@@ -6,33 +6,36 @@ description: A cheatsheet of all the secrets required by the UDFs and integratio
6
6
The secret keys required by each secret are listed below.
7
7
| Secret Name | Secret Keys |
8
8
| --- | --- |
9
- | ` wiz ` | ` WIZ_API_URL ` , ` WIZ_AUTH_URL ` , ` WIZ_CLIENT_ID ` , ` WIZ_CLIENT_SECRET ` |
10
- | ` elastic ` | ` ELASTIC_API_KEY ` , ` ELASTIC_API_URL ` |
11
- | ` microsoft_defender_cloud ` | ` MICROSOFT_GRAPH_CLIENT_ID ` , ` MICROSOFT_GRAPH_CLIENT_SECRET ` , ` MICROSOFT_GRAPH_TENANT_ID ` |
12
- | ` datadog ` | ` DD_API_KEY ` , ` DD_APP_KEY ` , ` DD_REGION ` |
13
9
| ` aws_guardduty ` | ` AWS_ACCESS_KEY_ID ` , ` AWS_REGION ` , ` AWS_SECRET_ACCESS_KEY ` |
14
- | ` sentinel_one ` | ` SENTINEL_ONE_API_TOKEN ` , ` SENTINEL_ONE_BASE_URL ` |
15
10
| ` microsoft_defender_endpoint ` | ` MICROSOFT_GRAPH_CLIENT_ID ` , ` MICROSOFT_GRAPH_CLIENT_SECRET ` , ` MICROSOFT_GRAPH_TENANT_ID ` |
11
+ | ` okta ` | ` OKTA_API_TOKEN ` , ` OKTA_BASE_URL ` |
16
12
| ` crowdstrike ` | ` CROWDSTRIKE_CLIENT_ID ` , ` CROWDSTRIKE_CLIENT_SECRET ` |
17
- | ` virustotal ` | ` VIRUSTOTAL_API_KEY ` |
13
+ | ` slack ` | ` SLACK_BOT_TOKEN ` |
14
+ | ` microsoft_defender_cloud ` | ` MICROSOFT_GRAPH_CLIENT_ID ` , ` MICROSOFT_GRAPH_CLIENT_SECRET ` , ` MICROSOFT_GRAPH_TENANT_ID ` |
15
+ | ` datadog ` | ` DD_API_KEY ` , ` DD_APP_KEY ` , ` DD_REGION ` |
18
16
| ` resend_api_key ` | ` RESEND_API_KEY ` |
19
17
| ` openai ` | ` OPENAI_API_KEY ` |
20
- | ` slack_chatops ` | ` SLACK_BOT_TOKEN ` |
18
+ | ` virustotal ` | ` VIRUSTOTAL_API_KEY ` |
19
+ | ` sentinel_one ` | ` SENTINEL_ONE_API_TOKEN ` , ` SENTINEL_ONE_BASE_URL ` |
20
+ | ` wiz ` | ` WIZ_API_URL ` , ` WIZ_AUTH_URL ` , ` WIZ_CLIENT_ID ` , ` WIZ_CLIENT_SECRET ` |
21
+ | ` elastic ` | ` ELASTIC_API_KEY ` , ` ELASTIC_API_URL ` |
22
+ | ` ldap ` | ` LDAP_BIND_DN ` , ` LDAP_BIND_PASS ` |
21
23
22
24
## Core Actions
23
25
Note that the fully qualified namespace for each Core Action UDF is prefixed with ` core. ` .
24
26
| Sub-namespace | Function | Secrets |
25
27
| --- | --- | --- |
26
- | extraction | extract_emails | - |
27
- | extraction | extract_ipv4_addresses | - |
28
+ | - | send_email_smtp | - |
28
29
| - | open_case | - |
29
30
| condition | regex | - |
30
31
| condition | compare | - |
31
32
| condition | membership | - |
32
- | - | send_email | ` resend_api_key ` |
33
33
| - | http_request | - |
34
34
| - | ai_action | ` openai ` |
35
35
| transform | reshape | - |
36
+ | transform | filter | - |
37
+ | transform | build_reference_table | - |
38
+ | workflow | execute | - |
36
39
37
40
## Integrations
38
41
Note that the fully qualified namespace for each Integration UDF is prefixed with ` integrations. ` .
@@ -41,18 +44,43 @@ Note that the fully qualified namespace for each Integration UDF is prefixed wit
41
44
| aws.guardduty | list_guardduty_alerts | ` aws_guardduty ` |
42
45
| microsoft_defender | list_defender_cloud_alerts | ` microsoft_defender_cloud ` |
43
46
| wiz | list_wiz_alerts | ` wiz ` |
44
- | chat.slack | post_slack_message | ` slack_chatops ` |
45
- | chat.slack | list_slack_users | ` slack_chatops ` |
47
+ | chat.slack | post_slack_message | ` slack ` |
48
+ | chat.slack | list_slack_conversations | ` slack ` |
49
+ | chat.slack | list_slack_users | ` slack ` |
50
+ | chat.slack | tag_slack_users | ` slack ` |
46
51
| crowdstrike | list_crowdstrike_alerts | ` crowdstrike ` |
47
52
| crowdstrike | list_crowdstrike_detects | ` crowdstrike ` |
48
53
| crowdstrike | update_crowdstrike_alert_status | ` crowdstrike ` |
49
54
| crowdstrike | update_crowdstrike_detect_status | ` crowdstrike ` |
50
55
| microsoft_defender | list_defender_endpoint_alerts | ` microsoft_defender_endpoint ` |
51
56
| sentinel_one | list_sentinelone_alerts | ` sentinel_one ` |
52
57
| sentinel_one | update_sentinelone_alert_status | ` sentinel_one ` |
58
+ | sentinel_one | get_sentinelone_agents_by_username | ` sentinel_one ` |
59
+ | sentinel_one | get_sentinelone_agents_by_hostname | ` sentinel_one ` |
60
+ | sentinel_one | isolate_sentinelone_agent | ` sentinel_one ` |
61
+ | sentinel_one | unisolate_sentinelone_agent | ` sentinel_one ` |
62
+ | sentinel_one | get_sentinel_one_firewall_rule | ` sentinel_one ` |
63
+ | sentinel_one | update_sentinel_one_firewall_rule | ` sentinel_one ` |
64
+ | email.resend | send_email_resend | ` resend_api_key ` |
53
65
| virustotal | analyze_url | ` virustotal ` |
54
66
| virustotal | analyze_ip_address | ` virustotal ` |
55
67
| virustotal | analyze_malware_sample | ` virustotal ` |
68
+ | ldap | find_ldap_users | ` ldap ` |
69
+ | ldap | disable_ad_user | ` ldap ` |
70
+ | ldap | enable_ad_user | ` ldap ` |
71
+ | okta | find_okta_users | ` okta ` |
72
+ | okta | suspend_okta_user | ` okta ` |
73
+ | okta | unsuspend_okta_user | ` okta ` |
74
+ | okta | expire_okta_sessions | ` okta ` |
75
+ | okta | list_okta_user_events | ` okta ` |
56
76
| datadog | list_datadog_alerts | ` datadog ` |
57
77
| elastic | list_elastic_alerts | ` elastic ` |
58
78
| sinks | write_to_database | - |
79
+
80
+ ## ETL Actions
81
+ Note that the fully qualified namespace for each ETL UDF is prefixed with ` etl. ` .
82
+ | Sub-namespace | Function | Secrets |
83
+ | --- | --- | --- |
84
+ | extraction | extract_emails | - |
85
+ | extraction | extract_ipv4_addresses | - |
86
+ | extraction | extract_urls | - |
0 commit comments