From 9a69a60ffc35b683101cd284b753694772a29825 Mon Sep 17 00:00:00 2001
From: Juliya Smith <juliya.smith@code42.com>
Date: Mon, 5 Oct 2020 19:31:03 +0000
Subject: [PATCH 1/3] Rm using statements

---
 .../Code42/integration-Code42.yml             | 2257 +++++++++++++++++
 .../TestPlaybooks/playbook-Code42-Test.yml    |   10 -
 2 files changed, 2257 insertions(+), 10 deletions(-)
 create mode 100644 Packs/Code42/Integrations/Code42/integration-Code42.yml

diff --git a/Packs/Code42/Integrations/Code42/integration-Code42.yml b/Packs/Code42/Integrations/Code42/integration-Code42.yml
new file mode 100644
index 000000000000..c1c266d4cec4
--- /dev/null
+++ b/Packs/Code42/Integrations/Code42/integration-Code42.yml
@@ -0,0 +1,2257 @@
+category: Endpoint
+commonfields:
+  id: Code42
+  version: -1
+configuration:
+- defaultvalue: console.us.code42.com
+  display: Code42 Console URL for your Code42 environment
+  name: console_url
+  required: true
+  type: 0
+- display: Username
+  name: credentials
+  required: true
+  type: 9
+- display: Fetch incidents
+  name: isFetch
+  required: false
+  type: 8
+- display: Incident type
+  name: incidentType
+  required: false
+  type: 13
+- display: Alert severities to fetch when fetching incidents
+  name: alert_severity
+  options:
+  - High
+  - Medium
+  - Low
+  required: false
+  type: 16
+- defaultvalue: 24 hours
+  display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
+  name: fetch_time
+  required: false
+  type: 0
+- defaultvalue: '10'
+  display: Alerts to fetch per run; note that increasing this value may result in slow performance if too many results are returned at once
+  name: fetch_limit
+  required: false
+  type: 0
+- defaultvalue: 'false'
+  display: Include the list of files in returned incidents.
+  name: include_files
+  required: false
+  type: 8
+description: Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.
+display: Code42 (Partner Contribution)
+name: Code42
+script:
+  commands:
+  - arguments:
+    - default: false
+      description: JSON query payload using Code42 query syntax.
+      isArray: false
+      name: json
+      required: false
+      secret: false
+    - default: false
+      description: MD5 or SHA256 hash of the file to search for.
+      isArray: false
+      name: hash
+      required: false
+      secret: false
+    - default: false
+      description: Username to search for.
+      isArray: false
+      name: username
+      required: false
+      secret: false
+    - default: false
+      description: Hostname to search for.
+      isArray: false
+      name: hostname
+      required: false
+      secret: false
+    - auto: PREDEFINED
+      default: false
+      description: Exposure types to search for. Values can be "All", "RemovableMedia", "ApplicationRead", "CloudStorage", "IsPublic", "SharedViaLink", "SharedViaDomain", or "OutsideTrustedDomains". When "All" is specified with other types, other types would be ignored and filter rule for all types would be applied.
+      isArray: true
+      name: exposure
+      predefined:
+      - All
+      - RemovableMedia
+      - ApplicationRead
+      - CloudStorage
+      - IsPublic
+      - SharedViaLink
+      - SharedViaDomain
+      - OutsideTrustedDomains
+      required: false
+      secret: false
+    - default: false
+      defaultValue: '100'
+      description: The number of results to return. The default is 100.
+      isArray: false
+      name: results
+      required: false
+      secret: false
+    deprecated: false
+    description: Searches for file events by JSON query, hash, username, device hostname, exfiltration type, or a combination of parameters. At least one argument must be passed in the command. If a JSON argument is passed, it will be used to the exclusion of other parameters, otherwise parameters will be combined with an AND clause.
+    execution: false
+    name: code42-securitydata-search
+    outputs:
+    - contextPath: Code42.SecurityData.EventTimestamp
+      description: Timestamp for the event.
+      type: date
+    - contextPath: Code42.SecurityData.FileCreated
+      description: File creation date.
+      type: date
+    - contextPath: Code42.SecurityData.EndpointID
+      description: Code42 device ID.
+      type: string
+    - contextPath: Code42.SecurityData.DeviceUsername
+      description: The username that the device is associated with in Code42.
+      type: string
+    - contextPath: Code42.SecurityData.EmailFrom
+      description: The sender email address for email exfiltration events.
+      type: string
+    - contextPath: Code42.SecurityData.EmailTo
+      description: The recipient email address for email exfiltration events.
+      type: string
+    - contextPath: Code42.SecurityData.EmailSubject
+      description: The email subject line for email exfiltration events.
+      type: string
+    - contextPath: Code42.SecurityData.EventID
+      description: The Security Data event ID.
+      type: string
+    - contextPath: Code42.SecurityData.EventType
+      description: The type of Security Data event.
+      type: string
+    - contextPath: Code42.SecurityData.FileCategory
+      description: The file type, as determined by Code42 engine.
+      type: string
+    - contextPath: Code42.SecurityData.FileOwner
+      description: The owner of the file.
+      type: string
+    - contextPath: Code42.SecurityData.FileName
+      description: The file name.
+      type: string
+    - contextPath: Code42.SecurityData.FilePath
+      description: The path to file.
+      type: string
+    - contextPath: Code42.SecurityData.FileSize
+      description: The size of the file (in bytes).
+      type: number
+    - contextPath: Code42.SecurityData.FileModified
+      description: The date the file was last modified.
+      type: date
+    - contextPath: Code42.SecurityData.FileMD5
+      description: MD5 hash of the file.
+      type: string
+    - contextPath: Code42.SecurityData.FileHostname
+      description: Hostname where the file event was captured.
+      type: string
+    - contextPath: Code42.SecurityData.DevicePrivateIPAddress
+      description: Private IP addresses of the device where the event was captured.
+      type: string
+    - contextPath: Code42.SecurityData.DevicePublicIPAddress
+      description: Public IP address of the device where the event was captured.
+      type: string
+    - contextPath: Code42.SecurityData.RemovableMediaType
+      description: Type of removable media.
+      type: string
+    - contextPath: Code42.SecurityData.RemovableMediaCapacity
+      description: Total capacity of removable media (in bytes).
+      type: number
+    - contextPath: Code42.SecurityData.RemovableMediaMediaName
+      description: The full name of the removable media.
+      type: string
+    - contextPath: Code42.SecurityData.RemovableMediaName
+      description: The name of the removable media.
+      type: string
+    - contextPath: Code42.SecurityData.RemovableMediaSerialNumber
+      description: The serial number for the removable medial device.
+      type: string
+    - contextPath: Code42.SecurityData.RemovableMediaVendor
+      description: The vendor name for removable device.
+      type: string
+    - contextPath: Code42.SecurityData.FileSHA256
+      description: The SHA256 hash of the file.
+      type: string
+    - contextPath: Code42.SecurityData.FileShared
+      description: Whether the file is shared using a cloud file service.
+      type: boolean
+    - contextPath: Code42.SecurityData.FileSharedWith
+      description: Accounts that the file is shared with on a cloud file service.
+      type: string
+    - contextPath: Code42.SecurityData.Source
+      description: The source of the file event. Can be "Cloud" or "Endpoint".
+      type: string
+    - contextPath: Code42.SecurityData.ApplicationTabURL
+      description: The URL associated with the application read event.
+      type: string
+    - contextPath: Code42.SecurityData.ProcessName
+      description: The process name for the application read event.
+      type: string
+    - contextPath: Code42.SecurityData.ProcessOwner
+      description: The process owner for the application read event.
+      type: string
+    - contextPath: Code42.SecurityData.WindowTitle
+      description: The process name for the application read event.
+      type: string
+    - contextPath: Code42.SecurityData.FileURL
+      description: The URL of the file on a cloud file service.
+      type: string
+    - contextPath: Code42.SecurityData.Exposure
+      description: The event exposure type.
+      type: string
+    - contextPath: Code42.SecurityData.SharingTypeAdded
+      description: The type of sharing added to the file.
+      type: string
+    - contextPath: File.Name
+      description: The file name.
+      type: string
+    - contextPath: File.Path
+      description: The file path.
+      type: string
+    - contextPath: File.Size
+      description: The file size (in bytes).
+      type: number
+    - contextPath: File.MD5
+      description: The MD5 hash of the file.
+      type: string
+    - contextPath: File.SHA256
+      description: The SHA256 hash of the file.
+      type: string
+    - contextPath: File.Hostname
+      description: The hostname where the file event was captured.
+      type: string
+  - arguments:
+    - default: false
+      description: The alert ID to retrieve. Alert IDs are associated with alerts that are fetched via fetch-incidents.
+      isArray: false
+      name: id
+      required: true
+      secret: false
+    deprecated: false
+    description: Retrieve alert details by alert ID
+    execution: false
+    name: code42-alert-get
+    outputs:
+    - contextPath: Code42.SecurityAlert.Username
+      description: The username associated with the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.Occurred
+      description: The timestamp when the alert occurred.
+      type: date
+    - contextPath: Code42.SecurityAlert.Description
+      description: The description of the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.ID
+      description: The alert ID.
+      type: string
+    - contextPath: Code42.SecurityAlert.Name
+      description: The alert rule name that generated the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.State
+      description: The alert state.
+      type: string
+    - contextPath: Code42.SecurityAlert.Type
+      description: The alert type.
+      type: string
+    - contextPath: Code42.SecurityAlert.Severity
+      description: The severity of the alert.
+      type: string
+  - arguments:
+    - default: false
+      description: The alert ID to resolve. Alert IDs are associated with alerts that are fetched via fetch-incidents.
+      isArray: false
+      name: id
+      required: true
+      secret: false
+    deprecated: false
+    description: Resolves a Code42 Security alert.
+    execution: false
+    name: code42-alert-resolve
+    outputs:
+    - contextPath: Code42.SecurityAlert.ID
+      description: The alert ID of the resolved alert.
+      type: string
+  - arguments:
+    - default: false
+      description: The username to add to the Departing Employee List.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    - default: false
+      description: The departure date for the employee, in the format YYYY-MM-DD.
+      isArray: false
+      name: departuredate
+      required: false
+      secret: false
+    - default: false
+      description: Note to attach to the Departing Employee.
+      isArray: false
+      name: note
+      required: false
+      secret: false
+    deprecated: false
+    description: Adds a user to the Departing Employee List.
+    execution: false
+    name: code42-departingemployee-add
+    outputs:
+    - contextPath: Code42.DepartingEmployee.CaseID
+      description: Internal Code42 Case ID for the Departing Employee. Deprecated. Use Code42.DepartingEmployee.UserID.
+      type: string
+    - contextPath: Code42.DepartingEmployee.UserID
+      description: Internal Code42 User ID for the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.Username
+      description: The username of the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.Note
+      description: Note associated with the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.DepartureDate
+      description: The departure date for the Departing Employee.
+      type: Unknown
+  - arguments:
+    - default: false
+      description: The username to remove from the Departing Employee List.
+      isArray: false
+      name: username
+      required: false
+      secret: false
+    deprecated: false
+    description: Removes a user from the Departing Employee List.
+    execution: false
+    name: code42-departingemployee-remove
+    outputs:
+    - contextPath: Code42.DepartingEmployee.CaseID
+      description: Internal Code42 Case ID for the Departing Employee. Deprecated. Use Code42.DepartingEmployee.UserID.
+      type: string
+    - contextPath: Code42.DepartingEmployee.UserID
+      description: Internal Code42 User ID for the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.Username
+      description: The username of the Departing Employee.
+      type: string
+  - arguments:
+    - default: false
+      description: The number of items to return.
+      isArray: false
+      name: results
+      required: false
+      secret: false
+    - auto: PREDEFINED
+      default: true
+      defaultValue: OPEN
+      description: Filters the results based on specific filters.
+      isArray: false
+      name: filtertype
+      predefined:
+      - EXFILTRATION_30_DAYS
+      - EXFILTRATION_24_HOURS
+      - OPEN
+      - LEAVING_TODAY
+      required: false
+      secret: false
+    deprecated: false
+    description: Get all employees on the Departing Employee List.
+    execution: false
+    name: code42-departingemployee-get-all
+    outputs:
+    - contextPath: Code42.DepartingEmployee.UserID
+      description: Internal Code42 User ID for the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.Username
+      description: The username of the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.Note
+      description: Note associated with the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.DepartureDate
+      description: The departure date for the Departing Employee.
+      type: Unknown
+  - arguments:
+    - default: false
+      description: The username to add to the High Risk Employee List.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    - default: false
+      description: Note to attach to the High Risk Employee.
+      isArray: false
+      name: note
+      required: false
+      secret: false
+    deprecated: false
+    description: Adds a user from the High Risk Employee List.
+    execution: false
+    name: code42-highriskemployee-add
+    outputs:
+    - contextPath: Code42.HighRiskEmployee.UserID
+      description: Internal Code42 User ID for the High Risk Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.Username
+      description: The username of the High Risk Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.Note
+      description: Note associated with the High Risk Employee.
+      type: string
+  - arguments:
+    - default: false
+      description: The username to remove from the High Risk Employee List.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    deprecated: false
+    description: Removes a user from the High Risk Employee List.
+    execution: false
+    name: code42-highriskemployee-remove
+    outputs:
+    - contextPath: Code42.HighRiskEmployee.UserID
+      description: Internal Code42 User ID for the High Risk Employee.
+      type: Unknown
+    - contextPath: Code42.HighRiskEmployee.Username
+      description: The username of the High Risk Employee.
+      type: Unknown
+  - arguments:
+    - auto: PREDEFINED
+      default: false
+      description: To filter results by employees who have these risk tags. Comma delimited.
+      isArray: false
+      name: risktags
+      predefined:
+      - PERFORMANCE_CONCERNS
+      - PERFORMANCE_CONCERNS
+      - POOR_SECURITY_PRACTICES
+      - HIGH_IMPACT_EMPLOYEE
+      - ELEVATED_ACCESS_PRIVILEGES
+      - FLIGHT_RISK
+      - CONTRACT_EMPLOYEE
+      required: false
+      secret: false
+    - default: false
+      description: The number of items to return.
+      isArray: false
+      name: results
+      required: false
+      secret: false
+    - auto: PREDEFINED
+      default: true
+      defaultValue: OPEN
+      description: Filters the results based on specific filters.
+      isArray: false
+      name: filtertype
+      predefined:
+      - EXFILTRATION_30_DAYS
+      - EXFILTRATION_24_HOURS
+      - OPEN
+      required: false
+      secret: false
+    deprecated: false
+    description: Get all employees on the High Risk Employee List.
+    execution: false
+    name: code42-highriskemployee-get-all
+    outputs:
+    - contextPath: Code42.HighRiskEmployee.UserID
+      description: Internal Code42 User ID for the High Risk Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.Username
+      description: The username of the High Risk Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.Note
+      description: Note associated with the High Risk Employee.
+      type: string
+  - arguments:
+    - default: false
+      description: The username of the High Risk Employee.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    - auto: PREDEFINED
+      default: false
+      description: Comma-delimited risk tags to associate with the High Risk Employee.
+      isArray: false
+      name: risktags
+      predefined:
+      - PERFORMANCE_CONCERNS
+      - PERFORMANCE_CONCERNS
+      - POOR_SECURITY_PRACTICES
+      - HIGH_IMPACT_EMPLOYEE
+      - ELEVATED_ACCESS_PRIVILEGES
+      - FLIGHT_RISK
+      - CONTRACT_EMPLOYEE
+      required: true
+      secret: false
+    deprecated: false
+    description: Associates risk tags with the employee with the given username.
+    execution: false
+    name: code42-highriskemployee-add-risk-tags
+    outputs:
+    - contextPath: Code42.HighRiskEmployee.UserID
+      description: Internal Code42 User ID for the Departing Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.Username
+      description: The username of the High Risk Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.RiskTags
+      description: Risk tags to associate with the High Risk Employee.
+      type: Unknown
+  - arguments:
+    - default: false
+      description: The username of the High Risk Employee.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    - auto: PREDEFINED
+      default: false
+      description: Comma-delimited risk tags to disassociate from the High Risk Employee.
+      isArray: false
+      name: risktags
+      predefined:
+      - PERFORMANCE_CONCERNS
+      - PERFORMANCE_CONCERNS
+      - POOR_SECURITY_PRACTICES
+      - HIGH_IMPACT_EMPLOYEE
+      - ELEVATED_ACCESS_PRIVILEGES
+      - FLIGHT_RISK
+      - CONTRACT_EMPLOYEE
+      required: true
+      secret: false
+    deprecated: false
+    description: Disassociates risk tags from the user with the given username.
+    execution: false
+    name: code42-highriskemployee-remove-risk-tags
+    outputs:
+    - contextPath: Code42.HighRiskEmployee.UserID
+      description: Internal Code42 User ID for the Departing Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.Username
+      description: The username of the High Risk Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.RiskTags
+      description: Risk tags to disassociate from the High Risk Employee.
+      type: Unknown
+  - arguments:
+    - default: false
+      description: The name of the Code42 organization from which to add the user.
+      isArray: false
+      name: orgname
+      required: true
+      secret: false
+    - default: false
+      description: The username to give to the user.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    - default: false
+      defaultValue: The email to give to the user.
+      description: The email of the user to create.
+      isArray: false
+      name: email
+      required: true
+      secret: false
+    deprecated: false
+    description: Creates a Code42 user.
+    execution: false
+    name: code42-user-create
+    outputs:
+    - contextPath: Code42.User.Username
+      description: A username for a Code42 user.
+      type: String
+    - contextPath: Code42.User.Email
+      description: An email for a Code42 user.
+      type: String
+    - contextPath: Code42.User.UserID
+      description: An ID for a Code42 user.
+      type: String
+  - arguments:
+    - default: false
+      description: The username of the user to block.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    deprecated: false
+    description: Blocks a user in Code42.  A blocked user is not allowed to log in or restore files. Backups will continue if the user is still active.
+    execution: false
+    name: code42-user-block
+    outputs:
+    - contextPath: Code42.User.UserID
+      description: An ID for a Code42 user.
+      type: String
+  - arguments:
+    - default: false
+      description: The username of the user to deactivate.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    deprecated: false
+    description: Deactivate a user in Code42; signing them out of their devices. Backups discontinue for a deactivated user, and their archives go to cold storage.
+    execution: false
+    name: code42-user-deactivate
+    outputs:
+    - contextPath: Code42.User.UserID
+      description: The ID of a Code42 User.
+      type: String
+  - arguments:
+    - default: false
+      description: The username of the user to unblock.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    deprecated: false
+    description: Removes a block, if one exists, on the user with the given user ID. Unblocked users are allowed to log in and restore.
+    execution: false
+    name: code42-user-unblock
+    outputs:
+    - contextPath: Code42.User.UserID
+      description: An ID for a Code42 user.
+      type: String
+  - arguments:
+    - default: false
+      description: The username of the user to reactivate.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    deprecated: false
+    description: Reactivates the user with the given username.
+    execution: false
+    name: code42-user-reactivate
+    outputs:
+    - contextPath: Code42.User.UserID
+      description: The ID of a Code42 User.
+      type: String
+  - arguments:
+    - default: false
+      description: The username of the user to add to the given legal hold matter.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    - default: false
+      description: The name of the legal hold matter to which the user will be added.
+      isArray: false
+      name: mattername
+      required: true
+      secret: false
+    deprecated: false
+    description: Adds a Code42 user to a legal hold matter.
+    execution: false
+    name: code42-legalhold-add-user
+    outputs:
+    - contextPath: Code42.LegalHold.UserID
+      description: The ID of a Code42 user.
+      type: Unknown
+    - contextPath: Code42.LegalHold.MatterID
+      description: The ID of a Code42 legal hold matter.
+      type: String
+    - contextPath: Code42.LegalHold.Username
+      description: A username for a Code42 user.
+      type: String
+    - contextPath: Code42.LegalHold.MatterName
+      description: A name for a Code42 legal hold matter.
+      type: String
+  - arguments:
+    - default: false
+      description: The username of the user to release from the given legal hold matter.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    - default: false
+      description: The name of the legal hold matter from which the user will be released.
+      isArray: false
+      name: mattername
+      required: true
+      secret: false
+    deprecated: false
+    description: Removes a Code42 user from a legal hold matter.
+    execution: false
+    name: code42-legalhold-remove-user
+    outputs:
+    - contextPath: Code42.LegalHold.UserID
+      description: The ID of a Code42 user.
+      type: Unknown
+    - contextPath: Code42.LegalHold.MatterID
+      description: The ID of a Code42 legal hold matter.
+      type: String
+    - contextPath: Code42.LegalHold.Username
+      description: A username for a Code42 user.
+      type: String
+    - contextPath: Code42.LegalHold.MatterName
+      description: A name for a Code42 legal hold matter.
+      type: String
+  - arguments:
+    - default: false
+      description: Either the SHA256 or MD5 hash of the file.
+      isArray: false
+      name: hash
+      required: true
+      secret: false
+    - default: false
+      description: The filename to save the file as.
+      isArray: false
+      name: filename
+      required: false
+      secret: false
+    deprecated: false
+    description: Downloads a file from Code42.
+    execution: false
+    name: code42-download-file
+    outputs:
+    - contextPath: File.Size
+      description: The size of the file.
+      type: Number
+    - contextPath: File.SHA1
+      description: The SHA1 hash of the file.
+      type: String
+    - contextPath: File.SHA256
+      description: The SHA256 hash of the file.
+      type: String
+    - contextPath: File.Name
+      description: The name of the file.
+      type: String
+    - contextPath: File.SSDeep
+      description: The SSDeep hash of the file.
+      type: String
+    - contextPath: File.EntryID
+      description: The entry ID of the file.
+      type: String
+    - contextPath: File.Info
+      description: File information.
+      type: String
+    - contextPath: File.Type
+      description: The file type.
+      type: String
+    - contextPath: File.MD5
+      description: The MD5 hash of the file.
+      type: String
+    - contextPath: File.Extension
+      description: The file extension.
+      type: String
+  - arguments:
+    - default: false
+      description: Email id of the user.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    deprecated: false
+    description: Retrieve high risk employee details.
+    execution: false
+    name: code42-highriskemployee-get
+    outputs:
+    - contextPath: Code42.HighRiskEmployee.UserID
+      description: Internal Code42 User ID for the High Risk Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.Username
+      description: The username of the High Risk Employee.
+      type: string
+    - contextPath: Code42.HighRiskEmployee.Note
+      description: Note associated with the High Risk Employee.
+      type: string
+  - arguments:
+    - default: false
+      description: Email id of the departing employee.
+      isArray: false
+      name: username
+      required: true
+      secret: false
+    deprecated: false
+    description: Retrieve departing employee details.
+    execution: false
+    name: code42-departingemployee-get
+    outputs:
+    - contextPath: Code42.DepartingEmployee.UserID
+      description: Internal Code42 User ID for the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.Username
+      description: The username of the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.Note
+      description: Note associated with the Departing Employee.
+      type: string
+    - contextPath: Code42.DepartingEmployee.DepartureDate
+      description: The departure date for the Departing Employee.
+      type: Unknown
+  dockerimage: demisto/py42:1.0.0.11140
+  feed: false
+  isfetch: true
+  longRunning: false
+  longRunningPort: false
+  runonce: false
+  script: >2
+
+
+
+    """ IMPORTS """
+
+    import json
+
+    import os
+
+    import requests
+
+    import py42.sdk
+
+    import py42.settings
+
+    from datetime import datetime
+
+    from py42.services.detectionlists.departing_employee import DepartingEmployeeFilters
+
+    from py42.services.detectionlists.high_risk_employee import HighRiskEmployeeFilters
+
+    from py42.sdk.queries.fileevents.file_event_query import FileEventQuery
+
+    from py42.sdk.queries.fileevents.filters import (
+        MD5,
+        SHA256,
+        Actor,
+        EventTimestamp,
+        OSHostname,
+        DeviceUsername,
+        ExposureType,
+        EventType,
+        FileCategory,
+    )
+
+    from py42.sdk.queries.alerts.alert_query import AlertQuery
+
+    from py42.sdk.queries.alerts.filters import DateObserved, Severity, AlertState
+
+
+    # Disable insecure warnings
+
+    requests.packages.urllib3.disable_warnings()
+
+
+    """ CONSTANTS """
+
+    CODE42_EVENT_CONTEXT_FIELD_MAPPER = {
+        "eventTimestamp": "EventTimestamp",
+        "createTimestamp": "FileCreated",
+        "deviceUid": "EndpointID",
+        "deviceUserName": "DeviceUsername",
+        "emailFrom": "EmailFrom",
+        "emailRecipients": "EmailTo",
+        "emailSubject": "EmailSubject",
+        "eventId": "EventID",
+        "eventType": "EventType",
+        "fileCategory": "FileCategory",
+        "fileOwner": "FileOwner",
+        "fileName": "FileName",
+        "filePath": "FilePath",
+        "fileSize": "FileSize",
+        "modifyTimestamp": "FileModified",
+        "md5Checksum": "FileMD5",
+        "osHostName": "FileHostname",
+        "privateIpAddresses": "DevicePrivateIPAddress",
+        "publicIpAddresses": "DevicePublicIPAddress",
+        "removableMediaBusType": "RemovableMediaType",
+        "removableMediaCapacity": "RemovableMediaCapacity",
+        "removableMediaMediaName": "RemovableMediaMediaName",
+        "removableMediaName": "RemovableMediaName",
+        "removableMediaSerialNumber": "RemovableMediaSerialNumber",
+        "removableMediaVendor": "RemovableMediaVendor",
+        "sha256Checksum": "FileSHA256",
+        "shared": "FileShared",
+        "sharedWith": "FileSharedWith",
+        "source": "Source",
+        "tabUrl": "ApplicationTabURL",
+        "url": "FileURL",
+        "processName": "ProcessName",
+        "processOwner": "ProcessOwner",
+        "windowTitle": "WindowTitle",
+        "exposure": "Exposure",
+        "sharingTypeAdded": "SharingTypeAdded",
+    }
+
+
+    CODE42_ALERT_CONTEXT_FIELD_MAPPER = {
+        "actor": "Username",
+        "createdAt": "Occurred",
+        "description": "Description",
+        "id": "ID",
+        "name": "Name",
+        "state": "State",
+        "type": "Type",
+        "severity": "Severity",
+    }
+
+
+    FILE_CONTEXT_FIELD_MAPPER = {
+        "fileName": "Name",
+        "filePath": "Path",
+        "fileSize": "Size",
+        "md5Checksum": "MD5",
+        "sha256Checksum": "SHA256",
+        "osHostName": "Hostname",
+    }
+
+
+    SECURITY_EVENT_HEADERS = [
+        "EventType",
+        "FileName",
+        "FileSize",
+        "FileHostname",
+        "FileOwner",
+        "FileCategory",
+        "DeviceUsername",
+    ]
+
+
+    SECURITY_ALERT_HEADERS = ["Type", "Occurred", "Username", "Name", "Description", "State", "ID"]
+
+
+
+    def _get_severity_filter_value(severity_arg):
+        """Converts single str to upper case. If given list of strs, converts all to upper case."""
+        if severity_arg:
+            return (
+                [severity_arg.upper()]
+                if isinstance(severity_arg, str)
+                else list(map(lambda x: x.upper(), severity_arg))
+            )
+
+
+    def _create_alert_query(event_severity_filter, start_time):
+        """Creates an alert query for the given severity (or severities) and start time."""
+        alert_filters = AlertQueryFilters()
+        severity = event_severity_filter
+        alert_filters.append_result(_get_severity_filter_value(severity), Severity.is_in)
+        alert_filters.append(AlertState.eq(AlertState.OPEN))
+        alert_filters.append_result(start_time, DateObserved.on_or_after)
+        alert_query = alert_filters.to_all_query()
+        return alert_query
+
+
+    def _get_all_high_risk_employees_from_page(page, risk_tags):
+        res = []
+        employees = page.get("items") or []
+        for employee in employees:
+            if not risk_tags:
+                res.append(employee)
+                continue
+
+            employee_tags = employee.get("riskFactors")
+            # If the employee risk tags contain all the given risk tags
+            if employee_tags and set(risk_tags) <= set(employee_tags):
+                res.append(employee)
+        return res
+
+
+    class Code42Client(BaseClient):
+        """
+        Client will implement the service API, should not contain Cortex XSOAR logic.
+        Should do requests and return data
+        """
+
+        def __init__(self, sdk, base_url, auth, verify=True, proxy=False):
+            super().__init__(base_url, verify=verify, proxy=proxy)
+            # Allow sdk parameter for unit testing.
+            # Otherwise, lazily load the SDK so that the TEST Command can effectively check auth.
+            self._sdk = sdk
+            self._sdk_factory = (
+                lambda: py42.sdk.from_local_account(base_url, auth[0], auth[1])
+                if not self._sdk
+                else None
+            )
+
+            if not proxy:
+                _clear_env_var_if_exists('HTTP_PROXY')
+                _clear_env_var_if_exists('HTTPS_PROXY')
+                _clear_env_var_if_exists('http_proxy')
+                _clear_env_var_if_exists('https_proxy')
+
+            py42.settings.set_user_agent_suffix("Cortex XSOAR")
+            py42.settings.verify_ssl_certs = verify
+
+        def _get_sdk(self):
+            if self._sdk is None:
+                self._sdk = self._sdk_factory()
+            return self._sdk
+
+        def add_user_to_departing_employee(self, username, departure_date=None, note=None):
+            user_id = self._get_user_id(username)
+            self._get_sdk().detectionlists.departing_employee.add(
+                user_id, departure_date=departure_date
+            )
+            if note:
+                self._get_sdk().detectionlists.update_user_notes(user_id, note)
+            return user_id
+
+        def remove_user_from_departing_employee(self, username):
+            user_id = self._get_user_id(username)
+            self._get_sdk().detectionlists.departing_employee.remove(user_id)
+            return user_id
+
+        def get_all_departing_employees(self, results, filter_type):
+            res = []
+            results = int(results) if results else 50
+            filter_type = filter_type if filter_type else DepartingEmployeeFilters.OPEN
+            pages = self._get_sdk().detectionlists.departing_employee.get_all(filter_type=filter_type)
+            for page in pages:
+                page_json = json.loads(page.text)
+                employees = page_json.get("items") or []
+                for employee in employees:
+                    res.append(employee)
+                    if results and len(res) == results:
+                        return res
+            return res
+
+        def add_user_to_high_risk_employee(self, username, note=None):
+            user_id = self._get_user_id(username)
+            self._get_sdk().detectionlists.high_risk_employee.add(user_id)
+            if note:
+                self._get_sdk().detectionlists.update_user_notes(user_id, note)
+            return user_id
+
+        def remove_user_from_high_risk_employee(self, username):
+            user_id = self._get_user_id(username)
+            self._get_sdk().detectionlists.high_risk_employee.remove(user_id)
+            return user_id
+
+        def add_user_risk_tags(self, username, risk_tags):
+            risk_tags = argToList(risk_tags)
+            user_id = self._get_user_id(username)
+            self._get_sdk().detectionlists.add_user_risk_tags(user_id, risk_tags)
+            return user_id
+
+        def remove_user_risk_tags(self, username, risk_tags):
+            risk_tags = argToList(risk_tags)
+            user_id = self._get_user_id(username)
+            self._get_sdk().detectionlists.remove_user_risk_tags(user_id, risk_tags)
+            return user_id
+
+        def get_all_high_risk_employees(self, risk_tags, results, filter_type):
+            risk_tags = argToList(risk_tags)
+            results = int(results) if results else 50
+            filter_type = filter_type if filter_type else HighRiskEmployeeFilters.OPEN
+            res = []
+            pages = self._get_sdk().detectionlists.high_risk_employee.get_all(filter_type=filter_type)
+            for page in pages:
+                page_json = json.loads(page.text)
+                employees = _get_all_high_risk_employees_from_page(page_json, risk_tags)
+                for employee in employees:
+                    res.append(employee)
+                    if results and len(res) == results:
+                        return res
+            return res
+
+        def fetch_alerts(self, start_time, event_severity_filter):
+            query = _create_alert_query(event_severity_filter, start_time)
+            res = self._get_sdk().alerts.search(query)
+            return json.loads(res.text).get("alerts")
+
+        def get_alert_details(self, alert_id):
+            py42_res = self._get_sdk().alerts.get_details(alert_id)
+            res = json.loads(py42_res.text).get("alerts")
+            if not res:
+                raise Code42AlertNotFoundError(alert_id)
+            return res[0]
+
+        def resolve_alert(self, id):
+            self._get_sdk().alerts.resolve(id)
+            return id
+
+        def get_current_user(self):
+            res = self._get_sdk().users.get_current()
+            return res
+
+        def get_user(self, username):
+            py42_res = self._get_sdk().users.get_by_username(username)
+            res = json.loads(py42_res.text).get("users")
+            if not res:
+                raise Code42UserNotFoundError(username)
+            return res[0]
+
+        def create_user(self, org_name, username, email):
+            org_uid = self._get_org_id(org_name)
+            response = self._get_sdk().users.create_user(org_uid, username, email)
+            return json.loads(response.text)
+
+        def block_user(self, username):
+            user_id = self._get_legacy_user_id(username)
+            self._get_sdk().users.block(user_id)
+            return user_id
+
+        def unblock_user(self, username):
+            user_id = self._get_legacy_user_id(username)
+            self._get_sdk().users.unblock(user_id)
+            return user_id
+
+        def deactivate_user(self, username):
+            user_id = self._get_legacy_user_id(username)
+            self._get_sdk().users.deactivate(user_id)
+            return user_id
+
+        def reactivate_user(self, username):
+            user_id = self._get_legacy_user_id(username)
+            self._get_sdk().users.reactivate(user_id)
+            return user_id
+
+        def get_legal_hold_matter(self, matter_name):
+            matter_pages = self._get_sdk().legalhold.get_all_matters(name=matter_name)
+            for matter_page in matter_pages:
+                matters = matter_page["legalHolds"]
+                for matter in matters:
+                    return matter
+            raise Code42LegalHoldMatterNotFoundError(matter_name)
+
+        def add_user_to_legal_hold_matter(self, username, matter_name):
+            user_uid = self._get_user_id(username)
+            matter_id = self._get_legal_hold_matter_id(matter_name)
+            response = self._get_sdk().legalhold.add_to_matter(user_uid, matter_id)
+            return json.loads(response.text)
+
+        def remove_user_from_legal_hold_matter(self, username, matter_name):
+            user_uid = self._get_user_id(username)
+            matter_id = self._get_legal_hold_matter_id(matter_name)
+            membership_id = self._get_legal_hold_matter_membership_id(user_uid, matter_id)
+            if membership_id:
+                self._get_sdk().legalhold.remove_from_matter(membership_id)
+                return user_uid, matter_id
+
+            raise Code42InvalidLegalHoldMembershipError(username, matter_name)
+
+        def get_org(self, org_name):
+            org_pages = self._get_sdk().orgs.get_all()
+            for org_page in org_pages:
+                page_json = json.loads(org_page.text)
+                orgs = page_json.get("orgs")
+                for org in orgs:
+                    if org.get("orgName", "") == org_name:
+                        return org
+            raise Code42OrgNotFoundError(org_name)
+
+        def search_file_events(self, payload):
+            py42_res = self._get_sdk().securitydata.search_file_events(payload)
+            return json.loads(py42_res.text).get("fileEvents")
+
+        def download_file(self, hash_arg):
+            security_module = self._get_sdk().securitydata
+            if _hash_is_md5(hash_arg):
+                return security_module.stream_file_by_md5(hash_arg)
+            elif _hash_is_sha256(hash_arg):
+                return security_module.stream_file_by_sha256(hash_arg)
+            else:
+                raise Code42UnsupportedHashError()
+
+        def _get_user_id(self, username):
+            user_id = self.get_user(username).get("userUid")
+            if user_id:
+                return user_id
+            raise Code42UserNotFoundError(username)
+
+        def _get_legacy_user_id(self, username):
+            user_id = self.get_user(username).get("userId")
+            if user_id:
+                return user_id
+            raise Code42UserNotFoundError(username)
+
+        def _get_org_id(self, org_name):
+            org_uid = self.get_org(org_name).get("orgUid")
+            if org_uid:
+                return org_uid
+            raise Code42OrgNotFoundError(org_name)
+
+        def get_departing_employee(self, username):
+            user_id = self._get_user_id(username)
+            response = self._get_sdk().detectionlists.departing_employee.get(user_id)
+            return json.loads(response.text)
+
+        def get_high_risk_employee(self, username):
+            user_id = self._get_user_id(username)
+            response = self._get_sdk().detectionlists.high_risk_employee.get(user_id)
+            return json.loads(response.text)
+
+        def _get_legal_hold_matter_id(self, matter_name):
+            matter_id = self.get_legal_hold_matter(matter_name).get("legalHoldUid")
+            return matter_id
+
+        def _get_legal_hold_matter_membership_id(self, user_id, matter_id):
+            member_pages = self._get_sdk().legalhold.get_all_matter_custodians(legal_hold_uid=matter_id,
+                                                                               user_uid=user_id)
+            for member_page in member_pages:
+                members = member_page["legalHoldMemberships"]
+                for member in members:
+                    return member["legalHoldMembershipUid"]
+
+
+    class Code42AlertNotFoundError(Exception):
+        def __init__(self, alert_id):
+            super(Code42AlertNotFoundError, self).__init__(
+                "No alert found with ID {0}.".format(alert_id)
+            )
+
+
+    class Code42UserNotFoundError(Exception):
+        def __init__(self, username):
+            super(Code42UserNotFoundError, self).__init__(
+                "No user found with username {0}.".format(username)
+            )
+
+
+    class Code42OrgNotFoundError(Exception):
+        def __init__(self, org_name):
+            super(Code42OrgNotFoundError, self).__init__(
+                "No organization found with name {0}.".format(org_name)
+            )
+
+
+    class Code42UnsupportedHashError(Exception):
+        def __init__(self):
+            super(Code42UnsupportedHashError, self).__init__(
+                "Unsupported hash. Must be SHA256 or MD5."
+            )
+
+
+    class Code42MissingSearchArgumentsError(Exception):
+        def __init__(self):
+            super(Code42MissingSearchArgumentsError, self).__init__(
+                "No query args provided for searching Code42 security events."
+            )
+
+
+    class Code42LegalHoldMatterNotFoundError(Exception):
+        def __init__(self, matter_name):
+            super(Code42LegalHoldMatterNotFoundError, self).__init__(
+                "No legal hold matter found with name {0}.".format(matter_name)
+            )
+
+
+    class Code42InvalidLegalHoldMembershipError(Exception):
+        def __init__(self, username, matter_name):
+            super(Code42InvalidLegalHoldMembershipError, self).__init__(
+                "User '{0}' is not an active member of legal hold matter '{1}'".format(
+                    username, matter_name
+                )
+            )
+
+
+    class Code42SearchFilters(object):
+        def __init__(self):
+            self._filters = []
+
+        @property
+        def filters(self):
+            return self._filters
+
+        def to_all_query(self):
+            """Override"""
+
+        def append(self, _filter):
+            if _filter:
+                self._filters.append(_filter)
+
+        def extend(self, _filters):
+            if _filters:
+                self._filters.extend(_filters)
+
+        def append_result(self, value, create_filter):
+            """Safely creates and appends the filter to the working list."""
+            if not value:
+                return
+            _filter = create_filter(value)
+            self.append(_filter)
+
+
+    class FileEventQueryFilters(Code42SearchFilters):
+        """Class for simplifying building up a file event search query"""
+
+        def __init__(self, pg_size=None):
+            self._pg_size = pg_size
+            super(FileEventQueryFilters, self).__init__()
+
+        def to_all_query(self):
+            """Convert list of search criteria to *args"""
+            query = FileEventQuery.all(*self._filters)
+            if self._pg_size:
+                query.page_size = self._pg_size
+            return query
+
+
+    class AlertQueryFilters(Code42SearchFilters):
+        """Class for simplifying building up an alert search query"""
+
+        def to_all_query(self):
+            query = AlertQuery.all(*self._filters)
+            query.page_size = 500
+            query.sort_direction = "asc"
+            return query
+
+
+    @logger
+
+    def build_query_payload(args):
+        """Build a query payload combining passed args"""
+
+        pg_size = args.get("results")
+        _hash = args.get("hash")
+        hostname = args.get("hostname")
+        username = args.get("username")
+        exposure = args.get("exposure")
+
+        if not _hash and not hostname and not username and not exposure:
+            raise Code42MissingSearchArgumentsError()
+
+        search_args = FileEventQueryFilters(pg_size)
+        search_args.append_result(_hash, _create_hash_filter)
+        search_args.append_result(hostname, OSHostname.eq)
+        search_args.append_result(username, DeviceUsername.eq)
+        search_args.append_result(exposure, _create_exposure_filter)
+
+        query = search_args.to_all_query()
+        LOG("File Event Query: {}".format(str(query)))
+        return query
+
+
+    def _hash_is_sha256(hash_arg):
+        return hash_arg and len(hash_arg) == 64
+
+
+    def _hash_is_md5(hash_arg):
+        return hash_arg and len(hash_arg) == 32
+
+
+    def _create_hash_filter(hash_arg):
+        if _hash_is_md5(hash_arg):
+            return MD5.eq(hash_arg)
+        elif _hash_is_sha256(hash_arg):
+            return SHA256.eq(hash_arg)
+
+
+    def _create_exposure_filter(exposure_arg):
+        # Because the CLI can't accept lists, convert the args to a list if the type is string.
+        exposure_arg = argToList(exposure_arg)
+        if "All" in exposure_arg:
+            return ExposureType.exists()
+        return ExposureType.is_in(exposure_arg)
+
+
+    def get_file_category_value(key):
+        # Meant to handle all possible cases
+        key = key.lower().replace("-", "").replace("_", "")
+        category_map = {
+            "sourcecode": FileCategory.SOURCE_CODE,
+            "audio": FileCategory.AUDIO,
+            "executable": FileCategory.EXECUTABLE,
+            "document": FileCategory.DOCUMENT,
+            "image": FileCategory.IMAGE,
+            "pdf": FileCategory.PDF,
+            "presentation": FileCategory.PRESENTATION,
+            "script": FileCategory.SCRIPT,
+            "spreadsheet": FileCategory.SPREADSHEET,
+            "video": FileCategory.VIDEO,
+            "virtualdiskimage": FileCategory.VIRTUAL_DISK_IMAGE,
+            "archive": FileCategory.ZIP,
+        }
+        return category_map.get(key, "UNCATEGORIZED")
+
+
+    class ObservationToSecurityQueryMapper(object):
+        """Class to simplify the process of mapping observation data to query objects."""
+
+        # Exfiltration consts
+        _ENDPOINT_TYPE = "FedEndpointExfiltration"
+        _CLOUD_TYPE = "FedCloudSharePermissions"
+
+        # Query consts
+        _PUBLIC_SEARCHABLE = "PublicSearchableShare"
+        _PUBLIC_LINK = "PublicLinkShare"
+        _OUTSIDE_TRUSTED_DOMAINS = "SharedOutsideTrustedDomain"
+
+        exposure_type_map = {
+            "PublicSearchableShare": ExposureType.IS_PUBLIC,
+            "PublicLinkShare": ExposureType.SHARED_VIA_LINK,
+            "SharedOutsideTrustedDomain": ExposureType.OUTSIDE_TRUSTED_DOMAINS,
+        }
+
+        def __init__(self, observation, actor):
+            self._obs = observation
+            self._actor = actor
+
+        @property
+        def _observation_data(self):
+            return self._obs.get("data")
+
+        @property
+        def _exfiltration_type(self):
+            return self._obs.get("type")
+
+        @property
+        def _is_endpoint_exfiltration(self):
+            return self._exfiltration_type == self._ENDPOINT_TYPE
+
+        @property
+        def _is_cloud_exfiltration(self):
+            return self._exfiltration_type == self._CLOUD_TYPE
+
+        def _create_user_filter(self):
+            return (
+                DeviceUsername.eq(self._actor)
+                if self._is_endpoint_exfiltration
+                else Actor.eq(self._actor)
+            )
+
+        def map(self):
+            search_args = self._create_search_args()
+            query = search_args.to_all_query()
+            LOG("Alert Observation Query: {}".format(query))
+            return query
+
+        def _create_search_args(self):
+            filters = FileEventQueryFilters()
+            exposure_types = self._observation_data.get("exposureTypes")
+            first_activity = self._observation_data.get("firstActivityAt")
+            last_activity = self._observation_data.get("lastActivityAt")
+            filters.append(self._create_user_filter())
+            if first_activity:
+                begin_time = _convert_date_arg_to_epoch(first_activity)
+                if begin_time:
+                    filters.append(EventTimestamp.on_or_after(begin_time))
+            if last_activity:
+                end_time = _convert_date_arg_to_epoch(last_activity)
+                if end_time:
+                    filters.append(EventTimestamp.on_or_before(end_time))
+            filters.extend(self._create_exposure_filters(exposure_types))
+            filters.append(self._create_file_category_filters())
+            return filters
+
+        @logger
+        def _create_exposure_filters(self, exposure_types):
+            """Determine exposure types based on alert type"""
+            exp_types = []
+            if self._is_cloud_exfiltration:
+                for t in exposure_types:
+                    exp_type = self.exposure_type_map.get(t)
+                    if exp_type:
+                        exp_types.append(exp_type)
+                    else:
+                        LOG("Received unsupported exposure type {0}.".format(t))
+                if exp_types:
+                    return [ExposureType.is_in(exp_types)]
+                else:
+                    # If not given a support exposure type, search for all unsupported exposure types
+                    supported_exp_types = list(self.exposure_type_map.values())
+                    return [ExposureType.not_in(supported_exp_types)]
+            elif self._is_endpoint_exfiltration:
+                return [
+                    EventType.is_in([EventType.CREATED, EventType.MODIFIED, EventType.READ_BY_APP]),
+                    ExposureType.is_in(exposure_types),
+                ]
+            return []
+
+        def _create_file_category_filters(self):
+            """Determine if file categorization is significant"""
+            observed_file_categories = self._observation_data.get("fileCategories")
+            if observed_file_categories:
+                categories = [
+                    get_file_category_value(c.get("category"))
+                    for c in observed_file_categories
+                    if c.get("isSignificant") and c.get("category")
+                ]
+                if categories:
+                    return FileCategory.is_in(categories)
+
+
+    def map_observation_to_security_query(observation, actor):
+        mapper = ObservationToSecurityQueryMapper(observation, actor)
+        return mapper.map()
+
+
+    def _convert_date_arg_to_epoch(date_arg):
+        date_arg = date_arg[:25]
+        return (
+            datetime.strptime(date_arg, "%Y-%m-%dT%H:%M:%S.%f") - datetime.utcfromtimestamp(0)
+        ).total_seconds()
+
+
+    def _clear_env_var_if_exists(var):
+        if os.environ.get(var):
+            del os.environ[var]
+
+
+    @logger
+
+    def map_to_code42_event_context(obj):
+        code42_context = _map_obj_to_context(obj, CODE42_EVENT_CONTEXT_FIELD_MAPPER)
+        # FileSharedWith is a special case and needs to be converted to a list
+        shared_with_list = code42_context.get("FileSharedWith")
+        if shared_with_list:
+            shared_list = [u.get("cloudUsername") for u in shared_with_list if u.get("cloudUsername")]
+            code42_context["FileSharedWith"] = str(shared_list)
+        return code42_context
+
+
+    @logger
+
+    def map_to_code42_alert_context(obj):
+        return _map_obj_to_context(obj, CODE42_ALERT_CONTEXT_FIELD_MAPPER)
+
+
+    @logger
+
+    def map_to_file_context(obj):
+        return _map_obj_to_context(obj, FILE_CONTEXT_FIELD_MAPPER)
+
+
+    @logger
+
+    def _map_obj_to_context(obj, context_mapper):
+        return {v: obj.get(k) for k, v in context_mapper.items() if obj.get(k)}
+
+
+    def create_command_error_message(cmd, ex):
+        return "Failed to execute command {0} command. Error: {1}".format(cmd, str(ex))
+
+
+    """Commands"""
+
+
+
+    @logger
+
+    def alert_get_command(client, args):
+        code42_securityalert_context = []
+        alert = client.get_alert_details(args.get("id"))
+        if not alert:
+            return CommandResults(
+                readable_output="No results found",
+                outputs={"Results": []},
+                outputs_key_field="ID",
+                outputs_prefix="Code42.SecurityAlert",
+                raw_response={},
+            )
+
+        code42_context = map_to_code42_alert_context(alert)
+        code42_securityalert_context.append(code42_context)
+        readable_outputs = tableToMarkdown(
+            "Code42 Security Alert Results",
+            code42_securityalert_context,
+            headers=SECURITY_ALERT_HEADERS,
+        )
+        return CommandResults(
+            outputs_prefix="Code42.SecurityAlert",
+            outputs_key_field="ID",
+            outputs=code42_securityalert_context,
+            readable_output=readable_outputs,
+            raw_response=alert,
+        )
+
+
+    @logger
+
+    def alert_resolve_command(client, args):
+        code42_securityalert_context = []
+        alert_id = client.resolve_alert(args.get("id"))
+        if not alert_id:
+            return CommandResults(
+                readable_output="No results found",
+                outputs={"Results": []},
+                outputs_key_field="ID",
+                outputs_prefix="Code42.SecurityAlert",
+                raw_response={},
+            )
+
+        # Retrieve new alert details
+        alert_details = client.get_alert_details(alert_id)
+        code42_context = map_to_code42_alert_context(alert_details)
+        code42_securityalert_context.append(code42_context)
+        readable_outputs = tableToMarkdown(
+            "Code42 Security Alert Resolved",
+            code42_securityalert_context,
+            headers=SECURITY_ALERT_HEADERS,
+        )
+        return CommandResults(
+            outputs_prefix="Code42.SecurityAlert",
+            outputs_key_field="ID",
+            outputs=code42_securityalert_context,
+            readable_output=readable_outputs,
+            raw_response=alert_details,
+        )
+
+
+    @logger
+
+    def departingemployee_add_command(client, args):
+        departing_date = args.get("departuredate")
+        username = args.get("username")
+        note = args.get("note")
+        user_id = client.add_user_to_departing_employee(username, departing_date, note)
+        # CaseID included but is deprecated.
+        de_context = {
+            "CaseID": user_id,
+            "UserID": user_id,
+            "Username": username,
+            "DepartureDate": departing_date,
+            "Note": note,
+        }
+        readable_outputs = tableToMarkdown("Code42 Departing Employee List User Added", de_context)
+        return CommandResults(
+            outputs_prefix="Code42.DepartingEmployee",
+            outputs_key_field="UserID",
+            outputs=de_context,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def departingemployee_remove_command(client, args):
+        username = args.get("username")
+        user_id = client.remove_user_from_departing_employee(username)
+        # CaseID included but is deprecated.
+        de_context = {"CaseID": user_id, "UserID": user_id, "Username": username}
+        readable_outputs = tableToMarkdown("Code42 Departing Employee List User Removed", de_context)
+        return CommandResults(
+            outputs_prefix="Code42.DepartingEmployee",
+            outputs_key_field="UserID",
+            outputs=de_context,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def departingemployee_get_all_command(client, args):
+        results = args.get("results", 50)
+        filter_type = args.get("filtertype", DepartingEmployeeFilters.OPEN)
+        employees = client.get_all_departing_employees(results, filter_type)
+        if not employees:
+            return CommandResults(
+                readable_output="No results found",
+                outputs_prefix="Code42.DepartingEmployee",
+                outputs_key_field="UserID",
+                outputs={"Results": []},
+                raw_response={},
+            )
+
+        employees_context = [
+            {
+                "UserID": e.get("userId"),
+                "Username": e.get("userName"),
+                "DepartureDate": e.get("departureDate"),
+                "Note": e.get("notes"),
+            }
+            for e in employees
+        ]
+        readable_outputs = tableToMarkdown("All Departing Employees", employees_context)
+        return CommandResults(
+            outputs_prefix="Code42.DepartingEmployee",
+            outputs_key_field="UserID",
+            outputs=employees_context,
+            readable_output=readable_outputs,
+            raw_response=employees,
+        )
+
+
+    @logger
+
+    def departingemployee_get_command(client, args):
+        username = args.get("username")
+        departing_employee = client.get_departing_employee(username)
+        de_context = {
+            "UserID": departing_employee.get("userId"),
+            "Username": departing_employee.get("userName"),
+            "DepartureDate": departing_employee.get("departureDate"),
+            "Note": departing_employee.get("notes"),
+        }
+        readable_outputs = tableToMarkdown("Retrieve departing employee", de_context)
+        return CommandResults(
+            outputs_prefix="Code42.DepartingEmployee",
+            outputs_key_field="UserID",
+            outputs=de_context,
+            readable_output=readable_outputs,
+            raw_response=username,
+        )
+
+
+    @logger
+
+    def highriskemployee_get_command(client, args):
+        username = args.get("username")
+        high_risk_employee = client.get_high_risk_employee(username)
+        hre_context = {
+            "UserID": high_risk_employee.get("userId"),
+            "Username": high_risk_employee.get("userName"),
+            "Note": high_risk_employee.get("notes")
+        }
+        readable_outputs = tableToMarkdown("Retrieve high risk employee", hre_context)
+        return CommandResults(
+            outputs_prefix="Code42.HighRiskEmployee",
+            outputs_key_field="UserID",
+            outputs=hre_context,
+            readable_output=readable_outputs,
+            raw_response=username,
+        )
+
+
+    @logger
+
+    def highriskemployee_add_command(client, args):
+        username = args.get("username")
+        note = args.get("note")
+        user_id = client.add_user_to_high_risk_employee(username, note)
+        hr_context = {"UserID": user_id, "Username": username}
+        readable_outputs = tableToMarkdown("Code42 High Risk Employee List User Added", hr_context)
+        return CommandResults(
+            outputs_prefix="Code42.HighRiskEmployee",
+            outputs_key_field="UserID",
+            outputs=hr_context,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def highriskemployee_remove_command(client, args):
+        username = args.get("username")
+        user_id = client.remove_user_from_high_risk_employee(username)
+        hr_context = {"UserID": user_id, "Username": username}
+        readable_outputs = tableToMarkdown("Code42 High Risk Employee List User Removed", hr_context)
+        return CommandResults(
+            outputs_prefix="Code42.HighRiskEmployee",
+            outputs_key_field="UserID",
+            outputs=hr_context,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def highriskemployee_get_all_command(client, args):
+        tags = args.get("risktags")
+        results = args.get("results", 50)
+        filter_type = args.get("filtertype", HighRiskEmployeeFilters.OPEN)
+        employees = client.get_all_high_risk_employees(tags, results, filter_type)
+        if not employees:
+            return CommandResults(
+                readable_output="No results found",
+                outputs_prefix="Code42.HighRiskEmployee",
+                outputs_key_field="UserID",
+                outputs={"Results": []},
+                raw_response={},
+            )
+        employees_context = [
+            {"UserID": e.get("userId"), "Username": e.get("userName"), "Note": e.get("notes")}
+            for e in employees
+        ]
+        readable_outputs = tableToMarkdown("Retrieved All High Risk Employees", employees_context)
+        return CommandResults(
+            outputs_prefix="Code42.HighRiskEmployee",
+            outputs_key_field="UserID",
+            outputs=employees_context,
+            readable_output=readable_outputs,
+            raw_response=employees,
+        )
+
+
+    @logger
+
+    def highriskemployee_add_risk_tags_command(client, args):
+        username = args.get("username")
+        tags = args.get("risktags")
+        user_id = client.add_user_risk_tags(username, tags)
+        rt_context = {"UserID": user_id, "Username": username, "RiskTags": tags}
+        readable_outputs = tableToMarkdown("Code42 Risk Tags Added", rt_context)
+        return CommandResults(
+            outputs_prefix="Code42.HighRiskEmployee",
+            outputs_key_field="UserID",
+            outputs=rt_context,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def highriskemployee_remove_risk_tags_command(client, args):
+        username = args.get("username")
+        tags = args.get("risktags")
+        user_id = client.remove_user_risk_tags(username, tags)
+        rt_context = {"UserID": user_id, "Username": username, "RiskTags": tags}
+        readable_outputs = tableToMarkdown("Code42 Risk Tags Removed", rt_context)
+        return CommandResults(
+            outputs_prefix="Code42.HighRiskEmployee",
+            outputs_key_field="UserID",
+            outputs=rt_context,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def securitydata_search_command(client, args):
+        code42_security_data_context = []
+        _json = args.get("json")
+        file_context = []
+
+        # If JSON payload is passed as an argument, ignore all other args and search by JSON payload
+        if _json is not None:
+            file_events = client.search_file_events(_json)
+        else:
+            # Build payload
+            payload = build_query_payload(args)
+            file_events = client.search_file_events(payload)
+        if file_events:
+            for file_event in file_events:
+                code42_context_event = map_to_code42_event_context(file_event)
+                code42_security_data_context.append(code42_context_event)
+                file_context_event = map_to_file_context(file_event)
+                file_context.append(file_context_event)
+            readable_outputs = tableToMarkdown(
+                "Code42 Security Data Results",
+                code42_security_data_context,
+                headers=SECURITY_EVENT_HEADERS,
+            )
+            code42_results = CommandResults(
+                outputs_prefix="Code42.SecurityData",
+                outputs_key_field="EventID",
+                outputs=code42_security_data_context,
+                readable_output=readable_outputs,
+                raw_response=file_events,
+            )
+            file_results = CommandResults(
+                outputs_prefix="File", outputs_key_field=None, outputs=file_context
+            )
+            return code42_results, file_results
+
+        else:
+            return CommandResults(
+                readable_output="No results found",
+                outputs={"Results": []},
+                outputs_key_field="EventID",
+                outputs_prefix="Code42.SecurityData",
+                raw_response={},
+            )
+
+
+    @logger
+
+    def user_create_command(client, args):
+        org_name = args.get("orgname")
+        username = args.get("username")
+        email = args.get("email")
+        res = client.create_user(org_name, username, email)
+        outputs = {
+            "Username": res.get("username"),
+            "UserID": res.get("userUid"),
+            "Email": res.get("email"),
+        }
+        readable_outputs = tableToMarkdown("Code42 User Created", outputs)
+        return CommandResults(
+            outputs_prefix="Code42.User",
+            outputs_key_field="UserID",
+            outputs=outputs,
+            readable_output=readable_outputs,
+            raw_response=res,
+        )
+
+
+    @logger
+
+    def user_block_command(client, args):
+        username = args.get("username")
+        user_id = client.block_user(username)
+        outputs = {"UserID": user_id}
+        readable_outputs = tableToMarkdown("Code42 User Blocked", outputs)
+        return CommandResults(
+            outputs_prefix="Code42.User",
+            outputs_key_field="UserID",
+            outputs=outputs,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def user_unblock_command(client, args):
+        username = args.get("username")
+        user_id = client.unblock_user(username)
+        outputs = {"UserID": user_id}
+        readable_outputs = tableToMarkdown("Code42 User Unblocked", outputs)
+        return CommandResults(
+            outputs_prefix="Code42.User",
+            outputs_key_field="UserID",
+            outputs=outputs,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def user_deactivate_command(client, args):
+        username = args.get("username")
+        user_id = client.deactivate_user(username)
+        outputs = {"UserID": user_id}
+        readable_outputs = tableToMarkdown("Code42 User Deactivated", outputs)
+        return CommandResults(
+            outputs_prefix="Code42.User",
+            outputs_key_field="UserID",
+            outputs=outputs,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def user_reactivate_command(client, args):
+        username = args.get("username")
+        user_id = client.reactivate_user(username)
+        outputs = {"UserID": user_id}
+        readable_outputs = tableToMarkdown("Code42 User Reactivated", outputs)
+        return CommandResults(
+            outputs_prefix="Code42.User",
+            outputs_key_field="UserID",
+            outputs=outputs,
+            readable_output=readable_outputs,
+            raw_response=user_id,
+        )
+
+
+    @logger
+
+    def legal_hold_add_user_command(client, args):
+        username = args.get("username")
+        matter_name = args.get("mattername")
+        response = client.add_user_to_legal_hold_matter(username, matter_name)
+        legal_hold_info = response.get("legalHold")
+        user_info = response.get("user")
+        outputs = {
+            "MatterID": legal_hold_info.get("legalHoldUid") if legal_hold_info else None,
+            "MatterName": legal_hold_info.get("name") if legal_hold_info else None,
+            "UserID": user_info.get("userUid") if legal_hold_info else None,
+            "Username": user_info.get("username") if user_info else None,
+        }
+        readable_outputs = tableToMarkdown("Code42 User Added to Legal Hold Matter", outputs)
+        return CommandResults(
+            outputs_prefix="Code42.LegalHold",
+            outputs_key_field="MatterID",
+            outputs=outputs,
+            readable_output=readable_outputs,
+            raw_response=response
+        )
+
+
+    @logger
+
+    def legal_hold_remove_user_command(client, args):
+        username = args.get("username")
+        matter_name = args.get("mattername")
+        user_uid, matter_id = client.remove_user_from_legal_hold_matter(username, matter_name)
+        outputs = {
+            "MatterID": matter_id,
+            "MatterName": matter_name,
+            "UserID": user_uid,
+            "Username": username
+        }
+        readable_outputs = tableToMarkdown("Code42 User Removed from Legal Hold Matter", outputs)
+        return CommandResults(
+            outputs_prefix="Code42.LegalHold",
+            outputs_key_field="MatterID",
+            outputs=outputs,
+            readable_output=readable_outputs,
+            raw_response=user_uid
+        )
+
+
+    @logger
+
+    def download_file_command(client, args):
+        file_hash = args.get("hash")
+        filename = args.get("filename") or file_hash
+        response = client.download_file(file_hash)
+        file_chunks = [c for c in response.iter_content(chunk_size=128) if c]
+        return fileResult(filename, data=b"".join(file_chunks))
+
+
+    """Fetching"""
+
+
+
+    def _create_incident_from_alert_details(details):
+        return {"name": "Code42 - {}".format(details.get("name")), "occurred": details.get("createdAt")}
+
+
+    def _stringify_lists_if_needed(event):
+        # We need to convert certain fields to a stringified list else React.JS will throw an error
+        shared_with = event.get("sharedWith")
+        private_ip_addresses = event.get("privateIpAddresses")
+        if shared_with:
+            shared_list = [u.get("cloudUsername") for u in shared_with if u.get("cloudUsername")]
+            event["sharedWith"] = str(shared_list)
+        if private_ip_addresses:
+            event["privateIpAddresses"] = str(private_ip_addresses)
+        return event
+
+
+    def _process_event_from_observation(event):
+        return _stringify_lists_if_needed(event)
+
+
+    class Code42SecurityIncidentFetcher(object):
+        def __init__(
+            self,
+            client,
+            last_run,
+            first_fetch_time,
+            event_severity_filter,
+            fetch_limit,
+            include_files,
+            integration_context=None,
+        ):
+            self._client = client
+            self._last_run = last_run
+            self._first_fetch_time = first_fetch_time
+            self._event_severity_filter = event_severity_filter
+            self._fetch_limit = fetch_limit
+            self._include_files = include_files
+            self._integration_context = integration_context
+
+        @logger
+        def fetch(self):
+            remaining_incidents_from_last_run = self._fetch_remaining_incidents_from_last_run()
+            if remaining_incidents_from_last_run:
+                return remaining_incidents_from_last_run
+            start_query_time = self._get_start_query_time()
+            alerts = self._fetch_alerts(start_query_time)
+            incidents = [self._create_incident_from_alert(a) for a in alerts]
+            save_time = datetime.utcnow().timestamp()
+            next_run = {"last_fetch": save_time}
+            return next_run, incidents[: self._fetch_limit], incidents[self._fetch_limit:]
+
+        def _fetch_remaining_incidents_from_last_run(self):
+            if self._integration_context:
+                remaining_incidents = self._integration_context.get("remaining_incidents")
+                # return incidents if exists in context.
+                if remaining_incidents:
+                    return (
+                        self._last_run,
+                        remaining_incidents[:self._fetch_limit],
+                        remaining_incidents[self._fetch_limit:],
+                    )
+
+        def _get_start_query_time(self):
+            start_query_time = self._try_get_last_fetch_time()
+
+            # Handle first time fetch, fetch incidents retroactively
+            if not start_query_time:
+                start_query_time, _ = parse_date_range(
+                    self._first_fetch_time, to_timestamp=True, utc=True
+                )
+                start_query_time /= 1000
+
+            return start_query_time
+
+        def _try_get_last_fetch_time(self):
+            return self._last_run.get("last_fetch")
+
+        def _fetch_alerts(self, start_query_time):
+            return self._client.fetch_alerts(start_query_time, self._event_severity_filter)
+
+        def _create_incident_from_alert(self, alert):
+            details = self._client.get_alert_details(alert.get("id"))
+            incident = _create_incident_from_alert_details(details)
+            if self._include_files:
+                details = self._relate_files_to_alert(details)
+            incident["rawJSON"] = json.dumps(details)
+            return incident
+
+        def _relate_files_to_alert(self, alert_details):
+            observations = alert_details.get("observations")
+            if not observations:
+                alert_details["fileevents"] = []
+                return
+            for obs in observations:
+                file_events = self._get_file_events_from_alert_details(obs, alert_details)
+                alert_details["fileevents"] = [_process_event_from_observation(e) for e in file_events]
+            return alert_details
+
+        def _get_file_events_from_alert_details(self, observation, alert_details):
+            security_data_query = map_observation_to_security_query(observation, alert_details.get("actor"))
+            return self._client.search_file_events(security_data_query)
+
+
+    def fetch_incidents(
+        client,
+        last_run,
+        first_fetch_time,
+        event_severity_filter,
+        fetch_limit,
+        include_files,
+        integration_context=None,
+    ):
+        fetcher = Code42SecurityIncidentFetcher(
+            client,
+            last_run,
+            first_fetch_time,
+            event_severity_filter,
+            fetch_limit,
+            include_files,
+            integration_context,
+        )
+        return fetcher.fetch()
+
+
+    """Main and test"""
+
+
+
+    def test_module(client):
+        try:
+            # Will fail if unauthorized
+            client.get_current_user()
+            return "ok"
+        except Exception:
+            return (
+                "Invalid credentials or host address. Check that the username and password are correct, that the host "
+                "is available and reachable, and that you have supplied the full scheme, domain, and port "
+                "(e.g. https://myhost.code42.com:4285)."
+            )
+
+
+    def get_command_map():
+        return {
+            "code42-alert-get": alert_get_command,
+            "code42-alert-resolve": alert_resolve_command,
+            "code42-securitydata-search": securitydata_search_command,
+            "code42-departingemployee-add": departingemployee_add_command,
+            "code42-departingemployee-remove": departingemployee_remove_command,
+            "code42-departingemployee-get-all": departingemployee_get_all_command,
+            "code42-departingemployee-get": departingemployee_get_command,
+            "code42-highriskemployee-add": highriskemployee_add_command,
+            "code42-highriskemployee-remove": highriskemployee_remove_command,
+            "code42-highriskemployee-get-all": highriskemployee_get_all_command,
+            "code42-highriskemployee-add-risk-tags": highriskemployee_add_risk_tags_command,
+            "code42-highriskemployee-remove-risk-tags": highriskemployee_remove_risk_tags_command,
+            "code42-highriskemployee-get": highriskemployee_get_command,
+            "code42-user-create": user_create_command,
+            "code42-user-block": user_block_command,
+            "code42-user-unblock": user_unblock_command,
+            "code42-user-deactivate": user_deactivate_command,
+            "code42-user-reactivate": user_reactivate_command,
+            "code42-legalhold-add-user": legal_hold_add_user_command,
+            "code42-legalhold-remove-user": legal_hold_remove_user_command,
+            "code42-download-file": download_file_command,
+        }
+
+
+    def handle_test_command(client):
+        # This is the call made when pressing the integration Test button.
+        result = test_module(client)
+        demisto.results(result)
+
+
+    def handle_fetch_command(client):
+        integration_context = demisto.getIntegrationContext()
+        # Set and define the fetch incidents command to run after activated via integration settings.
+        next_run, incidents, remaining_incidents = fetch_incidents(
+            client=client,
+            last_run=demisto.getLastRun(),
+            first_fetch_time=demisto.params().get("fetch_time"),
+            event_severity_filter=demisto.params().get("alert_severity"),
+            fetch_limit=int(demisto.params().get("fetch_limit")),
+            include_files=demisto.params().get("include_files"),
+            integration_context=integration_context,
+        )
+        demisto.setLastRun(next_run)
+        demisto.incidents(incidents)
+        # Store remaining incidents in integration context
+        integration_context["remaining_incidents"] = remaining_incidents
+        demisto.setIntegrationContext(integration_context)
+
+
+    def run_command(command):
+        try:
+            results = command()
+            if not isinstance(results, (tuple, list)):
+                results = [results]
+            for result in results:
+                return_results(result)
+        except Exception as e:
+            return_error(create_command_error_message(demisto.command(), e))
+
+
+    def create_client():
+        username = demisto.params().get("credentials").get("identifier")
+        password = demisto.params().get("credentials").get("password")
+        base_url = demisto.params().get("console_url")
+        verify_certificate = not demisto.params().get("insecure", False)
+        proxy = demisto.params().get("proxy", False)
+        return Code42Client(
+            base_url=base_url,
+            sdk=None,
+            auth=(username, password),
+            verify=verify_certificate,
+            proxy=proxy,
+        )
+
+
+    def main():
+        client = create_client()
+        commands = get_command_map()
+        command_key = demisto.command()
+        LOG("Command being called is {0}.".format(command_key))
+        if command_key == "test-module":
+            handle_test_command(client)
+        elif command_key == "fetch-incidents":
+            handle_fetch_command(client)
+        elif command_key in commands:
+            run_command(lambda: commands[command_key](client, demisto.args()))
+
+
+    if __name__ in ("__main__", "__builtin__", "builtins"):
+        main()
+  subtype: python3
+  type: python
+fromversion: 4.1.0
+image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAHjElEQVR4nO2aeYxV1R3HP/e+h2wyoCxalhkQpFJpUcQ2LijRLsE9ikutUjCh44poWzUqalyitmqiQdM0rfsSlbjVuFsXlChVaaWKSnBBBnDsMAwyFpiZd815871wuNztDTP4B+eT3Hn3nv2e3zm/3+/87uBwOBwOh8PhcDgcDofD4XA4HA6Hw7EteKXjqAMGA9908kz2AVYDY4B6O8ML4GN/ANOKU/AJ6EGrE2IXUZQgsH47E9Omb7fn6fdef19Wen3YM2igtCnV0dn4XTyjga4tUhb7g3i6MIYhwVon3C6mqwW8BaEo7/b3pZEe9Kbl+3rvHYbidn3RAD7wB/Fs4YdUB020bbl7+wIHAbsBG4CFwOIKWt8f2AsoAMuA+cD6jDo1wE5Am549XQ1AY44+ewDDgNJWmmoz3YAmYFVGWz3VVpvaMu+xUe+S1LbZoPsBo3T/KfC2xlOmUgG3qrNuFdazbO941tCT3fmGtnYFYgZ3E3CMVSzkE2Am8HxK05cBFwD9I+lmcu4GLgbWxNQzE/gmMCSh3c+AF4AbgM8TyvwUeC1lbCHPAEdmlLkROC+SZhZFNWyl6nYBrgJO173NWuDPwLVUoKL/BkzQ7hoEjANuzVm3nQAW+bvxTGE0NUFjKNxTgCXAsRKuWb11lkc/GngOuDqmxSpgkV4kFG6DtVPMzvwdsBzYp6KxtjMCqJWgoxPf2RxUQR8n63QyM0a44bxcA7xIDgF/K8HOAN5Vw2Y3vA/Mkkr8X9aIwm35lD+GRnqFx6JfAg9ZxWYDuwJDNcjJUk9h3mmRZs3uGqv7f2gxDAB+oIU4R3m9tcsGpwxxLrCzjnSmnfGapGbl3wZcmPGaf5CaHRu5jAo9K6PuLRn5NuNi0pq0c21+DlyUJeBfSbBJfAxMSrERm2jxfBb4wxgYNIee8+1W9gHaifYgn5NdNbv0PuCfVt5FwM90f7PU+xIrv147Yrqeq1QuidUS5kdqx9j/K4CR0ihhP3untLFMNv+DyPWetVDj+L1UPaq3KGMqLzWWTvePaTH1kw9zQaTsMWkCNmr5jYzOwkHdmJDnl68Alnr9qaOKncv+EyfJ9houB95KqF+vFTsVWGGlT9XvJ9o5SRgb/KTyjGobnlAu6az2FTDNep6R0ldHqA5tpZgtJymL2TJrJ2j+Q+ZE5mlAmpP1YAUD/gvQXd5vGJYy6mpdaE+Xe1Ws83aiT1AW8C9UpmStxiSi2mGstZOeyDG2RywbPzHFYUriJe3C8aqfRLXeeWQk33jaX2qxRLle+UhjPQ6cmWNMyxK0woSIKVqVJOBWqd+8fJFkozz9ubMwgSIlCgRGYuFOWqyXr4Q9rLIf5qj3X+s+aQfnaWO8hNgj4fh1k644jIa7JJJ+NHCq9TxLvz07OEbjfzwcSZubpqIz7WoltFDA29xk2G9HgtAF6z5PffuIUUgpl0bYj99JwSE/4hPUWhuqI/P+Y9WvttJeNio7aQcX5U2uzNnBUA1yozUZZqU3B3C7F9A8ve0dZhWPKjtYHkF4lBku56Cpgpeps+7z7EhbZeZ9nyh76rleJ4s4ZsnbHhXJ6x4T5LjCahPVuUyevD3eKpkwc+S5M6HfM4C/R9IW6BSSGuj4dc5DPBLu5THprfKAm4cGa8uhSRO9KhLMl3rqK/uYZYdtFsqRGCwv/7qM8pOt+39V0E/IOMv2vpNSboV235KUMiHRc/kfE8r1UqxgYIKAH5ScbO4Azgmf09RNreW+pzFa0aI4SuXLg5pgDQOCZr5tD4I9IgcMeZFVCfV9BVROsdJa5IygiZ+aUNdgjlln636enKVKucMq/0AH6ncFP5KTFRXuGZZwy2HXLHvyfMbZz8RyX8kTuuwbrGefYCVfe73NuelrqSkUf/1PzKo2bT6qiM1D1pkWhelW6/4e4PyYLs3OfcV6np01Rgtfnr6xawcq+S55uklU8lnsbcUXnrSux7XwG6xyG7QoX7XSJupoNCzSpqk3RWOuU0zhffPBf22Ob8HGtvxVR4ySjPlvFXBIc1w2quxX5iP/y4WRzCgez/CgMXS45tjqRBGyfysceqjlUb6mgIrNgYolh6zSuX2DgiC2LazV+G0K8v6HKMhRr7RA/dverIl0nRjzfodYZqxBvkR0sQ/TIpwWUz+O1y2TEBeL/g1wf862mvJ+bJipa70E3Ctnvc14cHjbUg7xP+NNv6Ys5BLeuVrNtyka8xNdNn9KMAHzdWS6X8LeXSvY5nOp8HkZo+ut2HMUcwy7UgJOeKtN9I/54BEyKM8UxbS5zeTdwR1l0w5G/6rzUmEUtcXjqA7WtIe42jEq8QjgYE3SBqmauTk9X3NMOEq7paD+zDEhzUn0FOI08e//W+lFecrv5QiKDNRXoo32J7oIVQqBvp5zDg/Xwm1R3P+pSNs1Mh/NGUcq472v274Cpn1I07tNYZ5fw4j2XdxFXTvY3v/RES6300sLy+Ju3b7d75B09Qx7W9kUDw5rW8qk0qfUeVV2dMvRBRTl+fVJ+K+HbaGf2tzCNgWS+LS2d1ngDy2HMIuJ5svhcDgcDofD4XA4HA6Hw+FwOBwOh8Px/QF8B+pZzTnuPtCMAAAAAElFTkSuQmCC
+detaileddescription: >
+  ### Partner Contributed Integration
+
+  #### Integration Author: Code42
+
+  Support and maintenance for this integration are provided by the author. Please use the following contact details:
+
+  - **URL**: [https://support.code42.com/Administrator/Cloud/Monitoring_and_managing](https://support.code42.com/Administrator/Cloud/Monitoring_and_managing)
+
+  ***
+
+  ## Code42
+
+
+  Code42 provides simple, fast detection and response to everyday data loss from insider threats by focusing on customer data on endpoints and the cloud.
+
+
+  To configure this integration, you will need to create a local (non-SSO) user within the Code42 application with one of the following sets of roles:
+
+
+  * Customer Cloud Admin
+
+  * Security Center User + (Org Security Viewer or Cross Org Security Viewer)
+
+
+  After this user is set up, use the username and password to configure the Code42 integration.
diff --git a/Packs/Code42/TestPlaybooks/playbook-Code42-Test.yml b/Packs/Code42/TestPlaybooks/playbook-Code42-Test.yml
index f7070acf63de..78c4a8363ef5 100644
--- a/Packs/Code42/TestPlaybooks/playbook-Code42-Test.yml
+++ b/Packs/Code42/TestPlaybooks/playbook-Code42-Test.yml
@@ -131,8 +131,6 @@ tasks:
         simple: alert=
       id:
         simple: ${inputs.alert-id}
-      using:
-        simple: ${inputs.instance}
     separatecontext: false
     skipunavailable: false
     task:
@@ -236,8 +234,6 @@ tasks:
         simple: alert=
       id:
         simple: ${inputs.alert-id}
-      using:
-        simple: ${inputs.instance}
     separatecontext: false
     skipunavailable: false
     task:
@@ -343,8 +339,6 @@ tasks:
       note: {}
       username:
         simple: ${inputs.username}
-      using:
-        simple: ${inputs.instance}
     separatecontext: false
     skipunavailable: false
     task:
@@ -448,8 +442,6 @@ tasks:
         simple: departingemployee=
       username:
         simple: ${inputs.username}
-      using:
-        simple: ${inputs.instance}
     separatecontext: false
     skipunavailable: false
     task:
@@ -559,8 +551,6 @@ tasks:
       results:
         simple: "100"
       username: {}
-      using:
-        simple: ${inputs.instance}
     separatecontext: false
     skipunavailable: false
     task:

From 0df920d56f6c924d3b9f5d649ff895dfe85abad8 Mon Sep 17 00:00:00 2001
From: Juliya Smith <juliya.smith@code42.com>
Date: Mon, 5 Oct 2020 19:32:31 +0000
Subject: [PATCH 2/3] Bump docker image

---
 Packs/Code42/Integrations/Code42/Code42.yml   |    2 +-
 .../Code42/integration-Code42.yml             | 2257 -----------------
 2 files changed, 1 insertion(+), 2258 deletions(-)
 delete mode 100644 Packs/Code42/Integrations/Code42/integration-Code42.yml

diff --git a/Packs/Code42/Integrations/Code42/Code42.yml b/Packs/Code42/Integrations/Code42/Code42.yml
index 91f1dde2e469..012c215ad4ae 100644
--- a/Packs/Code42/Integrations/Code42/Code42.yml
+++ b/Packs/Code42/Integrations/Code42/Code42.yml
@@ -805,7 +805,7 @@ script:
     - contextPath: Code42.DepartingEmployee.DepartureDate
       description: The departure date for the Departing Employee.
       type: Unknown
-  dockerimage: demisto/py42:1.0.0.11140
+  dockerimage: demisto/py42:1.0.0.12043
   feed: false
   isfetch: true
   longRunning: false
diff --git a/Packs/Code42/Integrations/Code42/integration-Code42.yml b/Packs/Code42/Integrations/Code42/integration-Code42.yml
deleted file mode 100644
index c1c266d4cec4..000000000000
--- a/Packs/Code42/Integrations/Code42/integration-Code42.yml
+++ /dev/null
@@ -1,2257 +0,0 @@
-category: Endpoint
-commonfields:
-  id: Code42
-  version: -1
-configuration:
-- defaultvalue: console.us.code42.com
-  display: Code42 Console URL for your Code42 environment
-  name: console_url
-  required: true
-  type: 0
-- display: Username
-  name: credentials
-  required: true
-  type: 9
-- display: Fetch incidents
-  name: isFetch
-  required: false
-  type: 8
-- display: Incident type
-  name: incidentType
-  required: false
-  type: 13
-- display: Alert severities to fetch when fetching incidents
-  name: alert_severity
-  options:
-  - High
-  - Medium
-  - Low
-  required: false
-  type: 16
-- defaultvalue: 24 hours
-  display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
-  name: fetch_time
-  required: false
-  type: 0
-- defaultvalue: '10'
-  display: Alerts to fetch per run; note that increasing this value may result in slow performance if too many results are returned at once
-  name: fetch_limit
-  required: false
-  type: 0
-- defaultvalue: 'false'
-  display: Include the list of files in returned incidents.
-  name: include_files
-  required: false
-  type: 8
-description: Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.
-display: Code42 (Partner Contribution)
-name: Code42
-script:
-  commands:
-  - arguments:
-    - default: false
-      description: JSON query payload using Code42 query syntax.
-      isArray: false
-      name: json
-      required: false
-      secret: false
-    - default: false
-      description: MD5 or SHA256 hash of the file to search for.
-      isArray: false
-      name: hash
-      required: false
-      secret: false
-    - default: false
-      description: Username to search for.
-      isArray: false
-      name: username
-      required: false
-      secret: false
-    - default: false
-      description: Hostname to search for.
-      isArray: false
-      name: hostname
-      required: false
-      secret: false
-    - auto: PREDEFINED
-      default: false
-      description: Exposure types to search for. Values can be "All", "RemovableMedia", "ApplicationRead", "CloudStorage", "IsPublic", "SharedViaLink", "SharedViaDomain", or "OutsideTrustedDomains". When "All" is specified with other types, other types would be ignored and filter rule for all types would be applied.
-      isArray: true
-      name: exposure
-      predefined:
-      - All
-      - RemovableMedia
-      - ApplicationRead
-      - CloudStorage
-      - IsPublic
-      - SharedViaLink
-      - SharedViaDomain
-      - OutsideTrustedDomains
-      required: false
-      secret: false
-    - default: false
-      defaultValue: '100'
-      description: The number of results to return. The default is 100.
-      isArray: false
-      name: results
-      required: false
-      secret: false
-    deprecated: false
-    description: Searches for file events by JSON query, hash, username, device hostname, exfiltration type, or a combination of parameters. At least one argument must be passed in the command. If a JSON argument is passed, it will be used to the exclusion of other parameters, otherwise parameters will be combined with an AND clause.
-    execution: false
-    name: code42-securitydata-search
-    outputs:
-    - contextPath: Code42.SecurityData.EventTimestamp
-      description: Timestamp for the event.
-      type: date
-    - contextPath: Code42.SecurityData.FileCreated
-      description: File creation date.
-      type: date
-    - contextPath: Code42.SecurityData.EndpointID
-      description: Code42 device ID.
-      type: string
-    - contextPath: Code42.SecurityData.DeviceUsername
-      description: The username that the device is associated with in Code42.
-      type: string
-    - contextPath: Code42.SecurityData.EmailFrom
-      description: The sender email address for email exfiltration events.
-      type: string
-    - contextPath: Code42.SecurityData.EmailTo
-      description: The recipient email address for email exfiltration events.
-      type: string
-    - contextPath: Code42.SecurityData.EmailSubject
-      description: The email subject line for email exfiltration events.
-      type: string
-    - contextPath: Code42.SecurityData.EventID
-      description: The Security Data event ID.
-      type: string
-    - contextPath: Code42.SecurityData.EventType
-      description: The type of Security Data event.
-      type: string
-    - contextPath: Code42.SecurityData.FileCategory
-      description: The file type, as determined by Code42 engine.
-      type: string
-    - contextPath: Code42.SecurityData.FileOwner
-      description: The owner of the file.
-      type: string
-    - contextPath: Code42.SecurityData.FileName
-      description: The file name.
-      type: string
-    - contextPath: Code42.SecurityData.FilePath
-      description: The path to file.
-      type: string
-    - contextPath: Code42.SecurityData.FileSize
-      description: The size of the file (in bytes).
-      type: number
-    - contextPath: Code42.SecurityData.FileModified
-      description: The date the file was last modified.
-      type: date
-    - contextPath: Code42.SecurityData.FileMD5
-      description: MD5 hash of the file.
-      type: string
-    - contextPath: Code42.SecurityData.FileHostname
-      description: Hostname where the file event was captured.
-      type: string
-    - contextPath: Code42.SecurityData.DevicePrivateIPAddress
-      description: Private IP addresses of the device where the event was captured.
-      type: string
-    - contextPath: Code42.SecurityData.DevicePublicIPAddress
-      description: Public IP address of the device where the event was captured.
-      type: string
-    - contextPath: Code42.SecurityData.RemovableMediaType
-      description: Type of removable media.
-      type: string
-    - contextPath: Code42.SecurityData.RemovableMediaCapacity
-      description: Total capacity of removable media (in bytes).
-      type: number
-    - contextPath: Code42.SecurityData.RemovableMediaMediaName
-      description: The full name of the removable media.
-      type: string
-    - contextPath: Code42.SecurityData.RemovableMediaName
-      description: The name of the removable media.
-      type: string
-    - contextPath: Code42.SecurityData.RemovableMediaSerialNumber
-      description: The serial number for the removable medial device.
-      type: string
-    - contextPath: Code42.SecurityData.RemovableMediaVendor
-      description: The vendor name for removable device.
-      type: string
-    - contextPath: Code42.SecurityData.FileSHA256
-      description: The SHA256 hash of the file.
-      type: string
-    - contextPath: Code42.SecurityData.FileShared
-      description: Whether the file is shared using a cloud file service.
-      type: boolean
-    - contextPath: Code42.SecurityData.FileSharedWith
-      description: Accounts that the file is shared with on a cloud file service.
-      type: string
-    - contextPath: Code42.SecurityData.Source
-      description: The source of the file event. Can be "Cloud" or "Endpoint".
-      type: string
-    - contextPath: Code42.SecurityData.ApplicationTabURL
-      description: The URL associated with the application read event.
-      type: string
-    - contextPath: Code42.SecurityData.ProcessName
-      description: The process name for the application read event.
-      type: string
-    - contextPath: Code42.SecurityData.ProcessOwner
-      description: The process owner for the application read event.
-      type: string
-    - contextPath: Code42.SecurityData.WindowTitle
-      description: The process name for the application read event.
-      type: string
-    - contextPath: Code42.SecurityData.FileURL
-      description: The URL of the file on a cloud file service.
-      type: string
-    - contextPath: Code42.SecurityData.Exposure
-      description: The event exposure type.
-      type: string
-    - contextPath: Code42.SecurityData.SharingTypeAdded
-      description: The type of sharing added to the file.
-      type: string
-    - contextPath: File.Name
-      description: The file name.
-      type: string
-    - contextPath: File.Path
-      description: The file path.
-      type: string
-    - contextPath: File.Size
-      description: The file size (in bytes).
-      type: number
-    - contextPath: File.MD5
-      description: The MD5 hash of the file.
-      type: string
-    - contextPath: File.SHA256
-      description: The SHA256 hash of the file.
-      type: string
-    - contextPath: File.Hostname
-      description: The hostname where the file event was captured.
-      type: string
-  - arguments:
-    - default: false
-      description: The alert ID to retrieve. Alert IDs are associated with alerts that are fetched via fetch-incidents.
-      isArray: false
-      name: id
-      required: true
-      secret: false
-    deprecated: false
-    description: Retrieve alert details by alert ID
-    execution: false
-    name: code42-alert-get
-    outputs:
-    - contextPath: Code42.SecurityAlert.Username
-      description: The username associated with the alert.
-      type: string
-    - contextPath: Code42.SecurityAlert.Occurred
-      description: The timestamp when the alert occurred.
-      type: date
-    - contextPath: Code42.SecurityAlert.Description
-      description: The description of the alert.
-      type: string
-    - contextPath: Code42.SecurityAlert.ID
-      description: The alert ID.
-      type: string
-    - contextPath: Code42.SecurityAlert.Name
-      description: The alert rule name that generated the alert.
-      type: string
-    - contextPath: Code42.SecurityAlert.State
-      description: The alert state.
-      type: string
-    - contextPath: Code42.SecurityAlert.Type
-      description: The alert type.
-      type: string
-    - contextPath: Code42.SecurityAlert.Severity
-      description: The severity of the alert.
-      type: string
-  - arguments:
-    - default: false
-      description: The alert ID to resolve. Alert IDs are associated with alerts that are fetched via fetch-incidents.
-      isArray: false
-      name: id
-      required: true
-      secret: false
-    deprecated: false
-    description: Resolves a Code42 Security alert.
-    execution: false
-    name: code42-alert-resolve
-    outputs:
-    - contextPath: Code42.SecurityAlert.ID
-      description: The alert ID of the resolved alert.
-      type: string
-  - arguments:
-    - default: false
-      description: The username to add to the Departing Employee List.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    - default: false
-      description: The departure date for the employee, in the format YYYY-MM-DD.
-      isArray: false
-      name: departuredate
-      required: false
-      secret: false
-    - default: false
-      description: Note to attach to the Departing Employee.
-      isArray: false
-      name: note
-      required: false
-      secret: false
-    deprecated: false
-    description: Adds a user to the Departing Employee List.
-    execution: false
-    name: code42-departingemployee-add
-    outputs:
-    - contextPath: Code42.DepartingEmployee.CaseID
-      description: Internal Code42 Case ID for the Departing Employee. Deprecated. Use Code42.DepartingEmployee.UserID.
-      type: string
-    - contextPath: Code42.DepartingEmployee.UserID
-      description: Internal Code42 User ID for the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.Username
-      description: The username of the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.Note
-      description: Note associated with the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.DepartureDate
-      description: The departure date for the Departing Employee.
-      type: Unknown
-  - arguments:
-    - default: false
-      description: The username to remove from the Departing Employee List.
-      isArray: false
-      name: username
-      required: false
-      secret: false
-    deprecated: false
-    description: Removes a user from the Departing Employee List.
-    execution: false
-    name: code42-departingemployee-remove
-    outputs:
-    - contextPath: Code42.DepartingEmployee.CaseID
-      description: Internal Code42 Case ID for the Departing Employee. Deprecated. Use Code42.DepartingEmployee.UserID.
-      type: string
-    - contextPath: Code42.DepartingEmployee.UserID
-      description: Internal Code42 User ID for the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.Username
-      description: The username of the Departing Employee.
-      type: string
-  - arguments:
-    - default: false
-      description: The number of items to return.
-      isArray: false
-      name: results
-      required: false
-      secret: false
-    - auto: PREDEFINED
-      default: true
-      defaultValue: OPEN
-      description: Filters the results based on specific filters.
-      isArray: false
-      name: filtertype
-      predefined:
-      - EXFILTRATION_30_DAYS
-      - EXFILTRATION_24_HOURS
-      - OPEN
-      - LEAVING_TODAY
-      required: false
-      secret: false
-    deprecated: false
-    description: Get all employees on the Departing Employee List.
-    execution: false
-    name: code42-departingemployee-get-all
-    outputs:
-    - contextPath: Code42.DepartingEmployee.UserID
-      description: Internal Code42 User ID for the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.Username
-      description: The username of the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.Note
-      description: Note associated with the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.DepartureDate
-      description: The departure date for the Departing Employee.
-      type: Unknown
-  - arguments:
-    - default: false
-      description: The username to add to the High Risk Employee List.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    - default: false
-      description: Note to attach to the High Risk Employee.
-      isArray: false
-      name: note
-      required: false
-      secret: false
-    deprecated: false
-    description: Adds a user from the High Risk Employee List.
-    execution: false
-    name: code42-highriskemployee-add
-    outputs:
-    - contextPath: Code42.HighRiskEmployee.UserID
-      description: Internal Code42 User ID for the High Risk Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.Username
-      description: The username of the High Risk Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.Note
-      description: Note associated with the High Risk Employee.
-      type: string
-  - arguments:
-    - default: false
-      description: The username to remove from the High Risk Employee List.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    deprecated: false
-    description: Removes a user from the High Risk Employee List.
-    execution: false
-    name: code42-highriskemployee-remove
-    outputs:
-    - contextPath: Code42.HighRiskEmployee.UserID
-      description: Internal Code42 User ID for the High Risk Employee.
-      type: Unknown
-    - contextPath: Code42.HighRiskEmployee.Username
-      description: The username of the High Risk Employee.
-      type: Unknown
-  - arguments:
-    - auto: PREDEFINED
-      default: false
-      description: To filter results by employees who have these risk tags. Comma delimited.
-      isArray: false
-      name: risktags
-      predefined:
-      - PERFORMANCE_CONCERNS
-      - PERFORMANCE_CONCERNS
-      - POOR_SECURITY_PRACTICES
-      - HIGH_IMPACT_EMPLOYEE
-      - ELEVATED_ACCESS_PRIVILEGES
-      - FLIGHT_RISK
-      - CONTRACT_EMPLOYEE
-      required: false
-      secret: false
-    - default: false
-      description: The number of items to return.
-      isArray: false
-      name: results
-      required: false
-      secret: false
-    - auto: PREDEFINED
-      default: true
-      defaultValue: OPEN
-      description: Filters the results based on specific filters.
-      isArray: false
-      name: filtertype
-      predefined:
-      - EXFILTRATION_30_DAYS
-      - EXFILTRATION_24_HOURS
-      - OPEN
-      required: false
-      secret: false
-    deprecated: false
-    description: Get all employees on the High Risk Employee List.
-    execution: false
-    name: code42-highriskemployee-get-all
-    outputs:
-    - contextPath: Code42.HighRiskEmployee.UserID
-      description: Internal Code42 User ID for the High Risk Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.Username
-      description: The username of the High Risk Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.Note
-      description: Note associated with the High Risk Employee.
-      type: string
-  - arguments:
-    - default: false
-      description: The username of the High Risk Employee.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    - auto: PREDEFINED
-      default: false
-      description: Comma-delimited risk tags to associate with the High Risk Employee.
-      isArray: false
-      name: risktags
-      predefined:
-      - PERFORMANCE_CONCERNS
-      - PERFORMANCE_CONCERNS
-      - POOR_SECURITY_PRACTICES
-      - HIGH_IMPACT_EMPLOYEE
-      - ELEVATED_ACCESS_PRIVILEGES
-      - FLIGHT_RISK
-      - CONTRACT_EMPLOYEE
-      required: true
-      secret: false
-    deprecated: false
-    description: Associates risk tags with the employee with the given username.
-    execution: false
-    name: code42-highriskemployee-add-risk-tags
-    outputs:
-    - contextPath: Code42.HighRiskEmployee.UserID
-      description: Internal Code42 User ID for the Departing Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.Username
-      description: The username of the High Risk Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.RiskTags
-      description: Risk tags to associate with the High Risk Employee.
-      type: Unknown
-  - arguments:
-    - default: false
-      description: The username of the High Risk Employee.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    - auto: PREDEFINED
-      default: false
-      description: Comma-delimited risk tags to disassociate from the High Risk Employee.
-      isArray: false
-      name: risktags
-      predefined:
-      - PERFORMANCE_CONCERNS
-      - PERFORMANCE_CONCERNS
-      - POOR_SECURITY_PRACTICES
-      - HIGH_IMPACT_EMPLOYEE
-      - ELEVATED_ACCESS_PRIVILEGES
-      - FLIGHT_RISK
-      - CONTRACT_EMPLOYEE
-      required: true
-      secret: false
-    deprecated: false
-    description: Disassociates risk tags from the user with the given username.
-    execution: false
-    name: code42-highriskemployee-remove-risk-tags
-    outputs:
-    - contextPath: Code42.HighRiskEmployee.UserID
-      description: Internal Code42 User ID for the Departing Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.Username
-      description: The username of the High Risk Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.RiskTags
-      description: Risk tags to disassociate from the High Risk Employee.
-      type: Unknown
-  - arguments:
-    - default: false
-      description: The name of the Code42 organization from which to add the user.
-      isArray: false
-      name: orgname
-      required: true
-      secret: false
-    - default: false
-      description: The username to give to the user.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    - default: false
-      defaultValue: The email to give to the user.
-      description: The email of the user to create.
-      isArray: false
-      name: email
-      required: true
-      secret: false
-    deprecated: false
-    description: Creates a Code42 user.
-    execution: false
-    name: code42-user-create
-    outputs:
-    - contextPath: Code42.User.Username
-      description: A username for a Code42 user.
-      type: String
-    - contextPath: Code42.User.Email
-      description: An email for a Code42 user.
-      type: String
-    - contextPath: Code42.User.UserID
-      description: An ID for a Code42 user.
-      type: String
-  - arguments:
-    - default: false
-      description: The username of the user to block.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    deprecated: false
-    description: Blocks a user in Code42.  A blocked user is not allowed to log in or restore files. Backups will continue if the user is still active.
-    execution: false
-    name: code42-user-block
-    outputs:
-    - contextPath: Code42.User.UserID
-      description: An ID for a Code42 user.
-      type: String
-  - arguments:
-    - default: false
-      description: The username of the user to deactivate.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    deprecated: false
-    description: Deactivate a user in Code42; signing them out of their devices. Backups discontinue for a deactivated user, and their archives go to cold storage.
-    execution: false
-    name: code42-user-deactivate
-    outputs:
-    - contextPath: Code42.User.UserID
-      description: The ID of a Code42 User.
-      type: String
-  - arguments:
-    - default: false
-      description: The username of the user to unblock.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    deprecated: false
-    description: Removes a block, if one exists, on the user with the given user ID. Unblocked users are allowed to log in and restore.
-    execution: false
-    name: code42-user-unblock
-    outputs:
-    - contextPath: Code42.User.UserID
-      description: An ID for a Code42 user.
-      type: String
-  - arguments:
-    - default: false
-      description: The username of the user to reactivate.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    deprecated: false
-    description: Reactivates the user with the given username.
-    execution: false
-    name: code42-user-reactivate
-    outputs:
-    - contextPath: Code42.User.UserID
-      description: The ID of a Code42 User.
-      type: String
-  - arguments:
-    - default: false
-      description: The username of the user to add to the given legal hold matter.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    - default: false
-      description: The name of the legal hold matter to which the user will be added.
-      isArray: false
-      name: mattername
-      required: true
-      secret: false
-    deprecated: false
-    description: Adds a Code42 user to a legal hold matter.
-    execution: false
-    name: code42-legalhold-add-user
-    outputs:
-    - contextPath: Code42.LegalHold.UserID
-      description: The ID of a Code42 user.
-      type: Unknown
-    - contextPath: Code42.LegalHold.MatterID
-      description: The ID of a Code42 legal hold matter.
-      type: String
-    - contextPath: Code42.LegalHold.Username
-      description: A username for a Code42 user.
-      type: String
-    - contextPath: Code42.LegalHold.MatterName
-      description: A name for a Code42 legal hold matter.
-      type: String
-  - arguments:
-    - default: false
-      description: The username of the user to release from the given legal hold matter.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    - default: false
-      description: The name of the legal hold matter from which the user will be released.
-      isArray: false
-      name: mattername
-      required: true
-      secret: false
-    deprecated: false
-    description: Removes a Code42 user from a legal hold matter.
-    execution: false
-    name: code42-legalhold-remove-user
-    outputs:
-    - contextPath: Code42.LegalHold.UserID
-      description: The ID of a Code42 user.
-      type: Unknown
-    - contextPath: Code42.LegalHold.MatterID
-      description: The ID of a Code42 legal hold matter.
-      type: String
-    - contextPath: Code42.LegalHold.Username
-      description: A username for a Code42 user.
-      type: String
-    - contextPath: Code42.LegalHold.MatterName
-      description: A name for a Code42 legal hold matter.
-      type: String
-  - arguments:
-    - default: false
-      description: Either the SHA256 or MD5 hash of the file.
-      isArray: false
-      name: hash
-      required: true
-      secret: false
-    - default: false
-      description: The filename to save the file as.
-      isArray: false
-      name: filename
-      required: false
-      secret: false
-    deprecated: false
-    description: Downloads a file from Code42.
-    execution: false
-    name: code42-download-file
-    outputs:
-    - contextPath: File.Size
-      description: The size of the file.
-      type: Number
-    - contextPath: File.SHA1
-      description: The SHA1 hash of the file.
-      type: String
-    - contextPath: File.SHA256
-      description: The SHA256 hash of the file.
-      type: String
-    - contextPath: File.Name
-      description: The name of the file.
-      type: String
-    - contextPath: File.SSDeep
-      description: The SSDeep hash of the file.
-      type: String
-    - contextPath: File.EntryID
-      description: The entry ID of the file.
-      type: String
-    - contextPath: File.Info
-      description: File information.
-      type: String
-    - contextPath: File.Type
-      description: The file type.
-      type: String
-    - contextPath: File.MD5
-      description: The MD5 hash of the file.
-      type: String
-    - contextPath: File.Extension
-      description: The file extension.
-      type: String
-  - arguments:
-    - default: false
-      description: Email id of the user.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    deprecated: false
-    description: Retrieve high risk employee details.
-    execution: false
-    name: code42-highriskemployee-get
-    outputs:
-    - contextPath: Code42.HighRiskEmployee.UserID
-      description: Internal Code42 User ID for the High Risk Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.Username
-      description: The username of the High Risk Employee.
-      type: string
-    - contextPath: Code42.HighRiskEmployee.Note
-      description: Note associated with the High Risk Employee.
-      type: string
-  - arguments:
-    - default: false
-      description: Email id of the departing employee.
-      isArray: false
-      name: username
-      required: true
-      secret: false
-    deprecated: false
-    description: Retrieve departing employee details.
-    execution: false
-    name: code42-departingemployee-get
-    outputs:
-    - contextPath: Code42.DepartingEmployee.UserID
-      description: Internal Code42 User ID for the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.Username
-      description: The username of the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.Note
-      description: Note associated with the Departing Employee.
-      type: string
-    - contextPath: Code42.DepartingEmployee.DepartureDate
-      description: The departure date for the Departing Employee.
-      type: Unknown
-  dockerimage: demisto/py42:1.0.0.11140
-  feed: false
-  isfetch: true
-  longRunning: false
-  longRunningPort: false
-  runonce: false
-  script: >2
-
-
-
-    """ IMPORTS """
-
-    import json
-
-    import os
-
-    import requests
-
-    import py42.sdk
-
-    import py42.settings
-
-    from datetime import datetime
-
-    from py42.services.detectionlists.departing_employee import DepartingEmployeeFilters
-
-    from py42.services.detectionlists.high_risk_employee import HighRiskEmployeeFilters
-
-    from py42.sdk.queries.fileevents.file_event_query import FileEventQuery
-
-    from py42.sdk.queries.fileevents.filters import (
-        MD5,
-        SHA256,
-        Actor,
-        EventTimestamp,
-        OSHostname,
-        DeviceUsername,
-        ExposureType,
-        EventType,
-        FileCategory,
-    )
-
-    from py42.sdk.queries.alerts.alert_query import AlertQuery
-
-    from py42.sdk.queries.alerts.filters import DateObserved, Severity, AlertState
-
-
-    # Disable insecure warnings
-
-    requests.packages.urllib3.disable_warnings()
-
-
-    """ CONSTANTS """
-
-    CODE42_EVENT_CONTEXT_FIELD_MAPPER = {
-        "eventTimestamp": "EventTimestamp",
-        "createTimestamp": "FileCreated",
-        "deviceUid": "EndpointID",
-        "deviceUserName": "DeviceUsername",
-        "emailFrom": "EmailFrom",
-        "emailRecipients": "EmailTo",
-        "emailSubject": "EmailSubject",
-        "eventId": "EventID",
-        "eventType": "EventType",
-        "fileCategory": "FileCategory",
-        "fileOwner": "FileOwner",
-        "fileName": "FileName",
-        "filePath": "FilePath",
-        "fileSize": "FileSize",
-        "modifyTimestamp": "FileModified",
-        "md5Checksum": "FileMD5",
-        "osHostName": "FileHostname",
-        "privateIpAddresses": "DevicePrivateIPAddress",
-        "publicIpAddresses": "DevicePublicIPAddress",
-        "removableMediaBusType": "RemovableMediaType",
-        "removableMediaCapacity": "RemovableMediaCapacity",
-        "removableMediaMediaName": "RemovableMediaMediaName",
-        "removableMediaName": "RemovableMediaName",
-        "removableMediaSerialNumber": "RemovableMediaSerialNumber",
-        "removableMediaVendor": "RemovableMediaVendor",
-        "sha256Checksum": "FileSHA256",
-        "shared": "FileShared",
-        "sharedWith": "FileSharedWith",
-        "source": "Source",
-        "tabUrl": "ApplicationTabURL",
-        "url": "FileURL",
-        "processName": "ProcessName",
-        "processOwner": "ProcessOwner",
-        "windowTitle": "WindowTitle",
-        "exposure": "Exposure",
-        "sharingTypeAdded": "SharingTypeAdded",
-    }
-
-
-    CODE42_ALERT_CONTEXT_FIELD_MAPPER = {
-        "actor": "Username",
-        "createdAt": "Occurred",
-        "description": "Description",
-        "id": "ID",
-        "name": "Name",
-        "state": "State",
-        "type": "Type",
-        "severity": "Severity",
-    }
-
-
-    FILE_CONTEXT_FIELD_MAPPER = {
-        "fileName": "Name",
-        "filePath": "Path",
-        "fileSize": "Size",
-        "md5Checksum": "MD5",
-        "sha256Checksum": "SHA256",
-        "osHostName": "Hostname",
-    }
-
-
-    SECURITY_EVENT_HEADERS = [
-        "EventType",
-        "FileName",
-        "FileSize",
-        "FileHostname",
-        "FileOwner",
-        "FileCategory",
-        "DeviceUsername",
-    ]
-
-
-    SECURITY_ALERT_HEADERS = ["Type", "Occurred", "Username", "Name", "Description", "State", "ID"]
-
-
-
-    def _get_severity_filter_value(severity_arg):
-        """Converts single str to upper case. If given list of strs, converts all to upper case."""
-        if severity_arg:
-            return (
-                [severity_arg.upper()]
-                if isinstance(severity_arg, str)
-                else list(map(lambda x: x.upper(), severity_arg))
-            )
-
-
-    def _create_alert_query(event_severity_filter, start_time):
-        """Creates an alert query for the given severity (or severities) and start time."""
-        alert_filters = AlertQueryFilters()
-        severity = event_severity_filter
-        alert_filters.append_result(_get_severity_filter_value(severity), Severity.is_in)
-        alert_filters.append(AlertState.eq(AlertState.OPEN))
-        alert_filters.append_result(start_time, DateObserved.on_or_after)
-        alert_query = alert_filters.to_all_query()
-        return alert_query
-
-
-    def _get_all_high_risk_employees_from_page(page, risk_tags):
-        res = []
-        employees = page.get("items") or []
-        for employee in employees:
-            if not risk_tags:
-                res.append(employee)
-                continue
-
-            employee_tags = employee.get("riskFactors")
-            # If the employee risk tags contain all the given risk tags
-            if employee_tags and set(risk_tags) <= set(employee_tags):
-                res.append(employee)
-        return res
-
-
-    class Code42Client(BaseClient):
-        """
-        Client will implement the service API, should not contain Cortex XSOAR logic.
-        Should do requests and return data
-        """
-
-        def __init__(self, sdk, base_url, auth, verify=True, proxy=False):
-            super().__init__(base_url, verify=verify, proxy=proxy)
-            # Allow sdk parameter for unit testing.
-            # Otherwise, lazily load the SDK so that the TEST Command can effectively check auth.
-            self._sdk = sdk
-            self._sdk_factory = (
-                lambda: py42.sdk.from_local_account(base_url, auth[0], auth[1])
-                if not self._sdk
-                else None
-            )
-
-            if not proxy:
-                _clear_env_var_if_exists('HTTP_PROXY')
-                _clear_env_var_if_exists('HTTPS_PROXY')
-                _clear_env_var_if_exists('http_proxy')
-                _clear_env_var_if_exists('https_proxy')
-
-            py42.settings.set_user_agent_suffix("Cortex XSOAR")
-            py42.settings.verify_ssl_certs = verify
-
-        def _get_sdk(self):
-            if self._sdk is None:
-                self._sdk = self._sdk_factory()
-            return self._sdk
-
-        def add_user_to_departing_employee(self, username, departure_date=None, note=None):
-            user_id = self._get_user_id(username)
-            self._get_sdk().detectionlists.departing_employee.add(
-                user_id, departure_date=departure_date
-            )
-            if note:
-                self._get_sdk().detectionlists.update_user_notes(user_id, note)
-            return user_id
-
-        def remove_user_from_departing_employee(self, username):
-            user_id = self._get_user_id(username)
-            self._get_sdk().detectionlists.departing_employee.remove(user_id)
-            return user_id
-
-        def get_all_departing_employees(self, results, filter_type):
-            res = []
-            results = int(results) if results else 50
-            filter_type = filter_type if filter_type else DepartingEmployeeFilters.OPEN
-            pages = self._get_sdk().detectionlists.departing_employee.get_all(filter_type=filter_type)
-            for page in pages:
-                page_json = json.loads(page.text)
-                employees = page_json.get("items") or []
-                for employee in employees:
-                    res.append(employee)
-                    if results and len(res) == results:
-                        return res
-            return res
-
-        def add_user_to_high_risk_employee(self, username, note=None):
-            user_id = self._get_user_id(username)
-            self._get_sdk().detectionlists.high_risk_employee.add(user_id)
-            if note:
-                self._get_sdk().detectionlists.update_user_notes(user_id, note)
-            return user_id
-
-        def remove_user_from_high_risk_employee(self, username):
-            user_id = self._get_user_id(username)
-            self._get_sdk().detectionlists.high_risk_employee.remove(user_id)
-            return user_id
-
-        def add_user_risk_tags(self, username, risk_tags):
-            risk_tags = argToList(risk_tags)
-            user_id = self._get_user_id(username)
-            self._get_sdk().detectionlists.add_user_risk_tags(user_id, risk_tags)
-            return user_id
-
-        def remove_user_risk_tags(self, username, risk_tags):
-            risk_tags = argToList(risk_tags)
-            user_id = self._get_user_id(username)
-            self._get_sdk().detectionlists.remove_user_risk_tags(user_id, risk_tags)
-            return user_id
-
-        def get_all_high_risk_employees(self, risk_tags, results, filter_type):
-            risk_tags = argToList(risk_tags)
-            results = int(results) if results else 50
-            filter_type = filter_type if filter_type else HighRiskEmployeeFilters.OPEN
-            res = []
-            pages = self._get_sdk().detectionlists.high_risk_employee.get_all(filter_type=filter_type)
-            for page in pages:
-                page_json = json.loads(page.text)
-                employees = _get_all_high_risk_employees_from_page(page_json, risk_tags)
-                for employee in employees:
-                    res.append(employee)
-                    if results and len(res) == results:
-                        return res
-            return res
-
-        def fetch_alerts(self, start_time, event_severity_filter):
-            query = _create_alert_query(event_severity_filter, start_time)
-            res = self._get_sdk().alerts.search(query)
-            return json.loads(res.text).get("alerts")
-
-        def get_alert_details(self, alert_id):
-            py42_res = self._get_sdk().alerts.get_details(alert_id)
-            res = json.loads(py42_res.text).get("alerts")
-            if not res:
-                raise Code42AlertNotFoundError(alert_id)
-            return res[0]
-
-        def resolve_alert(self, id):
-            self._get_sdk().alerts.resolve(id)
-            return id
-
-        def get_current_user(self):
-            res = self._get_sdk().users.get_current()
-            return res
-
-        def get_user(self, username):
-            py42_res = self._get_sdk().users.get_by_username(username)
-            res = json.loads(py42_res.text).get("users")
-            if not res:
-                raise Code42UserNotFoundError(username)
-            return res[0]
-
-        def create_user(self, org_name, username, email):
-            org_uid = self._get_org_id(org_name)
-            response = self._get_sdk().users.create_user(org_uid, username, email)
-            return json.loads(response.text)
-
-        def block_user(self, username):
-            user_id = self._get_legacy_user_id(username)
-            self._get_sdk().users.block(user_id)
-            return user_id
-
-        def unblock_user(self, username):
-            user_id = self._get_legacy_user_id(username)
-            self._get_sdk().users.unblock(user_id)
-            return user_id
-
-        def deactivate_user(self, username):
-            user_id = self._get_legacy_user_id(username)
-            self._get_sdk().users.deactivate(user_id)
-            return user_id
-
-        def reactivate_user(self, username):
-            user_id = self._get_legacy_user_id(username)
-            self._get_sdk().users.reactivate(user_id)
-            return user_id
-
-        def get_legal_hold_matter(self, matter_name):
-            matter_pages = self._get_sdk().legalhold.get_all_matters(name=matter_name)
-            for matter_page in matter_pages:
-                matters = matter_page["legalHolds"]
-                for matter in matters:
-                    return matter
-            raise Code42LegalHoldMatterNotFoundError(matter_name)
-
-        def add_user_to_legal_hold_matter(self, username, matter_name):
-            user_uid = self._get_user_id(username)
-            matter_id = self._get_legal_hold_matter_id(matter_name)
-            response = self._get_sdk().legalhold.add_to_matter(user_uid, matter_id)
-            return json.loads(response.text)
-
-        def remove_user_from_legal_hold_matter(self, username, matter_name):
-            user_uid = self._get_user_id(username)
-            matter_id = self._get_legal_hold_matter_id(matter_name)
-            membership_id = self._get_legal_hold_matter_membership_id(user_uid, matter_id)
-            if membership_id:
-                self._get_sdk().legalhold.remove_from_matter(membership_id)
-                return user_uid, matter_id
-
-            raise Code42InvalidLegalHoldMembershipError(username, matter_name)
-
-        def get_org(self, org_name):
-            org_pages = self._get_sdk().orgs.get_all()
-            for org_page in org_pages:
-                page_json = json.loads(org_page.text)
-                orgs = page_json.get("orgs")
-                for org in orgs:
-                    if org.get("orgName", "") == org_name:
-                        return org
-            raise Code42OrgNotFoundError(org_name)
-
-        def search_file_events(self, payload):
-            py42_res = self._get_sdk().securitydata.search_file_events(payload)
-            return json.loads(py42_res.text).get("fileEvents")
-
-        def download_file(self, hash_arg):
-            security_module = self._get_sdk().securitydata
-            if _hash_is_md5(hash_arg):
-                return security_module.stream_file_by_md5(hash_arg)
-            elif _hash_is_sha256(hash_arg):
-                return security_module.stream_file_by_sha256(hash_arg)
-            else:
-                raise Code42UnsupportedHashError()
-
-        def _get_user_id(self, username):
-            user_id = self.get_user(username).get("userUid")
-            if user_id:
-                return user_id
-            raise Code42UserNotFoundError(username)
-
-        def _get_legacy_user_id(self, username):
-            user_id = self.get_user(username).get("userId")
-            if user_id:
-                return user_id
-            raise Code42UserNotFoundError(username)
-
-        def _get_org_id(self, org_name):
-            org_uid = self.get_org(org_name).get("orgUid")
-            if org_uid:
-                return org_uid
-            raise Code42OrgNotFoundError(org_name)
-
-        def get_departing_employee(self, username):
-            user_id = self._get_user_id(username)
-            response = self._get_sdk().detectionlists.departing_employee.get(user_id)
-            return json.loads(response.text)
-
-        def get_high_risk_employee(self, username):
-            user_id = self._get_user_id(username)
-            response = self._get_sdk().detectionlists.high_risk_employee.get(user_id)
-            return json.loads(response.text)
-
-        def _get_legal_hold_matter_id(self, matter_name):
-            matter_id = self.get_legal_hold_matter(matter_name).get("legalHoldUid")
-            return matter_id
-
-        def _get_legal_hold_matter_membership_id(self, user_id, matter_id):
-            member_pages = self._get_sdk().legalhold.get_all_matter_custodians(legal_hold_uid=matter_id,
-                                                                               user_uid=user_id)
-            for member_page in member_pages:
-                members = member_page["legalHoldMemberships"]
-                for member in members:
-                    return member["legalHoldMembershipUid"]
-
-
-    class Code42AlertNotFoundError(Exception):
-        def __init__(self, alert_id):
-            super(Code42AlertNotFoundError, self).__init__(
-                "No alert found with ID {0}.".format(alert_id)
-            )
-
-
-    class Code42UserNotFoundError(Exception):
-        def __init__(self, username):
-            super(Code42UserNotFoundError, self).__init__(
-                "No user found with username {0}.".format(username)
-            )
-
-
-    class Code42OrgNotFoundError(Exception):
-        def __init__(self, org_name):
-            super(Code42OrgNotFoundError, self).__init__(
-                "No organization found with name {0}.".format(org_name)
-            )
-
-
-    class Code42UnsupportedHashError(Exception):
-        def __init__(self):
-            super(Code42UnsupportedHashError, self).__init__(
-                "Unsupported hash. Must be SHA256 or MD5."
-            )
-
-
-    class Code42MissingSearchArgumentsError(Exception):
-        def __init__(self):
-            super(Code42MissingSearchArgumentsError, self).__init__(
-                "No query args provided for searching Code42 security events."
-            )
-
-
-    class Code42LegalHoldMatterNotFoundError(Exception):
-        def __init__(self, matter_name):
-            super(Code42LegalHoldMatterNotFoundError, self).__init__(
-                "No legal hold matter found with name {0}.".format(matter_name)
-            )
-
-
-    class Code42InvalidLegalHoldMembershipError(Exception):
-        def __init__(self, username, matter_name):
-            super(Code42InvalidLegalHoldMembershipError, self).__init__(
-                "User '{0}' is not an active member of legal hold matter '{1}'".format(
-                    username, matter_name
-                )
-            )
-
-
-    class Code42SearchFilters(object):
-        def __init__(self):
-            self._filters = []
-
-        @property
-        def filters(self):
-            return self._filters
-
-        def to_all_query(self):
-            """Override"""
-
-        def append(self, _filter):
-            if _filter:
-                self._filters.append(_filter)
-
-        def extend(self, _filters):
-            if _filters:
-                self._filters.extend(_filters)
-
-        def append_result(self, value, create_filter):
-            """Safely creates and appends the filter to the working list."""
-            if not value:
-                return
-            _filter = create_filter(value)
-            self.append(_filter)
-
-
-    class FileEventQueryFilters(Code42SearchFilters):
-        """Class for simplifying building up a file event search query"""
-
-        def __init__(self, pg_size=None):
-            self._pg_size = pg_size
-            super(FileEventQueryFilters, self).__init__()
-
-        def to_all_query(self):
-            """Convert list of search criteria to *args"""
-            query = FileEventQuery.all(*self._filters)
-            if self._pg_size:
-                query.page_size = self._pg_size
-            return query
-
-
-    class AlertQueryFilters(Code42SearchFilters):
-        """Class for simplifying building up an alert search query"""
-
-        def to_all_query(self):
-            query = AlertQuery.all(*self._filters)
-            query.page_size = 500
-            query.sort_direction = "asc"
-            return query
-
-
-    @logger
-
-    def build_query_payload(args):
-        """Build a query payload combining passed args"""
-
-        pg_size = args.get("results")
-        _hash = args.get("hash")
-        hostname = args.get("hostname")
-        username = args.get("username")
-        exposure = args.get("exposure")
-
-        if not _hash and not hostname and not username and not exposure:
-            raise Code42MissingSearchArgumentsError()
-
-        search_args = FileEventQueryFilters(pg_size)
-        search_args.append_result(_hash, _create_hash_filter)
-        search_args.append_result(hostname, OSHostname.eq)
-        search_args.append_result(username, DeviceUsername.eq)
-        search_args.append_result(exposure, _create_exposure_filter)
-
-        query = search_args.to_all_query()
-        LOG("File Event Query: {}".format(str(query)))
-        return query
-
-
-    def _hash_is_sha256(hash_arg):
-        return hash_arg and len(hash_arg) == 64
-
-
-    def _hash_is_md5(hash_arg):
-        return hash_arg and len(hash_arg) == 32
-
-
-    def _create_hash_filter(hash_arg):
-        if _hash_is_md5(hash_arg):
-            return MD5.eq(hash_arg)
-        elif _hash_is_sha256(hash_arg):
-            return SHA256.eq(hash_arg)
-
-
-    def _create_exposure_filter(exposure_arg):
-        # Because the CLI can't accept lists, convert the args to a list if the type is string.
-        exposure_arg = argToList(exposure_arg)
-        if "All" in exposure_arg:
-            return ExposureType.exists()
-        return ExposureType.is_in(exposure_arg)
-
-
-    def get_file_category_value(key):
-        # Meant to handle all possible cases
-        key = key.lower().replace("-", "").replace("_", "")
-        category_map = {
-            "sourcecode": FileCategory.SOURCE_CODE,
-            "audio": FileCategory.AUDIO,
-            "executable": FileCategory.EXECUTABLE,
-            "document": FileCategory.DOCUMENT,
-            "image": FileCategory.IMAGE,
-            "pdf": FileCategory.PDF,
-            "presentation": FileCategory.PRESENTATION,
-            "script": FileCategory.SCRIPT,
-            "spreadsheet": FileCategory.SPREADSHEET,
-            "video": FileCategory.VIDEO,
-            "virtualdiskimage": FileCategory.VIRTUAL_DISK_IMAGE,
-            "archive": FileCategory.ZIP,
-        }
-        return category_map.get(key, "UNCATEGORIZED")
-
-
-    class ObservationToSecurityQueryMapper(object):
-        """Class to simplify the process of mapping observation data to query objects."""
-
-        # Exfiltration consts
-        _ENDPOINT_TYPE = "FedEndpointExfiltration"
-        _CLOUD_TYPE = "FedCloudSharePermissions"
-
-        # Query consts
-        _PUBLIC_SEARCHABLE = "PublicSearchableShare"
-        _PUBLIC_LINK = "PublicLinkShare"
-        _OUTSIDE_TRUSTED_DOMAINS = "SharedOutsideTrustedDomain"
-
-        exposure_type_map = {
-            "PublicSearchableShare": ExposureType.IS_PUBLIC,
-            "PublicLinkShare": ExposureType.SHARED_VIA_LINK,
-            "SharedOutsideTrustedDomain": ExposureType.OUTSIDE_TRUSTED_DOMAINS,
-        }
-
-        def __init__(self, observation, actor):
-            self._obs = observation
-            self._actor = actor
-
-        @property
-        def _observation_data(self):
-            return self._obs.get("data")
-
-        @property
-        def _exfiltration_type(self):
-            return self._obs.get("type")
-
-        @property
-        def _is_endpoint_exfiltration(self):
-            return self._exfiltration_type == self._ENDPOINT_TYPE
-
-        @property
-        def _is_cloud_exfiltration(self):
-            return self._exfiltration_type == self._CLOUD_TYPE
-
-        def _create_user_filter(self):
-            return (
-                DeviceUsername.eq(self._actor)
-                if self._is_endpoint_exfiltration
-                else Actor.eq(self._actor)
-            )
-
-        def map(self):
-            search_args = self._create_search_args()
-            query = search_args.to_all_query()
-            LOG("Alert Observation Query: {}".format(query))
-            return query
-
-        def _create_search_args(self):
-            filters = FileEventQueryFilters()
-            exposure_types = self._observation_data.get("exposureTypes")
-            first_activity = self._observation_data.get("firstActivityAt")
-            last_activity = self._observation_data.get("lastActivityAt")
-            filters.append(self._create_user_filter())
-            if first_activity:
-                begin_time = _convert_date_arg_to_epoch(first_activity)
-                if begin_time:
-                    filters.append(EventTimestamp.on_or_after(begin_time))
-            if last_activity:
-                end_time = _convert_date_arg_to_epoch(last_activity)
-                if end_time:
-                    filters.append(EventTimestamp.on_or_before(end_time))
-            filters.extend(self._create_exposure_filters(exposure_types))
-            filters.append(self._create_file_category_filters())
-            return filters
-
-        @logger
-        def _create_exposure_filters(self, exposure_types):
-            """Determine exposure types based on alert type"""
-            exp_types = []
-            if self._is_cloud_exfiltration:
-                for t in exposure_types:
-                    exp_type = self.exposure_type_map.get(t)
-                    if exp_type:
-                        exp_types.append(exp_type)
-                    else:
-                        LOG("Received unsupported exposure type {0}.".format(t))
-                if exp_types:
-                    return [ExposureType.is_in(exp_types)]
-                else:
-                    # If not given a support exposure type, search for all unsupported exposure types
-                    supported_exp_types = list(self.exposure_type_map.values())
-                    return [ExposureType.not_in(supported_exp_types)]
-            elif self._is_endpoint_exfiltration:
-                return [
-                    EventType.is_in([EventType.CREATED, EventType.MODIFIED, EventType.READ_BY_APP]),
-                    ExposureType.is_in(exposure_types),
-                ]
-            return []
-
-        def _create_file_category_filters(self):
-            """Determine if file categorization is significant"""
-            observed_file_categories = self._observation_data.get("fileCategories")
-            if observed_file_categories:
-                categories = [
-                    get_file_category_value(c.get("category"))
-                    for c in observed_file_categories
-                    if c.get("isSignificant") and c.get("category")
-                ]
-                if categories:
-                    return FileCategory.is_in(categories)
-
-
-    def map_observation_to_security_query(observation, actor):
-        mapper = ObservationToSecurityQueryMapper(observation, actor)
-        return mapper.map()
-
-
-    def _convert_date_arg_to_epoch(date_arg):
-        date_arg = date_arg[:25]
-        return (
-            datetime.strptime(date_arg, "%Y-%m-%dT%H:%M:%S.%f") - datetime.utcfromtimestamp(0)
-        ).total_seconds()
-
-
-    def _clear_env_var_if_exists(var):
-        if os.environ.get(var):
-            del os.environ[var]
-
-
-    @logger
-
-    def map_to_code42_event_context(obj):
-        code42_context = _map_obj_to_context(obj, CODE42_EVENT_CONTEXT_FIELD_MAPPER)
-        # FileSharedWith is a special case and needs to be converted to a list
-        shared_with_list = code42_context.get("FileSharedWith")
-        if shared_with_list:
-            shared_list = [u.get("cloudUsername") for u in shared_with_list if u.get("cloudUsername")]
-            code42_context["FileSharedWith"] = str(shared_list)
-        return code42_context
-
-
-    @logger
-
-    def map_to_code42_alert_context(obj):
-        return _map_obj_to_context(obj, CODE42_ALERT_CONTEXT_FIELD_MAPPER)
-
-
-    @logger
-
-    def map_to_file_context(obj):
-        return _map_obj_to_context(obj, FILE_CONTEXT_FIELD_MAPPER)
-
-
-    @logger
-
-    def _map_obj_to_context(obj, context_mapper):
-        return {v: obj.get(k) for k, v in context_mapper.items() if obj.get(k)}
-
-
-    def create_command_error_message(cmd, ex):
-        return "Failed to execute command {0} command. Error: {1}".format(cmd, str(ex))
-
-
-    """Commands"""
-
-
-
-    @logger
-
-    def alert_get_command(client, args):
-        code42_securityalert_context = []
-        alert = client.get_alert_details(args.get("id"))
-        if not alert:
-            return CommandResults(
-                readable_output="No results found",
-                outputs={"Results": []},
-                outputs_key_field="ID",
-                outputs_prefix="Code42.SecurityAlert",
-                raw_response={},
-            )
-
-        code42_context = map_to_code42_alert_context(alert)
-        code42_securityalert_context.append(code42_context)
-        readable_outputs = tableToMarkdown(
-            "Code42 Security Alert Results",
-            code42_securityalert_context,
-            headers=SECURITY_ALERT_HEADERS,
-        )
-        return CommandResults(
-            outputs_prefix="Code42.SecurityAlert",
-            outputs_key_field="ID",
-            outputs=code42_securityalert_context,
-            readable_output=readable_outputs,
-            raw_response=alert,
-        )
-
-
-    @logger
-
-    def alert_resolve_command(client, args):
-        code42_securityalert_context = []
-        alert_id = client.resolve_alert(args.get("id"))
-        if not alert_id:
-            return CommandResults(
-                readable_output="No results found",
-                outputs={"Results": []},
-                outputs_key_field="ID",
-                outputs_prefix="Code42.SecurityAlert",
-                raw_response={},
-            )
-
-        # Retrieve new alert details
-        alert_details = client.get_alert_details(alert_id)
-        code42_context = map_to_code42_alert_context(alert_details)
-        code42_securityalert_context.append(code42_context)
-        readable_outputs = tableToMarkdown(
-            "Code42 Security Alert Resolved",
-            code42_securityalert_context,
-            headers=SECURITY_ALERT_HEADERS,
-        )
-        return CommandResults(
-            outputs_prefix="Code42.SecurityAlert",
-            outputs_key_field="ID",
-            outputs=code42_securityalert_context,
-            readable_output=readable_outputs,
-            raw_response=alert_details,
-        )
-
-
-    @logger
-
-    def departingemployee_add_command(client, args):
-        departing_date = args.get("departuredate")
-        username = args.get("username")
-        note = args.get("note")
-        user_id = client.add_user_to_departing_employee(username, departing_date, note)
-        # CaseID included but is deprecated.
-        de_context = {
-            "CaseID": user_id,
-            "UserID": user_id,
-            "Username": username,
-            "DepartureDate": departing_date,
-            "Note": note,
-        }
-        readable_outputs = tableToMarkdown("Code42 Departing Employee List User Added", de_context)
-        return CommandResults(
-            outputs_prefix="Code42.DepartingEmployee",
-            outputs_key_field="UserID",
-            outputs=de_context,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def departingemployee_remove_command(client, args):
-        username = args.get("username")
-        user_id = client.remove_user_from_departing_employee(username)
-        # CaseID included but is deprecated.
-        de_context = {"CaseID": user_id, "UserID": user_id, "Username": username}
-        readable_outputs = tableToMarkdown("Code42 Departing Employee List User Removed", de_context)
-        return CommandResults(
-            outputs_prefix="Code42.DepartingEmployee",
-            outputs_key_field="UserID",
-            outputs=de_context,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def departingemployee_get_all_command(client, args):
-        results = args.get("results", 50)
-        filter_type = args.get("filtertype", DepartingEmployeeFilters.OPEN)
-        employees = client.get_all_departing_employees(results, filter_type)
-        if not employees:
-            return CommandResults(
-                readable_output="No results found",
-                outputs_prefix="Code42.DepartingEmployee",
-                outputs_key_field="UserID",
-                outputs={"Results": []},
-                raw_response={},
-            )
-
-        employees_context = [
-            {
-                "UserID": e.get("userId"),
-                "Username": e.get("userName"),
-                "DepartureDate": e.get("departureDate"),
-                "Note": e.get("notes"),
-            }
-            for e in employees
-        ]
-        readable_outputs = tableToMarkdown("All Departing Employees", employees_context)
-        return CommandResults(
-            outputs_prefix="Code42.DepartingEmployee",
-            outputs_key_field="UserID",
-            outputs=employees_context,
-            readable_output=readable_outputs,
-            raw_response=employees,
-        )
-
-
-    @logger
-
-    def departingemployee_get_command(client, args):
-        username = args.get("username")
-        departing_employee = client.get_departing_employee(username)
-        de_context = {
-            "UserID": departing_employee.get("userId"),
-            "Username": departing_employee.get("userName"),
-            "DepartureDate": departing_employee.get("departureDate"),
-            "Note": departing_employee.get("notes"),
-        }
-        readable_outputs = tableToMarkdown("Retrieve departing employee", de_context)
-        return CommandResults(
-            outputs_prefix="Code42.DepartingEmployee",
-            outputs_key_field="UserID",
-            outputs=de_context,
-            readable_output=readable_outputs,
-            raw_response=username,
-        )
-
-
-    @logger
-
-    def highriskemployee_get_command(client, args):
-        username = args.get("username")
-        high_risk_employee = client.get_high_risk_employee(username)
-        hre_context = {
-            "UserID": high_risk_employee.get("userId"),
-            "Username": high_risk_employee.get("userName"),
-            "Note": high_risk_employee.get("notes")
-        }
-        readable_outputs = tableToMarkdown("Retrieve high risk employee", hre_context)
-        return CommandResults(
-            outputs_prefix="Code42.HighRiskEmployee",
-            outputs_key_field="UserID",
-            outputs=hre_context,
-            readable_output=readable_outputs,
-            raw_response=username,
-        )
-
-
-    @logger
-
-    def highriskemployee_add_command(client, args):
-        username = args.get("username")
-        note = args.get("note")
-        user_id = client.add_user_to_high_risk_employee(username, note)
-        hr_context = {"UserID": user_id, "Username": username}
-        readable_outputs = tableToMarkdown("Code42 High Risk Employee List User Added", hr_context)
-        return CommandResults(
-            outputs_prefix="Code42.HighRiskEmployee",
-            outputs_key_field="UserID",
-            outputs=hr_context,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def highriskemployee_remove_command(client, args):
-        username = args.get("username")
-        user_id = client.remove_user_from_high_risk_employee(username)
-        hr_context = {"UserID": user_id, "Username": username}
-        readable_outputs = tableToMarkdown("Code42 High Risk Employee List User Removed", hr_context)
-        return CommandResults(
-            outputs_prefix="Code42.HighRiskEmployee",
-            outputs_key_field="UserID",
-            outputs=hr_context,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def highriskemployee_get_all_command(client, args):
-        tags = args.get("risktags")
-        results = args.get("results", 50)
-        filter_type = args.get("filtertype", HighRiskEmployeeFilters.OPEN)
-        employees = client.get_all_high_risk_employees(tags, results, filter_type)
-        if not employees:
-            return CommandResults(
-                readable_output="No results found",
-                outputs_prefix="Code42.HighRiskEmployee",
-                outputs_key_field="UserID",
-                outputs={"Results": []},
-                raw_response={},
-            )
-        employees_context = [
-            {"UserID": e.get("userId"), "Username": e.get("userName"), "Note": e.get("notes")}
-            for e in employees
-        ]
-        readable_outputs = tableToMarkdown("Retrieved All High Risk Employees", employees_context)
-        return CommandResults(
-            outputs_prefix="Code42.HighRiskEmployee",
-            outputs_key_field="UserID",
-            outputs=employees_context,
-            readable_output=readable_outputs,
-            raw_response=employees,
-        )
-
-
-    @logger
-
-    def highriskemployee_add_risk_tags_command(client, args):
-        username = args.get("username")
-        tags = args.get("risktags")
-        user_id = client.add_user_risk_tags(username, tags)
-        rt_context = {"UserID": user_id, "Username": username, "RiskTags": tags}
-        readable_outputs = tableToMarkdown("Code42 Risk Tags Added", rt_context)
-        return CommandResults(
-            outputs_prefix="Code42.HighRiskEmployee",
-            outputs_key_field="UserID",
-            outputs=rt_context,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def highriskemployee_remove_risk_tags_command(client, args):
-        username = args.get("username")
-        tags = args.get("risktags")
-        user_id = client.remove_user_risk_tags(username, tags)
-        rt_context = {"UserID": user_id, "Username": username, "RiskTags": tags}
-        readable_outputs = tableToMarkdown("Code42 Risk Tags Removed", rt_context)
-        return CommandResults(
-            outputs_prefix="Code42.HighRiskEmployee",
-            outputs_key_field="UserID",
-            outputs=rt_context,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def securitydata_search_command(client, args):
-        code42_security_data_context = []
-        _json = args.get("json")
-        file_context = []
-
-        # If JSON payload is passed as an argument, ignore all other args and search by JSON payload
-        if _json is not None:
-            file_events = client.search_file_events(_json)
-        else:
-            # Build payload
-            payload = build_query_payload(args)
-            file_events = client.search_file_events(payload)
-        if file_events:
-            for file_event in file_events:
-                code42_context_event = map_to_code42_event_context(file_event)
-                code42_security_data_context.append(code42_context_event)
-                file_context_event = map_to_file_context(file_event)
-                file_context.append(file_context_event)
-            readable_outputs = tableToMarkdown(
-                "Code42 Security Data Results",
-                code42_security_data_context,
-                headers=SECURITY_EVENT_HEADERS,
-            )
-            code42_results = CommandResults(
-                outputs_prefix="Code42.SecurityData",
-                outputs_key_field="EventID",
-                outputs=code42_security_data_context,
-                readable_output=readable_outputs,
-                raw_response=file_events,
-            )
-            file_results = CommandResults(
-                outputs_prefix="File", outputs_key_field=None, outputs=file_context
-            )
-            return code42_results, file_results
-
-        else:
-            return CommandResults(
-                readable_output="No results found",
-                outputs={"Results": []},
-                outputs_key_field="EventID",
-                outputs_prefix="Code42.SecurityData",
-                raw_response={},
-            )
-
-
-    @logger
-
-    def user_create_command(client, args):
-        org_name = args.get("orgname")
-        username = args.get("username")
-        email = args.get("email")
-        res = client.create_user(org_name, username, email)
-        outputs = {
-            "Username": res.get("username"),
-            "UserID": res.get("userUid"),
-            "Email": res.get("email"),
-        }
-        readable_outputs = tableToMarkdown("Code42 User Created", outputs)
-        return CommandResults(
-            outputs_prefix="Code42.User",
-            outputs_key_field="UserID",
-            outputs=outputs,
-            readable_output=readable_outputs,
-            raw_response=res,
-        )
-
-
-    @logger
-
-    def user_block_command(client, args):
-        username = args.get("username")
-        user_id = client.block_user(username)
-        outputs = {"UserID": user_id}
-        readable_outputs = tableToMarkdown("Code42 User Blocked", outputs)
-        return CommandResults(
-            outputs_prefix="Code42.User",
-            outputs_key_field="UserID",
-            outputs=outputs,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def user_unblock_command(client, args):
-        username = args.get("username")
-        user_id = client.unblock_user(username)
-        outputs = {"UserID": user_id}
-        readable_outputs = tableToMarkdown("Code42 User Unblocked", outputs)
-        return CommandResults(
-            outputs_prefix="Code42.User",
-            outputs_key_field="UserID",
-            outputs=outputs,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def user_deactivate_command(client, args):
-        username = args.get("username")
-        user_id = client.deactivate_user(username)
-        outputs = {"UserID": user_id}
-        readable_outputs = tableToMarkdown("Code42 User Deactivated", outputs)
-        return CommandResults(
-            outputs_prefix="Code42.User",
-            outputs_key_field="UserID",
-            outputs=outputs,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def user_reactivate_command(client, args):
-        username = args.get("username")
-        user_id = client.reactivate_user(username)
-        outputs = {"UserID": user_id}
-        readable_outputs = tableToMarkdown("Code42 User Reactivated", outputs)
-        return CommandResults(
-            outputs_prefix="Code42.User",
-            outputs_key_field="UserID",
-            outputs=outputs,
-            readable_output=readable_outputs,
-            raw_response=user_id,
-        )
-
-
-    @logger
-
-    def legal_hold_add_user_command(client, args):
-        username = args.get("username")
-        matter_name = args.get("mattername")
-        response = client.add_user_to_legal_hold_matter(username, matter_name)
-        legal_hold_info = response.get("legalHold")
-        user_info = response.get("user")
-        outputs = {
-            "MatterID": legal_hold_info.get("legalHoldUid") if legal_hold_info else None,
-            "MatterName": legal_hold_info.get("name") if legal_hold_info else None,
-            "UserID": user_info.get("userUid") if legal_hold_info else None,
-            "Username": user_info.get("username") if user_info else None,
-        }
-        readable_outputs = tableToMarkdown("Code42 User Added to Legal Hold Matter", outputs)
-        return CommandResults(
-            outputs_prefix="Code42.LegalHold",
-            outputs_key_field="MatterID",
-            outputs=outputs,
-            readable_output=readable_outputs,
-            raw_response=response
-        )
-
-
-    @logger
-
-    def legal_hold_remove_user_command(client, args):
-        username = args.get("username")
-        matter_name = args.get("mattername")
-        user_uid, matter_id = client.remove_user_from_legal_hold_matter(username, matter_name)
-        outputs = {
-            "MatterID": matter_id,
-            "MatterName": matter_name,
-            "UserID": user_uid,
-            "Username": username
-        }
-        readable_outputs = tableToMarkdown("Code42 User Removed from Legal Hold Matter", outputs)
-        return CommandResults(
-            outputs_prefix="Code42.LegalHold",
-            outputs_key_field="MatterID",
-            outputs=outputs,
-            readable_output=readable_outputs,
-            raw_response=user_uid
-        )
-
-
-    @logger
-
-    def download_file_command(client, args):
-        file_hash = args.get("hash")
-        filename = args.get("filename") or file_hash
-        response = client.download_file(file_hash)
-        file_chunks = [c for c in response.iter_content(chunk_size=128) if c]
-        return fileResult(filename, data=b"".join(file_chunks))
-
-
-    """Fetching"""
-
-
-
-    def _create_incident_from_alert_details(details):
-        return {"name": "Code42 - {}".format(details.get("name")), "occurred": details.get("createdAt")}
-
-
-    def _stringify_lists_if_needed(event):
-        # We need to convert certain fields to a stringified list else React.JS will throw an error
-        shared_with = event.get("sharedWith")
-        private_ip_addresses = event.get("privateIpAddresses")
-        if shared_with:
-            shared_list = [u.get("cloudUsername") for u in shared_with if u.get("cloudUsername")]
-            event["sharedWith"] = str(shared_list)
-        if private_ip_addresses:
-            event["privateIpAddresses"] = str(private_ip_addresses)
-        return event
-
-
-    def _process_event_from_observation(event):
-        return _stringify_lists_if_needed(event)
-
-
-    class Code42SecurityIncidentFetcher(object):
-        def __init__(
-            self,
-            client,
-            last_run,
-            first_fetch_time,
-            event_severity_filter,
-            fetch_limit,
-            include_files,
-            integration_context=None,
-        ):
-            self._client = client
-            self._last_run = last_run
-            self._first_fetch_time = first_fetch_time
-            self._event_severity_filter = event_severity_filter
-            self._fetch_limit = fetch_limit
-            self._include_files = include_files
-            self._integration_context = integration_context
-
-        @logger
-        def fetch(self):
-            remaining_incidents_from_last_run = self._fetch_remaining_incidents_from_last_run()
-            if remaining_incidents_from_last_run:
-                return remaining_incidents_from_last_run
-            start_query_time = self._get_start_query_time()
-            alerts = self._fetch_alerts(start_query_time)
-            incidents = [self._create_incident_from_alert(a) for a in alerts]
-            save_time = datetime.utcnow().timestamp()
-            next_run = {"last_fetch": save_time}
-            return next_run, incidents[: self._fetch_limit], incidents[self._fetch_limit:]
-
-        def _fetch_remaining_incidents_from_last_run(self):
-            if self._integration_context:
-                remaining_incidents = self._integration_context.get("remaining_incidents")
-                # return incidents if exists in context.
-                if remaining_incidents:
-                    return (
-                        self._last_run,
-                        remaining_incidents[:self._fetch_limit],
-                        remaining_incidents[self._fetch_limit:],
-                    )
-
-        def _get_start_query_time(self):
-            start_query_time = self._try_get_last_fetch_time()
-
-            # Handle first time fetch, fetch incidents retroactively
-            if not start_query_time:
-                start_query_time, _ = parse_date_range(
-                    self._first_fetch_time, to_timestamp=True, utc=True
-                )
-                start_query_time /= 1000
-
-            return start_query_time
-
-        def _try_get_last_fetch_time(self):
-            return self._last_run.get("last_fetch")
-
-        def _fetch_alerts(self, start_query_time):
-            return self._client.fetch_alerts(start_query_time, self._event_severity_filter)
-
-        def _create_incident_from_alert(self, alert):
-            details = self._client.get_alert_details(alert.get("id"))
-            incident = _create_incident_from_alert_details(details)
-            if self._include_files:
-                details = self._relate_files_to_alert(details)
-            incident["rawJSON"] = json.dumps(details)
-            return incident
-
-        def _relate_files_to_alert(self, alert_details):
-            observations = alert_details.get("observations")
-            if not observations:
-                alert_details["fileevents"] = []
-                return
-            for obs in observations:
-                file_events = self._get_file_events_from_alert_details(obs, alert_details)
-                alert_details["fileevents"] = [_process_event_from_observation(e) for e in file_events]
-            return alert_details
-
-        def _get_file_events_from_alert_details(self, observation, alert_details):
-            security_data_query = map_observation_to_security_query(observation, alert_details.get("actor"))
-            return self._client.search_file_events(security_data_query)
-
-
-    def fetch_incidents(
-        client,
-        last_run,
-        first_fetch_time,
-        event_severity_filter,
-        fetch_limit,
-        include_files,
-        integration_context=None,
-    ):
-        fetcher = Code42SecurityIncidentFetcher(
-            client,
-            last_run,
-            first_fetch_time,
-            event_severity_filter,
-            fetch_limit,
-            include_files,
-            integration_context,
-        )
-        return fetcher.fetch()
-
-
-    """Main and test"""
-
-
-
-    def test_module(client):
-        try:
-            # Will fail if unauthorized
-            client.get_current_user()
-            return "ok"
-        except Exception:
-            return (
-                "Invalid credentials or host address. Check that the username and password are correct, that the host "
-                "is available and reachable, and that you have supplied the full scheme, domain, and port "
-                "(e.g. https://myhost.code42.com:4285)."
-            )
-
-
-    def get_command_map():
-        return {
-            "code42-alert-get": alert_get_command,
-            "code42-alert-resolve": alert_resolve_command,
-            "code42-securitydata-search": securitydata_search_command,
-            "code42-departingemployee-add": departingemployee_add_command,
-            "code42-departingemployee-remove": departingemployee_remove_command,
-            "code42-departingemployee-get-all": departingemployee_get_all_command,
-            "code42-departingemployee-get": departingemployee_get_command,
-            "code42-highriskemployee-add": highriskemployee_add_command,
-            "code42-highriskemployee-remove": highriskemployee_remove_command,
-            "code42-highriskemployee-get-all": highriskemployee_get_all_command,
-            "code42-highriskemployee-add-risk-tags": highriskemployee_add_risk_tags_command,
-            "code42-highriskemployee-remove-risk-tags": highriskemployee_remove_risk_tags_command,
-            "code42-highriskemployee-get": highriskemployee_get_command,
-            "code42-user-create": user_create_command,
-            "code42-user-block": user_block_command,
-            "code42-user-unblock": user_unblock_command,
-            "code42-user-deactivate": user_deactivate_command,
-            "code42-user-reactivate": user_reactivate_command,
-            "code42-legalhold-add-user": legal_hold_add_user_command,
-            "code42-legalhold-remove-user": legal_hold_remove_user_command,
-            "code42-download-file": download_file_command,
-        }
-
-
-    def handle_test_command(client):
-        # This is the call made when pressing the integration Test button.
-        result = test_module(client)
-        demisto.results(result)
-
-
-    def handle_fetch_command(client):
-        integration_context = demisto.getIntegrationContext()
-        # Set and define the fetch incidents command to run after activated via integration settings.
-        next_run, incidents, remaining_incidents = fetch_incidents(
-            client=client,
-            last_run=demisto.getLastRun(),
-            first_fetch_time=demisto.params().get("fetch_time"),
-            event_severity_filter=demisto.params().get("alert_severity"),
-            fetch_limit=int(demisto.params().get("fetch_limit")),
-            include_files=demisto.params().get("include_files"),
-            integration_context=integration_context,
-        )
-        demisto.setLastRun(next_run)
-        demisto.incidents(incidents)
-        # Store remaining incidents in integration context
-        integration_context["remaining_incidents"] = remaining_incidents
-        demisto.setIntegrationContext(integration_context)
-
-
-    def run_command(command):
-        try:
-            results = command()
-            if not isinstance(results, (tuple, list)):
-                results = [results]
-            for result in results:
-                return_results(result)
-        except Exception as e:
-            return_error(create_command_error_message(demisto.command(), e))
-
-
-    def create_client():
-        username = demisto.params().get("credentials").get("identifier")
-        password = demisto.params().get("credentials").get("password")
-        base_url = demisto.params().get("console_url")
-        verify_certificate = not demisto.params().get("insecure", False)
-        proxy = demisto.params().get("proxy", False)
-        return Code42Client(
-            base_url=base_url,
-            sdk=None,
-            auth=(username, password),
-            verify=verify_certificate,
-            proxy=proxy,
-        )
-
-
-    def main():
-        client = create_client()
-        commands = get_command_map()
-        command_key = demisto.command()
-        LOG("Command being called is {0}.".format(command_key))
-        if command_key == "test-module":
-            handle_test_command(client)
-        elif command_key == "fetch-incidents":
-            handle_fetch_command(client)
-        elif command_key in commands:
-            run_command(lambda: commands[command_key](client, demisto.args()))
-
-
-    if __name__ in ("__main__", "__builtin__", "builtins"):
-        main()
-  subtype: python3
-  type: python
-fromversion: 4.1.0
-image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAHjElEQVR4nO2aeYxV1R3HP/e+h2wyoCxalhkQpFJpUcQ2LijRLsE9ikutUjCh44poWzUqalyitmqiQdM0rfsSlbjVuFsXlChVaaWKSnBBBnDsMAwyFpiZd815871wuNztDTP4B+eT3Hn3nv2e3zm/3+/87uBwOBwOh8PhcDgcDofD4XA4HA6Hw7EteKXjqAMGA9908kz2AVYDY4B6O8ML4GN/ANOKU/AJ6EGrE2IXUZQgsH47E9Omb7fn6fdef19Wen3YM2igtCnV0dn4XTyjga4tUhb7g3i6MIYhwVon3C6mqwW8BaEo7/b3pZEe9Kbl+3rvHYbidn3RAD7wB/Fs4YdUB020bbl7+wIHAbsBG4CFwOIKWt8f2AsoAMuA+cD6jDo1wE5Am549XQ1AY44+ewDDgNJWmmoz3YAmYFVGWz3VVpvaMu+xUe+S1LbZoPsBo3T/KfC2xlOmUgG3qrNuFdazbO941tCT3fmGtnYFYgZ3E3CMVSzkE2Am8HxK05cBFwD9I+lmcu4GLgbWxNQzE/gmMCSh3c+AF4AbgM8TyvwUeC1lbCHPAEdmlLkROC+SZhZFNWyl6nYBrgJO173NWuDPwLVUoKL/BkzQ7hoEjANuzVm3nQAW+bvxTGE0NUFjKNxTgCXAsRKuWb11lkc/GngOuDqmxSpgkV4kFG6DtVPMzvwdsBzYp6KxtjMCqJWgoxPf2RxUQR8n63QyM0a44bxcA7xIDgF/K8HOAN5Vw2Y3vA/Mkkr8X9aIwm35lD+GRnqFx6JfAg9ZxWYDuwJDNcjJUk9h3mmRZs3uGqv7f2gxDAB+oIU4R3m9tcsGpwxxLrCzjnSmnfGapGbl3wZcmPGaf5CaHRu5jAo9K6PuLRn5NuNi0pq0c21+DlyUJeBfSbBJfAxMSrERm2jxfBb4wxgYNIee8+1W9gHaifYgn5NdNbv0PuCfVt5FwM90f7PU+xIrv147Yrqeq1QuidUS5kdqx9j/K4CR0ihhP3untLFMNv+DyPWetVDj+L1UPaq3KGMqLzWWTvePaTH1kw9zQaTsMWkCNmr5jYzOwkHdmJDnl68Alnr9qaOKncv+EyfJ9houB95KqF+vFTsVWGGlT9XvJ9o5SRgb/KTyjGobnlAu6az2FTDNep6R0ldHqA5tpZgtJymL2TJrJ2j+Q+ZE5mlAmpP1YAUD/gvQXd5vGJYy6mpdaE+Xe1Ws83aiT1AW8C9UpmStxiSi2mGstZOeyDG2RywbPzHFYUriJe3C8aqfRLXeeWQk33jaX2qxRLle+UhjPQ6cmWNMyxK0woSIKVqVJOBWqd+8fJFkozz9ubMwgSIlCgRGYuFOWqyXr4Q9rLIf5qj3X+s+aQfnaWO8hNgj4fh1k644jIa7JJJ+NHCq9TxLvz07OEbjfzwcSZubpqIz7WoltFDA29xk2G9HgtAF6z5PffuIUUgpl0bYj99JwSE/4hPUWhuqI/P+Y9WvttJeNio7aQcX5U2uzNnBUA1yozUZZqU3B3C7F9A8ve0dZhWPKjtYHkF4lBku56Cpgpeps+7z7EhbZeZ9nyh76rleJ4s4ZsnbHhXJ6x4T5LjCahPVuUyevD3eKpkwc+S5M6HfM4C/R9IW6BSSGuj4dc5DPBLu5THprfKAm4cGa8uhSRO9KhLMl3rqK/uYZYdtFsqRGCwv/7qM8pOt+39V0E/IOMv2vpNSboV235KUMiHRc/kfE8r1UqxgYIKAH5ScbO4Azgmf09RNreW+pzFa0aI4SuXLg5pgDQOCZr5tD4I9IgcMeZFVCfV9BVROsdJa5IygiZ+aUNdgjlln636enKVKucMq/0AH6ncFP5KTFRXuGZZwy2HXLHvyfMbZz8RyX8kTuuwbrGefYCVfe73NuelrqSkUf/1PzKo2bT6qiM1D1pkWhelW6/4e4PyYLs3OfcV6np01Rgtfnr6xawcq+S55uklU8lnsbcUXnrSux7XwG6xyG7QoX7XSJupoNCzSpqk3RWOuU0zhffPBf22Ob8HGtvxVR4ySjPlvFXBIc1w2quxX5iP/y4WRzCgez/CgMXS45tjqRBGyfysceqjlUb6mgIrNgYolh6zSuX2DgiC2LazV+G0K8v6HKMhRr7RA/dverIl0nRjzfodYZqxBvkR0sQ/TIpwWUz+O1y2TEBeL/g1wf862mvJ+bJipa70E3Ctnvc14cHjbUg7xP+NNv6Ys5BLeuVrNtyka8xNdNn9KMAHzdWS6X8LeXSvY5nOp8HkZo+ut2HMUcwy7UgJOeKtN9I/54BEyKM8UxbS5zeTdwR1l0w5G/6rzUmEUtcXjqA7WtIe42jEq8QjgYE3SBqmauTk9X3NMOEq7paD+zDEhzUn0FOI08e//W+lFecrv5QiKDNRXoo32J7oIVQqBvp5zDg/Xwm1R3P+pSNs1Mh/NGUcq472v274Cpn1I07tNYZ5fw4j2XdxFXTvY3v/RES6300sLy+Ju3b7d75B09Qx7W9kUDw5rW8qk0qfUeVV2dMvRBRTl+fVJ+K+HbaGf2tzCNgWS+LS2d1ngDy2HMIuJ5svhcDgcDofD4XA4HA6Hw+FwOBwOh8Px/QF8B+pZzTnuPtCMAAAAAElFTkSuQmCC
-detaileddescription: >
-  ### Partner Contributed Integration
-
-  #### Integration Author: Code42
-
-  Support and maintenance for this integration are provided by the author. Please use the following contact details:
-
-  - **URL**: [https://support.code42.com/Administrator/Cloud/Monitoring_and_managing](https://support.code42.com/Administrator/Cloud/Monitoring_and_managing)
-
-  ***
-
-  ## Code42
-
-
-  Code42 provides simple, fast detection and response to everyday data loss from insider threats by focusing on customer data on endpoints and the cloud.
-
-
-  To configure this integration, you will need to create a local (non-SSO) user within the Code42 application with one of the following sets of roles:
-
-
-  * Customer Cloud Admin
-
-  * Security Center User + (Org Security Viewer or Cross Org Security Viewer)
-
-
-  After this user is set up, use the username and password to configure the Code42 integration.

From 53d3e75f1be36aceb4df9056b31e3071e75316c4 Mon Sep 17 00:00:00 2001
From: Juliya Smith <juliya.smith@code42.com>
Date: Tue, 6 Oct 2020 14:37:19 +0000
Subject: [PATCH 3/3] Update release data

---
 Packs/Code42/ReleaseNotes/2_0_5.md | 4 ++++
 Packs/Code42/pack_metadata.json    | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)
 create mode 100644 Packs/Code42/ReleaseNotes/2_0_5.md

diff --git a/Packs/Code42/ReleaseNotes/2_0_5.md b/Packs/Code42/ReleaseNotes/2_0_5.md
new file mode 100644
index 000000000000..d69522ebf539
--- /dev/null
+++ b/Packs/Code42/ReleaseNotes/2_0_5.md
@@ -0,0 +1,4 @@
+
+#### Integrations
+##### Code42
+- Use latest Docker tag
diff --git a/Packs/Code42/pack_metadata.json b/Packs/Code42/pack_metadata.json
index 2be3799f53c8..d4699d014a3b 100644
--- a/Packs/Code42/pack_metadata.json
+++ b/Packs/Code42/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Code42",
     "description": "Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.",
     "support": "partner",
-    "currentVersion": "2.0.4",
+    "currentVersion": "2.0.5",
     "author": "Code42",
     "url": "https://support.code42.com/Administrator/Cloud/Monitoring_and_managing",
     "email": "",