Code42.yml

category: Endpoint
commonfields:
  id: Code42
  version: -1
configuration:
- defaultvalue: console.us.code42.com
  display: Code42 Console URL for the pod your Code42 instance is running in
  name: console_url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
- display: Incident type
  name: incidentType
  required: false
  type: 13
- display: Alert severities to fetch when fetching incidents
  name: alert_severity
  options:
  - High
  - Medium
  - Low
  required: false
  type: 16
- defaultvalue: 24 hours
  display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
  name: fetch_time
  required: false
  type: 0
- defaultvalue: '10'
  display: Alerts to fetch per run; note that increasing this value may result in
    slow performance if too many results are returned at once
  name: fetch_limit
  required: false
  type: 0
- defaultvalue: 'false'
  display: Include the list of files in returned incidents.
  name: include_files
  required: false
  type: 8
description: Use the Code42 integration to identify potential data exfiltration from
  insider threats while speeding investigation and response by providing fast access
  to file events and metadata across physical and cloud environments.
display: Code42
name: Code42
script:
  commands:
  - arguments:
    - default: false
      description: JSON query payload using Code42 query syntax.
      isArray: false
      name: json
      required: false
      secret: false
    - default: false
      description: MD5 or SHA256 hash of the file to search for.
      isArray: false
      name: hash
      required: false
      secret: false
    - default: false
      description: Username to search for.
      isArray: false
      name: username
      required: false
      secret: false
    - default: false
      description: Hostname to search for.
      isArray: false
      name: hostname
      required: false
      secret: false
    - auto: PREDEFINED
      default: false
      description: Exposure types to search for. Can be "RemovableMedia", "ApplicationRead",
        "CloudStorage", "IsPublic", "SharedViaLink", "SharedViaDomain", or "OutsideTrustedDomains".
      isArray: true
      name: exposure
      predefined:
      - RemovableMedia
      - ApplicationRead
      - CloudStorage
      - IsPublic
      - SharedViaLink
      - SharedViaDomain
      - OutsideTrustedDomains
      required: false
      secret: false
    - default: false
      defaultValue: '100'
      description: The number of results to return. The default is 100.
      isArray: false
      name: results
      required: false
      secret: false
    deprecated: false
    description: Searches for a file in Security Data by JSON query, hash, username,
      device hostname, exfiltration type, or a combination of parameters. At least
      one argument must be passed in the command. If a JSON argument is passed, it
      will be used to the exclusion of other parameters, otherwise parameters will
      be combined with an AND clause.
    execution: false
    name: code42-securitydata-search
    outputs:
    - contextPath: Code42.SecurityData.EventTimestamp
      description: Timestamp for the event.
      type: date
    - contextPath: Code42.SecurityData.FileCreated
      description: File creation date.
      type: date
    - contextPath: Code42.SecurityData.EndpointID
      description: Code42 device ID.
      type: string
    - contextPath: Code42.SecurityData.DeviceUsername
      description: The username that the device is associated with in Code42.
      type: string
    - contextPath: Code42.SecurityData.EmailFrom
      description: The sender email address for email exfiltration events.
      type: string
    - contextPath: Code42.SecurityData.EmailTo
      description: The recipient email address for email exfiltration events.
      type: string
    - contextPath: Code42.SecurityData.EmailSubject
      description: The email subject line for email exfiltration events.
      type: string
    - contextPath: Code42.SecurityData.EventID
      description: The Security Data event ID.
      type: string
    - contextPath: Code42.SecurityData.EventType
      description: The type of Security Data event.
      type: string
    - contextPath: Code42.SecurityData.FileCategory
      description: The file type, as determined by Code42 engine.
      type: string
    - contextPath: Code42.SecurityData.FileOwner
      description: The owner of the file.
      type: string
    - contextPath: Code42.SecurityData.FileName
      description: The file name.
      type: string
    - contextPath: Code42.SecurityData.FilePath
      description: The path to file.
      type: string
    - contextPath: Code42.SecurityData.FileSize
      description: The size of the file (in bytes).
      type: number
    - contextPath: Code42.SecurityData.FileModified
      description: The date the file was last modified.
      type: date
    - contextPath: Code42.SecurityData.FileMD5
      description: MD5 hash of the file.
      type: string
    - contextPath: Code42.SecurityData.FileHostname
      description: Hostname where the file event was captured.
      type: string
    - contextPath: Code42.SecurityData.DevicePrivateIPAddress
      description: Private IP addresses of the device where the event was captured.
      type: string
    - contextPath: Code42.SecurityData.DevicePublicIPAddress
      description: Public IP address of the device where the event was captured.
      type: string
    - contextPath: Code42.SecurityData.RemovableMediaType
      description: Type of removable media.
      type: string
    - contextPath: Code42.SecurityData.RemovableMediaCapacity
      description: Total capacity of removable media (in bytes).
      type: number
    - contextPath: Code42.SecurityData.RemovableMediaMediaName
      description: The full name of the removable media.
      type: string
    - contextPath: Code42.SecurityData.RemovableMediaName
      description: The name of the removable media.
      type: string
    - contextPath: Code42.SecurityData.RemovableMediaSerialNumber
      description: The serial number for the removable medial device.
      type: string
    - contextPath: Code42.SecurityData.RemovableMediaVendor
      description: The vendor name for removable device.
      type: string
    - contextPath: Code42.SecurityData.FileSHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: Code42.SecurityData.FileShared
      description: Whether the file is shared using a cloud file service.
      type: boolean
    - contextPath: Code42.SecurityData.FileSharedWith
      description: Accounts that the file is shared with on a cloud file service.
      type: string
    - contextPath: Code42.SecurityData.Source
      description: The source of the file event. Can be "Cloud" or "Endpoint".
      type: string
    - contextPath: Code42.SecurityData.ApplicationTabURL
      description: The URL associated with the application read event.
      type: string
    - contextPath: Code42.SecurityData.ProcessName
      description: The process name for the application read event.
      type: string
    - contextPath: Code42.SecurityData.ProcessOwner
      description: The process owner for the application read event.
      type: string
    - contextPath: Code42.SecurityData.WindowTitle
      description: The process name for the application read event.
      type: string
    - contextPath: Code42.SecurityData.FileURL
      description: The URL of the file on a cloud file service.
      type: string
    - contextPath: Code42.SecurityData.Exposure
      description: The event exposure type.
      type: string
    - contextPath: Code42.SecurityData.SharingTypeAdded
      description: The type of sharing added to the file.
      type: string
    - contextPath: File.Name
      description: The file name.
      type: string
    - contextPath: File.Path
      description: The file path.
      type: string
    - contextPath: File.Size
      description: The file size (in bytes).
      type: number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Hostname
      description: The hostname where the file event was captured.
      type: string
  - arguments:
    - default: false
      description: The alert ID to retrieve. Alert IDs are associated with alerts
        that are fetched via fetch-incidents.
      isArray: false
      name: id
      required: true
      secret: false
    deprecated: false
    description: Retrieve alert details by alert ID
    execution: false
    name: code42-alert-get
    outputs:
    - contextPath: Code42.SecurityAlert.Username
      description: The username associated with the alert.
      type: string
    - contextPath: Code42.SecurityAlert.Occurred
      description: The timestamp when the alert occurred.
      type: date
    - contextPath: Code42.SecurityAlert.Description
      description: The description of the alert.
      type: string
    - contextPath: Code42.SecurityAlert.ID
      description: The alert ID.
      type: string
    - contextPath: Code42.SecurityAlert.Name
      description: The alert rule name that generated the alert.
      type: string
    - contextPath: Code42.SecurityAlert.State
      description: The alert state.
      type: string
    - contextPath: Code42.SecurityAlert.Type
      description: The alert type.
      type: string
    - contextPath: Code42.SecurityAlert.Severity
      description: The severity of the alert.
      type: string
  - arguments:
    - default: false
      description: The alert ID to resolve. Alert IDs are associated with alerts that
        are fetched via fetch-incidents.
      isArray: false
      name: id
      required: true
      secret: false
    deprecated: false
    description: Resolves a Code42 Security alert.
    execution: false
    name: code42-alert-resolve
    outputs:
    - contextPath: Code42.SecurityAlert.ID
      description: The alert ID of the resolved alert.
      type: string
  - arguments:
    - default: false
      description: The username to add to the Departing Employee List.
      isArray: false
      name: username
      required: true
      secret: false
    - default: false
      description: The departure date for the employee, in the format YYYY-MM-DD.
      isArray: false
      name: departuredate
      required: false
      secret: false
    - default: false
      description: Note to attach to the Departing Employee.
      isArray: false
      name: note
      required: false
      secret: false
    deprecated: false
    description: Adds a user to the Departing Employee List.
    execution: false
    name: code42-departingemployee-add
    outputs:
    - contextPath: Code42.DepartingEmployee.CaseID
      description: Internal Code42 Case ID for the Departing Employee. Deprecated.
        Use Code42.DepartingEmployee.UserID.
      type: string
    - contextPath: Code42.DepartingEmployee.UserID
      description: Internal Code42 User ID for the Departing Employee.
      type: string
    - contextPath: Code42.DepartingEmployee.Username
      description: The username of the Departing Employee.
      type: string
    - contextPath: Code42.DepartingEmployee.Note
      description: Note associated with the Departing Employee.
      type: string
    - contextPath: Code42.DepartingEmployee.DepartureDate
      description: The departure date for the Departing Employee.
      type: Unknown
  - arguments:
    - default: false
      description: The username to remove from the Departing Employee List.
      isArray: false
      name: username
      required: false
      secret: false
    deprecated: false
    description: Removes a user from the Departing Employee List.
    execution: false
    name: code42-departingemployee-remove
    outputs:
    - contextPath: Code42.DepartingEmployee.CaseID
      description: Internal Code42 Case ID for the Departing Employee. Deprecated.
        Use Code42.DepartingEmployee.UserID.
      type: string
    - contextPath: Code42.DepartingEmployee.UserID
      description: Internal Code42 User ID for the Departing Employee.
      type: string
    - contextPath: Code42.DepartingEmployee.Username
      description: The username of the Departing Employee.
      type: string
  - arguments:
    - default: false
      description: The number of items to return.
      isArray: false
      name: results
      required: false
      secret: false
    deprecated: false
    description: Get all employees on the Departing Employee List.
    execution: false
    name: code42-departingemployee-get-all
    outputs:
    - contextPath: Code42.DepartingEmployee.UserID
      description: Internal Code42 User ID for the Departing Employee.
      type: string
    - contextPath: Code42.DepartingEmployee.Username
      description: The username of the Departing Employee.
      type: string
    - contextPath: Code42.DepartingEmployee.Note
      description: Note associated with the Departing Employee.
      type: string
    - contextPath: Code42.DepartingEmployee.DepartureDate
      description: The departure date for the Departing Employee.
      type: Unknown
  - arguments:
    - default: false
      description: The username to add to the High Risk Employee List.
      isArray: false
      name: username
      required: true
      secret: false
    - default: false
      description: Note to attach to the High Risk Employee.
      isArray: false
      name: note
      required: false
      secret: false
    deprecated: false
    description: Adds a user from the High Risk Employee List.
    execution: false
    name: code42-highriskemployee-add
    outputs:
    - contextPath: Code42.HighRiskEmployee.UserID
      description: Internal Code42 User ID for the High Risk Employee.
      type: string
    - contextPath: Code42.HighRiskEmployee.Username
      description: The username of the High Risk Employee.
      type: string
    - contextPath: Code42.HighRiskEmployee.Note
      description: Note associated with the High Risk Employee.
      type: string
  - arguments:
    - default: false
      description: The username to remove from the High Risk Employee List.
      isArray: false
      name: username
      required: true
      secret: false
    deprecated: false
    description: Removes a user from the High Risk Employee List.
    execution: false
    name: code42-highriskemployee-remove
    outputs:
    - contextPath: Code42.HighRiskEmployee.UserID
      description: Internal Code42 User ID for the High Risk Employee.
      type: Unknown
    - contextPath: Code42.HighRiskEmployee.Username
      description: The username of the High Risk Employee.
      type: Unknown
  - arguments:
    - default: false
      description: To filter results by employees who have these risk tags. Space
        delimited.
      isArray: false
      name: risktags
      required: false
      secret: false
    - default: false
      description: The number of items to return.
      isArray: false
      name: results
      required: false
      secret: false
    deprecated: false
    description: Get all employees on the High Risk Employee List.
    execution: false
    name: code42-highriskemployee-get-all
    outputs:
    - contextPath: Code42.HighRiskEmployee.UserID
      description: Internal Code42 User ID for the High Risk Employee.
      type: string
    - contextPath: Code42.HighRiskEmployee.Username
      description: The username of the High Risk Employee.
      type: string
    - contextPath: Code42.HighRiskEmployee.Note
      description: Note associated with the High Risk Employee.
      type: string
  - arguments:
    - default: false
      description: The username of the High Risk Employee.
      isArray: false
      name: username
      required: true
      secret: false
    - default: false
      description: Space-delimited risk tags to associate with the High Risk Employee.
      isArray: false
      name: risktags
      required: true
      secret: false
    deprecated: false
    description: Associates risk tags with the employee with the given username.
    execution: false
    name: code42-highriskemployee-add-risk-tags
    outputs:
    - contextPath: Code42.HighRiskEmployee.UserID
      description: Internal Code42 User ID for the Departing Employee.
      type: string
    - contextPath: Code42.HighRiskEmployee.Username
      description: The username of the High Risk Employee.
      type: string
    - contextPath: Code42.HighRiskEmployee.RiskTags
      description: Risk tags to associate with the High Risk Employee.
      type: Unknown
  - arguments:
    - default: false
      description: The username of the High Risk Employee.
      isArray: false
      name: username
      required: true
      secret: false
    - default: false
      description: Space-delimited risk tags to disassociate from the High Risk Employee.
      isArray: false
      name: risktags
      required: true
      secret: false
    deprecated: false
    description: Disassociates risk tags from the user with the given username.
    execution: false
    name: code42-highriskemployee-remove-risk-tags
    outputs:
    - contextPath: Code42.HighRiskEmployee.UserID
      description: Internal Code42 User ID for the Departing Employee.
      type: string
    - contextPath: Code42.HighRiskEmployee.Username
      description: The username of the High Risk Employee.
      type: string
    - contextPath: Code42.HighRiskEmployee.RiskTags
      description: Risk tags to disassociate from the High Risk Employee.
      type: Unknown
  - arguments:
    - default: false
      description: The name of the Code42 organization from which to add the user.
      isArray: false
      name: orgname
      required: true
      secret: false
    - default: false
      description: The username to give to the user.
      isArray: false
      name: username
      required: true
      secret: false
    - default: false
      defaultValue: The email to give to the user.
      description: The email of the employee to create.
      isArray: false
      name: email
      required: true
      secret: false
    deprecated: false
    description: Creates a Code42 user.
    execution: false
    name: code42-user-create
    outputs:
    - contextPath: Code42.User.Username
      description: A username for a Code42 user.
      type: String
    - contextPath: Code42.User.Email
      description: An email for a Code42 user.
      type: String
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - default: false
      description: The username of the user to block.
      isArray: false
      name: username
      required: true
      secret: false
    deprecated: false
    description: Blocks a user in Code42.  A blocked user is not allowed to log in
      or restore files. Backups will continue if the user is still active.
    execution: false
    name: code42-user-block
    outputs:
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - default: false
      description: The username of the user to deactivate.
      isArray: false
      name: username
      required: true
      secret: false
    deprecated: false
    description: Deactivate a user in Code42; signing them out of their devices. Backups
      discontinue for a deactivated user, and their archives go to cold storage.
    execution: false
    name: code42-user-deactivate
    outputs:
    - contextPath: Code42.User.UserID
      description: The ID of a Code42 User.
      type: String
  - arguments:
    - default: false
      description: The username of the user to unblock.
      isArray: false
      name: username
      required: true
      secret: false
    deprecated: false
    description: Removes a block, if one exists, on the user with the given user ID.
      Unblocked users are allowed to log in and restore.
    execution: false
    name: code42-user-unblock
    outputs:
    - contextPath: Code42.User.UserID
      description: An ID for a Code42 user.
      type: String
  - arguments:
    - default: false
      description: The username of the user to reactivate.
      isArray: false
      name: username
      required: true
      secret: false
    deprecated: false
    description: Reactivates the user with the given username.
    execution: false
    name: code42-user-reactivate
    outputs:
    - contextPath: Code42.User.UserID
      description: The ID of a Code42 User.
      type: String
  - arguments:
    - default: false
      description: Either the SHA256 or MD5 hash of the file.
      isArray: false
      name: hash
      required: true
      secret: false
    deprecated: false
    description: Downloads a file from Code42 servers.
    execution: false
    name: code42-download-file
  dockerimage: demisto/py42:1.0.0.9653
  feed: false
  isfetch: true
  longRunning: false
  longRunningPort: false
  runonce: false
  script: '-'
  subtype: python3
  type: python