display: iZOOlogic name: iZOOlogic provider: iZOOlogic category: Network Security sectionorder: - Connect - Collect commonfields: id: iZOOlogic version: -1 configuration: - name: url display: Server URL required: true type: 0 additionalinfo: 'The iZOOlogic API server URL.' section: Connect - name: api_key required: true type: 9 displaypassword: API Key hiddenusername: true additionalinfo: 'The API key provided by iZOOlogic for authentication.' section: Connect - name: secret_key required: true type: 9 displaypassword: Secret Key hiddenusername: true additionalinfo: 'The secret key corresponding to the API key.' section: Connect - name: insecure display: Trust any certificate (not secure) type: 8 required: false additionalinfo: 'Whether to trust any certificate (not secure).' section: Connect - name: proxy display: Use system proxy settings type: 8 required: false additionalinfo: 'Whether to use the system proxy settings.' section: Connect - name: isFetchEvents type: 8 required: false additionalinfo: 'Whether to fetch incidents from iZOOlogic.' section: Collect hidden: - xsoar - name: events_types_filter display: Fetch incident types required: true defaultvalue: brand abuse,phishing,malware,pharming,smishing,vishing,mobile apps,social media,other,email,executive type: 16 options: - brand abuse - phishing - malware - pharming - smishing - vishing - mobile apps - social media - other - email - executive additionalinfo: 'A comma-separated list of incident types to fetch from iZOOlogic.' section: Collect hidden: - xsoar - name: max_fetch display: Maximum incidents per fetch per type required: true defaultvalue: '5000' type: 0 additionalinfo: 'The maximum number of incidents to fetch per type per fetch cycle.' section: Collect hidden: - xsoar description: Fetches and manages incidents from iZOOlogic, enabling automated ingestion, incident creation, and advanced filtering for brand protection and threat management. script: commands: - name: izoologic-get-events description: Gets events from iZOOlogic. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism. arguments: - name: limit description: The maximum number of events to return per type. defaultValue: '50' - name: start_time description: 'The time to filter events detected at or after. Supports ISO 8601 format or relative time expressions (e.g., "3 days ago", "2024-01-01T00:00:00Z").' - name: end_time description: 'The time to filter events detected at or before. Supports ISO 8601 format or relative time expressions (e.g., "now", "2024-01-01T00:00:00Z").' - name: event_type description: 'The event types to filter by, as a comma-separated list. If not specified, the command uses the types configured in the integration parameters.' isArray: true auto: PREDEFINED predefined: - brand abuse - phishing - malware - pharming - smishing - vishing - mobile apps - social media - other - email - executive - name: should_push_events description: The flag that indicates whether to push events to Cortex XSIAM. Pushing events is supported on Cortex XSIAM only. When set to false, or on non-Cortex XSIAM platforms, events are displayed without being pushed. auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' outputs: - contextPath: iZOOlogic.Incident.incidentID description: The unique identifier of the incident. type: String - contextPath: iZOOlogic.Incident.incidentType description: The type and subtype of the incident. type: String - contextPath: iZOOlogic.Incident.subIncidentType description: The subtype of the incident. type: String - contextPath: iZOOlogic.Incident.detectionDate description: The detection date of the incident as a Unix timestamp (e.g., 1704067200). type: String - contextPath: iZOOlogic.Incident.url description: The URL associated with the incident. type: String - contextPath: iZOOlogic.Incident.status description: The current status of the incident. type: String - contextPath: iZOOlogic.Incident.statusCode description: The numeric status code of the incident. type: Number - contextPath: iZOOlogic.Incident.brand description: The brand associated with the incident. type: String - contextPath: iZOOlogic.Incident.threatType description: The threat level of the incident. type: String - contextPath: iZOOlogic.Incident.createdOn description: The creation date of the incident as a Unix timestamp (e.g., 1704067200). type: String - contextPath: iZOOlogic.Incident.closedOn description: The closing date of the incident as a Unix timestamp (e.g., 1704067200). type: String - contextPath: iZOOlogic.Incident.detectedBy description: The entity that detected the incident. type: String - name: izoologic-incident-create description: Creates a new security incident in iZOOlogic. arguments: - name: incident_url description: The URL, email, or target of the security incident (max 1000 characters). required: true - name: incident_type description: The type of incident. required: true auto: PREDEFINED predefined: - brand abuse - phishing - malware - pharming - smishing - vishing - mobile apps - social media - other - email - executive - name: brand_code description: The brand identifier associated with the incident. required: true - name: threat_type description: The threat level. defaultValue: moderate threat auto: PREDEFINED predefined: - low threat - moderate threat - substantial threat - high threat - critical threat - redirect to whitelist - name: case_type description: The preferred case type for processing. All new incidents are initially created as "Reported Incident" and may be reclassified during review. defaultValue: incident auto: PREDEFINED predefined: - incident - brand abuse monitoring - domain monitoring - social media monitoring - mobile app monitoring - executive monitoring - name: comment description: The comments about the incident (max 2500 characters). - name: executive_name description: The executive name. Required for executive-related incidents (max 2500 characters). - name: client_code description: The client identifier for validation and access control. outputs: - contextPath: iZOOlogic.Incident.reportedIncidentId description: The unique identifier for the created incident case. type: String - contextPath: iZOOlogic.Incident.statusCode description: The numeric status code (1 = under review). type: Number - contextPath: iZOOlogic.Incident.statusDescription description: The human-readable status description. type: String - contextPath: iZOOlogic.Incident.caseType description: The case type code (9 = reported incident). type: Number - contextPath: iZOOlogic.Incident.caseTypeDescription description: The human-readable case type description. type: String - name: izoologic-incident-fetch description: Fetches incidents from iZOOlogic based on specified filters including date range, brand, incident type, and other criteria. arguments: - name: from_date description: 'The start date for filtering incidents. Supports ISO 8601 format or relative time expressions (e.g., "1 day ago", "2024-01-01T00:00:00Z"). Maximum date range is 31 days.' defaultValue: '1 day ago' - name: to_date description: 'The end date for filtering incidents. Supports ISO 8601 format or relative time expressions (e.g., "now", "2024-01-01T00:00:00Z"). Maximum date range is 31 days.' defaultValue: 'now' - name: incident_type description: The type of incident to filter by. auto: PREDEFINED predefined: - brand abuse - phishing - malware - pharming - smishing - vishing - mobile apps - social media - other - email - executive - name: threat_type description: The threat level to filter by. auto: PREDEFINED predefined: - low threat - moderate threat - substantial threat - high threat - critical threat - redirect to whitelist - name: brand_code description: The brand identifier to filter incidents by. - name: executive_name description: The executive name for filtering executive-related incidents (max 100 characters). - name: client_ref_id description: The client reference ID for specific incident lookup. - name: client_code description: The client identifier for filtering incidents. outputs: - contextPath: iZOOlogic.Incident.incidentID description: The unique identifier of the incident. type: String - contextPath: iZOOlogic.Incident.incidentType description: The type and subtype of the incident. type: String - contextPath: iZOOlogic.Incident.subIncidentType description: The subtype of the incident. type: String - contextPath: iZOOlogic.Incident.detectionDate description: The detection date of the incident as a Unix timestamp (e.g., 1704067200). type: String - contextPath: iZOOlogic.Incident.url description: The URL associated with the incident. type: String - contextPath: iZOOlogic.Incident.status description: The current status of the incident. type: String - contextPath: iZOOlogic.Incident.statusCode description: The numeric status code of the incident. type: Number - contextPath: iZOOlogic.Incident.brand description: The brand associated with the incident. type: String - contextPath: iZOOlogic.Incident.threatType description: The threat level of the incident. type: String - contextPath: iZOOlogic.Incident.createdOn description: The creation date of the incident as a Unix timestamp (e.g., 1704067200). type: String - contextPath: iZOOlogic.Incident.closedOn description: The closing date of the incident as a Unix timestamp (e.g., 1704067200). type: String - contextPath: iZOOlogic.Incident.detectedBy description: The entity that detected the incident. type: String dockerimage: demisto/fastapi:0.125.0.10158186 isfetchevents: true isfetchevents:xsoar: false runonce: false script: '-' subtype: python3 type: python fromversion: 8.2.0 tests: - No tests (auto formatted)