feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/cortex-xdr/scripts/abort_scan.py

@@ -0,0 +1,69 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filters = []
+    if inputs.get("endpoint_id_list"):
+        filters.append({"field": "endpoint_id_list", "operator": "in", "value": csv(inputs["endpoint_id_list"])})
+    rd = {"filters": filters if filters else "all"}
+    if inputs.get("incident_id"):
+        rd["incident_id"] = inputs["incident_id"]
+    print(json.dumps(post("/endpoints/abort_scan/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/add_exclusion.py

@@ -0,0 +1,64 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    rd = {"indicator": json.loads(inputs.get("indicator") or "{}"), "name": inputs.get("name"), "status": inputs.get("status") or "ENABLED"}
+    print(json.dumps(post("/alerts_exclusion/add/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/add_tag_endpoint.py

@@ -0,0 +1,65 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    eids = csv(inputs.get("endpoint_ids"))
+    body = {"context": {"lcaas_id": eids}, "request_data": {"filters": [{"field": "endpoint_id_list", "operator": "in", "value": eids}], "tag": inputs.get("tag")}}
+    print(json.dumps(post_raw("/tags/agents/assign/", body)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/audit_management_logs.py

@@ -0,0 +1,74 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filters = []
+    if inputs.get("email"):
+        filters.append({"field": "email", "operator": "in", "value": csv(inputs["email"])})
+    if inputs.get("type"):
+        filters.append({"field": "type", "operator": "in", "value": csv(inputs["type"])})
+    g = to_ms(inputs.get("timestamp_gte"))
+    if g is not None:
+        filters.append({"field": "timestamp", "operator": "gte", "value": g})
+    rd = {"search_from": 0, "search_to": int(inputs.get("limit") or 100)}
+    if filters:
+        rd["filters"] = filters
+    print(json.dumps(post("/audits/management_logs/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/create_distribution.py

@@ -0,0 +1,64 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    rd = {"name": inputs.get("name"), "platform": inputs.get("platform"), "package_type": inputs.get("package_type") or "standalone", "agent_version": inputs.get("agent_version"), "description": inputs.get("description") or ""}
+    print(json.dumps(post("/distributions/create/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/delete_endpoints.py

@@ -0,0 +1,64 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    rd = {"filters": [{"field": "endpoint_id_list", "operator": "in", "value": csv(inputs.get("endpoint_ids"))}]}
+    print(json.dumps(post("/endpoints/delete/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/delete_exclusion.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/alerts_exclusion/delete/", {"alert_exclusion_id": int(inputs.get("alert_exclusion_id"))})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_audit_agent_reports.py

@@ -0,0 +1,74 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filters = []
+    if inputs.get("endpoint_ids"):
+        filters.append({"field": "endpoint_id", "operator": "in", "value": csv(inputs["endpoint_ids"])})
+    if inputs.get("type"):
+        filters.append({"field": "type", "operator": "in", "value": csv(inputs["type"])})
+    g = to_ms(inputs.get("timestamp_gte"))
+    if g is not None:
+        filters.append({"field": "timestamp", "operator": "gte", "value": g})
+    rd = {"search_from": 0, "search_to": int(inputs.get("limit") or 100)}
+    if filters:
+        rd["filters"] = filters
+    print(json.dumps(post("/audits/agents_reports/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_device_control_violations.py

@@ -0,0 +1,71 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filters = []
+    if inputs.get("endpoint_ids"):
+        filters.append({"field": "endpoint_id_list", "operator": "in", "value": csv(inputs["endpoint_ids"])})
+    if inputs.get("type"):
+        filters.append({"field": "type", "operator": "in", "value": csv(inputs["type"])})
+    g = to_ms(inputs.get("timestamp_gte"))
+    if g is not None:
+        filters.append({"field": "timestamp", "operator": "gte", "value": g})
+    print(json.dumps(post("/device_control/get_violations/", {"filters": filters})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_distribution_status.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/distributions/get_status/", {"distribution_id": inputs.get("distribution_id")})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_distribution_url.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/distributions/get_dist_url/", {"distribution_id": inputs.get("distribution_id"), "package_type": inputs.get("package_type")})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_exclusion.py

@@ -0,0 +1,66 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    rd = {}
+    if inputs.get("tenant_id"):
+        rd["tenant_id"] = inputs["tenant_id"]
+    print(json.dumps(post("/alerts_exclusion/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_original_alerts.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/alerts/get_original_alerts/", {"alert_id_list": csv(inputs.get("alert_id_list"))})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_risk_score.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/get_risk_score/", {"id": inputs.get("id")})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_script_code.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/scripts/get_script_code/", {"script_uid": inputs.get("script_uid")})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_script_execution_status.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/scripts/get_script_execution_status/", {"action_id": inputs.get("action_id")})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/get_script_metadata.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/scripts/get_script_metadata/", {"script_uid": inputs.get("script_uid")})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/list_risky_hosts.py

@@ -0,0 +1,62 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    print(json.dumps(post("/get_risky_hosts/")))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/list_risky_users.py

@@ -0,0 +1,62 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    print(json.dumps(post("/get_risky_users/")))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/list_roles.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/rbac/get_roles/", {"role_names": csv(inputs.get("role_names"))})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/list_user_groups.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/rbac/get_user_group/", {"group_names": csv(inputs.get("group_names"))})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/list_users.py

@@ -0,0 +1,62 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    print(json.dumps(post("/rbac/get_users/", {})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/remove_tag_endpoint.py

@@ -0,0 +1,65 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    eids = csv(inputs.get("endpoint_ids"))
+    body = {"context": {"lcaas_id": eids}, "request_data": {"filters": [{"field": "endpoint_id_list", "operator": "in", "value": eids}], "tag": inputs.get("tag")}}
+    print(json.dumps(post_raw("/tags/agents/remove/", body)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/remove_user_role.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/rbac/set_user_role/", {"user_emails": csv(inputs.get("user_emails"))})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/retrieve_file.py

@@ -0,0 +1,74 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    eids = csv(inputs.get("endpoint_ids"))
+    files = {}
+    if inputs.get("windows"):
+        files["windows"] = csv(inputs["windows"])
+    if inputs.get("linux"):
+        files["linux"] = csv(inputs["linux"])
+    if inputs.get("macos"):
+        files["macos"] = csv(inputs["macos"])
+    rd = {"filters": [{"field": "endpoint_id_list", "operator": "in", "value": eids}], "files": files}
+    if inputs.get("incident_id"):
+        rd["incident_id"] = inputs["incident_id"]
+    print(json.dumps(post("/endpoints/file_retrieval/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/retrieve_file_details.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/actions/file_retrieval_details/", {"group_action_id": int(inputs.get("action_id"))})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/run_snippet_code_script.py

@@ -0,0 +1,66 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    rd = {"filters": [{"field": "endpoint_id_list", "operator": "in", "value": csv(inputs.get("endpoint_ids"))}], "snippet_code": inputs.get("snippet_code")}
+    if inputs.get("incident_id"):
+        rd["incident_id"] = inputs["incident_id"]
+    print(json.dumps(post("/scripts/run_snippet_code_script", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/set_endpoint_alias.py

@@ -0,0 +1,64 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    rd = {"filters": [{"field": "endpoint_id_list", "operator": "in", "value": csv(inputs.get("endpoint_ids"))}], "alias": inputs.get("alias")}
+    print(json.dumps(post("/endpoints/update_agent_name/", rd)))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/cortex-xdr/scripts/set_user_role.py

@@ -0,0 +1,63 @@
+import json, os, sys, time, hashlib, secrets, string, urllib.request, urllib.error
+
+
+def _client():
+    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+    base = s.get("url", "").rstrip("/") + "/public_api/v1"
+    key = s.get("api_key", "")
+    kid = str(s.get("api_key_id", ""))
+    headers = {"x-xdr-auth-id": kid, "Content-Type": "application/json", "Accept": "application/json"}
+    if str(s.get("auth_type") or "standard").lower() == "advanced":
+        nonce = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(64))
+        ts = str(int(time.time()) * 1000)
+        headers["x-xdr-nonce"] = nonce
+        headers["x-xdr-timestamp"] = ts
+        headers["Authorization"] = hashlib.sha256((key + nonce + ts).encode("utf-8")).hexdigest()
+    else:
+        headers["Authorization"] = key
+    return base, headers
+
+
+def post_raw(path, body):
+    base, headers = _client()
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    req = urllib.request.Request(base + path, data=data, headers=headers, method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def post(path, request_data=None):
+    return post_raw(path, {"request_data": request_data} if request_data is not None else None)
+
+
+def csv(v):
+    return [x.strip() for x in str(v or "").split(",") if x.strip()]
+
+
+def to_ms(v):
+    if v in (None, ""):
+        return None
+    s = str(v)
+    if s.isdigit():
+        return int(s)
+    try:
+        from datetime import datetime
+        return int(datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    print(json.dumps(post("/rbac/set_user_role/", {"user_emails": csv(inputs.get("user_emails")), "role_name": inputs.get("role_name")})))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)