category: Data Enrichment & Threat Intelligence
provider: Haveli Investments
sectionorder:
- Connect
- Collect
commonfields:
  id: ZeroFoxKeyIncidents
  version: -1
configuration:
- defaultvalue: 'https://api.zerofox.com/'
  display: 'URL (e.g., https://api.zerofox.com/)'
  name: url
  required: true
  section: Connect
  type: 0
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  defaultvalue: 'true'
- display: Username
  name: credentials
  required: true
  section: Connect
  type: 9
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  defaultvalue: '10'
  required: false
  hidden: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
description: Cloud-based SaaS to detect risks found on social media and digital channels.
display: ZeroFox Key Incidents
name: ZeroFoxKeyIncidents
script:
  commands:
  - name: zerofox-get-key-incident-attachment
    description: Fetches a Key Incident Attachment by ID and uploads it to the current investigation War Room.
    arguments:
    - name: attachment_id
      required: true
      description: The ID of the Key Incident Attachment.
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  script: '-'
  type: python
  subtype: python3
  longRunning: false
  longRunningPort: false
  runonce: false
  isfetch: true
  ismappable: false
  isremotesyncin: true
  isremotesyncout: false
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.1.0
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests (auto formatted)