category: Analytics & SIEM
provider: iManage
sectionorder:
  - Connect
  - Collect
commonfields:
  id: iManageThreatManager
  version: -1
configuration:
  - display: Server URL
    name: url
    additionalinfo: Should be in the format https://<your-instance>.tm-cloudimanage.com.
    required: true
    type: 0
    section: Connect
  - display: User Name
    name: credentials_user
    displaypassword: Password
    additionalinfo: Required for Addressable Alerts and Detect And Protect Alerts event types.
    required: false
    type: 9
    section: Connect
  - display: Token
    name: credentials_token
    displaypassword: Secret
    additionalinfo: Required for Behavior Analytics alerts.
    required: false
    type: 9
    section: Connect
  - display: Trust any certificate (not secure)
    name: insecure
    required: false
    type: 8
    section: Connect
  - display: Use system proxy settings
    name: proxy
    required: false
    type: 8
    section: Connect
  - display: Fetch events
    name: isFetchEvents
    defaultvalue: "false"
    required: false
    type: 8
    section: Collect
  - display: Events types to fetch
    name: event_types
    defaultvalue: Behavior Analytics alerts
    additionalinfo: Select which event types to fetch.
    required: false
    type: 16
    section: Collect
    options:
      - Behavior Analytics alerts
      - Addressable Alerts
      - Detect And Protect Alerts
  - display: Maximum number of events per type
    name: max_events_per_type
    defaultvalue: "900"
    additionalinfo: Default and maximum is 900 events to fetch for each event type.
    type: 0
    section: Collect
description: iManage Threat Manager protects privileged information against internal and external threat actors using machine learning and user behavior analytics.
display: iManage Threat Manager
name: iManageThreatManager
script:
  commands:
    - arguments:
        - name: should_push_events
          auto: PREDEFINED
          defaultValue: "false"
          description: If true, the command creates events, otherwise it only displays them.
          predefined:
            - "true"
            - "false"
          required: true
        - name: event_type
          auto: PREDEFINED
          description: Type of events to fetch.
          predefined:
            - Behavior Analytics alerts
            - Addressable Alerts
            - Detect And Protect Alerts
          defaultValue: Behavior Analytics alerts
          required: false
        - name: limit
          description: Maximum number of results to return.
          required: false
          defaultValue: "50"
        - name: from_date
          description: Start date from which to get events. Supports ISO format or natural language (e.g., "7 days ago", "1 hour ago"). Default is 1 hour ago.
          required: false
        - name: to_date
          description: End date until which to get events. Supports ISO format or natural language (e.g., "now", "30 minutes ago"). Default is now.
          required: false
      description: Fetches events from iManage Threat Manager.
      name: imanage-threat-manager-get-events
  dockerimage: demisto/fastapi:0.125.0.10158186
  isfetchevents: true
  runonce: false
  script: "-"
  subtype: python3
  type: python
marketplaces:
  - marketplacev2
  - platform
fromversion: 8.4.0
tests:
  - No tests (auto formatted)