args:
- description: The indicators query.
  name: query
  required: true
- auto: PREDEFINED
  description: The action that will be taken if the indicator will be discovered in the organization.
  name: action
  predefined:
  - Warn
  - Block
  - Audit
  - Alert
  - AlertAndBlock
  - BlockAndRemediate
  - Allowed
  required: true
- defaultValue: '10000'
  description: The maximum number of indicators to fetch.
  name: limit
- defaultValue: '0'
  description: The results offset page. Only change when the number of the results exceed the limit.
  name: offset
comment: Transform a XSOAR indicator into a Microsoft Defender for Endpoint IOC. The output (at TransformIndicatorToMSDefenderIOC.JsonOutput) is a json representation of the indicators in MSDE format. This json can be the input for the *microsoft-atp-indicator-batch-update* command.
commonfields:
  id: TransformIndicatorToMSDefenderIOC
  version: -1
name: TransformIndicatorToMSDefenderIOC
outputs:
- contextPath: TransformIndicatorToMSDefenderIOC.JsonOutput
  description: Json output of the indicators. Should be the input for the *microsoft-atp-indicator-batch-update*.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.indicatorValue
  description: The value of the Indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.indicatorType
  description: 'Type of the indicator. Possible values are: FileSha1, FileSha256, FileMd5, CertificateThumbprint, IpAddress, DomainName, Url.'
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.lastUpdateTime
  description: The last time the indicator was updated.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.lastUpdatedBy
  description: Identity of the user/application that last updated the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.action
  description: 'The action that will be taken if the indicator will be discovered in the organization. Possible values are: "Warn", "Block", "Audit", "Alert", "AlertAndBlock", "BlockAndRemediate" and "Allowed".'
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.title
  description: Indicator title.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.expirationTime
  description: The expiration time of the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.description
  description: Description of the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.creationTimeDateTimeUtc
  description: The date and time when the indicator was created.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.Severity
  description: 'The severity of the indicator. possible values are: Informational, Low, Medium and High.'
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.application
  description: The application associated with the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.externalID
  description: Id the customer can submit in the request for custom correlation.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.sourceType
  description: 'User in case the Indicator created by a user. "AadApp" in case it submitted using automated application via the API.'
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.createdBySource
  description: The name of the user or application that submitted the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.createdBy
  description: Unique identity of the user or application that submitted the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.recommendedActions
  description: Recommended actions for the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.rbacGroupNames
  description: RBAC device group names where the indicator is exposed and active. Empty list in case it exposed to all devices.
  type: Unknown
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.rbacGroupIds
  description: RBAC device group ID's where the indicator is exposed and active. Empty list in case it exposed to all devices.
  type: Unknown
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.generateAlert
  description: True if alert generation is required, False if this indicator should not generate an alert.
  type: String
script: '-'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.0.0
tests:
- No tests (auto formatted)