false name: user_id required: true secret: false deprecated: false description: Add an assignment for the entity. execution: false name: vectra-entity-assignment-add outputs: - contextPath: Vectra.Entity.Assignments.id description: ID of the assignment. type: Number - contextPath: Vectra.Entity.Assignments.assignment_id description: ID of the assignment. type: Number - contextPath: Vectra.Entity.Assignments.assigned_by.id description: ID of the user who assigned the entity. type: Number - contextPath: Vectra.Entity.Assignments.assigned_by.username description: Username of the user who assigned the entity. type: String - contextPath: Vectra.Entity.Assignments.date_assigned description: Date when the entity was assigned. type: Date - contextPath: Vectra.Entity.Assignments.date_resolved description: Date when the entity was resolved. type: Date - contextPath: Vectra.Entity.Assignments.events.assignment_id description: ID of the assignment event. type: Number - contextPath: Vectra.Entity.Assignments.events.actor description: ID of the actor who performed the assignment event. type: Number - contextPath: Vectra.Entity.Assignments.events.event_type description: Type of assignment event. type: String - contextPath: Vectra.Entity.Assignments.events.datetime description: Date of the assignment event. type: Date - contextPath: Vectra.Entity.Assignments.events.context.to description: ID of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.events.context.entity_t_score description: Threat score of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.events.context.entity_c_score description: Certainty score of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.outcome.id description: ID of the assignment outcome. type: String - contextPath: Vectra.Entity.Assignments.outcome.builtin description: Whether the assignment outcome is builtin or not. type: String - contextPath: Vectra.Entity.Assignments.outcome.user_selectable description: Whether the assignment outcome is user selectable or not. type: String - contextPath: Vectra.Entity.Assignments.outcome.title description: Title of the assignment outcome. type: String - contextPath: Vectra.Entity.Assignments.outcome.category description: Category of the assignment outcome. type: String - contextPath: Vectra.Entity.Assignments.resolved_by.id description: ID of the user who resolved the entity. type: Number - contextPath: Vectra.Entity.Assignments.resolved_by.username description: Username of the user who resolved the entity. type: String - contextPath: Vectra.Entity.Assignments.triaged_detections description: Number of detections that have been triaged for the entity. type: Unknown - contextPath: Vectra.Entity.Assignments.host_id description: ID of the host that the entity is associated with. type: Number - contextPath: Vectra.Entity.Assignments.account_id description: ID of the account that the entity is associated with. type: Unknown - contextPath: Vectra.Entity.Assignments.assigned_to.id description: ID of the user who is currently assigned to the entity. type: Number - contextPath: Vectra.Entity.Assignments.assigned_to.username description: Username of the user who is currently assigned to the entity. type: String - arguments: - default: false description: Specify the ID of the assignment. isArray: false name: assignment_id required: true secret: false - default: false description: Specify the ID of the user. isArray: false name: user_id required: true secret: false deprecated: false description: Update an assignment in the entity. execution: false name: vectra-entity-assignment-update outputs: - contextPath: Vectra.Entity.Assignments.id description: ID of the assignment. type: Number - contextPath: Vectra.Entity.Assignments.assignment_id description: ID of the assignment. type: Number - contextPath: Vectra.Entity.Assignments.assigned_by.id description: ID of the user who assigned the entity. type: Number - contextPath: Vectra.Entity.Assignments.assigned_by.username description: Username of the user who assigned the entity. type: String - contextPath: Vectra.Entity.Assignments.date_assigned description: Date when the entity was assigned. type: Date - contextPath: Vectra.Entity.Assignments.date_resolved description: Date when the entity was resolved. type: Date - contextPath: Vectra.Entity.Assignments.events.assignment_id description: ID of the assignment event. type: Number - contextPath: Vectra.Entity.Assignments.events.actor description: ID of the actor who performed the assignment event. type: Number - contextPath: Vectra.Entity.Assignments.events.event_type description: Type of assignment event. type: String - contextPath: Vectra.Entity.Assignments.events.datetime description: Date of the assignment event. type: Date - contextPath: Vectra.Entity.Assignments.events.context.to description: ID of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.events.context.from description: ID of the entity that was assigned. type: Number - contextPath: Vectra.Entity.Assignments.events.context.entity_t_score description: Threat score of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.events.context.entity_c_score description: Certainty score of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.outcome.id description: ID of the assignment outcome. type: String - contextPath: Vectra.Entity.Assignments.outcome.builtin description: Whether the assignment outcome is builtin or not. type: String - contextPath: Vectra.Entity.Assignments.outcome.user_selectable description: Whether the assignment outcome is user selectable or not. type: String - contextPath: Vectra.Entity.Assignments.outcome.title description: Title of the assignment outcome. type: String - contextPath: Vectra.Entity.Assignments.outcome.category description: Category of the assignment outcome. type: String - contextPath: Vectra.Entity.Assignments.resolved_by.id description: ID of the user who resolved the entity. type: Number - contextPath: Vectra.Entity.Assignments.resolved_by.username description: Username of the user who resolved the entity. type: String - contextPath: Vectra.Entity.Assignments.triaged_detections description: Number of detections that have been triaged for the entity. type: Unknown - contextPath: Vectra.Entity.Assignments.host_id description: ID of the host that the entity is associated with. type: Number - contextPath: Vectra.Entity.Assignments.account_id description: ID of the account that the entity is associated with. type: Unknown - contextPath: Vectra.Entity.Assignments.assigned_to.id description: ID of the user who is currently assigned to the entity. type: Number - contextPath: Vectra.Entity.Assignments.assigned_to.username description: Username of the user who is currently assigned to the entity. type: String - arguments: - default: false description: Specify the ID of the detection. isArray: false name: detection_id required: true secret: false deprecated: false description: Download pcap of the detection. execution: false name: vectra-detection-pcap-download outputs: - contextPath: File.Size description: The size of the file. type: Number - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file. type: String - contextPath: File.EntryID description: The entry ID of the file. type: String - contextPath: File.Info description: File information. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: The file extension. type: String - arguments: - default: false description: Specify the IDs of the entities. Comma-separated values supported. isArray: false name: entity_ids required: false secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - account - host required: false secret: false - auto: PREDEFINED default: false description: Filter by resolved status. isArray: false name: resolved predefined: - 'True' - 'False' required: false secret: false - default: false description: Filter by user ids of the assignment. Comma-separated values supported. isArray: false name: assignees required: false secret: false - default: false description: Filter by outcome ids of the resolution. Comma-separated values supported. isArray: false name: resolution required: false secret: false - default: false description: "Filter by created after the timestamp.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n \nFor example: 01 May 2023, 01 Mar 2021 04:45:33, 2022-04-17T14:05:44Z." isArray: false name: created_after required: false secret: false - default: false defaultValue: '1' description: Enables the caller to specify a particular page of results. isArray: false name: page required: false secret: false - default: false defaultValue: '50' description: Specify the desired page size for the request. isArray: false name: page_size required: false secret: false deprecated: false description: Returns a list of all assignments. execution: false name: vectra-assignment-list outputs: - contextPath: Vectra.Entity.Assignments.id description: ID of the assignment. type: Number - contextPath: Vectra.Entity.Assignments.assignment_id description: ID of the assignment. type: Number - contextPath: Vectra.Entity.Assignments.assigned_by.id description: ID of the user who assigned the entity. type: Number - contextPath: Vectra.Entity.Assignments.assigned_by.username description: Username of the user who assigned the entity. type: String - contextPath: Vectra.Entity.Assignments.date_assigned description: Date when the entity was assigned. type: Date - contextPath: Vectra.Entity.Assignments.date_resolved description: Date when the entity was resolved. type: Date - contextPath: Vectra.Entity.Assignments.events.assignment_id description: ID of the assignment event. type: Number - contextPath: Vectra.Entity.Assignments.events.actor description: ID of the actor who performed the assignment event. type: Number - contextPath: Vectra.Entity.Assignments.events.event_type description: Type of the assignment event. type: String - contextPath: Vectra.Entity.Assignments.events.datetime description: Date of the assignment event. type: Date - contextPath: Vectra.Entity.Assignments.events.context.to description: ID of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.events.context.entity_t_score description: Threat score of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.events.context.entity_c_score description: Certainty score of the entity that was assigned to. type: Number - contextPath: Vectra.Entity.Assignments.events.context.triage_as description: Triage status of the entity. type: String - contextPath: Vectra.Entity.Assignments.events.context.triaged_detection_ids description: IDs of the detections that have been triaged for the entity. type: Array - contextPath: Vectra.Entity.Assignments.events.context.fixed_detection_ids description: IDs of the detections that have been fixed. type: Array - contextPath: Vectra.Entity.Assignments.events.context.created_rule_ids description: IDs of the rules that have been created for the entity. type: Array - contextPath: Vectra.Entity.Assignments.outcome.id description: ID of the assignment outcome. type: Number - contextPath: Vectra.Entity.Assignments.outcome.builtin description: Whether the assignment outcome is builtin or not. type: Boolean - contextPath: Vectra.Entity.Assignments.outcome.user_selectable description: Whether the assignment outcome is user selectable or not. type: Boolean - contextPath: Vectra.Entity.Assignments.outcome.title description: Title of the assignment outcome. type: String - contextPath: Vectra.Entity.Assignments.outcome.category description: Category of the assignment outcome. type: String - contextPath: Vectra.Entity.Assignments.resolved_by.id description: ID of the user who resolved the entity. type: Number - contextPath: Vectra.Entity.Assignments.resolved_by.username description: Username of the user who resolved the entity. type: String - contextPath: Vectra.Entity.Assignments.triaged_detections description: Number of detections that have been triaged for the entity. type: Array - contextPath: Vectra.Entity.Assignments.host_id description: ID of the host that the entity is associated with. type: Number - contextPath: Vectra.Entity.Assignments.account_id description: ID of the account that the entity is associated with. type: Number - contextPath: Vectra.Entity.Assignments.assigned_to.id description: ID of the user who is currently assigned to the entity. type: Number - contextPath: Vectra.Entity.Assignments.assigned_to.username description: Username of the user who is currently assigned to the entity. type: String - arguments: - default: false description: Specify the ID of the entity. isArray: false name: entity_id required: true secret: false - auto: PREDEFINED default: false description: Specify the type of the entity. isArray: false name: entity_type predefined: - host - account required: true secret: false deprecated: false description: Returns a list of notes for a specified entity. execution: false name: vectra-entity-note-list outputs: - contextPath: Vectra.Entity.Notes.note_id description: ID of the note. type: Number - contextPath: Vectra.Entity.Notes.id description: ID of the note. type: Number - contextPath: Vectra.Entity.Notes.date_created description: Date when the note was created. type: Date - contextPath: Vectra.Entity.Notes.date_modified description: Date when the note was last modified. type: Unknown - contextPath: Vectra.Entity.Notes.created_by description: User who created the note. type: String - contextPath: Vectra.Entity.Notes.modified_by description: User who last modified the note. type: Unknown - contextPath: Vectra.Entity.Notes.note description: Content of the note. type: String - contextPath: Vectra.Entity.Notes.entity_id description: ID of the entity associated with the note. type: String - contextPath: Vectra.Entity.Notes.entity_type description: Type of the entity associated with the note. type: String - arguments: - auto: PREDEFINED default: false description: Filter by group type. isArray: false name: group_type predefined: - account - host - ip - domain required: false secret: false - default: false description: |- Filter by Account Names. Supports comma-separated values. Note: Only valid when the group_type parameter is set to "account". isArray: true name: account_names required: false secret: false - default: false description: |- Filter by Domains. Supports comma-separated values. Note: Only valid when the group_type parameter is set to "domain". isArray: true name: domains required: false secret: false - default: false description: |- Filter by Host IDs. Supports comma-separated values. Note: Only valid when the group_type parameter is set to "host". isArray: true name: host_ids required: false secret: false - default: false description: |- Filter by Host Names. Supports comma-separated values. Note: Only valid when the group_type parameter is set to "host". isArray: true name: host_names required: false secret: false - auto: PREDEFINED default: false description: Filter by group importance. isArray: false name: importance predefined: - high - medium - low - never_prioritize required: false secret: false - default: false description: |- Filter by IPs. Supports comma-separated values. Note: Only valid when the group_type parameter is set to "ip". isArray: true name: ips required: false secret: false - default: false description: Filter by group description. isArray: false name: description required: false secret: false - default: false description: |- Return only the groups which have a last modification timestamp equal to or after the given timestamp. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z. isArray: false name: last_modified_timestamp required: false secret: false - default: false description: Filters by the user id who made the most recent modification to the group. isArray: false name: last_modified_by required: false secret: false - default: false description: Filters by group name. isArray: false name: group_name required: false secret: false deprecated: false description: Returns a list of all groups. execution: false name: vectra-group-list outputs: - contextPath: Vectra.Group.group_id description: ID of the group. type: Number - contextPath: Vectra.Group.id description: ID of the group. type: Number - contextPath: Vectra.Group.name description: Name of the group. type: String - contextPath: Vectra.Group.description description: Description of the group. type: String - contextPath: Vectra.Group.last_modified description: Date when the group was last modified. type: Date - contextPath: Vectra.Group.last_modified_by description: Name of the user who last modified the group. type: String - contextPath: Vectra.Group.type description: Type of the group. type: String - contextPath: Vectra.Group.members description: Members of the group. type: Unknown - contextPath: Vectra.Group.members.id description: Entity ID of member. type: Number - contextPath: Vectra.Group.members.name description: Entity name of member. type: String - contextPath: Vectra.Group.members.is_key_asset description: Indicates key asset. type: Boolean - contextPath: Vectra.Group.members.url description: Entity URL of member. type: String - contextPath: Vectra.Group.members.uid description: Entity UID of member. type: String - contextPath: Vectra.Group.rules.triage_category description: Triage category of rule. type: String - contextPath: Vectra.Group.rules.id description: Id of the rule. type: Number - contextPath: Vectra.Group.rules.description description: Description of the rule. type: String - contextPath: Vectra.Group.importance description: Importance level of the group. type: String - contextPath: Vectra.Group.cognito_managed description: Whether the group is managed by Cognito or not. type: Boolean - arguments: - default: false description: Specify Group ID to unassign members. isArray: false name: group_id required: true secret: false - default: false description: "Member values based on the group type. Supports comma-separated values.\n\n Note: \nIf the group type is host, then the \"Host IDs\". \nIf the group type is account, then \"Account Names\".\nIf the group type is ip, then the list of \"IPs\".\nIf the group type is domain, then the list of \"Domains\" ." isArray: true name: members required: true secret: false deprecated: false description: Unassign members from the specified group. execution: false name: vectra-group-unassign outputs: - contextPath: Vectra.Group.group_id description: ID of the group. type: Number - contextPath: Vectra.Group.id description: ID of the group. type: Number - contextPath: Vectra.Group.name description: Name of the group. type: String - contextPath: Vectra.Group.description description: Description of the group. type: String - contextPath: Vectra.Group.last_modified description: Date when the group was last modified. type: Date - contextPath: Vectra.Group.last_modified_by description: Name of the user who last modified the group. type: String - contextPath: Vectra.Group.type description: Type of the group. type: String - contextPath: Vectra.Group.members description: Members of the group. type: Unknown - contextPath: Vectra.Group.members.id description: Entity ID of member. type: Number - contextPath: Vectra.Group.members.name description: Entity name of member. type: String - contextPath: Vectra.Group.members.is_key_asset description: Indicates key asset. type: Boolean - contextPath: Vectra.Group.members.url description: Entity URL of member. type: String - contextPath: Vectra.Group.members.uid description: Entity UID of member. type: String - contextPath: Vectra.Group.rules.triage_category description: Triage category of rule. type: String - contextPath: Vectra.Group.rules.id description: Id of the rule. type: Number - contextPath: Vectra.Group.rules.description description: Description of the rule. type: String - arguments: - default: false description: Specify Group ID to assign members. isArray: false name: group_id required: true secret: false - default: false description: "Member values based on the group type. Supports comma-separated values.\n\n Note: \nIf the group type is host, then the \"Host IDs\". \nIf the group type is account, then \"Account Names\".\nIf the group type is ip, then the list of \"IPs\".\nIf the group type is domain, then the list of \"Domains\" ." isArray: true name: members required: true secret: false deprecated: false description: Assign members to the specified group. execution: false name: vectra-group-assign outputs: - contextPath: Vectra.Group.group_id description: ID of the group. type: Number - contextPath: Vectra.Group.id description: ID of the group. type: Number - contextPath: Vectra.Group.name description: Name of the group. type: String - contextPath: Vectra.Group.description description: Description of the group. type: String - contextPath: Vectra.Group.last_modified description: Date when the group was last modified. type: Date - contextPath: Vectra.Group.last_modified_by description: Name of the user who last modified the group. type: String - contextPath: Vectra.Group.type description: Type of the group. type: String - contextPath: Vectra.Group.members description: Members of the group. type: Unknown - contextPath: Vectra.Group.members.id description: Entity ID of member. type: Number - contextPath: Vectra.Group.members.name description: Entity name of member. type: String - contextPath: Vectra.Group.members.is_key_asset description: Indicates key asset. type: Boolean - contextPath: Vectra.Group.members.url description: Entity URL of member. type: String - contextPath: Vectra.Group.members.uid description: Entity UID of member. type: String - contextPath: Vectra.Group.rules.triage_category description: Triage category of rule. type: String - contextPath: Vectra.Group.rules.id description: Id of the rule. type: Number - contextPath: Vectra.Group.rules.description description: Description of the rule. type: String - arguments: - description: Specify the ID of the entity. name: entity_id required: true - auto: PREDEFINED description: Specify the type of the entity. name: entity_type predefined: - account - host required: true - auto: PREDEFINED description: Specify the close reason. name: close_reason predefined: - benign - remediated required: true description: Mark the detections of the entity as closed with the provided entity ID in the argument. execution: false name: vectra-entity-detections-mark-asclosed - arguments: - description: Provide a list of detection IDs separated by commas or a single detection ID. isArray: true name: detection_ids required: true description: Open detections with provided detection IDs in the argument. execution: false name: vectra-detections-mark-asopen - arguments: - description: Specify the ID of the detection. name: detection_id required: true deprecated: false description: Returns a list of tags for a specified detection. execution: false name: vectra-detection-tag-list outputs: - contextPath: Vectra.Detection.Tags.tag_id description: The ID of the tag. type: String - contextPath: Vectra.Detection.Tags.detection_id description: The ID of the Detection associated with the tag. type: String - contextPath: Vectra.Detection.Tags.tags description: A list of tags linked to a detection. type: Unknown - arguments: - description: Specify the ID of the detection. name: detection_id required: true - description: Comma-separated values of tags to be added to the detection. isArray: true name: tags required: true description: Add tags to a detection. execution: false name: vectra-detection-tag-add outputs: - contextPath: Vectra.Detection.Tags.tag_id description: The ID of the tag. type: String - contextPath: Vectra.Detection.Tags.detection_id description: The ID of the detection associated with the tag. type: String - contextPath: Vectra.Detection.Tags.tags description: A list of tags linked to a detection. type: Unknown - arguments: - description: Specify the ID of the detection. name: detection_id required: true - description: Comma-separated values of tags to be removed from the detection. isArray: true name: tags required: true secret: false deprecated: false description: Remove tags from the detection. execution: false name: vectra-detection-tag-remove outputs: - contextPath: Vectra.Detection.Tags.tag_id description: The ID of the tag. type: String - contextPath: Vectra.Detection.Tags.detection_id description: The ID of the detection associated with the tag. type: String - contextPath: Vectra.Detection.Tags.tags description: A list of tags linked to a detection. type: Unknown - arguments: - description: Specify the ID of the detection. name: detection_id required: true default: false isArray: false secret: false description: Returns a list of notes for a specified detection. execution: false name: vectra-detection-note-list deprecated: false outputs: - contextPath: Vectra.Detection.Notes.note_id description: ID of the note. type: Number - contextPath: Vectra.Detection.Notes.id description: ID of the note. type: Number - contextPath: Vectra.Detection.Notes.date_created description: Date when the note was created (ISO8601). type: Date - contextPath: Vectra.Detection.Notes.date_modified description: Date when the note was last modified (ISO8601). type: Date - contextPath: Vectra.Detection.Notes.created_by description: User who created the note. type: String - contextPath: Vectra.Detection.Notes.modified_by description: User who last modified the note. type: String - contextPath: Vectra.Detection.Notes.note description: Content of the note. type: String - contextPath: Vectra.Detection.Notes.detection_id description: ID of the detection associated with the note. type: String - arguments: - default: false description: Specify the ID of the detection. isArray: false name: detection_id required: true secret: false - default: false description: Note to be added in the specified detection_id. isArray: false name: note required: true secret: false deprecated: false description: Add a note to the detection. execution: false name: vectra-detection-note-add outputs: - contextPath: Vectra.Detection.Notes.detection_id description: ID of the detection associated with the note. type: String - contextPath: Vectra.Detection.Notes.note_id description: ID of the note. type: Number - contextPath: Vectra.Detection.Notes.id description: ID of the note. type: Number - contextPath: Vectra.Detection.Notes.date_created description: Date when the note was created (ISO8601). type: Date - contextPath: Vectra.Detection.Notes.created_by description: User who created the note. type: String - contextPath: Vectra.Detection.Notes.note description: Content of the note. type: String - arguments: - default: false description: Specify the ID of the detection. isArray: false name: detection_id required: true secret: false - default: false description: Specify the ID of the note. isArray: false name: note_id required: true secret: false - default: false description: Note to be updated for the specified note_id. isArray: false name: note required: true secret: false deprecated: false description: Update a note in the detection. execution: false name: vectra-detection-note-update outputs: - contextPath: Vectra.Detection.Notes.detection_id description: ID of the detection associated with the note. type: String - contextPath: Vectra.Detection.Notes.note_id description: ID of the note. type: Number - contextPath: Vectra.Detection.Notes.id description: ID of the note. type: Number - contextPath: Vectra.Detection.Notes.date_created description: Date when the note was created (ISO8601). type: Date - contextPath: Vectra.Detection.Notes.date_modified description: Date when the note was last modified (ISO8601). type: Date - contextPath: Vectra.Detection.Notes.created_by description: User who created the note. type: String - contextPath: Vectra.Detection.Notes.modified_by description: User who last modified the note. type: String - contextPath: Vectra.Detection.Notes.note description: Content of the note. type: String - arguments: - default: false description: Specify the ID of the detection. isArray: false name: detection_id required: true secret: false - default: false description: Specify the ID of the note. isArray: false name: note_id required: true secret: false deprecated: false description: Remove a note from the detection. execution: false name: vectra-detection-note-remove - arguments: - name: entity_id required: true description: "Specify the ID of the entity.\n\nNote: Users can get the entity ID by executing the \"vectra-entity-list\" command." - name: entity_type required: true description: Specify the type of the entity. auto: PREDEFINED predefined: - account - host outputs: - contextPath: Vectra.Entity.id description: An ID of the entity. type: String - contextPath: Vectra.Entity.type description: The type of the entity. type: String - contextPath: Vectra.Entity.unresolved_priority description: An entity unresolved priority status. type: Boolean description: Update the unresolved priority of an entity to false. execution: true # This command modifies the Vectra system name: vectra-entity-unresolved-priority-reset - arguments: - name: detection_ids required: true isArray: true description: "Provide a list of detection IDs separated by comma or a single detection ID.\n\nNote: Users can get the detection ID by executing the \"vectra-detection-list\" command." - name: investigation_status required: true description: Specify the investigation status. auto: PREDEFINED predefined: - open - acknowledged - escalated - paused - closed - expired outputs: - contextPath: Vectra.Detection.id description: The detection ID. type: String - contextPath: Vectra.Detection.investigation_status description: The detection investigation status. type: String description: Update the investigation status of the detection by detection ID(s). execution: true # This command modifies the Vectra system name: vectra-detection-investigation-status-update - arguments: - name: detection_ids required: true isArray: true description: "Provide a list of detection IDs separated by comma or a single detection ID.\n\nNote: Users can get the detection ID by executing the \"vectra-detection-list\" command." - name: external_reference_id required: true description: Provide the external reference ID. outputs: - contextPath: Vectra.Detection.id description: The detection ID. type: String - contextPath: Vectra.Detection.external_reference_id description: The external reference ID of the detection. type: String description: Update the external reference ID for the provided detection ID(s). execution: true # This command modifies the Vectra system name: vectra-detection-external-id-update - arguments: - name: entity_id required: true description: "Specify the ID of the entity.\n\nNote: Users can get the entity ID by executing the \"vectra-entity-list\" command." - name: entity_type required: true description: Specify the type of the entity. auto: PREDEFINED predefined: - account - host - name: external_reference_id required: true description: Provide the external reference ID. outputs: - contextPath: Vectra.Entity.id description: An ID of the entity. type: String - contextPath: Vectra.Entity.type description: The type of the entity. type: String - contextPath: Vectra.Entity.external_reference_id description: The external reference ID of the entity. type: String description: Update the external reference ID for the provided entity. execution: true # This command modifies the Vectra system name: vectra-entity-external-id-update - arguments: - description: "Filter the detections by created on or after the specified time.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 March 2026, 01 Mar 2026 04:45:33, 2026-04-17T14:05:44Z." name: created_after required: false - description: "Filter the detections by created on or before the specified time.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 March 2026, 01 Mar 2026 04:45:33, 2026-04-17T14:05:44Z." name: created_before required: false - description: "Filter the detections by last detected on or after the specified time.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 March 2026, 01 Mar 2026 04:45:33, 2026-04-17T14:05:44Z." name: last_detected_after required: false - description: "Filter the detections by last detected on or before the specified time.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 March 2026, 01 Mar 2026 04:45:33, 2026-04-17T14:05:44Z." name: last_detected_before required: false - description: Filter by description containing specified value. name: description required: false - description: Filter by detection name. name: detection_name required: false - description: Filter by detection type. name: detection_type required: false - auto: PREDEFINED description: Filter by detections category. name: detection_category predefined: - Command & Control - Botnet - Reconnaissance - Lateral Movement - Exfiltration - Info required: false - auto: PREDEFINED description: Include the info category detections which are excluded by default. name: include_info_category_detections defaultValue: 'true' predefined: - 'true' - 'false' required: false - auto: PREDEFINED description: Filter by close reason of the detection. name: close_reason predefined: - benign - remediated required: false - description: Filter by detection state. name: detection_state auto: PREDEFINED predefined: - active - inactive - fixed required: false - description: Filter by Entity type. name: entity_type auto: PREDEFINED predefined: - account - host required: false - description: Filter by detection tags. Comma-separated values supported. name: tags isArray: true required: false - description: Filter by detection triage status. name: is_triaged defaultValue: 'false' auto: PREDEFINED predefined: - 'true' - 'false' required: false - defaultValue: '1' description: Provide page number to retrieve. name: page required: false - defaultValue: '50' description: Provide a number of results per page. name: page_size required: false description: Returns a list of detections based on the specified filters. execution: false name: vectra-detection-list outputs: - contextPath: Vectra.Detection.id description: A unique identifier for the detection. type: Number - contextPath: Vectra.Detection.assigned_date description: The date when the detection was assigned. type: Date - contextPath: Vectra.Detection.assigned_to description: The email or user to whom the detection is assigned. type: String - contextPath: Vectra.Detection.certainty description: The certainty level associated with the detection. type: Number - contextPath: Vectra.Detection.created_timestamp description: The timestamp when the detection was created. type: Date - contextPath: Vectra.Detection.custom_detection description: The custom detection configuration or settings. type: Unknown - contextPath: Vectra.Detection.data_source.type description: The type of data source for the detection. type: String - contextPath: Vectra.Detection.data_source.connection_name description: The name of the connection used for data ingestion. type: String - contextPath: Vectra.Detection.data_source.connection_id description: A unique identifier for the data source connection. type: String - contextPath: Vectra.Detection.description description: The description of the detection. type: String - contextPath: Vectra.Detection.detection description: The name of the detection. type: String - contextPath: Vectra.Detection.detection_category description: The category of the detection. type: String - contextPath: Vectra.Detection.detection_type description: The type of the detection. type: String - contextPath: Vectra.Detection.detection_url description: The URL to access the detection details. type: String - contextPath: Vectra.Detection.filtered_by_ai description: Indicates if the detection was filtered by AI. type: Boolean - contextPath: Vectra.Detection.filtered_by_rule description: Indicates if the detection was filtered by a rule. type: Boolean - contextPath: Vectra.Detection.filtered_by_user description: Indicates if the detection was filtered by a user. type: Boolean - contextPath: Vectra.Detection.first_timestamp description: The first timestamp when the detection was observed. type: Date - contextPath: Vectra.Detection.grouped_details.role description: The role associated with the detection group. type: String - contextPath: Vectra.Detection.grouped_details.last_timestamp description: The last timestamp of the detection group. type: Date - contextPath: Vectra.Detection.groups.id description: A unique identifier for the group. type: Number - contextPath: Vectra.Detection.groups.name description: The name of the group. type: String - contextPath: Vectra.Detection.groups.description description: The description of the group. type: String - contextPath: Vectra.Detection.groups.type description: The type of the group. type: String - contextPath: Vectra.Detection.groups.last_modified description: The timestamp when the group was last modified. type: Date - contextPath: Vectra.Detection.groups.last_modified_by description: The email or user who last modified the group. type: String - contextPath: Vectra.Detection.is_custom_model description: Indicates if the detection uses a custom model. type: Boolean - contextPath: Vectra.Detection.is_marked_custom description: Indicates if the detection is marked as custom. type: Boolean - contextPath: Vectra.Detection.is_triaged description: Indicates if the detection has been triaged. type: Boolean - contextPath: Vectra.Detection.last_timestamp description: The last timestamp when the detection was observed. type: Date - contextPath: Vectra.Detection.note description: A note associated with the detection. type: String - contextPath: Vectra.Detection.note_modified_by description: The email or user who modified the note. type: String - contextPath: Vectra.Detection.note_modified_timestamp description: The timestamp when the note was last modified. type: Date - contextPath: Vectra.Detection.notes.created_by description: The email or user who created the note. type: String - contextPath: Vectra.Detection.notes.date_created description: The date when the note was created. type: Date - contextPath: Vectra.Detection.notes.date_modified description: The date when the note was modified. type: Date - contextPath: Vectra.Detection.notes.id description: A unique identifier for the note. type: Number - contextPath: Vectra.Detection.notes.modified_by description: The email or user who modified the note. type: String - contextPath: Vectra.Detection.notes.note description: The content of the note. type: String - contextPath: Vectra.Detection.reason description: The reason for the detection state or triage action. type: String - contextPath: Vectra.Detection.sensor description: The sensor identifier that detected the activity. type: String - contextPath: Vectra.Detection.sensor_name description: The name of the sensor that detected the activity. type: String - contextPath: Vectra.Detection.src_account.id description: A unique identifier for the source account. type: Number - contextPath: Vectra.Detection.src_account.name description: The name of the source account. type: String - contextPath: Vectra.Detection.src_account.url description: The URL to access the source account details. type: String - contextPath: Vectra.Detection.src_account.threat description: The threat level associated with the source account. type: Number - contextPath: Vectra.Detection.src_account.certainty description: The certainty level associated with the source account. type: Number - contextPath: Vectra.Detection.src_account.privilege_level description: The privilege level associated with the source account. type: Number - contextPath: Vectra.Detection.src_account.privilege_category description: The privilege category associated with the source account. type: String - contextPath: Vectra.Detection.src_host.id description: A unique identifier for the source host. type: Number - contextPath: Vectra.Detection.src_host.name description: The name of the source host. type: String - contextPath: Vectra.Detection.src_host.ip description: The IP address of the source host. type: String - contextPath: Vectra.Detection.src_host.url description: The URL to access the source host details. type: String - contextPath: Vectra.Detection.src_host.is_key_asset description: Indicates if the source host is a key asset. type: Boolean - contextPath: Vectra.Detection.src_host.group.id description: A unique identifier for the source host group. type: Number - contextPath: Vectra.Detection.src_host.group.name description: The name of the source host group. type: String - contextPath: Vectra.Detection.src_host.group.description description: The description of the source host group. type: String - contextPath: Vectra.Detection.src_host.group.type description: The type of the source host group. type: String - contextPath: Vectra.Detection.src_host.group.last_modified description: The timestamp when the source host group was last modified. type: Date - contextPath: Vectra.Detection.src_host.group.last_modified_by description: The email or user who last modified the source host group. type: String - contextPath: Vectra.Detection.src_host.threat description: The threat level associated with the source host. type: Number - contextPath: Vectra.Detection.src_host.certainty description: The certainty level associated with the source host. type: Number - contextPath: Vectra.Detection.src_ip description: The source IP address in the detection. type: String - contextPath: Vectra.Detection.src_groups.id description: A unique identifier for the source group. type: Number - contextPath: Vectra.Detection.src_groups.name description: The name of the source group. type: String - contextPath: Vectra.Detection.src_groups.description description: The description of the source group. type: String - contextPath: Vectra.Detection.src_groups.type description: The type of the source group. type: String - contextPath: Vectra.Detection.src_groups.last_modified description: The timestamp when the source group was last modified. type: Date - contextPath: Vectra.Detection.src_groups.last_modified_by description: The email or user who last modified the source group. type: String - contextPath: Vectra.Detection.dst_groups.id description: A unique identifier for the destination group. type: Number - contextPath: Vectra.Detection.dst_groups.name description: The name of the destination group. type: String - contextPath: Vectra.Detection.dst_groups.description description: The description of the destination group. type: String - contextPath: Vectra.Detection.dst_groups.type description: The type of the destination group. type: String - contextPath: Vectra.Detection.dst_groups.last_modified description: The timestamp when the destination group was last modified. type: Date - contextPath: Vectra.Detection.dst_groups.last_modified_by description: The email or user who last modified the destination group. type: String - contextPath: Vectra.Detection.state description: The current state of the detection. type: String - contextPath: Vectra.Detection.summary.artifact description: The artifacts associated with the detection summary. type: Array - contextPath: Vectra.Detection.summary.last_timestamp description: The last timestamp in the detection summary. type: Date - contextPath: Vectra.Detection.summary.description description: The description in the detection summary. type: String - contextPath: Vectra.Detection.summary.roles description: The roles associated with the detection summary. type: Array - contextPath: Vectra.Detection.tags description: The tags associated with the detection. type: Array - contextPath: Vectra.Detection.is_targeting_key_asset description: Indicates if the detection is targeting a key asset. type: Boolean - contextPath: Vectra.Detection.threat description: The threat level of the detection. type: Number - contextPath: Vectra.Detection.triage_rule_id description: A unique identifier for the triage rule applied to the detection. type: Unknown - contextPath: Vectra.Detection.type description: The type of the detection. type: String - contextPath: Vectra.Detection.url description: The URL to access the detection details. type: String - arguments: - name: query required: true description: Provide an investigation query in the supported query language. - name: version required: false description: Specify the version of the query language. outputs: - contextPath: Vectra.Investigation.request_id description: The unique identifier for the query request. Use this to retrieve results. type: String - contextPath: Vectra.Investigation.searchable_range.searchable_days_allowed description: A Maximum number of days of data that can be searched. type: Number description: Submit an investigation query and receive a request ID for retrieving results. execution: true # This command modifies the Vectra system name: vectra-investigation-query-send - arguments: - name: id required: true description: Provide the unique request ID of investigation. - name: page defaultValue: '1' required: false description: Provide page number to retrieve. - name: page_size defaultValue: '50' required: false description: Provide a number of results per page to retrieve. outputs: - contextPath: Vectra.Investigation.request_id description: The unique identifier for the query request. type: String - contextPath: Vectra.Investigation.data description: An array of query results. type: Unknown - contextPath: Vectra.Investigation.meta.query_status description: The status of the query. type: String - contextPath: Vectra.Investigation.meta.num_rows_available description: Total rows returned by the query. type: Number - contextPath: Vectra.Investigation.meta.page description: The current page number. type: Number - contextPath: Vectra.Investigation.meta.page_size description: The rows returned on this page. type: Number - contextPath: Vectra.Investigation.meta.estimated_file_size_bytes description: The estimated size of the full result set in bytes. type: Number - contextPath: Vectra.Investigation.meta.columns description: An array of tuples describing the result schema. type: Unknown description: Retrieve the results of a previously submitted investigation query using the request ID. execution: false name: vectra-investigation-result-get dockerimage: demisto/python3:3.12.13.10116658 isfetch: true isremotesyncin: true isremotesyncout: true runonce: false script: '-' subtype: python3 type: python fromversion: 6.10.0 tests: - No tests (auto formatted)